I’ve edited photos for years, across four different tools — RawTherapee, Lightroom, Luminar, Darktable. All of them do “non-destructive” editing, which is a genuinely good idea: you never touch the original file. You record your edits separately, as a set of instructions, and the software replays them on top of the untouched original every time you open it.

If that sounds familiar, it should. It’s the same idea I trust in data systems — keep the source immutable, log the transformations, rebuild the result on demand. Event sourcing, basically, for pictures. Which is exactly why the way it failed me is worth writing down.

The catch I only saw looking back

I have the same photos edited four different ways, in four incompatible formats, and most of that history I can no longer replay outside the exact tool that created it.

The originals are fine — that’s the part non-destructive editing actually promises, and it delivered. But my edits — a decade of actual decisions about these images — are scattered across four tools and a pile of catalog migrations, and only some of them are still legible to me. “Non-destructive” turned out to be a promise about the original file and nothing else.

The hero: a log you can read

RawTherapee writes its edits to a little sidecar file that sits right next to the photo. It’s plain text. You open it in any text editor and you can read every decision — the white balance temperature, the tone curve, the highlight-recovery method, the sharpening, the working color profile. Every knob, recorded in the open.

That file is the event-sourced ideal. It’s human-readable. You can diff two versions of it and see exactly what changed between edits. You can replay it in a batch from the command line without ever opening the GUI. And the original never moved. A portable, legible, replayable log of transformations — that’s the whole dream, sitting in a text file.

The cautionary tale: a log you can’t

Lightroom is also non-destructive. The edits are just as real, and the original is just as untouched. But the edits live inside a proprietary database, not next to the file — and you can only replay them inside Adobe’s software.

The log exists. You simply can’t read it, or move it, or replay it anywhere else. And it gets worse over time: my catalogs are organized by year, and every one carries migration suffixes — v10, v11, v12 — because each upgrade migrates the database schema. My edit history is a database that’s been migrated a dozen times and is legible to exactly one vendor’s app. The day I can’t run that app is the day that history is gone, originals notwithstanding.

The lesson is about the log, not the original

Here’s the distinction I’d missed. “Non-destructive” is a promise about the original: we won’t alter your file. That’s valuable and both tools kept it. But it says nothing about a completely separate property — whether you can still read and replay the log in ten years, move it to another tool, or understand it without the software that wrote it.

Portability of the log is its own thing, and it’s the one that quietly decides whether your history survives. A rich edit history trapped in a black-box database is worth less than a plain one you can read with a text editor, because the plain one will outlive the tool.

This is the exact trap in data work, and I’ve watched it there too. An event log or an audit trail is only worth something if you can replay it — and if the only thing that can replay it is the proprietary system that wrote it, you don’t have a portable history. You have a hostage. The plain-text sidecar is an open format; the proprietary catalog is lock-in sold as a feature. It’s the same choice as an open table format versus a warehouse you can’t export from, and it ends the same way.

Keep the original — but keep the log legible

So I’ve added a second half to the rule. Keeping the original immutable is necessary and not sufficient. Also keep the log in something you can read without the app — declarative, human-legible text you can diff, replay, and move. A history you control beats a richer history you don’t, every time the tool changes underneath you. And the tool always eventually changes underneath you.

My photos survived. The “you’ll always be able to redo this” promise I assumed came bundled with “non-destructive” quietly didn’t — it held only for the edits I made in the tool that writes plain text. Keep the original. But keep the log where you can still read it.