ImageSharp/HEIF_IMPLEMENTATION_PLAN.md

AVIF and AV1 implementation plan

Goal

Complete a production-quality, fully managed AV1 codec and its bounded AVIF/HEIF image container integration for ImageSharp. The finished work must decode and encode still images and bounded image sequences, preserve source precision, use ImageSharp memory ownership, and provide SIMD-first hot paths with one behaviorally identical scalar fallback.

This plan is the authoritative delivery checklist. A source file, unit test, build, self-roundtrip, or local implementation is not completion evidence by itself.

Source authority

• AV1 codec syntax, tables, fixed-point arithmetic, prediction, transforms, entropy behavior, filters, encoder decisions, and lifecycle behavior must be ported and checked only against the current main branch of the official libaom checkout at D:\GitHub\AOMediaCodec\aom.
• Libaom is the sole external codec implementation source. Do not use HM, libheif, FFmpeg, GPAC, SVT-AV1, dav1d, libgav1, or any other codec implementation as an algorithm, arithmetic, output, or architecture reference.
• Existing ImageSharp and JPEG code is authoritative only for ImageSharp architecture, allocator ownership, SIMD dispatch, pixel conversion, and test API patterns. It is not an alternate AV1 algorithm source.
• Production code must not load, invoke, install, or fall back to a native codec.
• Existing independent container files may be used only as interoperability inputs. Native AV1 expected output must be generated by the current libaom main checkout, and no independent decoder output may substitute for it.

Reference checkout evidence on 2026-08-31:

• D:\GitHub\AOMediaCodec\aom is attached to main, clean, and aligned with origin/main after a fresh fetch.
• Both HEAD and origin/main resolved to 441c439b9916474cac15d2822af47a9ad70674a8. This records the tree audited on that date; it is not a pin and must not prevent later work from updating to the then-current main.

Status notation

• Verified: the current behavior has exact evidence from the current libaom main tree and the evidence proves the production contract.
• [~] Locally implemented, checkpoint open: production source exists, but current-tree verification is missing or a known audit issue invalidates the checkpoint.
• Remaining: the production behavior is absent, incomplete, or has not reached its required implementation boundary.

Current source reconciliation

Reconciled with the worktree on 2026-08-31.

• [~] The bounded container reader, still-image path, sequence parser, AV1 decoder, color pipeline, presentation pipeline, and broad AV1 test suite exist locally.
• [~] The inter-frame decoder has verified checkpoints through non-translational global prediction. Inter deblocking decisions and reference/mode deltas remain open as the next ordered checkpoint.
• [~] Loop filtering, CDEF, super-resolution, restoration, film grain, layered presentation, alpha composition, and color conversion exist locally. Shared-source cleanup changed the current tree, so final production-path verification is open.
• [~] AV1 writer primitives, forward transforms, symbol encoding, and tile-writing source exist locally, but they are not connected to the public encoder.
• The public AV1 encoder is not implemented. HeifEncoderCore.Encode throws NotSupportedException when AV1 is selected.
• Patented codec production code, registrations, tests, benchmarks, fixtures, reference outputs, and notices were manually deleted and committed by 78a74d448.
• Remaining task-created HM, HEVC, libheif, GPAC, Nokia, FFmpeg, Pillow HEIF, libavif-build, and libjpeg-build directories were traced to their creation commands in the recovered Codex session history and deleted on 2026-08-31. The user-provided repositories and all libaom-only source, build, and reference data were left untouched.
• The PNG metadata-suppression fix and three HEIF/AV1 diagnostic-save call-site corrections passed the exact 34 net11.0 ARM CI cases and were committed with the single-reference checkpoint as 54bb6cbe59bd113058854a3ee31448cf61f462ca. They are infrastructure evidence, not decoder or encoder completion evidence.
• The complete decoder and encoder release matrix is not complete.

Immediate execution queue

Work must proceed in this order. Do not skip to a later item while an earlier checkpoint is open.

1. Finish and verify the AV1-only cleanup

• Remove production types, registrations, constants, parser branches, properties, tests, benchmarks, fixtures, reference outputs, notices, and documentation for removed codec work.
• Remove downloaded non-libaom reference source, tools, generated outputs, and local installations.
• Retain the official current-main libaom checkout and libaom-only build artifacts required for AV1 verification.
• Retain user-supplied AV1 fixtures and their recorded expected outputs.
• Audit production source, tests, benchmarks, assets, project files, notices, and documentation for stale removed-code references.
• The cleanup and cICP tree built in Release for net10.0 and net11.0 with restore disabled, build servers disabled, and one MSBuild node.
• The exact 34 net11.0 ARM CI failures pass after the cICP correction, and the subsequent single-reference checkpoint set passes on net10.0 and net11.0.
• Roslynk, scoped StyleCop, whitespace, and git diff --check accepted the cleanup and cICP checkpoint.
• The cleanup and cICP evidence was recorded and committed with the single-reference checkpoint.

Historical cleanup evidence from 2026-08-30, retained with its limitation:

• Release source builds passed for net10.0 and net11.0 with zero warnings and zero errors. Both builds used --no-restore, --disable-build-servers, and one MSBuild node.
• The focused net10.0 HEIF decoder, encoder, metadata, sequence-parser, and AV1 reconstruction set passed 221 of 221 tests with zero failures and zero skips. It did not execute the net11.0 diagnostic-save path that later failed in CI.
• The Roslyn compiler and configured StyleCop analyzers accepted the changed production source. Roslynk's open_solution entry point was attempted separately but failed before returning a solution handle, so no Roslynk result is claimed.
• The tracked-source text and filename audit found no removed-code references outside the unchanged repository and shared-infrastructure .gitattributes patterns. A later history reconstruction found ignored task-created reference directories that this audit missed; those directories were deleted on 2026-08-31.
• git diff --check passed and neither .gitattributes file changed.

