Function check_orientation_roundtrip 

pub fn check_orientation_roundtrip<E, D>(
    enc: E,
    dec: D,
    img: &TestImage,
) -> Conformance
where
    E: EncoderConfig,
    D: DecoderConfig,
    <E::Job as EncodeJob>::Enc: Encoder<Error = E::Error>,

The displayed image is preserved through a policy that keeps orientation.

EXIF orientation is a rendering transform the reader applies, not a label, so the invariant is on the displayed pixels — render(pixels, orientation) — not the stored buffer. For each non-identity orientation under each keeping policy (Web, ColorAndRotation, PreserveExact), this asserts render(decoded_pixels, decoded_orientation) == render(input, requested).

That one invariant is correct for every valid storage strategy and catches every failure mode:

• Carry (stored pixels as-authored + tag) — passes.
• Bake (rotated pixels + Identity tag, the only option for a metadata-free format) — also passes; the displayed image is identical.
• Double-application (rotated pixels and the tag) — caught: applying the tag to already-rotated pixels rotates twice, so the render differs.
• Loss (tag dropped to Identity, pixels untouched) — caught: the render is the un-rotated image.