4.7 The metadata harness
Color operations change what pixels mean, so they must also change what the metadata says — automatically, or the two drift apart. The harness wraps every color-aware operation and classifies what the operation can honestly claim about its output: Known (a named target: stamp the verdict, scrub stale provenance, maintain the cheap current-state descriptors), Preserved (space-preserving: everything passes through), or Unknowable (an arbitrary LUT: erase the verdict and descriptors — absence means “could not determine,” never a guess).
The scrub follows a two-bucket rule. Facts a file deposited about the source (colorInteropID, CICP, ICC, chromaticities, gamma) no longer describe the buffer after a known color change — they scrub. Descriptors of the buffer’s current state (encoding, image state, range) are updated or erased, never left stale. Only cheap descriptors are maintained per-operation; expensive color-space properties derive at write-planning time. And one honest boundary: automatic tracking is a convenience, not a contract — best-effort maintenance, with gaps documented rather than promised away. In the demo this is the color_operation(spec, kind) context manager.