Current cICP failure correction evidence from 2026-08-31:

• The failure was not decoded HEIF metadata. PngEncoderCore.WriteCicpChunk ignored PngChunkFilter.ExcludeAll, so diagnostic PNG saves attempted to write a non-identity source matrix that PNG cannot represent.
• PngEncoderCore now honors the existing SkipMetadata contract for cICP, and the three affected HEIF/AV1 diagnostic saves explicitly use PngEncoder { SkipMetadata = true }. Actual comparisons and decoded-image metadata assertions remain unchanged.
• The direct embedded-ICC case and every row of the 12-case profile matrix passed: 13 of 13 net11.0 Release cases.
• The exact 34 cases reported by CI passed: 34 of 34 net11.0 Release cases, with zero failures and zero skips.
• Roslynk reported zero compiler errors after the fix, and git diff --check passed.

Recovered task-history evidence from 2026-08-31:

• The primary session beginning on 2026-08-24 was reopened from task ID 01a03239-831b-7831-84e7-7f6947279ccb: 96,777 records, 295 turn contexts, 211 compactions, 190 user messages, 1,920 assistant messages, and 13,671 tool calls.
• The continuation beginning on 2026-08-27 was reopened from task ID 01a04314-f1c6-7133-b1bc-5c74a94dd714: 61,129 records at the audit point, 166 turn contexts, 96 compactions, 223 user messages, 1,113 assistant messages, and 8,942 tool calls.
• The restored first session records the user selecting official AOM/libaom as the AV1 source after the ImageSharp discussion was inspected. It does not authorize another codec implementation as an AV1 source and does not authorize importing a patented codec.
• The restored tool calls identify the exact creation commands for the non-libaom source, tool, and output directories removed on 2026-08-31. No directory was selected for deletion from its name alone.
• The recovered Git sequence establishes that 78a74d448 removed the patented codec implementation and 92fa7a8ca merged the later upstream ImageSharp changes. The current branch and worktree, not an older summary, remain authoritative.

2. Correct the single-reference inter-frame checkpoint

The checkpoint implementation is complete. The first two inherited audit findings were rechecked against current libaom main and did not require production changes; the remaining production boundary, reconstruction, and ownership work is now implemented and verified.

• Reconcile interpolation-filter syntax in Av1TileReader with current libaom main.
  • Current libaom av1_is_interp_needed calls is_nontrans_global_motion, whose loop rejects only TRANSLATION. Identity GLOBALMV therefore omits switchable-filter symbols.
  • Current Av1TileReader uses the same non-Translation classification. The existing Identity test leaves sentinel filter symbols unread, while the Translation test consumes them.
  • No production change is required. The stale test comment was changed from “pinned” to “current” libaom.
• Reconcile both spatial single-reference extension loops in Av1ReferenceMotionVectors with current libaom main.
  • Current libaom setup_ref_mv_list stops both loops at MAX_MV_REF_CANDIDATES, which is two. MAX_REF_MV_STACK_SIZE, which is eight, is the stack capacity used by the earlier direct and temporal candidate collection; it is not the stop condition for these two extension loops.
  • Current Av1ReferenceMotionVectors uses the same two-entry stop condition and retains an eight-entry stack for earlier candidates and DRL selection.
  • No production change is required. This remains spatial single-reference extension, not temporal extension.
• Establish and enforce the contiguous frame-plane invariant used by Av1FrameBuffer and inter reconstruction.
  • Every frame plane is allocated with preferContiguosImageBuffers: true, so a constrained allocator cannot split a representable padded plane into normal memory groups.
  • Av1FrameBuffer now rejects an external frame geometry whose padded plane reaches the int.MaxValue fallback boundary before any allocation. This makes every direct DangerousGetSingleSpan call an enforced owner invariant rather than a memory-group accident.
  • ConstructorRequestsContiguousPaddedPlanes proves that a plane larger than the allocator's group capacity is one group. ConstructorRejectsPaddedPlaneThatCannotBeContiguous proves that an unrepresentable plane is rejected before allocation.
  • The production path performs no plane copy and no per-block, per-row, or per-scanline allocation.
• Prove the real Av1BlockDecoder.DecodeBlock inter-reconstruction branch.
  • Decode the progressive dependent-frame fixture through the complete public production path.
  • Compare the final frame's native Y, Cb, and Cr planes exactly with current-main libaom output.
  • Compare the final presented image through the established ImageSharp reference-image comparison API.
  • Do not substitute an internal helper test, fake tile reader, non-zero assertion, custom pixel loop, or tolerant comparison.
• Prove motion-field ownership and lifetime.
  • Track initialization, retained-slot aliases, failure unwinding, presentation ownership, decoder-result ownership, and final disposal.
  • Every allocator-owned object must be returned exactly once.
• Correct stale documentation.
  • Av1InterFrameModeInfoTests must describe the behavior it actually proves.
  • Do not claim production reconstruction, constrained allocation, ownership, or reference-stack coverage unless the test executes that contract.

Checkpoint gate:

• Default Identity-omission and Translation-consumption GLOBALMV syntax cases pass in the focused current-tree run.
• Two-entry spatial single-reference extension passes; current-main source inspection confirms the separate eight-entry overall stack capacity and DRL access.
• The exact dependent-frame native-plane comparison passes.
• The established exact presentation comparison passes.
• Normal, AVX-512-disabled, AVX-disabled, and scalar FeatureTestRunner configurations pass where supported.
• Constrained allocation preserves the enforced single-group plane invariant without copying or per-block allocation.
• Motion-field allocation tracking is balanced across success and failure.
• Release builds for net10.0 and net11.0 pass with zero errors.
• Focused Release tests pass with zero failures or skips.
• Scoped semantic, StyleCop, whitespace, and git diff checks pass.
• The completed checkpoint was committed as 54bb6cbe59bd113058854a3ee31448cf61f462ca with author and committer James Jackson-South <james_south@hotmail.com>.

