XMP.434: reconcile current main & complete warning locales

Preserve Target-aware sidecar operations, add French/Ukrainian warnings, and ensure omitted diagnostic fields decode in the native UI.

Generated with Codex.

docs/ai-masks.md

@@ -42,6 +42,42 @@ The result is stored with the mask: the model's 288 × 288 mask logits over the
 need the model, so masks survive moving the library to a machine without it, and the web build
 renders them. Editing the photo's look later does not recompute a mask (click again to update).
 
+## Remote Metal inference
+
+Native builds with `sam` can keep the editor, RAW files, library, and exports local while
+a Mac runs SAM 3. Build both ends from the same revision. On the Mac, install the model
+as described below, then run:
+
+```sh
+cargo build --release --locked -p lightcraft-segment --bin lightcraft-sam3-worker
+target/release/lightcraft-sam3-worker "$HOME/Library/Application Support/LightCraft/models/sam3" 127.0.0.1:8793
+```
+
+On the editing computer, start an SSH tunnel in one terminal and LightCraft in another:
+
+```sh
+ssh -N -T -o ExitOnForwardFailure=yes -L 127.0.0.1:8793:127.0.0.1:8793 user@your-mac
+LIGHTCRAFT_SAM3_REMOTE=127.0.0.1:8793 lightcraft
+```
+
+Object clicks, Describe prompts, and detail refinement use the remote worker. Only the
+rendered model input (long edge at most 1008 pixels) and prompts cross the tunnel. The
+worker caches the current photo; detail crops do not replace that cache. Returned masks
+stay in the local library, so later adjustments and exports work without the connection.
+
+The worker requires Metal and accepts one editing connection at a time. It loads weights
+on demand and releases them when the client disconnects or remains idle for ten minutes.
+Both endpoints require loopback addresses: SSH provides authentication and encryption.
+The listener has no independent authentication; do not expose it through a public proxy. Any
+process of any user on the worker Mac can connect to it, and on the editing computer a local
+process listening on the port while the tunnel is down receives the rendered model input, so use
+this only on machines whose local users you trust.
+
+No local weights are required in remote mode. An unavailable worker produces an explicit
+error, not a silent CPU fallback. Restore the tunnel and retry. Unset
+`LIGHTCRAFT_SAM3_REMOTE` to use the local model again. This offloads segmentation only,
+not RAW development, denoising, or upscaling. The model licence below still applies.
+
 ## Getting the model
 
 ### In the app (recommended)
@@ -150,10 +186,12 @@ Therefore:
 | `mask.objectPoint` | `{x, y, exclude?: bool, id?}` | one click on the selected mask's Object selection (≤ 64 clicks) |
 | `mask.refineDetail` | `{id?, component?}` | the zoomed-in detail pass → `{started}` |
 | `segment.prepare` | `{}` | load the model and analyze the active photo → `{busy}` |
-| `segment.model.status` | `{}` | `{available, installed, dir, loaded, busy, analyzing, sizeBytes, license, licenseUrl, mirrors, download}` |
+| `segment.model.status` | `{}` | `{available, installed, remote, dir, loaded, busy, analyzing, sizeBytes, license, licenseUrl, mirrors, download}` |
 | `segment.model.download` | `{acknowledged: true}` | start the download in the background → `{started}` |
 | `segment.model.cancel` | `{}` | stop it (it resumes next time) → `{cancelled}` |
 
+`remote` reports the configured endpoint, not its health. `installed` describes local weights only.
+
 Coordinates are normalized to the uncropped, oriented photo, like every mask shape. `seg` passes
 a stored segmentation (as `mask.list` / the develop settings hold it): the mask is made without
 the model. Without the model, the AI kinds fail with an error starting "The SAM 3 model is not

docs/architecture.md

@@ -0,0 +1,70 @@
+# Architecture
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created from the code; the full design notes stay in the local `plan/architecture.md`) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+How LightCraft is built today. The longer design document (`plan/architecture.md`) is local-only
+(`plan/` is gitignored); this page is the committed, current summary. Sizes are Rust lines counted
+on 2026-10-10 (≈ 202,000 tracked lines in 505 files: 24 library crates, 3 apps and `xtask`).
+
+## Layers
+
+`cargo xtask layers` (part of `cargo xtask ci`, `xtask/src/layers.rs`) enforces that nothing below
+L5 depends on egui, eframe, winit or rfd, and that each crate only uses lower layers.
+
+| Layer | Crates (lines) | Role |
+|---|---|---|
+| L0 | `geom` (1.4k), `color` (0.9k), `raster` (0.8k), `tiff` (2.0k), `fetch` (1.4k), `sysmem` (0.1k) | Matrices and warps, colour spaces and transfer functions, float image buffers, TIFF/IFD read and write, pinned HTTPS model downloads, the one `unsafe` FFI call (`malloc_zone_pressure_relief`) |
+| L1 | `raw` (22.3k), `codecs` (7.3k), `meta` (4.3k), `develop` (2.5k), `denoise-core` (2.2k), `denoise` (2.7k), `faces` (5.3k), `scenes` (1.0k), `heif` (2.1k, optional) | Raw decoders and demosaic, DNG colour model; standard codecs and encoders; EXIF/XMP/IPTC; the non-destructive edit model and control specs; AI denoise; face detection and recognition; procedural demo photos; HEIC |
+| L2 | `pipeline` (9.8k) | The develop pipeline: scene-referred float, resolution independent; the CPU reference (oracle) for everything else |
+| L3 | `catalog` (11.0k), `gpu` (5.1k), `preview` (1.3k), `merge` (3.8k), `segment` (2.3k) | Library model and persistence; wgpu compute twin of the pipeline; thumbnail/preview cache and job pool; HDR and panorama merge; SAM 3 segmentation |
+| L4 | `engine` (53.2k) | Session, command registry (everything is a command), history, render and export jobs, import, Lightroom catalog and preset import, faces index, view-models |
+| L5 | `ui-egui` (46.9k), `mcp` (2.3k) | The Lightroom-style egui interface (swappable); the MCP server |
+| L6 | `apps/lightcraft` (2.8k), `apps/lightcraft-cli` (1.5k), `apps/lightcraft-web` (3.4k), `xtask` (2.7k) | Desktop app (eframe + wgpu, native menus, control server), CLI (render, commands, calibrate, snapshot, MCP), WASM build, tooling |
+
+## Data model
+
+- **Photo** records in `catalog` hold the original's path, content hash, metadata, ratings, flags,
+  labels, keywords, faces and the current `develop::Settings`. Albums, smart albums (rule trees),
+  stacks, virtual copies, versions and folder records live alongside.
+- **Persistence** (`crates/catalog/src/journal.rs`): an append-only journal of human-readable
+  operations plus periodic snapshots, compacted in the background; torn appends and crashes are
+  tested (`tests_torn_append.rs`, `tests_journal.rs`). A lock file guards against two writers.
+- **Edits** are a `develop::Settings` value (every slider is a control spec with id, range and
+  default), normalized to image coordinates so previews and exports match. Process versions
+  (`docs/process-versions.md`) keep old edits rendering the same after a retune.
+- **Sidecars**: XMP read and write with Adobe `crs:` interop (`docs/xmp-interop.md`); Lightroom
+  Classic `.lrcat` import through a pure-Rust SQLite reader (`docs/lightroom-catalog-import.md`).
+
+## Rendering
+
+1. **Decode** (`raw`, `codecs`): raw files to linear camera RGB (demosaic, black/white levels,
+   opcodes, highlight handling) and a camera-to-XYZ colour model; standard images to linear light
+   through their ICC profile.
+2. **Develop** (`pipeline`): white balance, profile, exposure and tone (local Laplacian
+   highlights/shadows), curves, HSL / colour mixer, point colour, colour grading, texture, clarity,
+   dehaze, detail (sharpening, NR, AI denoise result), optics (lens profile, CA, defringe,
+   vignette), geometry (crop, Upright, transforms), masks with local adjustments, heal/clone, grain,
+   effects. Stage caching and a source pyramid make slider drags cheap.
+3. **GPU** (`gpu`): the same stages in WGSL on Metal / DX12 / Vulkan, checked against the CPU path
+   (within 1/255); GPU errors fall back to the CPU (`docs/gpu-pipeline.md`).
+4. **Display and export**: display-profile conversion (`docs/display-profiles.md`); export through
+   one encoder for app, CLI, MCP and web (`lightcraft_engine::export`).
+
+## Agent control
+
+Every action is an engine command (id, label, menu path, shortcut, params, enabled, run). The UI,
+the CLI, the JSON-lines control channel (`docs/control-protocol.md`) and MCP (`docs/mcp.md`) all
+dispatch by id, and headless snapshots render the UI without a window.
+
+## Quality gates
+
+`cargo xtask ci`: fmt, clippy `-D warnings` with the never-crash lints, the HEIF build, tests,
+`parity` (every id and path cited in [parity-checklist.md](parity-checklist.md) exists), `layers`,
+`assets` (every asset attributed, no Adobe formats) and the WASM build. Other workflows build and
+test FreeBSD and Windows ARM64, lint packaging, and build releases.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the code (crate sizes, layers, data model, rendering, control, gates) |

docs/background-tasks.md

@@ -0,0 +1,65 @@
+# Long-running tasks and the activity stack
+
+Everything that takes a while runs off the UI thread and shows up in **one** place: the activity stack in the
+top-left corner under the top bar (issue #345). Each task has a row with its name, a progress bar (a sweep while
+the amount of work isn't known), the count and what it's working on, and ✕ if it can stop. Quitting asks first while
+a task that can stop is running. Agents see the same list through `activity.list` / `activity.cancel`, and
+`ui.inspect` reports it as `activity`.
+
+The registry is `lightcraft_engine::activity` (`crates/engine/src/activity.rs`, `Session::activity`). The stack is
+`crates/ui-egui/src/panels/activity.rs`. Every job that can last more than a moment uses it; **don't add a progress
+window, panel or progress toast of your own**. A dialog may still show progress inline (the Synchronize Folder
+dialog counts files while it scans), and a toast at the end saying what happened is fine.
+
+## Adding a task
+
+```rust
+use lightcraft_engine::activity::{Cancel, Unit};
+
+// when the job starts, with the cancel flag the worker already checks between files
+let guard = app.session.activity.start("export", "Exporting", Cancel::Flag(cancel.clone()));
+guard.progress(0, total as u64);
+
+// every frame (or from the worker, through `guard.handle()`)
+guard.progress(done as u64, total as u64);
+guard.detail(&file_name);
+```
+
+- **Keep the guard for exactly as long as the job runs.** Put it in the struct the UI polls (`ExportTask`, `ScanTask`,
+  `SyncRun`…), or move it into the worker thread. Dropping it removes the row, also when the worker panics, so a
+  dead job never leaves a stuck bar. A worker that only reports progress takes a `TaskHandle` (`guard.handle()`,
+  `Clone + Send`).
+- **`kind`** is a stable camelCase id that agents filter by (`export`, `import`, `scan`, `sync`, `previews`,
+  `download`, `faces`…). **`label`** is a short English name in sentence case ("Building previews"). The stack shows it
+  translated, so add it to every catalog in `crates/ui-egui/locales/`.
+- **Progress:** `progress(done, total)`. A `total` of 0 means the amount of work isn't known yet, and the bar sweeps.
+  `set_unit(Unit::Bytes)` makes the count read "12 of 340 MB"; `Unit::Percent` reads "40 %". The default `Unit::Count`
+  reads "3 of 25".
+- **Detail:** what the job is on (a file name, a model's name). Detail set by engine code is a name, never a sentence.
+  UI code may set translated text.
+- **Cancel:**
+  - `Cancel::Flag(Arc<AtomicBool>)` adopts the flag the job already checks. The row's ✕, `activity.cancel` and the
+    job's own Cancel then all set the same atomic.
+  - `Cancel::Yes`: the job polls `guard.is_cancelled()` itself.
+  - `Cancel::No`: the job can't stop; it gets no ✕ and doesn't make Quit ask.
+  - `set_cancellable(false)` for a phase that has to finish once started (a Lightroom import adding its photos).
+- **Quiet periodic work** shows no row: the auto-import folder listing runs every few seconds through
+  `tasks::spawn(.., None, ..)`.
+
+## Examples in the code
+
+| Job | Where | Shows how to |
+|---|---|---|
+| Export, contact sheet | `crates/ui-egui/src/export_task.rs` | adopt the job's flag; update the row each frame |
+| Build Previews | `crates/engine/src/cmd/previews.rs` | move the guard into the worker thread |
+| Model downloads | `crates/engine/src/face_download.rs` | report progress through a `TaskHandle` in shared state |
+| Lightroom catalog import | `crates/ui-egui/src/lightroom_import.rs` | stop being cancellable for a phase that must finish |
+| Face scan, AI Denoise | `crates/engine/src/cmd/face_recognize.rs`, `crates/engine/src/denoise.rs` | a continuous job with no ✕, kept in session state |
+| Find Missing Photos | `crates/ui-egui/src/tasks.rs` | a generic background task with a row (`kind: Some(..)`) |
+
+## Testing
+
+Assert the row (`session.activity.list()`: kind, label, total, `cancellable`), that `activity.cancel(id)` stops the
+job, and that the row is gone once the job ends. `crates/ui-egui/src/tests_activity.rs` has the helpers, and the
+job-specific tests show the pattern (`tests_sync.rs`, `export_task.rs`, `tests_denoise.rs`…). A row only appears
+on screen once its task is 0.5 s old, so tests that click its ✕ wait for `activity:cancel:<id>` first.

docs/camera-preview-colour.md

@@ -1,6 +1,6 @@
-# Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2 and Pentax PEF starting look
+# Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2, Pentax PEF, Samsung SRW and Olympus ORF starting look
 
-ARW, NEF, RW2, RAF, CR3, CR2 and PEF decoding supply sensor data and camera white-balance multipliers, but currently no measured camera colour matrix. Treating camera RGB as linear sRGB produces a dark, muted default rendering. The loader now estimates a file-local starting look from that file's embedded camera JPEG, only when a usable camera matrix is absent. All output pixels still come from the RAW sensor data; there is no JPEG replacement or uniform saturation boost.
+ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW and ORF decoding supply sensor data and camera white-balance multipliers, but currently no measured camera colour matrix. Treating camera RGB as linear sRGB produces a dark, muted default rendering. The loader now estimates a file-local starting look from that file's embedded camera JPEG, only when a usable camera matrix is absent. All output pixels still come from the RAW sensor data; there is no JPEG replacement or uniform saturation boost.
 
 ## Colour and tone are separate
 
@@ -10,11 +10,15 @@ Two thirds of the usable pixels train a ridge-regularised 3×3 **chromaticity**
 
 The JPEG's colourfulness also depends on brightness, as a camera's per-channel tone curve makes it: relative to a luminance-only curve, shadows were up to 1.4× more colourful and highlights above 0.85 luminance bleached to 0.1–0.3×, so warm sunlit rock rendered cream instead of white (+4 b* in the brightest fifth of the picture). A **chroma curve** (8 nodes over display luminance, `CameraTone::chroma`) is fitted to that ratio, including the bright pixels the colour and tone fits leave out, and applied in the finish stage right after the tone map (CPU and GPU), scaling chroma toward luminance so luminance is kept. It is kept only when it lowers the held-out error; smart previews carry it in their header, and older headers load without one.
 
-Matrix-only and matrix + table looks are each completed (tone curve, then chroma curve) and compared on the held-out pixels in gamma-encoded display values: in linear values a slightly missed bright rock outweighed a clearly wrong dark shirt. The acceptance gates below still use linear values. Luminance is fitted separately: 32 equal-population bins with robust median knots and pooled-adjacent-violators isotonic regression. The curve preserves black, cannot reverse, and extends beyond observed highlights with a bounded shoulder.
+Matrix-only and matrix + table looks are each completed (tone curve, then chroma curve) and compared on the held-out pixels in gamma-encoded display values: in linear values a slightly missed bright rock outweighed a clearly wrong dark shirt. The acceptance gates below still use linear values. Luminance is fitted separately, by quantile matching: knot *i* pairs the median of the *i*-th 1/32 of the sorted scene luminances with the median of the *i*-th 1/32 of the sorted JPEG luminances. A tone curve is monotone, so it maps each scene quantile to the same JPEG quantile; this needs no pixel-exact registration and is increasing by construction. The earlier fit (the JPEG's median per scene-luminance bin, then pooled-adjacent-violators isotonic regression) broke on lens-corrected, sharpened JPEGs of busy scenes: neighbouring bins disagreed by more than the gap between them, pooling turned them into flat steps (13 of 31 segments on a CC0 Z 6II forest shot) that rendered as posterised patches with hard edges, and regression toward the mean flattened both ends of the curve (issue #475, also #211, #454). On the 1,781 files of the CC0 archive that render, 384 of the 1,023 accepted fits had at least one flat segment (1,073 in total, up to 14 of 31); with quantile matching 1,017 of the 1,023 have none. The quantile fit is slightly worse by least squares than the conditional medians (median held-out RMS 0.0331 against 0.0330, worst +0.013), and on 7 files (compacts, bridge cameras, early Micro Four Thirds) the look cleared the acceptance gates only with the old curve. The search therefore runs once with the quantile fit (all pixels, away from edges, with and without the camera profile's colour) and, only when no look passes, once more with the earlier conditional-median fit, kept as `fit_tone_conditional`; the gates are the same, so no file loses its look. Those 7 files render exactly as before, and 6 of them still have flat segments (35 in total). The curve preserves black, cannot reverse, and extends beyond observed highlights with a bounded shoulder.
+
+**Clipped sensor pixels are left out of the fit.** A raw pixel with a channel at the clip level (0.99 of white, as in highlight reconstruction) no longer records the scene's colour: a white overcast sky with the green channel clipped and red and blue still rising comes out magenta or blue through the camera matrix, while the camera JPEG shows it white. As training pairs such pixels pulled the colour matrix toward grey and made the chroma curve remove colour at their display luminance. On the CC0 Z 6II forest sample (raw.pixls.us 4160) 24% of the proxy pixels are clipped; every chroma sample above display luminance 0.36 was one of them, and the curve cut colourfulness there to 13-19% (`[1.10, 0.94, 0.69, 0.19, 0.13, 0.19, 0.89, 1.0]`); the colours of the forest were muted by the matrix as well (spread of a\*/b\* on the proxy 63% of the JPEG's before the curve, 48% after). Over the 940 accepted looks with a chroma curve, 37% of the curve's downward pull came from clipped pixels whose JPEG pixel is near neutral, 53% in the 245 curves with a node below 0.4. The proxies therefore carry a clip mask (any sensor sample a proxy pixel covers, aligned with the CR3 framing), and the look is refitted without those pixels. The search on all pixels still decides whether a photo gets a look and which attempt (tone fit, profile or own colour, all pixels or away from edges) gives it; only that attempt is refitted, and when the refit misses the gates the look on all pixels is kept, so no photo loses its look or switches attempt. A photo without a look gets one when the search without the clipped pixels finds it. Camera-profile pairs (`calibrate`) leave clipped pixels out too. On the 1,781 files of the CC0 archive that render: 1,023 looks before, 1,027 after (none lost, 4 gained); 618 renders change (all with a look), 8 keep their earlier look through the fallback; median CIEDE2000 to the camera JPEG over the changed files 3.24 -> 3.07 (worse by more than 0.5 on 3, better by more than 0.5 on 59); median colourfulness (mean C\* of the render over the camera JPEG's) 0.973 -> 0.982 over the files with a look. The rest of the chroma curve's pull is mostly misregistration (a near-neutral JPEG pixel with a matching colour within one proxy pixel: 21%); a registration-free estimate of the curve (band means of colourfulness by each image's own luminance) brought the median colourfulness ratio to 0.999 but did not lower CIEDE2000, and is not used.
 
 The matrix is applied to scene-linear sensor pixels. The curve is carried in `SourceInfo` and applied in the pipeline finish stage, after exposure/WB/local edits. It is never baked into decoded luminance or clipped to JPEG precision. CPU and GPU use the same tone LUT. Contrast, whites and blacks adjust the starting look through the display-domain controls. JPEG neutral rendering and the existing DNG colour model are unchanged.
 
-One third of the pixels are held out from both fits. The combined model must reduce linear-display squared error by at least 30% and have per-channel RMS error ≤0.10 (0.055 rejected half of the public raw.pixls.us samples tried — ILCE-6400, -6700, -7M4 — whose fits were still 1.5–3× closer to the camera JPEG than the fallback and visibly better). When the fit on all pixels fails these gates, it is tried once more, with the same gates, on the pixels away from edges (where the 3×3 neighbourhood in either proxy spans a luminance ratio above 3). Many camera JPEGs are lens-corrected while the raw is not (Sony "Distortion Comp.: Auto", compacts and kit zooms), and on a detailed scene the misaligned edges alone fail the gate although the colours agree everywhere else (issue #232). The public ILCE-7RM2 samples (raw.pixls.us, one façade shot in seven compression/correction variants, 24–70 mm at 51 mm) are up to 15 px of 1440 off their JPEG; the six with distortion correction on missed the gate at held-out RMS 0.108–0.115 and opened in the grey neutral fallback, 13 L* too dark (ΔE76 16.6–16.9 against the JPEG after registering its geometry). Away from edges they pass at 0.049–0.052 and land at ΔE 3.7–3.8 with lightness within 0.6 L*, like the variant shot with distortion correction off (0.059 on all pixels, ΔE 3.9). The corpus GX80 kit-zoom sample (up to 63 px of 1440 off) passes too: 0.107 → 0.081, ΔE 19.1 → 7.9. Fits accepted on all pixels are unchanged. These are provisional acceptance gates, not a colour-accuracy certification. Monochrome, singular, unrelated, aspect-mismatched and poor-fitting references retain the documented fallback. Both fits use the same fixed proxy at every decode resolution.
+One third of the pixels are held out from both fits. The combined model must reduce linear-display squared error by at least 30% and have per-channel RMS error ≤0.10 (0.055 rejected half of the public raw.pixls.us samples tried — ILCE-6400, -6700, -7M4 — whose fits were still 1.5–3× closer to the camera JPEG than the fallback and visibly better). When the fit on all pixels fails these gates, it is tried once more, with the same gates, on the pixels away from edges (where the 3×3 neighbourhood in either proxy spans a luminance ratio above 3). Many camera JPEGs are lens-corrected while the raw is not (Sony "Distortion Comp.: Auto", compacts and kit zooms), and on a detailed scene the misaligned edges alone fail the gate although the colours agree everywhere else (issue #232). The public ILCE-7RM2 samples (raw.pixls.us, one façade shot in seven compression/correction variants, 24–70 mm at 51 mm) are up to 15 px of 1440 off their JPEG; the six with distortion correction on missed the gate at held-out RMS 0.108–0.115 and opened in the grey neutral fallback, 13 L* too dark (ΔE76 16.6–16.9 against the JPEG after registering its geometry). Away from edges they pass at 0.049–0.052 and land at ΔE 3.7–3.8 with lightness within 0.6 L*, like the variant shot with distortion correction off (0.059 on all pixels, ΔE 3.9). The corpus GX80 kit-zoom sample (up to 63 px of 1440 off) passes too: 0.107 → 0.081, ΔE 19.1 → 7.9. Fits accepted on all pixels are unchanged. These are provisional acceptance gates, not a colour-accuracy certification. Monochrome, singular, unrelated and aspect-mismatched references retain the documented fallback; poor-fitting ones get the partial look below when it is clearly closer to the camera JPEG. Both fits use the same fixed proxy at every decode resolution.
+
+**A partial look when the full look misses the gates.** The neutral fallback (camera RGB taken as sRGB, the default tone map) is far from the camera JPEG. Rendered for every photo on this path in the CC0 archive (1,150 files with a camera JPEG), it is 10.7 L\* too dark (median; about one stop), keeps 0.36 of the camera's colourfulness and has hues 7° off on the coloured pixels (median CIEDE2000 13.6). Its white balance is right: on the pixels the camera renders near-neutral the cast is under 1 a\*/b\* (median, every maker). The "blue" fallback on newer Sony bodies (Δb\* −22 over the whole frame on the ILCE-7RM5 sample) is a warm scene losing its colour, not a cast: its near-neutral pixels are within −1.6 b\*. So before falling back, a partial look is fitted (`fit_partial`): the quantile tone curve (registration-free, the largest part of the error), the chroma curve, and, when the scene has enough colour to learn a matrix (the full look's condition), the photo's own colour matrix at half weight, the other half the identity (`PARTIAL_MATRIX_WEIGHT`). No hue/saturation table. Half weight because, on the held-out proxy pixels of the 23 colourful photos without a look, the full matrix left 2 of them more than 2° further from the camera's hues than the neutral fallback and half weight none (median hue error 9.6° with the generic colour, 5.1° at half weight, 4.2° at full weight; on the 1,080 photos with a look 3.9° and 2.7°). Without a matrix (tone and chroma curve alone, or with one global saturation scale) about a third of all photos ended up more than 2° further from the camera's hues than the fallback, as the added colour makes the generic matrix's hue errors visible. The partial look is tried on all pixels, then away from edges, and used only when it cuts the held-out squared error below 0.7 of the neutral fallback's in linear and in gamma-encoded display values, and when the JPEG's luminance ranks the pixels like the scene's (Spearman ≥ 0.5, `PARTIAL_MIN_RANK_CORRELATION`): a curve matched to the brightness of an unrelated picture also beats the dark fallback pixel for pixel. The accepted full looks have 0.55 or more; three old Coolpix files whose raws decode wrongly have 0.07–0.27 and keep the fallback. There is no limit on the partial look's own error. On the archive (1,783 renders): all 1,087 full looks are byte-identical; of the 55 photos that reach the partial fit, 49 get it (40 on all pixels, 9 away from edges; 13 with the damped matrix, 41 with a chroma curve) and 6 keep the fallback (lens-corrected compacts: RX10, TZ80 1:1, D-LUX 4, G10 16:9, GF2 ×2). On the 49, median CIEDE2000 to the camera JPEG 14.0 → 2.1, ΔL\* −11.5 → +0.6, colourfulness 0.36 → 0.87, hue error 10.1° → 7.1°; every one is closer, by at least 1.3. Most of the others without a look never reach a fit: on 48 files (Nikon D4, Df, D300/D300S, D7000, D5100 and others) the camera JPEG proxy comes out a pixel narrower than the sensor proxy and no pairs are collected (the resize in PR #531 fixes this; with it 46 of them pass the full look's gates, CIEDE2000 17.9 → 2.9).
 
 ## Source metadata and white balance
 
@@ -74,9 +78,70 @@ This is a per-file camera-look estimate, **not measured spectral calibration or
 
 One photo can show too little of a colour for its own fit to learn it: in a second shot of the lime shirt only a few dozen proxy pixels show it, next to a hillside of foliage at the same hue that the camera renders differently, and the shirt stayed yellow (hue 68° against the JPEG's 82°; a 192-pixel proxy only reached 74°). `lightcraft-cli calibrate [--max N] [--out DIR] FOLDERS…` therefore pools the colour pairs of many ARWs, NEFs or RAFs per camera model — each against its own embedded JPEG, at a 192-pixel proxy, at most 4000 pairs per photo, files spread evenly over the folders — and fits one matrix (from white-balanced camera RGB, so no single photo's white point is baked in) and one hue/saturation/value table. Models need at least 5 usable photos.
 
-Profiles are JSON files `<model>.json` in `$LIGHTCRAFT_CAMERA_PROFILES`, else `<config>/camera-profiles` (macOS `~/Library/Application Support/LightCraft/camera-profiles`); a local profile replaces a built-in one. Built-in profiles live in `assets/camera-profiles/` (listed in `assets/ATTRIBUTION.md`) and are compiled in, so the app, CLI and web build share them: ILCE-7M4, fitted to 597 photos (2.2 million colour pairs) shot in 2026, mostly with the Standard creative style and DRO Auto; X-H2S, 201 photos; X-T4, 545 photos. They hold aggregate colour statistics only. A photo of a profiled model takes its colour from the profile and fits only its own tone and chroma curves (DRO and picture styles vary per shot); the acceptance gates still apply. A rejected profile fit retries the photo's own colour and tone fit before falling back to neutral rendering. Files are read once per process and validated (version, bounded invertible matrix, table shape and finite data); a damaged file is ignored with a warning. The profiles folder's contents are part of the render cache keys, so thumbnails rendered before a profile existed are redone; smart previews built before keep their colour until rebuilt.
+Profiles are JSON files `<model>.json` in `$LIGHTCRAFT_CAMERA_PROFILES`, else `<config>/camera-profiles` (macOS `~/Library/Application Support/LightCraft/camera-profiles`); a local profile replaces a built-in one. Built-in profiles live in `assets/camera-profiles/` (listed in `assets/ATTRIBUTION.md`) and are compiled in, so the app, CLI and web build share them: ILCE-7M4, fitted to 597 photos (2.2 million colour pairs) shot in 2026, mostly with the Standard creative style and DRO Auto; ILCE-7CR, 125 photos (below); X-H2S, 201 photos; X-T4, 545 photos. They hold aggregate colour statistics only. A photo of a profiled model takes its colour from the profile and fits only its own tone and chroma curves (picture styles vary per shot; with Sony's DRO on, that tone curve is then lowered as described below); the acceptance gates still apply. A rejected profile fit retries the photo's own colour and tone fit before falling back to neutral rendering. Files are read once per process and validated (version, bounded invertible matrix, table shape and finite data); a damaged file is ignored with a warning. The profiles folder's contents are part of the render cache keys, so thumbnails rendered before a profile existed are redone; smart previews built before keep their colour until rebuilt.
 
 
+### Sony ILCE-7CR
+
+Fitted from 125 usable photos of 131 ILCE-7CR ARWs (one photographer, September 2025 to September 2026, Standard creative style with DRO off, Lv3 or Auto; 127 uncompressed, 2 compressed, 2 lossless compressed), 448,230 colour pairs. Measured as above: rendered at 1200 px with `lightcraft-cli render`, mean CIE76 ΔE against each file's embedded JPEG at 200 px.
+
+Without a profile, 123 of the 131 photos accept their own fit; the other 8 open with the neutral fallback at ΔE 6–26. For validation every fifth photo in sorted name order (26) was withheld and a profile fitted to the other 105 (100 usable). On the withheld photos mean ΔE went from 4.07 with per-file fitting to 3.29 with the profile. Both withheld photos whose own fit is rejected are accepted (ΔE 26.0 → 6.1 on a night scene, 6.2 → 5.5). Withheld photos whose own fit was accepted are about unchanged and move both ways: 12 of 24 improve, mean ΔE 3.06 → 3.08, largest regression 1.8. On that photo (gold tinsel bokeh) the profile turns a blue light blue again where the per-file fit had made it teal, but renders the gold slightly more saturated than the camera. With the final profile all 131 photos are accepted, and the 8 previously rejected ones land at ΔE 1.3–5.7; that comparison is in-sample.
+
+The nine public raw.pixls.us ILCE-7CR files are one scene in every coding the camera writes (uncompressed, lossless compressed L, M and S, compressed, full frame and APS-C crop). They were not used for fitting. All nine accept their own fit at ΔE 1.3–2.1 and stay accepted with the profile, at ΔE 1.5–2.9 (mean 1.59 → 1.99). On this colourful daylight scene the per-file fit is already close. The subsampled M and S codings, which decode with unity white-balance gains, move most (2.0 → 2.8). This is a camera-JPEG look estimate like the others, not measured calibration or Lightroom parity.
+
+## Sony Dynamic Range Optimizer (DRO)
+
+Sony bodies apply DRO, a local tone operator that brightens darker regions, to their JPEG (and the preview embedded in the ARW) only; the raw data are unchanged, and the factory default is DRO Auto. The tone curve fitted to that JPEG carried the brightening into the raw's starting look, so DRO photos opened lighter than in Lightroom, darktable, Photomator or Affinity, which develop the raw without it (issue #244). On 24 ILCE-7CR photos (Standard creative style) with Lightroom 9.5.1 default exports, mean L* at 200 px: with DRO off, Lightroom matches the camera JPEG (+0.15 L*, all within ±1.4) and LightCraft matches Lightroom (−0.19 L*, median ΔE76 3.6); with DRO Lv3 or Auto (8 photos), Lightroom is 2.4–10.7 L* darker than the camera JPEG and LightCraft followed the JPEG, +6.4 L* from Lightroom (median ΔE76 7.5). The tone curves fitted to 131 ILCE-7CR photos show where: at scene luminance 0.01, 0.02, 0.05 and 0.1 the median DRO Lv3/Auto curve is 8, 10, 9 and 6 L* above the DRO-off one, and from 0.3 up they agree.
+
+The ARW decoder reads the setting from maker-note tag `0xb025` (ExifTool's Sony tag documentation: 0 Off; 1 Standard, 2 Advanced Auto, 3 Auto, 8–12 Advanced Lv1–5, 16–23 Lv1–8; other values are treated as unknown). It was present on all 264 Sony raws checked (98 bodies, DSLR-A100 to ILCE-7CR); the second tag of that name, `0xb04f`, only says off or on and is missing on the older bodies. With DRO on, the look keeps the colour fitted to the JPEG (matrix, hue/saturation table, chroma curve) and its tone curve is lowered, knot by knot, to Sony's curve without DRO wherever that is darker (`assets/camera-tone/sony-dro-off.json`, listed in `assets/ATTRIBUTION.md`). Past its last knot a curve continues as a shoulder whose rate comes from its last two knots, so the second-last knot is lowered only as far as keeps that shoulder at or below the fitted one; the result is never brighter than the fitted curve at any scene luminance. Sony's curve is quantile-matched, as one photo's tone is, over the pooled pairs of 12 CC0 raw.pixls.us ARWs shot with DRO off and the Standard creative style on 10 interchangeable-lens bodies (ILCE-3500, -5000, -6600, -7M3, -7S, -7CR, -9M2, ILCA-77M2, SLT-A57, NEX-F3; the file lists their URLs and SHA-256); pooled the same way from 55 private ILCE-7CR photos with DRO off, the curve differs by at most 1.2 L* between scene luminance 0.01 and 0.5. DRO only brightens, so the photo's own curve bounds the curve without it from above: the 1″ compacts map raw values darker (with DRO off, the DSC-RX100M2, -RX100M5 and -RX10M4 curves lie 8–16 L* below Sony's at scene luminance 0.18) and keep their own curve where it is the darker one. Photos with DRO off or unknown, and other makers, are unchanged.
+
+Measured before → after (mean L* and CIE76 ΔE at 200 px): on the 24 ILCE-7CR photos with Lightroom references, the 8 with DRO on go from +6.4 L* (+4.4 to +10.5) to +0.8 L* (−0.4 to +1.9) against Lightroom's default, median ΔE 7.5 → 3.3; by Lightroom lightness band (L* 0–25, 25–50, 50–75, 75–100) they now differ from it by +2.3, +1.4, −0.8 and −3.0 L* (before +7.8, +9.4, +3.8, −0.8), like the 16 with DRO off (+2.5, −0.1, −2.0, −3.2), which render byte-identically. Of all 131 ILCE-7CR photos, the 56 fitted with DRO on now render 6.1 L* darker than their camera JPEGs on average (0.3 lighter before), as Lightroom renders the measured ones 5.7 L* darker; the 71 with DRO off are byte-identical. Of 116 CC0 Sony files from 100 bodies, 79 were shot with DRO on (71 of them Auto); the 57 changed of the 69 fitted ones render 2.1 L* darker on average (at most 10.8), the 12 others (six compacts, four ILCE-7M4 shots in Vivid, an ILCE-1 and an ILCE-7RM4, whose own curves are already darker) and all 35 DRO-off files are unchanged. The issue's ILCE-7M3 file goes from +0.8 to −6.5 L* against its camera JPEG. Applied to photos shot with DRO off, whose JPEG shows the camera's own curve, the rule would move the 68 fitted ILCE-7CR photos by −0.4 L* (median; at most −4.1) and 25 of 28 fitted CC0 ones by at most −1.8 L*; the exceptions are an ILCE-3500 (−4.7) and the cine bodies FX3 and FX30 (−7.2 and −5.1), whose picture profiles are not the Standard style.
+
+Picture styles other than Standard are lowered to the Standard curve too where it is darker; Lightroom ignores them as well. Nikon Active D-Lighting, Canon Auto Lighting Optimizer and Fujifilm D-Range settings are likely to have the same effect and are not handled yet. Render cache version 23 redraws thumbnails; smart previews built before keep the brightened tone curve in their header until rebuilt.
+
+## Spectral camera matrices and the order of precedence
+
+For 52 camera models LightCraft has colour matrices fitted to the camera's measured spectral sensitivities
+(`crates/raw/src/spectral.rs`, generated into `spectral_table.rs` by `tools/spectral_camera_table.py` from
+[rawtoaces-data](https://github.com/AcademySoftwareFoundation/rawtoaces-data) v1.1.0, Apache-2.0): 22 Canon, 11 Nikon,
+11 Sony, 3 Fujifilm and 5 others, plus the other names rawtoaces-data lists for them (EOS Rebel T3i and Kiss X5 for
+the EOS 600D; bodies it lists as sharing a sensor, such as the GFX100S with the GFX 100). Per model the generator fits,
+under CIE Standard Illuminant A and under D65, a white-preserving 3×3 from white-balanced camera RGB to XYZ by the
+least mean CIE76 error over rawtoaces-data's 190 training reflectances, and writes DNG `ColorMatrix1/2` and
+`ForwardMatrix1/2`. The existing DNG colour model then interpolates them for the file's as-shot white, which the
+vendor white-balance multipliers give through the same matrices. No number comes from Adobe or from a raw decoder.
+
+A raw starts from the first of these that is available (`camera_preview::starting_colour`):
+
+1. the file's own colour matrices (DNG);
+2. a camera profile for its model (bundled or local), with tone and chroma fitted to the file's JPEG;
+3. the file-local fit to its own JPEG described above;
+4. the model's spectral matrices, with LightCraft's default tone curve and no JPEG fit;
+5. the neutral fallback.
+
+The spectral matrices only replace the neutral fallback: a photo whose JPEG fit is accepted (with or without a
+profile) renders exactly as before, and a covered model takes its spectral matrices only when that fit fails the
+gates or the file has no usable JPEG. White balance stays relative to the as-shot look for every raw without matrices
+of its own, as before, so the catalog's `Photo::relative_wb` and the controls are unchanged. `lightcraft-cli
+calibrate` still pools the uncorrected camera colour of covered models, so a profile can be fitted for them.
+
+No colour-difference measurement of the spectral matrices against the camera JPEG, or against the file-local fit,
+is recorded here yet. Whether they should come before the file-local fit for these models is open until one is.
+
+## Smart previews and the look version
+
+A smart preview keeps the result of the fit twice: the colour matrix is baked into its pixels and the tone and chroma curves are stored in its header. When the fit changes, a preview built earlier keeps the old look until it is rebuilt, and the render cache version does not reach it (renders are keyed on the library's files, proxies are files of their own).
+
+The fit therefore has a version, `LOOK_VERSION` in `crates/engine/src/camera_preview.rs`, and every smart preview records the version that wrote it in its header line (`look_version`). **Bump the constant in any change that makes the fit give a different result for the same file**: the matrix, hue/saturation, tone or chroma fit, their gates and fallbacks, or how a camera profile feeds them. Changes that leave the fitted look alone don't need it. A header without the field (everything built before it existed) counts as version 0, and so does a value that is not a non-negative integer; a value from a newer build is left alone.
+
+A proxy older than the constant is brought up to date by the existing Build Smart Previews path (`smart_run`), which also repairs damaged proxies:
+
+- only proxies of raws that take the per-file look (`file_local_look`: ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW, ORF…) go stale; the fit never reaches JPEG, PNG, TIFF or DNG proxies, which are never rebuilt for it;
+- when the library is opened and its smart previews folder has not been checked at this `LOOK_VERSION` (the `look-version` marker file in the folder), a background thread looks at those proxies, rebuilds the stale ones from their originals and then writes the marker, so the scan runs once per version bump, not at every opening (no proxy is created, nothing is shown, the UI never waits on a drive);
+- Build Smart Previews does the same for the photos it is run on (`refreshed` in its result), whatever the marker says;
+- when the original can't be read (offline drive), the proxy and its curve are kept exactly as they are (`staleKept`). The old version in its header is the mark: the next Build Smart Previews with the original online rebuilds it. A rebuilt proxy carries the current version, so nothing is rebuilt twice. A proxy is only ever rebuilt from the original, never from another proxy;
+- the two never write the same proxy at once: each proxy is checked and written under one lock.
+
 ## Nikon crop and preview colour metadata
 
