Apple Vision Image Pipeline

Build one bounded path from bytes to validated pixels and evidence. Treat input, metadata, OCR, and labels as untrusted.

Decide the contract

Identify every ingress, accepted format, byte/pixel/frame limit, orientation/color convention, concurrency policy, retained evidence, metadata policy, and fallback. Files and clipboard data must share the decoder and validation policy.

Preserve these invariants

1. Inspect type, count, dimensions, and overflow before full decode; verify decoded dimensions afterward.
2. Bound accumulated bytes, pixels, and concurrent memory; downsample when full resolution is unnecessary.
3. Apply orientation once: either pass source orientation to Vision or render upright pixels and use .up.
4. Preserve or deliberately convert color; successful encoding alone proves no fidelity.
5. Give one owner admission, cancellation, and stale-result rejection.
6. Keep OCR candidates/confidence/regions and classifier scores as evidence. Deterministic policy owns thresholds, unknowns, and actions.
7. Check ImageIO creation/finalization, then reopen and validate output.
8. Do not log pixels, OCR, clipboard contents, paths, or metadata. Copy only allowlisted metadata.