Verified single-reference checkpoint evidence on 2026-08-31:

• The current-main aomdec was rebuilt directly from D:\GitHub\AOMediaCodec\aom and identified itself as 3.15.0-13-g441c439b99.
• Decoding the 72-byte progressive payload with --all-layers, one thread, and row multithreading disabled produced 2,178 YUV444 color samples. All samples in both layers match the first three planes of the stored YUV444-alpha reference exactly.
• DecodeProgressiveSingleReferenceMatchesPinnedReferences executes the production decoder through FeatureTestRunner and compares the complete presented Rgba32 image with CompareToReferenceOutput(ImageComparer.Exact, provider). The redundant manual alpha loop was removed.
• DecodeProgressiveSingleReferenceWithConstrainedAllocator executes the same production reconstruction with a 1,024-byte allocator group capacity and verifies that every allocation is returned exactly once.
• MotionFieldsFollowReferenceAliasesAndPresentationOwnership, MotionFieldAllocationFailureUnwindsTileReaderOwnership, DecodeProgressiveSingleReferenceTracksMotionFieldResultOwnership, and the reference-store replacement, reset, and transfer tests cover initialization, aliases, presentation ownership, decoder-result ownership, failure unwinding, repeated disposal, and exactly-once final returns.
• The focused Release set passed 17 of 17 tests on net10.0 and 17 of 17 tests on net11.0, with zero failures and zero skips. This includes both GLOBALMV syntax cases, spatial extension, plane invariants, production reconstruction, FeatureTestRunner dispatch, and ownership.
• Release source builds passed for net10.0 and net11.0 with zero warnings and zero errors.
• Roslynk reported zero compiler errors. The scoped changed-file analyzer inspection reported no StyleCop diagnostics attributable to this checkpoint; its only remaining match is the pre-existing xUnit cancellation warning in an unrelated HeifDecoderTests method.
• git diff --check passed, and neither .gitattributes file changed.

Exact verification commands, run directly in the foreground from D:\GitHub\ynse01\ImageSharp:

$env:MSBUILDUSESERVER = '0'
$env:DOTNET_CLI_USE_MSBUILD_SERVER = '0'
$env:DOTNET_CLI_HOME = 'D:\GitHub\ynse01\ImageSharp\.dotnet'
$env:DOTNET_SKIP_FIRST_TIME_EXPERIENCE = '1'
$env:DOTNET_CLI_TELEMETRY_OPTOUT = '1'
$env:DOTNET_DbgEnableMiniDump = '0'
$env:COMPlus_DbgEnableMiniDump = '0'
$env:DOTNET_EnableCrashReport = '0'
$env:COMPlus_EnableCrashReport = '0'

$heifCheckpointFilter = 'FullyQualifiedName~Av1InterFrameModeInfoTests.ReadInterFrameModeInfoReadsInterpolationFilters|FullyQualifiedName~Av1InterFrameModeInfoTests.ReadInterFrameModeInfoOmitsInterpolationFiltersForIdentityGlobalMotion|FullyQualifiedName~Av1ReferenceMotionVectorsTests.BuildReversesOppositeDirectionExtensionCandidate|FullyQualifiedName~Av1FrameBufferTests|FullyQualifiedName~Av1ReferenceFrameStoreTests.MotionFieldsFollowReferenceAliasesAndPresentationOwnership|FullyQualifiedName~Av1ReferenceFrameStoreTests.MotionFieldAllocationFailureUnwindsTileReaderOwnership|FullyQualifiedName~Av1ReferenceFrameStoreTests.PartialReplacementPreservesSharedOwner|FullyQualifiedName~Av1ReferenceFrameStoreTests.FinalReplacementReleasesDisplacedOwner|FullyQualifiedName~Av1ReferenceFrameStoreTests.ResetReleasesUniqueOwnersAndClearsSlots|FullyQualifiedName~Av1ReferenceFrameStoreTests.TakeOutputTransfersPlanesAndReleasesOtherReferences|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleReferenceMatchesPinnedReferences|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleReferenceWithConstrainedAllocator|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleReferenceTracksMotionFieldResultOwnership'

dotnet build src\ImageSharp\ImageSharp.csproj -c Release -f net10.0 --no-restore --disable-build-servers -m:1 --no-incremental --nologo --verbosity:minimal
dotnet build src\ImageSharp\ImageSharp.csproj -c Release -f net11.0 --no-restore --disable-build-servers -m:1 --no-incremental --nologo --verbosity:minimal
dotnet test tests\ImageSharp.Tests\ImageSharp.Tests.csproj -c Release -f net10.0 --no-restore --disable-build-servers -m:1 --filter $heifCheckpointFilter --logger 'console;verbosity=minimal'
dotnet test tests\ImageSharp.Tests\ImageSharp.Tests.csproj -c Release -f net11.0 --no-restore --disable-build-servers -m:1 --filter $heifCheckpointFilter --logger 'console;verbosity=minimal'

$aomVcVars = 'C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\VC\Auxiliary\Build\vcvars64.bat'
$aomCmake = 'C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\Common7\IDE\CommonExtensions\Microsoft\CMake\CMake\bin\cmake.exe'
$aomEnvironment = & cmd.exe /d /s /c "`"$aomVcVars`" >nul && set"
foreach ($aomEntry in $aomEnvironment)
{
    $aomParts = $aomEntry -split '=', 2
    if ($aomParts.Length -eq 2)
    {
        [Environment]::SetEnvironmentVariable($aomParts[0], $aomParts[1], 'Process')
    }
}

