collective

Browse / github.com/storytold/lightcraft / patch

Cr3 white level saturation

CR3: highlights between Canon's stated white level and sensor saturation are clipped, leaving a hard pale ring (EOS RP, R100) ## Problem For Canon CR3 files, the decoder takes the white level from `ColorData` (the word after the normal white level). That value is lower than the point where the sensor actually saturates: | Camera | Stated white | Where samples actually saturate | Range lost | |---|---|---|---| | EOS RP (every ISO) | 14558 | pile-up at 16383 | ~0.2 EV | | EOS R100, ISO 640 (a −⅓-stop ISO) | 10439 | pile-up spread over 13300–13700 | ~0.4 EV | The samples in that range are real light. On an EOS RP night shot of the moon (ISO 3200), the G/R and G/B ratios of the same surfaces stay within 1% from G = 80

Status
open
Score
0.00
Adopters
0 other operators
Author
jensgoemaere (imported from pull request #3097, open)
Base
bb08a697a41b2561a54f1b740245119503b24758
Size
+393 −39 in 12 files
Review
pending
Shared
2026-10-28
Id
83a936373850256510676795

How it went

No other operator has reported using it yet.

Diff

raw · crates/engine/src/camera_preview.rs crates/engine/src/media.rs crates/merge/src/output.rs crates/raw/src/dng.rs crates/raw/src/lib.rs crates/raw/src/saturation.rs crates/raw/src/vendor/cr3.rs crates/raw/src/vendor/mod.rs docs/cr3.md docs/parity-checklist.md docs/raw-parity.md docs/whats-new.md

diff --git a/crates/engine/src/camera_preview.rs b/crates/engine/src/camera_preview.rs--- a/crates/engine/src/camera_preview.rs+++ b/crates/engine/src/camera_preview.rs@@ -243,6 +243,7 @@ pub(crate) fn dng_colour(tags: &ColorData, declared: &crate::files::DngWhite, t:         as_shot_neutral: Some(neutral),         as_shot_white_xy: None,         baseline_exposure: t.baseline_exposure + k.log2(),+        white_extension_ev: 0.0,         baseline_sharpness: tags.baseline_sharpness,         kelvin_presets: None,         profile: ProfileLook {@@ -320,6 +321,14 @@ pub(crate) fn fit_preview(raw: &RawImage, bytes: &[u8], transform: &CameraTransf /// the render's highlight reconstruction. const SENSOR_CLIP: f32 = 0.99; +/// [`SENSOR_CLIP`] relative to the white level the file states, for `raw`'s normalised samples. A CR3 whose white+/// level the decoder raised to the sensor's saturation point (`white_extension_ev`) still fits its look without the+/// samples the file calls clipped, so the fit, and every render below the old white level, stays as it was.+fn sensor_clip(raw: &RawImage) -> f32 {+    let ev = raw.color.white_extension_ev;+    if ev.is_finite() && ev > 0.0 { SENSOR_CLIP * (-ev).exp2() as f32 } else { SENSOR_CLIP }+}+ /// [`fit_look_with`] for a photo without Sony's DRO. #[cfg(test)] fn fit_look(sensor: &Rgb32f, reference: &Rgb32f, clipped: &[bool], colour: Option<(Mat3, Option<HsvTable>)>) -> Option<CameraLook> {@@ -385,10 +394,10 @@ fn without_clipped(sensor: &Rgb32f, clipped: &[bool]) -> Option<Rgb32f> {     Some(out) } -/// 1 where any channel of a camera-RGB pixel is at or above [`SENSOR_CLIP`], else 0.-fn clip_mask(camera: &Rgb32f) -> Rgb32f {+/// 1 where any channel of a camera-RGB pixel is at or above `clip` ([`sensor_clip`]), else 0.+fn clip_mask(camera: &Rgb32f, clip: f32) -> Rgb32f {     let mut mask = camera.clone();-    mask.map_in_place(|p| if p.iter().any(|v| *v >= SENSOR_CLIP) { [1.0; 3] } else { [0.0; 3] });+    mask.map_in_place(|p| if p.iter().any(|v| *v >= clip) { [1.0; 3] } else { [0.0; 3] });     mask } @@ -652,7 +661,7 @@ fn proxies(     // Fixed, bounded proxy: the selected look cannot depend on thumbnail/export resolution.     let k = (crop.width.max(crop.height).div_ceil(edge as usize).max(2)).div_ceil(2) * 2;     let mut sensor = sensor_proxy(raw, k, edge as usize)?;-    let mut clipped = clip_mask(&sensor);+    let mut clipped = clip_mask(&sensor, sensor_clip(raw));     // The camera may have corrected its JPEG with the lens warp the file carries (Nikon Z lenses always, at up to 9 %     // zoom; other cameras when their correction setting is on): the sensor moved into that geometry is a candidate,     // kept below when it lines up with the JPEG better than the uncorrected one.@@ -959,7 +968,7 @@ fn into_lens_geometry(img: &Rgb32f, raw: &RawImage, k: usize, lens: &LensGeometr }  fn sensor_proxy(raw: &RawImage, k: usize, edge: usize) -> Option<Rgb32f> {-    Some(match raw.develop_binned(k, SENSOR_CLIP).ok()? {+    Some(match raw.develop_binned(k, sensor_clip(raw)).ok()? {         Some(sensor) => sensor,         // Lens opcodes cannot be applied to a binned mosaic: they are defined at full resolution.         None if (raw.cpp == 3 && raw.cfa.is_none()) || (raw.format == RawFormat::Dng && !raw.opcodes.list3.is_empty()) => {@@ -4336,6 +4345,29 @@ mod tests {         assert_eq!(small.data, fit(&full, 16, 16, Filter::Box).data, "correct first, then reduce");     } +    /// A raw whose white level the decoder raised to the sensor's saturation point (a CR3, issue #2053) fits its look+    /// without the samples the file calls clipped, as it did before the raise.+    #[test]+    fn samples_at_the_stated_white_level_stay_clipped_after_the_white_level_is_raised() {+        let bytes = crate::tests_xmp::synthetic_dng_with(None, Default::default());+        let mut raw = lightcraft_raw::decode(&bytes).unwrap();+        let (black, stated) = (raw.black.mean(), raw.white_at(0));+        raw.data = lightcraft_raw::RawData::U16(vec![stated as u16; raw.width * raw.height]);+        let clipped_share = |raw: &RawImage| {+            let mask = clip_mask(&sensor_proxy(raw, 2, 32).unwrap(), sensor_clip(raw));+            mask.data.iter().filter(|p| p[0] == 1.0).count() as f64 / mask.data.len() as f64+        };+        assert_eq!(clipped_share(&raw), 1.0);+        // the decoder's raise (`extend_white_to_saturation`): a white level 0.3 EV higher, the change in the baseline+        // exposure and recorded as the white extension+        raw.white = vec![black + (stated - black) * 0.3f32.exp2()];+        raw.color.baseline_exposure += 0.3;+        raw.color.white_extension_ev = 0.3;+        assert_eq!(clipped_share(&raw), 1.0);+        raw.color.white_extension_ev = 0.0;+        assert_eq!(clipped_share(&raw), 0.0, "without the record the old white level reads as unclipped light");+    }+     /// Which DNGs get a tone fitted to their camera JPEG: a colour matrix, a tone curve that is absent or the     /// identity, with or without a look table; and no other raw format.     #[test]diff --git a/crates/engine/src/media.rs b/crates/engine/src/media.rs--- a/crates/engine/src/media.rs+++ b/crates/engine/src/media.rs@@ -62,7 +62,7 @@ impl SettingsHashes { }  /// Bump when the pipeline's output changes, to invalidate cached thumbnails.-pub const RENDER_CACHE_VERSION: u64 = 70;+pub const RENDER_CACHE_VERSION: u64 = 71;  /// Thumbnails render at one of these long edges (so window/cell size changes reuse the cache). pub const THUMB_SIZES: [usize; 4] = [128, 256, 384, 512];diff --git a/crates/merge/src/output.rs b/crates/merge/src/output.rs--- a/crates/merge/src/output.rs+++ b/crates/merge/src/output.rs@@ -34,12 +34,13 @@ pub enum DngSamples {  /// The DNG colour tags for frames of `color`. A source's gain table map is dropped: it is /// positioned on that one capture's active area, which a merged image (aligned, oriented,-/// stitched, cropped) no longer shares.+/// stitched, cropped) no longer shares. So is its white extension: the merged image has its own white level. pub fn color_data(color: &FrameColor) -> ColorData {     match color {         FrameColor::Camera(c) => {             let mut c = (**c).clone();             c.profile.gain_table_map = None;+            c.white_extension_ev = 0.0;             c         }         FrameColor::Linear { to_xyz_d50 } => {@@ -54,6 +55,7 @@ pub fn color_data(color: &FrameColor) -> ColorData {                 as_shot_neutral: Some([1.0, 1.0, 1.0]),                 as_shot_white_xy: None,                 baseline_exposure: 0.0,+                white_extension_ev: 0.0,                 baseline_sharpness: None,                 profile: Default::default(),                 kelvin_presets: None,diff --git a/crates/raw/src/dng.rs b/crates/raw/src/dng.rs--- a/crates/raw/src/dng.rs+++ b/crates/raw/src/dng.rs@@ -118,6 +118,7 @@ pub(crate) fn color_data(ifd0: &Ifd, raw: &Ifd, order: ByteOrder) -> ColorData {         as_shot_white_xy: get(t::AS_SHOT_WHITE_XY).filter(|v| v.len() == 2 && v[0] > 0.0 && v[1] > 0.0).map(|v| Xy::new(v[0], v[1])),         baseline_exposure: get(t::BASELINE_EXPOSURE).and_then(|v| v.first().copied()).filter(|v| v.is_finite()).unwrap_or(0.0)             + get(t::BASELINE_EXPOSURE_OFFSET).and_then(|v| v.first().copied()).filter(|v| v.is_finite()).unwrap_or(0.0),+        white_extension_ev: 0.0,         // DNG 1.7 BaselineSharpness (IFD 0 or the enhanced IFD); implausible values are ignored         baseline_sharpness: get(t::BASELINE_SHARPNESS).and_then(|v| v.first().copied()).filter(|v| v.is_finite() && *v > 0.0 && *v <= 16.0),         profile: profile_look(ifd0, raw, order),diff --git a/crates/raw/src/lib.rs b/crates/raw/src/lib.rs--- a/crates/raw/src/lib.rs+++ b/crates/raw/src/lib.rs@@ -660,6 +660,11 @@ pub struct ColorData {     pub as_shot_white_xy: Option<Xy>,     /// EV to add for a "normal" rendering (`BaselineExposure` + `BaselineExposureOffset`).     pub baseline_exposure: f64,+    /// The part of `baseline_exposure` that comes from raising the white level above the one the file states+    /// ([`RawImage::extend_white_to_saturation`], CR3): normalised samples at `2^-white_extension_ev` and up are what+    /// the file calls clipped. 