ImageSharp/HEIF_IMPLEMENTATION_PLAN.md

AVIF and AV1 implementation plan

Goal

Complete a production-quality, fully managed AV1 codec and its bounded AVIF/HEIF image container integration for ImageSharp. The finished work must decode and encode still images and bounded image sequences, preserve source precision, use ImageSharp memory ownership, and provide SIMD-first hot paths with one behaviorally identical scalar fallback.

This plan is the authoritative delivery checklist. A source file, unit test, build, self-roundtrip, or local implementation is not completion evidence by itself.

Source authority

• AV1 codec syntax, tables, fixed-point arithmetic, prediction, transforms, entropy behavior, filters, encoder decisions, and lifecycle behavior must be ported and checked only against the current main branch of the official libaom checkout at D:\GitHub\AOMediaCodec\aom.
• Libaom is the sole external codec implementation source. Do not use HM, libheif, FFmpeg, GPAC, SVT-AV1, dav1d, libgav1, or any other codec implementation as an algorithm, arithmetic, output, or architecture reference.
• Existing ImageSharp and JPEG code is authoritative only for ImageSharp architecture, allocator ownership, SIMD dispatch, pixel conversion, and test API patterns. It is not an alternate AV1 algorithm source.
• Production code must not load, invoke, install, or fall back to a native codec.
• Existing independent container files may be used only as interoperability inputs. Native AV1 expected output must be generated by the current libaom main checkout, and no independent decoder output may substitute for it.

Reference checkout evidence on 2026-08-31:

• D:\GitHub\AOMediaCodec\aom is attached to main, clean, and aligned with origin/main after a fresh fetch.
• Both HEAD and origin/main resolved to 441c439b9916474cac15d2822af47a9ad70674a8. This records the tree audited on that date; it is not a pin and must not prevent later work from updating to the then-current main.

Status notation

• Verified: the current behavior has exact evidence from the current libaom main tree and the evidence proves the production contract.
• [~] Locally implemented, checkpoint open: production source exists, but current-tree verification is missing or a known audit issue invalidates the checkpoint.
• Remaining: the production behavior is absent, incomplete, or has not reached its required implementation boundary.

Current source reconciliation

Reconciled with the worktree on 2026-08-31.

• [~] The bounded container reader, still-image path, sequence parser, AV1 decoder, color pipeline, presentation pipeline, and broad AV1 test suite exist locally.
• The inter-frame decoder has verified checkpoints through inter deblocking decisions and reference/mode deltas.
• [~] Loop filtering, CDEF, super-resolution, restoration, film grain, layered presentation, alpha composition, and color conversion exist locally. Shared-source cleanup changed the current tree, so final production-path verification is open.
• [~] AV1 writer primitives, forward transforms, symbol encoding, and tile-writing source exist locally, but they are not connected to the public encoder.
• The public AV1 encoder is not implemented. HeifEncoderCore.Encode throws NotSupportedException when AV1 is selected.
• Patented codec production code, registrations, tests, benchmarks, fixtures, reference outputs, and notices were manually deleted and committed by 78a74d448.
• Remaining task-created HM, HEVC, libheif, GPAC, Nokia, FFmpeg, Pillow HEIF, libavif-build, and libjpeg-build directories were traced to their creation commands in the recovered Codex session history and deleted on 2026-08-31. The user-provided repositories and all libaom-only source, build, and reference data were left untouched.
• The PNG metadata-suppression fix and three HEIF/AV1 diagnostic-save call-site corrections passed the exact 34 net11.0 ARM CI cases and were committed with the single-reference checkpoint as 54bb6cbe59bd113058854a3ee31448cf61f462ca. They are infrastructure evidence, not decoder or encoder completion evidence.
• The complete decoder and encoder release matrix is not complete.

Immediate execution queue

Work must proceed in this order. Do not skip to a later item while an earlier checkpoint is open.

1. Finish and verify the AV1-only cleanup

• Remove production types, registrations, constants, parser branches, properties, tests, benchmarks, fixtures, reference outputs, notices, and documentation for removed codec work.
• Remove downloaded non-libaom reference source, tools, generated outputs, and local installations.
• Retain the official current-main libaom checkout and libaom-only build artifacts required for AV1 verification.
• Retain user-supplied AV1 fixtures and their recorded expected outputs.
• Audit production source, tests, benchmarks, assets, project files, notices, and documentation for stale removed-code references.
• The cleanup and cICP tree built in Release for net10.0 and net11.0 with restore disabled, build servers disabled, and one MSBuild node.
• The exact 34 net11.0 ARM CI failures pass after the cICP correction, and the subsequent single-reference checkpoint set passes on net10.0 and net11.0.
• Roslynk, scoped StyleCop, whitespace, and git diff --check accepted the cleanup and cICP checkpoint.
• The cleanup and cICP evidence was recorded and committed with the single-reference checkpoint.

Historical cleanup evidence from 2026-08-30, retained with its limitation:

• Release source builds passed for net10.0 and net11.0 with zero warnings and zero errors. Both builds used --no-restore, --disable-build-servers, and one MSBuild node.
• The focused net10.0 HEIF decoder, encoder, metadata, sequence-parser, and AV1 reconstruction set passed 221 of 221 tests with zero failures and zero skips. It did not execute the net11.0 diagnostic-save path that later failed in CI.
• The Roslyn compiler and configured StyleCop analyzers accepted the changed production source. Roslynk's open_solution entry point was attempted separately but failed before returning a solution handle, so no Roslynk result is claimed.
• The tracked-source text and filename audit found no removed-code references outside the unchanged repository and shared-infrastructure .gitattributes patterns. A later history reconstruction found ignored task-created reference directories that this audit missed; those directories were deleted on 2026-08-31.
• git diff --check passed and neither .gitattributes file changed.

Current cICP failure correction evidence from 2026-08-31:

• The failure was not decoded HEIF metadata. PngEncoderCore.WriteCicpChunk ignored PngChunkFilter.ExcludeAll, so diagnostic PNG saves attempted to write a non-identity source matrix that PNG cannot represent.
• PngEncoderCore now honors the existing SkipMetadata contract for cICP, and the three affected HEIF/AV1 diagnostic saves explicitly use PngEncoder { SkipMetadata = true }. Actual comparisons and decoded-image metadata assertions remain unchanged.
• The direct embedded-ICC case and every row of the 12-case profile matrix passed: 13 of 13 net11.0 Release cases.
• The exact 34 cases reported by CI passed: 34 of 34 net11.0 Release cases, with zero failures and zero skips.
• Roslynk reported zero compiler errors after the fix, and git diff --check passed.

Recovered task-history evidence from 2026-08-31:

• The primary session beginning on 2026-08-24 was reopened from task ID 01a03239-831b-7831-84e7-7f6947279ccb: 96,777 records, 295 turn contexts, 211 compactions, 190 user messages, 1,920 assistant messages, and 13,671 tool calls.
• The continuation beginning on 2026-08-27 was reopened from task ID 01a04314-f1c6-7133-b1bc-5c74a94dd714: 61,129 records at the audit point, 166 turn contexts, 96 compactions, 223 user messages, 1,113 assistant messages, and 8,942 tool calls.
• The restored first session records the user selecting official AOM/libaom as the AV1 source after the ImageSharp discussion was inspected. It does not authorize another codec implementation as an AV1 source and does not authorize importing a patented codec.
• The restored tool calls identify the exact creation commands for the non-libaom source, tool, and output directories removed on 2026-08-31. No directory was selected for deletion from its name alone.
• The recovered Git sequence establishes that 78a74d448 removed the patented codec implementation and 92fa7a8ca merged the later upstream ImageSharp changes. The current branch and worktree, not an older summary, remain authoritative.