 Nikon maker-note `CropArea` (0x0045) supplies the default `[left, top, width, height]` crop. The decoder validates the rectangle against the active sensor area and falls back to that area for missing or invalid values. The CFA origin is unchanged; cropping follows demosaicing.
@@ -85,9 +150,24 @@ An embedded JPEG with neither ICC nor EXIF metadata uses Nikon maker-note `Color
 
 Synthetic tests cover crop bounds/CFA preservation, colour-space tags, fallback transfer decoding and metadata precedence. A private Nikon Z 8 sample reports an 8256 × 5504 default crop from an 8280 × 5520 sensor. No private sample or Adobe asset is included.
 
+### Samsung SRW
+
+Samsung SRW decoding (uncompressed files) supplies the as-shot white-balance multipliers from the maker note and no colour
+matrix, so SRW takes the same fit, gates and relative white balance.
+
 ### Canon CR2 and Pentax PEF
 
 CR2 and PEF decode without a camera colour matrix too, but were left out of the fit until issue #310 (CR2 files opening
 flat and desaturated: the camera's preview first, then the neutral fallback). They now use the same fit, gates and
 relative white balance. This change was not measured on the corpus: the gates keep the fallback for any file whose fit
 doesn't pass, so a file can only stay as before or move closer to its camera JPEG. Per-model numbers are still to come.
+
+### Olympus ORF
+
+The ORF decoder (uncompressed files) supplies the as-shot white balance (ImageProcessing `WB_RBLevels`) and no colour
+matrix, so ORF takes the same fit, gates and relative white balance. The reference is the camera's preview JPEG (on the
+E-1 the 1280 × 960 one the maker note points to). All three decodable corpus files are accepted (held-out RMS against
+the neutral fallback): E-1 0.126 → 0.014, E-400 0.087 → 0.022, XZ-2 0.061 → 0.023. Compressed ORFs (E-M1, E-M10 III)
+still open from their embedded JPEG. Against Lightroom Classic's render of a CC0 E-1 photo (2000 px, ΔE00 of the
+unedited render) the starting look moved from 11.25 to 8.30. Lightroom frames that E-1 file about 4 × 11 sensor pixels
+differently from the crop the file records (`CropLeft`/`CropTop` 36, 34); the file's own crop is kept.

docs/control-protocol.md

@@ -30,20 +30,24 @@ mode ([mcp.md](mcp.md)) is a thin layer over this channel. Implementation:
 | `engine.commands` | — | Engine + UI commands: id, label, menu, shortcut, params doc, enabled |
 | `ui.menu.list` | — | Menu entries (flat: id, label, menu path, shortcut, enabled) |
 | `ui.menu.tree` | — | The menu bar as shown (File … Help): items `{id, params?, label, shortcut?, enabled, checked?}`, separators, submenus — the model behind the native macOS menu bar and the in-window menus |
-| `ui.inspect` | — | UI state, window, `loupe` (`source`, and `region: {full, window, pending}` when a zoomed view also renders the window on screen at no more than 100 % — `full` is the frame it is cut from, `window` its `[x, y, w, h]` — and `regionBefore` for the Before side of a Before/After view), canvas/image rects, `scroll: {grid, filmstrip}` (scroll offsets in points, `null` until drawn), active photo, selection, perf (`frameMs` = layout, `logicMs` = per-frame logic before it, `updateMs` = both, `maxUpdateMs`, `fps`, render queue …, `gpu` = adapter in use, `gpuReason` = why renders don't use the GPU, `gpuFallback` = latest render redone on the CPU and why — see `docs/gpu-pipeline.md`), status, memory (bytes per cache, see `library.memory`; plus stage caches — `budgetBytes`, `trimmed`, `sharedSourceBytes` (the one device copy of a big original) — and textures), `export: {running: {total, done, current} \| null, last}`, `notices` (warnings waiting to be shown, e.g. a damaged settings file; OK = `button:noticeOk`), `quitPrompt` (why quitting was stopped: unsaved changes; `button:quitRetry` / `button:quitAnyway` / `button:quitCancel`), `import: {done, total, imported, cancelled} \| null` (an import runs on a worker thread), `tasks` (other background work: `Find Missing Photos`, `Auto Import`), `fileDialogs` (commands waiting on a native file dialog, which runs off the UI thread; they run again with the answer when it closes) |
+| `ui.inspect` | — | UI state, window, `loupe` (`source`, and `region: {full, window, pending}` when a zoomed view also renders the window on screen at no more than 100 % — `full` is the frame it is cut from, `window` its `[x, y, w, h]` — and `regionBefore` for the Before side of a Before/After view), canvas/image rects, `scroll: {grid, filmstrip}` (scroll offsets in points, `null` until drawn), active photo, selection, perf (`frameMs` = layout, `logicMs` = per-frame logic before it, `updateMs` = both, `maxUpdateMs`, `fps`, render queue …, `gpu` = adapter in use, `gpuReason` = why renders don't use the GPU, `gpuFallback` = latest render redone on the CPU and why — see `docs/gpu-pipeline.md`), status, memory (bytes per cache, see `library.memory`; plus stage caches — `budgetBytes`, `trimmed`, `sharedSourceBytes` (the one device copy of a big original) — and textures), `export: {running: {total, done, current} \| null, last}`, `notices` (warnings waiting to be shown, e.g. a damaged settings file; OK = `button:noticeOk`), `quitPrompt` (why quitting was stopped: tasks that would be cut short are running — `button:quitAnyway` cancels them and quits, `button:quitCancel` keeps working — or unsaved changes: `button:quitRetry` / `button:quitAnyway` / `button:quitCancel`), `import: {done, total, imported, cancelled} \| null` (an import runs on a worker thread), `tasks` (other background work: `Find Missing Photos`, `Auto Import`), `activity` (every long-running task in flight as the activity stack in the top-left corner shows it, same shape as `activity.list`; a row appears once its task is 0.5 s old, ids `activity:row:<id>`, ✕ = `activity:cancel:<id>`, `activity:more` expands past 3 rows), `fileDialogs` (commands waiting on a native file dialog, which runs off the UI thread; they run again with the answer when it closes), `copied` (the text the UI last put on the clipboard, `null` until something is copied) |
 | `ui.widgets` | `{filter?}` | On-screen widgets `{id, rect: [x, y, w, h]}` (screen points) |
-| `ui.clickWidget` / `ui.dragWidget` / `ui.hoverWidget` | `{id, count?, fx?, fy?}` / `{id, toX?, toY?, dx?, dy?, steps?}` / `{id, fx?, fy?}` | Real egui input on a widget (hover: the pointer rests on it, e.g. for preset/profile previews) |
+| `ui.clickWidget` / `ui.dragWidget` / `ui.hoverWidget` | `{id, count?, button?, fx?, fy?}` (`button: "right"` right-clicks) / `{id, toX?, toY?, dx?, dy?, steps?}` / `{id, fx?, fy?}` | Real egui input on a widget (hover: the pointer rests on it, e.g. for preset/profile previews) |
 | `ui.move` / `ui.click` / `ui.drag` | `{x, y, count?, button?}` / `{x, y, toX, toY, steps?}` | Raw pointer input, screen points |
 | `ui.pointer` | `{events: [{kind: down\|drag\|up, x, y}], alt?, shift?, cmd?}` | Gesture in normalized image coordinates (Detail view) |
 | `ui.key` | `{key, cmd?, shift?, alt?, ctrl?}` | Key press |
 | `ui.text` | `{text}` | Text input |
+| `ui.clipboard` | `{action: cut\|copy\|paste, text?}` | Cut, copy or paste in the focused text field, as the system does for ⌘X / ⌘C / ⌘V; `paste` pastes `text`, or the system clipboard without it. Refused when no text field has the focus (outside one, ⌘C / ⌘V are the commands `develop.copy` / `develop.paste`). In the desktop app cut and copy write the system clipboard. `ui.inspect` → `copied` is the text the UI last put on the clipboard |
 | `ui.scroll` | `{dx, dy, cmd?, ctrl?, shift?, alt?}` | Wheel / two-finger scroll at the current pointer; pans over the image, modifier-scroll zooms |
 | `ui.zoom` | `{factor}` | Pinch zoom at the current pointer (positive scale multiplier; 1 = unchanged). Position it first with `ui.move` or `ui.hoverWidget` |
 | `ui.set` | partial UI state, e.g. `{"view": "detail"}` | Resulting UI state |
 | `ui.dialog.confirm` / `ui.dialog.cancel` | — | Close the open dialog |
 | `ui.resize` | `{width, height}` | Resize the window |
+| `ui.zoomFactor` | `{factor}` | Set the interface scale (0.5–3; egui's zoom keys are off, Cmd+= / Cmd+- zoom the photo) |
 | `ui.screenshot` | `{path?, headless?}` | `{path, width, height}` once the frame (with finished renders) is captured. `headless: true` draws the UI on the CPU (no compositor needed); a windowed capture that gets no frame within 2 s falls back to headless automatically |
 | `engine.execute {command: "app.export", params}` | export params (see `docs/mcp.md`), plus `preset`, `dir` / `path`, `ids`, `background` | Writes the files and returns `{files}`; with `background: true` (what the Export dialog and menus use) it returns `{background: true, total}` at once and the batch runs on a worker thread — poll `ui.inspect` → `export` |
+| `engine.execute {command: "activity.list"}` | — | The long-running tasks in flight (imports, exports, preview builds, downloads, the face scan…), oldest first: `{tasks: [{id, kind, label, done, total, unit, detail, cancellable, cancelling, ageMs}]}`; `total` 0 = not known yet; `unit` is `count`, `bytes` or `percent`; `label` is English (the app shows it translated) |
+| `engine.execute {command: "activity.cancel"}` | `{id}` or `{all: true}` | Asks the task (or every cancellable one) to stop at its next file or photo → `{cancelled: n}`; an unknown id (it may have just finished) or a task that can't be cancelled is an error |
 | `ui.render` | `{id?, size?, path?}` | Render a photo (PNG to `path`), `{width, height}` |
 | `app.quit` | — | Close the app |
 
@@ -55,6 +59,12 @@ scrolling pans in both axes and respects the operating system's scrolling direct
 These gestures work in Detail (including editing tools and full-screen preview), Compare and Reference
 views, and only apply over their image areas. Panning stops at the image edges.
 
+Mask brushing uses the UI command `tool.brush` through `engine.execute`. With `{}` it activates
+painting on the current mask. `{"new": true}` creates a separate brush mask; `{"op": "add"}` or
+`{"op": "subtract"}` appends a brush component to the selected mask. Creating either starts in
+paint mode with the overlay visible. Brush Erase (or Alt while painting) removes strokes' coverage
+within that brush component; it is distinct from subtracting the component from the whole mask.
+
 ### When the library can't be saved
 
 With a persistent library, every command that changes something is written to the catalog journal (fsynced) before
@@ -85,14 +95,28 @@ scissor clipping as egui's GPU backends, so the image matches the window (minus
 - **In the running app:** `{"method": "ui.screenshot", "params": {"path": "a.png", "headless": true}}`.
   The UI is drawn into an offscreen context from the app's logic tick, which keeps running when the
   window is occluded or the display sleeps/locks. Windowed screenshots fall back to this after 2 s.
-- **Without any app window:** `lightcraft-cli snapshot` runs a whole app session headlessly and
-  answers the same control requests (same handler) from a JSON-lines script:
+- **Without any app window:** `lightcraft-cli snapshot` runs a whole app session headlessly.
+  Photo development also defaults to the CPU, so the initial frames do not discover a GPU adapter
+  or load a graphics driver. `LIGHTCRAFT_GPU=1` does not opt snapshots back into GPU rendering.
+  This applies only to the snapshot session: even `--library DIR` leaves the desktop app's saved
+  `ui.json` preferences untouched. It answers the same control requests (same handler) from a JSON-lines script:
 
 ```text
 lightcraft-cli snapshot --demo -o grid.png --size 1600x1000 [--scale 2]
 lightcraft-cli snapshot --library DIR --script tour.jsonl -o shot.png
 ```
 
+Headless screenshot dimensions must be finite and at least one logical point, with a finite,
+positive scale. Rounded output must be at least one pixel per edge, at most 16,384 pixels
+per edge and 64 million pixels in total. `snapshot` and `ui.resize` reject requests outside
+these limits before layout or rasterization; supplied resize dimensions must be numbers.
+An interface zoom (egui's zoom factor; the keyboard never changes it — ⌘= / ⌘− / ⌘0 zoom the
+photo, issue #566) changes text and control sizes while preserving the snapshot viewport's requested
+physical pixel dimensions. Later `ui.resize` requests use current egui points; validation
+and rasterization both convert them to native viewport points before rounding the output
+pixels. A native edge below one point after zooming out is valid if it rounds to at least
+one pixel.
+
   `tour.jsonl` holds one request per line (`#` comments allowed), e.g.
   `{"method": "ui.set", "params": {"view": "detail", "right": "edit", "openSections": ["optics"]}}`
   then `{"method": "ui.screenshot"}`. Replies are printed to stdout. A failed request

docs/cr3.md

@@ -5,6 +5,12 @@ The CR3 adapter reads the CRX Bayer track, `CMP1` compression descriptor,
 black/white levels and the default crop come from the file. A Dual Pixel delta
 track is never substituted for the primary Bayer track.
 
+The in-camera aspect ratio (3:2, 4:3, 16:9, 1:1) is not applied to the sensor data. The maker note's
+`AspectInfo` (tag `0x009a`: aspect code, cropped width, height, left, top) gives the shot's rectangle inside the
+recommended crop, and the decoder uses it as the default crop, so the developed image has the shape the photographer
+framed (PowerShot SX70 HS, EOS 250D, PowerShot G5 X Mark II, EOS M6 Mark II and EOS M50 samples). A rectangle that
+is missing or does not fit inside the crop is ignored. The embedded JPEG still shows the whole frame.
+
 The decoder is independent Rust code shared by desktop, CLI and WebAssembly;
 it has no operating-system imaging dependency or external decoder. Its sources
 are the public prose descriptions and patents cited in
@@ -55,7 +61,16 @@ The version `0x200` QP predictor and entropy framing were checked independently.
 Controlled input mutations establish floor averaging of paired QP rows before
 the nonlinear integer table, then multiplication, division by eight, addition
 of the subband base and a minimum step of one. QP values 131–167 are verified;
-unmeasured values and an odd QP-map height are rejected. Partial-subband and
+unmeasured values are rejected.
+
+An odd QP-map height (EOS R7: 4732 sensor rows give 1183 QP rows) leaves the
+last row of the second-level high-frequency bands without a partner row; that
+row's QP is used on its own. The odd-height map decodes to the exact end of its
+entropy stream. This rule is not yet checked against a black-box reference:
+it was checked on paired R7 RAW and C-RAW captures of the same scene (ISO 100
+and 6400), whose developed images match visually and whose sensor means agree
+within 0.1% at ISO 6400. Files with even-height maps never reach this rule, so
+the six verified fixtures are unchanged. Partial-subband and
 rounded-plane coding, vertical C-RAW tiling and adaptive low-frequency gains
 remain unsupported. The decoder bounds image dimensions, sample count,
 tile count, marker headers and temporary allocations. The full sensor buffer is

docs/denoise.md

@@ -0,0 +1,138 @@
+# AI Denoise
+
+Edit ▸ Detail ▸ **AI Denoise** is a per-photo switch above **Amount** (0–100).
+Turning it on starts at 50, or preserves an already positive Amount. Turning it off
+preserves Amount and mixes none of the cleaned picture. It affects only the requesting
+photo, independently of Auto Sync, and is undoable. Manual luminance and colour noise
+reduction remain separate controls.
+
+If no model is selected, turning it on opens **Settings ▸ AI Denoise** without changing
+the photo. After installation, the pending request enables the original photo even if
+the selection changed. Cancel the pending action in Settings. Cancelled downloads,
+deleted or relinked photos, switching libraries and quitting cancel the request.
+An active slider gesture finishes before the pending action resumes.
+
+## Models and terms
+
+**No model weights are bundled.** Models live in the per-user `denoise-models` folder
+(override with `LIGHTCRAFT_DENOISE_MODELS`). Settings provides **Install from file…**
+for a user-supplied ONNX file with a `denoise-model.json` beside it. The default build
+offers no model downloads. The separate `rawnind-model` Cargo feature enables the
+pinned RawNIND offer only when a release's model policy permits it.
+Terms must be acknowledged before installation or
+download. Downloads use the shared pure-Rust `lightcraft-fetch` client, with resume,
+progress, cancellation, size limits and SHA-256 verification.
+
+RawNIND's optional ONNX weights are **GPL-3.0**, as recorded in the pinned model catalog.
+They are downloaded separately after consent and read by our own Rust executor.
+Whether releases should offer this download remains a maintainer policy decision;
+permissively licensed or independently trained weights remain a gap. This is not a
+claim that optional downloading settles licensing questions. No GPL decoder or neural
+runtime code is included. Model metadata is in `crates/denoise-core/src/known.rs`.
+
+Installation checks the manifest, model hash and size, then runs a synthetic self-test:
+finite output of the promised shape, repeatability, the declared scale and reduced
+noise. Unsupported operators, malformed files and a failed self-test return errors.
+The UI performs copying, extraction, hashing, parsing and CPU/GPU self-tests on one
+background installation worker. `denoise.models.downloads` and `denoise.pump` report
+`installing`, `installed` or `failed`; an existing model is preserved on a failed replacement.
+Command clients can request the same asynchronous path with `background: true`.
+The synchronous command remains available for scripts that require the result immediately.
+
+The current contract is `bayerToRgb`: normalized, black-subtracted, non-white-balanced
+RGGB planes `[1, 4, tile, tile]` produce camera RGB `[1, 3, 2*tile, 2*tile]`.
+RawNIND uses a 512-cell tile, 64-cell overlap and a mean-matched nominal gain of 1e6.
+See `DenoiserManifest` for the validated JSON schema.
+
+## Photos, previews and exports
+
+Original RAW files stay untouched. A cleaned picture is cached under
+`<library>/denoise/<key>.lcdn`, keyed by source content, model and algorithm version.
+The compressed half-float cache has checked headers, bounded windows and checksums.
+It can be cleared or recreated; it is not a new catalog photo or a duplicate DNG.
+
+Plain and cleaned camera RGB go through the same highlight reconstruction, white
+balance, colour matrix, DNG profile tables, camera hue/saturation look, crop and
+orientation. Amount blends the two before the remaining develop pipeline, so edits
+and exports use the same data. At zero Amount or with Detail disabled, the ordinary
+render path remains in use.
+
+The queue prioritizes the open and selected photos, pauses after input, and adjusts
+its worker count while the user works. Progress, cancellation and retry are available
+in Settings and through commands. The default cache limit is 20 GB; unused products
+are evicted oldest first. A failed file is not continuously retried.
+
+An export with a nonzero effective Amount creates a missing product synchronously.
+It returns a clear error if it cannot produce the denoised result; it never silently
+exports the plain image instead. Unsupported sensor layouts retain manual noise
+reduction and report their limitation.
+
+## Pure-Rust CPU and GPU execution
+
+The CPU executor reads a bounded subset of ONNX into checked network data. Convolutions
+use bounded im2col blocks and `faer-core 0.17.1` with its pure-Rust GEMM backend,
+without BLAS, C dependencies or an inner thread pool. That backend includes
+architecture-specific assembly in its dependencies. Tiles share the outer worker
+pool. A scalar implementation checks the optimized operators on synthetic networks.
+Tract is not a workspace dependency or a product feature.
+CPU inference and the GPU model module are feature-gated; ordinary engine/web builds
+do not compile the faer/GEMM backend. The engine depends on the inference crate only through `denoise = ["dep:lightcraft-denoise", …]`;
+lightweight `lightcraft-denoise-core` metadata and cache formats remain available without inference. Pictures are capped at 100 megapixels; at most
+four tile calls run together, chosen within the process-wide working-memory budget.
+One idle CPU workspace is retained, and cache costs reserve room for the blended picture.
+
+The GPU executor uses our WGSL kernels through wgpu. It checks a real model's output
+against the CPU and falls back on errors, unsupported networks or a slower device.
+Setup has a time limit and a crash marker. Automatic selection estimates throughput
+from a check tile; this estimate can choose imperfectly on unmeasured hardware.
+Settings offers Automatic, Graphics card and Processor. GPU tests cover supported
+synthetic networks against the scalar executor; a real-model test compares CPU/GPU.
+
+The convolution kernel stores its shared input tile as scalar elements, each with
+one writer, and gathers vectors after a workgroup barrier. Writing separate lanes
+of the same shared vector from different invocations is not safe under WGSL
+([component references](https://www.w3.org/TR/WGSL/#vector-component-reference));
+this caused incorrect Metal results (issue #479). Synthetic equivalence tests include
+repeated partial tiles and concurrent calls, and reject non-finite outputs.
+
+### Historical performance, measured 2026-10-07
+
+These are the contributor's measurements **before the current upstream integration**,
+on a Ryzen 9 7945HX and RTX 4090 Laptop GPU (DX12), release build, model SHA-256
+`da27509dab6a2915da67e988acd86cf71f9d5bbc8d1aa0ed32933578a887b901`.
+The 24.34 MP Sony a7 III photo is 35 tiles. Numbers exclude model loading, source
+decode, GPU setup, cache encoding and export, but include packing and blending.
+
+| Work | Pure-Rust CPU | Prior Tract reference | GPU |
+|---|---:|---:|---:|
+| One warm 512-cell tile, one caller | 1148 ms | 1463 ms | 15.1 ms |
+| Whole photo, 16 CPU / 4 GPU feeding workers | 5.185 s | 9.534 s | 0.582 s |
+
+The largest relative differences were 1.68e-6 CPU/reference and 1.57e-6 CPU/GPU for
+the check tile, below the required 1e-3 tolerance. Reference comparisons were made
+on the older contributor branch; that reference runtime is intentionally excluded
+from the current workspace. These numbers are not a fresh benchmark of this rebase.
+
+Fresh checks can be run using an already installed model and CC0 raw samples:
+
+```text
+LC_DENOISE_MODEL=<model.onnx> cargo test --release -p lightcraft-gpu --lib real_model_on_the_gpu_matches_cpu -- --ignored --nocapture
+LC_DENOISE_MODEL=<model.onnx> LC_DENOISE_RAW=<corpus/raw> cargo test --release -p lightcraft-engine --features rawnind-model --test denoise_cpu -- --ignored --nocapture
+LC_DENOISE_MODEL=<model.onnx> LC_DENOISE_RAW=<corpus/raw> cargo test --release -p lightcraft-engine --features rawnind-model --test denoise_real -- --ignored --nocapture
+```
+
+## Commands and limits
+
+UI, CLI, control channel and MCP dispatch `denoise.toggle`, `denoise.settings`,
+`denoise.queue`, `.cancel`, `.status`, `.pump`, `.clear`, and `denoise.models.*`
+(`list`, `install`, `download`, `downloads`, `downloadCancel`, `test`, `remove`,
+`select`). The develop control is `enhance.denoise`.
+
+Native apps enable inference through their `denoise` feature. A build without it and
+the web build report inference unavailable. Manifest/cache primitives still compile
+for WASM. Settings and models remain opt-in; nothing is downloaded on launch.
+
+This implementation supports **Bayer RAW only**. X-Trans, Foveon, demosaiced DNG and
+non-RAW images remain unsupported by this model contract. No measured quality parity
+with Lightroom is claimed. Apple/Metal and wider hardware verification, model policy,
+a linear-RGB contract and a side-by-side fidelity suite remain future work.

docs/display-profiles.md

@@ -0,0 +1,44 @@
+# Display (monitor) profiles
+
+LightCraft can show photos through the monitor's ICC profile, so colours are right on wide-gamut and calibrated
+displays. Without one, previews are sRGB, which a wide-gamut panel shows oversaturated.
+
+## Using it
+
+Settings ▸ Display ▸ **Choose Profile…** picks an `.icc` / `.icm` file (the dialog opens where the system keeps
+them: `~/.local/share/icc` on Linux, ColorSync's folders on macOS, `…\spool\drivers\color` on Windows). **Use sRGB**
+goes back to no profile. The choice is an app setting (`ui.json`, `displayProfile`) and applies at once; a file that
+can't be used is reported there and previews stay sRGB.
+
+Agents and scripts: `app.displayProfile {"path": "/path/to/monitor.icc"}` (`""` or `null`: none; no `path`: report
+only) returns `{path, description, kind: "matrix" | "lut", primaries: {red, green, blue: [x, y]}}`.
+
+## How it works
+
+- **The loupe renders into the display's gamut.** Views (Detail, Before, Compare / Reference, preset and profile
+  hover, the second window) ask the pipeline for a render in the display's own primaries
+  (`lightcraft_pipeline::DisplaySpace`, `RenderRequest::display`): the per-pixel stage converts from the working space
+  to the display's linear RGB, gamut maps into *its* gamut and encodes with the sRGB curve, on the CPU and the GPU
+  alike (only `FinishParams::to_out` / `out_luma` change). Colours an sRGB render would clip stay as saturated as the
+  display can show. For a display that is exactly a standard space the result equals an 8-bit render into that space.
+- **Then to the display's device values** (`lightcraft_codecs::display::DisplayProfile::correct`): for a matrix/TRC
+  profile, three 256-entry tables from the sRGB curve to the profile's tone curves (nothing at all when they are the
+  sRGB curve, as for Display P3); for a LUT-based profile, a `moxcms` transform through its B2A tables. A LUT-only
+  profile (no colorant tags) gets its primaries measured through its A2B tables.
+- **Everything made for sRGB is converted** (`lightcraft_engine::display::present`, on the render workers):
+  thumbnails, cached view previews, embedded camera JPEGs and merge previews.
+- **What stays sRGB:** the histogram (of the same sampled pixels, converted back to sRGB), the rendered-thumbnail and
+  view-preview caches (a profile change doesn't invalidate them), exports, and the UI itself.
+- **Soft proofing:** the blue "display" gamut warning shows what the monitor can't show, from its profile.
+- Conversions are relative colorimetric: the display's white is the image's white.
+
+## Cost
+
+Measured on a 2-core cloud VM, 2560 × 1707 preview: the tone-curve tables take about 5 ms (single-threaded); converting the sampled
+histogram pixels a few ms; the sRGB copy for the view-preview cache (full-quality renders only) about 30 ms; a
+LUT-based profile's correction about 65 ms. Drafts during slider drags skip the full sRGB copy.
+
+## Not yet
+
+- Picking up the profile the operating system assigns (X11 `_ICC_PROFILE`, colord, ColorSync, WCS) and following
+  the window across monitors with different profiles.