0 otherwise. Not a DNG tag.+    #[serde(default)]+    pub white_extension_ev: f64,     /// `BaselineSharpness`: sharpening relative to a reference camera (`None`: the DNG default,     /// 1). Read and written back by DNG export; rendering doesn't use it yet.     #[serde(default)]@@ -727,6 +732,15 @@ pub struct Normalized {     pub cfa: Option<Cfa>, } +/// `color` as the file's headers state it: without the white extension a full decode adds+/// ([`RawImage::extend_white_to_saturation`] needs the samples, which a header probe doesn't read), so a decode's+/// [`RawInfo`] is its [`probe_info`]. Exact for CR3, whose decoder starts the baseline exposure at 0.+fn stated_color(mut color: ColorData) -> ColorData {+    color.baseline_exposure -= color.white_extension_ev;+    color.white_extension_ev = 0.0;+    color+}+ impl RawImage {     /// The description without the samples (what [`probe_info`] returns for the same file).     pub fn info(&self) -> RawInfo {@@ -740,7 +754,7 @@ impl RawImage {             active_area: self.active_area,             crop: self.crop,             orientation: self.orientation,-            color: self.color.clone(),+            color: stated_color(self.color.clone()),             wb_multipliers: self.wb_multipliers,             opcodes: self.opcodes.clone(),             metadata: self.metadata.clone(),@@ -761,7 +775,7 @@ impl RawImage {             active_area: self.active_area,             crop: self.crop,             orientation: self.orientation,-            color: self.color,+            color: stated_color(self.color),             wb_multipliers: self.wb_multipliers,             opcodes: self.opcodes,             metadata: self.metadata,diff --git a/crates/raw/src/saturation.rs b/crates/raw/src/saturation.rs--- a/crates/raw/src/saturation.rs+++ b/crates/raw/src/saturation.rs@@ -1,4 +1,4 @@-//! Sensors that clip below the stated white level.+//! Sensors that clip below, or above, the stated white level. //! //! A DNG's `WhiteLevel` is what the writer says the sample range tops out at, not always where the //! sensor really saturates: a camera app can state 4095 for 12-bit data that piles up at 3567 (85 % of@@ -10,8 +10,18 @@ //! (a pile-up of identical values near the top of the range) and raises the samples at or above it to //! the stated white level. Nothing else changes: unclipped samples keep their values, and a file whose //! data really reaches its white level, or has no pile-up, is left alone.+//!+//! The opposite also happens: Canon's CR3 `ColorData` white level sits below where the sensor saturates+//! (EOS RP: 14558 while samples run linearly up to a pile-up at 16383; EOS R100 at ISO 640: 10439 under a+//! pile-up spread over 13300–13700, about 0.4 EV). Samples between the two are real light, but highlight+//! reconstruction took them as clipped and rebuilt them, which drew a hard-edged pale band where a bright+//! sky crosses the stated level. [`RawImage::extend_white_to_saturation`] moves the white level up to the+//! data's saturation point and adds the difference to the baseline exposure (recording it as+//! [`crate::ColorData::white_extension_ev`], so the camera-look fit still leaves out what the file calls clipped):+//! everything below the old white level renders exactly as before and only the highlights gain range. -use crate::{RawData, RawImage};+use crate::vendor::sample_row_step;+use crate::{Cfa, RawData, RawImage};  /// A saturation plateau must hold at least this share of its colour's samples (and 100 of them)... const MIN_SHARE: f64 = 1e-4;@@ -27,24 +37,25 @@ const ABOVE_MARGIN: f32 = 0.01; /// How far below the plateau the "average value just below it" reaches. const NEIGHBOURHOOD: usize = 64; +/// Above the stated white level the search runs on coarse bins of this share of the range above black: a plateau+/// made by a digital ISO pull (Canon's −⅓-stop ISOs) is spread over a few hundred values, not one.+const ABOVE_BIN: f32 = 1.0 / 128.0;+/// Samples above the stated white level worth acting on: at least this share of all samples (and 64 of them).+const ABOVE_SHARE: f64 = 1e-5;+/// A saturation plateau above the stated white level is at least this many times as populated as the bins below+/// it (`ABOVE_REFERENCE` of them, skipping the one right under the plateau, which a spread plateau spills into).+const ABOVE_SPIKE: f64 = 3.0;+const ABOVE_REFERENCE: usize = 8;+/// Samples above the top of the data that are hot pixels, not where it ends.+const ABOVE_STRAYS: u64 = 16;+ impl RawImage {     /// The value each colour's samples saturate at, when that is clearly below the stated white level     /// (see the module docs). Only single-plane integer CFA data is examined.     pub fn saturation_points(&self) -> [Option<u16>; 3] {         let none = [None; 3];-        let (RawData::U16(d), Some(cfa)) = (&self.data, &self.cfa) else { return none };-        let white = self.white_at(0);-        let black = self.black.mean();-        // a hostile file can state any levels: NaN, negative or inverted ones are left alone-        let levels_ok = black.is_finite() && white.is_finite() && black >= 0.0 && white > black && white <= 65535.0;-        if self.cpp != 1 || !cfa.valid() || self.width.checked_mul(self.height) != Some(d.len()) || !levels_ok {-            return none;-        }+        let Some((d, cfa, black, white)) = self.cfa_samples().filter(|&(.., white)| white <= 65535.0) else { return none };         let a = self.active_area;-        let fits = |start: usize, len: usize, max: usize| start.checked_add(len).is_some_and(|end| end <= max);-        if !fits(a.x, a.width, self.width) || !fits(a.y, a.height, self.height) {-            return none;-        }         let lo = (black + 0.5 * (white - black)).ceil().max(0.0) as usize;         let hi = (white as usize).min(65535);         if lo + NEIGHBOURHOOD >= hi {@@ -104,6 +115,119 @@ impl RawImage {         }         changed     }++    /// Where the sensor saturates when its samples run past the stated white level (see the module docs): the+    /// lowest lower edge of a colour's pile-up above that level, or the top of the bit depth when no pile-up is+    /// found but the data reaches that top. `None` when next to nothing lies above the stated white level, when+    /// the data ends under the top without piling up (no measured saturation point), or when the image isn't+    /// single-plane integer CFA data with sane levels.+    pub fn saturation_above_white(&self) -> Option<f32> {+        let full = ((1u32 << self.bits.clamp(1, 16)) - 1) as f32;+        let (d, cfa, black, white) = self.cfa_samples().filter(|&(.., white)| white < full)?;+        let a = self.active_area;+        // coarse bins over the upper half of the range, so the bins under a plateau just above the stated white+        // level can still serve as its reference+        let base = (black + 0.5 * (full - black)).min(white).floor() as usize;+        let bin = ((ABOVE_BIN * (full - black)) as usize).max(1);+        let bins = (full as usize - base) / bin + 1;+        let mut hist = vec![[0u64; 3]; bins];+        // integer samples above `white` are those above its floor (`white` is finite, in 0..full)+        let white_floor = white as usize;+        let full_value = full as usize;+        let mut total = 0u64;+        let mut above = 0u64;+        let mut at_top = 0u64;+        for y in (0..a.height).step_by(sample_row_step(a.height)) {+            let Some(row) = d.get((a.y + y) * self.width + a.x..).and_then(|r| r.get(..a.width)) else { continue };+            for (x, &v) in row.iter().enumerate() {+                total += 1;+                let v = usize::from(v);+                if v > white_floor {+                    above += 1;+                }+                if v >= full_value {+                    at_top += 1;+                }+                if v >= base+                    && let Some(h) = hist.get_mut((v - base) / bin)+                {+                    h[cfa.color_at(a.x + x, a.y + y).min(2) as usize] += 1;+                }+            }+        }+        if (above as f64) < (total as f64 * ABOVE_SHARE).max(64.0) {+            return None;+        }+        // the bin holding the stated white level: a pile-up can start in it (white level just under a spread plateau)+        let first = white_floor.saturating_sub(base) / bin;+        let pile_up = |c: usize| {+            let count = |i: usize| hist.get(i).map_or(0, |h| h[c]);+            // a pile-up is the top of the data (a few stray hot pixels above it aside), not its busiest bin: a bright+            // sky just over the stated level can hold more samples than a small clipped patch+            let mut strays = 0;+            let top = (first..bins).rev().find(|&i| {+                strays += count(i);+                strays > ABOVE_STRAYS+            })?;+            let peak = (top.saturating_sub(2).max(first)..=top).max_by_key(|&i| (count(i), i)).unwrap_or(top);+            let n = count(peak);+            let reference =+                (peak.saturating_sub(1 + ABOVE_REFERENCE)..peak.saturating_sub(1)).map(count).sum::<u64>() as f64 / ABOVE_REFERENCE as f64;+            let spike = ABOVE_SPIKE * reference.max(1.0);+            let beyond: u64 = (peak + 3..bins).map(count).sum();+            if (n as f64) < spike || n < 32 || beyond as f64 > MAX_ABOVE * n as f64 {+                return None;+            }+            // a spread plateau covers the bins under its peak that still stand out from the reference+            let mut edge = peak;+            while edge > first && count(edge - 1) as f64 >= spike && count(edge - 1) * 2 >= n {+                edge -= 1;+            }+            Some(((base + edge * bin) as f32).clamp(white, full))+        };+        // no pile-up found: data that reaches the top of the bit depth piles up there behind a busy patch of light+        // the bins can't tell apart from it; data that ends under the top has no measured saturation point and keeps+        // the stated level. A pile-up at or just over the stated level keeps it too.