2. Correct the single-reference inter-frame checkpoint

The checkpoint is complete through c4b4e4e0386328dea574a884b6fa36c360ad5a9b. It replaces frame-sized palette maps with fixed decoder-session scratch, reconstructs each superblock before reusing that scratch, and passes the ownership, documentation, full AV1 test, and Release source-build gates on both target frameworks.

• Reconcile interpolation-filter syntax in Av1TileReader with current libaom main.
  • Current libaom av1_is_interp_needed calls is_nontrans_global_motion, whose loop rejects only TRANSLATION. Identity GLOBALMV therefore omits switchable-filter symbols.
  • Current Av1TileReader uses the same non-Translation classification. The existing Identity test leaves sentinel filter symbols unread, while the Translation test consumes them.
  • No production change is required. The focused test describes only the syntax behavior it proves.
• Reconcile both spatial single-reference extension loops in Av1ReferenceMotionVectors with current libaom main.
  • Current libaom setup_ref_mv_list stops both loops at MAX_MV_REF_CANDIDATES, which is two. MAX_REF_MV_STACK_SIZE, which is eight, is the stack capacity used by the earlier direct and temporal candidate collection; it is not the stop condition for these two extension loops.
  • Current Av1ReferenceMotionVectors uses the same two-entry stop condition and retains an eight-entry stack for earlier candidates and DRL selection.
  • No production change is required. This remains spatial single-reference extension, not temporal extension.
• Establish and enforce the contiguous frame-plane invariant used by Av1FrameBuffer and inter reconstruction.
  • Every frame plane is allocated with preferContiguosImageBuffers: true, so a constrained allocator cannot split a representable padded plane into normal memory groups.
  • Av1FrameBuffer now rejects an external frame geometry whose padded plane reaches the int.MaxValue fallback boundary before any allocation. This makes every direct DangerousGetSingleSpan call an enforced owner invariant rather than a memory-group accident.
  • ConstructorRequestsContiguousPaddedPlanes proves that a plane larger than the allocator's group capacity is one group. ConstructorRejectsPaddedPlaneThatCannotBeContiguous proves that an unrepresentable plane is rejected before allocation.
  • The production path performs no plane copy and no per-block, per-row, or per-scanline allocation.
• Prove the real Av1BlockDecoder.DecodeBlock inter-reconstruction branch.
  • Decode the progressive dependent-frame fixture through the complete public production path.
  • Compare the final frame's native Y, Cb, and Cr planes exactly with current-main libaom output.
  • Compare the final presented image through the established ImageSharp reference-image comparison API.
  • Do not substitute an internal helper test, fake tile reader, non-zero assertion, custom pixel loop, or tolerant comparison.
• Prove motion-field ownership and lifetime after the current reconstruction-timing change.
  • Track initialization, retained-slot aliases, failure unwinding, presentation ownership, decoder-result ownership, and final disposal.
  • Every allocator-owned object must be returned exactly once.
• Correct stale documentation for the current worktree.
  • Av1InterFrameModeInfoTests must describe the behavior it actually proves.
  • Do not claim production reconstruction, constrained allocation, ownership, or reference-stack coverage unless the test executes that contract.

Checkpoint gate:

• Default Identity-omission and Translation-consumption GLOBALMV syntax cases pass in the focused current-tree run.
• Two-entry spatial single-reference extension passes; current-main source inspection confirms the separate eight-entry overall stack capacity and DRL access.
• The exact dependent-frame native-plane comparison passes.
• The established exact presentation comparison passes.
• Normal, AVX-512-disabled, AVX-disabled, and scalar FeatureTestRunner configurations pass where supported.
• Constrained allocation preserves the enforced single-group plane invariant without copying or per-block allocation.
• Motion-field allocation tracking is balanced across success and failure on net10.0 and net11.0.
• Release source builds pass for net10.0 and net11.0 with zero warnings and zero errors.
• The complete AV1 namespace passes 8,732 of 8,732 tests on net10.0 and net11.0 with zero failures or skips.
• Roslynk reports zero compiler errors; scoped analyzer inspection reports no diagnostics introduced by the current changes; git diff --check passes.
• The completed checkpoint was committed as 54bb6cbe59bd113058854a3ee31448cf61f462ca with author and committer James Jackson-South <james_south@hotmail.com>.
• The palette-memory follow-up was committed as c4b4e4e0386328dea574a884b6fa36c360ad5a9b with author and committer James Jackson-South <james_south@hotmail.com>.

Verified single-reference checkpoint evidence on 2026-08-31:

• The current-main aomdec was rebuilt directly from D:\GitHub\AOMediaCodec\aom and identified itself as 3.15.0-13-g441c439b99.
• Decoding the 72-byte progressive payload with --all-layers, one thread, and row multithreading disabled produced 2,178 YUV444 color samples. All samples in both layers match the first three planes of the stored YUV444-alpha reference exactly.
• DecodeProgressiveSingleMatchesReference executes the production decoder through FeatureTestRunner and compares the complete presented Rgba32 image with CompareToReferenceOutput(ImageComparer.Exact, provider). The redundant manual alpha loop was removed.
• DecodeProgressiveSingleWithConstrainedAllocator executes the same production reconstruction with a 1,024-byte allocator group capacity and verifies that every allocation is returned exactly once.
• MotionFieldsFollowAliasesAndPresentationOwnership, MotionFieldAllocationFailureUnwindsTileReaderOwnership, DecodeProgressiveSingleTracksMotionFieldOwnership, and the reference-store replacement, reset, and transfer tests cover initialization, aliases, presentation ownership, decoder-result ownership, failure unwinding, repeated disposal, and exactly-once final returns in the current worktree.
• The current worktree passes the four-case palette set, seven-case ownership set, and 29-case syntax, plane, and production reconstruction set on both target frameworks. The complete AV1 namespace passes 8,732 of 8,732 tests on net10.0 and net11.0 with zero failures or skips.
• Release source builds passed for net10.0 and net11.0 with zero warnings and zero errors.
• Roslynk reported zero compiler errors. The scoped changed-file analyzer inspection reported no StyleCop diagnostics attributable to this checkpoint; its only remaining match is the pre-existing xUnit cancellation warning in an unrelated HeifDecoderTests method.
• git diff --check passed, and neither .gitattributes file changed.

Exact verification commands, run directly in the foreground from D:\GitHub\ynse01\ImageSharp:

$env:MSBUILDUSESERVER = '0'
$env:DOTNET_CLI_USE_MSBUILD_SERVER = '0'
$env:DOTNET_CLI_HOME = 'D:\GitHub\ynse01\ImageSharp\.dotnet'
$env:DOTNET_SKIP_FIRST_TIME_EXPERIENCE = '1'
$env:DOTNET_CLI_TELEMETRY_OPTOUT = '1'
$env:DOTNET_DbgEnableMiniDump = '0'
$env:COMPlus_DbgEnableMiniDump = '0'
$env:DOTNET_EnableCrashReport = '0'
$env:COMPlus_EnableCrashReport = '0'

