Two layers
The pipeline produces clean outputs: composed, colour-normalized, encoded once per rendition. Delivery composes the watermark policy on top of those and caches the result at the edge. The two are versioned separately: pipeline rev 6 and watermark rev 3 can both be in play for one Photo.
What a rollout does
- Renders each live rendition with the new policy, oldest live first.
- Swaps the edge cache atomically per rendition so a URL never serves a half-updated set.
- Records the revision on every affected publication so you can see which rev a URL is answering with.
Publishing and replacing live selections pause while a rollout is preparing. Uploads, pipeline runs and review continue. Withdrawal and deletion are never blocked.
Cost
A rollout counts against processing allowance once per live rendition. It does not count pipeline steps, because none run. On the reference project (7 Photos, 6 renditions each) a rollout is 42 renders.