Versioned compatibility evidence

Fixture declarations, executed comparisons, source coverage, and release publication have different identities and denominators.

The AV1 encoder entropy corpus retains ten complete files from standalone pinned libavif/libaom builds, with Pillow/dav1d decoded pixels. It contains twelve independently inspected tile payloads: monochrome, 4:2:0/4:2:2/4:4:4, alpha, two-column tiling, lossless, and 8/10/12-bit samples. Original and instrumented builds each encode every file twice with identical results. All twelve tile payloads bind uniquely to finished native writers; unmodified libaom replay matches every logical state, CDF update and final byte. This is native encoder evidence, not Pillow save() parity or a Rust execution result.

The 76 hashed artifacts total 1,468,557 bytes. Gzip traces retain expanded lengths and hashes; prepared planes, replay inputs, syntax reports, complete files, pixels, instrumentation patch and build identities remain separate. Committed tiles exhibit 252 normalization flushes and 89 carry changes, including a two-byte carry. Separately labelled native models cover alphabets 2–16, probability endpoints, CDF plateaus, frozen adaptation, counter thresholds and empty/short termination. They are not full-file syntax claims. The generator is scripts/generate_av1_encoder_refs.py; its C observers under scripts/av1_encoder_oracle/ are development tools, excluded from the crate. The Rust entropy/tile writer, image analysis and full AV1 compressor remain unimplemented. No roadmap or matrix status is promoted; Rust behavioral tests and managed coverage remain deferred.

The 2026-09-17 private still-container candidate has a 28-file native mux corpus. Pinned Pillow/libavif/libaom observations repeat exactly, including complete encoded bytes and decoded pixels. Sixteen files correspond to registered planned still rows; twelve supplemental files cover orientation, combined alpha/metadata and actual media reuse within and across item boundaries. The corpus has 105 hashed artifacts totaling 314,731 bytes and retains clean libavif source, native binary, generator, source image and manifest identities.

The Rust writer consumes semantic descriptors and encoded/metadata payloads; expected serialized boxes and output offsets are excluded from its inputs. Deferred tests compare complete containers, output limits and separate model error/interruption states. The source-derived 10/12-bit descriptor handling has no native encode witness yet; all 28 files are 8-bit. AV1 compression and metadata preparation remain unimplemented, so public encoding is still unavailable and no matrix row is promoted. Rust behavioral execution and managed coverage remain deferred; historical measurements below are unchanged. All 16 strict compile configurations pass across native and both WASM targets, with AVIF-only/all features and ordinary/coverage modes, plus native default and no-codec lanes. Warnings-as-errors rustdoc, formatting and static checks pass. The current exact guard inventory is 543 across 89 files; these added guards are provenance records, not coverage exclusions or a new measurement.

Historical release 0.1.2

Version 0.1.2 passed main CI and release CI at 70190214a0711223302c76ab58e76c097288d80b. The published crate matches the GitHub checksum manifest, with SHA-256 e53037e57d0c5cae052ba94851c8cf72a80b9dfe195cd21b166506ab7bdbeb3b.

The 2026-09-15 all-feature release coverage run recorded 95,473/161,451 lines, 14,912/32,258 branches, 4,859/9,244 functions, and 140,609/241,503 regions. The release floors are respectively 59%, 46%, 52%, and 58%. The complete target retains 100%; a floor pass is not complete coverage. All executed comparisons remain mandatory.

Maintained fixture matrix

The retained matrix contains 1,567 total rows: 1,170 decode / inspect / verify rows and 397 encode rows. Of those, 1,170 decode rows and 365 encode rows are active. Planned rows stay outside executed parity numerators. Active rows have operation-specific outcomes, including not-applicable results.

Generated capabilities distinguish declarations and actual native/all-feature fixture observations. A WASM cross-compile does not extend that pixel-evidence scope.

Decoder validation — 2026-09-20

The full public matrix passes all 46 tests, including 343 AVIF rows and exact native comparisons of complete animations. All native, WASI and browser-WASM feature lanes pass. High-depth, HDR and animation additions are on main, awaiting the next release; the 32 AVIF encoder rows remain planned.

A fresh local make coverage run passes every executed test and the unchanged release floors: 99,349/163,373 lines (60.8112%), 15,524/32,418 branches (47.8870%), 5,052/9,372 functions (53.9053%), and 145,689/243,793 regions (59.7593%). This is LLVM evidence, not a new managed Coverage MCP snapshot. The changed-line review observes 274/294 executable lines in the seven changed AV1 modules. Unobserved lines include defensive failures and the Wiener stripe branch; this is not complete line or branch coverage.

The local reports live under target/release-evidence/: coverage.json, coverage.lcov, and avif-fix-coverage.json. The last receipt retains source and input hashes and the exact uncovered line list. CI produces a fresh report for each pushed commit and retains it as the llvm-coverage artifact.