+        let level = match (0..3).filter_map(pile_up).reduce(f32::min) {+            Some(level) => level,+            None if at_top > ABOVE_STRAYS => full,+            None => return None,+        };+        (level > white + 1.0).then_some(level)+    }++    /// Raise the white level to [`Self::saturation_above_white`] and add the change to the baseline exposure, so+    /// samples below the old white level render as before while the ones above it stay real light instead of+    /// counting as clipped. The change is also kept as [`crate::ColorData::white_extension_ev`], for fits that must+    /// still treat what the file called clipped as clipped. Returns the new white level; the samples are not touched.+    pub fn extend_white_to_saturation(&mut self) -> Option<f32> {+        let level = self.saturation_above_white()?;+        // finite and above 1: `saturation_above_white` checked the levels and returns one above the white level+        let black = self.black.mean();+        let ev = f64::from((level - black) / (self.white_at(0) - black)).log2();+        self.white = vec![level];+        self.color.baseline_exposure += ev;+        self.color.white_extension_ev += ev;+        Some(level)+    }++    /// The samples, CFA, black and stated white level of single-plane integer CFA data whose active area lies in+    /// the image. A hostile file can state any levels: NaN, negative or inverted ones give `None`.+    fn cfa_samples(&self) -> Option<(&[u16], &Cfa, f32, f32)> {+        let (RawData::U16(d), Some(cfa)) = (&self.data, &self.cfa) else { return None };+        let white = self.white_at(0);+        let black = self.black.mean();+        let levels_ok = black.is_finite() && white.is_finite() && black >= 0.0 && white > black;+        let a = self.active_area;+        let fits = |start: usize, len: usize, max: usize| start.checked_add(len).is_some_and(|end| end <= max);+        let ok = self.cpp == 1+            && cfa.valid()+            && self.width.checked_mul(self.height) == Some(d.len())+            && levels_ok+            && fits(a.x, a.width, self.width)+            && fits(a.y, a.height, self.height);+        ok.then_some((d.as_slice(), cfa, black, white))+    } }  #[cfg(test)]@@ -269,4 +393,133 @@ mod tests {         let after = render(&r);         assert!(tint(after) < 0.01, "{after:?}");     }++    /// A 14-bit 128 x 128 RGGB mosaic like a Canon CR3: black `black`, stated white `white`, samples spread+    /// evenly from black up to `top`; `pile(i, v)` may replace each sample (a sensor's saturation).+    fn canon(black: f32, white: f32, top: u32, pile: impl Fn(usize, u16) -> u16) -> RawImage {+        let span = top - black as u32;+        let data = (0..128 * 128usize)+            .map(|i| {+                let (x, y) = (i % 128, i / 128);+                let v = (black as u32 + ((x * 131 + y * 37 + (x * y) % 97) as u32 * 7919) % span).min(65535) as u16;+                pile(i, v)+            })+            .collect();+        RawImage {+            width: 128,+            height: 128,+            data: RawData::U16(data),+            bits: 14,+            black: BlackLevel::uniform(black),+            active_area: Rect::new(0, 0, 128, 128),+            crop: Rect::new(0, 0, 128, 128),+            ..raw_with(None, white)+        }+    }++    /// EOS RP: ColorData says 14558, the sensor piles up at 16383 and is linear in between.+    fn eos_rp() -> RawImage {+        canon(512.0, 14558.0, 18000, |_, v| v.min(16383))+    }++    /// EOS R100 at ISO 640 (a digitally pulled ISO): ColorData says 10439, the samples pile up over 13300..13700.+    fn r100(white: f32) -> RawImage {+        canon(2048.0, white, 16000, |i, v| if v >= 13300 { 13300 + ((i * 7919) % 400) as u16 } else { v })+    }++    #[test]+    fn data_past_the_white_level_extends_it_to_the_pile_up() {+        let mut r = eos_rp();+        let before = r.data.clone();+        let level = r.extend_white_to_saturation().expect("raised");+        // the lower edge of the plateau's bin (1/128 of the range)+        assert!((16383.0 - 125.0..=16383.0).contains(&level), "{level}");+        assert_eq!(r.white, vec![level]);+        assert!(r.color.white_extension_ev > 0.0 && r.color.white_extension_ev == r.color.baseline_exposure, "{:?}", r.color);+        assert_eq!(r.data, before, "samples untouched");+        // a sample under the old white level normalises (with the baseline exposure) to what it did before+        let v = 9000.0f32;+        let old = (v - 512.0) / (14558.0 - 512.0);+        let new = (v - 512.0) / (level - 512.0) * 2f32.powf(r.color.baseline_exposure as f32);+        assert!((old - new).abs() < 1e-5, "{old} {new}");+        assert_eq!(r.extend_white_to_saturation(), None, "idempotent");+    }++    #[test]+    fn a_spread_pile_up_above_the_white_level_is_found() {+        let r = r100(10439.0);+        let level = r.saturation_above_white().expect("found");+        assert!((13100.0..=13400.0).contains(&level), "{level}");+    }++    #[test]+    fn a_white_level_just_under_a_pile_up_is_kept() {+        // the stated level sits inside the plateau's bin: the plateau is still a plateau, not unclipped light+        // (taking the whole range would leave the saturated samples unflagged and turn them magenta)+        let r = r100(13320.0);+        // kept, or moved up at most to the plateau's lower bin edge, where its samples still count as clipped+        let level = r.saturation_above_white().unwrap_or(13320.0);+        assert!(level <= 2048.0 + (13300.0 - 2048.0) / 0.99, "{level}");+    }++    #[test]+    fn a_small_pile_up_above_a_bright_sky_is_found() {+        // most samples above the stated level are a sky just over it; the clipped patch at the top, where a pulled+        // ISO saturates (16100, under the 14-bit range), is far smaller. (A sky within `ABOVE_REFERENCE` bins of+        // the pile-up would hide it: the reference is a mean.)+        let r = canon(512.0, 14558.0, 16300, |i, v| match i % 50 {+            0 => 16100,+            1..=25 if v > 12000 => 14600 + (v % 100),+            _ => v.min(16100),+        });+        let level = r.saturation_above_white().expect("found");+        assert!((16100.0 - 125.0..=16100.0).contains(&level), "{level}");+    }++    #[test]+    fn data_past_the_white_level_without_a_pile_up_keeps_the_stated_level() {+        // light above the stated level that ends under the top of the bit depth without piling up: no measured+        // saturation point, so the stated level stays (a 90D at ISO 100 tops out at 15047 over a stated 13036)+        let mut r = canon(2048.0, 14558.0, 15800, |_, v| v);+        assert_eq!(r.extend_white_to_saturation(), None);+        assert_eq!(r.white, vec![14558.0]);+    }++    #[test]+    fn data_reaching_the_top_takes_it_when_its_pile_up_is_hidden() {+        // a third of the samples are a busy patch of light over the 8 bins under the top, which hides the pile-up at+        // 16383 from the bin search; the data still reaches the top of the bit depth, so that is the saturation point+        let r = canon(512.0, 14558.0, 16300, |i, v| match (i % 3, i % 40) {+            (_, 0) => 16383,+            (0, _) => 15400 + v % 980,+            _ => v,+        });+        assert_eq!(r.saturation_above_white(), Some(16383.0));+    }++    #[test]+    fn data_under_the_white_level_is_left_alone() {+        let mut r = canon(512.0, 14558.0, 14000, |_, v| v);+        assert_eq!(r.extend_white_to_saturation(), None);+        assert_eq!(r.white, vec![14558.0]);+        assert_eq!(r.color.baseline_exposure, 0.0);+        // a few hot pixels above it are not light worth a new white level+        let mut r = canon(512.0, 14558.0, 14000, |i, v| if i % 1000 == 0 { 16383 } else { v });+        assert_eq!(r.extend_white_to_saturation(), None);+    }++    #[test]+    fn hostile_levels_keep_the_stated_white_level() {+        for (black, white) in [(f32::NAN, 14558.0), (-5.0, 14558.0), (512.0, f32::NAN), (512.0, 16383.0), (512.0, 70000.0), (15000.0, 14558.0)] {+            let mut r = eos_rp();+            r.black = BlackLevel::uniform(black);+            r.white = vec![white];+            assert_eq!(r.extend_white_to_saturation(), None, "{black} {white}");+        }+        let mut r = eos_rp();+        r.active_area = Rect::new(usize::MAX, 0, 2, 128);+        assert_eq!(r.extend_white_to_saturation(), None);+        r.active_area = Rect::new(0, 0, 0, 0);+        assert_eq!(r.extend_white_to_saturation(), None);+    } }diff --git a/crates/raw/src/vendor/cr3.rs b/crates/raw/src/vendor/cr3.rs--- a/crates/raw/src/vendor/cr3.rs+++ b/crates/raw/src/vendor/cr3.rs@@ -237,7 +237,7 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {     }     metadata.width = Some(crop.width as u32);     metadata.height = Some(crop.height as u32);-    let image = RawImage {+    let mut image = RawImage {         format: RawFormat::Cr3,         width,         height,@@ -258,6 +258,10 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {         metadata,         lens_metadata: Default::default(),     };+    // ColorData states a white level below the sensor's saturation point (see `saturation.rs`)+    if levels.white.is_some() && mode == Mode::Full {+        image.extend_white_to_saturation();+    }     image.validate_for(mode)?;     Ok(image) }diff --git a/crates/raw/src/vendor/mod.rs b/crates/raw/src/vendor/mod.rs--- a/crates/raw/src/vendor/mod.rs+++ b/crates/raw/src/vendor/mod.rs@@ -69,12 +69,16 @@ pub(crate) fn black_from_columns(data: &[u16], width: usize, cols: Range<usize>,     BlackLevel { repeat_rows: 2, repeat_cols: 2, values: (0..4).map(|i| (sum[i] / n[i] as f64) as f32).collect(), delta_h: vec![], delta_v: vec![] } } -/// Samples of up to 512 evenly spaced rows of the active area, for [`white_from_data`]: the borders can hold-/// their own saturated runs (0xffff junk on RW2, masked rows at 16383 on some Canon CR2s). The step is odd so both-/// row parities, and with them every CFA site, are read.