A repetitive human visual judgment, expanding, removing, or modifying specific pixel regions by eye, needed to become a reliable automated system. A false positive, a pixel changed that should have been left alone, is treated as more serious than a hard image sent to a person for review. Reliability is the top priority, above throughput and above coverage.
The stated ask is automate the edit, and the reflex is to add a model or grow a mask by a fixed amount. The real problem is the negative guarantee: proving which pixels must never change, on every image. That is a different question from which pixels should change, and no amount of detector accuracy answers it, because a detector describes what it found rather than what it promises not to touch.
The reflex, and the fix.
Add a model and dilate the mask
Fast to demonstrate, and it looks correct on most images.
A fixed dilation crosses protected boundaries, and a model alone can only report confidence. Neither can promise that a protected pixel was untouched.
Separate detection from modification, then prove the negative
A dual-mask architecture, boundary-aware expansion, deterministic rules over the model output, and a pixel-level regression harness as part of the product.
A demonstrable zero unexpected changes on protected pixels, per image, with hard cases routed to a person.
Prove the negative, because that is what the operator was actually guaranteeing by eye.
Surface versus hidden reality
The identify then modify then preserve chain explodes into the eight implicit judgments an operator makes at once. Detection is separated from modification by a dual-mask architecture: a candidate mask and a protected mask feeding a decision mask.
Expansion that cannot cross a boundary
Boundary-aware expansion grows the region where it is safe and clips cleanly against an explicit protected mask, with the guarantee that the count of unexpected changes is zero, demonstrated per image rather than asserted.
A hybrid pipeline instead of blindly adding a model
The model is demoted to a candidate detector, deterministic rules enforce the exact pixel constraints, and validation decides safety. The model earns its place through measured reliability rather than a demonstration.
Integration designed around the engine
Four integration architectures were considered, native, plugin plus engine, hybrid, and headless, and the choice was made for reliability and testability rather than for convenience.
A pixel-level regression harness
An automated release gate: build, run the corpus, diff, check protected and expected and performance, pass or fail. Plus a closed production feedback loop from edge case to root cause to corpus to fix to verify.
A single headline number hides where a system fails. This work was scored on the dimensions that actually decide whether it holds in production, measured on real, held-out cases rather than the demo path.
A system that is right most of the time, cannot say which pixels it promises not to touch, and puts the burden of catching its mistakes back on the person it was supposed to relieve.
A pipeline that guarantees zero unexpected changes on protected pixels and demonstrates it per image, routes hard cases to a person, and gates every change through a regression harness that is part of the product rather than an afterthought.
What it owns, and what it hands to a person.
The guarantee is about protected pixels, not about perfect detection. Hard images are routed to a person by design, and the corpus has to grow as new edge cases arrive, which is why the feedback loop is part of the architecture rather than a process document.
Where the cost of a wrong action exceeds the cost of asking a person, the deliverable is the negative guarantee rather than the positive capability. Separate detection from modification, enforce the constraint deterministically, and make the regression harness part of what ships.