$heifCheckpointFilter = 'FullyQualifiedName~Av1InterFrameModeInfoTests.ReadInterFrameModeInfoReadsInterpolationFilters|FullyQualifiedName~Av1InterFrameModeInfoTests.IdentityGlobalMotionOmitsInterpolationFilters|FullyQualifiedName~Av1ReferenceMotionVectorsTests.BuildReversesOppositeDirectionExtensionCandidate|FullyQualifiedName~Av1FrameBufferTests|FullyQualifiedName~Av1ReferenceFrameStoreTests.MotionFieldsFollowAliasesAndPresentationOwnership|FullyQualifiedName~Av1ReferenceFrameStoreTests.MotionFieldAllocationFailureUnwindsTileReaderOwnership|FullyQualifiedName~Av1ReferenceFrameStoreTests.PartialReplacementPreservesSharedOwner|FullyQualifiedName~Av1ReferenceFrameStoreTests.FinalReplacementReleasesDisplacedOwner|FullyQualifiedName~Av1ReferenceFrameStoreTests.ResetReleasesUniqueOwnersAndClearsSlots|FullyQualifiedName~Av1ReferenceFrameStoreTests.TakeOutputTransfersPlanesAndReleasesOtherReferences|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleMatchesReference|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleWithConstrainedAllocator|FullyQualifiedName~Av1ReconstructionConformanceTests.DecodeProgressiveSingleTracksMotionFieldOwnership'

dotnet build src\ImageSharp\ImageSharp.csproj -c Release -f net10.0 --no-restore --disable-build-servers -m:1 --no-incremental --nologo --verbosity:minimal
dotnet build src\ImageSharp\ImageSharp.csproj -c Release -f net11.0 --no-restore --disable-build-servers -m:1 --no-incremental --nologo --verbosity:minimal
dotnet test tests\ImageSharp.Tests\ImageSharp.Tests.csproj -c Release -f net10.0 --no-restore --disable-build-servers -m:1 --filter $heifCheckpointFilter --logger 'console;verbosity=minimal'
dotnet test tests\ImageSharp.Tests\ImageSharp.Tests.csproj -c Release -f net11.0 --no-restore --disable-build-servers -m:1 --filter $heifCheckpointFilter --logger 'console;verbosity=minimal'

$aomVcVars = 'C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\VC\Auxiliary\Build\vcvars64.bat'
$aomCmake = 'C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\Common7\IDE\CommonExtensions\Microsoft\CMake\CMake\bin\cmake.exe'
$aomEnvironment = & cmd.exe /d /s /c "`"$aomVcVars`" >nul && set"
foreach ($aomEntry in $aomEnvironment)
{
    $aomParts = $aomEntry -split '=', 2
    if ($aomParts.Length -eq 2)
    {
        [Environment]::SetEnvironmentVariable($aomParts[0], $aomParts[1], 'Process')
    }
}

& $aomCmake --build artifacts\reference\aom-generic --target aomdec --config Release --parallel 1
& 'artifacts\reference\aom-generic\aomdec.exe' --codec=av1 --rawvideo --all-layers --threads=1 --row-mt=0 --output='artifacts\reference\aom-generic\progressive-current-main-all-layers.yuv' 'tests\Images\Input\Heif\Av1\Conformance\libavif-progressive-draw-points-8b.bit'

3. Reverify downstream inter prediction in recorded order

The single-reference syntax, buffer, reconstruction, and ownership foundation is verified by 54bb6cbe59bd113058854a3ee31448cf61f462ca. Reverify the existing downstream implementations in this exact order, treating each as locally implemented but unverified until its current-main evidence is recorded.

• Compound reference selection, paired reference-MV derivation, and equal averaging.
• Inter-intra prediction.
• Distance-weighted compound prediction.
• Wedge compound prediction.
• Difference-weighted compound prediction.
• OBMC.
• Scaled-reference prediction.
• Local warped prediction.
• Non-translational global prediction.
• Inter deblocking decisions and reference/mode deltas.

Verified equal-average compound checkpoint evidence on 2026-08-31:

• Refreshed the clean official libaom main checkout and audited the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. Reference selection and compound mode syntax match read_comp_reference_type and read_ref_frames in av1/decoder/decodemv.c; contexts match av1/common/pred_common.c; paired reference-MV construction and eight-entry extension match process_compound_ref_mv_candidate and setup_ref_mv_list in av1/common/mvref_common.c.
• Audited equal-average reconstruction against av1/common/convolve.c and av1/common/convolve.h. Corrected the unscaled 10/12-bit translational path so both references retain libaom's no-round compound intermediates until the sole final average and clipping step, including the larger first-round shift required for 12-bit horizontal intermediates.
• Added descending Vector512, Vector256, Vector128, and scalar high-bit-depth traversal to the existing semantic compound-prediction operator families. No per-block, per-row, or per-scanline allocation or copy was added.
• Added FeatureTestRunner coverage for 10/12-bit copy, horizontal, vertical, and separable subpixel prediction at widths 9, 17, 33, and 65, with an independent no-round bilinear oracle, row-padding sentinels, and explicit scalar comparison.
• Added a complete Av1BlockDecoder.DecodeBlock 10/12-bit half-sample regression whose expected result comes from the scalar no-round pipeline. The selected vector differs by one sample from the obsolete round-each-reference behavior, so the test proves the production branch selection.
• Refreshed the official libaom main remote immediately before verification and decoded the fixture's 5,465-byte AV1 mdat payload with current aomdec, one thread and row threading disabled. All 19 frames decoded; the final 19,200 YUV444 samples have SHA-256 E79D2F49C260B1AC9B1B9BBBB2D611126AFD3B241DA389EB9E7BD4EA0ED42080 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires decoded equal-average compound blocks, compares the final native Y, U, and V planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 31/31 on net10.0 and 31/31 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file, Roslynk reports zero compiler errors and no diagnostics in the changed files, and git diff --check passes. .gitattributes is unchanged.
• The completed checkpoint was committed as 4075a0844836e863a93cb2e2f3ca42d202c7df1b with author and committer James Jackson-South <james_south@hotmail.com>.

Verified inter-intra checkpoint evidence on 2026-08-31:

• Audited syntax against current libaom av1/decoder/decodemv.c and av1/common/blockd.h. ImageSharp applies the same sequence enable, skip-mode, block-size, and single-reference gates, reads the same four-mode CDF, and reads wedge syntax only within libaom's wedge-supported BLOCK_8X8 through BLOCK_32X32 range.
• Audited reconstruction against ii_weights1d, ii_size_scales, build_smooth_interintra_mask, and combine_interintra in current av1/common/reconinter.c. The ImageSharp weights, plane-size scaling, smooth-mask direction, complemented destination orientation, wedge sign, subsampling, and final 6-bit blend match. No production change was required.
• The mask tests cover all four inter-intra modes, complemented orientation, row-padding sentinels, and the 32-wide curve. FeatureTestRunner covers byte and high-bit-depth selectable blending under SIMD and scalar dispatch, and complete Av1BlockDecoder.DecodeBlock tests execute smooth inter-intra reconstruction at 8, 10, and 12 bits.
• Extracted the fixture's 5,327-byte AV1 mdat payload and decoded it with the refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8B776C2751DC30CA838931A4B74535FC6E681179568A1278747A38CFF2E5BFA and match the retained native reference with zero differing samples.
• The real production sequence requires both smooth and wedge inter-intra blocks, compares the final native Y, Cb, and Cr planes exactly, and compares final RGBA presentation through ImageSharp's established reference-output API. Its constrained 1,024-byte tracked-allocator run proves motion-field allocation and exactly one return for every allocation.
• The focused Release checkpoint set passes 50/50 on net10.0 and 50/50 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for both changed C# files. Roslynk reports zero compiler errors and no diagnostics in the changed files, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 18b1c881271a3494489ca6f410ab140544902e2d with author and committer James Jackson-South <james_south@hotmail.com>.