docs/faces.md

@@ -0,0 +1,298 @@
+# Faces
+
+LightCraft reads the face names other apps (Lightroom, digiKam…) write into your photos, shows them in the loupe
+(boxes you can switch off, resize and remove) and groups photos by person in the People view. This page is about the
+*models* that find and recognise faces by themselves.
+
+## Nothing is bundled; every model is an opt-in download
+
+No model weights are part of LightCraft. Each one is a file you choose to get, from **Settings ▸ Faces**:
+
+- **Face detection:** [YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) (232 KB, MIT).
+  It runs in LightCraft's own code, with no extra runtime. It was trained on the WIDER FACE dataset; an MIT licence on
+  weights does not settle that dataset's terms, so this is flagged for the maintainer. It finds faces; it does not
+  identify anyone. **Photo ▸ Detect Faces** offers the download the first time you use it.
+- **Face recognition models** are large (AuraFace is 261 MB), and their licences and training data deserve a decision by
+  the person installing them. Everything works without one: names from XMP, the People view, the face boxes.
+- **Recognition runs in LightCraft's own pure-Rust CPU interpreter**, shared with the detector. Dense
+  convolutions use bounded im2col and single-thread float32 GEMM (ndarray 0.17.2 / matrixmultiply 0.3.11, MIT or Apache-2.0, default/BLAS/threading features disabled);
+  depthwise convolutions use row-wise Rust loops. There is no nested thread pool. No C or assembly is compiled by
+  this dependency path. Desktop and CLI builds always include recognition (there is no separate cargo feature for it). The browser retains its existing model-install/background-scan restrictions.
+
+### Supported graphs and limits
+
+The pinned SFace 2021dec and AuraFace v1 files both use ONNX opset 11. Their combined operators are **Conv** (including
+SFace's depthwise groups), **BatchNormalization**, **PRelu**, **Add**, **Sub**, **Mul**, **Dropout** (inference identity),
+**Flatten**, and **Gemm**. The shared engine also supports the detector's Relu, Sigmoid, MaxPool, nearest whole-number
+Resize, Transpose and constant-shape Reshape, plus GlobalAveragePool and Identity. This is a limited inference engine:
+other operators (including MatMul and Concat), custom domains, training graphs, unsupported attribute combinations,
+external/sparse weights and non-float32 inputs/outputs fail to load with an explicit error.
+
+Shapes and attributes are checked before installation's self-test, including all intermediates and the promised output
+size. Files are limited to 512 MiB, combined weights to 64 Mi elements (256 MiB of float32), rank to eight and live tensors plus
+retained convolution scratch to 512 MiB. All supplied weights and produced activations must be finite. Embeddings retain the
+manifest's RGB/BGR and mean/std preprocessing, and are normalized using a bounded float64 norm to avoid float32 overflow.
+
+The agreement figures below come from a one-off comparison against an independent ONNX reference runtime, run outside
+this repository; that tooling is not part of it, so those figures cannot be reproduced from here. What the repository
+does check is listed under "Agreement and regression coverage".
+
+## Downloading a model
+
+**Settings ▸ Faces ▸ Download** (or Photo ▸ Detect Faces, which offers it for the detector):
+
+1. A dialog shows the model's licence, whether commercial use is allowed, what it was trained on (or that this is not
+   known) and which site the file comes from. **Download stays disabled until you tick "I have read these terms and
+   accept them for my own use".** Nothing is fetched before that.
+2. LightCraft downloads the file from the model's own repository (GitHub for YuNet and SFace, Hugging Face for
+   AuraFace), at an address pinned to a commit, over https, in pure Rust (the `lightcraft-fetch` crate: no `curl`, no
+   OpenSSL). An interrupted download resumes where it stopped.
+3. The file must match the model's recorded size and SHA-256, or it is thrown away. A file that matches is installed
+   by itself. Nothing else is sent anywhere, and no token or account is involved.
+
+**Open page** opens the model's own page in your browser if you would rather get the file yourself.
+
+## Adding a model file yourself
+
+Adding a model is how you say you want it: once it is installed it is **chosen and recognition is switched on**, with no
+further step. The one question is its licence, and that comes first.
+
+1. **Settings ▸ Faces ▸ Add a model file…**, or drop a `.onnx` file on the window.
+2. LightCraft looks at the file (it never runs it at this point): it recognises models it knows by their SHA-256, and
+   for any other file it reads the input and output shapes and describes what it assumed (112 × 112 aligned faces,
+   RGB, `(x − 127.5) / 127.5`, one vector per face: the ArcFace convention that InsightFace models also use).
+3. The same dialog shows the licence, whether commercial use is allowed and what the model was trained on, and
+   **Install stays disabled until you tick the acceptance box**.
+4. The model is copied into LightCraft's models folder and checked against the original by hash.
+
+Non-commercial models (InsightFace, for example) can be added this way for your own use; LightCraft never bundles,
+hosts, downloads or links them from a picker, and the dialog says so.
+
+The newest model is the one in use. An earlier one stays installed, **Use** switches back, and each model keeps its own
+cache of embeddings (`face-embeddings-<model id>.bin` in the library folder), so going back does not start over. Removing
+the model in use hands over to another installed one. Results of the model that was running when you switched are
+discarded, never mixed into the new one's index.
+
+### Bring your own models: `catalog.json`
+
+LightCraft's built-in list only holds models whose terms let the project point at them. For anything else (a stronger
+recogniser whose weights are for research use, a model you trained, a mirror you trust) put a `catalog.json` in the models
+folder. Each entry is a model manifest plus the address to fetch it from, and it then gets the same **Download** button as
+a built-in model, with its licence notice shown before anything is fetched. LightCraft ships and links to none of them: what
+the file says, and whether you may use the weights, is yours to check (the dialog shows the notice you wrote, in a warning
+colour unless you marked the model `"commercial": "yes"`).
+
+```json
+{ "models": [ {
+    "id": "my-recogniser", "name": "My recogniser (R50)", "version": "1", "role": "embedder",
+    "url": "https://example.org/weights/recogniser.onnx",
+    "sha256": "(64 lowercase hex digits)", "sizeBytes": 166000000,
+    "licence": { "name": "Research use only", "commercial": "no", "notice": "Not for commercial use." },
+    "provenance": "Trained on ...",
+    "output": { "kind": "embedding", "dim": 512 },
+    "thresholds": { "matchCosine": 0.4 },
+    "speed": 1.7
+} ] }
+```
+
+`speed` is optional: how many times faster the model is than a ResNet-100 (1.7 for a ResNet-50, 7 for a MobileFaceNet; see the
+next section). Settings ▸ Faces shows it as "1.7× faster than a ResNet-100 model", also before the model is downloaded; leave it
+out if you have not measured it and nothing is shown. `input` may be left out (112 × 112 RGB, `(x − 127.5) / 127.5`, the ArcFace convention that InsightFace-style models use); say
+otherwise with `"input": {"width": 112, "height": 112, "colour": "bgr", "mean": [0,0,0], "std": [1,1,1]}`. `sha256` and
+`sizeBytes` are required (a download is checked against them), the address must be `https`, and the model must give one
+vector per face. A bad entry is reported in Settings ▸ Faces and skipped; the rest still load. The same file by hand
+(Add a model file…) is recognised by its hash and gets the terms you wrote. Models you cannot or do not want to list can
+still be added by file; non-commercial models are never offered by the built-in list.
+
+The models folder is `<config>/models` (`%APPDATA%\LightCraft\models` on Windows, `~/Library/Application Support/LightCraft/models`
+on macOS, `~/.config/lightcraft/models` on Linux), or `$LIGHTCRAFT_FACE_MODELS`. The desktop app, the CLI and the MCP
+server share it.
+
+## What is known about the models LightCraft recognises
+
+| Model | Licence of the weights | Trained on | Notes |
+| --- | --- | --- | --- |
+| YuNet 2023mar (detector) | MIT | WIDER FACE | 232 KB |
+| AuraFace v1 | Apache-2.0 | "a commercial dataset", undisclosed | 261 MB; the best measured on sculpted busts |
+| SFace 2021dec | labelled Apache-2.0 | undocumented (the upstream repository mentions CASIA-WebFace, VGGFace2, MS1MV2) | 39 MB; two questions about commercial use are unanswered upstream |
+
+"Commercial use allowed" in the dialog is the weights' licence; it says nothing about the training data.
+
+## How fast are the models
+
+The current pure-Rust runner was measured in standard release mode (no `target-cpu=native`) on Windows,
+Ryzen 9 7945HX, over **40 aligned photographic crops** from `corpus/public-faces` (public-domain sources in
+`SOURCES.tsv`). Each call runs on one thread. Preprocessing, inference and unit normalization are included;
+model loading, photo decoding, detection and alignment are excluded.
+
+| Model | Pure Rust / face (median) | Speed (R100 = 1×) |
+| --- | ---: | ---: |
+| SFace 2021dec (39 MB) | **33.82–36.29 ms** | **6.9×** |
+| AuraFace v1 (261 MB) | **233.18–252.14 ms** | **1×** |
+
+The ranges are medians from two runs (the rerun reproduced the same embedding errors).
+Five faces cost about **169–181 ms with SFace**, or **1.17–1.26 s with AuraFace**, just for recognition; ten faces cost
+338–363 ms / 2.33–2.52 s. Decoding, detecting and aligning the photo add to this. The background scan parallelizes photos
+using its existing bounded worker pools; the recognizer never creates an inner pool. These serial estimates do not imply
+whole-library throughput. Convolution dominates the profiled model time. Dense kernels lower at most 256 positions
+with contiguous plane copies and explicit border masks; depthwise kernels remain direct. CPU-dispatched Rust
+AVX-512 intrinsics improve supported x86 CPUs; other CPUs and wasm use the dependency's Rust fallback.
+AuraFace remains a costly CPU choice (its load time is 120–172 ms).
+
+SFace's builtin speed metadata now uses the measured 6.9× ratio. User `catalog.json` ratios remain user-provided.
+Older published tables for MobileFaceNet/R50/R100 came from a different runtime and are not measurements of this runner; architecture
+names alone do not guarantee the same speed, and those additional model files were not verified in this task.
+
+### Agreement and regression coverage
+
+The public-crop embeddings match the reference runtime's outputs:
+
+| Model | Maximum absolute component difference | Mean absolute difference | Minimum cosine | Mean cosine |
+| --- | ---: | ---: | ---: | ---: |
+| SFace | 2.0266e-6 | 2.0542e-7 | 0.999999999992 | 0.999999999994 |
+| AuraFace | 1.2219e-6 | 1.2725e-7 | 0.999999999990 | 0.999999999993 |
+
+Maximum component difference relative to the largest reference component was 8.60e-6 / 7.10e-6, below 1e-3.
+Twenty seeded synthetic recognition nets also agree (maximum absolute embedding difference 7.45e-7).
+Unit regressions cover normalization, PReLU broadcasting, transposed Gemm/optional bias, odd grouped convolutions,
+reuse of padding, retained scratch/constant-copy limits, invalid manifests, overflow, concurrent calls, and malformed/truncated/ambiguous ONNX fields.
+These establish inference agreement, not face-identification accuracy or Lightroom parity.
+
+The shared YuNet graph is also compared against the reference runtime on four synthetic pictures. It passes an absolute
+1e-6 plus relative 1e-3 tolerance. The reference's sigmoid uses a clamped rational approximation; LightCraft keeps its existing
+exponential sigmoid. Tiny confidence outputs differ by at most 4.47e-7 absolute (6.44% relative on the blank picture),
+far below the 0.6 detection threshold. Neither pinned recognizer uses Sigmoid. No approximate activation or reduced
+precision was introduced to get the speed figures.
+
+`LC_FACE_MODELS=<folder> cargo test --release -p lightcraft-faces runtime::tests::real_models_pass_the_self_test -- --ignored --nocapture`
+runs the installation checks against locally supplied, hash-recognized model files. Models/crops stay out of git.
+
+### And how well do they recognise?
+
+Published numbers only, each copied from the model's own page (we have not re-run them). Higher is better. They are
+standard face-verification benchmarks: **IJB-C** (hard, mixed-quality photos; true-accept rate at one false accept in
+10,000), **CFP-FP** (frontal against profile) and **AgeDB-30** (years apart), both in percent.
+
+| Model | Speed (R100 = 1×) | IJB-C | CFP-FP | AgeDB-30 | Source |
+| --- | --- | --- | --- | --- | --- |
+| MobileFaceNet (InsightFace buffalo_s / buffalo_sc) | 7× faster | 95.02 | 98.00 | 96.58 | InsightFace model zoo |
+| SFace (OpenCV Zoo) | 6.9× faster (current Rust) | not given | not given | not given | OpenCV Zoo says 0.9940 on a set it does not name |
+| ResNet-50 (InsightFace buffalo_l) | 1.7× faster | 97.25 | 99.33 | 98.23 | InsightFace model zoo |
+| ResNet-100 (AuraFace v1) | 1× | not given | 95.19 | 96.10 | its Hugging Face page |
+| TopoFR R50 / R100 / R200 (Glint360K) | 1.7× / 1× / 0.5× | 97.27 / 97.60 / 97.84 | not given | not given | TopoFR repository |
+
+Read with care: the sources report different sets, so the blanks are not zeros and the rows are not all on the same
+yardstick. What the numbers do say: a ResNet-50 recogniser is about two points above a MobileFaceNet on IJB-C, a ResNet-100
+or 200 adds only a few tenths more, and AuraFace's published CFP-FP and AgeDB-30 are below buffalo_l's ResNet-50 despite being
+a ResNet-100 (so it is not the accuracy choice its size suggests). InsightFace's pretrained weights are, in its own words,
+"available for non-commercial research purposes only"; TopoFR's page states no licence for its weights.
+
+## Finding faces yourself
+
+**Photo ▸ Detect Faces** (`faces.detect`) runs the YuNet detector on the selected photos and adds what it finds as
+unnamed face boxes, in one undo step. A new run replaces earlier detections; boxes that came from XMP, or that you drew or
+named, are never touched (and a face that already has one is not boxed a second time), and no sidecar is written. It looks at the photo upright and uncropped with default settings,
+so your edits and crops do not matter. `apply: false` only reports. It finds faces of about 10 pixels and up in a
+640-pixel version of the photo (so very small faces in a large group photo can be missed; looking at tiles is planned).
+The detector's output matches OpenCV's own YuNet on a 45-photo public-domain test set (97 of 99 faces found by both,
+mean box overlap 0.97), including marble busts and paintings, with no false boxes on the landscape and architecture
+photos in the set.
+
+## Suggesting who is in a photo
+
+With **Recognise faces** switched on in Settings ▸ Faces and a recognition model chosen (**Use**), LightCraft works out, in
+the background, what each face in your library looks like to the model, and uses the faces you have already named to
+suggest names for the ones you have not:
+
+- An unnamed face with a good match gets a dim label such as **Jane Doe?** in the loupe. Click it and the name box opens
+  with the guess filled in; Enter confirms. Any other unnamed face shows **Add name** when you point at it. Clicking a name
+  lets you change it, and clearing the box removes it. Typing completes from the people you have already named.
+- **Nothing is ever named for you.** A suggestion is only a label until you confirm it, and a suggestion appears only when
+  the match is strong *and* clearly ahead of the next person: it is better to leave a face unnamed than to name it wrongly.
+  Naming a face also makes it one of the faces the others are compared with, so the suggestions improve as you go.
+- Faces come from the names other apps wrote into your photos (read from XMP), from Photo ▸ Detect Faces, or both. A face is
+  aligned using the detector's five landmarks (eyes, nose, mouth corners) when it finds the same face, and cut out by its box
+  otherwise.
+- Everything stays on your computer. The embeddings (one short list of numbers per face) are cached in the library folder in
+  `face-embeddings-<model id>.bin`, one file per model, so switching models back and forth does not start over; they are
+  not part of the catalog and not written to XMP.
+
+### The background scan
+
+Turning recognition on starts a scan of the whole library, once, in the background:
+
+- A photo that already has face boxes (from XMP, or drawn, or named) has its faces embedded.
+- A photo with **no** face boxes at all is searched with the detector, and what it is sure of becomes that photo's unnamed
+  face boxes (marked "Detected by YuNet", so a manual Detect Faces replaces them), embedded in the same pass. Photos are
+  searched once: `face-scanned.bin` in the library folder remembers which, so a photo whose boxes you remove is not boxed
+  again. These boxes are LightCraft's own bookkeeping: not an undo step, never written to a sidecar.
+- Photos you have named faces in go first, then the rest. Raw files are read through the camera's embedded preview (much
+  faster than decoding the raw); everything else is rendered at 2048 pixels.
+- **How hard it works follows what you are doing.** The app tells the engine on every call to `faces.pump`, which is made
+  about 20 times a second while there is work and a few times a minute otherwise (the window is not redrawn for it at any
+  other time). Dragging, typing or scrolling: nothing new is started. The pointer moving, or the window minimized:
+  **light**, one photo at a time on two threads. Idle for three seconds, or the window still on screen but with another
+  app in front (you are working elsewhere): **normal**, half of the processor's threads. Idle and looking at the progress
+  (Settings ▸ Faces, or the People view): **full**, four fifths. Photos already running are never interrupted, and a
+  change of pace takes effect at once.
+- **Threads and photos.** Most of a photo's cost is its parallel work (decoding, developing the picture), so the pace sets the
+  size of a pool of threads for that work: two, half the machine, four fifths. The scan has pools of its own, not the one the
+  loupe and exports use (which has no priorities), so a slider drag never queues behind a scan. Earlier measurements (with a different runner) on a 32-thread
+  desktop with 4 photos at once: about 6.4 photos a second at full pace (a pool of 25 threads), 6.0 at normal (16) and 1.8
+  when light (2 threads).
+- **Memory** limits the number of photos at once as much as the processor does: a photo in progress holds about 180 MB
+  (peak memory grew by that much per extra worker), so at most half of the memory budget (a quarter of the RAM, at most
+  1.5 GiB, unless `LIGHTCRAFT_MEMORY_MB` says otherwise) is given to them: about four photos at once on a default setup,
+  whatever the core count. Eight at once was not much faster and needed about twice the memory (a 2.0 GB peak against
+  1.1 GB). `LIGHTCRAFT_FACE_THREADS` replaces these limits with a number of your own. A couple more photos wait behind
+  the running ones, so a worker that finishes has its next photo at once.
+- **Earlier scan speed (a different runner).** A mixed raw and JPEG library of 184 photos (the raws read through their embedded previews, 73 photos searched
+  for faces) took about 29 seconds on that machine at full pace: roughly 6 photos a second, so the first scan of 10,000 photos
+  is a matter of half an hour; after that only new photos are looked at. Settings ▸ Faces shows how many are left, with a progress bar, and the activity stack shows "Finding faces" meanwhile. After you accept a model's terms
+  you are returned to that tab, so the download and then the scan can be watched there; the main window has no status bar.
+- Opening another library starts a fresh scan state; nothing learned about one library is used in another.
+
+### The People view
+
+Until recognition is set up, a line at the top says what it takes and has one button: **Set up face recognition** (no model
+yet: it opens Settings ▸ Faces, where the download is) or **Turn on** (a model is installed, recognition is off: it switches it
+on there and then). The loupe's name box offers the same ("Set up name suggestions…" / "Turn on name suggestions"), and so
+does a person's page.
+
+**People** shows a card for each named person (their face, with the number of photos they are in on the picture) and, below
+a line, the **Unnamed faces**: every face nobody has named, as cropped pictures. With recognition running, faces that look
+alike are next to each other (put in order by looking at every pair, for up to the first 1,500 embedded faces), and a face
+the named ones recognise carries the name they suggest along its bottom edge; click that name to accept it for that face.
+To name a group: click faces to select them (Shift-click selects a range, **Select all** takes every one listed), type a
+name in the bar that appears (people already named complete as you type), press Enter: all of them are named at once, as
+one undo step. Selecting names nothing.
+
+The thumbnail-size slider in the bottom bar sizes the faces here too, with limits of their own. Every face is shown by the
+same kind of box: the detector's own box once the scan has looked at it (kept beside its embedding), so a loosely drawn box
+from another tool does not make one face look farther away than the next; before the scan has looked at a face it is shown
+by its own box.
+
+### A person's page
+
+In **People**, a click on a person opens their page: **only cropped faces**, never whole photos. First the faces named
+with their name (a click opens that photo), then **More**: the unnamed faces that look like them, most alike first. Click one
+to confirm it (that names the face, as one undo step, and it moves up into their faces), or × to hide it for this session.
+**Show photos** puts their photos in the grid; **‹ People** or Escape goes back. "More" only holds faces the scan has
+already embedded, so it fills in as the scan goes; it shows faces scoring above four fifths of the model's suggestion bar,
+since you look at each one before anything is named.
+
+How well it works: on 755 named faces of marble busts from one museum folder (each face hidden in turn and matched against
+shots taken more than five seconds apart), SFace named the right person first 95.5% of the time and AuraFace 94.7%; at
+the starting thresholds LightCraft suggests (SFace 0.55, AuraFace 0.40) about 97% of the suggestions were right. Busts are
+a hard case in some ways (no skin or hair to go by) and an easy one in others (the same sculpture looks the same in every
+shot), so check a model on your own photos before trusting it:
+
+`faces.evaluate` tests a model on *your* photos: it hides each named face in turn, asks who it looks like from the others
+(ignoring shots taken within a few seconds of it, which would make it too easy) and reports, for each threshold, how many
+suggestions it would make and how many were right.
+
+## Commands
+
+All of this is reachable from the control channel, the CLI and MCP: `faces.models.list`, `faces.models.inspect {path}`,
+`faces.models.install {path, acknowledged: true, activate?}`, `faces.models.download {id, acknowledged: true}` (then `faces.models.downloads`, which also installs what has arrived, and `faces.models.downloadCancel {id}`), `faces.models.remove {id}`, `faces.models.select {id}`,
+`faces.enable {enabled?}`, `faces.detect {ids?, apply?}`, `faces.index {budgetMs?, ids?}`, `faces.pump` (what the app calls every frame), `faces.suggest {ids?, threshold?, margin?}`, `faces.person {name, more?}` (a person's faces and the unnamed faces that look like them), `faces.unnamed {limit?}` (every unnamed face, look-alikes together, with suggested names), `faces.setName {id?, index, name}`, `faces.nameFaces {faces: [{photo, index}], name}` (name many at once, one undo step) and `faces.evaluate`. `acknowledged` must be `true`: the caller has shown the user the terms and the user agreed. Installing makes the model the one in use and switches recognition on unless `activate` is `false`.

docs/file-format-parity.md

@@ -0,0 +1,79 @@
+# File format parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created; formats measured from the code and the target's Info.plist) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+Every format Lightroom reads or writes, with our support, fidelity and tests. Camera raw formats are
+deep enough to have their own document: [raw-parity.md](raw-parity.md).
+
+**How measured:** the target's document types come from the installed Lightroom 9.6
+`Info.plist` (`CFBundleDocumentTypes`: catalog `mcat`, `xmp`, toolkit / module / library bundles, and
+the raw-and-image list: jpg, tif, dng, heic and 27 raw extensions) plus Lightroom Classic's documented
+import and export formats. Ours come from `crates/codecs/src/sniff.rs`, `crates/codecs/src/encode.rs`,
+`crates/engine/src/export.rs`, `crates/engine/src/import.rs` and the tests named below.
+
+## Images (non-raw)
+
+| Format | Target reads | Target writes | LightCraft reads | LightCraft writes | Notes / tests |
+|---|---|---|---|---|---|
+| JPEG | ✅ | ✅ | ✅ (parallel decoder, ICC, EXIF orientation) | ✅ quality, size limit, ICC, metadata | `crates/codecs/src/jpeg.rs`, export tests |
+| TIFF | ✅ 8/16/32-bit | ✅ 8/16-bit, LZW/ZIP | ✅ 1–64-bit integer, 16–64-bit float, bilevel, CCITT fax, WhiteIsZero | ✅ 8/16-bit, 32-bit float linear, none / LZW / ZIP | `crates/tiff`, `crates/codecs/src/tiff_codec.rs` |
+| PNG | ✅ | ✅ | ✅ | ✅ | |
+| PSD / PSB | ✅ (maximized-compatibility composite) | ✅ (Classic: PSD export, edit-in round trip) | ✅ merged composite | ⬜ (external-editor round trip writes 16-bit TIFF) | `crates/codecs/src/psd.rs` |
+| HEIC / HEIF | ✅ | ⬜ (Classic) / HDR only | ✅ in every release build (`crates/heif`, heic-rs) | ⬜ | `heif` feature on by packaging scripts |
+| AVIF | ✅ | ✅ (HDR) | ⬜ recognised, not decoded (no permissive pure-Rust AV1 decoder) | ✅ 8/10-bit, PQ HDR | |
+| JPEG XL | ✅ | ✅ | ✅ (`jxl-oxide`) incl. DNG 1.7 JXL tiles | ⬜ | |
+| WebP | not in its document types | ⬜ | ✅ | ✅ | beyond target |
+| GIF, BMP | ⬜ | ⬜ | ✅ | ⬜ | beyond target |
+| DNG (from raw) | ✅ | ✅ incl. lossy, embedded original | ✅ | ✅ uncompressed or LJ92; ⬜ lossy DNG, embedded original | `crates/raw/src/dngwrite.rs` |
+| Render to DNG (15.5) | — | ✅ | — | ⬜ | new in Classic 15.5 |
+| Original + sidecar | — | ✅ | — | ✅ | |
+| HDR gain map JPEG (ISO 21496-1) | ✅ | ✅ | ✅ (gain map read) | ✅ | `crates/codecs/src/gainmap.rs` |
+| PQ / HLG HDR | ✅ | ✅ AVIF, JXL, TIFF | — | 🟡 PQ AVIF, float TIFF; no HLG | |
+| Contact sheet / print PDF | — | ✅ (Print module: PDF / JPEG / printer) | — | 🟡 paginated contact-sheet PDF (A4 / Letter, 150 dpi, sRGB) | `crates/engine/src/contact_sheet.rs` |
+| Video (MP4, MOV, AVCHD…) | ✅ playback, trim, edit | ✅ export | 🟡 catalogued (kind, duration) | ⬜ | see video gap |
+
+## Colour spaces and profiles
+
+| Feature | Target | LightCraft |
+|---|---|---|
+| Export colour spaces | sRGB, Adobe RGB, Display P3, ProPhoto, Rec.2020, custom ICC | ✅ sRGB, Display P3, Adobe RGB-compatible, ProPhoto, Rec.2020 with gamut mapping (CPU and GPU), embedded ICC; ⬜ custom ICC output profiles; AVIF stays sRGB |
+| Input ICC (JPEG / TIFF / PNG) | ✅ | ✅ matrix / TRC and LUT profiles (moxcms) |
+| Soft proofing with printer profiles | ✅ | 🟡 |
+
+## Metadata, sidecars, presets and catalogs
+
+| Format | Target | LightCraft | Notes |
+|---|---|---|---|
+| XMP sidecars (`crs:` develop settings, ratings, keywords, regions) | read / write | ✅ read / write, manual (⌘S) and automatic | [xmp-interop.md](xmp-interop.md) |
+| EXIF / IPTC / XMP embedded on export | ✅ | ✅ with metadata filters | `crates/meta` |
+| Develop presets `.xmp` | ✅ | ✅ import (mapping of supported settings) | |
+| Legacy presets `.lrtemplate` | ✅ (converted) | ✅ import | |
+| Camera / creative profiles (`.dcp`, `.xmp` profiles) | ✅ | ⬜ deliberately (Adobe profile formats are never used); `.cube` LUT profiles ✅ | |
+| Lens profiles `.lcp` | ✅ | ⬜ deliberately | |
+| Other apps' presets | — | ✅ Luminar `.lmp` / `.mplumpack`, `.zip` bundles | beyond target |
+| Lightroom Classic catalog `.lrcat` | native | 🟡 import (ratings, flags, labels, keywords, collections, virtual copies, supported develop settings; read-only pure-Rust SQLite incl. WAL) | [lightroom-catalog-import.md](lightroom-catalog-import.md) |
+| Lightroom (cloud) library `.lrlibrary` | native | ⬜ | cloud library format, local cache only |
+| Write back to `.lrcat` | native | ⬜ (one-way migration by design) | |
+| Keyword lists (text) | import / export | ✅ | |
+| GPX track logs | ✅ | ✅ | `crates/meta/src/gpx.rs` |
+| Export presets, metadata presets, filename templates | ✅ (`.lrtemplate`) | ✅ own JSON | not interchangeable |
+| Lightroom plug-ins (`.lrplugin`, `.lrdevplugin`) | ✅ | ⬜ | see ecosystem in [target-app-parity.md](target-app-parity.md) |
+
+## Scores
+
+| Part | Weight | Ready for real work | Kind |
+|---|---:|---:|---|
+| Standard image import / export | 35% | ~85% | estimated (table above; missing: AVIF read, JXL / PSD write, lossy DNG) |
+| Sidecars, metadata, presets | 25% | ~85% | estimated |
+| Lightroom catalog migration | 25% | ~50% | estimated (one-way, approximate rendering of unsupported settings) |
+| HDR, print, video output | 15% | ~35% | estimated |
+| **Non-raw file formats** | 100% | **~70%** | estimated; raw is in [raw-parity.md](raw-parity.md) (~50%) |
+
+Remaining: **30–55 h** (AVIF decode 8–15 h if a permissive decoder is written or found; JXL encode
+4–8 h; PSD write 4–8 h; lossy DNG and Render to DNG 4–8 h; HLG 3–5 h; catalog import depth 8–12 h).
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the code and the installed Lightroom's document types |

docs/gaps.md

@@ -0,0 +1,77 @@
+# Gaps: where LightCraft falls short of Lightroom
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created; absorbs the checklist's Top gaps and the ROADMAP's honest assessment, re-ranked after a full re-measure) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+Every known shortfall, one entry each, ranked by user impact (how many Lightroom users hit it, and
+how hard it blocks them), then by effort. **Agents pick work from the top** (the first entry nobody is
+working on). When you close a gap, delete or shrink its entry, update its rows in
+[parity-checklist.md](parity-checklist.md), and the numbers in [target-app-parity.md](target-app-parity.md)
+and [ROADMAP.md](../ROADMAP.md) if they move.
+
+Hours are Opus 5.5 agent wall-clock hours (see [target-app-parity.md](target-app-parity.md#how-hours-are-calibrated)).
+`B` marks a gap that blocks **beta**.
+
+## Ranked
+
+| # | Gap | Evidence | User impact | Hours | Doc |
+|---:|---|---|---|---:|---|
+| 1 B | **Camera colour is estimated, not measured** (LR-PROF-CAMERACOLOR). Raws start from a per-file fit to the camera JPEG, 4 bundled profiles or 52 spectral matrices; others use a neutral matrix | ΔE vs camera JPEG 2.9–10 after fitting (raw-parity.md); 0 chart-calibrated models vs 1,500 Adobe Standard profiles | every raw shooter sees colour that is close but not Lightroom's; some get neutral-matrix colour | 50–90 | [raw-parity](raw-parity.md#colour) |
+| 2 B | **CR3 beyond three verified bodies** (LR-IMP-FORMATS): CRX variants other than those verified on M50 / R100 / R8 fall back to the preview; CR3 sRAW / mRAW and HEIF CR3 too | measured: Canon is the largest bucket (33% of photographers) and its share whose camera fully works is the lowest of the big four, 72%; 17 of 22 popular Canon bodies write CR3, 2 verified (raw-parity.md) | +6.5 points of photographers whose camera works, the biggest single raw gain | 25–45 | [raw-parity](raw-parity.md#remaining-work-ranked-by-photographers-unlocked-per-hour) |
+| 3 B | **Render fidelity unmeasured** (LR-BEHAV-RENDER-FIDELITY): tone, highlights, texture / clarity / dehaze, NR and sharpening are tuned by eye | no side-by-side suite; a retune needs a new process version (only V1 exists) | edits imported from Lightroom look different; the look "isn't Lightroom's" | 30–60 | [raw-parity](raw-parity.md), [process-versions](process-versions.md) |
+| 4 B | **Original-pixel detail at 100%** (LR-VIEW-ZOOM, P0): the whole-image preview is capped (2,560 px default); compare, overlays and soft proofing lack sharp zoom windows (#323) | checklist row 🟡 | checking focus, the first thing culling needs, isn't reliable on large files | 8–15 | [ui-parity](ui-parity.md) |
+| 5 B | **AI masks: Subject, Sky, People, Background, Landscape** are heuristics; Object / Describe run SAM 3 but its download has no mirror configured | `crates/segment`; ai-masks.md; MASK rows 67% | masking is how most Lightroom users edit today | 40–70 + model decision | [target-app-parity](target-app-parity.md#ai) |
+| 6 B | **Compressed ORF** (every Olympus / OM body since ~2008) | measured: 66 of 78 Olympus / OM models preview-only; `orf.rs` refuses; OM bucket 3% of photographers, 3% of them fully work | +2.6 points; best gain per hour of any raw gap (~0.2) | 8–15 | [raw-parity](raw-parity.md) |
+| 7 | **Nikon High Efficiency NEF** (HE / HE★ on Z 8, Z 9, Z 6III, Z f, Z50II, Z5II when set to HE) | named and preview only (#193); needs a pure-Rust JPEG XS decoder | +1.1 points (only shots taken in HE; lossless works on the same bodies); low gain per hour (~0.04), so not a beta blocker | 20–40 | [raw-parity](raw-parity.md) |
+| 8 B | **No lens profile database** (LR-EDIT-OPTICS-PROFILE): only DNG opcodes, RW2 in-file distortion and Sony ILCE-7RM4A distortion | Adobe ships 3,635 lens profiles; we never use them | distortion / vignetting correction is a default step for many | 40–80 + calibration shots | [raw-parity](raw-parity.md#lens-profiles) |
+| 9 B | **Tests don't run in CI on macOS, Windows or Linux x64**: only FreeBSD runs `cargo test`; the others build packages | `.github/workflows/` (freebsd, packaging-lint, release, windows-arm64) | regressions reach users on the main platforms; `cargo xtask ci` runs only locally | 6–12 | [target-app-parity](target-app-parity.md#by-dimension) |
+| 10 B | **Per-model verification thin, plus cheap per-body decode fixes**: 234 of 1,446 Adobe models verified (16%), ~40% of photographers on a verified body; Nikon 5 bodies verified, Canon 11. Cheap fixes: Z 6II packed 14-bit NEF (#769, PR #671), Sony A100 / F828 regression (#702), DSLR-A200…A390 / A850 12-bit ARW (#535) | measured: [raw/coverage.tsv](raw/coverage.tsv) | per-body bugs (levels, crops, WB) surface only from users | 25–45 | [raw-parity](raw-parity.md#by-maker-measured) |
+| 11 | **Enhance: Raw Details, Super Resolution; AI denoise without shippable weights or X-Trans** | ENH rows 0%; denoise Bayer only, RawNIND weights GPL and opt-in | Fujifilm users get no AI denoise; nobody gets it out of the box | 30–60 + model decision | [raw-parity](raw-parity.md#demosaic-levels-crops-and-lens-metadata) |
+| 12 | **Content-aware / generative remove, detect distractions, reflections removal** | REM rows 75%; patch synthesis missing | cleanup work goes back to Photoshop | 25–45 (+ generative model) | [target-app-parity](target-app-parity.md#ai) |
+| 13 | **Lightroom catalog migration is one-way and approximate**: unsupported Adobe profiles / AI settings archived, history kept as data | lightroom-catalog-import.md | switching users lose some looks | 8–12 | [file-format-parity](file-format-parity.md) |
+| 14 | **HDR display** (EDR / Windows HDR); HLG; HDR settings from `crs` XMP | HDR rows 70%; LR-VIEW-HDR-DISPLAY ⬜ | HDR editing works blind on HDR monitors | 12–25 | [hardware-parity](hardware-parity.md) |
+| 15 | **Print module**: custom packages, printer colour management (contact-sheet PDF only) | LRC-PRINT rows | Classic users who print | 25–40 | [target-app-parity](target-app-parity.md#features) |
+| 16 | **Map view, Book, Slideshow module, publish services** | LRC-MAP / BOOK / SS rows ⬜ | Classic users; publish services matter for Flickr / SmugMug workflows | 60–100 | [target-app-parity](target-app-parity.md#features) |
+| 17 | **Tethered capture** | ⬜ | studio photographers | 25–45 + cameras | [hardware-parity](hardware-parity.md) |
+| 18 | **Video**: playback, trim, global edits, export | VID rows 0% | users who mix stills and clips | 25–45 | [target-app-parity](target-app-parity.md#features) |
+| 19 | **Plug-in ecosystem**: no Lightroom SDK equivalent (export / publish plug-ins, metadata plug-ins) | ⬜ | pro workflows built on plug-ins (LR/Enfuse, Jeffrey's exporters, Negative Lab Pro) | 40–80 + owner decision | [target-app-parity](target-app-parity.md#by-dimension) |
+| 20 | **Long-tail raw formats**: compressed SRW, ARQ pixel shift, IIQ, Hasselblad compression, X3F, CRW, MRW, ERF, KDC, DCR, MEF, GPR, old FinePix | raw-parity.md | small user share each | 45–85 | [raw-parity](raw-parity.md) |
+| 21 | **Localization**: 9 of 15 shipped languages partial (74–99% of catalog messages), lower-layer errors English; Hindi, Arabic, Indonesian, Korean, Vietnamese absent; no RTL or complex shaping | measured from catalogs | non-English users see mixed English | 55–90 (shipped to full); 145–255 (five new) | [localization-parity](localization-parity.md) |
+| 22 | **Pen pressure**, OS monitor profiles, follow-window colour | hardware-parity.md | brush users with tablets; multi-monitor setups | 11–22 | [hardware-parity](hardware-parity.md) |
+| 23 | **Accessibility** audit with screen readers; canvas tools keyboard-reachable | LR-BEHAV-ACCESS 🟡 | blind and low-vision users | 10–20 | [ui-parity](ui-parity.md) |
+| 24 | **Brush live preview and masking feel** (#517, #518); Feather / Edge mask refinement (15.5) | issues | masking feels slower than Lightroom | 8–12 | [ui-parity](ui-parity.md) |
+| 25 | **File writes**: JXL encode, PSD export, lossy DNG, Render to DNG; AVIF import | file-format-parity.md | interchange edge cases | 25–45 | [file-format-parity](file-format-parity.md) |
+| 26 | **Performance at scale**: 85k-photo library opens in 1.7–4.7 s; 100k grid test pending; colour NR at half resolution | ROADMAP log, gpu-pipeline.md | large-catalog users | 15–30 | [target-app-parity](target-app-parity.md#by-dimension) |
+| 27 | **Windows / Linux runtime coverage**: Windows installer UI unverified on Windows (#79); GPU path proven on Apple only | ROADMAP, issues | non-Mac users find bugs first | 15–30 | [hardware-parity](hardware-parity.md) |
+| 28 | **Small Classic shortcuts and keys**: rating `[` `]`, flag cycling, filter-bar keys, F1 help, panel keys (Tab, F5–F8) | [ui-parity](ui-parity.md#shortcuts) | Classic muscle memory | 4–8 | [ui-parity](ui-parity.md) |
+
+Beta-blocking gaps (B) total **~230–430 h**; with the stability and platform work they need around them,
+**~340–600 h** to beta (incl. 40–80 h for the ~92 open core-path user issues) (see [target-app-parity.md](target-app-parity.md#stage)).
+
+## Gaps by kind
+
+- **Feature:** 5, 8, 11, 12, 13, 15, 16, 18, 19
+- **UI / UX:** 4, 23, 24, 28
+- **File format:** 2, 6, 7, 10, 13, 20, 25 (raw ones in [raw-parity.md](raw-parity.md))
+- **Hardware:** 14, 17, 22, 27
+- **Localization:** 21
+- **Quality / fidelity:** 1, 3
+- **Stability and platforms:** 9, 26, 27
+
+## Closed recently (kept for calibration)
+
+- 2026-10-10: Nikon lossy-after-split NEF (#633), ORF 12.8 bpp (#651), HDR gain map / PQ AVIF / float
+  TIFF export (#646), activity stack (#345).
+- 2026-10-09: HEIC in release builds (#609), Samsung uncompressed SRW (#459), contact-sheet PDF (#563),
+  Ukrainian UI (#564), Sony ILCE-7CR profile.
+- 2026-10-08: CR3 CRX lossless and C-RAW (#279), Fujifilm compressed RAF (#282), AI RAW denoise (#384),
+  Lightroom catalog import (#218), German, Spanish, Russian UI.
+- 2026-10-07: RW2 every format (#215), faces recognition in pure Rust (#174).
+- 2026-10-05: compressed NEF (#86). The older history is in [ROADMAP.md](../ROADMAP.md#progress-log).
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | RAW gaps re-measured model by model (raw-parity.md): CR3, compressed ORF and verification entries carry measured shares; HE NEF no longer a beta blocker (+1.1 points for 20–40 h); verification entry absorbs the cheap per-body fixes (#769, #702, A200 series) |
+| 2026-10-10 | minor | Beta total raised to 340–600 h to include the ~92 open core-path user issues |
+| 2026-10-10 | major | Created from the checklist's Top gaps (whose items 1–2 had been duplicated by a merge) and ROADMAP's Where we stand; re-ranked; added evidence, impact, hours and beta flags; added platform-CI, lens-database, HE NEF and localization gaps |

docs/gpu-pipeline.md

@@ -44,11 +44,33 @@ Overrides (read once at launch):
   the compute device always used Vulkan + DX12 (+ Metal).
 - `LIGHTCRAFT_GPU=0`: GPU rendering off for the process (the window is unaffected).
 
