cairo: surface write-to-png fails - cairo_save does not roll back surface schema changes

Goal

Decide whether cairo should automatically revert surface-level schema changes after cairo_save/restore, or leave surface state management to the caller.

Constraints

In cairo 1.18 and later, cairo_save and cairo_restore protect the graphics state but do not undo surface format or device-surface modifications. A subsequent cairo_surface_write_to_png may therefore fail or produce undefined results after a schema change. Older releases before 1.12 lack explicit surface-format APIs, and concurrent access to the same surface can introduce races that cairo_save does not address.

Open questions

Should cairo_save capture surface schema state so cairo_restore can roll it back? If automatic rollback is unsafe, what surface-state tracking should client code perform before calling cairo_surface_write_to_png?