Verified distance-weighted compound checkpoint evidence on 2026-08-31:

• Audited reference-distance quantization against quant_dist_weight and quant_dist_lookup_table in current libaom av1/common/common_data.h, and audited order-hint distance selection and forward/backward reference assignment against av1_dist_wtd_comp_weight_assign in av1/common/reconinter.c.
• Audited reconstruction against current libaom av1/common/convolve.c. Corrected the production 10/12-bit subpixel path, which incorrectly finalized its two no-round compound intermediates with an equal average instead of the signaled distance weights. The fixed path applies libaom's 4-bit weighted shift before bias removal, final rounding, and clipping.
• Added descending Vector512, Vector256, Vector128, and scalar traversal to the existing semantic distance-weighted intermediate predictor family. Unsigned widening preserves the biased 12-bit intermediate range. No per-block, per-row, or per-scanline allocation or copy was added.
• Added FeatureTestRunner coverage for every current-libaom distance-weight class in both reference orders, and for 10/12-bit copy, horizontal, vertical, and separable subpixel prediction at widths 9, 17, 33, and 65, with an independent no-round oracle and row-padding sentinels.
• Added a complete Av1BlockDecoder.DecodeBlock 10/12-bit half-sample regression that selects the 13:3 distance weights through real order hints. Its first reconstructed sample differs from the old equal-average result, so the test proves the corrected production branch is executed.
• Extracted the fixture's 5,372-byte AV1 mdat payload and decoded it with the refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires decoded distance-weighted compound blocks, compares the final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 44/44 on net10.0 and 44/44 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors and no diagnostics in the changed files, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 7e2de7a2c25852acc374b17936a1a644464f77f3 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified wedge compound checkpoint evidence on 2026-08-31:

• Audited mask generation against current libaom tools/gen_wedge_masks_data.py and av1/common/reconinter.c, including the master prototypes, direction transforms, block-size codebooks, sign flips, offsets, and luma/chroma mask sampling. ImageSharp's generated masks match those definitions; only stale “pinned” documentation required correction.
• Audited reconstruction against current libaom aom_dsp/blend_a64_mask.c. The high-bit-depth d16 path applies the Q6 mask to both no-round intermediates before bias removal, the sole final rounding step, and clipping.
• Corrected the production high-bit-depth intermediate eligibility gate, which admitted only equal-average blocks and made the distance-weighted and wedge no-round finalizers unreachable. Average, distance-weighted, and wedge subpixel blocks now retain both intermediates until their signaled finalizer; difference-weighted blending remains excluded for its next ordered checkpoint.
• Added high-bit-depth traversal to the existing semantic mask-blend predictor and readonly operator family with descending Vector512, Vector256, Vector128, and scalar dispatch. Unsigned widening preserves the biased 12-bit intermediate range. No per-block, per-row, or per-scanline allocation or copy was added.
• Extended FeatureTestRunner coverage with an independent Q6 mask oracle across 10/12-bit copy, horizontal, vertical, and separable subpixel prediction, widths 9, 17, 33, and 65, all mask weights from 0 through 64, and row-padding sentinels. A complete Av1BlockDecoder.DecodeBlock regression verifies the current-libaom 8x8 wedge mask and the production no-round branch.
• Extracted the fixture's 5,374-byte AV1 mdat payload and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires both wedge-mask orientations, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 35/35 on net10.0 and 35/35 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 9883a24dc319e16b471f68be632d4f62f2c1cd5e with author and committer James Jackson-South <james_south@hotmail.com>.

Verified difference-weighted compound checkpoint evidence on 2026-08-31:

• Audited syntax against current libaom av1/decoder/decodemv.c. ImageSharp applies the same masked-compound enable and block-size gates, selects difference-weighted compound directly when wedge is unavailable, and reads the same one-bit type-38 mask orientation.
• Audited mask generation and reconstruction against current libaom av1/common/reconinter.c and aom_dsp/blend_a64_mask.c. The d16 path rounds the absolute intermediate difference by the convolution and bit-depth shift, scales it by 1/16, adds the type-38 base, clamps or inverts the mask, and then blends the original no-round intermediates before final rounding and clipping. Chroma reuses the luma-derived mask through rounded subsampling.
• Corrected the production 10/12-bit subpixel eligibility gate, which previously rounded both references before difference-mask construction and blending. Difference-weighted blocks now use the existing semantic intermediate mask-builder and mask-blend predictor/operator families through the sole final rounding step. No new operator family, per-block allocation, or copy was introduced.
• Renamed the stale “pinned formula” test and extended FeatureTestRunner's independent oracle across current-libaom regular and d16 mask arithmetic, both mask orientations, 8/10/12-bit samples, widths that cross every Vector512, Vector256, Vector128, and scalar boundary, subpixel phases, and row-padding sentinels.
• Added a complete Av1BlockDecoder.DecodeBlock regression for 10/12-bit half-sample prediction and both type-38 orientations. Its expected mask and reconstruction are calculated directly from the current-libaom equations, independently of the production mask builder and finalizer.
• Extracted the fixture's 5,358-byte AV1 mdat payload and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The real 19-frame production sequence requires both difference-mask orientations, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API, and repeats the complete decode with a 1,024-byte constrained tracked allocator and exactly-once return checks.
• The focused Release checkpoint set passes 37/37 on net10.0 and 37/37 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as fb4c64474e1ced4067a42731384f3b5ad4212a2f with author and committer James Jackson-South <james_south@hotmail.com>.

Verified OBMC checkpoint evidence on 2026-08-31:

• Audited motion-mode syntax against current libaom av1/decoder/decodemv.c, av1/common/blockd.h, av1/common/reconinter.c, av1/common/obmc.h, and av1/common/reconinter_template.inc. ImageSharp applies the same switchable-mode, skip, single-reference, inter-intra, minimum-size, overlappable-neighbor, fixed-global-motion, scaled reference, and projection-sample gates and reads the matching binary or three-way CDF.
• Audited above and left neighbor traversal, 4x4 pairing, neighbor caps, chroma suppression, prediction rectangles, interpolation filters, first-reference selection, mask tables, and blend order against current libaom. The existing semantic mask-blend predictor remains the correct SIMD-first traversal; no OBMC-specific operator family, allocation, or copy was introduced.
• Corrected the unscaled neighbor far-edge UMV clamp. After converting libaom's neighbor-relative motion-vector limits to an absolute source coordinate, the prediction extent cancels from the right and bottom limits; the previous code counted it twice.
• Extracted the fixture's 5,387-byte AV1 mdat payload at AVIF offset 1,065 and decoded it with refreshed current libaom aomdec, using one thread with row threading disabled. All 19 frames decoded. The final 19,200 YUV444 samples have SHA-256 E8CAA650F1571C5B9CACAF8C06E1DDF5F5D2ED35F65F1C34377076C573425899 and match the retained native reference with zero differing samples.
• The production sequence asserts decoded OBMC mode state, compares final native Y, Cb, and Cr planes exactly, compares final RGBA presentation through ImageSharp's established reference-output API under normal and scalar FeatureTestRunner dispatch, and repeats reconstruction with a 1,024-byte constrained tracked allocator. Direct DecodeBlock tests cover above-then-left blending at 8/10/12-bit and 4:2:0 and 4:2:2 chroma geometry.
• Renamed the stale pinned-reference test and its established reference-output PNG together. The PNG SHA-256 remains D2CB388C9092EF17C4F0382C0150DD30D6F9D0EE247FF45AB5D7D4D312CEB23C; only its contract-derived filename changed.
• The focused Release checkpoint set passes 18/18 on net10.0 and 18/18 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 7e7e3cbe6438d63926b31d966795d2652e221939 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified scaled-reference checkpoint evidence on 2026-08-31:

• Audited reference-size validation and variable-scale coordinates, filters, edge extension, convolution rounding, and compound intermediates against current libaom av1/common/scale.c, av1/decoder/decodeframe.c, and av1/common/convolve.c. The frame boundary accepts the same half-to-sixteen-times dimension range and requires at least one compatible selected reference.
• Corrected the production scaled-compound branch. It previously rounded each scaled reference into native pixels before blending; current libaom retains both CONV_BUF_TYPE values with COMPOUND_ROUND1_BITS equal to seven and performs one final rounding after the selected compound blend.
• Kept native-pixel and compound output in the existing Av1ScaledInterPredictor traversal with semantic NativeOperator and CompoundOperator output contracts. The closed generic traversal shares variable-phase arithmetic across byte and ushort sources, dispatches Vector512, Vector256, Vector128, then scalar, and adds no per-block allocation or copy.
• Added independent FeatureTestRunner oracles for native and no-round compound output across 8, 10, and 12 bits, variable phases, all interpolation families, reduced kernels, vector tails, and destination padding. A complete Av1BlockDecoder.DecodeBlock() regression covers scaled compound prediction across all, AVX-512-disabled, AVX-disabled, and scalar configurations and proves the vector differs from an incorrectly early-rounded blend.
• Decoded the 2,195-byte layered payload with refreshed current libaom aomdec, using one thread, row threading disabled, all layers selected, and raw 8-bit output. The 40x40 YUV444 base and 80x80 YUV444 dependent frames total 24,000 samples with SHA-256 DD219E41B52C6C9343A92CD0A2D451DF57B73B25F10124811675B4CB2F8D666F; both match their retained native references with zero differing samples.
• The production tests compare both native frames exactly, compare selected-layer and final RGBA presentation through ImageSharp's established reference-output API, and repeat both paths with a 1,024-byte constrained tracked allocator whose allocations have balanced exactly-once returns.
• Renamed the two stale pinned-reference tests and their contract-derived PNGs together. Their Git blob identifiers remain unchanged, and their SHA-256 values remain DC4C6DBE6BD92C5FCE1E3E23700AFA603EF04ED02EDD336213EBBA1E3BD84BA0 and 678C5E5D4650EA6F0C590302E7DB9E3C6608851BC577453DA4A6837BDB4D3AF3.
• The focused Release checkpoint set passes 10/10 on net10.0 and 10/10 on net11.0, with zero failures or skips. Scoped analyzer and whitespace verification pass for every changed C# file. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 658a9cd1b6e22806decbae923da8800bca03a09e with author and committer James Jackson-South <james_south@hotmail.com>.

Verified local warped-prediction checkpoint evidence on 2026-08-31:

• Refreshed the clean official libaom main checkout and audited the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. Motion-mode eligibility and CDF selection match read_motion_mode in av1/decoder/decodemv.c; above, left, top-left, and top-right spatial projection samples and threshold selection match findSamples and selectSamples in av1/common/mvref_common.c; affine fitting, shear reduction, phase derivation, filters, rounding, clipping, and invalid-model fallback match av1/common/warped_motion.c and av1/common/reconinter.c.
• Mechanically compared all 1,544 ImageSharp and independent-test warped-filter coefficients against current libaom's av1_warped_filter; both comparisons have zero differences. The separate scalar test transcription covers 8-, 10-, and 12-bit luma and subsampled-chroma coordinates, tail widths, destination stride preservation, libaom's 12-bit round adjustment, and AVX-512, AVX, 128-bit, and scalar dispatch through FeatureTestRunner.
• Extracted the fixture's exact 2,310-byte AV1 mdat payload at AVIF offset 997. Its SHA-256 is 644D04FE1D1A32BB7A3856AD7EB49CF1EFDE0AC845E55BEAC4170F72353F2391. Current official libaom decoded both 256x256 YUV444 frames with one thread, row threading disabled, and all layers enabled. The complete Y4M SHA-256 is 8FDC5D46014F5E5A7455A83643AB6F0DA66FC5A984E72A43F8C75BAD8271C299; the final frame's 196,608 native samples have SHA-256 47B2AB39BF3B9DA15C1EC59840F964DFDF227760947F6E1295FB38A84555F75C and match the retained native reference with zero differences.
• The real two-frame fixture exercises Av1BlockDecoder.DecodeBlock(), requires decoded WARPED_CAUSAL state and the expected multi-sample affine model, compares final native Y, U, and V planes exactly, compares the retained final presentation through ImageSharp's established reference-output API, and passes through intrinsic and scalar dispatch. The 1,024-byte constrained tracked-allocator path passes with motion-field allocations present and balanced exactly-once returns.
• Renamed the stale pinned-reference test and its contract-derived PNG together without changing the PNG bytes. Its SHA-256 remains 4490D62FB6679378E92CACA48427359091AD2106BE49FC1A3848F78BE03BEEB1.
• The focused Release checkpoint set passes 4/4 on net10.0 and 4/4 on net11.0, with zero failures or skips. Scoped analyzer verification passes for both changed C# files. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 27a522424fe7aaea25078e705d71a501da110727 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified non-translational global-prediction checkpoint evidence on 2026-08-31:

• Audited global-motion syntax, coefficient decoding, previous-reference recentering, shear validation, motion-vector projection, and warped-prediction eligibility against current official libaom main at the observed revision 441c439b9916474cac15d2822af47a9ad70674a8. The implementation matches read_global_motion_params, read_global_motion_model, gm_get_motion_vector, is_global_mv_block, and the WARP_PRED selection in av1/common/reconinter.c.
• Corrected high-bit-depth compound warped/global prediction to retain both references in libaom's unsigned no-round compound domain. Current get_conv_params_no_round, av1_warp_plane, and av1_highbd_warp_affine_c require the 12-bit first-round adjustment while retaining a seven-bit second round; native clipping now occurs only after the compound blend.
• The independent scalar libaom transcription validates native and no-round compound output for byte, 8-bit, 10-bit, and 12-bit sources, including tail widths and destination-stride preservation. All cases pass through AVX-512, AVX, 128-bit, and scalar dispatch with FeatureTestRunner. Direct Av1BlockDecoder.DecodeBlock() coverage validates GLOBAL_GLOBALMV compound reconstruction at all supported bit depths.
• Extracted the fixture's exact 38,475-byte AV1 mdat payload at AVIF offset 997. Its SHA-256 is 6AC7EC9984B1FF5C00403D7E3858441E9CEE75128F7414101D06DEEE59A351D0. Current official libaom decoded both 256x256 YUV444 frames with one thread, row threading disabled, and all layers enabled. The complete Y4M SHA-256 is 84754DE0B9FABC4F3F8F344C848183EC17B625BFD87E4519C3D8AD7DEFD20F2C; the final frame's 196,608 native samples have SHA-256 FEC89E2DE7496980389806B194425042F3800C7BAA817249D1A51D44A2B37A8E and match the retained native reference with zero differences.
• The real two-frame fixture exercises the production decoder, requires decoded non-translational global motion, compares final native Y, U, and V planes exactly, compares the retained presentation through ImageSharp's established reference-output API, and passes the constrained tracked-allocator path.
• Renamed the stale pinned-reference test and its contract-derived PNG together without changing the PNG bytes. Its SHA-256 remains F7D27ABF79450DFA311F72106FD1DA80997EABC0937F2F5578EF627119FF83B0, and Git attributes select the LFS filter and diff driver.
• The focused Release checkpoint set passes 11/11 on net10.0 and 11/11 on net11.0, with zero failures or skips. Scoped analyzer verification passes for all six changed C# files. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as 25295683d39a2336e9b98484c9fd54f33107ea66 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified inter-deblocking checkpoint evidence on 2026-08-31:

• Audited frame-level loop-filter syntax and primary-reference inheritance against setup_loopfilter in current av1/decoder/decodeframe.c; per-superblock delta-LF parsing and prediction against read_delta_q_params in av1/decoder/decodemv.c; and default reference/mode deltas against av1/common/entropymode.c at observed current-main revision 441c439b9916474cac15d2822af47a9ad70674a8.
• Audited filter-level derivation, segmentation adjustment, reference scaling, global/non-global mode classes, skipped-transform prediction-unit decisions, transform-edge selection, kernel length, sharpness limits, and vertical-then-horizontal traversal against get_filter_level, set_lpf_parameters, av1_filter_block_plane_vert, av1_filter_block_plane_horz, and av1_thread_loop_filter_rows. No production arithmetic change was required.
• Added direct production Av1LoopFilterDecoder.DecodeFrame() coverage using adjacent skipped 16x8 inter blocks split into 8x8 transforms. An independent scalar oracle proves that internal transform edges remain untouched and the prediction-unit edge uses current-libaom levels 17 for LAST/GLOBALMV, 21 for LAST/NEWMV, and 22 for GOLDEN/GLOBALMV. Existing FeatureTestRunner coverage continues to verify every filter width at 8, 10, and 12 bits under intrinsic and scalar dispatch.
• Current official libaom decoded the retained 20,750-byte 8-bit, 37,169-byte 10-bit, and 23,769-byte 12-bit elementary streams with one thread, row threading disabled, raw output, and their native output depths. The generated native files match the retained references byte for byte. Their output SHA-256 values are 8DDE2EEC742C39F0579C29AE84CBA0FE01522A9008ADCB2CFFCCEC0295D18141, 9A59DD92A0C579F942ACCA8281EBD0465DC848BE200A4D2FF57EAFF589445F6C, and EF712BE32AF7CF0A95C5C41BDCC51AFC05A4AB7C047383F5F65EDAD2BB986712.
• Reused the already current-main scaled-reference sequence as the real inter checkpoint. It requires an inter frame with reference/mode-delta processing enabled, nonzero chroma filter levels, intra, inter, and skipped-inter blocks; compares both decoded native frames exactly; compares final presentation through ImageSharp's established reference-output API; and passes constrained tracked allocation with balanced returns.
• Removed an obsolete SVT-AV1 design link from mode-map documentation. Current official libaom remains the sole external codec implementation source.
• The focused Release checkpoint set passes 6/6 on net10.0 and 6/6 on net11.0, with zero failures or skips.
• Scoped analyzer verification passes for all four changed C# files. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• The completed checkpoint was committed as fcb502e4960cc7b8efb06b6f060e2c73a913a2bf with author and committer James Jackson-South <james_south@hotmail.com>.

For every item:

• Trace syntax and arithmetic to the current libaom main tree.
• Execute the real production decoder path.
• Compare native planes exactly.
• Compare presentation through the established reference-image API.
• Run constrained allocator and exactly-once ownership coverage.
• Run FeatureTestRunner for SIMD and scalar dispatch when the implementation has SIMD.
• Record focused Release evidence before marking the item verified.

4. Close AV1 decoder coverage

Previously verified algorithm checkpoints remain valuable evidence, but the final decoder gate requires a fresh current-tree run after the inter and cleanup corrections.

• Bounded OBU framing, sequence headers, frame headers, tile groups, alignment, and trailing-bit parsing have been re-audited and verified against current libaom main.
• Partition traversal, mode information, segmentation, delta quantization, transform-size selection, coefficient decoding, inverse quantization, and inverse transforms have been re-audited and verified against current libaom main.
• Intra prediction covers directional, DC, smooth, Paeth, chroma-from-luma, filter-intra, and palette families with the established operator architecture.
• Intra-block copy has exact native reconstruction and feature-isolated SIMD evidence.
• Lossless inverse transform, loop filtering, CDEF, super-resolution, restoration, and film grain have focused checkpoint evidence.
• Retained references, CDF snapshots, segmentation maps, global motion, temporal motion fields, and dependent-frame lifecycle have been re-audited and verified against current libaom main.
• The 12-case all-intra profile matrix covers every valid 8, 10, and 12-bit monochrome, 4:2:0, 4:2:2, and 4:4:4 combination. Dependent-frame coverage is recorded separately above.
• The exact current-tree native-plane matrix passes through the production decoder on net10.0 and net11.0. The normal-dispatch and FeatureTestRunner fallback methods pass 2 of 2 focused tests on each target.
• The exact current-tree presentation matrix passes 12 of 12 cases through ImageSharp's established reference-image API on net10.0 and net11.0.
• Verify malformed/truncated data, frame IDs, reference slots, tile bounds, allocation limits, cancellation, and failure unwinding.
• Verify still items and bounded sequences from file, memory, non-seekable, and short-read streams.
• Verify ICC, CICP, alpha, grids, pixel aspect ratio, clean aperture, rotation, mirroring, metadata, and every presented sequence frame.
• Complete the public AVIF format/API review so registered capabilities match implemented behavior.
• Remove or reject every valid in-scope AV1 syntax branch that remains silently ignored or unsupported.

Verified negative-path and frame-identifier gate evidence on 2026-08-31:

• A two-frame lossless frame-identifier sequence was generated and decoded with the clean official libaom main checkout at observed revision 441c439b9916474cac15d2822af47a9ad70674a8. Both decoded frames match the source Y, Cb, and Cr samples exactly.
• DecodeFrameIdentifiersMatchReference executes the production decoder through FeatureTestRunner, compares both native frames exactly, and proves the second frame is dependent with a changed current frame identifier. The current-frame, reference-delta, stale-slot, and refreshed-slot identifier logic was audited against the same current main source.
• The focused negative-path set passes 46 of 46 cases on net10.0 and 46 of 46 on net11.0, with zero failures or skips. It covers truncated palette entropy, malformed-following-OBU recovery, parser lifecycle failure, overflowing and invalid tile bounds, reference-slot ownership and transfer, constrained multi-group allocation, motion-field allocation failure unwinding, and frame identifiers.
• The established paused-stream cancellation suite now includes AVIF. It verifies cancellation at 0%, 30%, and 70% of both file and memory streams, plus pre-cancelled identification, on both targets.
• The completed checkpoint was committed as 7f0e08126b3354e8f1eb45886f0d572006ae27de with author and committer James Jackson-South <james_south@hotmail.com>.

Verified bounded-OBU checkpoint evidence on 2026-08-31:

• Audited av1/decoder/obu.c, av1/decoder/decodeframe.c, av1/common/obu_util.c, av1/common/tile_common.c, aom/src/aom_integer.c, and aom_dsp/bitreader_buffer.c in the clean official libaom main checkout. Both HEAD and origin/main resolved to the observed revision 441c439b9916474cac15d2822af47a9ad70674a8; this is verification evidence, not a pin.
• The bounded container scanner and production OBU reader now agree with current libaom on ignored reserved header fields and the shared unsigned 32-bit LEB128 limit.
• Sequence-header validation now rejects undefined level indices, initial display delays above ten, frame identifiers above sixteen bits, zero timing units, the UVLC overflow sentinel, and invalid identity-matrix profile or subsampling combinations at the owning syntax boundary.
• Frame and tile parsing now rejects show_existing_frame in a combined OBU_FRAME, the all-slots intra-only refresh mask, inner tile columns below current libaom's super-resolution-aware minimum, overflowing or out-of-bounds tile sizes, and empty final tile payloads.
• The still-image writer now emits the required zero tile-bound-presence bit for a multi-tile combined OBU_FRAME, matching current libaom's single-tile-group encoder path.
• ObuFrameHeaderTests and ObuFrameLifecycleTests cover the corrected syntax through the real bounded parser. The focused parser set passes 50 of 50 cases on net10.0.
• The final focused production set passes 55 of 55 cases on net10.0 and 55 of 55 on net11.0, with zero failures or skips. It includes exact final-layer and selected-layer native planes, exact established reference-image presentation, constrained allocator ownership, malformed-following-OBU recovery, and FeatureTestRunner normal, AVX-512-disabled, AVX-disabled, and scalar execution.
• A fresh direct foreground current-main aomdec run decoded both progressive layers with one thread and row multithreading disabled. All 2,178 Y, U, and V samples match the retained YUV444-alpha reference; the alpha plane is excluded from the AV1 native-plane comparison.
• The current-libaom production reference test and its established PNG were renamed together. The PNG bytes remain unchanged at SHA-256 0758C17DC36E38AEE9F4389A335C2BF332AB91E4C79D7B0B22994FDDD0FD1605, both paths resolve to diff=lfs, and .gitattributes was not edited.
• Release source builds pass for net10.0 and net11.0 with zero warnings and zero errors. Roslynk reports zero compiler errors, and scoped production and test analyzer verification reports no changes.
• The completed checkpoint was committed as 243524c2c0b52a49d8d161fab806ab092cabe47c with author and committer James Jackson-South <james_south@hotmail.com>.