+**DX12 shader compiler (issue #471).** Every instance (window and compute) compiles DX12 shaders with
+FXC (`d3dcompiler_47.dll`, part of Windows; `lightcraft_gpu::backend::backend_options`). wgpu's
+default, `Auto`, loads whichever `dxcompiler.dll` the DLL search path finds first. LightCraft ships
+none, so that copy belongs to another program (a Windows SDK, a folder on `PATH`). An older copy without
+`dxil.dll` beside it (e.g. DXC 1.7) warns that the DXIL is unsigned, wgpu treats the warning as a
+compile error, its indirect-validation pipelines fail, the device is lost, and the window never opened
+(`WGPU error: Parent device is lost`). `WGPU_DX12_COMPILER=dxc | auto | fxc` (wgpu's variable) still
+chooses; with `dxc`, put `dxcompiler.dll` *and* `dxil.dll` (DXC ≥ 1.8.2502) next to `lightcraft.exe`.
+FXC builds the compute kernels somewhat slower than DXC (≈ 9 s vs 7.5 s for the GPU test suite on an
+RTX 4080), off the startup path.
+
 **Off the startup path.** The compute device is created on a background thread once the window is
 up (`gpu::warm_up` from the first frame's settings), and never while GPU rendering is off: with
 Settings ▸ Performance ▸ *Use the GPU for rendering* unchecked (applied before the window opens),
 `LIGHTCRAFT_GPU=0` or `LIGHTCRAFT_GPU_BACKEND=off`, no GPU driver is loaded for rendering at all.
 
+**Quitting.** The devices are never dropped, and renders run on worker threads: a render still inside
+the driver while the process exits crashes there (a SIGSEGV in the NVIDIA Vulkan driver on Linux,
+issue #620), which no panic hook catches. So every entry into a device counts as work in flight
+(`crates/gpu/src/exit.rs`), and the desktop app ends with `LightcraftApp::shutdown` (from `on_exit`,
+after settings and library are saved): `gpu::begin_shutdown()` — from then on `gpu::render` returns
+`None`, no device is created, denoise tiles fail over and a render job gives up instead of rendering
+on the CPU — then the render pool stops (queued jobs dropped, running ones waited for) and
+`gpu::wait_idle` waits for GPU work on other threads (export, denoise, the device warm-up). One
+deadline of 2 s covers it all; past it the app quits anyway. A job pool that is dropped (headless
+hosts, tests) waits for its running jobs the same way (`JobPool::shutdown`, `crates/preview/src/pool.rs`).
+
 **Crash sentinel.** The desktop app writes `gpu-init.marker` into its settings folder (next to
 `ui.json`: `%APPDATA%\LightCraft`, `~/Library/Application Support/LightCraft`,
 `~/.config/lightcraft`) just before the compute device is created and removes it as soon as creation

docs/hardware-parity.md

@@ -0,0 +1,50 @@
+# Hardware parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created from the code, gpu-pipeline.md and the parity checklist) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+What Lightroom does with the machine's hardware, per platform, and what LightCraft does. Sources:
+[gpu-pipeline.md](gpu-pipeline.md), [display-profiles.md](display-profiles.md), [denoise.md](denoise.md),
+[ai-masks.md](ai-masks.md), `crates/gpu`, `crates/engine/src/devices.rs`, `crates/ui-egui/src/panels/second.rs`.
+
+| Feature | Target | LightCraft: macOS | Windows | Linux / BSD | Web | Status |
+|---|---|---|---|---|---|---|
+| GPU for display and editing | Metal / DX12, "Use GPU for display / image processing / export" | wgpu Metal: geometry, resize, blur, WB, NR, guided filter, dehaze, masks, finish; CPU fallback per render | DX12 only (Vulkan opt-in, #136) | Vulkan | CPU only (no WebGPU yet) | 🟡 defringe, spot removal, heuristic masks, long brushes and high-bit exports stay on CPU |
+| GPU export | ✅ | ✅ (6000 × 4000 in ~0.3 s vs ~1.2 s CPU) | ✅ | ✅ | — | ✅ (black-export fix on an Intel iGPU, #78) |
+| AI on GPU / neural engine | Metal / DirectML / Core ML, model per feature | AI denoise on GPU or CPU (setting); SAM 3 on Metal via candle; faces on CPU | CPU / GPU denoise | CPU / GPU denoise | — | 🟡 no Core ML / Neural Engine / DirectML |
+| HDR (EDR) display | ✅ (macOS EDR, Windows HDR) | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ (LR-VIEW-HDR-DISPLAY) |
+| Monitor profile | automatic per display, follows the window | 🟡 picked by hand | 🟡 | 🟡 | — | 🟡 OS profile not read; no follow across monitors |
+| Second window / second monitor | ✅ (Classic) | ✅ (⌘F11) | ✅ | ✅ | — | ✅ (Classic secondary-window keys missing) |
+| Pen pressure / tilt (brush masks) | ✅ pressure for size / flow | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ |
+| Trackpad gestures | pinch zoom, pan | ✅ pinch, two-finger pan | 🟡 (winit) | 🟡 | 🟡 | ✅ on macOS |
+| Card readers / cameras as import sources | ✅ (devices panel, eject after import) | ✅ mounted volumes with DCIM | ✅ | ✅ | — | 🟡 no eject-after-import check, no MTP / PTP phones |
+| Tethered capture | ✅ Classic (Canon, Nikon, Sony, Leica) | ⬜ | ⬜ | ⬜ | — | ⬜ |
+| Printers | ✅ Print module, printer colour management | ⬜ (PDF contact sheets only) | ⬜ | ⬜ | — | ⬜ |
+| Control surfaces (MIDI / Loupedeck via plug-ins) | via SDK plug-ins | control channel and MCP can drive every command | same | same | — | 🟡 different mechanism; no MIDI mapping |
+| Multi-core CPU | ✅ | ✅ worker pools, parallel JPEG decode, parallel import copy | ✅ | ✅ | single thread | ✅ |
+| Memory pressure | managed | ✅ memory budget, `crates/sysmem` returns allocator pages on macOS | ✅ budget | ✅ budget | — | ✅ |
+
+## Score
+
+**~40% ready** (estimated): the GPU editing path is real and fast (measured: 24 MP exposure drag
+3.9 ms on GPU vs 22–42 ms CPU; NR drag 18 ms vs 301–471 ms), but HDR display, pen pressure,
+tethering, printing, automatic monitor profiles and neural-engine inference are missing. GPU
+correctness is proven on Apple GPUs; other vendors rely on user reports.
+
+## Remaining (Opus 5.5 agent hours)
+
+| Work | Hours | Needs |
+|---|---:|---|
+| HDR display (EDR on macOS, Windows HDR, Linux where possible) | 10–20 | an HDR display to verify (human) |
+| OS monitor profile, follow window across displays | 5–10 | multi-monitor setup |
+| Pen pressure for brush masks (winit tablet events or a pure-Rust tablet layer) | 6–12 | a tablet |
+| Remaining stages on GPU (defringe, spot removal, masks) | 10–20 | |
+| Tethered capture (PTP over USB in pure Rust, Canon / Nikon / Sony first) | 25–45 | cameras (human) |
+| Printing with colour management | 15–25 | printers (human) |
+| Neural-engine / DirectML inference for AI features | 10–20 | depends on the AI model decision |
+| **Total** | **80–150 h** (the core set for beta, HDR display + monitor profile + pen pressure: 20–40 h) | |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created |

docs/library-shortcuts.md

@@ -6,11 +6,12 @@ Select photos in Photo Grid or Square Grid, then use:
 |---|---|
 | `0` | Clear the star rating |
 | `1`–`5` | Set the star rating |
+| `[` / `]` | Decrease / increase each selected photo's rating by one, within 0–5 |
 | `6`, `7`, `8`, `9` | Set a red, yellow, green or blue label |
 | `P` | Flag as a pick |
 | `X` | Flag as rejected |
 | `U` | Clear the flag |
-| `Shift` + any key above | Apply the action and select the next photo |
+| `Shift` + `0`–`9`, `P`, `X` or `U` | Apply the action and select the next photo |
 
 Purple and clearing a colour label are available in Photo → Set Color Label and the photo context
 menu. Purple has no default number key, matching Lightroom Classic. Rejection marks a photo for
@@ -22,6 +23,12 @@ footer (translucent, over the bottom of the photo) and Detail filmstrip surround
 The label confirmation uses a pale matching background with dark text; ratings and errors retain
 their neutral HUD styling. Custom names use the underlying label's colour.
 
+Bracket ratings use each photo's own starting rating, and the changed photos form one Undo / Redo
+step. AutoWrite uses the normal rating metadata path. In Detail, including Masking and Remove,
+`[` / `]` keep resizing the brush and shifted brackets keep adjusting feather. Saved overrides,
+remapping and disabling the default brush bindings take precedence over their grid bracket actions.
+The separate Decrease Rating / Increase Rating commands can also be assigned in Help → Keyboard Shortcuts.
+
 Grid actions apply to all selected photos and support Undo / Redo. In Compare and Survey, culling
 actions apply to the active photo. Auto Advance moves forward after an action; holding Shift with
 Auto Advance on still advances only once. The last photo stays selected. Text fields keep their

docs/lightroom-catalog-import.md

@@ -38,9 +38,16 @@ WITHOUT ROWID or virtual table produces an explicit error, handled as a warning
 Develop settings reuse the existing XMP/preset mapper. Supported sliders, curves and supported
 mask structures remain editable, but this is approximate rendering: camera profiles, Adobe AI
 models, some masking/retouch fields and process-version algorithms are not reproduced. Unmapped
-fields are reported. When a recovery archive is saved, it retains source settings/history/snapshots
+fields are reported. Lightroom's `ProcessVersion` is not mapped: newly imported photos are on
+LightCraft's latest rendering process, and photos already in the library keep theirs
+([process-versions.md](process-versions.md)). When a recovery archive is saved, it retains source settings/history/snapshots
 and original smart-collection rules. Smart collections become regular albums with current
 membership. Archived history and snapshots are source data, not native LightCraft history yet.
+A Custom white balance on a raw LightCraft develops relative to its as-shot look (ARW, NEF, RW2,
+RAF, CR3, CR2, PEF, SRW; Lightroom names them all `RAW`) can't be taken as Kelvin: the catalog keeps no
+as-shot white for Custom photos, so the photo stays As Shot and `Temperature, Tint` are reported
+(issue #510; a DNG keeps the Kelvin value, and an XMP packet with `crs:AsShotTemperature` is
+shifted by the same mired difference, see [xmp-interop.md](xmp-interop.md)).
 Lightroom's `-999999` deferred-adjustment sentinel is omitted from both catalog and XMP mappings;
 it is reported, included in any saved archive, and never clamped into a real slider value. Deferred Adobe Auto Tone
 is not evaluated by the importer; LightCraft's Auto control remains available after migration.

docs/localization-ja.md

@@ -24,5 +24,9 @@ LightCraft は日本語・簡体字中国語・英語（English）の表示に
 英語の単複数語尾を日本語で省略する場合、対応する文字列引数は `{:.0}` で空にします。
 `LIGHTCRAFT_LANGUAGE=ja lightcraft-cli snapshot ...` で日本語の画面を描画できます。
 
+スマートアルバムの「はい／いいえ」で答える条件（編集、切り抜きなど）の値は、文脈付きキー
+`"smart album value|Yes"`・`"smart album value|No"` で「あり／なし」と表示します。共有の
+`"Yes"`・`"No"`（はい／いいえ）は他の画面でそのまま使います（[`localization.md`](localization.md) の文脈の説明を参照）。
+
 表示・フォント・言語の切り替え・設定の保存・コマンドIDの保持は
 `cargo test -p lightcraft-ui-egui i18n::tests` で検証します（グリフの検査は `CRAFT_FONTS_DIR` 指定時のみ実行）。

docs/localization-parity.md

@@ -0,0 +1,92 @@
+# Localization parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first per-language measurement from the catalogs) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+How far each interface language is from `full`. How to add or maintain a language is in
+[localization.md](localization.md); per-language notes are in `localization-<code>.md`
+([zh-hans](localization-zh-hans.md), [zh-hant](localization-zh-hant.md), [ja](localization-ja.md),
+[pt-br](localization-pt-br.md), [es](localization-es.md), [de](localization-de.md),
+[ru](localization-ru.md)).
+
+## The target
+
+Lightroom 9.6 (installed on the owner's Mac) ships 16 interface languages, listed from its bundle's
+`.lproj` folder names: English, German, Spanish, French, Italian, Japanese, Korean, Norwegian Bokmål,
+Dutch, Polish, Portuguese (Brazil), Russian, Swedish, Thai, Simplified Chinese and Traditional
+Chinese. It does **not** ship Hindi, Arabic, Indonesian or Vietnamese, so for those LightCraft would
+go beyond the target.
+
+## How the numbers are measured
+
+**Measured** (a Python count over `crates/ui-egui/locales/*.json`, 2026-10-10):
+
+- The denominator is every message any catalog knows: the union of the plain catalogs' keys (2,074
+  English source strings: menus, commands, controls, panels, dialogs, tooltips, presets, What's New
+  lines) plus the 230 messages of the formats catalogs (`*-formats.json`: text with runtime values and
+  date patterns), 2,304 messages in all.
+- A message counts as translated when the catalog has a non-empty value that differs from the English
+  key. Some identical values are correct (`ISO`, `OK` in German), so the figure slightly understates
+  coverage; on the other hand, strings that never reach a catalog (technical errors raised in lower
+  crates, some `format!` text outside `tr_format!`) are not in the denominator at all. That is why no
+  language is `full` even at 99%.
+- The UI has 563 distinct `tr("…")` literals and 198 `tr_format!` messages in `crates/ui-egui` and
+  `apps/`; command, control, menu and preset labels reach the catalogs through `display_label`.
+
+Script support is checked against the code: `language_table!` in `crates/ui-egui/src/i18n.rs` lists
+scripts `Latn`, `Cyrl`, `Hans`, `Hant`, `Jpan` only. The UI is egui, which has no bidirectional layout
+and no complex-script shaping, so Arabic (RTL, joining) and Devanagari (conjuncts, reordering) cannot
+render correctly today.
+
+Native-speaker review: no catalog has had a formal review. Several catalogs have edits from community
+contributors whose commits only touch that language (ja, zh-hans, zh-hant, fr, de, ru, uk, pt-br);
+that is promising but is not recorded as review, so the column says `no (community edits)`.
+
+## The twelve key languages
+
+| # | Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | To `full` |
+|---|---|---|---:|---|---|---|---|---:|
+| 1 | English | `en` | 2,304 / 2,304 (100%, source) | all; Help ▸ What's New and the shortcut sheet; no full user manual | Latin (Inter) | n/a | **full** | 0 h |
+| 2 | Simplified Chinese | `zh-hans` | 1,994 / 2,304 (87%) | menus, panels, dialogs, presets, profiles, dates; lower-layer errors English | Hans via craft-fonts (Noto Sans CJK SC); IME through winit; no vertical text in UI (not in target either) | no (community edits) | partial | 6–10 h |
+| 3 | Spanish | `es` | 1,972 / 2,304 (86%) | as zh-hans | Latin | no (community edits) | partial | 6–10 h |
+| 4 | Hindi | `hi` | 0 (0%) | none | **Devanagari shaping missing** (egui has no complex shaping) | no | none (target: not shipped) | 50–90 h (shaping 25–50 h, shared with Arabic) |
+| 5 | Arabic | `ar` | 0 (0%) | none | **RTL layout and Arabic shaping missing** | no | none (target: not shipped) | 60–110 h (RTL mirroring 30–50 h + shaping, shared with Hindi) |
+| 6 | French | `fr` | 2,021 / 2,304 (88%) | as zh-hans | Latin | no (community edits) | partial | 5–9 h |
+| 7 | Portuguese (Brazil) | `pt-br` | 1,966 / 2,304 (85%) | as zh-hans | Latin | no (community edits) | partial | 6–10 h |
+| 8 | Indonesian | `id` | 0 (0%) | none | Latin (Inter covers it) | no | none (target: not shipped) | 10–16 h |
+| 9 | Japanese | `ja` | 1,995 / 2,304 (87%) | as zh-hans; vertical export watermarks | Jpan via craft-fonts (BIZ UDPGothic / UDMincho); IME through winit | no (community edits) | partial | 6–10 h |
+| 10 | German | `de` | 2,104 / 2,304 (91%) | as zh-hans; What's New translated line by line | Latin | no (community edits) | partial | 4–8 h |
+| 11 | Korean | `ko` | 0 (0%) | none | **no Korean (Hangul) face**: needs a non-Adobe OFL face in craft-fonts (Noto CJK is allowed only for Chinese) | no | none | 14–22 h |
+| 12 | Vietnamese | `vi` | 0 (0%) | none | Latin with stacked diacritics (Inter covers it; check combining marks) | no | none (target: not shipped) | 10–16 h |
+
+## Other languages LightCraft ships (3)
+
+| Language | Code | UI strings translated | Script | Native review | Status | To `full` |
+|---|---|---:|---|---|---|---:|
+| Traditional Chinese (Taiwan) | `zh-hant` | 1,993 / 2,304 (87%) | Hant; uses the Simplified Chinese face until craft-fonts has a TC face | no (community edits) | partial | 8–14 h (incl. the font) |
+| Russian | `ru` | 1,704 / 2,304 (74%) | Cyrillic (Inter) | no (community edits) | partial | 8–12 h |
+| Ukrainian | `uk` | 2,287 / 2,304 (99%) | Cyrillic (Inter) | no (community edits) | partial (lower-layer errors English) | 2–4 h |
+
+Target languages LightCraft lacks: Italian, Korean, Dutch, Polish, Swedish, Norwegian Bokmål, Thai
+(Thai needs shaping and line breaking without spaces). Each Latin-script one is ~10–16 h; Thai
+~20–35 h on top of the shaping work.
+
+## Shared work before any language is `full` (counted once, ~20–35 h)
+
+- Route lower-layer error messages (catalog, raw, codecs, engine) through translatable message ids
+  instead of English `format!` strings (~12–20 h).
+- A check in `cargo xtask ci` that every user-visible literal reaches a catalog (~4–8 h).
+- A user manual / help pages beyond What's New and the shortcut sheet (Lightroom links to online
+  help; ~4–8 h for a translatable in-app help index).
+- Native-speaker review passes (human; cannot be done by agents).
+
+## Totals
+
+- Bring the 9 shipped non-English catalogs to `full`: ~55–90 h (incl. the shared work).
+- Add the 5 missing key languages: ~145–255 h, most of it RTL and complex shaping in egui.
+- Reach the target's 16 languages: + ~60–100 h (Italian, Dutch, Polish, Swedish, Norwegian, Thai).
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created: per-language counts measured from the catalogs, the twelve key languages, script support, estimates |

docs/localization-zh-hans.md

@@ -12,9 +12,9 @@ LightCraft 的界面支持英语、简体中文、繁体中文（台湾）和日
   `cargo::warning` 提示这一点。
 - 翻译只发生在显示层：命令 ID、照片文件名、用户输入的元数据都不做改动。
 - 尚未翻译的技术性错误、补充说明和发行说明仍以英文显示。
-- 已知限制：**网页版（wasm32）目前只内嵌日文字体**，因此浏览器里的中文仍显示为方框
-  （单个字体文件 16 MB，加上 wasm 会超过托管方 Cloudflare 的 25 MiB 单文件上限）。
-  原生桌面版不受影响。
+- 网页版将 Noto Sans CJK SC 作为独立的 `lightcraft_zh_hans.otf` 文件随站点分发，页面启动时加载；
+  这样可显示简体中文，也避免把约 16 MB 字体放进受单文件大小限制的 WASM。部署时需上传整个
+  `target/web/` 目录。未指定 `CRAFT_FONTS_DIR` 的开发构建仍缺少中文字体。
 - 日期分组标题与拍摄时间按中文格式显示（如 `2026年9月20日 星期日`）。
 
 ## 翻译的维护

docs/localization-zh-hant.md

@@ -22,7 +22,7 @@ CRAFT_FONTS_DIR=../craft-fonts cargo run --release -p lightcraft
 
 craft-fonts 目前沒有繁體中文專用字型：桌面版先以 Noto Sans CJK SC 顯示繁中文字（字形為大陸規範寫法），其次才是日文字型；不在此儲存庫新增字型檔。
 未指定 `CRAFT_FONTS_DIR` 的建置缺少 CJK 字形。
-Web 建置僅嵌入 BIZ UDPGothic Regular，尚未驗證完整繁中文字形覆蓋。
+Web 建置在 WASM 中嵌入 BIZ UDPGothic Regular，並另外載入 Noto Sans CJK SC；繁中文字形仍採用簡中規範寫法。
 
 ## 自動化與維護
 

docs/localization.md

@@ -2,7 +2,7 @@
 
 The interface ships in the language it is written in (English) plus every language in the table in
 `crates/ui-egui/src/i18n.rs`. Today that is English, Simplified Chinese (`zh-hans`), Traditional
-Chinese (`zh-hant`, Taiwan), Japanese (`ja`), Brazilian Portuguese (`pt-br`), Spanish (`es`), German (`de`) and Russian (`ru`). This file is the reference for **adding or maintaining a language**; the per-language notes
+Chinese (`zh-hant`, Taiwan), Japanese (`ja`), Brazilian Portuguese (`pt-br`), Spanish (`es`), German (`de`), Russian (`ru`) and French (`fr`). This file is the reference for **adding or maintaining a language**; the per-language notes
 are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-hant.md`](localization-zh-hant.md),
 [`localization-ja.md`](localization-ja.md), [`localization-pt-br.md`](localization-pt-br.md), [`localization-es.md`](localization-es.md),
 [`localization-de.md`](localization-de.md) and [`localization-ru.md`](localization-ru.md).
@@ -29,14 +29,17 @@ are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-h
        PtBr, "pt-br", "Português (Brasil)", "Latn", include_str!("../locales/pt-br.json");
        De, "de", "Deutsch", "Latn", include_str!("../locales/de.json");
        Ru, "ru", "Русский", "Cyrl", include_str!("../locales/ru.json");
+       Uk, "uk", "Українська", "Cyrl", include_str!("../locales/uk.json");
    }
    ```
 
    The fields are the BCP-47 code (also the settings-file value), the **endonym** shown in the
    Language menu, the ISO 15924 script (`Latn`, `Jpan`, `Hans`, `Hant`, `Kore`…), and the embedded
    catalog. `build.rs` picks up `<code>-formats.json` by name, so the macro and the format lookup
-   follow automatically — nothing else in the UI needs to change. The menus, the settings row, the
-   keyboard-shortcut sheet and the control channel all read the table.
+   follow automatically. Add the corresponding `app.language.<name>` entry to
+   `LANGUAGE_COMMANDS` and `language_from_command` in `src/menus.rs`, and to the
+   `language_commands_cover_every_language` test. Settings read the locale table; menus and
+   the control channel share the language-command mapping.
 3. **Make sure the glyphs exist.** The script drives which craft-fonts faces the UI installs: a
    language whose script has no face in the build shows boxes (the test says so instead of failing).
    Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), never here; a
@@ -49,6 +52,14 @@ are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-h
 text unchanged when there is no entry; `tr_format!` handles text with runtime values. Both are
 presentation-only: command ids, file names and user-entered metadata are never translated.
 
+A few messages take a **context**, for a word whose shared translation reads wrongly in one place.
+The catalog may then carry `"<context>|<English>"`, which wins there; without it the plain message
+is used, so only the languages that need it add one. Today the one context is `smart album value`:
+the Yes / No of a yes/no rule (Has Edits, Cropped…). Japanese uses it because はい / いいえ answer a
+question rather than describe a photo (`"smart album value|Yes": "あり"`, `"smart album value|No":
+"なし"`); every other language uses its plain Yes / No. A contextual key that names no real value
+fails the i18n tests.
+
 `tr_format!` is generated by `crates/ui-egui/build.rs`: one arm per English message, which formats
 the active language's translation with `format!` (English is the fallback arm). Every catalog's
 format string is therefore checked by Rust against the call site's own arguments:

docs/mcp.md

@@ -52,6 +52,53 @@ Or check a project-scoped `.mcp.json` into your repo:
 }
 ```
 
+### Codex
+
+The macOS release includes a separate `lightcraft-cli-<version>-macos-universal.zip`;
+unpack it alongside the desktop app if you do not want to build from source. Use the CLI
+and app from the same release. Verify both downloads against that release's `SHA256SUMS.txt`.
+
+Register the CLI's stdio server with Codex using its **absolute** installed path:
+
+```sh
+# Headless: a persistent library whose edits survive MCP restarts.
+codex mcp add lightcraft -- "/absolute/path/lightcraft-cli" mcp --library "/absolute/path/library"
+
+# Live desktop: start the app on the matching loopback port first.
+"/absolute/path/LightCraft.app/Contents/MacOS/LightCraft" --library "/absolute/path/library" --control 7980
+codex mcp add lightcraft-app -- "/absolute/path/lightcraft-cli" mcp --connect 127.0.0.1:7980
+```
+
+Choose one mode for a library: a headless server cannot open a library already locked by
+the desktop app. Connect mode edits the window's actual library and reconnects after the
+app restarts. An external library path keeps the catalog on that drive. Copy/move imports
+default to the library's `Originals/` folder; add-mode imports keep the originals at their
+existing paths. The library path does not relocate settings, logs or optional models (see
+the README's settings/log locations). Make sure an external drive is mounted before
+starting either process.
+
+`codex mcp list` confirms registration, not a successful tool call. After adding the server,
+restart the client's MCP connections and verify `doc_inspect` or `query_photos` against the
+expected library before editing. Configuration options are in the
+[Codex MCP documentation](https://developers.openai.com/codex/mcp/).
+
+### From an installed release
+
+The release packages ship `lightcraft-cli` alongside the desktop app, so no build is needed:
+
+| Install | CLI |
+|---|---|
+| Windows (MSI) | `C:\Program Files\LightCraft\lightcraft-cli.exe` by default (wherever you installed it otherwise), not on `PATH` |
+| Linux (deb, rpm) | `/usr/bin/lightcraft-cli` |
+| macOS | the separate `lightcraft-cli-<version>-macos-<arch>.zip` release asset (the `.app` holds only the desktop app) |
+
+```sh
+# Windows, default install folder
+claude mcp add lightcraft -- "C:\Program Files\LightCraft\lightcraft-cli.exe" mcp
+# Linux, or macOS with the CLI unzipped onto PATH
+claude mcp add lightcraft -- lightcraft-cli mcp
+```
+
 ### Other clients (Claude Desktop, Cursor, …)
 
 Every stdio MCP client takes the same shape: a `command` plus `args`. For example
@@ -71,6 +118,39 @@ Every stdio MCP client takes the same shape: a `command` plus `args`. For exampl
 During development you can also point the client at `cargo run --release -p lightcraft-cli -- mcp`
 (with `"cwd"` set to the repository), at the cost of a slower start.
 
+## Shared core tools
+
+These follow the same conventions as [filmcraft #28](https://github.com/storytold/filmcraft/pull/28).
+They are listed in both full and compact mode; existing documented helpers remain listed too.
+There are no hidden compatibility aliases.
+
+| Tool | Arguments | Result |
+|---|---|---|
+| `command_list` | `filter?`, `enabled_only?` | Command catalog |
+| `command_run` | `id`, `params?` | Command result |
+| `command_batch` | `steps: [{id, params?}]`, `stop_on_error?` | Counts and per-step results; stops on error by default |
+| `doc_inspect` | none | Library state and catalog counts |
+| `render_preview` | `id?`, `max_side?`, `format?` | Image; neither changes selection nor saves a file |
+
+Each edit in a batch has its own undo step. Connect mode also lists `ui_inspect` and
+`ui_screenshot` (the latter has no output-path argument). The existing `inspect_ui`,
+`screenshot`, `list_commands`, `run_command` and `render_photo` keep their documented arguments.
+Ports and connect mode are unchanged.
+
+Every listed tool has a title and all four MCP hints. Generated command tools are conservatively
+marked as edits. Helpers with optional output paths are marked as writers; `export` is not
+idempotent because the default conflict policy chooses a new filename on repeated calls.
+Unknown helper argument keys return JSON-RPC `-32602` naming the key and accepted arguments.
+Generated `cmd_*` tools and nested command params remain free-form: the registry has prose
+parameter docs, not machine-readable schemas. Existing command validation (including strict
+export options) is preserved. Escaped tool panics return `isError: true`, and the session keeps
+serving; backend panics during resource reads or tool listing return an internal error.
+The headless backend owns its session directly, without a session mutex.
+
+`lightcraft://document` and `lightcraft://commands` contain JSON matching `doc_inspect` and
+`command_list`. Existing resources remain available. Requests declaring MCP 2026-07-28 in
+per-request `_meta` receive `resultType: complete` and list/read cache hints; reads are not cached.
+
 ## Tools
 
 ### Helpers
@@ -83,7 +163,7 @@ During development you can also point the client at `cargo run --release -p ligh
 | `query_photos {filter?, sort?, offset?, limit?}` | Photos in the current view (or matching a catalog `Filter`) |
 | `select_photos {ids, active?, mode?}` | Set the selection / active photo. Every id (and `active`) must be in the library: an unknown id is a tool error (`no such photo 9999`) and the selection and active photo are left as they were |
 | `list_controls {section?}` | Every develop slider: id (`light.exposure`…), range, default, current value |
-| `get_develop {id?}` | Full develop-settings JSON |
+| `get_develop {id?}` | Full develop-settings JSON, with `process`: the rendering process the photo is on ([process-versions.md](process-versions.md)) |
 | `set_develop {id?, values?, settings?, label?}` | `values`: `{controlId: number}`; `settings`: partial develop JSON deep-merged. Undoable |
 | `apply_preset {preset, amount?, ids?}` | Apply a preset (ids from `cmd_presets_list`) |
 | `crop {id?, rect?, angle?, reset?}` | Normalized crop rect `[x0,y0,x1,y1]` and straighten angle; at least one of `rect`, `angle`, `reset: true` |
@@ -99,8 +179,9 @@ Tools taking `id` make that photo active first; without it they act on the activ
 | `screenshot {maxSize?, format?, path?}` | The app window as an image, after pending renders finish |
 | `inspect_ui` | View, panel, window/image rects, selection, status |
 | `set_ui {state}` | Merge UI state, e.g. `{"view": "detail"}` |
-| `list_widgets {filter?}` / `click {widget \| x,y, count?}` | Widgets by automation id; real egui clicks |
+| `list_widgets {filter?}` / `click {widget \| x,y, count?, button?}` | Widgets by automation id; real egui clicks (`button: "right"` right-clicks) |
 | `press_key {key, cmd?, shift?, alt?}` / `type_text {text}` | Keyboard input (shortcuts) |
+| `clipboard {action, text?}` | Cut, copy or paste in the focused text field (⌘X / ⌘C / ⌘V; refused when none has the focus; cut and copy write the system clipboard); `inspect_ui` → `copied` is what was copied |
 | `pointer_gesture {events}` | Gestures in normalized image coordinates (brush strokes, gradients, crop handles) |
 
 In headless mode these return a tool error explaining how to start the app.
@@ -186,3 +267,20 @@ lightcraft-cli calibrate --max 300 ~/Pictures/2026   # camera colour profiles (d
   (`Remote`) against a stand-in control server; also import → render → JPEG export of a real file.
 - `apps/lightcraft-cli/tests/cli.rs` — spawns `lightcraft-cli mcp` with real pipes; `render`;
   `commands`.
+
+## Export progress and cancellation
+
+Headless direct `export`, `command_run` / `run_command` with `app.export`, and `cmd_app_export`
+calls report photo-count progress when `params._meta.progressToken` is a string or number.
+Notifications are strictly increasing, at most ten per second plus the final total. No token
+means no notifications. `ping` is answered at photo boundaries; other requests wait in order
+until the export ends. EOF lets a pending export finish and preserves queued requests.
+
+`notifications/cancelled` with `params.requestId` stops the matching export before its next
+photo, suppressing its response. Unknown/completed request ids are ignored. A photo already
+being processed finishes first: completed photos remain, each written with the existing atomic
+file writer, and there are no partial files to delete. Unrelated outputs and earlier exports
+are untouched. A failed export is an `isError` tool result. Transport mutexes recover poisoning.
+
+Connect mode and exports inside `command_batch` remain synchronous and do not report MCP
+progress or cancellation. Use a direct headless export call for this behavior.

docs/merge.md

@@ -9,7 +9,7 @@ All algorithms are our own implementations from published papers (cited in the m
 - **App:** select the photos, then *Photo Merge ▸ HDR…* (`Ctrl+H`), *Panorama…* (`Ctrl+M`) or
   *HDR Panorama…* from the photo context menu (or the `dialog.merge*` commands). The dialog previews
   the merge at ≤ 1024 px and re-runs the preview when an option changes; *Merge* runs the full merge
-  in the background (progress in a toast). The result is written next to the first photo as
+  in the background (a row in the activity stack shows its progress, with ✕ to stop it). The result is written next to the first photo as
   `<name>-HDR.dng`, `-Pano.dng` or `-HDR-Pano.dng`, imported and selected.
 - **Commands** (CLI, MCP, control channel):
   - `merge.hdr {ids?, align=true, deghost=none|low|medium|high, autoSettings=true, stack=false, preview=false, showOverlay=false, previewPath?}`

docs/process-versions.md

@@ -0,0 +1,75 @@
+# Process versions
+
+Every photo's develop settings record the **rendering process** they are interpreted by
+(`DevelopSettings::process`, a `ProcessVersion` in `crates/develop/src/settings.rs`). Lightroom calls
+this the process version. It lets the look of LightCraft improve (a new default tone curve, issue #146;
+stronger Light sliders, issue #196) without changing a single photo someone has already edited.
+
+Today there is one process, **V1**: LightCraft's rendering from before process versions existed.
+
+## The rule
+
+**A change that alters how existing settings render ships as a new process. V1 is frozen.**
+
+- A deliberate change of look (tone model, slider response, default curve, how a stage interprets a
+  value) goes into a new process. Photos stay on the process they have until someone runs Update to
+  Current Process (or Reset).
+- Bug fixes that make output correct where it was broken (a crash, NaN or black output, a decoder
+  error, CPU and GPU disagreeing) are not looks and can land in place, as before.
+- Changes to how a file is decoded or which camera colour it gets change the source, not how settings
+  are interpreted; the process doesn't reach that stage today.
+
+## Adding a process
+
+1. Add a variant to `Process` (`V2`), append it to `Process::ALL` (oldest first), give it its number in
+   `Process::version` and make it `Process::LATEST`.
+2. The compiler then points at every `match` on `Process`. The base tone map is chosen in one place,
+   `lightcraft_pipeline::finish::base_tone` (both the CPU and the GPU renderer take it from there): give
+   V2 its own arm and leave V1's alone. A process that changes another stage branches there the same
+   way, on `s.process.process()`; if that stage is cached (`Plan::lin_key`, the planes in `local.rs`),
+   add the process to its key.
+3. Keep `settings_saved_before_process_versions_load_as_v1` (`crates/develop/src/tests_process.rs`)
+   passing: settings saved without the field must stay V1, not become the new latest. That is the
+   field's `#[serde(default = "ProcessVersion::legacy")]`; the struct-level `Default` gives new
+   settings the latest instead.
+4. Render a few procedural scenes on both processes and compare, and update `docs/parity-checklist.md`.
+
+## What gets which process
+
+| | Process |
+|---|---|
+| A newly imported, merged or Lightroom-imported photo | the latest |
+| Settings saved without the field (catalogs and their snapshots, versions and history, `lc:settings` in XMP sidecars, browser libraries: everything from before process versions), or with a damaged value | V1 |
+| Reset (`develop.reset`) | the latest |
+| Reset of a section or a slider | unchanged |
+| Update to Current Process (`develop.updateProcess`) | the latest, for photos on an older one; one undo step. The menu item follows the selection; a call with `ids` / `id` acts on those photos whatever is selected |
+| Virtual copy, duplicate | the source's |
+| Copy / paste / sync / Auto Sync / presets | unchanged (see below) |
+| `crs:` edits (XMP from other raw developers, Lightroom catalogs, imported presets) | unchanged; a new photo has the latest |
+| Restoring a version or history step | the one it had |
+
+**Copy, paste, sync and presets** never carry the process: it is in no settings group, so the photos
+they change keep their own and interpret the pasted values with it. (Lightroom offers the process
+version as a separate checkbox when syncing; LightCraft's groups are coarser and keep it out.) Partial
+settings JSON that names `process` itself (`develop.merge`, a hand-written preset) sets it.
+
+**Lightroom edits** are re-interpreted by LightCraft's mapper (`crates/engine/src/crs.rs`), which is
+written against the current rendering. `crs:ProcessVersion` numbers Adobe's renderer, not ours, and is
+ignored; a photo imported with Lightroom edits is on LightCraft's latest process, and an existing
+LightCraft photo that receives them keeps its own.
+
+**A number this build doesn't know** (a library or sidecar written by a newer LightCraft) loads, is
+kept when saved, and renders with the newest process this build has. Update to Current Process never
+moves a photo to an older process; Reset does move it to this build's latest.
+
+**A damaged value** (anything but a whole number from 0 to 2^32 - 1; `2.0` counts as 2) reads as V1,
+like a missing field, and costs nothing else: the rest of the settings load from the catalog, a
+snapshot, the op log or an `lc:settings` sidecar as usual. The damaged value isn't kept: the photo is
+saved as V1.
+
+## Storage
+
+The process is saved as `"process": <number>` in the settings JSON, except V1, which is left out.
+Settings made before process versions existed are therefore saved exactly as before, and their
+preview-cache keys (`DevelopSettings::hash64`) don't change. `develop.get` (MCP `get_develop`) always
+states the process.

docs/raw-parity.md

@@ -0,0 +1,253 @@
+# RAW parity: cameras, formats, demosaic, colour and lens profiles
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (model-by-model measurement against Adobe's published camera list; use-weighted coverage; variant matrix; colour and lens sections; ranked next cameras) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6 (Camera Raw 18.7)
+
+Raw processing is the deepest single dimension of Lightroom parity: a photographer whose camera
+does not decode, or decodes with the wrong colour, cannot switch. This document measures it model by
+model. The numbers feed [target-app-parity.md](target-app-parity.md); individual shortfalls are
+ranked in [gaps.md](gaps.md). Details per format: [cr3.md](cr3.md),
+[raf-compression.md](raf-compression.md), [sony-lens-corrections.md](sony-lens-corrections.md),
+[camera-preview-colour.md](camera-preview-colour.md), [denoise.md](denoise.md).
+
+## Headline
+
+| Measure | Value | Kind |
+|---|---:|---|
+| Adobe-listed camera models | **1,446** | measured: [raw/adobe-cameras.tsv](raw/adobe-cameras.tsv) |
+| Decoded from sensor data and **verified** on a real file | **234** (16%) | measured: [raw/evidence.tsv](raw/evidence.tsv) |
+| Decoder path should handle it, **unverified** | **943** (65%) | measured from the format rules (632 of them DNG, mostly phones) |
+| **Preview-only** (embedded JPEG) | **233** (16%) | measured |
+| **Unsupported** (not imported, refused or decodes wrongly) | **36** (2%) | measured |
+| Models added since 2017 (Camera Raw 10+): verified / unverified / preview / unsupported | 81 / 641 / 24 / 8 of 754 | measured |
+| **Share of photographers whose camera fully works** (decodes from sensor data), use-weighted | **~84%** | estimated: measured classes × written usage weights × per-format confidence |
+| …of which on a body we have verified | **~40%** | estimated, same weights |
+| Camera colour: Adobe profiles vs ours | 1,500 Adobe Standard profiles, 481 models with Camera Matching profiles vs **4 bundled profiles** + per-file fits + 52 spectral matrices | measured (bundle listing, Adobe list, `assets/camera-profiles`) |
+| Lens profiles: Adobe vs ours | **3,635 vs 0** (in-file corrections only) | measured |
+| **RAW readiness** (decoding 60%, colour 25%, lens 15%) | **~56%** (range 50–60%) | estimated, see [Scores](#scores) |
+
+Re-measure with `python3 docs/raw/coverage.py` (standard library only): it classifies every Adobe
+model from the format rules in the script (which mirror `crates/raw/src`) plus the per-model evidence,
+rewrites [raw/coverage.tsv](raw/coverage.tsv) and prints the tables below; `--check` fails when the
+committed table is stale.
+
+## How it was measured
+
+- **Adobe's list**: helpx "Camera Raw supported cameras" (the live page refuses scripted requests, so
+  the Wayback Machine capture of 2026-10-03 was parsed): 1,446 camera rows from 40 makers after
+  dropping profile-only rows; maker, model, extension(s), Camera Matching profile, minimum Camera Raw
+  version. The year a model was added is approximated from that Camera Raw major version.
+- **What we decode**: the decoders and their refusals in `crates/raw/src` (`lib.rs` routing, `vendor/*.rs`
+  coding variants, `crx.rs` CRX limits, `orf.rs` / `srw.rs` compressed refusals), the import list
+  `lightcraft_engine::import::EXTENSIONS`, and `KNOWN_UNSUPPORTED` in `crates/raw/tests/corpus.rs`. Doc
+  claims were not used.
+- **Verified** means a real file from that body decoded from sensor data in: the corpus test over the
+  `RAW_SAMPLES` manifest (`xtask/src/main.rs`, 101 CC0 files; bodies whose sample is in
+  `KNOWN_UNSUPPORTED` excluded), `crates/raw/tests/cr3_corpus.rs` (3 bodies, exact), the RAF reference
+  check ([raf-compression.md](raf-compression.md)), and the raw.pixls.us bulk checks recorded in issue
+  #535 (all 100 Sony bodies there; 87 decode) and PR #215 (every Panasonic / Leica RW2 / RWL / RAW body
+  there, 178 files from 118 bodies). Bulk-check body lists were matched to Adobe names through the
+  raw.pixls.us folder names. Checks without a body list (≈ 60 NEFs, 35 CR2 bodies for the CFA layout)
+  are not counted as verified.
+- **Usage weights** ([raw/usage-weights.tsv](raw/usage-weights.tsv)): maker buckets from 2025 market
+  data (Nikkei production: Canon ~36%, Sony ~29%, Nikon ~14%, Fujifilm ~12% of mirrorless; BCN retail:
+  Sony 29.9%, Canon 27.4%, Nikon 15.1%), adjusted for the DSLR installed base and for the makers named
+  in this repo's 325 user issues (Sony 33, Nikon 31, Canon 26, phones 23, Fujifilm 9, Panasonic / Leica
+  8, OM / Olympus 6, Pentax / Ricoh 6). Inside each bucket, 80% goes to the popular bodies of the last
+  ~8 years (listed in the file), 20% to the bucket's other Adobe models.
+- **Per-format confidence** for unverified bodies (the chance their files decode correctly): DNG, CR2,
+  RAF, RW2 0.95; NEF, ARW, PEF 0.9; ORF, SRW, SR2 0.8; **CR3 0.6** (the CRX decoder refuses several
+  coding variants and only three bodies are verified; maintainers report the R7 working).
+
+## By maker (measured)
+
+| Maker | Adobe models | verified | unverified | preview | unsupported | Main reason for preview / unsupported |
+|---|---:|---:|---:|---:|---:|---|
+| Sony | 149 | 86 | 51 | 9 | 3 | DSLR-A200…A390 and A850 12-bit compressed ARW (preview, #535); A100 and DSC-F828 refused (regression #702); SRF not imported |
+| Canon | 134 | 11 | 100 | 21 | 2 | CRW (2000–2004 bodies) preview; EOS-1D / 1Ds TIFF raws not imported |
+| Samsung | 128 | 1 | 118 | 9 | 0 | compressed SRW (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini, Galaxy NX) |
+| Apple | 113 | 1 | 112 | 0 | 0 | — (DNG / ProRAW) |
+| Panasonic | 104 | 93 | 11 | 0 | 0 | — |
+| Nikon | 99 | 5 | 94 | 0 | 0 | — (HE / HE★ is a per-shot setting, preview-only) |
+| Fujifilm | 97 | 16 | 55 | 26 | 0 | pre-X FinePix RAF without a raw IFD (estimated split) |
+| Google | 88 | 1 | 87 | 0 | 0 | — |
+| Olympus | 71 | 3 | 9 | 59 | 0 | **compressed ORF** |
+| Leica | 61 | 13 | 48 | 0 | 0 | — |
+| Xiaomi, Oppo, LG, Huawei, OnePlus, Motorola, Nokia | 139 | 0 | 139 | 0 | 0 | — (DNG) |
+| Pentax / Ricoh | 60 | 4 | 56 | 0 | 0 | — |
+| Hasselblad | 34 | 0 | 2 | 32 | 0 | Hasselblad-compressed 3FR / FFF |
+| Phase One / Leaf / Mamiya | 59 | 0 | 0 | 43 | 16 | IIQ, MOS preview; TIFF raws and MEF not imported |
+| Casio | 26 | 0 | 26 | 0 | 0 | — (DNG) |
+| DJI | 21 | 0 | 21 | 0 | 0 | — (DNG) |
+| OM Digital Solutions | 7 | 0 | 0 | 7 | 0 | **compressed ORF** |
+| Kodak, Konica Minolta, Epson, Sigma, GoPro, Contax, others | 56 | 0 | 14 | 27 | 15 | DCR, GPR not imported; KDC, MRW, ERF, X3F preview |
+| **All** | **1,446** | **234 (16%)** | **943 (65%)** | **233 (16%)** | **36 (2%)** | |
+
+## By use (estimated)
+
+| Bucket | Weight | Camera fully works | On a verified body | Why |
+|---|---:|---:|---:|---|
+| Canon | 33% | 72% | 16% | 17 of the 22 popular bodies write CR3; 2 of them verified, the rest at 0.6 |
+| Sony | 27% | 98% | 91% | bulk-checked |
+| Nikon | 16% | 91% | 12% | decoders cover every NEF coding but HE; few bodies verified |
+| Fujifilm | 10% | 91% | 45% | |
+| Panasonic | 4% | 100% | 98% | bulk-checked |
+| OM / Olympus | 3% | 3% | 1% | compressed ORF |
+| Phones | 3% | 93% | 1% | DNG |
+| Pentax / Ricoh | 1.5% | 94% | 14% | |
+| Leica | 1% | 95% | 5% | |
+| DJI | 1% | 95% | 0% | |
+| Medium format and others | 0.5% | 23% | 0% | IIQ, 3FR, X3F |
+| **Weighted** | 100% | **84%** | **40%** | |
+
+About 5 in 6 raw photographers' cameras decode, but only about 2 in 5 use a body we have actually
+checked, and Canon, the largest bucket, is the weakest of the big four.
+
+## Variant matrix (depth per format)
+
+✅ decoded and checked on real files · 🟡 decoded, partial or unverified · ⬜ preview-only or refused.
+
+| Format | Variant | Status | Evidence |
+|---|---|---|---|
+| CR2 | lossless JPEG slices | ✅ | 8 corpus bodies; CFA phase from `CR2CFAPattern` (#85, 35 bodies); masked-column black level |
+| CR2 | sRAW / mRAW (YCbCr) | ✅ | `vendor/cr2/sraw.rs`, 31 samples from 16 models |
+| CR3 | CRX lossless, version 0x100 | ✅ | M50, R100, R8 exact against a reference |
+| CR3 | C-RAW 0x100 (horizontal tiles), 0x200 (single 14-bit tile, adaptive QP) | ✅ | same 3 bodies exact |
+| CR3 | other CRX variants (vertical tiles, partial subbands, other plane flags, 0x200 multi-tile) | ⬜ | refused in `crx.rs`, falls back to the preview; which bodies write them is unmeasured |
+| CR3 | sRAW / mRAW | ⬜ | 4-plane Bayer only |
+| CR3 | HEIF / HDR PQ | ⬜ | HEVC tracks recognised, not decoded |
+| CR3 | dual-pixel raw | ⬜ | never substituted |
+| CRW | all | ⬜ | preview |
+| NEF | uncompressed, lossless, lossy type 1 / 2, lossy after split | ✅ | D5100, D7000, D7500, Z f corpus; ~60 NEFs by hand; #633 |
+| NEF | packed 14-bit stored under a compressed tag (Z 6II uncompressed) | ⬜ | #769; fix in PR #671 (not merged) |
+| NEF | High Efficiency / HE★ (JPEG XS) | ⬜ | named, preview (#193); needs a JPEG XS decoder |
+| ARW | uncompressed, cRAW (ARW2), lossless LJ92 (L / M / S) | ✅ | 86 bodies (#535); M/S black level 1024 |
+| ARW | packed 12-bit (A900) | ✅ | one CC0 file; A850 unmeasured |
+| ARW | 12-bit compressed of DSLR-A200…A390 | ⬜ | preview (#535) |
+| ARW | A100 ARW; SRF (F828, V3) | ⬜ | refused (#702); SRF not imported |
+| ARW | ARQ pixel shift | ⬜ | no code |
+| SR2 | DSC-R1 | ✅ | CC0 3221 sample |
+| RAF | uncompressed, lossless and lossy compressed; Bayer and X-Trans; GFX 14/16-bit | ✅ | 24 files from 13 bodies exact |
+| RAF | pre-X FinePix without a raw IFD | ⬜ | `raf.rs` refuses (26 Adobe models, estimated split) |
+| ORF | uncompressed 16-bit, 12-bit packed, two-field 12-bit, 12.8 bpp | ✅ | E-1, E-400, XZ-2 corpus; #651 |
+| ORF | **compressed** (every Olympus / OM body since ~2008) | ⬜ | `orf.rs` refuses; the E-M1 and E-M10 III corpus files are `KNOWN_UNSUPPORTED` |
+| RW2 / RWL / RAW | formats 2, 4, 5, 6, 7, 8 and 16-bit words | ✅ | 118 bodies (#215) |
+| PEF | uncompressed, Huffman, packed 12-bit | ✅ | K10D, K-3, K-5 IIs |
+| PEF / DNG | Pentax pixel shift | ⬜ | frames not combined |
+| SRW | uncompressed, 12-bit packed | ✅ | EX1 corpus; NX10, NX20 |
+| SRW | compressed 32770 / 32772 / 32773 | ⬜ | refused |
+| DNG | uncompressed, LJ92, lossy JPEG / Smart Preview, Deflate incl. float, LinearRaw, tiles / strips, row / column interleave | ✅ | 6 corpus DNGs; 4 ILCE-6400 JXL DNGs |
+| DNG | JPEG XL (DNG 1.7, lossless and lossy) | ✅ | synthetic bit-exact; real lossless and lossy files |
+| DNG | Apple ProRAW (incl. semantic mattes) | ✅ | iPhone 12 Pro corpus; ProfileGainTableMap read but off (ΔE00 19 against Lightroom with it on) |
+| DNG | phone DNGs (Pixel, Galaxy, Xiaomi…) | 🟡 | Pixel 2 XL only; white-level pile-up fix #548 |
+| DNG | GoPro GPR (VC-5) | ⬜ | refused |
+| 3FR / FFF | DNG-like layouts | 🟡 | decoded when uncompressed or LJ92 |
+| 3FR / FFF | Hasselblad compression | ⬜ | preview |
+| IIQ, MOS, MRW, ERF, KDC, X3F | all | ⬜ | preview |
+| DCR, MEF, MFW, DXO, GPR, TIFF raws | all | ⬜ | not imported |
+
+## Demosaic, levels, crops and lens metadata
+
+| Stage | Target | LightCraft | Status |
+|---|---|---|---|
+| Bayer demosaic | Adobe's own, plus AI "Raw Details" | AHD (default), PPG, bilinear (`crates/raw/src/demosaic`) | 🟡 quality unmeasured against Lightroom; no Raw Details |
+| X-Trans demosaic | ✅ | in-house edge-weighted directional | 🟡 unmeasured |
+| Foveon | ✅ (older bodies) | — | ⬜ |
+| Monochrome / LinearRaw | ✅ | handled, no demosaic | ✅ |
+| Pixel shift (Sony ARQ, Pentax, OM high-res, Nikon) | ✅ (Sony, Pentax, Nikon) | — | ⬜ |
+| Black and white levels | per model, calibrated | read from each file (masked columns, maker notes, SR2SubIFD, CMP1) | 🟡 per-body bugs keep surfacing: A450–A700 SR2 black level and M/S ARW pedestal (#535, fixed); 5D Mark IV CR2 renders dark (#455, open); white-level pile-up in phone DNGs (#548, fixed) |
+| Crop masks and aspect | ✅ | DefaultCrop, Sony recorded size, Canon AspectInfo, Panasonic in-camera crops, Nikon CropArea | 🟡 7RM3 / 7RM4 crop origin 8–32 px off (cosmetic) |
+| Lens metadata | ✅ read for profile selection | EXIF lens fields read; used only for the in-file corrections below | 🟡 |
+| Highlight reconstruction | ✅ | neutral clip, chromaticity diffusion (`highlight.rs`) | 🟡 tuned by eye |
+| AI denoise | ✅ Bayer and X-Trans, model bundled | Bayer only, user-installed weights, pure-Rust CPU / GPU | 🟡 no X-Trans, no shippable weights |
+| Super Resolution | ✅ | — | ⬜ |
+| HDR / panorama merge to raw DNG | ✅ | linear DNG (float16 HDR) with the source's colour tags | ✅ |
+| Convert to DNG | ✅ | uncompressed or LJ92 tiles (`dngwrite.rs`) | ✅ (no lossy DNG) |
+
+## Colour
+
+| Item | Adobe | LightCraft |
+|---|---|---|
+| Default profile per model | Adobe Standard for every model (1,500 profile names in the bundle) | the DNG's own matrices; else a pooled profile (**4 bundled**: ILCE-7CR, ILCE-7M4, X-H2S, X-T4); else a guarded per-file fit to the camera's embedded JPEG; else spectral matrices (**52 models**, rawtoaces-data); else a neutral matrix |
+| Camera Matching looks | 481 models (plus phone-maker looks) | none (the per-file JPEG fit imitates the camera's own look) |
+| Creative profiles | Adobe Color, Portrait, Landscape, Vivid, Monochrome… | our own looks (Color, Neutral, Vivid, Landscape, Portrait, Monochrome) |
+| DCP / dual-illuminant model | ✅ | dual-illuminant DNG colour (ColorMatrix / ForwardMatrix 1-2, CameraCalibration, AnalogBalance), HueSatMap, LookTable, ProfileToneCurve; external `.dcp` never loaded (clean-room) |
+| White balance in Kelvin | ✅ for every model | absolute Kelvin only where matrices exist; per-file fits give relative WB (#296, #730) |
+
+**How far the default rendering is from Adobe's** (CIE ΔE; measured where stated):
+
+- Against the camera JPEG (what the fit targets): the Sony bulk check (#535) accepted fits on 81 of 87
+  bodies, median ΔE 5.1, ΔL\* +0.2; rejected fits fall back to a neutral matrix at median ΔE 18.5,
+  ΔL\* −11, chroma ×0.39. RW2 140 of 174 files accepted, median 5.0. NEF 13 of 13, 2.9–7.8. RAF 23 of
+  24, pooled X-H2S 1.62 / X-T4 2.34. SRW 2.2–7.6.
+- Against Lightroom itself (few): Sony DRO median ΔE76 7.5 → 3.3; Olympus E-1 vs Lightroom Classic
+  ΔE00 11.25 → 8.30; ProRAW with its gain map ΔE00 19 (why the map is off). No measurement against
+  Adobe Standard across models exists.
+- User evidence: 33 open issues about raw colour or rendering (wrong colours, dark, flat, green,
+  desaturated), the largest group of open core-path issues.
+
+**Colour score ~35%** (estimated): most decoded files start close to the camera's own look (ΔE ~5),
+about 10% start far off (ΔE ~18), nothing is calibrated, Kelvin WB is missing for fitted cameras, and
+the distance to Adobe Standard is unmeasured. In the readiness numbers this becomes a colour factor
+of ×0.85 for a working photographer (they correct colour by hand, at a cost) and ×0.75 for the
+essentials user (the default look is what they keep).
+
+## Lens profiles
+
+| Item | Adobe | LightCraft |
+|---|---|---|
+| Profile database | 3,635 profile files, 56 makers, auto-selected | **0** (Adobe LCPs never used; no database of our own) |
+| In-file corrections | ✅ | DNG opcodes (WarpRectilinear, FixVignetteRadial, GainMap…) applied; Panasonic / Leica RW2 distortion (79 photos, 13 bodies, 11 lenses); Sony tag 0x7037 distortion for the ILCE-7RM4A (2 lenses) |
+| Vignetting / lateral CA from maker notes | ✅ | ⬜ |
+| Manual distortion, vignetting, CA, defringe | ✅ | ✅ |
+
+**Lens score ~10%** (estimated): automatic correction reaches roughly Panasonic / Leica, phone and
+drone DNG users (~9% of photographers by the weights above); Adobe reaches nearly everyone.
+
+## Scores
+
+| Part | Weight | Score | Basis |
+|---|---:|---:|---|
+| Decoding | 60% | **76%** | use-weighted 84% × 0.9 for per-body decode bugs still surfacing (levels, crops, WB: #535, #455, #461, #702) |
+| Colour | 25% | **35%** | see [Colour](#colour) |
+| Lens profiles | 15% | **10%** | see [Lens profiles](#lens-profiles) |
+| **RAW readiness** | 100% | **~56%** (range 50–60%) | 45.6 + 8.75 + 1.5; demosaic and highlight quality unmeasured |
+
+The previous estimate (earlier on 2026-10-10) was ~50%, with decoding at ~78% weighted by maker
+from the format list alone. Measured model by model, decoding comes out about the same; the change is
+the written decomposition, not new decoding.
+
+## Remaining work, ranked by photographers unlocked per hour
+
+Hours are Opus 5.5 agent hours, calibrated on this repo's raw PRs: RW2 every format 6.5 h (#215),
+compressed RAF 8.6 h (#282), CR3 CRX 10 h (#279), NEF lossy after split 4.7 h (#633), ORF 12.8 bpp
+1.7 h (#651), HEIC 7 h (#609). "Gain" is the change in the use-weighted share whose camera fully
+works, from [raw/usage-weights.tsv](raw/usage-weights.tsv).
+
+| # | Camera / variant | Gain (points of photographers) | Hours | Gain per hour | Needs |
+|---:|---|---:|---:|---:|---|
+| 1 | Compressed ORF (every Olympus / OM body since ~2008) | +2.6 | 8–15 | ~0.20 | CC0 samples (have 2) |
+| 2 | CR3: remaining CRX variants, then verify the 17 popular CR3 bodies | +6.5 | 25–45 | ~0.19 | samples per body (raw.pixls.us has most) |
+| 3 | Verify popular Nikon, Fujifilm, Canon CR2 and Pentax bodies (one CC0 file each, fix what breaks) | +2.0 | 8–15 | ~0.17 | public samples |
+| 4 | Nikon packed 14-bit under a compressed tag (Z 6II uncompressed, #769) | +0.2 | 1–2 | ~0.13 | PR #671 exists |
+| 5 | Sony DSLR-A200…A390 / A850 12-bit compressed ARW | +0.4 | 3–6 | ~0.08 | samples on raw.pixls.us |
+| 6 | Pre-X FinePix RAF | +0.6 | 4–8 | ~0.08 | samples |
+| 7 | Sony A100 and DSC-F828 regression (#702) | +0.1 | 1–2 | ~0.07 | samples on raw.pixls.us |
+| 8 | Canon CRW (2000–2004 bodies) | +1.2 by the uniform tail weight, far less by real use | 6–12 | ≤ 0.1 | samples |
+| 9 | Nikon HE / HE★ NEF (Z 8, Z 9, Z 6III, Z f, Z50II, Z5II set to HE) | +1.1 | 20–40 | ~0.04 | a pure-Rust JPEG XS decoder |
+| 10 | Compressed SRW, Hasselblad 3FR, IIQ, X3F, MRW, KDC, ERF, DCR, MEF, GPR | +0.6 together | 45–85 | ~0.01 | samples; low use |
+
+Beyond decoding:
+
+| Gap | Hours | Needs |
+|---|---:|---|
+| Measured colour calibration for the ~60 popular bodies, Kelvin WB, render-fidelity suite against Lightroom | 80–150 | chart shots per camera (a human with cameras) or licensable measured data |
+| Lens profile database of our own (fitting tools, data format, top 100 lenses), maker-note vignetting / CA | 40–80 | calibration shots (a human with lenses) |
+| Demosaic and highlight quality measured against Lightroom; X-Trans AI denoise | 15–30 | |
+| **Total RAW** | **255–480 h** (decoding list above 120–220 h; ~60% parallelizes) | |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 (later) | major | Model-by-model measurement against Adobe's published list (1,446 models: 234 verified, 943 unverified, 233 preview, 36 unsupported); `docs/raw/` data and re-measure script; use-weighted share 84% (40% on verified bodies); variant matrix; colour and lens sections with scores; ranked next cameras; RAW readiness ~56% from written parts |
+| 2026-10-10 | major | Created: formats, makers, demosaic, colour and lens checklists; target counts from the installed Lightroom 9.6 bundle listing |

docs/raw/coverage.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Measure LightCraft's raw camera coverage against Adobe's supported-camera list.
+
+    python3 docs/raw/coverage.py            # print the summary, rewrite docs/raw/coverage.tsv
+    python3 docs/raw/coverage.py --check    # exit 1 if coverage.tsv is stale
+
+Inputs (all in docs/raw/):
+  adobe-cameras.tsv   Adobe's published list (maker, camera, extensions, ...).
+  evidence.tsv        per-model evidence: verified decodes, known preview-only or refused bodies.
+  usage-weights.tsv   estimated share of photographers per maker bucket and popular bodies.
+
+Every Adobe-listed model gets one class:
+  verified     decoded from sensor data, and a real file from this body was checked (evidence.tsv)
+  unverified   the decoder path for its format and coding should handle it; no sample checked
+  preview      opens as the embedded JPEG (format or coding not decoded)
+  unsupported  not imported, refused, or decodes wrongly
+
+The format rules below mirror the decoders in crates/raw/src (see docs/raw-parity.md). When a decoder
+changes, update the rules and evidence, rerun, and commit coverage.tsv with the docs.
+Standard library only; no third-party packages.
+"""
+
+import csv
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+# Olympus ORF bodies that write uncompressed / packed data (crates/raw/src/vendor/orf.rs). Everything else
+# writes compressed ORF, which is preview-only (the E-M5 II / PEN-F high-res mode alone is decoded).
+ORF_DECODED = re.compile(r"^(E-1|E-10|E-20|EVOLT E-300|EVOLT E-330|EVOLT E-400|EVOLT E-500|E-300|E-330|E-500|Camedia C-\S+.*|Stylus XZ-2 iHS)$")
+# Samsung SRW bodies with compressed raw data (crates/raw/src/vendor/srw.rs refuses 32770 / 32772 / 32773).
+SRW_COMPRESSED = re.compile(r"(^|\W)(NX1|NX30|NX300|NX300M|NX500|NX2000|NX3000|NX3300|NX mini|EK-GN\d+|EK-KN\d+)(\W|$)")
+# Fujifilm bodies before the X series whose RAF has no raw IFD (crates/raw/src/vendor/raf.rs).
+RAF_OLD = re.compile(r"^(FinePix (E|F|S\d|S\d{3,4}|IS)|IS Pro|S5Pro|S3Pro|S2Pro)", re.I)
+
+# Probability that an unverified body of a format decodes correctly, used for the use-weighted share only.
+CONFIDENCE = {"DNG": 0.95, "CR2": 0.95, "CR3": 0.6, "NEF": 0.9, "NRW": 0.9, "ARW": 0.9, "SR2": 0.8, "RAF": 0.95,
+              "RW2": 0.95, "RWL": 0.95, "RAW": 0.95, "PEF": 0.9, "ORF": 0.8, "SRW": 0.8}
+
+
+def read_tsv(name):
+    with open(os.path.join(HERE, name), newline="", encoding="utf-8") as f:
+        lines = [line for line in f if not line.startswith("#")]
+    return list(csv.DictReader(lines, delimiter="\t"))
+
+
+def exts(field):
+    return [e.strip().upper() for e in re.split(r"[,/+]", re.sub(r"\(.*?\)", "", field)) if e.strip()]
+
+
+def classify(maker, camera, ext_field):
+    """(class, format, reason) from the format rules alone."""
+    es = exts(ext_field)
+    for e in es:
+        if e == "DNG":
+            return "unverified", "DNG", "DNG decoder (uncompressed, LJ92, lossy, Deflate, JPEG XL, LinearRaw)"
+        if e == "CR2":
+            return "unverified", "CR2", "CR2 lossless JPEG decoder"
+        if e == "CR3":
+            return "unverified", "CR3", "CRX decoder: lossless and C-RAW 0x100 / 0x200 single-tile; other variants fall back to the preview"
+        if e in ("NEF", "NRW"):
+            return "unverified", e, "NEF decoder (uncompressed, lossless, lossy, lossy after split); HE / HE* setting preview-only"
+        if e == "ARW":
+            return "unverified", "ARW", "ARW decoder (uncompressed, cRAW, packed 12-bit, lossless, downsized YCbCr)"
+        if e == "SR2":
+            return "unverified", "SR2", "SR2 decoder"
+        if e == "RAF":
+            if RAF_OLD.search(camera):
+                return "preview", "RAF", "pre-X FinePix RAF without a raw IFD"
+            return "unverified", "RAF", "RAF decoder (uncompressed, lossless / lossy compressed, Bayer and X-Trans)"