& $aomCmake --build artifacts\reference\aom-generic --target aomdec --config Release --parallel 1
& 'artifacts\reference\aom-generic\aomdec.exe' --codec=av1 --rawvideo --all-layers --threads=1 --row-mt=0 --output='artifacts\reference\aom-generic\progressive-current-main-all-layers.yuv' 'tests\Images\Input\Heif\Av1\Conformance\libavif-progressive-draw-points-8b.bit'

3. Reverify downstream inter prediction in recorded order

The single-reference syntax, buffer, reconstruction, and ownership foundation is verified by 54bb6cbe59bd113058854a3ee31448cf61f462ca. Reverify the existing downstream implementations in this exact order, treating each as locally implemented but unverified until its current-main evidence is recorded.

• Compound reference selection, paired reference-MV derivation, and equal averaging.
• Inter-intra prediction.
• Distance-weighted compound prediction.
• Wedge compound prediction.
• Difference-weighted compound prediction.
• OBMC.
• Scaled-reference prediction.
• Local warped prediction.
• Non-translational global prediction.
• [~] Inter deblocking decisions and reference/mode deltas. Current item.

Verified equal-average compound checkpoint evidence on 2026-08-31:

• Refreshed the clean official libaom main checkout and audited the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. Reference selection and compound mode syntax match read_comp_reference_type and read_ref_frames in av1/decoder/decodemv.c; contexts match av1/common/pred_common.c; paired reference-MV construction and eight-entry extension match process_compound_ref_mv_candidate and setup_ref_mv_list in av1/common/mvref_common.c.
• Audited equal-average reconstruction against av1/common/convolve.c and av1/common/convolve.h. Corrected the unscaled 10/12-bit translational path so both references retain libaom's no-round compound intermediates until the sole final average and clipping step, including the larger first-round shift required for 12-bit horizontal intermediates.
• Added descending Vector512, Vector256, Vector128, and scalar high-bit-depth traversal to the existing semantic compound-prediction operator families. No per-block, per-row, or per-scanline allocation or copy was added.
• Added FeatureTestRunner coverage for 10/12-bit copy, horizontal, vertical, and separable subpixel prediction at widths 9, 17, 33, and 65, with an independent no-round bilinear oracle, row-padding sentinels, and explicit scalar comparison.
• Added a complete Av1BlockDecoder.DecodeBlock 10/12-bit half-sample regression whose expected result comes from the scalar no-round pipeline. The selected vector differs by one sample from the obsolete round-each-reference behavior, so the test proves the production branch selection.
• Refreshed the official libaom main remote immediately before verification and decoded the fixture's 5,465-byte AV1 mdat payload with current aomdec, one thread and row threading disabled. All 19 frames decoded; the final 19,200 YUV444 samples have SHA-256 E79D2F49C260B1AC9B1B9BBBB2D611126AFD3B241DA389EB9E7BD4EA0ED42080 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires decoded equal-average compound blocks, compares the final native Y, U, and V planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 31/31 on net10.0 and 31/31 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file, Roslynk reports zero compiler errors and no diagnostics in the changed files, and git diff --check passes. .gitattributes is unchanged.
• The completed checkpoint was committed as 4075a0844836e863a93cb2e2f3ca42d202c7df1b with author and committer James Jackson-South <james_south@hotmail.com>.

Verified inter-intra checkpoint evidence on 2026-08-31:

• Audited syntax against current libaom av1/decoder/decodemv.c and av1/common/blockd.h. ImageSharp applies the same sequence enable, skip-mode, block-size, and single-reference gates, reads the same four-mode CDF, and reads wedge syntax only within libaom's wedge-supported BLOCK_8X8 through BLOCK_32X32 range.
• Audited reconstruction against ii_weights1d, ii_size_scales, build_smooth_interintra_mask, and combine_interintra in current av1/common/reconinter.c. The ImageSharp weights, plane-size scaling, smooth-mask direction, complemented destination orientation, wedge sign, subsampling, and final 6-bit blend match. No production change was required.
• The mask tests cover all four inter-intra modes, complemented orientation, row-padding sentinels, and the 32-wide curve. FeatureTestRunner covers byte and high-bit-depth selectable blending under SIMD and scalar dispatch, and complete Av1BlockDecoder.DecodeBlock tests execute smooth inter-intra reconstruction at 8, 10, and 12 bits.
• Extracted the fixture's 5,327-byte AV1 mdat payload and decoded it with the refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8B776C2751DC30CA838931A4B74535FC6E681179568A1278747A38CFF2E5BFA and match the retained native reference with zero differing samples.
• The real production sequence requires both smooth and wedge inter-intra blocks, compares the final native Y, Cb, and Cr planes exactly, and compares final RGBA presentation through ImageSharp's established reference-output API. Its constrained 1,024-byte tracked-allocator run proves motion-field allocation and exactly one return for every allocation.
• The focused Release checkpoint set passes 50/50 on net10.0 and 50/50 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for both changed C# files. Roslynk reports zero compiler errors and no diagnostics in the changed files, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 18b1c881271a3494489ca6f410ab140544902e2d with author and committer James Jackson-South <james_south@hotmail.com>.