Historical claim ledger

The following source-bound baseline was measured on 2026-08-27. Its historical percentages must not be relabeled as current-release coverage. The validator checks the historical manifest/matrix bytes at the measured Git revision, Coverage MCP identities, and separately checks current fixture integrity. The public rendering is centralized here so copied prose cannot drift across guides.

Current claim-ledger baseline (not current HEAD): - Measured revision: 93ec80ec99c42671dce6cf70694bce27ad8a2ef4. - Coverage MCP run: ec4c4bbd-dbda-4e49-8109-d7da07722dc0; snapshot: 7665cda3-f4a7-4568-b871-a9d34afaa92c. - Coverage: 100,389/110,015 lines (91.2503%), 12,861/14,246 branches (90.2780%), 5,125/5,794 functions (88.4536%), and 150,221/166,375 regions (90.2906%). - Measured manifest SHA-256: c1a1cccd485d066ffbe206a6e1577a1788aff8d4f288e4e8f8a933fa3c62ae7b; measured matrix SHA-256: f26151b3811aaab58556da422f476b714b5fac5925ff5b97807904096b4d2d58. - Current fixture integrity only: manifest a733f11e94ba5054259726c9608da8d17e6a3ca2d6d3e757b8c89fe18d0c1476; matrix 2919ec08515c562a0bcd1f3531845a615fb026278b319e456515a463ce1a0bc5.

The larger current source denominator and the historical source denominator are not interchangeable. Selected incremental runs cannot substitute for a full fresh report. Keep the original raw reports and context rather than attaching old identities to new measurements.

The ledger's fixture-manifest hashes track current-file integrity. Updating those hashes does not extend the historical coverage run to new code, guards, or unexecuted regressions. The 2026-09-17 AVIF temporal-candidate repair remains unverified by Rust execution, as recorded in the roadmap.

The 2026-09-17 coverage-fixture maintenance passes strict all-feature Clippy with --cfg coverage on native and wasm32-unknown-unknown targets. Native coverage builds also pass with no codecs, default codecs, and each codec individually. Ordinary native Clippy, both WASM library feature matrices, and all-feature rustdoc pass. Fixture setup retains explicit failure assertions, checked bounds, and the original malformed inputs; feature-specific exercises follow the same feature gates as their implementation. The Rust behavioral test suite and coverage measurements remain deferred. The documentation checker inadvertently executed the README quickstart during this maintenance; that example passed, but is not evidence of roadmap or parity completion. The historical coverage totals and open capability statuses remain unchanged.

The 2026-09-17 HDR color candidate has independent full-file native evidence: dav1d and libavif agree on 240,000 YUV bytes, while pinned scalar libyuv, libavif and Pillow agree on 120,000 RGB bytes. The deterministic observation is recorded in the HDR oracle index. This witnesses the native conversion of 10-bit full-range I444 CICP 9/16/9 without alpha. The safe-Rust converter and its full-plane/tail regressions are implemented; their behavioral execution and managed coverage are deferred. Strict Clippy passes for native, wasm32-unknown-unknown and wasm32-wasip1 with AVIF-only and all features, both ordinary and coverage configurations. Native and coverage-enabled unknown-WASM checks include all targets; WASI checks compile the library. Warnings-as-errors rustdoc, formatting and static provenance/roadmap checks also pass. The HDR public row remains planned and historical coverage is unchanged.

The 2026-09-17 high-depth color candidate adds the exact 12-bit limited-range I422 CICP 2/2/2 declaration with auxiliary alpha from 10bit.avif. Independent scalar dav1d and libavif agree on 81,920 color-plane bytes and 40,960 alpha-plane bytes across all five frames. Pinned scalar libyuv, libavif and Pillow agree on 81,920 RGBA bytes, with repeatable native planes, pixels and timing. Source, compiler, default I601 build flags and artifact hashes are retained in the native index. Partial-alpha pixels witness straight output; zero-alpha pixels are absent.

The shared declaration selector and Rust color conversion are implemented, with deferred regressions for every native frame, 25 full-row slices and separate internal admission/sample-buffer checks. Strict Clippy passes all 12 native/WASM, AVIF-only/all-feature, ordinary/coverage lanes used for the HDR candidate, and warnings-as-errors rustdoc, formatting and static checks pass. This is compile-only Rust verification. Public reconstruction, sequence presentation, Rust pixel execution and managed coverage remain unverified; the existing sequence gates, planned matrix rows and historical coverage totals are retained.

The 2026-09-17 sequence presentation candidate processes matching color and alpha samples with persistent reference state, converts each complete display before advancing, and publishes frames only after all samples succeed. It reserves later output transfer bytes before reconstruction and requires the inspected frame count, output mode and actual frame geometry to agree. Missing reconstruction surfaces remain capability gaps; malformed tile envelopes and empty reference slots retain precedence. That revision retained the frame-ID sequence presentation gate; the later candidate below removes it.