+        if e in ("RW2", "RWL") or (e == "RAW" and maker in ("Panasonic", "Leica")):
+            return "unverified", e, "Panasonic decoder, every raw format"
+        if e == "PEF":
+            return "unverified", "PEF", "PEF decoder (uncompressed, Huffman, packed 12-bit)"
+        if e == "ORF":
+            if ORF_DECODED.match(camera):
+                return "unverified", "ORF", "uncompressed / packed ORF"
+            return "preview", "ORF", "compressed ORF is not decoded"
+        if e == "SRW":
+            if SRW_COMPRESSED.search(camera):
+                return "preview", "SRW", "compressed SRW is not decoded"
+            return "unverified", "SRW", "uncompressed / packed SRW"
+    e = es[0] if es else ""
+    if e in ("CRW", "3FR", "FFF", "IIQ", "MOS", "ERF", "KDC", "MRW", "X3F", "RAW", "ORI"):
+        return "preview", e, f"{e} is opened from its embedded JPEG only"
+    return "unsupported", e, f"{e or 'unknown'} is not imported"
+
+
+def main():
+    adobe = read_tsv("adobe-cameras.tsv")
+    evidence = {(r["maker"], r["camera"]): r for r in read_tsv("evidence.tsv")}
+    rows = []
+    for a in adobe:
+        cls, fmt, reason = classify(a["maker"], a["camera"], a["extensions"])
+        ev = evidence.get((a["maker"], a["camera"]))
+        if ev:
+            cls, reason = ev["status"], ev["source"]
+        rows.append({"maker": a["maker"], "camera": a["camera"], "format": fmt, "year_added": a["year_added"], "class": cls, "reason": reason})
+
+    out = os.path.join(HERE, "coverage.tsv")
+    header = ["maker", "camera", "format", "year_added", "class", "reason"]
+    text = "# Generated by docs/raw/coverage.py; do not edit.\n" + "\t".join(header) + "\n"
+    text += "".join("\t".join(r[k] for k in header) + "\n" for r in rows)
+    if "--check" in sys.argv:
+        with open(out, encoding="utf-8") as f:
+            if f.read() != text:
+                print("docs/raw/coverage.tsv is stale: run python3 docs/raw/coverage.py")
+                return 1
+    else:
+        with open(out, "w", encoding="utf-8") as f:
+            f.write(text)
+
+    classes = ["verified", "unverified", "preview", "unsupported"]
+    by_maker = {}
+    for r in rows:
+        by_maker.setdefault(r["maker"], {c: 0 for c in classes})[r["class"]] += 1
+    print("| Maker | Adobe models | verified | unverified | preview | unsupported |")
+    print("|---|---:|---:|---:|---:|---:|")
+    for m, c in sorted(by_maker.items(), key=lambda kv: -sum(kv[1].values())):
+        print(f"| {m} | {sum(c.values())} | " + " | ".join(str(c[k]) for k in classes) + " |")
+    tot = {k: sum(c[k] for c in by_maker.values()) for k in classes}
+    n = sum(tot.values())
+    print(f"| **All** | **{n}** | " + " | ".join(f"**{tot[k]}** ({100 * tot[k] / n:.0f}%)" for k in classes) + " |")
+    recent = [r for r in rows if r["year_added"] and int(r["year_added"]) >= 2017]
+    rc = {k: sum(1 for r in recent if r["class"] == k) for k in classes}
+    print(f"\nModels added since 2017 (ACR 10+): {len(recent)}: " + ", ".join(f"{k} {rc[k]}" for k in classes))
+
+    # Use-weighted share of photographers whose camera fully works (decodes from sensor data).
+    weights = read_tsv("usage-weights.tsv")
+    by_cam = {(r["maker"], r["camera"]): r for r in rows}
+    total = works = verified_share = 0.0
+    print("\n| Bucket | Weight | Camera fully works | of which verified bodies |")
+    print("|---|---:|---:|---:|")
+    for b in [w for w in weights if w["kind"] == "maker"]:
+        makers = b["makers_or_camera"].split(",")
+        popular = [w["makers_or_camera"] for w in weights if w["kind"] == "body" and w["bucket"] == b["bucket"]]
+        members = [r for r in rows if r["maker"] in makers]
+        pop_rows = [r for m in makers for (mk, cam), r in by_cam.items() if mk == m and cam in popular]
+        missing = set(popular) - {r["camera"] for r in pop_rows}
+        if missing:
+            print(f"usage-weights.tsv: unknown cameras {sorted(missing)}", file=sys.stderr)
+            return 1
+        rest = [r for r in members if r["camera"] not in popular]
+
+        def score(r):
+            if r["class"] == "verified":
+                return 1.0
+            if r["class"] == "unverified":
+                return CONFIDENCE.get(r["format"], 0.7)
+            return 0.0
+
+        def mean(rs, f):
+            return sum(f(r) for r in rs) / len(rs) if rs else 0.0
+
+        if pop_rows:
+            s = 0.8 * mean(pop_rows, score) + 0.2 * mean(rest, score)
+            v = 0.8 * mean(pop_rows, lambda r: r["class"] == "verified") + 0.2 * mean(rest, lambda r: r["class"] == "verified")
+        else:
+            s, v = mean(members, score), mean(members, lambda r: r["class"] == "verified")
+        w = float(b["weight"])
+        total += w
+        works += w * s
+        verified_share += w * v
+        print(f"| {b['bucket']} | {w:g}% | {100 * s:.0f}% | {100 * v:.0f}% |")
+    print(f"| **Weighted** | {total:g}% | **{100 * works / total:.0f}%** | **{100 * verified_share / total:.0f}%** |")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

docs/raw/evidence.tsv

@@ -0,0 +1,249 @@
+# Per-model evidence that overrides the format rules in coverage.py. status: verified | preview | unsupported.
+# "verified" means a real file from this body decoded from sensor data in a corpus test or a recorded bulk check (source column).
+maker	camera	status	source
+Apple	iPhone 12 Pro Rear Wide Camera	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 40D	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 550D (EOS Digital Rebel T2i, EOS Kiss X4 Digital)	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 5D Mark II	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 5DS R	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 6D	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 7D	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS 80D	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Canon	EOS M50 (EOS Kiss M)	verified	corpus: crates/raw/tests/cr3_corpus.rs (exact sensor hashes, docs/cr3.md)
+Canon	EOS R100	verified	corpus: crates/raw/tests/cr3_corpus.rs (exact sensor hashes, docs/cr3.md)
+Canon	EOS R8	verified	corpus: crates/raw/tests/cr3_corpus.rs (exact sensor hashes, docs/cr3.md)
+Canon	EOS-5D Mark III	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	GFX 100	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	GFX 100RF (Final Support)	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	GFX 100S	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	GFX 50S	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-A2	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-A5	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-E1	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-E5	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-H2	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-H2S	verified	docs/raf-compression.md (supplied files, exact sensor arrays)
+Fujifilm	X-M5	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-T2	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-T20	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-T4**	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-T5	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Fujifilm	X-T50	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Google	Pixel 2 XL	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Leica	C (Typ 112)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	D-Lux (Typ 109)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	D-Lux 3	verified	PR #215: raw.pixls.us bulk check of every RW2 / RWL / RAW body
+Leica	D-Lux 4	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	D-Lux 5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	D-Lux 6	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	D-Lux 7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	Digilux 2	verified	PR #215: raw.pixls.us bulk check of every RW2 / RWL / RAW body
+Leica	Digilux 3	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	V-LUX (Typ 114)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	V-LUX 1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	V-LUX 4	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Leica	V-LUX 5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Nikon	COOLPIX B700	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Nikon	D5100	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Nikon	D7000	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Nikon	D7500	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Nikon	Z f	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Olympus	E-1	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Olympus	EVOLT E-400	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Olympus	Stylus XZ-2 iHS	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Panasonic	LUMIX DC - G97 (DC-G99M2)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-FZ1000M2 (DC-FZ10002)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-FZ80 (DC-FZ82, DC-FZ85)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-G100 (DC-G110)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-G100D	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-G9	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-G95D	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-G99 (DC-G90, DC-G91, DC-G95)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GF10 (DC-GF90)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GF9 (DC-GX850, DC-GX800)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GH5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GH5M2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GH5s	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GH6	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GH7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GX880	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-GX9 (DC-GX7MK3)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-LX100 II	verified	PR #215: raw.pixls.us bulk check of every RW2 / RWL / RAW body
+Panasonic	LUMIX DC-S1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S1H	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S1M2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S1M2ES (Final Support)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S1R	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S1RM2 (Final Support)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S5M2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S5M2X	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-S9	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-TX2D (DC-TZ200D, DC-TZ202D, DC-TZ220D, DC-ZS200D, DC-ZS220D)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-ZS70 (DC-TZ90, DC-TZ91, DC-TZ92, DC-TZ93)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-ZS80 (DC-TZ95, DC-TZ96, DC-TZ97)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DC-ZS80D (DC-TZ95D, DC-TZ96D)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DCG9M2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-CM1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FX150	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ100	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ1000	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ150	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ18	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ200	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ2500 (DMC-FZ2000, DMC-FZH1)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ28	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ30	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ300	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ330	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ35	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ38	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ40 (DMC-FZ45)	verified	PR #215: raw.pixls.us bulk check of every RW2 / RWL / RAW body
+Panasonic	LUMIX DMC-FZ50	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ70	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ72	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-FZ8	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G10	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G3	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G6	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-G8 (DMC-G80, DMC-G81, DMC-G85)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF3	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF6	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GF8	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GH1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GH2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GH3	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GH4	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GM1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GM1S	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GM5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GX1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GX7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GX8	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-GX85 (DMC-GX80, DMC-GX7MK2)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-L1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-L10	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LF1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX1	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX100	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX2	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX3	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX5	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX7	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-LX9 (DMC-LX10, DMC-LX15)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-ZS100 (DMC-ZS110, DMC-TZ100, DMC-TZ101, DMC-TZ110, DMC-TX1)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-ZS40 (DMC-TZ60, DMC-TZ61)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-ZS50 (DMC-TZ70, DMC-TZ71)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX DMC-ZS60 (DMC-TZ80, DMC-TZ81, DMC-TZ85)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Panasonic	LUMIX ZS200 (DC-TX2, DC-TZ200, DC-TZ202, DC-TZ220, DC-ZS220)	verified	PR #215: 178 raw.pixls.us files from 118 Panasonic / Leica bodies, every RW2 format
+Pentax	K-3	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Pentax	K-5 IIs	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Pentax	K10D	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Ricoh	GR III	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Samsung	TL500 (EX1)	verified	corpus: crates/raw/tests/corpus.rs (xtask RAW_SAMPLES)
+Sony	A100 (DSLR-A100)	unsupported	issue #702: regression, refused as not a readable photo
+Sony	A200 (DSLR-A200)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A230 (DSLR-A230)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A290 (DSLR-A290)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A300 (DSLR-A300)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A3000 (ILCE-3000)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A33 (SLT-A33)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A330 (DSLR A330)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A35 (SLT-A35)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A350 (DSLR-A350)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A3500 (ILCE-3500)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A37 (SLT-A37)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A380 (DSLR-A380)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A390 (DSLR-A390)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A450 (DSLR-A450)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A500 (DSLR-A500)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A5000 (ILCE-5000)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A5100 (ILCE-5100)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A550 (DSLR-A550)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A55V (SLT-A55V)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies
+Sony	A560 (DSLR-A560)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A57 (SLT-A57)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A58 (SLT-A58)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A580 (DSLR-A580)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6000 (ILCE-6000)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6100 (ILCE-6100)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6300 (ILCE-6300)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6400 (ILCE-6400)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A65 (SLT-A65)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6500 (ILCE-6500)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6600 (ILCE-6600)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A6700 (ILCE-6700)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A68 (ILCA-68)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7 (ILCE-7)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7 II (ILCE-A7M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies
+Sony	A7 III (ILCE-7M3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7 IV (ILCE-7M4)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A700 (DSLR-A700)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A77 (SLT-A77)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A77 II (ILCA-77M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7C (ILCE-7C)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7C II (ILCE-7CM2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7CR (ILCE-7CR)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R (ILCE-7R)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R II (ILCE-7RM2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R III (ILCE-7RM3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R IIIA (ILCE-7RM3A)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R IV (ILCE-7RM4)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R IVA (ILCE-7RM4A)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7R V (ILCE-7RM5)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7S (ILCE-7S)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7S II (ILCE-7SM2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A7s III (ILCE-7SM3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A850 (DSLR-A850)	preview	issue #535: preview-only on the raw.pixls.us sample
+Sony	A9 (ILCE-9)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A9 II (ILCE-9M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A9 III (ILCE-9M3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A900 (DSLR-A900)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	A99 (SLT-A99V)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies
+Sony	A99 II (ILCA-99M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	Alpha 1 (ILCE-1)*	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	DSC-F828	unsupported	issue #702 (SRF refused); SRF not in the import list
+Sony	DSC-HX95	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	DSC-HX99	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	DSC-V3	unsupported	SRF not in the import list
+Sony	FX3 (ILME-FX3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	FX30 (ILME-FX30)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-3	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-3N	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-5	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-5N	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-5R	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-5T	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-6	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-7	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-C3	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	NEX-F3	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	QX1 (ILCE-QX1)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX0 (DSC-RX0)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX0 II (DSC-RX0M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX1 (DSC-RX1)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX10 (DSC-RX10)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX10 II (DSC-RX10M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX10 III (DSC-RX10M3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX10 IV (DSC-RX10M4)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 (DSC-RX100)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 II (DSC-RX100M2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 III (DSC-RX100M3)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 IV (DSC-RX100M4)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 V (DSC-RX100M5)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 VA (DSC-RX100M5A)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 VI (DSC-RX100M6)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX100 VII (DSC-RX100M7)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX1R (DSC-RX1R)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	RX1R II (DSC-RX1RM2)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	ZV-1 (DCZV1/B)	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	ZV-E1	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)
+Sony	ZV-E10	verified	issue #535: raw.pixls.us bulk check of all 100 Sony bodies (decodes; BL/WL/crop/WB vs ExifTool)

docs/raw/usage-weights.tsv

@@ -0,0 +1,114 @@
+# Estimated share of Lightroom raw photographers by camera maker, and the popular bodies of the last ~8 years inside each.
+# Sources (2026-10-10): Nikkei 2025 mirrorless production via PhotoRumors (Canon 2.3 M, Sony 1.8 M, Nikon 0.86 M, Fujifilm 0.75 M
+# units, i.e. ~36 / 29 / 14 / 12 % of CIPA's 6.31 M); BCN 2025 Japanese retail via PetaPixel (Sony 29.9 %, Canon 27.4 %, Nikon 15.1 %);
+# camera makers named in this repo's user issues (325 issues: Sony 33, Nikon 31, Canon 26, phones 23, Fujifilm 9, Panasonic/Leica 8,
+# OM/Olympus 6, Pentax/Ricoh 6, Samsung NX 5). Canon and Nikon get extra weight for their installed base of DSLRs.
+# Rows "maker" give the maker bucket's weight (percent of photographers); rows "body" give a popular body inside a bucket.
+# Inside a bucket, the listed bodies share 80 % equally and every other Adobe-listed model of the bucket's makers shares 20 %.
+kind	bucket	makers_or_camera	weight
+maker	Canon	Canon	33
+maker	Sony	Sony	27
+maker	Nikon	Nikon	16
+maker	Fujifilm	Fujifilm	10
+maker	Panasonic	Panasonic	4
+maker	OM / Olympus	Olympus,OM Digital Solutions	3
+maker	Phones	Apple,Google,Samsung,Xiaomi,Huawei,Oppo,OnePlus,LG,Motorola,Nokia	3
+maker	Pentax / Ricoh	Pentax,Ricoh	1.5
+maker	Leica	Leica	1
+maker	DJI	DJI	1
+maker	Medium format and others	Hasselblad,Phase One,Leaf,Mamiya,Sigma,Kodak,Konica Minolta,Epson,Casio,GoPro,Insta360,Zeiss,Pixii,Light,Skydio,Parrot,Yuneec,Contax,DxO	0.5
+body	Canon	EOS R6 Mark II	1
+body	Canon	EOS R5	1
+body	Canon	EOS R6	1
+body	Canon	EOS R7	1
+body	Canon	EOS R8	1
+body	Canon	EOS R10	1
+body	Canon	EOS R50	1
+body	Canon	EOS RP	1
+body	Canon	EOS R (** see note)	1
+body	Canon	EOS R5 Mark II	1
+body	Canon	EOS R6 Mark III	1
+body	Canon	EOS R3	1
+body	Canon	EOS R100	1
+body	Canon	EOS 90D	1
+body	Canon	EOS M50 (EOS Kiss M)	1
+body	Canon	EOS M50 Mark II	1
+body	Canon	EOS M6 Mark II	1
+body	Canon	EOS-5D Mark IV (** see note)	1
+body	Canon	EOS 6D Mark II	1
+body	Canon	EOS 80D	1
+body	Canon	EOS 250D (EOS Rebel SL3, EOS 200D II, EOS Kiss X10)	1
+body	Canon	EOS 1500D (EOS Rebel T7, EOS Kiss X90, EOS 2000D)	1
+body	Sony	A7 IV (ILCE-7M4)	1
+body	Sony	A7 III (ILCE-7M3)	1
+body	Sony	A7R V (ILCE-7RM5)	1
+body	Sony	A7R IV (ILCE-7RM4)	1
+body	Sony	A7C (ILCE-7C)	1
+body	Sony	A7C II (ILCE-7CM2)	1
+body	Sony	A7CR (ILCE-7CR)	1
+body	Sony	A6400 (ILCE-6400)	1
+body	Sony	A6700 (ILCE-6700)	1
+body	Sony	A6600 (ILCE-6600)	1
+body	Sony	A6100 (ILCE-6100)	1
+body	Sony	Alpha 1 (ILCE-1)*	1
+body	Sony	A9 III (ILCE-9M3)	1
+body	Sony	ZV-E10	1
+body	Sony	A7s III (ILCE-7SM3)	1
+body	Sony	RX100 VII (DSC-RX100M7)	1
+body	Nikon	Z 6 II	1
+body	Nikon	Z 6 III	1
+body	Nikon	Z 8	1
+body	Nikon	Z 9 (*See note)	1
+body	Nikon	Z f	1
+body	Nikon	Z 5	1
+body	Nikon	Z 50	1
+body	Nikon	Z 50 II	1
+body	Nikon	Z fc	1
+body	Nikon	Z 7 II	1
+body	Nikon	D850	1
+body	Nikon	D750	1
+body	Nikon	D7500	1
+body	Nikon	D780	1
+body	Fujifilm	X-T5	1
+body	Fujifilm	X-T4**	1
+body	Fujifilm	X-S20	1
+body	Fujifilm	X-S10	1
+body	Fujifilm	X-H2S	1
+body	Fujifilm	X-H2	1
+body	Fujifilm	X100V**	1
+body	Fujifilm	X100VI	1
+body	Fujifilm	X-T30 II	1
+body	Fujifilm	X-E4	1
+body	Fujifilm	X-T50	1
+body	Fujifilm	GFX 100S	1
+body	Fujifilm	X-M5	1
+body	Panasonic	LUMIX DC-S5	1
+body	Panasonic	LUMIX DC-S5M2	1
+body	Panasonic	LUMIX DC-GH6	1
+body	Panasonic	LUMIX DC-GH5M2	1
+body	Panasonic	LUMIX DCG9M2	1
+body	Panasonic	LUMIX DC-G9	1
+body	Panasonic	LUMIX DC-S1	1
+body	Panasonic	LUMIX DC-GX9 (DC-GX7MK3)	1
+body	Panasonic	LUMIX DMC-G8 (DMC-G80, DMC-G81, DMC-G85)	1
+body	Panasonic	LUMIX DC-LX100 II	1
+body	OM / Olympus	OM-D E-M1 Mark III	1
+body	OM / Olympus	OM-D E-M1 Mark II	1
+body	OM / Olympus	OM-D E-M10 Mark IV	1
+body	OM / Olympus	OM-D E-M5 Mark III	1
+body	OM / Olympus	PEN E-P7	1
+body	OM / Olympus	Stylus Tough TG-6	1
+body	OM / Olympus	OM System OM-1	1
+body	OM / Olympus	OM System OM-1 MARK II	1
+body	OM / Olympus	OM System OM-5	1
+body	Pentax / Ricoh	K-1 II (* see note)	1
+body	Pentax / Ricoh	K-3 Mark III	1
+body	Pentax / Ricoh	KF	1
+body	Pentax / Ricoh	K-70	1
+body	Pentax / Ricoh	GR III	1
+body	Pentax / Ricoh	GR IIIx	1
+body	Leica	Q3	1
+body	Leica	Q2	1
+body	Leica	M11	1
+body	Leica	SL2	1
+body	Leica	M10	1

docs/releasing.md

@@ -57,7 +57,9 @@ workflow, and bump it (in `release.yml`, five jobs, and `freebsd.yml`) whenever
 shipped language needs: a stale pin still builds, it just ships tofu (issue #319: v0.4.0 pinned a revision
 from before Noto Sans CJK SC, so Simplified Chinese had no glyphs). Before a release, check the pin against
 craft-fonts' `fonts/manifest.txt` and run `CRAFT_FONTS_DIR=../craft-fonts cargo test -p lightcraft-ui-egui i18n`,
-whose glyph-coverage test fails when a language's characters have no face.
+whose glyph-coverage test checks the characters in available faces. `CRAFT_FONTS_REQUIRED=1` now also makes
+the native build fail if the pinned manifest lacks Noto Sans CJK SC Regular (`Hans`) or BIZ UDPGothic Regular;
+the web build requires BIZ UDPGothic Regular and packages Noto Sans CJK SC as a separate asset.
 
 ## Signing credentials
 

docs/roadmap.md

@@ -0,0 +1,113 @@
+# Roadmap: milestones, current focus and what's next
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created; milestones moved here from ROADMAP.md, focus re-ranked after the 2026-10-10 re-measure) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+Forward-looking plan. The summary with the headline numbers is [ROADMAP.md](../ROADMAP.md); the
+ranked shortfalls are [gaps.md](gaps.md); the numbers come from [target-app-parity.md](target-app-parity.md).
+LightCraft has no `cargo xtask scorecard`; the measured checklist is
+[parity-checklist.md](parity-checklist.md) (`cargo xtask parity`).
+
+## Current focus
+
+Toward **beta** (~340–600 Opus 5.5 agent hours; ranked, each a gap in [gaps.md](gaps.md)):
+
+1. **Camera colour of our own** (gap 1, 50–90 h): chart-based calibration for the most-used models,
+   building on the per-file JPEG fits and pooled profiles (`lightcraft-cli calibrate`); never Adobe
+   data.
+2. **CR3 for every Canon body** (gap 2, 25–45 h): the remaining CRX variants, sRAW / mRAW, HEIF CR3;
+   clean-room from prose descriptions (decided 2026-10-05; compressed NEF is the template).
+3. **Render-fidelity suite** (gap 3, 30–60 h): score our output against Lightroom's on the same CC0
+   raws (references local in `plan/`), then tune; a retune ships as a new process version.
+4. **Full-resolution zoom** (gap 4, 8–15 h): visible-region rendering so 100% shows original pixels.
+5. **AI masks** (gap 5, 40–70 h): Subject / Sky / People on licensable weights; configure the SAM 3
+   mirror. Needs the maintainer's model decision.
+6. **Compressed ORF and HE NEF** (gaps 6–7, 28–55 h).
+7. **Lens profiles of our own** (gap 8, 40–80 h).
+8. **Tests in CI on macOS, Windows and Linux** (gap 9, 6–12 h).
+9. **Per-model verification** (gap 10, 20–35 h).
+
+## Alpha gate
+
+The target's core workflows: what a typical Lightroom user does every day. Alpha requires each to
+work end to end on the main platform (macOS) and the work to save and reopen. Checked on 2026-10-10
+against the code, tests, issues and [gaps.md](gaps.md).
+
+| Workflow | Works end to end? | Evidence | Hours to pass |
+|---|---|---|---:|
+| 1. Import a shoot (raw + JPEG) from a card or folder into the library | yes | Add / Copy / Move import with templates, duplicates, devices with DCIM, background import with cancel (`crates/engine/src/import.rs`, `tests_import.rs`, `tests_import_move.rs`); checklist A 83% | 0 |
+| 2. Cull: rate, flag, label, compare / survey, filter, check focus | yes (partial: focus check) | ratings / flags / labels with advance, Compare, Survey ≤ 48, filter bar, smart albums (checklist B–D 88–92%); 100% zoom is capped by the preview size (2,560 px default, adjustable in Settings), gap 4 — degrades focus checks on large files but does not block culling | 0 (8–15 h to close gap 4, beta) |
+| 3. Develop raws non-destructively (global sliders, crop, masks, heal) | yes for most cameras (partial: Canon CR3 outside the verified variants, compressed ORF, HE NEF open as embedded previews) | Sony, Nikon (except HE), Fujifilm, Panasonic, Pentax, CR2, DNG decode from sensor data (raw-parity.md); every Edit slider, crop / Upright, brush / gradient / range masks, heal / clone (checklist F, H, K); colour estimated per file rather than measured, gaps 1–3 | 0 (coverage and colour gaps are beta blockers 1–3, 6–7) |
+| 4. Save, quit and reopen the work | yes | crash-safe journal + snapshots, torn-append and crash tests (`crates/catalog/src/journal.rs`, `tests_journal.rs`, `tests_torn_append.rs`); XMP sidecars read / write; failed saves reported | 0 |
+| 5. Batch-apply a look: presets, copy / paste / sync settings | yes | presets (incl. `.xmp` / `.lrtemplate` import), copy / paste / sync, auto sync (checklist L 86%, N 100%) | 0 |
+| 6. Export deliverables (JPEG / TIFF, size, sharpening, metadata, watermark, naming) | yes | one encoder for app, CLI and MCP (`crates/engine/src/export.rs`, `tests_export.rs`); checklist S 89% | 0 |
+
+**Result: passes.** Every core workflow runs end to end on macOS and the work survives quit and
+reopen; the partial rows degrade fidelity for some cameras and large files but don't stop the
+workflow, so LightCraft stays **alpha** (ready for real work ~61%, above the ~40% bar).
+
+## After beta
+
+Enhance (Raw Details, Super Resolution, X-Trans denoise), content-aware remove, HDR display, the
+Classic output modules (Print, then Map, Book, Slideshow, publish services), tethering, video,
+plug-in ecosystem, localization to `full` and new scripts (RTL, shaping). Estimates in
+[gaps.md](gaps.md) entries 11–28; ~500–1,300 h after beta.
+
+## Milestones
+
+Original wall-clock estimates (made before work started, 4–6 parallel agents) are kept for
+calibration: M0–M13 took ≈ 25 active hours against an estimate of ≈ 110–170 h.
+
+**Status legend:** ✅ done · 🚧 in progress · ⬜ not started
+
+| # | Milestone | Scope (summary) | Estimate (h) | Status |
+|---|---|---|---|---|
+| M0 | Skeleton + visual shell | workspace, xtask CI + layering, geom/color/raster, develop model, pipeline v0, catalog v0, engine commands, Lightroom-look UI (grid, loupe, filmstrip, Edit panel), control channel, MCP, web build | 3–5 | ✅ |
+| M1 | Library core | import (JPEG/PNG/TIFF/WebP), EXIF/XMP, persistent catalog (op log + snapshots), albums, ratings/flags/labels, filter/search/sort, thumbnail cache, 100k-photo grid | 6–10 | ✅ (100k-photo grid scale test pending) |
+| M2 | Pipeline v1 (quality) | WB temp/tint, profiles, local tone mapping (highlights/shadows), curves, HSL, point colour, colour grading, texture/clarity/dehaze, vignette, grain, B&W, auto tone/WB, histogram, before/after | 10–15 | ✅ (look tuning vs our references ongoing) |
+| M3 | RAW I | TIFF/DNG (LJ92, deflate, tiles, opcodes), demosaic (AHD/PPG/bilinear), highlight recovery, DNG colour model, CR2, NEF, ARW, embedded previews | 10–15 | ✅ (DNG, CR2 incl. sRAW, ARW, NEF uncompressed / lossless / lossy / lossy after split, embedded previews) |
+| M4 | Crop, geometry, optics | crop tool + overlays, straighten, Upright (auto/level/vertical/full/guided), manual transforms, CA, defringe, manual lens corrections | 6–10 | ✅ |
+| M5 | Performance | source pyramids, wgpu compute pipeline (CPU oracle), draft/full renders, prefetch, budgets (16 ms slider updates on 24 MP) | 10–15 | 🚧 (stage cache, source pyramid, wgpu pipeline, prefetch, memory budget ✅; colour NR at half resolution, GPU histogram ⬜) |
+| M6 | Masking | brush, linear/radial gradients, colour/luminance/depth range, add/subtract/intersect/invert, all local adjustments, masks panel | 8–12 | 🚧 (brush/linear/radial/colour/luminance range, add/subtract/intersect, masks panel ✅; depth range, AI masks ⬜) |
+| M7 | Detail | sharpening + masking preview, luminance/colour NR, Denoise, Raw Details, Super Resolution | 6–10 | 🚧 (sharpening, luminance/colour NR ✅; AI Denoise 🟡 (Bayer, optional weights; policy/fidelity open); Raw Details, Super Resolution ⬜) |
+| M8 | Heal / Remove | content-aware remove (PatchMatch), heal, clone, brush spots, visualize spots, red/pet eye | 6–10 | 🚧 (heal, clone, auto source, visualize spots, red/pet eye ✅; PatchMatch remove ⬜) |
+| M9 | Presets, profiles, versions, sync | preset browser + amount, create/import presets, profile browser, versions, history, copy/paste/sync settings | 5–8 | ✅ |
+| M10 | Export & share | export dialog (JPEG/PNG/TIFF/DNG/AVIF/JXL/original), sizing, sharpening, metadata, watermark, naming, batch jobs, XMP sidecars, HDR export | 6–10 | 🚧 (all formats incl. DNG/original, sizing, presets, background jobs, HDR gain map JPEG / PQ AVIF ✅; JXL encode ⬜) |
+| M11 | RAW II | CR3, RAF (X-Trans), ORF, RW2, PEF, SRW, 3FR, IIQ + long tail; camera calibration DB; HEIC/AVIF/JXL import | 20–35 | 🚧 (RAF all, RW2 every format, PEF, ORF uncompressed and 12.8 bpp, SRW uncompressed, HEIC ✅; CR3 🟡 (3 bodies verified); **camera colour calibration** 🚧 (per-file JPEG fits, 4 bundled profiles, 52 spectral matrices; measured database missing); compressed ORF / SRW, HE NEF, IIQ, X3F ⬜) |
+| M12 | AI & smart features | subject/sky/background/people/object masks, semantic search, faces/People (permissively licensed models, pure-Rust inference) | 20–40 | 🚧 (faces: detection, recognition, People view ✅; Object / Describe masks via SAM 3 🟡; Subject / Sky / People masks, semantic search ⬜) |
+| M13 | Merge | HDR merge (deghost), panorama (projections, boundary warp, fill edges), HDR panorama | 10–15 | ✅ |
+| M14 | Video | import/playback/trim via FilmCraft crates, global edits + presets on video, video export | 6–10 | ⬜ |
+| M15 | Classic modules | Map, Book, Slideshow, Print, Web; smart collections, stacks, virtual copies, publish services, tethering | 25–40 | 🚧 (smart albums, stacks, virtual copies, compare/survey ✅; contact-sheet PDF 🟡; Map/Book/Slideshow/Print/Web ⬜) |
+| M16 | 1.0 polish | preferences, shortcut editor, accessibility, localization, packaging (dmg/msi/AppImage/web), hardening | 10–20 | 🚧 (settings, keyboard shortcuts sheet, packaging basics ✅; English/Chinese (Simplified, Traditional)/Japanese/Brazilian Portuguese/Spanish/German/Russian/Ukrainian localisation 🟡; accessibility and further locales ⬜) |
+
+## Risks that coding hours alone don't retire
+
+- **AI features** (subject / sky / people masks, generative remove) need model weights with
+  licences we can ship; classical fallbacks first. No permissively licensed sky-segmentation or
+  raw-denoise model was found; we may need to train our own.
+- **Camera colour and lens data** is a data problem: we never use Adobe's matrices, DCPs or LCPs.
+  DNG-embedded data first, then our own calibration; long-tail coverage grows over time and needs
+  people with cameras, lenses and charts.
+- **Raw-format sources:** decoders are written from prose format descriptions (even ones published
+  alongside GPL code); decoder source is never read (decided 2026-10-05). Still open:
+  freedom-to-operate review for local Laplacian filters, PatchMatch and HEVC (HEIC).
+- **Look parity** with Adobe's default rendering is tuned by eye until the fidelity suite exists.
+  Retuning changes existing edits, so it ships as a new process version
+  ([process-versions.md](process-versions.md)).
+
+## Design notes kept from the old ROADMAP
+
+- **Folder records:** library folders have records of their own in the catalog
+  (`Catalog.folder_records`, keyed by folder path; colour labels first). Photos still store full
+  paths, so moving a whole disk relinks each photo. If that becomes a problem (an "Update Folder
+  Location" for a renamed drive, journal growth on large moves), the next step is the Classic model:
+  photos point to a folder id (root + relative path).
+- **Zoom:** native pinch zoom and two-finger pan work in Detail, Compare and Reference views; the
+  whole-image preview still has a configurable cap (2,560 px default), see gap 4.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | Beta hours 340–600; full ready ~59% in the gate note |
+| 2026-10-10 | minor | Added the Alpha gate table (core-workflow gate from the revised standard): passes, stays alpha |
+| 2026-10-10 | major | Created: milestones moved from ROADMAP.md (statuses refreshed: M3 ✅, M11 / M12 / M15 detail), current focus re-ranked toward beta, risks and design notes kept |

docs/sony-lens-corrections.md

@@ -0,0 +1,117 @@