+/// The step between about 512 evenly spaced rows of an area `height` rows tall. It is odd so both row parities,+/// and with them every CFA site, are read.+pub(crate) fn sample_row_step(height: usize) -> usize {+    (height / 512).max(1) | 1+}++/// Samples of up to 512 evenly spaced rows of the active area ([`sample_row_step`]), for [`white_from_data`]: the+/// borders can hold their own saturated runs (0xffff junk on RW2, masked rows at 16383 on some Canon CR2s). pub(crate) fn active_rows(data: &[u16], w: usize, a: Rect) -> Vec<u16> {-    let step = (a.height / 512).max(1) | 1;-    (a.y..a.y + a.height).step_by(step).filter_map(|y| data.get(y * w + a.x..y * w + a.x + a.width)).flatten().copied().collect()+    (a.y..a.y + a.height).step_by(sample_row_step(a.height)).filter_map(|y| data.get(y * w + a.x..y * w + a.x + a.width)).flatten().copied().collect() }  /// White level estimate: the saturation plateau if a noticeable number of samples sit at the maximum value,diff --git a/docs/cr3.md b/docs/cr3.md--- a/docs/cr3.md+++ b/docs/cr3.md@@ -219,12 +219,46 @@ C-RAW captures; the pinned R7 file is lossless, so R7 C-RAW still has no black-b  ## White level -The white level is Canon's specular white from `ColorData` (the word after the-normal white level), not the sensor's saturation point. On the RP at ISO 100-it is 14558 while samples clip at 16383. At the −⅓-stop ISOs, which pull a-higher analog ISO down digitally, it drops further: 11062 at ISO 5000, where-red saturates near 13668. Samples above the white level render as clipped.-Whether Lightroom recovers them has not been measured.+`ColorData`'s white level (the word after the normal white level) is not the+sensor's saturation point. On the EOS RP it is 14558 at every ISO while samples+pile up at 16383, and in between the sensor is linear: on a night shot of the+moon (ISO 3200) the G/R and G/B ratios of the same surfaces stay within 1% from+G = 8000 up to 16300. The CC0 EOS R100 samples at ISO 640, a −⅓-stop ISO that+pulls a higher analog ISO down digitally, state 10439 under a pile-up spread over+13300–13700 (about 0.4 EV). Highlight reconstruction treated every sample above+the stated level as clipped and rebuilt it, so where a bright sky crossed 14558+it drew a hard-edged pale band (a ring around a backlit portrait).++When samples run past the stated level (at least 1 in 100,000 of them, and 64),+the decoder moves the white level up to the data's saturation point+(`RawImage::extend_white_to_saturation`, `crates/raw/src/saturation.rs`): the+lower edge of each colour's pile-up at the top of the data, searched on coarse+bins of 1/128 of the range so a spread plateau counts, the lowest over the three+colours. When no pile-up is found but the data reaches the top of the bit depth,+the level is that top (a pile-up there hidden by a busy patch of light below+it); data that ends under the top without piling up has no measured saturation+point and keeps the stated level. The difference goes into the baseline exposure,+so everything below the old white level renders exactly as before; only the+highlights gain range. It is also recorded (`ColorData::white_extension_ev`) so+the camera-look fit (`crates/engine/src/camera_preview.rs`) still leaves out the+samples at or above the stated level: with the raised level, heavily clipped+frames gave the fit hundreds of new highlight pairs, which shifted the fitted+tone curve and with it the whole frame (#2053). A file with nothing above the+stated level is unchanged.++Measured on 966 private EOS RP files (ISO 100–12800) and the 35 CC0 CR3 samples+of `cargo xtask corpus`: 555 RP files keep 14558, 391 move to 16319–16320 (the+16383 pile-up's bin) and 20 reach 16383 without a pile-up the bins can find and+move there; 50 with some light above 14558 that ends under the top keep it. Of+the CC0 samples, 11 move (RP to 16320, R100 and M50 Mark II to 13322–13323, R10,+R50 V, R6 Mark II and an R5 Mark II crop-mode file to 16319) and the other 24 are+unchanged. Rendered at 2000 px with default settings against the decoder before+the change, every pixel below 0.8 stays within 0.02 mean dE76 on all 35 CC0+samples and on 12 of the most clipped RP frames (the camera-look fit included);+across 228 CR3s of 29 bodies, the version without the fit's old-level clipping+moved whole heavily clipped frames by up to 8.9 dE76 (#2053). Limits: a busy+patch of light within 8 bins (about 6%) under a pile-up can hide it; whether+Lightroom recovers the same range has not been measured.  ## Colour limits diff --git a/docs/parity-checklist.md b/docs/parity-checklist.md--- a/docs/parity-checklist.md+++ b/docs/parity-checklist.md@@ -1,6 +1,6 @@ # Lightroom parity checklist -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** minor (LR-BEHAV-TITLEBAR: a double-click follows the system setting, and a panel over the bar keeps the window still; KEYC-METADATA, LRC-LIB-KEYWORDS: ⌥0 / ⌥⇧0 go to the next / previous keyword set; LRC-DEV-HISTOGRAM-DRAG: the histogram's five tonal zones — hover for the value, drag to adjust the Basic control the press locked, double-click to reset; LR-VIEW-HISTOGRAM note updated; MENU-BAR: on macOS a menu item that yields its key to a focused text field or to shortcut recording really lets it go; LR-MERGE-HDR / LR-MERGE-PANO: Lanczos-3 warps; LR-IMP-LOCAL: browsing from the sidebar records the folder; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LR-IMP-ADD-DIALOG: hierarchical import album destination reconciled with main, #2362; KEY-SLIDER-NUDGE: vertical wheel nudges need a click or drag in the row; leaving it disarms them; LR-EDIT-OPTICS-PROFILE: Fujifilm nine-knot lens tables read at the plain radius; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LRC-LIB-LIBFOLDERS, LR-BEHAV-BG-TASKS: Synchronize Folder's scan shows its folder listing and stops it on ✕; LRC-LIB-LIBFOLDERS: Synchronize Folder says a folder is up to date; LR-LIB-STACK: filmstrip stack badge click; LRC-LIB-REFVIEW / CATALOG-SWITCH: Escape preserves edits; catalog-local pins; deleted and malformed references refused; LRC-LIB-COMPARE: the Info panel labels the active photo while culling, #2398; KEYC-RATING: `\` shows / hides the Filter Bar in the grids; LR-VIEW-PHOTOGRID: the grid reads only the photos an import batch or an edit touched, not the whole list; earlier: LRC-PRINT-PAGE: Print Page Options; LR-META-XMP: fewer false unimported-XMP warnings; KEYC-METADATA: ⌘K / Ctrl+K Add Keywords; LRC-DEV-HISTOGRAM-DRAG: the histogram's five tonal zones — hover for the value, drag to adjust the Basic control the press locked, double-click to reset; LR-VIEW-HISTOGRAM note updated; MENU-BAR: on macOS a menu item that yields its key to a focused text field or to shortcut recording really lets it go; LR-MERGE-HDR / LR-MERGE-PANO: Lanczos-3 warps; LR-IMP-LOCAL: browsing from the sidebar records the folder; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LR-IMP-ADD-DIALOG: hierarchical import album destination reconciled with main, #2362; KEY-SLIDER-NUDGE: vertical wheel nudges need a click or drag in the row; leaving it disarms them; LR-EDIT-OPTICS-PROFILE: Fujifilm nine-knot lens tables read at the plain radius; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LRC-LIB-LIBFOLDERS, LR-BEHAV-BG-TASKS: Synchronize Folder's scan shows its folder listing and stops it on ✕; LRC-LIB-LIBFOLDERS: Synchronize Folder says a folder is up to date; LR-LIB-STACK: filmstrip stack badge click; LRC-LIB-REFVIEW / CATALOG-SWITCH: Escape preserves edits; catalog-local pins; deleted and malformed references refused; LRC-LIB-COMPARE: the Info panel labels the active photo while culling, #2398; KEYC-RATING: `\` shows / hides the Filter Bar in the grids; LR-VIEW-PHOTOGRID: the grid reads only the photos an import batch or an edit touched, not the whole list; earlier: LRC-PRINT-PAGE: Print Page Options; LR-META-XMP: fewer false unimported-XMP warnings) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (LR-IMP-CAMERA-COVERAGE: CR3 white level at the sensor's saturation point, #2053; LR-BEHAV-TITLEBAR: a double-click follows the system setting, and a panel over the bar keeps the window still; KEYC-METADATA, LRC-LIB-KEYWORDS: ⌥0 / ⌥⇧0 go to the next / previous keyword set; LRC-DEV-HISTOGRAM-DRAG: the histogram's five tonal zones — hover for the value, drag to adjust the Basic control the press locked, double-click to reset; LR-VIEW-HISTOGRAM note updated; MENU-BAR: on macOS a menu item that yields its key to a focused text field or to shortcut recording really lets it go; LR-MERGE-HDR / LR-MERGE-PANO: Lanczos-3 warps; LR-IMP-LOCAL: browsing from the sidebar records the folder; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LR-IMP-ADD-DIALOG: hierarchical import album destination reconciled with main, #2362; KEY-SLIDER-NUDGE: vertical wheel nudges need a click or drag in the row; leaving it disarms them; LR-EDIT-OPTICS-PROFILE: Fujifilm nine-knot