Verified partition, mode, segmentation, quantization, and transform checkpoint evidence on 2026-08-31:

• Audited partition traversal and chroma representability against read_partition and the subsampled plane-size rejection in current libaom av1/decoder/decodeframe.c; spatial segment-ID decoding and corruption handling against read_segment_id in av1/decoder/decodemv.c; delta-Q syntax, resolution, arithmetic, and clamping against read_delta_qindex and read_delta_q_params in the same file.
• Audited selected and variable transform-size traversal against read_tx_size, read_tx_size_vartx, and transform-block traversal in av1/decoder/decodeframe.c; coefficient syntax and arithmetic against av1_read_coeffs_txb in av1/decoder/decodetxb.c; inverse quantization and transform application against current av1/decoder/decodeframe.c, av1/common/idct.c, and the current libaom transform test oracle. The observed clean HEAD and origin/main revision was 441c439b9916474cac15d2822af47a9ad70674a8; this is verification evidence, not a pin.
• Partition decoding now rejects an invalid partition subsize and a block size that cannot represent the current subsampled chroma plane. Spatial segmentation rejects decoded IDs above the active segment range. Focused tests exercise both current-libaom corruption boundaries through the production tile reader.
• Coefficient entropy decoding uses one allocator-owned maximum-size Av1LevelBuffer per tile reader. Each transform resets and clears only its active padded geometry, so no transform creates an allocation. Allocation tracking over all eight minimum- and maximum-quantizer frames proves exactly one coefficient scratch allocation per frame and exactly-once return after decoder disposal.
• Palette index maps use two allocator-backed 128x128 decoder-session scratch buffers, one for luma and one for chroma. Each parsed superblock is reconstructed before either buffer is reused, and each block clears only its transient Buffer2DRegion view after prediction. The fixed 32 KiB session cost replaces the former two full-frame maps without copies or per-block allocations. A 1 KiB constrained allocator splits both buffers across memory groups. The four-case palette set passes on net10.0 and net11.0 with exact native and presentation output, truncated-entropy rejection, and balanced exactly-once disposal.
• Av1BlockModeInfo is value storage, removing the managed object allocation formerly created for every decoded coding block. Explicit ModeInfoIndex values preserve libaom's mode-info identity semantics at prediction-unit loop-filter edges, and the frame map now uses integer offsets so more than 65,535 decoded blocks cannot wrap its lookup identity.
• Current official libaom reproduced the 39-frame all-intra reference and all four 8/10-bit minimum- and maximum-quantizer references byte for byte. The production tests compare every native sample exactly, cover every intra mode and seven selected transform types, execute SIMD and scalar paths through FeatureTestRunner, and exercise the quantizer sequences under constrained tracked allocation.
• Current official libaom decoded the 42-byte palette payload into the retained 1,089-byte YUV444 reference at SHA-256 E05F7C0DF06ECCF0E43869D1D7B03DAA1D635ACD26A766F8940899BE18D53251. The exact native test requires luma and chroma palette syntax. The established reference-output test uses the unchanged presentation PNG at SHA-256 1148EBF6AA4B0F2D069D5E9B9605F6FB2A315E525F18016CDCAE23EFDD81DA84, whose renamed path still resolves to diff=lfs; .gitattributes was not edited.
• The exact final AV1 namespace passes 8,732 of 8,732 cases on net10.0 and 8,732 of 8,732 cases on net11.0, with zero failures or skips. Release source builds pass for net10.0 and net11.0 with zero warnings and zero errors. Roslynk reports zero compiler errors, and scoped analyzer verification reports no changes.
• The completed checkpoint was committed as 57a3f6668e39d0934e7b6b8d37a3dc2a5adc88f0 with author and committer James Jackson-South <james_south@hotmail.com>.

Verified retained-frame lifecycle checkpoint evidence on 2026-08-31:

• Audited primary-reference entropy selection, independent per-tile CDF starts, context-update-tile publication, segmentation-map inheritance, reference-map refresh, and show-existing key-frame reset against current libaom av1/decoder/decodeframe.c, av1/decoder/decodemv.c, av1/decoder/decoder.c, and av1/common/entropymode.c.
• Audited retained motion-vector cells, reference-side classification, projection source ordering, projection limits, and reference-frame publication against av1_copy_frame_mvs, av1_calculate_ref_frame_side, motion_field_projection, and av1_setup_motion_field in current libaom. Same-role primary-reference global-motion inheritance remains covered by the exact current-main global-warp fixture. The observed clean HEAD and origin/main revision was 441c439b9916474cac15d2822af47a9ad70674a8; this is verification evidence, not a pin.
• Current official libaom decoded the retained cdfupdate, mfmv, svc-L2T1, svc-L1T2, and svc-L2T2 streams with one thread, row threading disabled, and eight-bit output depth. Their generated Y4M files match the retained references byte for byte at SHA-256 4FBFF73FF0DE2D9084DAE557D1D4BD677B0486516525BF4D327D2D795D5A7779, F7DB607694818C19E62FD9A27F53E1A3E2D00B72C39C0430C1B26399CC76777D, 7A427631ECBF144F435AA4612F1201415FB1A9BCF9A67BA010AEF830B0C3AB81, 4012DE2D4AFD095E7BB68EAE18B50B0674781BB4971CECABC0E5471E63373ED3, and 1ABB981CFF76BA9557DA437B258D8A95FCA755DED8E3949D857E8388AB1D6AE3.
• Existing allocation-tracking tests exercise initialization, retained-slot aliases, allocation-failure unwinding, presentation ownership, decoder-result ownership, repeated disposal, and final exactly-once return of reference frames, frame-owned motion fields, entropy snapshots, and segmentation maps.
• The focused Release checkpoint set passes 54 of 54 cases on net10.0 and 54 of 54 cases on net11.0, with zero failures or skips. It includes exact native CDF-update, motion-field, spatial-layer, temporal-layer, spatial-temporal-layer, progressive dependent-frame, and global-warp production paths, plus constrained allocator coverage.
• Release source builds pass for net10.0 and net11.0 with zero warnings and zero errors. Roslynk reports zero compiler errors, scoped analyzer verification reports no changes, git diff --check passes, and .gitattributes is unchanged.

Final decoder allocation, lifetime, precision, architecture, and test-validity audit evidence on 2026-09-01:

• Refreshed the official libaom remote and audited against observed origin/main 976867526367f571a1c09b994066af8364aed781. The intervening external-rate-controller commit does not change av1/decoder, av1/common, aom_dsp, or the AV1 decoder build definition.
• CDEF now uses one bounded 64x64-unit bordered source workspace, two preserved top-row slots per plane, preserved left columns, and unit-local direction and variance storage. This replaces the frame-wide source copy and frame-wide direction maps while retaining libaom's unit traversal and cross-plane luma-direction lifetime.
• Loop restoration now retains the required immutable source and separate destination, but stores the full destination in native sample width. Eight-bit filtering narrows only bounded unit output after clipping, while high-bit-depth filtering writes directly to the native ushort destination.
• Reference-to-presentation copying now copies visible native rows only. Padding remains destination owned, and the ownership tests mutate a copied visible sample rather than unrelated padding.
• The remaining decoder allocations and copies are either bounded scratch or required ownership boundaries. Frame planes enforce their contiguous single-span invariant before allocation; palette, transform, film-grain, super-resolution, color-conversion, and alpha workspaces remain bounded and allocator owned. No per-block managed allocation remains in reconstruction.
• Valid unsupported tile-list syntax is rejected explicitly. Reserved and metadata OBUs are consumed only after bounded framing and trailing-bit validation. Eight-, ten-, and twelve-bit reconstruction, presentation, alpha, restoration, and film-grain paths retain native precision.
• Predictor traversal remains split into semantic readonly operator families. The planar sample adapter and transform-block context are value types, and Release construction sites use default without null-forgiving suppression.
• The net11.0 Release test project builds with zero errors. Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged.
• Visual Studio 18.9 VSTest ran the complete Formats.Heif.Av1 namespace with collection parallelism disabled and stop-on-failure enabled: 8,746 of 8,746 cases passed. The touched HeifDecoderTests and HeifSequenceParserTests add 104 of 104 passing integration cases. Focused CDEF, restoration, film-grain, copy-ownership, and reference-isolation runs also pass 15 of 15 cases. No test-host crash or Windows application-error dialog occurred.

