1. The highway model

Think of color information moving through a pipeline as traffic on a highway:

The highway model: two lanes, ramps, a merge rule, and hazard signage

• The inner lane is the active config’s color space — the verdict (oiio:ColorSpace). What the pixels mean right now, in terms of the active config. Fast, local, authoritative for everything happening in this process. Every color operation drives in this lane.
• The middle lane is colorInteropID — the interchange lane. It exists so a vehicle can change highways (configs, applications, facilities) without losing its identity. You merge into it to cross a boundary; you merge out of it into some config’s inner lane on the other side.
• The on-ramps, off-ramps, and merge lanes are the format metadata — CICP, ICC, chromaticities, gamma tags, container flags. Each format has its own ramp geometry: PNG’s cICP chunk, EXR’s attribute block, TIFF’s tags. Information enters the highway from files through these ramps on read, and exits through them on write.
• The priority list is the merge rule — when several ramps feed the same junction and disagree, one ordered rule decides who yields. Nobody improvises at the junction; that’s how collisions (silently wrong color) happen today.
• The metadata harness is lane discipline — after every maneuver (every color operation), signage gets updated: the verdict restamped, stale ramp-signs removed, current-state descriptors refreshed. Automatic, so no one drives with last exit’s signs.
• Never-guess is the no-phantom-vehicles rule — if identity can’t be determined, the lane is left empty and marked, never filled with a plausible-looking guess.
• Policy is the local traffic ordinance — the config author (the authority who actually knows this stretch of road) can post rules: which signs get written at which off-ramps, which ramps to trust. Defaults follow the Forum’s ordinance; deviation is declared, not improvised.

Why the metaphor earns its keep: it makes two central design facts intuitive. (1) The inner lane and the middle lane are different lanes — a process-local verdict and an interchange identity are related, but never conflated, which is why they are separate attributes with separate lifecycles. (2) Ramps are format-specific but the highway is central — format plugins keep their ramp geometry, while merging logic lives in exactly one place.