The unfiltered original must never be written
the problem
The natural implementation saves the photo, then processes it. That leaves the original on disk, where a gallery scanner or a cloud backup can pick it up before it is replaced.
what I did
Processing happens on the in-memory frame before anything is persisted, so the only file that ever exists on disk is the filtered one.