Final decoder stream, presentation, and public-registration evidence on 2026-09-01:

• Real AV1 still-item and timed-sequence files decode identically from a file stream, memory stream, non-seekable stream, and a seekable stream limited to three bytes per read. All eight stream rows pass through public format detection and production decoding, comparing every presented frame exactly.
• A two-frame production sequence applies a centered clean-aperture crop, counter-clockwise rotation, mirroring, pixel-aspect-ratio metadata, and CICP metadata to every frame. The complete five-frame real auxiliary-alpha sequence composes non-opaque alpha and retains timing, Exif, and XMP for every frame.
• The fixed-header detector accepts both compact and extended-size leading file-type boxes. Default configuration registers the implemented HEIF decoder and detector but no longer advertises the incomplete HEIF encoder.
• Visual Studio 18.9 VSTest, serialized with stop-on-failure enabled, passes the 12 of 12 new stream/presentation/registration cases and the complete current HeifDecoderTests plus HeifSequenceParserTests set with the registration contract: 115 of 115. The final explicit no-encoder registration assertion passes 1 of 1 after its final edit.
• The net11.0 Release test project builds with zero errors, Roslynk reports zero compiler errors, git diff --check passes, and .gitattributes is unchanged. Every VSTest invocation returned normally with no surviving test host and no Windows application-error dialog.

Decoder exit gate:

• Every supported native format and AV1 tool has exact current-main libaom production-path evidence.
• Every supported presentation behavior has established reference-image evidence at the correct output precision.
• No decoder path relies on a native codec, copied plane, per-block allocation, or contiguous memory-group accident.
• All allocator ownership is deterministic and exactly once.
• Full focused Release verification is recorded with no false coverage claims.

AV1 encoder implementation

Writer primitives are not an encoder. The public encoder remains incomplete until it produces independently decodable AV1 payloads and AVIF containers for every exposed option.

5. Define and enforce the encoder contract

• Finalize observable options for quality, effort, lossless mode, bit depth, chroma subsampling, alpha quality, metadata, and bounded sequences.
• Preserve high-bit-depth source precision through 16-bit RGB and native 10/12-bit component planes.
• Reject unsupported combinations at the public boundary before writing output.
• Register only capabilities that the completed encoder proves.

6. Build the complete AV1 frame encoder

• [~] SIMD-first RGB-to-native-plane conversion exists locally.
• [~] Forward transform families and transform workspace exist locally.
• [~] Symbol writer, coefficient writer, and tile writer fragments exist locally.
• Connect a frame-owned encoder lifecycle using ImageSharp allocators and pools.
• Write compliant temporal delimiter, sequence header, frame header, tile group, metadata, and padding OBUs as required.
• Implement superblock and partition analysis for every permitted block size and partition.
• Implement intra mode search, chroma mode search, palette, filter intra, chroma-from-luma, and intra-block copy decisions.
• Implement inter mode search for bounded sequences, including reference selection and the decoder-supported inter tools.
• Implement transform-size/type search, forward transform, quantization, coefficient optimization, and lossless behavior.
• Implement real rate-distortion selection and make quality and effort change work, size, and output quality.
• Implement tile-local entropy coding and CDF update behavior.
• Implement legal deblocking, CDEF, restoration, super-resolution, and film-grain signaling decisions.
• Remove per-transform and per-block managed allocations from active encoder paths.
• Use descending SIMD dispatch: Vector512, Vector256, Vector128, then scalar.
• Verify every SIMD operator with FeatureTestRunner and an independent scalar oracle shaped from the same current-main libaom behavior.

7. Write complete AVIF output

• Write the correct AVIF file type, item information, locations, references, properties, AV1 configuration, dimensions, color, alpha, metadata, and media data.
• Support single images, alpha auxiliary images, grids, multiple extents, and bounded image sequences in the final public scope.
• Preserve ICC, Exif, and XMP according to encoder options.
• Write CICP, range, chroma position, bit depth, and subsampling values that match the encoded planes.
• Apply orientation and clean-aperture behavior consistently with ImageSharp encoder conventions.
• Stream output through allocator-backed chunked storage without file-sized copies or ToArray materialization.

Encoder exit gate:

• Current-main libaom accepts every produced AV1 payload.
• Lossless output is exact at native-plane and final-pixel precision.
• Lossy output demonstrates recorded quality and effort tradeoffs with absolute size, quality, timing, and allocation evidence.
• 8, 10, and 12-bit monochrome, 4:2:0, 4:2:2, and 4:4:4 outputs pass.
• Alpha, grids, metadata, color profiles, transforms, and bounded sequences pass.
• ImageSharp decode of its own output is supplemental coverage only, never the sole oracle.
• Public encoding no longer throws for a supported AV1 request.
• Focused Release and FeatureTestRunner verification passes with exact recorded evidence.

Architecture rules

• Follow the JPEG color-converter operator architecture exactly.
• Each distinct prediction traversal owns a family-named predictor type.
• The family .Operator.cs file defines the nested static operator contract.
• Each semantic readonly struct belongs to that owner and implements concrete scalar, Vector128, Vector256, and Vector512 arithmetic for the shared traversal.
• Do not place a distinct predictor beneath a broad Av1IntraPredictor or Av1InterPredictor.
• Do not create semantic forwarding wrappers, top-level operator types, hardware-width-named operator types, CRTP contracts, or one file containing unrelated semantic operators.
• Forward transforms belong to Av1ForwardTransformer and its semantic operator files.
• Inverse axis transforms belong to Av1Inverse2dTransformer and its semantic operator files.
• Reconstruction output operators belong to Av1InverseTransformer.
• Shared lane primitives belong only in explicitly named Operations types.
• Dispatch from widest to narrowest supported SIMD width, then execute one scalar tail.
• Keep codec execution sequential. Do not add parallel execution inside the codec.
• Do not allocate per row, block, transform, scanline, or SIMD tail.
• Use ImageSharp allocators and pools. Do not use ToArray to cross an ownership boundary.
• On internal types, use public members when other types consume them; reserve private members for type-local behavior.
• Use established ImageSharp test data, allocator tracking, FeatureTestRunner, and reference-image comparison APIs. Do not build custom substitutes.
• Public XML documentation describes observable behavior only.
• Inline comments explain the current-libaom numerical rule, ownership boundary, edge extension, entropy ordering, or SIMD shape at technically complex points.
• Every multiline statement or declaration is followed by vertical whitespace.
• Do not edit .gitattributes directly.
• Do not install or download tools without explicit permission.

Final verification matrix

• Release source build: net10.0, zero errors.
• Release source build: net11.0, zero errors.
• Scoped semantic inspection: zero compiler errors attributable to this work.
• Focused decoder syntax, reconstruction, ownership, presentation, and malformed-input tests.
• Focused encoder syntax, payload, container, precision, ownership, and option tests.
• FeatureTestRunner coverage for normal, narrower SIMD tiers, and scalar fallback.
• Constrained multi-group allocator coverage with balanced exactly-once returns.
• Exact native-plane comparisons against current-main libaom.
• Established final-presentation comparisons at the target pixel precision.
• Scoped StyleCop and vertical-whitespace inspection.
• No stale unsupported capability claims or removed-code references.
• No restore-source failures, background test hosts, detached processes, or crash-report popups.
• .gitattributes unchanged.
• git diff --check clean.
• Documentation records exact commands, counts, current-main reference revision evidence, and results.
• Commit only after the relevant checkpoint is genuinely complete.
• Do not push.