+# Sony embedded distortion corrections
+
+LightCraft reads the signed 16-sample distortion table in the raw image IFD (`0x7037`) of
+Sony **ILCE-7RM4A (A7R IVA)** Bayer ARWs. Other camera models are deliberately left uncorrected,
+even when they contain a table with the same layout.
+It converts that table into `OpcodeList3` / `WarpRectilinear`, so the existing profile correction control,
+CPU/GPU optics path, EXIF orientation handling, and DNG export use the same correction.
+
+This adds **distortion only**. Sony vignetting and lateral chromatic-aberration tables are not decoded.
+The enabled and independently validated model is ILCE-7RM4A with the FE 24–105mm F4 G OSS and
+FE 200–600mm F5.6–6.3 G OSS. Linear YCbCr ARWs and non-3:2 camera crops are excluded pending validation. An aspect crop may
+retain the full-frame radial normalization; the decoder does not guess that relationship. Older files that carry
+only encrypted correction metadata, different table lengths, and rejected tables remain uncorrected.
+The camera's distortion Off setting does not erase its table. Newly imported photos use LightCraft's existing
+embedded-profile default (enabled); the profile correction control can disable or adjust it.
+
+## Clean-room evidence
+
+The [ExifTool EXIF tag-name documentation](https://exiftool.org/TagNames/EXIF.html) identifies
+`0x7037` as 17 signed 16-bit integers. The first value is the count, 16, followed by radial samples.
+No external photo decoder implementation or Adobe lens profile was consulted.
+Sony Imaging Edge Edit 4.1 was used only as a black-box reference on local scratch copies.
+
+The observed inverse mapping, with radius `r` normalized to the default crop's half diagonal, is:
+
+```
+f(r) = 1 + interpolate(table, r) / 16384
+source = center + (output - center) * zoom * f(r)
+zoom = 1 / max(f(r)) over radii on the rectangular output boundary
+```
+
+The border radii range from the shorter half edge / half diagonal to 1. Table knots span 0 through 1.
+Linear interpolation approximates the observed map closely; we do not claim to reproduce Sony's
+internal interpolator. A fixed-size weighted least-squares fit expresses source radius as
+`r * (k0 + k1*r² + k2*r⁴ + k3*r⁶)`. The fit is rejected if radial error exceeds 0.0005 of the
+half diagonal (about 0.43 px at a 1440 px 3:2 preview), or the mapping folds. Table values are bounded
+and the input must have precisely the supported signed-short layout. Crop offset and normalization
+are converted into DNG's active-area coordinate system before creating the opcode. The warp's centre
+and normalization come from the standard `DefaultCropOrigin` / `DefaultCropSize` when the file has them,
+not from Sony's crop tags: on the tested A7R IVA files the former start at raw x=32 and the latter at
+x=0, and the standard origin is the one that aligns with Sony's exports. The image itself keeps the
+decoder's crop precedence for every Sony body (Sony's crop tags, then the default crop, then the
+recorded image size), so the framing is unchanged; the opcode's centre is in active-area coordinates,
+so the warp stays on the optical centre either way. On the A7R IVA that framing still sits 32 raw
+pixels left of Sony's exports (eight pixels in a 2376-pixel-wide export).
+
+The main raw-IFD table is important: the similarly named MakerNote table has different values and
+must not be substituted into this formula. Main raw-IFD and SR2SubIFD values agreed in the test files.
+
+## Validation
+
+At 2376×1584, independent SIFT correspondences between Sony distortion On and Off TIFF exports gave:
+
+| Lens / focal length | Median residual | 95th percentile | Maximum matched radius |
+|---|---:|---:|---:|
+| FE 200–600 / 200 mm | 0.043 px | 0.191 px | 0.97 half diagonals |
+| FE 200–600 / 600 mm | 0.055 px | 0.231 px | 0.95 half diagonals |
+
+These use the fixed 16384 scale and automatic border framing, not fitted per-image scale or zoom.
+A median translation below 0.004 px was removed from the residuals. Correspondences do not cover
+all pixels; these are geometric feature residuals, not photometric equality or a worst-case guarantee.
+Across 20 sampled RAWs (16 at 24–105 mm, four at 200–600 mm), the polynomial's maximum deviation
+from the interpolated file table was below 0.12 px at 1440 px. That measures approximation error,
+not agreement with an independent renderer. Camera JPEG and Apple Core Image comparisons support
+the wide-lens interpretation but are weaker evidence than same-renderer On/Off pairs.
+
+Actual LightCraft exports after crop normalization were also compared directly with Sony's corrected
+TIFFs. At 2376 px wide, median / 95th-percentile feature residuals were 0.35 / 1.04 px at 24 mm,
+0.15 / 0.40 px at 200 mm, and 0.13 / 0.56 px at 600 mm (median translation below 0.024 px).
+The uncorrected medians at 200 and 600 mm were 8.63 and 10.82 px respectively. Different colour,
+sharpening, and demosaicing affect feature localization; these are geometry checks, not colour parity.
+An isolated desktop run on Apple M1 Metal detected the profile, rendered without GPU fallback or
+warnings, and exposed the existing Optics controls. Existing library edits are not reset: once the
+source has loaded, enable lens corrections if they were previously disabled.
+
+Tests cover signedness/length rejection, zero and malformed tables, independent 600 mm reference
+geometry, barrel framing, offset crop normalization, both TIFF byte orders, header/full consistency,
+and preservation through DNG export. No private photographs or reference TIFFs are committed.
+
+## Camera coverage and regression boundary
+
+The model check is exact: `ILCE-7RM4` (A7R IV without the A suffix), `ILCE-7M3`, unknown/missing
+model names, and every other model remain unsupported by this distortion decoder. Matching tag
+numbers and table lengths do not establish the scale, interpolation or crop normalization on another
+body. Support can expand after independent geometry validation; do not add model-name prefix matching.
+
+The original nine Sony samples listed by `cargo xtask corpus --download` were downloaded from its
+CC0 URLs. The manifest now also includes CC0 samples 4822 (A7R IVA / 24–105 mm) and 3989
+(A9 II / 200–600 mm), with their SHA-256 hashes recorded alongside the URLs. All eleven files
+are checked with `sony_embedded_distortion_is_limited_to_validated_models`:
+
+| Camera | Corpus samples | Raw-IFD table observed | Expected correction |
+|---|---|---|---|
+| ILCE-7RM4A | Compressed (4822) | 16 samples | One distortion warp |
+| ILCE-9M2 | Compressed (3989) | 16 samples | None |
+| ILCE-7M3 | Compressed, uncompressed | 16 samples | None |
+| ILCE-7M4 | 14-bit, lossless L/M/S | 11 samples in the 14-bit file; 16 in L/M/S | None |
+| ILCE-7RM2 | 12-bit uncompressed | 16 samples | None |
+| DSC-RX100 | One | No raw-IFD table | None |
+| DSC-RX100M3 | One | 11 samples | None |
+
+These are **model-boundary regression checks, not new geometric validation of those models**. In particular,
+refusing the A7 III tables resolves the unverified corner warp identified in review. The lossless M/S
+files are linear YCbCr and remain excluded independently of the model check. Header and full decode
+must agree for every sample. Synthetic tests also verify both TIFF byte orders, exact model matching,
+that the warp is centred on the standard default crop while the image keeps Sony's crop, and that DNG export preserves an accepted warp without adding one to rejected
+models. The existing independent Sony geometry tests continue to cover the enabled A7R IVA path.
+Re-exporting the 24, 200 and 600 mm reference files after the model restriction produced byte-identical
+corrected PNGs to the earlier validated exports. Isolated headless app checks showed the A7R IVA profile
+controls present and the A7 III profile controls absent, with no notices and completed RAW renders.
+
+Before enabling another body, compare corrected and uncorrected renders against independent references
+across multiple lenses/focal lengths and photographs with features near the edges and corners. Record
+residuals and spatial coverage, and check crop/aspect and compression variants. Embedded JPEGs are
+useful when the camera actually applied distortion correction; an Off JPEG cannot certify an On warp.
+Prefer same-renderer Sony On/Off exports when the camera setting or geometry is ambiguous. Table-fit
+error alone only checks our polynomial approximation, not whether the table's interpretation is correct.

docs/target-app-parity.md

@@ -0,0 +1,304 @@
+# Target-app parity: LightCraft vs Adobe Lightroom
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (full re-measure against Lightroom Classic 15.5 and the installed Lightroom 9.6; merged ROADMAP's parity estimate and honest assessment into this file) · **Target:** Adobe Lightroom Classic 15.5 (August 2026) and Lightroom 9.6 (desktop)
+
+The authoritative assessment of how close LightCraft is to Lightroom. The row-by-row checklist is
+[parity-checklist.md](parity-checklist.md); the ranked work list is [gaps.md](gaps.md); deep areas
+have their own documents: [raw-parity.md](raw-parity.md), [file-format-parity.md](file-format-parity.md),
+[ui-parity.md](ui-parity.md), [hardware-parity.md](hardware-parity.md),
+[localization-parity.md](localization-parity.md).
+
+## Headline
+
+| Number | Value | Kind |
+|---|---:|---|
+| **Feature breadth**, checklist | **81.1%** of 517 in-scope rows (P0 98.0%, P1 95.1%, P2 46.9%) | **measured**: recount of [parity-checklist.md](parity-checklist.md) rows (✅ 1, 🟡 ½, 🚫 left out), the same rule `cargo xtask parity` uses |
+| **Feature breadth**, weighted by use | **~77%** | estimated: feature-area table below |
+| **Ready for real work** (full target) | **~61%** (range 56–66%) | estimated: weighted sum over the dimensions with written weights, see [below](#ready-for-real-work-mainstream-practitioner-and-essentials-user) |
+| **Mainstream practitioner** | **~49%** (range 44–54%) | estimated: weekly areas of a working photographer, depth 71.8% × 0.804 × colour 0.85 |
+| **Essentials user** | **~64%** (range 59–69%) | estimated: core features at default settings, depth 77.4% × 0.830 |
+| Remaining to **beta** | **~340–600 h** | estimated; ~60% parallelizes |
+| Remaining to **full parity** | **~1,000–1,800 h** | estimated; ~70% parallelizes |
+| **Stage** | **alpha** | see [Stage](#stage) |
+
+## The target and how it was measured
+
+- **Target:** Lightroom Classic 15.5 (August 2026; latest per Adobe's release notes) for the
+  library, modules and depth; Lightroom 9.6 (the cloud-library desktop app), installed on the
+  owner's Mac at `/Applications/Adobe Lightroom CC`, for the interface LightCraft's layout follows.
+  Both share the Camera Raw engine.
+- **Installed bundle, inspected by listing only** (the clean-room rule forbids reading contents):
+  `Info.plist` document types (31 raw extensions, jpg, tif, heic, xmp, catalog bundles); 16
+  `.lproj` localizations; `CameraProfiles` (1,500 Adobe Standard and 395 Camera Matching model
+  names); `LensProfiles` (3,635 files, 56 makers); `ModelZoo` (37 AI model names). The app was not
+  launched.
+- **LightCraft side:** origin/main at `b70ae174` (2026-10-10): code counts (226 engine commands, 143
+  UI commands, 122 + 10 develop controls, 2,561 tests, ≈ 202,000 Rust lines in 24 crates + 3 apps),
+  the checklist rows, raw corpus manifests, locale catalogs, CI workflows, docs.
+- **Behaviour and output** were not compared against a running Lightroom in this pass; the
+  measured ΔE figures in [raw-parity.md](raw-parity.md) come from earlier work.
+
+**Presence is not parity.** ✅ rows are set by whoever lands a feature and have not been checked
+systematically against Lightroom's behaviour; bugs keep turning up in ✅ areas (CR2 colour-filter
+phase #85, duplicate Local entries #22, black GPU exports on an Intel iGPU #78).
+
+## By dimension
+
+| Dimension | Breadth | Ready for real work | Remaining | Doc |
+|---|---:|---:|---:|---|
+| Features (weighted areas below) | ~77% (checklist 81.1%, measured) | ~61% | 600–1,100 h | [Features](#features) |
+| ↳ RAW cameras, colour and lens profiles (part of features) | 81% of Adobe's 1,446 models decode (16% verified), measured | ~56% | 255–480 h | [raw-parity.md](raw-parity.md) |
+| UI/UX fidelity | ~85% | ~70% | 40–70 h | [ui-parity.md](ui-parity.md) |
+| File formats (non-raw: images, sidecars, presets, catalogs) | ~85% | ~70% | 30–55 h | [file-format-parity.md](file-format-parity.md) |
+| Hardware | ~50% | ~40% | 40–80 h (+ tethering and printing, counted under Classic modules) | [hardware-parity.md](hardware-parity.md) |
+| Localization (12 key languages) | 7 of 12 present | ~52% (mean of the 12, measured) | 130–210 h for the target's set; +145–255 h for Hindi, Arabic, Indonesian, Vietnamese, Korean | [localization-parity.md](localization-parity.md) |
+| Performance | ~80% | ~70% | 30–50 h | 24 MP GPU slider 3.9 ms, export 0.3 s (measured, [gpu-pipeline.md](gpu-pipeline.md)); 85k library opens in 1.7–4.7 s; 100k test pending |
+| Stability | — | ~60% | 30–60 h | never-crash lints and guards workspace-wide, crash-tested journal, 2,561 tests; but CI runs tests only on FreeBSD, user reports keep finding bugs in ✅ areas |
+| Platforms | macOS, Windows (x64 / x86 / ARM64), Linux (AppImage, deb, rpm, Flatpak, Nix), FreeBSD, web | ~60% | 25–45 h | macOS is where it is tested; Windows installer UI unverified on Windows (#79); web experimental (CPU only) |
+| Ecosystem / plug-ins | ~25% | ~15% | 40–80 h + owner decision | no Lightroom SDK equivalent (export, publish, metadata plug-ins); beyond the target: JSON-lines control channel, MCP server with 28 tools + one per command, CLI |
+| AI features | ~30% | ~20% | 120–220 h + model decisions | [AI](#ai) (overlaps the masking and Enhance rows; not added twice) |
+
+## Features
+
+Weights are a judgement of what Lightroom users spend their time on (library and develop dominate;
+Classic output modules and video are used by few). Breadth and readiness per area are estimated
+from the checklist sections and the deep-dive documents.
+
+| Area | Weight | Breadth | Ready | Remaining | Notes |
+|---|---:|---:|---:|---:|---|
+| Import and library (import, folders, albums, smart albums, keywords, metadata, search, faces) | 15% | 90% | 80% | 25–45 h | checklist A–E 83–92%; robust journal; 85k-photo libraries |
+| RAW decoding and camera coverage | 15% | 81% | 76% | 120–220 h | [raw-parity.md](raw-parity.md), measured model by model: 84% of photographers' cameras decode (use-weighted), × 0.9 for per-body bugs; CR3 variants, compressed ORF, HE NEF |
+| Colour, camera profiles, render fidelity | 10% | 65% | 35% | 80–150 h | 4 bundled profiles vs Adobe's 1,500; per-file fits median ΔE ~5 vs the camera JPEG, ~10% far off; no fidelity suite ([raw-parity.md](raw-parity.md#colour)) |
+| Global develop adjustments (light, colour, curves, grading, effects, detail) | 15% | 93% | 70% | 30–60 h | checklist F 91.7%; character tuned by eye |
+| Optics, lens profiles, crop and geometry | 6% | 80% | 50% | 40–80 h | no lens database; crop / Upright complete |
+| Masking | 8% | 67% | 45% | 60–110 h | checklist K 67.4%; AI masks heuristic or SAM 3 without mirror |
+| Remove, heal, Enhance (denoise, Raw Details, Super Resolution, Lens Blur) | 7% | 45% | 30% | 70–130 h | checklist I 75%, P 0% |
+| Presets, profiles, versions, history, sync | 5% | 95% | 85% | 8–15 h | |
+| Export | 6% | 89% | 75% | 15–30 h | checklist S 88.9% |
+| Merge and HDR | 3% | 85% | 60% | 20–35 h | merge 100%, HDR 70% (no HDR display) |
+| Views, compare, zoom, culling | 5% | 90% | 70% | 15–30 h | zoom detail P0 gap |
+| Classic output modules (Map, Book, Slideshow, Print, Web, publish, tethering) | 4% | 15% | 10% | 90–150 h | Classic extras 48% counts many small keys; the modules themselves are mostly ⬜ |
+| Video | 1% | 0% | 0% | 25–45 h | catalogued only |
+| **Weighted** | 100% | **~77%** | **~61%** (60.6%) | **600–1,100 h** | |
+
+## AI
+
+Lightroom 9.6 ships 37 on-device models (names listed from its `ModelZoo`), covering subject, sky,
+portrait, skin and object selection with refinement, depth estimation, denoise, dust detection,
+reflections removal, distraction / people detection, culling scores (eyes open, blur, aesthetics) and
+search embeddings; generative remove runs in Adobe's cloud.
+
+| Feature | LightCraft | Status |
+|---|---|---|
+| Subject / Sky / Background masks | classical heuristics; the file's own DNG semantic mattes | 🟡 |
+| People (faces, body, hair, skin…) and Landscape masks | — | ⬜ |
+| Object / Describe masks | SAM 3 in pure Rust (Metal / CPU); opt-in 3.4 GB download, no mirror configured | 🟡 |
+| Depth range mask, Lens Blur | — | ⬜ |
+| AI Denoise | Bayer only, pure-Rust CPU / GPU, user-installed weights | 🟡 |
+| Raw Details, Super Resolution | — | ⬜ |
+| Generative remove, distractions, reflections | — (generative is out of scope: cloud) | ⬜ |
+| Dust detection | ✅ | ✅ |
+| Faces / People | YuNet detection, SFace / AuraFace recognition (opt-in downloads), People view | ✅ (MVP, [faces.md](faces.md)) |
+| Assisted culling | focus, bursts | 🟡 (no eyes-open / aesthetics scores) |
+| Auto (tone), adaptive presets | Auto calibrated on Lightroom's Auto results (#628); no adaptive presets | 🟡 |
+| Natural-language search | — | ⬜ |
+
+**Blocked on a model strategy** (maintainer decision): licensable weights or our own training;
+pure-Rust inference is proven (faces, SAM 3, denoise).
+
+## Ready for real work, mainstream practitioner and essentials user
+
+Three readiness numbers (craftrules `standards/progress-docs.md`). The full number is a weighted
+sum over the dimensions with written weights. Mainstream and essentials take the weighted depth of
+the areas their user touches, then apply written multiplicative discounts for what still stops real
+work. Each has its own hours to ~95%, calibrated as in [How hours are calibrated](#how-hours-are-calibrated)
+(essentials ⊂ mainstream ⊂ full):
+
+| Audience | Ready | Opus 5.5 agent wall-clock hours to ~95% | Work that dominates |
+|---|---:|---:|---|
+| Full target (ready for real work) | **~61%** | **1,000–1,800 h** (~70% parallelizes) | raw colour, lens and camera data; AI models; Classic output modules; localization; plug-in ecosystem |
+| Mainstream practitioner | **~49%** | **450–840 h** (~60% parallelizes) | camera colour and render fidelity; CR3 / ORF / HE NEF; lens database; subject / sky masks; Lightroom XMP exchange; stability |
+| Essentials user | **~64%** | **160–300 h** (~50% parallelizes) | default raw look for popular cameras; launch stability; basic-slider feel; opening CR3 / HEIC files people send |
+
+### Full target (ready for real work): ~61%
+
+Weighted sum over the dimensions of [By dimension](#by-dimension) (AI is left out because it
+overlaps the masking and Enhance feature areas). RAW decoding and camera colour are their own rows,
+valued from the model-by-model measurement in [raw-parity.md](raw-parity.md):
+
+| Dimension | Weight | Ready |
+|---|---:|---:|
+| Features: the other 11 areas, weighted depth from [Features](#features) | 45% | 60.9% |
+| RAW decoding and camera coverage | 9% | 76% (84% use-weighted × 0.9) |
+| Camera colour and default rendering | 6% | 35% |
+| UI/UX fidelity | 8% | 70% |
+| File formats (non-raw) | 6% | 70% |
+| Hardware | 3% | 40% |
+| Localization | 3% | 52% |
+| Performance | 6% | 70% |
+| Stability | 8% | 60% |
+| Platforms | 4% | 60% |
+| Ecosystem / plug-ins | 2% | 15% |
+| **Weighted sum** | 100% | **60.6% ≈ 61%** (range 56–66%) |
+
+Mainstream comes out lower than full: its scope is the raw-develop core, where LightCraft is weakest
+(camera colour, CR3 coverage), and its discounts are multiplicative, while the full sum is lifted by
+strong library, presets, UI and format dimensions.
+
+**Why the numbers moved with the RAW measurement:** decoding measured model by model against
+Adobe's list is better than the earlier 50% estimate (84% of photographers' cameras decode, 76% after
+a bug discount), colour is lower (35%, was 40%) and is now its own row. Net: full +2 points.
+Mainstream now carries colour as a ×0.85 discount on top of the measured coverage (−2 points);
+essentials replaces its guessed 45% raw look with 84% × 0.75 (+1 point).
+
+### Discounts (evidence: open issues from users, 2026-10-10)
+
+| Discount | Mainstream | Essentials | Evidence |
+|---|---:|---:|---|
+| Interaction fidelity / UI clarity | ×0.95 | ×0.95 | brush live preview gaps and feathering (#517, #518); crop artefacts and limits (#731, #742, #770, #771); Compare white-balance selector (#743–#745); low-res slider previews (#330); dialogs taller than the window (#781); mouse-wheel scroll (#714); 100% zoom capped (gap 4) |
+| Stability on real machines | ×0.92 | ×0.92 | launch and quit crashes or silent startup failures (#250 macOS 12 Intel, #315 Windows Intel GPU, #431 Intel Mac, #260, #462, #783 Linux / Nouveau, #790 Windows installer); tests run in CI on FreeBSD only (gap 9) |
+| File exchange with Lightroom users (mainstream) / opening files people send (essentials) | ×0.92 | ×0.95 | Adobe XMP sidecars change colours (#290), XMP CameraProfile and Upright ignored (#204, #205), catalog import fails (#599), same Light values render differently (#523, #209), no write-back to `.lrcat`; for casual users: CR3 beyond verified bodies, compressed ORF, HE NEF open as previews (#473, #485, #556), HEIC trouble (#693) |
+| **Product** | **×0.804** | **×0.830** | |
+
+### Mainstream practitioner: ~49%
+
+A working photographer (wedding, portrait, events, landscape) shooting raw on one current camera,
+weekly: import, cull, develop, a few masks, sync a look, export. Excluded: Classic output modules,
+video, generative / cloud AI, plug-ins, tethering and other specialist hardware, languages other
+than the user's own.
+
+| Area | Weight | Depth |
+|---|---:|---:|
+| Import and library | 18% | 80% |
+| Cull: views, compare, zoom, ratings | 12% | 70% |
+| Raw decoding for their camera | 27% | 84% (measured use-weighted share whose camera fully works, [raw-parity.md](raw-parity.md#by-use-estimated)) |
+| Global develop adjustments | 15% | 70% |
+| Crop, geometry, lens corrections | 6% | 50% |
+| Masking (manual, subject / sky; no generative) | 8% | 45% |
+| Heal / remove (no generative), denoise | 5% | 40% |
+| Presets, copy / paste / sync | 5% | 85% |
+| Export | 4% | 75% |
+| **Weighted depth** | 100% | **71.8%** |
+
+Colour fidelity is a written discount, **×0.85**: most raws start near the camera's own look (median
+ΔE ~5), about 10% far off (ΔE ~18), none calibrated to Adobe Standard, so a working photographer
+corrects colour by hand (33 open colour issues). 71.8% × 0.804 × 0.85 = **~49%** (range 44–54%).
+
+### Essentials user: ~64%
+
+A casual photographer with default settings: import, look through, rate, fix a few photos with the
+basic sliders, crop, apply a preset, undo, export JPEGs.
+
+| Feature | Weight | Depth |
+|---|---:|---:|
+| Import photos | 15% | 80% |
+| Browse grid and detail view | 10% | 85% |
+| Rate and flag | 5% | 90% |
+| Basic sliders (exposure, contrast, highlights, shadows, white balance, vibrance / saturation) | 22% | 70% (slider strength differs from Lightroom, #196, #521) |
+| Auto | 5% | 65% (#318) |
+| Crop and straighten | 10% | 80% |
+| Presets and profiles | 8% | 80% |
+| Undo and history | 5% | 90% |
+| Their camera's raws: decode × default look | 10% | 63% (84% whose camera fully works × colour factor 0.75) |
+| Export JPEG | 10% | 85% |
+| **Weighted depth** | 100% | **77.4%** |
+
+77.4% × 0.830 = **~64%** (range 59–69%).
+
+### User evidence (GitHub issues, excluding the four maintainers)
+
+- 324 issues from 159 users; 162 open. 8,719 stars, 2,698 forks (2026-10-10).
+- Of the 162 open: **~92 core-path bugs** (33 colour / rendering, 16 decoding, ~36 UI / workflow, 7
+  launch / stability), ~11 developer / test infrastructure, **~59 feature requests or niche asks**
+  (plug-ins, mobile, sync servers, tablets, MIDI, geocoding, themes).
+- Praise in issue text (love / amazing / great work / awesome): ~14 issues; "thank you" in 27.
+  **No explicit "switched from Lightroom" report** was found ("switched" matches 6 issues, none a
+  switch report).
+- Reading: strong interest, but most open user issues are core-path, and raw colour dominates them,
+  so the mainstream number is held down by default rendering rather than missing features.
+
+### Why the full number moved (55% → 46% → 59%)
+
+The first figure (~55%) was the feature depth "pulled down" by an unwritten judgement. A later pass
+applied the mainstream discounts to it (~46%). The standard defines the full number as a weighted
+sum over the dimensions, so it is now that sum with the weights written above: ~59%. Method aligned
+with the standard, no new evidence. The stage stays **alpha**.
+
+## Stage
+
+**Alpha.** Core workflows exist end to end (import, cull, develop, mask, export, catalog migration),
+but ready-for-real-work is ~61%, below the ~75% beta bar, and the main file formats have blocking
+gaps: Canon CR3 decodes from sensor data on three verified bodies only, compressed ORF and HE NEF
+open as previews, and colour on every non-DNG raw is estimated rather than measured.
+
+**Alpha gate:** all six core workflows (import, cull, develop, save and reopen, batch looks, export)
+work end to end on macOS; see the table in [roadmap.md](roadmap.md#alpha-gate). The partial rows (CR3
+variants, compressed ORF, HE NEF as previews; capped 100% zoom) degrade but don't block a workflow.
+
+**To beta:** ~14 points of readiness, **~340–600 h**: the nine `B` gaps in [gaps.md](gaps.md)
+(~230–430 h), plus burning down the ~92 open core-path user issues (40–80 h) and stability work
+around them. Beta needs: CR3, ORF and
+HE NEF decoding from sensor data; measured colour for the popular models and a fidelity suite with
+scores; full-resolution zoom; Subject / Sky / People masks; a lens profile database for the
+popular lenses; tests in CI on macOS, Windows and Linux.
+
+## How hours are calibrated
+
+Hours are Opus 5.5 agent wall-clock hours, one session working sequentially, including tests and
+verification. Calibrated on this repository's history (git log and GitHub PR open-to-merge times):
+
+- **Project pace:** first commit 2026-09-30; by 2026-10-10, 1,066 non-merge commits and 325 merged
+  PRs, commits in 159 distinct clock hours, with 4–6 parallel agents plus community contributors.
+  On 2026-10-02 the ROADMAP recorded ≈ 105–145 agent-hours spent; M0–M13 took ≈ 25 active hours with
+  parallel agents against an up-front estimate of 110–170 h.
+- **UI and library rows:** a lead agent closed ≈ 45 checklist rows in ≈ 5 h (2026-10-01) and ≈ 60 in
+  ≈ 12 h (2026-10-02): 6–12 minutes per small row.
+- **Raw decoders:** RW2 in every format 6.5 h (#215), compressed RAF 8.6 h (#282), CR3 CRX 10 h
+  (#279), NEF lossy after split 4.7 h (#633), ORF 12.8 bpp 1.7 h (#651), HEIC 7 h (#609).
+- **Large features:** AI RAW denoise 8.3 h (#384, 12.8k lines), SAM 3 masks 14.9 h (#162),
+  HDR editing and export 2.3 h (#646, on existing groundwork), contact-sheet PDF (#563), German UI
+  13.8 h (#265).
+- PR open time includes queueing and review, so these are upper bounds per feature; the ranges add
+  a long-tail factor of 1.3–1.5× for verification against real files.
+
+### Why the estimate went up
+
+The previous estimate (2026-10-02, kept below) was ≈ 270–505 h to full parity. It counted checklist
+rows only. New evidence since: the target's own lists (≈ 1,000 dedicated camera models, 3,635 lens
+profiles, 37 AI models, 16 languages) measured from the installed bundle; per-maker verification
+counts; that CI tests only FreeBSD; and the standard's added dimensions (localization, stability,
+platforms, ecosystem). The raw-codec package it estimated at 40–80 h took roughly that and closed
+most of its list; what remains is the data-heavy part (colour, lenses, models) it did not count.
+
+## History of the numbers
+
+| Date | Checklist (all / P0 / P1 / P2) | Ready for real work | Remaining to full parity | Source |
+|---|---|---|---|---|
+| 2026-10-10 (RAW) | 81.1% (unchanged) | ~61% full · ~49% mainstream · ~64% essentials | unchanged | RAW measured model by model against Adobe's list; RAW decode and colour as explicit rows |
+| 2026-10-10 (final) | 81.1% (unchanged) | ~59% full (weighted sum) · ~51% mainstream · ~63% essentials | full 1,000–1,800 h · mainstream 450–840 h · essentials 160–300 h | method aligned with the standard |
+| 2026-10-10 (later) | 81.1% (unchanged) | ~46% full · ~51% mainstream · ~63% essentials | 1,000–1,800 h | full × discounts (superseded) |
+| 2026-10-10 | 81.1% / 98.0% / 95.1% / 46.9% (517 rows) | ~55% | 1,000–1,800 h | this re-measure |
+| 2026-10-08 | 79.7% / 98.2% / 95.6% / 41.6% (509 rows) | 60–70% | — | ROADMAP *Where we stand* |
+| 2026-10-02 | 75.6% | — | 270–505 h (cloud parity without AI / Classic: 130–255 h) | ROADMAP *Parity estimate* |
+
+The 2026-10-08 assessment by dimension, kept for evidence: feature checklist 79.7%; RAW coverage
+~55%; colour and image quality ~55–65%; AI and computational ~15–20%; workflow and library ~85%
+(single machine); Classic modules ~30%; HDR and video ~25%; platform and robustness ~70%. By kind of
+user: JPEG / DNG shooter ~85%; Nikon / Sony / Panasonic / older-Canon ~65%; Fujifilm ~65%; Canon
+CR3 / Olympus compressed ~45%; Classic power user ~45%; relies on AI ~25%. Today's numbers per user:
+JPEG / DNG ~75%; Sony, Panasonic, Fujifilm ~60%; Nikon ~55% (HE NEF); Canon CR3 ~40%; OM / Olympus
+~30%; Classic power user ~40%; relies on AI ~20%.
+
+The 2026-10-02 effort table, kept for calibration: remaining P0/P1 UI 5–10 h; raw codecs 40–80 h;
+lens database 15–30 h; video 20–40 h; AI 80–150 h; HDR 15–25 h; Classic modules 60–100 h; smaller
+P2 items 12–25 h; look tuning, performance, packaging, hardening 25–45 h.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | RAW measured model by model (raw-parity.md): RAW decoding (76%) and colour (35%) are explicit rows of the full sum (59% → 61%); mainstream uses the use-weighted 84% plus a ×0.85 colour discount (51% → 49%); essentials uses 84% × colour 0.75 (63% → 64%); beta ~14 points |
+| 2026-10-10 | minor | Full number restored to an additive weighted sum over the dimensions (~59%; method aligned with the standard, no new evidence); hours to ~95% for each of the three audiences; beta distance ~16 points |
+| 2026-10-10 | minor | Added mainstream practitioner (~51%) and essentials user (~63%) numbers; full ready re-derived from written weights × discounts (55% → 46%); user-issue evidence; beta hours 340–600 |
+| 2026-10-10 | minor | Stage re-checked against the core-workflow alpha gate: passes, stays alpha |
+| 2026-10-10 | major | Created per the progress-docs standard: full re-measure (checklist recount, installed Lightroom 9.6 bundle listing, code counts, catalogs, CI), feature areas with weights, dimensions, AI, stage, calibration; merged ROADMAP's *Where we stand* and *Parity estimate* |

docs/ui-parity.md

@@ -0,0 +1,81 @@
+# UI parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created; shortcut notes moved here from the checklist) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6
+
+How LightCraft's interaction compares with Lightroom's: views, panels, tools and handles, modifier
+keys, shortcuts, zoom, context menus and feel. Rows for individual menu items and shortcuts live in
+[parity-checklist.md](parity-checklist.md) (sections Y and Z, Classic keys); this page is the
+assessment and the notes that don't fit a row. Visual reference for agents: `plan/lightroom/`
+(local, gitignored; `10-observed-ui.md` and screenshots).
+
+## Measured counts (2026-10-10)
+
+- 226 engine commands (`crates/engine/src/cmd/`, 30 modules) and 143 UI commands (`UI_COMMANDS` in
+  `crates/ui-egui/src/menus.rs`, 73 with a shortcut) plus 10 language commands; 23 secondary
+  shortcut bindings (`ALIASES`, `crates/ui-egui/src/shortcuts.rs`); a keymap editor.
+- 122 develop controls plus 10 indexed templates (`crates/develop/src/controls.rs`).
+- Checklist: menus 95.3% (86 in-scope rows), desktop shortcuts 94.4% (81 rows), Classic extras
+  48.2% (82 rows), measured by recounting [parity-checklist.md](parity-checklist.md).
+- 31 panel modules (`crates/ui-egui/src/panels/`), 26 context-menu sites.
+
+## Assessment by area
+
+| Area | Target | LightCraft | Ready | Main gaps |
+|---|---|---|---:|---|
+| Layout and views | Lightroom: grid / detail / edit; Classic: Library, Develop, Map, Book, Slideshow, Print, Web modules, filmstrip, panels | Lightroom-style single window: Photo Grid, Square Grid, Detail, Compare, Survey (≤ 48), Before / After, People, quick slideshow, second window, filmstrip | 75% | no Classic module switcher (by design) or output modules; dark theme only |
+| Develop panels and sliders | Light, Color, Effects, Detail, Optics, Geometry, Lens Blur, Calibration | every global slider; scrub, double-click reset, Alt-drag previews where implemented | 80% | Lens Blur, Calibration panel depth; slider feel (acceleration, fine Shift-drag) unmeasured |
+| Crop, Upright, transform handles | handles, aspect lock, angle, overlays (O / ⇧O), guided Upright | ✅ all of them; overlay cycle on ⇧O | 85% | crop opacity of cut-out area (15.5) |
+| Masking tools | brush (A / B, flow, density, auto mask, pressure), linear / radial, range masks, AI masks, pins | brush, linear, radial, colour / luminance range, add / subtract / intersect / invert, masks panel, pins | 60% | brush live preview (#517 / #518), no pen pressure, no depth range, AI masks, Feather / Edge controls (15.5) |
+| Remove / heal | content-aware remove, heal, clone, visualize spots | heal, clone, auto source, visualize spots, red / pet eye | 65% | content-aware (patch synthesis) remove, generative remove, detect distractions |
+| Zoom and navigation | Fit / Fill / 1:1 / 2:1 … 11:1, Navigator, spacebar pan | Fit to 800%, pinch zoom, pan, Navigator-like | 60% | **original-pixel detail at 100% (preview capped at 2,560 px; P0 gap LR-VIEW-ZOOM)** |
+| Library culling and metadata | ratings, flags, labels with keys, painter, keywording, metadata panel, filter bar | ratings / flags / labels and advance, keyword list and sets, keywording box, metadata fields, smart albums, filter bar | 85% | painter tool, quick collection, some Classic keys |
+| Shortcuts | Lightroom desktop and Classic keymaps | Lightroom-desktop keymap with Classic additions, editable | 85% | deliberate differences below; no Classic keymap layer |
+| Context menus | everywhere | 26 sites (grid, filmstrip, albums, folders, keywords, masks, presets…) | 70% | unaudited against Lightroom's menus item by item |
+| Text fields | native editing behaviour | custom text field (LR-BEHAV-TEXTFIELD) | 70% | IME and selection edge cases |
+| Accessibility | VoiceOver / Narrator, keyboard navigation | AccessKit: sliders, buttons, dropdowns, section headers announce | 30% | canvas tools pointer-only; not audited with a screen reader |
+| Feel and responsiveness | GPU-interactive sliders (15.3) | ≤ 16 ms slider budget on GPU; background renders | 75% | colour NR at half resolution, 100k-photo grid test |
+| **UI/UX overall** | | | **~70%** | estimated, weighted by use (develop and library 60%, tools 25%, rest 15%) |
+
+Remaining: **40–70 h** (zoom detail 8–15 h, brush and masking feel 8–12 h, accessibility audit 10–20
+h, Classic keymap layer 4–8 h, context-menu audit 4–8 h, text-field and IME polish 4–8 h). Output
+modules and AI tools are counted with their features in [target-app-parity.md](target-app-parity.md).
+
+## Shortcuts
+
+Compared `plan/lightroom/06-shortcuts.md` (desktop part) with our bindings: command specs in `crates/engine/src/cmd/`,
+`UI_COMMANDS` in `crates/ui-egui/src/menus.rs` and secondary bindings (`ALIASES`) in `crates/ui-egui/src/shortcuts.rs`.
+`no_conflicting_bindings` (same file) fails when one key fires two actions.
+
+**Fixed (M16.1):** added Lightroom-desktop keys as secondary bindings for existing commands — ⌘D Select None, ⇧E
+Export dialog, Space Toggle zoom, ⇧M Create Version, ⇧X Reject + advance, ⇧U Unflag + advance. `⇧Y` fired both
+Before/After Split and the History panel; History lost the binding. `W` and `⇧⌘I` also fired the engine command
+under the UI command that wraps it (a no-op error); the UI command now wins.
+
+**Deliberate differences (our key → Lightroom desktop key)** — each is a conflict with another binding we have:
+
+| Action | Ours | Lightroom desktop | Why |
+|---|---|---|---|
+| Pick flag | P | Z | Z = toggle zoom (Classic convention); P is the Classic pick key |
+| Photos panel (left) | ⌘⇧L | P | P = pick |
+| Expand/collapse edit sections | ⌘⌥1–5 | ⌘1–6 | ⌘0 = Zoom to Fit, ⌘1 = Zoom 100 %; Geometry lives in the Crop panel |
+| Histogram | ⌘⇧H | ⌘0 | ⌘0 = Zoom to Fit |
+| Square Grid | ⇧G | (none; ⇧G = Guided Upright) | Guided Upright is a button in the Crop panel |
+| Export dialog | ⌘⇧E (+ ⇧E) | ⇧E | ⌘⇧E is "Edit in Photoshop" there; no external-editor command yet |
+| Crop overlay cycle | ⇧O | O | O = mask overlay; ⇧O (mask colour / overlay orientation) unused otherwise |
+| Create Version | ⌘⇧S (+ ⇧M) | ⇧M (Windows: Ctrl+⇧S) | — |
+| Select None | ⌘⇧A (+ ⌘D) | ⌘D | — |
+
+**Library culling (KEYC-RATING):** `0–5`, `6–9` and `P/X/U` reach egui on macOS even when displayed in the native menu (adapted from PR #261; issue #283). `Shift+0–9` applies and advances once; `Shift+P` picks and advances in Photo Grid / Square Grid and retains Presets elsewhere. See [library shortcuts](library-shortcuts.md) for the verified Classic mapping and regression coverage. Remaining Classic gaps: rating `[` / `]`, flag cycling and filter-bar keys.