The sequence native index retains five complete RGB displays, six decoded frames, two hidden frames and one show-existing display from the unchanged animated.avif. Unmodified and instrumented pinned scalar dav1d agree on 168,750 YUV bytes; repeated native libavif/Pillow observations agree on 337,500 RGB bytes. Native durations are exactly 1/30 second; Pillow reports rounded 33 ms durations. Independent libavif repetition observations distinguish this one-play animation from the infinitely repeating high-depth fixture. Pillow omits its loop field for both. The bundle notes retain the native metadata origin and required matrix reconciliation.

Deferred regressions compare every public display, first-image pixels, timing, native repetition and output-budget boundaries for both fixtures. Internal defensive cases remain Rust model assertions. All 12 strict Clippy lanes described above, warnings-as-errors rustdoc, formatting and static provenance/roadmap checks pass. Rust behavioral execution and managed coverage remain deferred; no row or finding is promoted. Output transfer limits do not bound retained AV1 references or scratch memory, and variable frame geometry and primary-item/track declaration disagreements remain unsupported.

The later 2026-09-17 frame-ID candidate corrects interleaved reference index and delta parsing in Rust and the syntax inspector. Seven pinned native reads establish the ordering and values independently of either implementation. The frame-ID oracle retains both native RGB displays, native YUV noninterference, exact timing and repetition, a full-file 32767-to-0 wraparound success and a full-file reference delta rejection. The latter preserves the first image in both native/Pillow observations and Rust's deferred regression. Native CLI diagnostics and actual frame outputs establish rejection even though that CLI returns exit code 0. Strict Clippy passes in all 12 native/WASM, AVIF-only/all-feature, ordinary/coverage lanes. Warnings-as-errors rustdoc, formatting, artifact hashes and static provenance/roadmap checks also pass. These are compile-only and static Rust checks; the native observer runs execute only pinned oracles.

The frame-ID-only presentation gate is removed, while repeated-current-ID validation retains precedence over reference-delta failures. Behavioral Rust execution and managed coverage remain deferred. Short-signaling fallback, stale-reference behavior, broader reconstruction and native-versus-Pillow loop reference reconciliation remain unfinished. The bundle's README separates these limitations from the bounded evidence; no matrix row or finding closes.

The 2026-09-17 short-reference candidate removes the no-future rejection and corrects the Python inspector's maximum-distance tie handling. The shared production helper preserves native fallback order, duplicate anchors and repeated earliest-slot reuse. Its normal parser wrapper still requires all eight reference headers.

The short-reference oracle contains six complete AVIF mutations with independently repeated native traces, 4,608 YUV bytes and 9,216 RGB bytes. Unmodified and instrumented dav1d agree byte for byte. Pillow/libavif observations repeat with exact native timing, and the corrected inspector agrees on all selected indices. Equal reference pixels make index comparisons necessary; the deferred coverage test invokes the same production selection helper. Invalid adapter arguments are separately identified as internal model assertions. No coverage exclusions were added.

All 12 strict native/WASM, AVIF-only/all-feature, ordinary/coverage compile lanes pass. Rust behavior and managed coverage remain deferred. This corpus does not establish every mixed-distance history or complete sequence/resource parity; planned rows, finding counts and historical coverage remain unchanged.

The 2026-09-17 repetition candidate aligns the container parser with native edit-list handling and replaces the matrix's absent-Pillow-loop inference with explicit native provenance. The loop index retains 28 complete inputs, 41 hashed artifacts and 420,956 RGB/RGBA bytes. Twenty accepted observations preserve all frames; eight malformed files fail native parsing and Pillow opening. All observations repeat identically.

The native signed-count boundary preserves 2,147,483,648 total plays as finite, then normalizes larger values to infinite. Absent edit lists stay unspecified; nonrepeating lists stop after flags. Repeating lists validate count, version and nonzero segment duration but ignore media fields. Color repetition wins over a different alpha value, while malformed alpha metadata still rejects.

The generator and Rust matrix harness bind loop evidence to the complete input, case, native source, index hash and normalized value. The Python static validator rejects a valid witness substituted from a different file. Existing row statuses and deferred Rust capability contracts remain unchanged pending the final behavioral campaign. All 16 strict native/WASM compile configurations, warnings-as-errors rustdoc and static provenance checks pass. The guard inventory remains 540 across 89 files. No current-source coverage claim is made.

The later 2026-09-17 display-retention candidate replaces the per-sample vector of shown completions with one selected completion. Online maximum selection preserves temporal-unit/spatial/temporal precedence and latest-tie behavior. Losing candidates still commit their reference/CDF/current-ID state. A hidden sample cannot reuse an earlier display as its current presentation. Failed flushes preserve the last completed-frame commit, not a whole-sample rollback.