lens tables read at the plain radius; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LRC-LIB-LIBFOLDERS, LR-BEHAV-BG-TASKS: Synchronize Folder's scan shows its folder listing and stops it on ✕; LRC-LIB-LIBFOLDERS: Synchronize Folder says a folder is up to date; LR-LIB-STACK: filmstrip stack badge click; LRC-LIB-REFVIEW / CATALOG-SWITCH: Escape preserves edits; catalog-local pins; deleted and malformed references refused; LRC-LIB-COMPARE: the Info panel labels the active photo while culling, #2398; KEYC-RATING: `\` shows / hides the Filter Bar in the grids; LR-VIEW-PHOTOGRID: the grid reads only the photos an import batch or an edit touched, not the whole list; earlier: LRC-PRINT-PAGE: Print Page Options; LR-META-XMP: fewer false unimported-XMP warnings; KEYC-METADATA: ⌘K / Ctrl+K Add Keywords; LRC-DEV-HISTOGRAM-DRAG: the histogram's five tonal zones — hover for the value, drag to adjust the Basic control the press locked, double-click to reset; LR-VIEW-HISTOGRAM note updated; MENU-BAR: on macOS a menu item that yields its key to a focused text field or to shortcut recording really lets it go; LR-MERGE-HDR / LR-MERGE-PANO: Lanczos-3 warps; LR-IMP-LOCAL: browsing from the sidebar records the folder; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LR-IMP-ADD-DIALOG: hierarchical import album destination reconciled with main, #2362; KEY-SLIDER-NUDGE: vertical wheel nudges need a click or drag in the row; leaving it disarms them; LR-EDIT-OPTICS-PROFILE: Fujifilm nine-knot lens tables read at the plain radius; LR-VIEW-ZOOM: only a full-size drag within 20 ms clears a slow-drag verdict; LRC-LIB-LIBFOLDERS, LR-BEHAV-BG-TASKS: Synchronize Folder's scan shows its folder listing and stops it on ✕; LRC-LIB-LIBFOLDERS: Synchronize Folder says a folder is up to date; LR-LIB-STACK: filmstrip stack badge click; LRC-LIB-REFVIEW / CATALOG-SWITCH: Escape preserves edits; catalog-local pins; deleted and malformed references refused; LRC-LIB-COMPARE: the Info panel labels the active photo while culling, #2398; KEYC-RATING: `\` shows / hides the Filter Bar in the grids; LR-VIEW-PHOTOGRID: the grid reads only the photos an import batch or an edit touched, not the whole list; earlier: LRC-PRINT-PAGE: Print Page Options; LR-META-XMP: fewer false unimported-XMP warnings) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6  The measured, row-by-row checklist: one row per Lightroom feature, menu item and shortcut, what we have and what is missing. It answers *does the feature exist?* (feature breadth). Whether it is good@@ -81,7 +81,7 @@ differences and missing bindings are in [ui-parity.md](ui-parity.md#shortcuts). | LR-IMP-LOCAL | Work on files in place | P0 | ✅ | `cmd:library.browse`, `cmd:photo.addToLibrary`, `cmd:library.import` (mode add), `cmd:local.addRoot`, `cmd:local.hide`, `cmd:local.restoreHidden`, `crates/engine/src/cmd/browse.rs`, `crates/ui-egui/src/panels/left.rs` (`local_section`), `crates/ui-egui/src/panels/grid.rs` (`folder_header`) | Local: browse Pictures / Desktop / Downloads / Home or any folder without adding it (breadcrumb, Include subfolders, Add N to My Photos); browsed photos stay out of All Photos, albums and counts (album commands skip them and the album menus say to Add to My Photos first, issue #684); folders picked with Browse Folder… (or Keep in Local / Add to Local on a folder row) stay listed across restarts, and browsing a folder inside a listed one highlights it inside that tree (opened down to it, siblings reachable) instead of adding a root; edits go to XMP sidecars; importing promotes them; right-click a top-level location → Remove from Local hides the shortcut only (nothing on disk or in the catalog changes), saved with the UI state, and “Show N hidden locations” (or Browse Folder… on it) brings it back, each on its own from the row's list when several are hidden, or all at once with Restore All (issue #2114); a folder is one location however its path is spelled (`/` or `\`, trailing separator, `.`/`..`, drive-letter case; `folder_key` in `crates/catalog/src/query.rs`); browsed photos nobody changed are forgotten once their folder has not been browsed for 30 days (Settings → Performance → Local folders, 0 = never; checked when the library opens, or `cmd:library.forgetLocal` with `dryRun`; files and sidecars stay, browsing again brings them back; see `crates/catalog/src/local.rs` for what counts as a change); browsing a folder again forgets at once the untouched records of its files that another app deleted or moved, so they no longer fail to load on every visit (issue #1392; changed ones stay, shown as missing); browsing a folder keeps the active photo when the folder shows it, else makes the folder's first photo active as it arrives, the same rule as albums and the other sources (`Session::keep_active_in_view`; issue #1447: before, a library photo stayed active, so Photo Grid marked nothing and Detail, the histogram and the info showed a photo the folder doesn't hold) | | LR-IMP-SIDECAR-SPLIT | Separate XMP sidecar variants | P2 | ⬜ | `cmd:library.xmpPreferences` | sidecar naming option exists (stem/full), no split sidecars | | LR-IMP-FORMATS | Supported formats | P0 | 🟡 | `crates/codecs/src/lib.rs`, `crates/raw/src/lib.rs`, `crates/raw/src/jxl.rs` | JPEG, PNG, TIFF (1- to 64-bit integer, 16- to 64-bit float, incl. bilevel and CCITT fax), WebP, JXL, PSD, GIF, BMP (lossy wide-gamut JXL decodes to the right colours: jxl-oxide desaturated XYB rendered to P3/Rec. 2020, worked around in `crates/codecs/src/jxl.rs`); DNG (incl. lossy / Smart Preview DNG and DNG 1.7 JPEG XL tiles/strips: lossless ones decode bit-exactly on synthetic CFA and LinearRaw files, lossy ones are restored to the declared primaries and transfer curve (linear, sRGB, BT.709 or a power; PQ / HLG stay preview-only) without clipping or gamut mapping, checked on one real file with 108 lossy tiles and on 2 Lightroom Classic 15.1 lossy LinearRaw DNGs (ILCE-7CM2) whose tiles declare Rec. 2100 primaries with the sRGB curve, which were preview-only before, and any tile that fails to decode makes the file preview-only; DNG 1.7 row/column-interleaved rasters (`RowInterleaveFactor` / `ColumnInterleaveFactor`) are undone before the mosaic is read, so a file from Adobe's converter with a 2×2 interleave no longer decodes as four scaled-down copies in the wrong colours; a dimension the factor does not divide decodes with short trailing fields; verified on 4 real ILCE-6400 JPEG XL DNGs rendering bit-identical to their non-interleaved twins, factors above 2 rest on the plain reading of the tag; a single-chunk JPEG XL preview IFD is offered as the embedded preview; a DNG whose samples pile up at one value well below its stated `WhiteLevel`, as a camera app's 12-bit Bayer DNG that states 4095 and clips at 3567, has those samples raised to the white level on decode, so highlight reconstruction sees the clipped areas instead of white balance tinting them magenta, issue #548, `crates/raw/src/saturation.rs`), CR2 (colour-filter layout from the file's `CR2CFAPattern` tag, issue #85), ARW (pre-2017 bodies: white balance and black level from the encrypted `SR2SubIFD`, issue #148, its `WB_RGGBLevels` being the white balance the camera applied, issue #535; the DSLR-A900's packed 12-bit strip, two pixels per three bytes, read only when the strip is exactly 1.5 bytes per pixel, with its camera-JPEG window centred, checked on one CC0 file (A850 unmeasured); downsized Sony lossless YCbCr 4:2:0 / 4:2:2 tiles decoded to linear RGB, verified on private ILCE-7M4 3:2 & 4:3 examples including 16-bit full-resolution export; Sony DSC-R1 .SR2 decodes, its big-endian 16-bit words read in the order that fits the sample range, checked on the CC0 3221 sample; its crop and white balance live in the SR2SubIFD and are not read yet; ARW6 Compressed / Compressed (HQ) of the ILCE-7RM6 (`crates/raw/src/vendor/arw6.rs`, `crates/raw/src/llvc.rs`; 12-bit codes exact against a black-box oracle on 8 CC0 files, FF over the full frame, APS-C in the interior (LibRaw's own edge rows differ); output through our own companding curve, measured from CC0 lossless / ARW6 pairs; geometry checked against the camera JPEG, `docs/arw6-compression.md`; the ILCE-7M5 writes the same codec, unverified)), NEF (uncompressed, lossless and lossy compressed 12/14-bit, `crates/raw/src/vendor/nefc.rs`), RAF (uncompressed, lossless/lossy compressed Bayer and X-Trans; `crates/raw/src/vendor/rafc.rs`, full sensor verification on 13 bodies, `docs/raf-compression.md`), RW2 / Leica RWL / Panasonic RAW in every raw format (compressed 4 and 6, the prefix-coded strips of format 8 from the GH6 on, packed 2/5/7, the 16-bit words of the 2005–2007 bodies; black levels, in-camera aspect crops and mapped-out defect pixels; 178 CC0 files from 118 bodies checked, `crates/raw/src/vendor/rw2.rs`), PEF, ORF (uncompressed; colour-filter layout from the file's Exif `CFAPattern`; 12.8 bit/px 16-byte blocks of ten 12-bit samples + a zero pad byte, E-300 / E-330 / E-500 verified on CC0 files, E-M5 Mark II / PEN-F high-res files decode smooth but CFA and black unverified), Kodak DCS520C TIFF (a two-component 12-bit lossless JPEG strip, the two components the even and odd columns; the file's `GrayResponseCurve` table linearises the companded samples to 12 bits, black measured per CFA position, white balance from the `KodakIFD`; `RawFormat::KodakDcs`, `crates/raw/src/vendor/kodak.rs`, checked on the one CC0 sample against its IFD0 thumbnail), Hasselblad 3FR and FFF (a TIFF without a DNG version tag that describes its CFA IFD, levels, crop and white balance with DNG's tags; `RawFormat::CfaTiff`, read by `dng::decode_as`, RGGB