Verified distance-weighted compound checkpoint evidence on 2026-08-31:

• Audited reference-distance quantization against quant_dist_weight and quant_dist_lookup_table in current libaom av1/common/common_data.h, and audited order-hint distance selection and forward/backward reference assignment against av1_dist_wtd_comp_weight_assign in av1/common/reconinter.c.
• Audited reconstruction against current libaom av1/common/convolve.c. Corrected the production 10/12-bit subpixel path, which incorrectly finalized its two no-round compound intermediates with an equal average instead of the signaled distance weights. The fixed path applies libaom's 4-bit weighted shift before bias removal, final rounding, and clipping.
• Added descending Vector512, Vector256, Vector128, and scalar traversal to the existing semantic distance-weighted intermediate predictor family. Unsigned widening preserves the biased 12-bit intermediate range. No per-block, per-row, or per-scanline allocation or copy was added.
• Added FeatureTestRunner coverage for every current-libaom distance-weight class in both reference orders, and for 10/12-bit copy, horizontal, vertical, and separable subpixel prediction at widths 9, 17, 33, and 65, with an independent no-round oracle and row-padding sentinels.
• Added a complete Av1BlockDecoder.DecodeBlock 10/12-bit half-sample regression that selects the 13:3 distance weights through real order hints. Its first reconstructed sample differs from the old equal-average result, so the test proves the corrected production branch is executed.
• Extracted the fixture's 5,372-byte AV1 mdat payload and decoded it with the refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires decoded distance-weighted compound blocks, compares the final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 44/44 on net10.0 and 44/44 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors and no diagnostics in the changed files, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 7e2de7a2c25852acc374b17936a1a644464f77f3 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified wedge compound checkpoint evidence on 2026-08-31:

• Audited mask generation against current libaom tools/gen_wedge_masks_data.py and av1/common/reconinter.c, including the master prototypes, direction transforms, block-size codebooks, sign flips, offsets, and luma/chroma mask sampling. ImageSharp's generated masks match those definitions; only stale “pinned” documentation required correction.
• Audited reconstruction against current libaom aom_dsp/blend_a64_mask.c. The high-bit-depth d16 path applies the Q6 mask to both no-round intermediates before bias removal, the sole final rounding step, and clipping.
• Corrected the production high-bit-depth intermediate eligibility gate, which admitted only equal-average blocks and made the distance-weighted and wedge no-round finalizers unreachable. Average, distance-weighted, and wedge subpixel blocks now retain both intermediates until their signaled finalizer; difference-weighted blending remains excluded for its next ordered checkpoint.
• Added high-bit-depth traversal to the existing semantic mask-blend predictor and readonly operator family with descending Vector512, Vector256, Vector128, and scalar dispatch. Unsigned widening preserves the biased 12-bit intermediate range. No per-block, per-row, or per-scanline allocation or copy was added.
• Extended FeatureTestRunner coverage with an independent Q6 mask oracle across 10/12-bit copy, horizontal, vertical, and separable subpixel prediction, widths 9, 17, 33, and 65, all mask weights from 0 through 64, and row-padding sentinels. A complete Av1BlockDecoder.DecodeBlock regression verifies the current-libaom 8x8 wedge mask and the production no-round branch.
• Extracted the fixture's 5,374-byte AV1 mdat payload and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires both wedge-mask orientations, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 35/35 on net10.0 and 35/35 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 9883a24dc319e16b471f68be632d4f62f2c1cd5e with author and committer James Jackson-South <james_south@hotmail.com>.

Verified difference-weighted compound checkpoint evidence on 2026-08-31:

• Audited syntax against current libaom av1/decoder/decodemv.c. ImageSharp applies the same masked-compound enable and block-size gates, selects difference-weighted compound directly when wedge is unavailable, and reads the same one-bit type-38 mask orientation.
• Audited mask generation and reconstruction against current libaom av1/common/reconinter.c and aom_dsp/blend_a64_mask.c. The d16 path rounds the absolute intermediate difference by the convolution and bit-depth shift, scales it by 1/16, adds the type-38 base, clamps or inverts the mask, and then blends the original no-round intermediates before final rounding and clipping. Chroma reuses the luma-derived mask through rounded subsampling.
• Corrected the production 10/12-bit subpixel eligibility gate, which previously rounded both references before difference-mask construction and blending. Difference-weighted blocks now use the existing semantic intermediate mask-builder and mask-blend predictor/operator families through the sole final rounding step. No new operator family, per-block allocation, or copy was introduced.
• Renamed the stale “pinned formula” test and extended FeatureTestRunner's independent oracle across current-libaom regular and d16 mask arithmetic, both mask orientations, 8/10/12-bit samples, widths that cross every Vector512, Vector256, Vector128, and scalar boundary, subpixel phases, and row-padding sentinels.
• Added a complete Av1BlockDecoder.DecodeBlock regression for 10/12-bit half-sample prediction and both type-38 orientations. Its expected mask and reconstruction are calculated directly from the current-libaom equations, independently of the production mask builder and finalizer.
• Extracted the fixture's 5,358-byte AV1 mdat payload and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires both difference-mask orientations, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 37/37 on net10.0 and 37/37 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as fb4c64474e1ced4067a42731384f3b5ad4212a2f with author and committer James Jackson-South <james_south@hotmail.com>.