Two deferred internal ownership regressions use Weak references to check immediate release of losing/superseded surfaces and survival of independently referenced surfaces. They also cover selection axes, exact ties, a winning missing-surface gap, hidden-unit filtering, pending frames and counter overflow. Existing complete native animation/high-depth/frame-ID witnesses retain pixel authority. No input acceptance boundary or oracle output is changed. Rust behavior and managed coverage remain deferred; aggregate memory limits and peak-allocation measurements remain unfinished. All 12 strict native/WASM, AVIF-only/all-feature, ordinary/coverage compile configurations pass, along with rustdoc, formatting and static provenance gates. The coverage-origin inventory remains 540 guards across 89 files.

Diagnostic provenance

The separate defensive-model contract has 61 diagnostic cases: 38 use committed bytes that also have a Pillow parity row; 23 cases construct runtime mutations. Diagnostic identities and messages remain Rust model observations, not Pillow parity fields. The provenance verifier checks the original input hashes and supporting baseline route for every case.

Contract catalog: behavior Pillow cannot prove

This is the separate Rust-only list. “Cannot prove” means Pillow may have a similar idea internally, but it cannot return this crate's exact field, token, target, sink, or typed result for comparison.

The bounded v1 map is machine-checked by make verify against tests/fixtures/unreachable_contract_manifest.json. covered means that the manifest names an existing fixture-backed integration contract or fixture verifier; planned means that no such contract is claimed yet. The map is an evidence index, not a claim that every legal format state is implemented.

The verifier also parses this ten-row table. It requires each row's status and Pillow-parity column to match the manifest, every covered row to name the exact manifest evidence paths, the release-package row to name its exact fixture verifier, and the planned allocation/stack/coverage row to say that no category-specific evidence is claimed while naming its bounded context paths. This is documentation-integrity evidence only: it does not promote the planned category to covered and does not add any Rust-only result to Pillow parity.

Map ID	Rust-only contract	Why Pillow cannot prove it	v1 status	Separate evidence	Pillow parity
decode-encode-policy-limits	DecodePolicy and EncodePolicy limits	Pillow does not expose this crate's pre-detection, canvas, metadata, decoded-byte, encoded-output, or work-budget result with the same boundary/error fields	covered	Manifest evidence: tests/decode_policy_tests.rs, tests/feature_gate_tests.rs	excluded
cancellation-work-budgets	Cancellation and work budgets	Pillow has no caller-owned CancellationToken, checkpoint budget, or EncodeWorkUnits result	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
output-sink-delivery	OutputSink delivery	Pillow does not accept this crate's dependency-free sink, expose delivered prefixes, flush failures, or rollback semantics	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
caller-owned-destination-buffers	Caller-owned destination buffers	Pillow does not expose decode_into capacity, short-destination rejection, or no-partial-write guarantees	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
source-provenance	Source provenance	SourceDescriptor, FileTypeBox facts, AVIF item/property identity, raw source relationships, and declared-versus-confirmed fields are not Pillow result fields	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
structured-diagnostics	Structured diagnostics	Rust diagnostic kind, offset, consumed extent, recovery status, and provenance are not Pillow's ordinary return shape	covered	Manifest evidence: tests/feature_gate_tests.rs, scripts/verify_diagnostic_provenance.py	excluded
feature-target-capability	Feature and target capability	Pillow does not model this crate's Cargo feature-disabled errors or native versus wasm32-wasip1 capability table	covered	Manifest evidence: tests/feature_gate_tests.rs, tests/capability_table.rs	excluded
cache-concurrency-api-lifecycle	Cache/concurrency/API lifecycle	Pillow does not expose EncodedImage lazy-cache states, Rust clone sharing, bounded native concurrent verification, or this crate's frame/page lifecycle	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
release-package-surface	Release package surface	Pillow cannot inspect this crate's Cargo archive, included source/legal files, or deliberate exclusion of parity fixtures and repository-only integration targets	covered	Manifest evidence: tests/fixtures/package_surface_manifest.json, scripts/verify_package_surface.py	excluded
allocation-stack-coverage-models	Allocation/stack/coverage models	Pillow cannot witness Rust allocator checkpoints, stack measurements, or private defensive branches	planned	No category-specific evidence is claimed. Planned context: scripts/benchmark_fixture_workloads.py, scripts/verify_coverage_origins.py, tests/fixtures/coverage_origin_manifest.json	excluded

These cases must stay out of coverage_matrix.json unless a row also has a separate Pillow-observable assertion. A Rust-only test may still use a Pillow-generated image as input; that makes the picture reproducible, but it does not turn the Rust-only result into Pillow parity.