+
+**Still missing / broken:**
+- No command yet: F1 help (verify the rest of the old list: full screen, settings, stacks,
+  visualize spots and merges have commands now).
+- `H` opens Remove; Lightroom also uses it (Classic) to hide pins — pins toggle from View → Show Mask Pins.
+- ⌘M / ⌘H / ⌘Q / ⌘W rely on the platform window defaults (unverified).
+
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created: measured command and shortcut counts, assessment by area, estimates; moved the shortcut conflicts section here from the checklist |

docs/web.md

@@ -52,13 +52,14 @@ codecs) at opt-level 3 and the rest (egui, eframe, serde, glue) at "s". What goe
 is the brotli column: 3.1 MB, 11 % less than the old build's brotli size and 41 % less than its
 gzip size (5.25 MB). `wasm-opt -Oz`, when installed, shrinks it further.
 
-**Fonts.** The browser has no system fonts to fall back on, so Japanese text comes from
+**Fonts.** The browser has no system fonts to fall back on, so CJK text comes from
 [craft-fonts](https://github.com/storytold/craft-fonts), the optional `CRAFT_FONTS_DIR` build
 input (`CRAFT_FONTS_DIR=../craft-fonts cargo xtask web`; release builds always set it). On wasm32
-`crates/engine/build.rs` embeds only BIZ UDPGothic Regular (UI, and the watermark fallback), so
-the module stays well under Cloudflare's 25 MiB per-file limit: measured 2026-10-06, 17.1 MB
-without craft-fonts and 21.8 MB with it (brotli 3.8 MB / 6.3 MB). Without it the web build
-works, but Japanese text has no glyphs.
+`crates/engine/build.rs` embeds only BIZ UDPGothic Regular (UI and watermark fallback). The web
+bundle also ships Noto Sans CJK SC Regular as `lightcraft_zh_hans.otf` and loads it before the UI
+starts. Keeping the 16 MB Chinese face separate leaves the module under Cloudflare's 25 MiB
+per-file limit (the older Japanese-only module measured 21.8 MB). Without `CRAFT_FONTS_DIR`, the
+web build still works, but Chinese and Japanese text lack glyphs.
 
 ## Deploying: headers
 
@@ -111,9 +112,10 @@ are the same in every version, so serve them with `Cache-Control: no-cache` (not
     (`originals/<hash>/<file name>`, so an unzipped backup is browsable; entries are stored, not
     compressed; at most 4 GB). **File ▸ Restore Library from Backup…** reads such a zip into a
     new library folder (`library-restored-<time>/`; originals already stored are skipped, every
-    entry's checksum is verified) and only then switches to it (`active-library` names the
-    folder in use) and reloads: the previous library stays in storage. Both are web-only
-    (`file.backupLibrary`, `file.restoreLibrary`; the desktop library is a folder).
+    entry's checksum is verified, and each restored original must match its content hash) and
+    only then switches to it (`active-library` names the folder in use) and reloads: the previous
+    library stays in storage. Both are web-only (`file.backupLibrary`, `file.restoreLibrary`; the
+    desktop library is a folder).
   - A failed save (quota exceeded, storage cleared) is not silent: the catalog then refuses new
     writes, so commands report `saved in memory but not written`, the top bar shows the unsaved
     warning (as on the desktop, see `docs/control-protocol.md`), and saving is retried every
@@ -122,8 +124,8 @@ are the same in every version, so serve them with `Cache-Control: no-cache` (not
     a reload); a notice says why.
   - One tab at a time: the page holds a Web Lock (`navigator.locks`, `lightcraft-library`); a
     second tab or window shows "LightCraft is already open in another tab" instead of loading
-    its own copy (two copies would overwrite each other's saves). Browsers without Web Locks
-    aren't protected.
+    its own copy (two copies would overwrite each other's saves). Browsers without Web Locks, or
+    that refuse the lock request, aren't protected: the app starts without the guard.
   - If the stored library can't be opened, a notice says the session is temporary and nothing
     is saved; the stored library is left as it was.
   - A panic (wasm is built with `panic = "abort"`) replaces the page with a message saying the

docs/whats-new.md

@@ -1,6 +1,154 @@
 # What's new in LightCraft
 
-## October 2026
+## 2026-10-10
+
+### Activity stack
+- Long-running tasks show in one place, top left under the top bar, as in Lightroom Classic (issue #345): imports and
+  folder scans, exports (and the contact sheet PDF), Synchronize Folder, Build / Smart Previews, Lightroom catalog import, Photo Merge, model downloads, the face scan,
+  AI Denoise and Find Missing Photos. Each row has the task's name, a progress bar, the count and what it is working
+  on; ✕ stops the tasks that can stop. Three rows show, then "+N more". The separate export panel and the progress
+  windows and toasts are gone.
+- Quitting while a task that can be stopped is running asks first ("Quit Anyway" stops it).
+- Agents list and stop tasks with `activity.list` and `activity.cancel`; `ui.inspect` reports them as `activity`.
+
+## 2026-10-09
+
+### Smart album rules
+- The rule editor's field menu is grouped: Rating, Pick Flag, Color Label and Any Searchable Text at the top, then
+  submenus for Source, File, Date, Keywords & People, Description, Camera Info, Location, Size, Develop and Assisted
+  Culling.
+- New fields: Keyword Count ("2 or more", "exactly 2"…), People and People Count (named faces), Shutter Speed (written
+  as 1/250), File Extension, Video Duration, Copy Name, In a Stack, Alt Text, City, State / Province, Country, Long
+  Edge, Short Edge, Aspect Ratio (landscape / portrait / square), Cropped and Treatment (in color / black & white).
+  Size rules measure the photo as shown: Megapixels now counts the cropped photo, like Long Edge, Short Edge and
+  Aspect Ratio (a 24 MP photo cropped to a square is 16 MP).
+- Choice values read as words in every language: "Public Domain", "Picked", "Black & White" rather than ids like
+  `publicDomain` (rules and agents keep using the ids; `album.ruleFields` adds `choiceLabels`).
+- Rule values are checked: a rating of 9, a date like 2026-13 or "banana", a "between" whose dates are the wrong
+  way round, "in the last 0 days", a colour label that doesn't exist, "contains" with nothing to look for, an
+  album that is gone, or an empty group is reported with its rule ("rule 2.1: no rating 0–5 is 9")
+  instead of quietly matching nothing or everything. New date rules start at the current year.
+- A smart album can include or exclude another smart album: "Keywords contain travel" and "Album isn't Excluded Photos"
+  leaves out whatever Excluded Photos matches, as its rules change. The album picker shows your albums as in the sidebar
+  (folders open on click) or finds them as you type part of a name or folder (↑ / ↓ and Enter to pick); albums that
+  can't be picked, such as one that would make an album include itself, are greyed with the reason. Esc with a dropdown or calendar open in a dialog
+  closes just that.
+- Date rules have a calendar button: pick a day, a month or a whole year (Year / Month / Day), in your language; the
+  two dates of a "between" can't be picked out of order; Esc closes just the calendar. It picks dates, not times (a
+  time is typed, and picking a day replaces one). Typing still works, and "2026-10-01 10:00" (a space for the
+  T) now matches.
+- Rule problems are shown in your language and name the field the way the menu does ("Title: needs something to look
+  for").
+- A smart album whose rules no longer check (an album they test was deleted) is marked ⚠ in the sidebar; its tooltip
+  says what to fix, and `albums.list` reports `problems`.
+- Editing a smart album's name and rules is one step: both or neither, and one undo takes both back
+  (`album.setRules` takes `name`).
+- The rule editor marks each rule that needs fixing right under it and keeps OK disabled until they are fixed. An
+  Album rule is "is" or "isn't" an album, picked with the album picker.
+- Yes/no fields (Has Edits, Cropped, Has GPS…) read Yes / No instead of true / false. A rule sent as `"false"` now
+  means no (it used to count as yes), and a value that is neither yes nor no is refused.
+- Any Searchable Text also finds the state / province, alt text, people and a virtual copy's name.
+
+### Keyword lists
+- File ▸ Import Keywords… and Export Keywords… read and write keyword list files as Lightroom Classic does (a keyword
+  a line, a tab per level, synonyms in braces, keywords left out of export in brackets). Capture One, darktable, Adobe
+  Bridge and Photo Supreme (its Formatted Vocabulary File) use the same files, so keyword lists move between them and
+  LightCraft. Importing adds the keywords you don't have, in one undo step; a file it can't read says which line, or
+  to save it as UTF-8. Exporting warns about keywords Capture One won't import, and names any keyword the format can't
+  hold (such as a name in brackets), which it leaves out so the file always reads back.
+
+### Keyword sets
+- Keyword Set ▸ Edit Set… edits a set's nine keywords in place, one field per ⌥ key, and renames it (or saves the edits as a new
+  set). An empty field leaves its key empty instead of moving the keywords after it; editing Recent Keywords and naming
+  them saves a new set.
+
+### Keywording box
+- The chips at the top of the Keywords panel are the keywords of every selected photo, not only the active one's; a
+  keyword only some of them have is marked with an asterisk (hover: how many). Only the × removes a keyword, from
+  every selected photo; a chip's menu acts on the selection (add to all, remove, show photos, edit) and no longer
+  deletes a keyword from the whole library.
+- Switch to & Containing to see the keywords with the keywords containing them, or to Will Export to see what
+  exported files will carry for the selection.
+- The keyword set's buttons and the suggestions follow the selection too; the typing boxes get the Cut / Copy / Paste
+  menu, and Return in the painter's box starts painting.
+
+### Keyword List
+- The Keywords panel ends with a Keyword List, as in Lightroom Classic: every keyword with its photo count, those no
+  photo has yet too. Filter it, tick a keyword to give it to the selected photos (a dash: only some have it), or click
+  the arrow to see its photos.
+- Create keywords with + (inside the one you picked, with synonyms, and given to the selection if you like), edit one
+  by double-clicking it, delete one with − after a confirmation. Right-click for more: create inside, Put New Keywords
+  Inside This Keyword, Purge Unused Keywords.
+- Drag a keyword onto another to nest it, or onto the list's title to bring it back to the top level; photos dragged
+  from the grid onto a keyword get it.
+- Right-click ▸ Put New Keywords Inside This Keyword: new keywords, made with + or typed in the box above, go inside
+  it. The list is there with no photo selected too, to set up keywords first.
+- Keyword tag options decide what exported files carry: Include on Export, Export Containing Keywords, Export
+  Synonyms. Exports now write keyword names to `dc:subject` and their paths to `lr:hierarchicalSubject`, and keywords
+  imported from files (or read from sidecars) keep the hierarchy `lr:hierarchicalSubject` gives them.
+
+### Text fields
+- Right-click Search Photos, a slider's typed value, the Info panel's fields, the name field of New Album, Rename
+  Album, New Smart Album, Rename Keyword, Merge Keywords and similar dialogs, or the name field under unnamed faces for
+  Cut, Copy, Paste and Select All. Esc in them gives back the text from before you started typing (in the Info panel it
+  no longer saves it). Return in those dialogs now confirms them, and their name opens selected. More fields will
+  follow.
+- On Windows and Linux, Ctrl+C outside a text field copies edit settings and Ctrl+V pastes them (⇧Ctrl+V: Paste
+  Selected Settings). Ctrl+V only reaches LightCraft while the system clipboard holds text; otherwise use Edit ▸ Paste Edit
+  Settings.
+
+### Synchronize Folder
+- Right-click a folder (or a disk other than the startup disk) in the sidebar's Folders section ▸ Synchronize
+  Folder…. The folder and the folders inside it are scanned in the background for photos added on disk, photos whose
+  file is gone, photos whose file was renamed or moved within the folder, and XMP sidecars changed by other apps; then
+  choose what to do: import the new photos and relink the moved ones (the defaults), move the missing ones to Recently
+  Deleted, read the metadata updates. A folder on a disk that isn't connected is reported as such. Synchronizing
+  runs in the background with a row in the activity stack (✕ stops it); everything it does is one undo step, and no file on disk
+  is touched. Agents use `folder.scanChanges` and `folder.synchronize`.
+
+### Folder colour labels
+- Right-click a folder (or a disk other than the startup disk) in the sidebar's Folders section ▸ Set Color Label ▸ a colour or None. The row
+  shows the label's dot before its photo count. Agents use `folder.label` (`path`, `label`); `library.folders`
+  reports each row's `label`.
+- A label follows its folder when it is renamed or moved in LightCraft, together with the labels of the folders
+  inside it; undo and redo carry them back and forth.
+- The catalog format is now version 4 (`Catalog.folder_records`, `Op::SetFolderRecord`). Once this version has
+  opened a library, older versions refuse it, as with every format change.
+
+### Monitor profiles
+- Settings ▸ Display ▸ Choose Profile… shows photos through your monitor's ICC profile (matrix/TRC or LUT-based), so
+  colours are right on wide-gamut and calibrated displays instead of oversaturated. The Detail view renders straight
+  into the display's own gamut; thumbnails and other previews are converted to it. Histograms, the preview caches
+  and exports don't change. Agents use `app.displayProfile`. See [display profiles](display-profiles.md).
+
+### Masking
+- Drag anywhere inside the selected radial gradient's ellipse to move it, including rotated
+  ellipses and radial components in compound masks. Edge and rotation handles keep their existing
+  functions, and one Undo restores the entire drag.
+
+### Crop rotation
+- Outside the crop box, where dragging rotates the photo, the pointer is a curved double arrow, and the angle is shown
+  next to it while you rotate (issue #534). For an exact angle, type it in the new Angle field under Straighten and press Return
+  (Esc keeps the old angle; a decimal comma works too), or click the Straighten value; hovering any slider's value now says it can be typed.
+
+## 2026-10-08
+
+### Albums tree
+- Album folders fold with the same disclosure triangle as Local, By Date, Folders and Keywords.
+- Right-click a folder ▸ New ▸ Create Album… / Create Smart Album… / Create Smart Album from Filter… / Create Folder…
+  makes it inside that folder (`dialog.newAlbum`, `dialog.newFolder`, `dialog.smartAlbum`, `dialog.newSmartAlbum` take `parent`).
+- Drag an album or folder onto a folder to move it there (a closed folder opens after 0.6 s under the pointer; a
+  "Albums" header takes it back to the top level; Esc cancels; holding a dragged album or photos near the top or bottom edge of the sidebar scrolls it). Drop on the top or bottom half of another album,
+  or the edge of another folder, to place it before or after it: that folder is then ordered by hand. Right-click ▸
+  Sort Contents A–Z (or ＋ ▸ Sort Albums A–Z at the top level) goes back to by name. To put a folder after an open
+  folder, fold that folder first (the bottom of an open folder means "inside"). Agents use `album.reorder`
+  (`id`, `parent?`, `before?`) and `album.sort`.
+- The catalog format is now version 3 (`Album.order`, `Op::SetAlbumOrder`). Once this version has opened a library,
+  older versions refuse it, as with every format change.
+
+### AI RAW denoise
+- Detail has a per-photo AI Denoise switch and Amount. Bayer RAW photos use a disposable cache, with matching previews and exports and pure-Rust CPU/GPU inference.
+- Models are installed separately after accepting their terms; no weights are bundled. See [setup and limitations](denoise.md).
 
 ### Library keyboard culling
 - Colour labels tint thumbnail surrounds in Square Grid and the Detail filmstrip, and a translucent footer along the bottom of the photo in Photo Grid. Label confirmations use a matching pale colour.
@@ -14,51 +162,25 @@
   press the new keys (Esc cancels), × removes it, ↺ restores the original, Reset All undoes every change. A key that
   belonged to another command moves to the new one. Menus show the new keys; agents use `app.setShortcut`.
 
-### RAW decoding
-- Canon CR2 and Pentax PEF raws get the same starting look fitted to the camera's own JPEG as ARW, NEF, RW2, RAF
-  and CR3, instead of opening flat and desaturated (issue #310). Photos already imported pick it up when re-rendered.
-- Panasonic and Leica raws (RW2, RWL) are now corrected for lens distortion the way the camera corrects its own JPEG
-  (issue #256): the correction the camera records in the file is applied under Lens Corrections ▸ Enable Profile
-  Corrections, on by default for newly imported photos, with the same framing as the camera's JPEG. At 12 mm the
-  12–32 mm kit zoom was off by about 5 % of the image width at the corners before. Files shot with the correction off
-  are unchanged; photos imported before this change get it when imported again.
-- Canon CR3 raws now develop from their sensor data: lossless RAW and C-RAW, checked sample for sample on the EOS
-  M50, R100 and R8. CR3 files the decoder can't read yet still open from their embedded JPEG, as before.
-- Canon CRW, Minolta MRW, Sigma X3F, Kodak KDC, Leaf MOS and Epson ERF files that LightCraft can't decode yet
-  now import as "preview only" with their embedded JPEG instead of failing. A raw whose data is damaged but whose
-  preview is intact does the same.
-- Raw files whose raw data sits in a private block of a TIFF (Phase One / Leaf IIQ, Canon EOS-1D / 1Ds and Kodak DCS
-  TIFFs) are no longer opened as a thumbnail-sized ordinary image. They are recognised as raws LightCraft can't decode
-  yet and import as "preview only", with the reason.
-- Sony ILCE-7M4 downsized lossless ARWs now decode subsampled YCbCr tiles into linear RGB,
-  preserving RAW editing & full-resolution export instead of using embedded JPEG previews.
-- Sony A7R II (and other) raws whose camera JPEG is lens-corrected no longer open grey and too dark (issue #232): the
-  starting look is fitted to the camera JPEG away from edges when the misaligned edges spoil the fit on all pixels.
-
-### Lightroom Classic catalogs
-- File → Import Lightroom Catalog… opens `.lrcat` directly, with originals referenced in place.
-  Ratings, flags, labels, keywords, collections/sets, virtual copies and supported edits migrate;
-  existing LightCraft edits are preserved by default. Source settings/history are archived, unsupported
-  fields are reported, and the original Lightroom database stays read-only. Rendering is approximate.
-
-### Presets and profiles
-- Import presets from other editors: XMP presets, classic `.lrtemplate` files, "DNG presets" from mobile apps and `.zip`
-  bundles of any of these — whole folders at once, grouped by pack. Masks inside presets come along.
-- Luminar looks: `.lmp` files and `.mplumpack` collections import as presets (grouped by collection); the sliders
-  with a counterpart here come along, the rest is listed.
-- 23 new built-in presets: Portrait, Landscape, Urban, Food, Seasons, Vintage and B&W toners.
-- Importing XMP presets no longer lists bookkeeping fields (`Cluster`, `SortName`, `SupportsAmount2`, the as-shot
-  white, empty Point Color slots…) as settings that couldn't be carried over.
-- A preset whose lens-profile switch is off no longer turns off the lens corrections built into a DNG (iPhone ProRAW
-  and other files with embedded distortion / vignetting corrections), matching what the preset does elsewhere.
-- A red / green / blue curve in an XMP preset without the master curve is ignored, as Lightroom ignores it.
-- Imported `.cube` LUT profiles appear in the Profile menu and the profile browser, grouped by their folder, and stay
-  favourites across restarts (issue #328).
+### Formats
+- HEIC / HEIF photos (iPhone and Mac) open now: the optional `lightcraft-heif` crate (heic-rs, pure Rust) behind
+  codecs' `heif` feature — 8- and 10-bit, alpha, grid tiles, the container's rotation/mirror/crop, ICC, EXIF and XMP.
+  Off by default (HEVC patents are the distributor's call, same as PhotoCraft); official builds pass `--features heif`.
+- HEIC colours now match libheif to within one code value (they were up to ~10 off): the HEVC stream's own
+  full-range/matrix signalling is honoured (iPhone photos are full range), chroma is upsampled like libheif, grids
+  take their tiles' ICC profile, and `imir` mirrors the way libheif writes it. Importing a HEIC reads its size from
+  the container instead of decoding it; small previews use the file's embedded thumbnail. The release packages
+  (macOS, Windows, Linux, FreeBSD, Nix) now really are built with HEIC support; a build without it reports
+  "HEIC/HEIF support isn't included in this build" for each `.heic`/`.heif` at import.
 
 ### Editing
 - The Tint slider works the right way round (issues #188, #321): left adds green, right adds magenta, as its track
   shows and as in Lightroom, and Tint values in Lightroom XMP sidecars now render as they do there. A custom Tint
   saved in an earlier version now shifts the other way; set it again (or re-run Auto / the white-balance picker).
+- White balance on DNGs (and other raws with a colour matrix) re-develops the photo for the new white through the
+  camera's own colour matrices, as Lightroom does, instead of shifting the colours of the as-shot rendering: a grey
+  lit by the chosen white comes out grey and saturated colours move as the camera records them. The eyedropper and
+  Auto use the same model. Custom white balances on these photos render slightly differently than before.
 - Crop (issue #295): a Lock toggle keeps the aspect ratio on every handle, Custom takes your own ratio (Apply), and
   dragging a handle into the image edge stops there instead of pushing the crop out of shape.
 
@@ -92,7 +214,71 @@
 )
 )
 
+## 2026-10-07
+
+### RAW decoding
+- Olympus ORF raws get the starting look fitted to the camera's own JPEG too, instead of opening flat and grey (the
+  E-1, E-400 and XZ-2 corpus files: all accepted), with white balance relative to the as-shot look as for the other
+  formats. On an E-1 photo the starting render moved from ΔE00 11.3 to 8.3 against Lightroom's. Photos already
+  imported pick it up when re-rendered.
+- Samsung SRW files without compression now open as raws: NX5, NX10, NX11, NX20, NX200, NX210, NX1000, NX1100, EX1
+  and WB2000. The compressed ones (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini) still open from their
+  camera JPEG. Photos already imported pick the change up on Reload.
+- Raws from 52 camera models (22 Canon, 11 Nikon, 11 Sony, 3 Fujifilm and 5 others, plus their other names) whose
+  camera JPEG can't be fitted no longer open with the neutral fallback: they start from colour matrices fitted to the
+  camera's measured spectral sensitivities, from the Academy Software Foundation's rawtoaces-data. A camera profile
+  and the fit to the photo's own JPEG still come first, so photos that had a fitted look keep it. See
+  [camera preview colour](camera-preview-colour.md#spectral-camera-matrices-and-the-order-of-precedence).
+- Canon CR2 raws no longer open too dark with blocked-up shadows: the black level was measured over border columns
+  that light already reaches (left of the image area Canon records), 4 % of the range too high on the EOS 6D. It is
+  now measured on the masked columns alone (8 corpus bodies, EOS 40D to 5DS R). On a 6D photo the starting render
+  moved from ΔE00 7.6 to 5.2 against Lightroom's.
+- Canon CR2 and Pentax PEF raws get the same starting look fitted to the camera's own JPEG as ARW, NEF, RW2, RAF
+  and CR3, instead of opening flat and desaturated (issue #310). Photos already imported pick it up when re-rendered.
+- JPEG XL compressed DNGs (DNG 1.7) now open: lossless tiles decode sample for sample (checked on synthetic files);
+  lossy tiles decode too, keeping the raw values above 1.0 instead of clipping them (checked on one real file). A tile that cannot be decoded makes the file open from its embedded
+  preview, with the reason, instead of showing a black tile. A JPEG XL preview stored in the DNG is used like an
+  embedded JPEG.
+- Apple ProRAW's gain table map (its local tone mapping, `ProfileGainTableMap`) is now read and kept when a photo is
+  exported or converted to DNG. It is not applied by default: Lightroom Classic renders ProRAW without it. To see a
+  ProRAW the way the iPhone renders it, turn on Profile ▸ Camera local tone mapping (shown for photos that carry the
+  map); the option is per photo, so presets and Copy Settings carry it.
+- iPhone ProRAW and other DNGs that carry their own segmentation mattes (DNG semantic masks) use them for the Select
+  Sky, Subject and Background masks instead of our heuristics, so the sky is selected where the camera found it
+  (checked on one CC0 iPhone 12 Pro ProRAW). Photos without mattes are unchanged.
+- Panasonic and Leica raws (RW2, RWL) are now corrected for lens distortion the way the camera corrects its own JPEG
+  (issue #256): the correction the camera records in the file is applied under Lens Corrections ▸ Enable Profile
+  Corrections, on by default for newly imported photos, with the same framing as the camera's JPEG. At 12 mm the
+  12–32 mm kit zoom was off by about 5 % of the image width at the corners before. Files shot with the correction off
+  are unchanged; photos imported before this change get it when imported again.
+- Canon CR3 raws now develop from their sensor data: lossless RAW and C-RAW, checked sample for sample on the EOS
+  M50, R100 and R8. CR3 files the decoder can't read yet still open from their embedded JPEG, as before.
+- Canon EOS R7 C-RAW files develop from their sensor data too, instead of opening from their embedded JPEG. For R7
+  C-RAWs imported earlier, Photo ▸ Reload from Disk picks up the raw data.
+- Canon CRW, Minolta MRW, Sigma X3F, Kodak KDC, Leaf MOS and Epson ERF files that LightCraft can't decode yet
+  now import as "preview only" with their embedded JPEG instead of failing. A raw whose data is damaged but whose
+  preview is intact does the same.
+- Raw files whose raw data sits in a private block of a TIFF (Phase One / Leaf IIQ, Canon EOS-1D / 1Ds and Kodak DCS
+  TIFFs) are no longer opened as a thumbnail-sized ordinary image. They are recognised as raws LightCraft can't decode
+  yet and import as "preview only", with the reason.
+- Sony ILCE-7M4 downsized lossless ARWs now decode subsampled YCbCr tiles into linear RGB,
+  preserving RAW editing & full-resolution export instead of using embedded JPEG previews.
+- Sony A7R II (and other) raws whose camera JPEG is lens-corrected no longer open grey and too dark (issue #232): the
+  starting look is fitted to the camera JPEG away from edges when the misaligned edges spoil the fit on all pixels.
+
+### Lightroom Classic catalogs
+- File → Import Lightroom Catalog… opens `.lrcat` directly, with originals referenced in place.
+  Ratings, flags, labels, keywords, collections/sets, virtual copies and supported edits migrate;
+  existing LightCraft edits are preserved by default. Source settings/history are archived, unsupported
+  fields are reported, and the original Lightroom database stays read-only. Rendering is approximate.
+
+## 2026-10-05
+
 ### Reliability
+- The Windows installer asks where to install LightCraft (Program Files by default; upgrades keep the folder you
+  chose) and ends on a page saying it was installed, with a "Launch LightCraft" box. It used to finish without a word,
+  so a successful install looked like nothing had happened (issues #18, #399). Silent installs (`/qn`, `/passive`)
+  show no dialogs and take `INSTALLFOLDER=...`.
 - If the desktop app can't open its window (for example when no graphics device can be used), it now says so in a
   message box that names the log file, instead of quitting without a trace (issue #260).
 - On macOS, single-key shortcuts that appear in the menu bar now work: E, C, H, M, ⇧P, I, K, D, ratings 0–5,
@@ -115,6 +301,9 @@
   ignored before) chooses the graphics backend; `off` renders on the CPU. The GPU now starts after the window
   is up, and only when Settings ▸ Performance ▸ Use the GPU for rendering is on; if LightCraft ever dies while
   starting the GPU, the next launch starts with GPU rendering off and says how to turn it back on.
+- The Windows app no longer quits at launch with "Parent device is lost" when another program's `dxcompiler.dll` is
+  on the DLL search path without its `dxil.dll` (issue #471): DirectX 12 shaders now always compile with the
+  compiler built into Windows (FXC). `WGPU_DX12_COMPILER=dxc` uses a `dxcompiler.dll` instead.
 - Exports and renders never write over a photo's original (issue #93): exporting into the photo's own folder with
   the same name and "Overwrite" (or Export with Previous repeating it), an exact output path from the control
   channel or MCP, a merge preview path or `lightcraft-cli render IMG.jpg -o IMG.jpg` is refused with a clear
@@ -181,6 +370,23 @@
   library) are written atomically and saved as soon as you open another library, not only at quit. Quitting while
   changes couldn't be saved tries once more, then asks: Try Saving Again, Quit Anyway or Cancel.
 
+## 2026-10-02
+
+### Presets and profiles
+- Import presets from other editors: XMP presets, classic `.lrtemplate` files, "DNG presets" from mobile apps and `.zip`
+  bundles of any of these — whole folders at once, grouped by pack. Masks inside presets come along.
+- Luminar looks: `.lmp` files and `.mplumpack` collections import as presets (grouped by collection); the sliders
+  with a counterpart here come along, the rest is listed.
+- 23 new built-in presets: Portrait, Landscape, Urban, Food, Seasons, Vintage and B&W toners.
+- Importing XMP presets no longer lists bookkeeping fields (`Cluster`, `SortName`, `SupportsAmount2`, the as-shot
+  white, empty Point Color slots…) as settings that couldn't be carried over.
+- A preset whose lens-profile switch is off no longer turns off the lens corrections built into a DNG (iPhone ProRAW
+  and other files with embedded distortion / vignetting corrections), matching what the preset does elsewhere.
+- XMP presets apply their red / green / blue curves only when they also have the master curve and all three channel
+  curves, as Lightroom does: a preset with just one channel curve (or no master curve) leaves the channels alone.
+- Imported `.cube` LUT profiles appear in the Profile menu and the profile browser, grouped by their folder, and stay
+  favourites across restarts (issue #328).
+
 ### Library
 - Photos in Recently Deleted can be restored from the app: right-click ▸ Restore (or Delete Permanently), also in the
   Photo menu. The filmstrip has the photo context menu too. Adding a file again that is in Recently Deleted no
@@ -230,6 +436,9 @@
   lost everything at quit; a temporary session shows a banner the whole time and never writes to your library.
 
 ### Editing
+- Optional remote SAM 3: keep the native editor local and run Object, Describe, and detail
+  inference on a Mac through SSH. Saved masks still render and export offline.
+  See [remote Metal inference](ai-masks.md#remote-metal-inference).
 - AI masks with SAM 3 (Object and Describe in the Masking panel): click an object to select it (⌥-click leaves a
   part out), or type what to select ("sky", "the red car", "car, road"); both combine with other masks, have an
   Edge setting, and get a sharper zoomed-in pass in the background. The model runs inside LightCraft in pure Rust

docs/xmp-interop.md

@@ -26,7 +26,7 @@ What we write (standard namespaces, so other tools can read the metadata):
 | Capture time, GPS | `exif:DateTimeOriginal`, `photoshop:DateCreated`, `exif:GPSLatitude`/`GPSLongitude` |
 | Pick / reject flag | `lc:flag` (`pick`, `reject`, `none`) |
 | Location | `lc:location` |
-| Develop settings | `lc:settings` — our complete `DevelopSettings` as JSON (exact round trip, incl. masks, spots, crop) |
+| Develop settings | `lc:settings` — our complete `DevelopSettings` as JSON (exact round trip, incl. masks, spots, crop and the rendering process; settings without `process` are V1, see [process-versions.md](process-versions.md)) |
 
 `lc:` is `http://ns.lightcraft.app/lc/1.0/`.
 
@@ -79,7 +79,7 @@ have none. So saving one photo never overwrites the other's metadata (`Session::
 LightCraft reads face, pet, focus and barcode regions in the Metadata Working Group's region schema
 (`mwg-rs:Regions`, `http://www.metadataworkinggroup.com/schemas/regions/`), as Lightroom, digiKam, Picasa and others
 write them, from sidecars and from XMP embedded in the file. Named faces become people in the People view
-(LR-LIB-PEOPLE in [`parity.md`](parity.md)), and every region is drawn as a box in the loupe.
+(LR-LIB-PEOPLE in [`parity-checklist.md`](parity-checklist.md)), and every region is drawn as a box in the loupe.
 
 - **Read only.** LightCraft never writes `mwg-rs:Regions`; saving a sidecar keeps another application's regions byte
   for byte. Removing or resizing a box in the loupe changes the library only.
@@ -104,15 +104,17 @@ Our pipeline renders differently, so **values carry over but the look is approxi
 We read these fields; we never write them. Only fields in the packet are applied: the result is a partial settings
 object that gets merged like a preset, so everything else keeps its current or default value. Packets marked
 `crs:AlreadyApplied="True"` are skipped, because those pixels already contain the edit. Only process-version 2012+ field
-names are read (e.g. `Exposure2012`, not the older `Exposure`).
+names are read (e.g. `Exposure2012`, not the older `Exposure`). `crs:ProcessVersion` itself numbers the other
+application's renderer and is ignored: the photo keeps LightCraft's own process, the latest for a newly imported photo
+([process-versions.md](process-versions.md)).
 
 | `crs:` field(s) | LightCraft control | Notes |
 |---|---|---|
 | `Exposure2012` | `light.exposure` | EV, 1:1 |
 | `Contrast2012`, `Highlights2012`, `Shadows2012`, `Whites2012`, `Blacks2012` | `light.contrast` … `light.blacks` | −100..100, 1:1 |
 | `WhiteBalance` | `wb.mode` | `As Shot`, `Auto`, `Daylight`, `Cloudy`, `Shade`, `Tungsten`, `Fluorescent`, `Flash`; other names → custom |
-| `Temperature`, `Tint` | `wb.temp`, `wb.tint` | Kelvin / tint for raw files (and presets) |
-| `IncrementalTemperature`, `IncrementalTint` | `wb.temp`, `wb.tint` | rendered files: −100..100 on our relative scale (mired shift around 6500 K, same as the Temp slider) |
+| `Temperature`, `Tint` | `wb.temp`, `wb.tint` | Kelvin / tint as written for raws with a measured illuminant (DNG) and for presets. Raws LightCraft develops relative to their as-shot look (ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW: 6500 K / 0 means as shot) take the same mired shift from the packet's `AsShotTemperature` / `AsShotTint` instead; without that reference a custom Kelvin stays As Shot and is reported (`Temperature, Tint (custom white balance without AsShotTemperature: kept As Shot)`), because read on the relative scale it would be a large colour cast (issue #510) |
+| `IncrementalTemperature`, `IncrementalTint` | `wb.temp`, `wb.tint` | rendered files: −100..100 on our relative scale (mired shift around 6500 K, same as the Temp slider); a rendered file with only `Temperature` shifts from `AsShotTemperature` like the raws above when it is present |
 | `Vibrance`, `Saturation` | `color.vibrance`, `color.saturation` | 1:1 |
 | `Texture`, `Clarity2012`, `Dehaze` | `effects.texture`, `effects.clarity`, `effects.dehaze` | 1:1 |
 | `HueAdjustment<Band>`, `SaturationAdjustment<Band>`, `LuminanceAdjustment<Band>` | `mixer.<band>.hue/sat/lum` | bands Red, Orange, Yellow, Green, Aqua, Blue, Purple, Magenta |
@@ -121,7 +123,7 @@ names are read (e.g. `Exposure2012`, not the older `Exposure`).
 | `ParametricShadows`, `ParametricDarks`, `ParametricLights`, `ParametricHighlights` | `curve.shadows/darks/lights/highlights` | |
 | `ParametricShadowSplit`, `ParametricMidtoneSplit`, `ParametricHighlightSplit` | `curve.split_shadows/split_mid/split_highlights` | |
 | `CurveRefineSaturation` | `curve.refine_saturation` | 0..100 (100 = curve saturation unchanged) |
-| `ToneCurvePV2012`, `ToneCurvePV2012Red/Green/Blue` | `curve.master/red/green/blue` | `"x, y"` points in 0..255 → 0..1; a straight 0→255 line = no curve; the red / green / blue curves are read only with `ToneCurvePV2012` (Lightroom Classic ignores them without it) |
+| `ToneCurvePV2012`, `ToneCurvePV2012Red/Green/Blue` | `curve.master/red/green/blue` | `"x, y"` points in 0..255 → 0..1; a straight 0→255 line = no curve; the red / green / blue curves are read only when `ToneCurvePV2012` and all three channel curves are present (Lightroom Classic ignores them otherwise: a master + red-only packet renders without the red curve) |
 | `SplitToningShadowHue/Saturation`, `SplitToningHighlightHue/Saturation` | `grading.shadows/highlights.hue/sat` | |
 | `ColorGradeShadowLum`, `ColorGradeHighlightLum` | `grading.shadows/highlights.lum` | |
 | `ColorGradeMidtoneHue/Sat/Lum`, `ColorGradeGlobalHue/Sat/Lum` | `grading.midtones/global.*` | |