Verified OBMC checkpoint evidence on 2026-08-31:

• Audited motion-mode syntax against current libaom av1/decoder/decodemv.c, av1/common/blockd.h, av1/common/reconinter.c, av1/common/obmc.h, and av1/common/reconinter_template.inc. ImageSharp applies the same switchable-mode, skip, single-reference, inter-intra, minimum-size, overlappable-neighbor, fixed-global-motion, scaled reference, and projection-sample gates and reads the matching binary or three-way CDF.
• Audited above and left neighbor traversal, 4x4 pairing, neighbor caps, chroma suppression, prediction rectangles, interpolation filters, first-reference selection, mask tables, and blend order against current libaom. The existing semantic mask-blend predictor remains the correct SIMD-first traversal; no OBMC-specific operator family, allocation, or copy was introduced.
• Corrected the unscaled neighbor far-edge UMV clamp. After converting libaom's neighbor-relative motion-vector limits to an absolute source coordinate, the prediction extent cancels from the right and bottom limits; the previous code counted it twice.
• Extracted the fixture's 5,387-byte AV1 mdat payload at AVIF offset 1,065 and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The production sequence asserts decoded OBMC mode state, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API under normal and scalar FeatureTestRunner dispatch, and repeats reconstruction with a 1,024-byte constrained tracked allocator. Direct DecodeBlock tests cover above-then-left blending at 8/10/12-bit and 4:2:0 and 4:2:2 chroma geometry.
• Renamed the stale pinned-reference test and its established reference-output PNG together. The PNG SHA-256 remains D2CB388C9092EF17C4F0382C0150DD30D6F9D0EE247FF45AB5D7D4D312CEB23C; only its contract-derived filename changed.
• The focused Release checkpoint set passes 18/18 on net10.0 and 18/18 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 7e7e3cbe6438d63926b31d966795d2652e221939 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified scaled-reference checkpoint evidence on 2026-08-31:

• Audited reference-size validation and variable-scale coordinates, filters, edge extension, convolution rounding, and compound intermediates against current libaom av1/common/scale.c, av1/decoder/decodeframe.c, and av1/common/convolve.c. The frame boundary accepts the same half-to-sixteen-times dimension range and requires at least one compatible selected reference.
• Corrected the production scaled-compound branch. It previously rounded each scaled reference into native pixels before blending; current libaom retains both CONV_BUF_TYPE values with COMPOUND_ROUND1_BITS equal to seven and performs one final rounding after the selected compound blend.
• Kept native-pixel and compound output in the existing Av1ScaledInterPredictor traversal with semantic NativeOperator and CompoundOperator output contracts. The closed generic traversal shares variable-phase arithmetic across byte and ushort sources, dispatches Vector512, Vector256, Vector128, then scalar, and adds no per-block allocation or copy.
• Added independent FeatureTestRunner oracles for native and no-round compound output across 8, 10, and 12 bits, variable phases, all interpolation families, reduced kernels, vector tails, and destination padding. A complete Av1BlockDecoder.DecodeBlock() regression covers scaled compound prediction across all, AVX-512-disabled, AVX-disabled, and scalar configurations and proves the vector differs from an incorrectly early-rounded blend.
• Decoded the 2,195-byte layered payload with refreshed current libaom aomdec, using one thread, row threading disabled, all layers selected, and raw 8-bit output. The 40x40 YUV444 base and 80x80 YUV444 dependent frames total 24,000 samples with SHA-256 DD219E41B52C6C9343A92CD0A2D451DF57B73B25F10124811675B4CB2F8D666F; both match their retained native references with zero differing samples.
• The production tests compare both native frames exactly, compare selected-layer and final RGBA presentation through ImageSharp's established reference-output API, and repeat both paths with a 1,024-byte constrained tracked allocator whose allocations have balanced exactly-once returns.
• Renamed the two stale pinned-reference tests and their contract-derived PNGs together. Their Git blob identifiers remain unchanged, and their SHA-256 values remain DC4C6DBE6BD92C5FCE1E3E23700AFA603EF04ED02EDD336213EBBA1E3BD84BA0 and 678C5E5D4650EA6F0C590302E7DB9E3C6608851BC577453DA4A6837BDB4D3AF3.
• The focused Release checkpoint set passes 10/10 on net10.0 and 10/10 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 658a9cd1b6e22806decbae923da8800bca03a09e with author and committer James Jackson-South <james_south@hotmail.com>.

Verified local warped-prediction checkpoint evidence on 2026-08-31:

• Refreshed the clean official libaom main checkout and audited the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. Motion-mode eligibility and CDF selection match read_motion_mode in av1/decoder/decodemv.c; above, left, top-left, and top-right spatial projection samples and threshold selection match findSamples and selectSamples in av1/common/mvref_common.c; affine fitting, shear reduction, phase derivation, filters, rounding, clipping, and invalid-model fallback match av1/common/warped_motion.c and av1/common/reconinter.c.
• Mechanically compared all 1,544 ImageSharp and independent-test warped-filter coefficients against current libaom's av1_warped_filter; both comparisons have zero differences. The separate scalar test transcription covers 8-, 10-, and 12-bit luma and subsampled-chroma coordinates, tail widths, destination stride preservation, libaom's 12-bit round adjustment, and AVX-512, AVX, 128-bit, and scalar dispatch through FeatureTestRunner.
• Extracted the fixture's exact 2,310-byte AV1 mdat payload at AVIF offset 997. Its SHA-256 is 644D04FE1D1A32BB7A3856AD7EB49CF1EFDE0AC845E55BEAC4170F72353F2391. Current official libaom decoded both 256x256 YUV444 frames with one thread, row threading disabled, and all layers enabled. The complete Y4M SHA-256 is 8FDC5D46014F5E5A7455A83643AB6F0DA66FC5A984E72A43F8C75BAD8271C299; the final frame's 196,608 native samples have SHA-256 47B2AB39BF3B9DA15C1EC59840F964DFDF227760947F6E1295FB38A84555F75C and match the retained native reference with zero differences.
• The real two-frame fixture exercises Av1BlockDecoder.DecodeBlock(), requires decoded WARPED_CAUSAL state and the expected multi-sample affine model, compares final native Y, U, and V planes exactly, compares the retained final presentation through ImageSharp's established reference-output API, and passes through intrinsic and scalar dispatch. The 1,024-byte constrained tracked-allocator path passes with motion-field allocations present and balanced exactly-once returns.
• Renamed the stale pinned-reference test and its contract-derived PNG together without changing the PNG bytes. Its SHA-256 remains 4490D62FB6679378E92CACA48427359091AD2106BE49FC1A3848F78BE03BEEB1.
• The focused Release checkpoint set passes 4/4 on net10.0 and 4/4 on net11.0, with zero failures or skips. Scoped analyzer verification passes for both changed C# files. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 27a522424fe7aaea25078e705d71a501da110727 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified non-translational global-prediction checkpoint evidence on 2026-08-31:

• Audited global-motion syntax, coefficient decoding, previous-reference recentering, shear validation, motion-vector projection, and warped-prediction eligibility against current official libaom main at the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. The implementation matches read_global_motion_params, read_global_motion_model, gm_get_motion_vector, is_global_mv_block, and the WARP_PRED selection in av1/common/reconinter.c.
• Corrected high-bit-depth compound warped/global prediction to retain both references in libaom's unsigned no-round compound domain. Current get_conv_params_no_round, av1_warp_plane, and av1_highbd_warp_affine_c require the 12-bit first-round adjustment while retaining a seven-bit second round; native clipping now occurs only after the compound blend.
• The independent scalar libaom transcription validates native and no-round compound output for byte, 8-bit, 10-bit, and 12-bit sources, including tail widths and destination-stride preservation. All cases pass through AVX-512, AVX, 128-bit, and scalar dispatch with FeatureTestRunner. Direct Av1BlockDecoder.DecodeBlock() coverage validates GLOBAL_GLOBALMV compound reconstruction at all supported bit depths.
• Extracted the fixture's exact 38,475-byte AV1 mdat payload at AVIF offset 997. Its SHA-256 is 6AC7EC9984B1FF5C00403D7E3858441E9CEE75128F7414101D06DEEE59A351D0. Current official libaom decoded both 256x256 YUV444 frames with one thread, row threading disabled, and all layers enabled. The complete Y4M SHA-256 is 84754DE0B9FABC4F3F8F344C848183EC17B625BFD87E4519C3D8AD7DEFD20F2C; the final frame's 196,608 native samples have SHA-256 FEC89E2DE7496980389806B194425042F3800C7BAA817249D1A51D44A2B37A8E and match the retained native reference with zero differences.
• The real two-frame fixture exercises the production decoder, requires decoded non-translational global motion, compares final native Y, U, and V planes exactly, compares the retained presentation through ImageSharp's established reference-output API, and passes the constrained tracked-allocator path.
• Renamed the stale pinned-reference test and its contract-derived PNG together without changing the PNG bytes. Its SHA-256 remains F7D27ABF79450DFA311F72106FD1DA80997EABC0937F2F5578EF627119FF83B0, and Git attributes select the LFS filter and diff driver.
• The focused Release checkpoint set passes 11/11 on net10.0 and 11/11 on net11.0, with zero failures or skips. Scoped analyzer verification passes for all six changed C# files. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.

For every item:

• Trace syntax and arithmetic to the current libaom main tree.
• Execute the real production decoder path.
• Compare native planes exactly.
• Compare presentation through the established reference-image API.
• Run constrained allocator and exactly-once ownership coverage.
• Run FeatureTestRunner for SIMD and scalar dispatch when the implementation has SIMD.
• Record focused Release evidence before marking the item verified.

4. Close AV1 decoder coverage

Previously verified algorithm checkpoints remain valuable evidence, but the final decoder gate requires a fresh current-tree run after the inter and cleanup corrections.

• [~] Bounded OBU framing, sequence headers, frame headers, tile groups, alignment, and trailing-bit parsing have historical checkpoint evidence against an obsolete pinned tree. Re-audit the current libaom main implementation before restoring verified status.
• [~] Partition traversal, mode information, segmentation, delta quantization, transform-size selection, coefficient decoding, inverse quantization, and inverse transforms have historical checkpoint evidence against an obsolete pinned tree. Re-audit the current libaom main implementation before restoring verified status.
• Intra prediction covers directional, DC, smooth, Paeth, chroma-from-luma, filter-intra, and palette families with the established operator architecture.
• Intra-block copy has exact native reconstruction and feature-isolated SIMD evidence.
• Lossless inverse transform, loop filtering, CDEF, super-resolution, restoration, and film grain have focused checkpoint evidence.
• [~] Retained references, CDF snapshots, segmentation maps, global motion, temporal motion fields, and dependent-frame lifecycle exist locally and require current-tree re-verification.
• [~] All-intra and dependent-frame profile fixtures exist for 8, 10, and 12-bit monochrome, 4:2:0, 4:2:2, and 4:4:4 paths.
• Re-run the exact current-tree native-plane matrix through the production decoder.
• Re-run the exact current-tree presentation matrix through ImageSharp's established comparison API.
• Verify malformed/truncated data, frame IDs, reference slots, tile bounds, allocation limits, cancellation, and failure unwinding.
• Verify still items and bounded sequences from file, memory, non-seekable, and short-read streams.
• Verify ICC, CICP, alpha, grids, pixel aspect ratio, clean aperture, rotation, mirroring, metadata, and every presented sequence frame.
• Complete the public AVIF format/API review so registered capabilities match implemented behavior.
• Remove or reject every valid in-scope AV1 syntax branch that remains silently ignored or unsupported.

Decoder exit gate:

• Every supported native format and AV1 tool has exact current-main libaom production-path evidence.
• Every supported presentation behavior has established reference-image evidence at the correct output precision.
• No decoder path relies on a native codec, copied plane, per-block allocation, or contiguous memory-group accident.
• All allocator ownership is deterministic and exactly once.
• Full focused Release verification is recorded with no false coverage claims.

AV1 encoder implementation

Writer primitives are not an encoder. The public encoder remains incomplete until it produces independently decodable AV1 payloads and AVIF containers for every exposed option.