when the file states no `CFAPattern`, checked against the camera preview on the CC0 H4D-40 FFF and CFV 3FR; an FFF has no colour matrix of its own and takes the camera's from the original 3FR header it embeds in tag `0xC51B`; neither carries a JPEG, so their uncompressed 8-bit RGB preview (1217 × 913 in the H4D-40 FFF, 218 × 218 in the CFV 3FR) is the embedded preview, handed on as a baseline TIFF, `crates/raw/src/vendor/hasselblad.rs`): uncompressed (X1D, X1D II, X2D, CFV 100C) and Hasselblad's lossless JPEG with scan selection value 8 (every FFF; H3D, H4D and CFV-50c 3FR), `ljpeg::decode_hasselblad`, its rule measured on 14 CC0 files with the ljpeg-explorer tool, Minolta / Konica Minolta MRW (the `\0MRM` block container: `PRD` sensor size, 12-bit packed or 16-bit-word storage and the RGGB / GBRG cell, `WBG` gains in cell order, the `TTW` TIFF for Exif and orientation, black 0 and white from the saturation plateau; `crates/raw/src/vendor/mrw.rs`, DiMAGE 7, 7Hi, A1, A2, A200 and Dynax / Maxxum 7D checked on CC0 files against their previews), Samsung SRW without compression (NX5, NX10, NX11 and the NX20-generation bodies NX20, NX200, NX210, NX1000 and NX1100 as 12-bit packed samples in either bit order, EX1 and WB2000 as 16-bit words; layout, camera-JPEG framing, levels and white balance from the maker note, `crates/raw/src/vendor/srw.rs`; median ΔE vs the camera JPEG 2.2–7.6 on 11 of the 12 files from 10 bodies checked, 10.7 (5.7 registered) on the backlit WB2000 sample). 12-bit NEF black level: maker note `0x003d` is in 14-bit units (D750, D780, D850, D7500, Z 50 checked). Lossy type 2 NEF curves of version `0x44 0x40` (D780, D6, Z 5, Z 6, Z 7, Z 7_2) span a quarter of the sample range, read from the table's own point spacing. Import probes (`probe_info`) of compressed NEFs decode only the first 128 rows, the ones the masked-trailing-column test reads in both the probe and the full decode (the D5100 and D7000 write 8 masked columns at 0 with no maker-note tag for them, compressed and uncompressed alike), instead of the whole Huffman stream: ~3 ms instead of the full decode time per file (386 ms on a 24 MP D750 file), issue #708. CR3 lossless CRX Bayer and version 0x100/0x200 C-RAW decodes to sensor pixels with timed white balance, black/white levels and file crop (EOS R6 Mark III `ColorData` version 66: as-shot white balance and black level from the file, white level from the data, `docs/cr3.md`) (the shot's aspect ratio from the maker note's `AspectInfo`); full sensor samples match the reference on M50/R100/R8/RP, incl. RP 1.6× crop mode (`crates/raw/tests/it/cr3_corpus.rs`, `docs/cr3.md`). EOS R5 Mark II C-RAW and RAW decode too (the QP map's first-symbol literal and 23-zero escape, odd-height Bayer planes): 4 CC0 files pinned, every QP map of 33,665 private C-RAW files decodes exactly, and full-frame images match the camera JPEG. Unsupported coding variants retain metadata and use the embedded JPEG when available; HEVC preview decoding remains unsupported. Missing: CR3 unverified CRX variants, compressed ORF, compressed Samsung SRW (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini: preview only with the reason), Nikon High Efficiency NEF (HE / HE★ from the Z 8, Z 9, Z 6III and Z f: compression 34713 with a JPEG XS codestream and no `0x0096` table; no public specification, so preview only with the reason "Nikon High Efficiency NEF", issue #193; Lossless compressed NEFs from the same bodies decode), NEF "lossy after split" (preview only: imported with `preview_only` = the decoder's reason, rendered as a rendered JPEG, flagged by a grid badge and loupe/Edit/Info notices, `previewOnly` in `catalog.query`; Reload clears it once the file decodes, and the notices carry a Reload from Disk button; each flag is stamped with the app version that set it, and a library opened in another version rechecks its preview-only raws in the background, so a raw a newer release decodes is cleared without a manual Reload, issue #662, `library.recheckPreviewOnly`), TIFF-based raws whose raw data sits in a private block (Phase One / Leaf IIQ, Canon EOS-1D / 1Ds and the Kodak DCS Pro / DCS760C TIFFs (compression 65000): IFD0 is only a reduced RGB image next to a much larger declared picture) are recognised from that structure and import as `preview_only` with the reason, instead of opening as a thumbnail-sized ordinary image (`thumbnail_shell` in `crates/raw/src/lib.rs`), Recognised raws LightCraft cannot decode open as `preview_only` with any usable embedded JPEG, also Canon CRW and Sigma X3F (containers recognised by magic, preview found by a structural JPEG scan), Kodak KDC (IFD0 without `ImageWidth`), Leaf MOS and Epson ERF (scan; ones with no JPEG still fail with "without an embedded preview", AVIF decode (HEIC decodes only behind the non-default `heif` feature, which the release packages enable: `crates/heif`, heic-rs for the container and HEVC (bit-exact against libde265 on iPhone tiles) plus our own colour conversion, matching libheif within 1 code value on iPhone-style grids (VUI full range, Display P3 ICC, nclx, 10-bit, irot/imir/clap, gain map/depth ignored); 4:2:0/monochrome only, 4:2:2/4:4:4 Canon/Sony HIF refused; same policy as PhotoCraft), palette (indexed-colour) TIFF (refused by the `tiff` crate); folder discovery and file pickers include Sony SR2 and SRF, with the same extension list used by CLI/MCP: DSC-R1 SR2 decodes from sensor data; DSC-F828 SRF stays preview-only; transparency is flattened onto white, in linear light, where the working image is built (`to_working` in `crates/codecs/src/lib.rs`): renders, previews, exports and contact sheets no longer turn transparent areas black, issue #1212; median ΔE vs the camera JPEG 2.2–7.6 on 11 of the 12 files from 10 bodies checked, 10.7 (5.7 registered) on the backlit WB2000 sample). 12-bit NEF black level: maker note `0x003d` is in 14-bit units (D750, D780, D850, D7500, Z 50 checked). Lossy type 2 NEF curves of version `0x44 0x40` (D780, D6, Z 5, Z 6, Z 7, Z 7_2) span a quarter of the sample range, read from the table's own point spacing. Import probes (`probe_info`) of compressed NEFs decode only the first 128 rows, the ones the masked-trailing-column test reads in both the probe and the full decode (the D5100 and D7000 write 8 masked columns at 0 with no maker-note tag for them, compressed and uncompressed alike), instead of the whole Huffman stream: ~3 ms instead of the full decode time per file (386 ms on a 24 MP D750 file), issue #708. CR3 lossless CRX Bayer and version 0x100/0x200 C-RAW decodes to sensor pixels with timed white balance, black/white levels and file crop (the shot's aspect ratio from the maker note's `AspectInfo`); the Hasselblad Lunar, a Sony NEX-7 under Make HASSELBLAD, decodes as an ARW: a HASSELBLAD file with Sony's raw coding (compression 32767 or tag `0x7010`) goes to the ARW reader, and the body for its `Tag2010` layout comes from the maker note's `SonyModelID`, checked on the CC0 4051 file, issue #1275; an uncompressed MOS, whose IFD0 is the 16-bit mosaic with no Make tag, is recognised by Leaf's data block `0x8606` instead of opening as a greyscale image of its mosaic, issue #1275), and any decode failure of a recognised raw, not only an unsupported variant Nikon 12-bit small RAW (D810 / D4S): packed Y0/Y1/Cb/Cr rows decode to linear RGB; header probes retain geometry without decoding pixels, and truncated strips are refused. Chroma gains are approximate. |-| LR-IMP-CAMERA-COVERAGE | Camera coverage, verified per model | P0 | 🟡 | `crates/raw/tests/it/corpus.rs`, `crates/raw/tests/it/coverage_sweep_corpus.rs`, `docs/raw/evidence.tsv`, `docs/raw/coverage-sweep.tsv`, `xtask/src/main.rs` | a supported container is not the same as every camera that writes it decoding correctly: ~55 CC0 corpus files plus 6 exact-sensor CR3 cases and 4 pinned EOS R5 Mark II files (plus ~60 NEFs checked by hand and 178 Panasonic / Leica RW2, RWL and RAW files from 118 bodies, checked against each file's own JPEG) against the >1,000 models Lightroom lists; per-model differences still surface (e.g. the CR2 colour-filter layout differed by model until it was read from the file's own tag, issue #85, checked on 35 CR2 bodies; CR2 black levels were read from border columns light already reaches, left of `SensorInfo`'s border, so CR2s rendered dark with crushed shadows (EOS 6D: 2591 instead of 2047), now measured from the masked columns only, checked on 8 corpus bodies; pre-2017 Sony ARWs opened green until their scrambled white balance / black level were read, issue #148, checked on 16 ARWs from 15 Sony bodies; their white balance now comes from the encrypted `SR2SubIFD`'s `WB_RGGBLevels`, the gains the camera applied, which 14 bodies (DSLR-A450 … A700, NEX-3/5/C3, SLT-A33/A35/A55, ILCE-6001, UMC-R10C) had no other source for and which the maker-note estimate read before missed by up to 100 % on preset shots, issue #535, checked against ExifTool on 100 decoded ARWs from 87 Sony bodies; the encrypted SR2 black level is now read from its directory entry (the DSLR-A450/A500/A550/A700 read 354–975 instead of 512), checked on 126 ARWs from 97 Sony bodies, and downsized lossless M/S ARWs use their measured black level 1024 instead of 512, checked on 12 files from 4 bodies, issue #535, and on a fifth, the ILCE-7CM2 (issue #697: 0.5.0 rendered its lossless M file with that 512 pedestal, the darkest half of a dusk scene +11 L* and blue, the lamplight white; its darkest 0.1 % per channel sits at 1017/1020/1024, and with 1024 the render is within +3 L* of the camera JPEG; the body's compressed and uncompressed "M-size" files are Bayer at 4736×3132 with black 512, two public ones in the corpus); pre-2017 Sony bodies shot in the camera's 16:9 mode (ILCE-7SM2, DSLR-A580) now get the 16:9 crop of their camera JPEG instead of the whole 3:2 frame with padding columns, issue #535; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked; private Z 8 crop verified; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone); the D7100, whose data holds picture beyond the camera's frame, develops at Lightroom's frame (the camera JPEG's size) in full frame and 1.3x crop, so Lightroom crops line up (#1248).; CR2 white levels came from masked rows holding samples at 16383, so on the EOS 50D, 60D, 450D (Rebel XSi), 500D (Rebel T1i), 550D (Rebel T2i), 1200D (Rebel T5) and 100D (Rebel SL1) clipped highlights sat at 81–98% of the range and were not treated as clipped, now taken from the active area only, issue #1272). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). ILCE-7RM6 ARW6 12-bit codes verified on 8 CC0 files (FF and APS-C, both compression modes). Sony ILCE-7CR (61 MP): lossless compressed L and M and compressed ARW2 samples of one scene in the corpus (black level, default crop, as-shot gains, lossless vs compressed mosaic agreement, fitted camera look), and all nine public codings (also uncompressed, small and APS-C crop) decode and fit. Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). Pentax PEFs without area tags (KP, KF, K-3 Mark III, K-70, K-1, K-1 Mark II, K-S1, K-S2, 645Z) no longer keep their masked border: black, empty and saturated lines are trimmed against the maker-note BlackPoint, issue #1271, measured on 38 CC0 PEFs from 30 bodies.; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). ILCE-7RM6 ARW6 12-bit codes verified on 8 CC0 files (FF and APS-C, both compression modes). Sony ILCE-7CR (61 MP): lossless compressed L and M and compressed ARW2 samples of one scene in the corpus (black level, default crop, as-shot gains, lossless vs compressed mosaic agreement, fitted camera look), and all nine public codings (also uncompressed, small and APS-C crop) decode and fit. Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). The Canon PowerShot G9, which writes no `ColorData`, takes its as-shot white balance from the WBInfo row (`0x0029`) of the preset ShotInfo names, issue #1273, checked on 1 CC0 file against neutral areas of the camera JPEG (within 0.1 %).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). The Olympus E-10 (no ImageProcessing directory) takes its as-shot gains and its black level (`0x1012` in `0x102c` ValidBits units: 128 at 12 bits) from the main maker note, issue #1273: its render against the camera thumbnail goes from ΔE76 18.5 with a rejected fit to 11.5 with the fit accepted (measured by AlexChambers).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone), and the Nikon D90 likewise on 10 of 550 NEFs (42 filler columns on the right that developed as a pink band; green clips below red and blue).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). Public raw.pixls.us coverage sweep (#1327): 30 more models verified on 40 CC0 files, with SHA-256 and FNV-1a sensor hashes pinned (`crates/raw/tests/it/coverage_sweep_corpus.rs`, `docs/raw/coverage-sweep.tsv`; `docs/raw/coverage.py`: 515 → 545 verified rows). Render/reference luminance correlation is 0.6801 to 0.9998; eleven candidates excluded for identity, provenance or missing/mismatched reference images. Nikon D6 / Z 6 / Z 7 uncompressed and Z 8 HE variants remain preview-only. Own-matrix DNG tone differs from the camera JPEG (#1277); sensor verification is not colour calibration. |+| LR-IMP-CAMERA-COVERAGE | Camera coverage, verified per model | P0 | 🟡 | `crates/raw/tests/it/corpus.rs`, `crates/raw/tests/it/coverage_sweep_corpus.rs`, `docs/raw/evidence.tsv`, `docs/raw/coverage-sweep.tsv`, `xtask/src/main.rs` | a supported container is not the same as every camera that writes it decoding correctly: ~55 CC0 corpus files plus 6 exact-sensor CR3 cases and 4 pinned EOS R5 Mark II files (plus ~60 NEFs checked by hand and 178 Panasonic / Leica RW2, RWL and RAW files from 118 bodies, checked against each file's own JPEG) against the >1,000 models Lightroom lists; per-model differences still surface (e.g. the CR2 colour-filter layout differed by model until it was read from the file's own tag, issue #85, checked on 35 CR2 bodies; CR2 black levels were read from border columns light already reaches, left of `SensorInfo`'s border, so CR2s rendered dark with crushed shadows (EOS 6D: 2591 instead of 2047), now measured from the masked columns only, checked on 8 corpus bodies; pre-2017 Sony ARWs opened green until their scrambled white balance / black level were read, issue #148, checked on 16 ARWs from 15 Sony bodies; their white balance now comes from the encrypted `SR2SubIFD`'s `WB_RGGBLevels`, the gains the camera applied, which 14 bodies (DSLR-A450 … A700, NEX-3/5/C3, SLT-A33/A35/A55, ILCE-6001, UMC-R10C) had no other source for and which the maker-note estimate read before missed by up to 100 % on preset shots, issue #535, checked against ExifTool on 100 decoded ARWs from 87 Sony bodies; the encrypted SR2 black level is now read from its directory entry (the DSLR-A450/A500/A550/A700 read 354–975 instead of 512), checked on 126 ARWs from 97 Sony bodies, and downsized lossless M/S ARWs use their measured black level 1024 instead of 512, checked on 12 files from 4 bodies, issue #535, and on a fifth, the ILCE-7CM2 (issue #697: 0.5.0 rendered its lossless M file with that 512 pedestal, the darkest half of a dusk scene +11 L* and blue, the lamplight white; its darkest 0.1 % per channel sits at 1017/1020/1024, and with 1024 the render is within +3 L* of the camera JPEG; the body's compressed and uncompressed "M-size" files are Bayer at 4736×3132 with black 512, two public ones in the corpus); pre-2017 Sony bodies shot in the camera's 16:9 mode (ILCE-7SM2, DSLR-A580) now get the 16:9 crop of their camera JPEG instead of the whole 3:2 frame with padding columns, issue #535; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked; private Z 8 crop verified; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone); the D7100, whose data holds picture beyond the camera's frame, develops at Lightroom's frame (the camera JPEG's size) in full frame and 1.3x crop, so Lightroom crops line up (#1248).; CR2 white levels came from masked rows holding samples at 16383, so on the EOS 50D, 60D, 450D (Rebel XSi), 500D (Rebel T1i), 550D (Rebel T2i), 1200D (Rebel T5) and 100D (Rebel SL1) clipped highlights sat at 81–98% of the range and were not treated as clipped, now taken from the active area only, issue #1272). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). ILCE-7RM6 ARW6 12-bit codes verified on 8 CC0 files (FF and APS-C, both compression modes). Sony ILCE-7CR (61 MP): lossless compressed L and M and compressed ARW2 samples of one scene in the corpus (black level, default crop, as-shot gains, lossless vs compressed mosaic agreement, fitted camera look), and all nine public codings (also uncompressed, small and APS-C crop) decode and fit. Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). Pentax PEFs without area tags (KP, KF, K-3 Mark III, K-70, K-1, K-1 Mark II, K-S1, K-S2, 645Z) no longer keep their masked border: black, empty and saturated lines are trimmed against the maker-note BlackPoint, issue #1271, measured on 38 CC0 PEFs from 30 bodies.; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). ILCE-7RM6 ARW6 12-bit codes verified on 8 CC0 files (FF and APS-C, both compression modes). Sony ILCE-7CR (61 MP): lossless compressed L and M and compressed ARW2 samples of one scene in the corpus (black level, default crop, as-shot gains, lossless vs compressed mosaic agreement, fitted camera look), and all nine public codings (also uncompressed, small and APS-C crop) decode and fit. Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). The Canon PowerShot G9, which writes no `ColorData`, takes its as-shot white balance from the WBInfo row (`0x0029`) of the preset ShotInfo names, issue #1273, checked on 1 CC0 file against neutral areas of the camera JPEG (within 0.1 %).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). The Olympus E-10 (no ImageProcessing directory) takes its as-shot gains and its black level (`0x1012` in `0x102c` ValidBits units: 128 at 12 bits) from the main maker note, issue #1273: its render against the camera thumbnail goes from ΔE76 18.5 with a rejected fit to 11.5 with the fit accepted (measured by AlexChambers).