5. Define and enforce the encoder contract

• Finalize observable options for quality, effort, lossless mode, bit depth, chroma subsampling, alpha quality, metadata, and bounded sequences.
• Preserve high-bit-depth source precision through 16-bit RGB and native 10/12-bit component planes.
• Reject unsupported combinations at the public boundary before writing output.
• Register only capabilities that the completed encoder proves.

6. Build the complete AV1 frame encoder

• [~] SIMD-first RGB-to-native-plane conversion exists locally.
• [~] Forward transform families and transform workspace exist locally.
• [~] Symbol writer, coefficient writer, and tile writer fragments exist locally.
• Connect a frame-owned encoder lifecycle using ImageSharp allocators and pools.
• Write compliant temporal delimiter, sequence header, frame header, tile group, metadata, and padding OBUs as required.
• Implement superblock and partition analysis for every permitted block size and partition.
• Implement intra mode search, chroma mode search, palette, filter intra, chroma-from-luma, and intra-block copy decisions.
• Implement inter mode search for bounded sequences, including reference selection and the decoder-supported inter tools.
• Implement transform-size/type search, forward transform, quantization, coefficient optimization, and lossless behavior.
• Implement real rate-distortion selection and make quality and effort change work, size, and output quality.
• Implement tile-local entropy coding and CDF update behavior.
• Implement legal deblocking, CDEF, restoration, super-resolution, and film-grain signaling decisions.
• Remove per-transform and per-block managed allocations from active encoder paths.
• Use descending SIMD dispatch: Vector512, Vector256, Vector128, then scalar.
• Verify every SIMD operator with FeatureTestRunner and an independent scalar oracle shaped from the same current-main libaom behavior.

7. Write complete AVIF output

• Write the correct AVIF file type, item information, locations, references, properties, AV1 configuration, dimensions, color, alpha, metadata, and media data.
• Support single images, alpha auxiliary images, grids, multiple extents, and bounded image sequences in the final public scope.
• Preserve ICC, Exif, and XMP according to encoder options.
• Write CICP, range, chroma position, bit depth, and subsampling values that match the encoded planes.
• Apply orientation and clean-aperture behavior consistently with ImageSharp encoder conventions.
• Stream output through allocator-backed chunked storage without file-sized copies or ToArray materialization.

Encoder exit gate:

• Current-main libaom accepts every produced AV1 payload.
• Lossless output is exact at native-plane and final-pixel precision.
• Lossy output demonstrates recorded quality and effort tradeoffs with absolute size, quality, timing, and allocation evidence.
• 8, 10, and 12-bit monochrome, 4:2:0, 4:2:2, and 4:4:4 outputs pass.
• Alpha, grids, metadata, color profiles, transforms, and bounded sequences pass.
• ImageSharp decode of its own output is supplemental coverage only, never the sole oracle.
• Public encoding no longer throws for a supported AV1 request.
• Focused Release and FeatureTestRunner verification passes with exact recorded evidence.

Architecture rules

• Follow the JPEG color-converter operator architecture exactly.
• Each distinct prediction traversal owns a family-named predictor type.
• The family .Operator.cs file defines the nested static operator contract.
• Each semantic readonly struct belongs to that owner and implements concrete scalar, Vector128, Vector256, and Vector512 arithmetic for the shared traversal.
• Do not place a distinct predictor beneath a broad Av1IntraPredictor or Av1InterPredictor.
• Do not create semantic forwarding wrappers, top-level operator types, hardware-width-named operator types, CRTP contracts, or one file containing unrelated semantic operators.
• Forward transforms belong to Av1ForwardTransformer and its semantic operator files.
• Inverse axis transforms belong to Av1Inverse2dTransformer and its semantic operator files.
• Reconstruction output operators belong to Av1InverseTransformer.
• Shared lane primitives belong only in explicitly named Operations types.
• Dispatch from widest to narrowest supported SIMD width, then execute one scalar tail.
• Keep codec execution sequential. Do not add parallel execution inside the codec.
• Do not allocate per row, block, transform, scanline, or SIMD tail.
• Use ImageSharp allocators and pools. Do not use ToArray to cross an ownership boundary.
• On internal types, use public members when other types consume them; reserve private members for type-local behavior.
• Use established ImageSharp test data, allocator tracking, FeatureTestRunner, and reference-image comparison APIs. Do not build custom substitutes.
• Public XML documentation describes observable behavior only.
• Inline comments explain the current-libaom numerical rule, ownership boundary, edge extension, entropy ordering, or SIMD shape at technically complex points.
• Every multiline statement or declaration is followed by vertical whitespace.
• Do not edit .gitattributes directly.
• Do not install or download tools without explicit permission.

Final verification matrix

• Release source build: net10.0, zero errors.
• Release source build: net11.0, zero errors.
• Scoped semantic inspection: zero compiler errors attributable to this work.
• Focused decoder syntax, reconstruction, ownership, presentation, and malformed-input tests.
• Focused encoder syntax, payload, container, precision, ownership, and option tests.
• FeatureTestRunner coverage for normal, narrower SIMD tiers, and scalar fallback.
• Constrained multi-group allocator coverage with balanced exactly-once returns.
• Exact native-plane comparisons against current-main libaom.
• Established final-presentation comparisons at the target pixel precision.
• Scoped StyleCop and vertical-whitespace inspection.
• No stale unsupported capability claims or removed-code references.
• No restore-source failures, background test hosts, detached processes, or crash-report popups.
• .gitattributes unchanged.
• git diff --check clean.
• Documentation records exact commands, counts, current-main reference revision evidence, and results.
• Commit only after the relevant checkpoint is genuinely complete.
• Do not push.