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone), and the Nikon D90 likewise on 10 of 550 NEFs (42 filler columns on the right that developed as a pink band; green clips below red and blue).; the Nikon D4, which records no CropArea, gets its image area and white level measured on 148 NEFs against the camera JPEG (optical-black stripes and magenta clipped highlights gone). Public raw.pixls.us coverage sweep (#1327): 30 more models verified on 40 CC0 files, with SHA-256 and FNV-1a sensor hashes pinned (`crates/raw/tests/it/coverage_sweep_corpus.rs`, `docs/raw/coverage-sweep.tsv`; `docs/raw/coverage.py`: 515 → 545 verified rows). Render/reference luminance correlation is 0.6801 to 0.9998; eleven candidates excluded for identity, provenance or missing/mismatched reference images. Nikon D6 / Z 6 / Z 7 uncompressed and Z 8 HE variants remain preview-only. Own-matrix DNG tone differs from the camera JPEG (#1277); sensor verification is not colour calibration. Canon CR3 `ColorData` white levels below the sensor's saturation point (EOS RP 14558 under a pile-up at 16383, R100 at ISO 640 10439 under 13300–13700) rise to the data's pile-up when the samples run past them, the change kept in the baseline exposure and out of the camera-look fit, issue #2053, checked on 35 CC0 CR3s from 26 bodies and 966 private EOS RP files. | | LR-IMP-PREVIEW-READ | Preview reads the header, not the raw | P0 | ✅ | `crates/raw/src/preview.rs` (`bounded_preview`, `embedded_preview_from_range`, `embedded_preview_covering`), `crates/engine/src/files.rs` (`preview_window`), `docs/raw-preview-reads.md`, `crates/engine/src/files.rs` (`preview_window`, `planned_preview`), `crates/raw/src/sparse.rs` (`preview_plan`), `crates/raw/src/dng.rs` (`decode_reduced`) | a grid thumbnail and a loupe preview of an unedited raw show the camera's embedded JPEG, which sits near the start of the file (a 24 MP Fuji RAF keeps its 5.6 MB JPEG in a 56 MB file), so the preview loader reads the header and that JPEG instead of the whole file: 56.5 MB → 5.9 MB and ~10 s → 0.96 s measured on one real RAF over a GVFS/SMB Wi-Fi share (byte-identical preview pixels; `LIGHTCRAFT_PROFILE=1` reports the bytes); the RAF pointer is read from its fixed header fields, a CR3's boxes and a TIFF raw whose preview tag sits past the prefix are read through `lightcraft_raw::sparse::preview_plan`, which names the ranges `embedded_preview` reads and nothing else; a cached render as stand-in, an edited photo and a raw without an embedded JPEG still render; the formats it cannot describe (CRW/MRW/X3F are found by scanning, NEF/ORF/PEF probe from samples) keep the whole-file path, and a lying pointer, a short read or a file that changes underneath us falls back to it rather than losing the preview. An unedited raw's **grid thumbnail is that camera JPEG itself**, so no sensor decode is scheduled behind it (`Session::embedded_thumb_is_final`, `grid::skips_the_real_render`): drawing a 512 px thumbnail used to decode the whole raw — 45 s a photo at 1.2 MB/s, 8.3 GB for a 149-raw folder — and the queue it built delayed the render the user was waiting for. Stand-ins and grid thumbnails decode the smallest embedded JPEG that covers the requested size and is a copy of the largest (aspect ratio within 1 %, same component count), not always the largest, on the whole-file and the plan route alike: an A7R VI's 1616 × 1080 JPEG (0.3 MB) instead of its 9984 × 6656 one (5.6 MB), and mid-sized NEF / RW2 JPEGs; a DNG that keeps reduced-resolution copies of its LinearRaw image (Lightroom HDR/panorama merges) develops a thumbnail or preview from the smallest copy that covers it (512 px of a 23836 × 7078 pano: 38 s → 1.1 s) | | LR-IMP-CULL-AT-IMPORT | Culling analysis at import | P2 | 🟡 | `cmd:photo.analyze` | run Assisted Culling on the imported photos (they're selected after an import); not automatic | | LR-IMP-MOVE | Move on import [Classic] | P1 | ✅ | `cmd:library.import` (`mode` move), `crates/engine/src/import_move.rs`, `crates/engine/src/tests_import_move.rs`, `crates/ui-egui/src/import.rs` | Transfer ▸ Move with Copy's destination, folders (day / month / one folder / custom template), rename template and example destination; XMP sidecars (both namings) move along; each source is removed only after its destination is written (hard link on the same volume, else copied, synced and compared byte for byte) and its catalog record is saved; failed, duplicate, unchecked files keep their sources, taken names get -1, -2…, never overwritten; files already in the destination/library are added in place; sources that can't be removed (read-only card) are kept and reported (`kept`). Undo removes the photos from the library but leaves the moved files at the destination. No Copy as DNG while moving |@@ -959,3 +959,4 @@ Latin stays upright. Advanced Japanese composition remains open. Regression cove | 2026-10-23 | patch | LR-BEHAV-ACCESS: the name field of New Album, New Smart Album, Rename and the other one-field dialogs takes the keyboard focus once when the dialog opens instead of every frame, so Tab and Shift+Tab reach the check box, Cancel and OK; status unchanged (🟡) | | 2026-10-22 | minor | LR-CROP-AUTO: Auto straighten turns by at most 10° and only on at least 3 agreeing lines, and says when it finds nothing to level by; measured on 68 photos straightened by hand and 300 left as shot, unwanted turns of more than 1° fell from 79 to 19 of the 300. Downgraded ✅ → 🟡: it still leaves most tilted photos alone | | 2026-10-23 | patch | LRC-LIB-FILTERBAR: showing an album (`library.source`) while the filter holds an album drops the filter's album, as showing a library folder already dropped its folder filter; before, the old album stayed in the filter unseen (the filter bar has no album chip) and narrowed the next source such as All Photos; the row's note says so; status unchanged (✅) |+| 2026-10-26 | patch | LR-IMP-CAMERA-COVERAGE: Canon CR3 white level at the sensor's saturation point when the data runs past `ColorData`'s (EOS RP, R100, #2053); status unchanged (🟡) |diff --git a/docs/raw-parity.md b/docs/raw-parity.md--- a/docs/raw-parity.md+++ b/docs/raw-parity.md@@ -1,6 +1,6 @@ # RAW parity: cameras, formats, demosaic, colour and lens profiles -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (Minolta MRW decoded, 6 bodies verified; lossy JPEG XL DNG tiles with a non-linear declared transfer curve decode; Canon ColorData Kelvin; X-Trans CMOS 4 bodies take the X-T3's spectral matrices) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6 (Camera Raw 18.7)+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** patch (CR3 white level at the sensor's saturation point, #2053; earlier: Minolta MRW decoded, 6 bodies verified; lossy JPEG XL DNG tiles with a non-linear declared transfer curve decode; Canon ColorData Kelvin; X-Trans CMOS 4 bodies take the X-T3's spectral matrices) · **Target:** Adobe Lightroom Classic 15.5 / Lightroom 9.6 (Camera Raw 18.7)  Raw processing is the deepest single dimension of Lightroom parity: a photographer whose camera does not decode, or decodes with the wrong colour, cannot switch. This document measures it model by@@ -199,7 +199,7 @@ sample files. A pointer for contributors, not legal advice. | Foveon | ✅ (older bodies) | — | ⬜ | | Monochrome / LinearRaw | ✅ | handled, no demosaic | ✅ | | Pixel shift (Sony ARQ, Pentax, OM high-res, Nikon) | ✅ (Sony, Pentax, Nikon) | — | ⬜ |-| Black and white levels | per model, calibrated | read from each file (masked columns, maker notes, SR2SubIFD, CMP1) | 🟡 per-body bugs keep surfacing: A450–A700 SR2 black level and M/S ARW pedestal (#535, fixed); 5D Mark IV CR2 renders dark (#455, open); white-level pile-up in phone DNGs (#548, fixed); CR2 white level taken from saturated masked rows (#1272, fixed) |+| Black and white levels | per model, calibrated | read from each file (masked columns, maker notes, SR2SubIFD, CMP1) | 🟡 per-body bugs keep surfacing: A450–A700 SR2 black level and M/S ARW pedestal (#535, fixed); 5D Mark IV CR2 renders dark (#455, open); white-level pile-up in phone DNGs (#548, fixed); CR2 white level taken from saturated masked rows (#1272, fixed); CR3 `ColorData` white level below the sensor's saturation point, EOS RP and R100 (#2053, fixed) | | Crop masks and aspect | ✅ | DefaultCrop, Sony recorded size, Canon AspectInfo, Panasonic in-camera crops, Nikon CropArea | 🟡 7RM3 / 7RM4 crop origin 8–32 px off (cosmetic) | | Black and white levels | per model, calibrated | read from each file (masked columns, maker notes, SR2SubIFD, CMP1) | 🟡 per-body bugs keep surfacing: A450–A700 SR2 black level and M/S ARW pedestal (#535, fixed); 5D Mark IV CR2 renders dark (#455, open); white-level pile-up in phone DNGs (#548, fixed) | | Crop masks and aspect | ✅ | DefaultCrop, Sony recorded size, Canon AspectInfo, Panasonic in-camera crops, Nikon CropArea, measured Nikon bodies without it (D4, D90, D5000, D600, D610) | 🟡 7RM3 / 7RM4 crop origin 8–32 px off (cosmetic) |@@ -328,3 +328,4 @@ Beyond decoding: | 2026-10-14 | minor | Integration batch 36: CC0 per-model verification for 117 Nikon/Fujifilm, 97 Canon CR2/Pentax/Ricoh, 21 Sony/Leica and 23 Olympus/Samsung bodies, 22 more CR3 bodies and 30 more models; Epson ERF and Mamiya MEF decode; measured Nikon image areas (#1053, #1770): 515 verified, 675 unverified, 218 preview, 38 unsupported (re-measured with `coverage.py`) | | 2026-10-15 | minor | By-maker and by-use tables re-measured with `coverage.py` after batches 36–39 (545 verified, 651 unverified, 212 preview, 38 unsupported; ~94% of photographers' cameras fully work, ~85% on a verified body); rows the per-model PRs had updated are current again | | 2026-10-18 | minor | Minolta MRW decoded (`vendor/mrw.rs`): DiMAGE 7, 7Hi, A1, A2, A200 and Dynax / Maxxum 7D verified; 551 verified, 656 unverified, 201 preview (re-measured with `coverage.py`) |+| 2026-10-26 | patch | CR3 white level at the sensor's saturation point when the data runs past `ColorData`'s (EOS RP 14558 → 16319–16320, R100 at ISO 640 10439 → 13322; #2053); scores unchanged |diff --git a/docs/whats-new.md b/docs/whats-new.md--- a/docs/whats-new.md+++ b/docs/whats-new.md@@ -1,5 +1,13 @@ # What's new in LightCraft +## 2026-10-25++### Canon CR3 highlights keep their colour+- Canon CR3 raws whose bright areas (a backlit sky, sunlit clouds) were just under the sensor's limit no longer+  show a hard-edged pale band or ring where the brightness crosses the level Canon's file states: the EOS RP states+  a clipping point about 0.2 EV below where its sensor really clips, the EOS R100 at ISO 640 about 0.4 EV. That range+  is now kept as real light, so Highlights can bring it back. Everything darker renders as before.+ ## 2026-10-24  ### Relative-date filters and smart albums follow the clock