Versioned compatibility evidence

The current public evidence matrix contains 3,934 total rows: 3,217 decode / inspect / verify rows and 717 encode rows. Of those, 3,217 decode rows are active and 690 encode rows are active; 27 encode rows remain planned.

WebP lossless method-six token and sink parity — 2026-11-11

The active parity row encode:webp:enc_lossless_method_6_tiled_noise_token encodes a deterministic 128×1024 RGB image made from eight repeats of a pinned 128×128 noise tile. It checks Pillow 12.2.0 encoded bytes and decoded pixels, including the token-aware encoder and append-only sink path. The selected run passed 1/1 row, produced 49,376 encoded bytes, matched all decoded pixels, made six public encode calls, and observed zero panics.

This is encoder stress and parity evidence for image-slash-star#9h5w; it did not increase the observed branch count in src/codecs/webp/native/encoder/backward_refs.rs. The 500-entry cost-manager fallback stayed false after 1,020 and 680 insertion attempts at its two checked sites, so this row does not close that branch gap. Sixteen- and thirty-two-repeat probes also passed parity without reaching the fallback and took longer, so the retained fixture uses eight repeats. The retained LLVM report is local evidence only: Coverage MCP was not queried, source identity is unverified, and test attribution is unknown.

Selected report: .coverage-mcp/local-evidence/selected/20261111T052625.786070Z-b2d38ea9adba4886bd05b4b26641aa6a/coverage.json (SHA-256 b3a1f49845a6f508b671b08e6560226068cc3926829853d9f56bc72b4df59c06). Its local receipt SHA-256 is 4cda522035242aa9fc1906fdb6f1aa5fab92313b15739e037ce58f4fbb61103f.

JPEG progressive YCCK and long Huffman mode parity — 2026-11-11

Appended decode:jpeg:progressive_ycck_subsampled_17x9 and decode:jpeg:long_huffman_code_slow_path to the append-only mode_decode_cases index, which now contains 58 rows across all eight decode formats. The progressive YCCK case adds a progressive CMYK layout; the grayscale case uses eleven-bit DC and AC Huffman codes to reach the decoder's slow fallback. The indexed rows check owned and borrowed header identity, decoded-transfer identity, token-aware decode, max-pixel policy, and exact Pillow pixels.

The focused run passed 2/2 rows: 612 exact CMYK bytes for progressive YCCK and 64 exact L8 bytes for the long-code case. Coverage MCP's selected-report query found no missing branch group in JPEG's fast-reader Huffman fallback at src/codecs/jpeg/decode/huffman.rs:371. The separate checked dequantization overflow fallback in progressive JPEG remains unobserved in this selection; the parser bounds coefficients to i16 and quantizers to u16, making that overflow unreachable from an accepted JPEG input. No unit tests or runtime codec changes were added.

The selected LLVM report contains 3,017/142,891 lines, 382/32,132 branches, 247/9,185 functions, and 4,543/221,283 regions for this two-row subset. These are not aggregate coverage totals: Coverage MCP marks source identity unverified and test attribution unknown. Report SHA-256: a46e4716fd044c1e915b8b49f859348cbed7ed9b1e7f86bb8799d8e360d0f7bd; local receipt SHA-256: 4da3e37af1cef5fe656fe82989b67efd1ecd35d14cbe7e972a0ec4059b6bcc80.

Selected report: .coverage-mcp/local-evidence/selected/20261111T071142.720348Z-00c2643339cf45d9a7043a657cf90912/coverage.json.

WebP lossy method-3 SNS strength parity — 2026-11-11

The WebP VP8 encoder now uses zero SNS strength for methods below 4 and the libwebp default strength of 50 for methods 4 and above. The new active parity row encode:webp:enc_lossy_sns_strength_method_3_q50 checks exact Pillow 12.2.0 encoded bytes and decoded pixels at quality 50, including token-aware encoding and the append-only sink path. The shared encode runner also checks that the sink preserves its existing prefix and reports the exact appended byte count.

Selected parity passed 4/4 rows: the GIF and TIFF header/transfer-mode edge cases, the new WebP method-3 case, and the existing WebP method-5 trellis case. The local Coverage MCP report for that selected run is .coverage-mcp/local-evidence/selected/20261111T023804.203107Z-e1aa38b8da0042a9909aed1e363e8a7f/coverage.json; its WebP VP8 query reports 1,118 covered branches of 32,130 for this selected subset. This local selection is not a whole-repository coverage result.

JPEG trailing DHT partial-length parity — 2026-11-11

Selected the twelve active baseline 4:4:4 rows for valid, missing, partial, truncated, and oversized post-scan DHT/metadata tails. This includes the existing baseline_444_single_scan_dht_missing_length and baseline_444_single_scan_dht_partial_length cases: both preserve the complete 8×8 RGB scan when the trailing DHT ends with no EOI and has zero or one length byte. All twelve rows passed exact Pillow pixel/error parity.

Coverage MCP reports no remaining branch group at src/codecs/jpeg/decode/parser.rs:546; the selected input set observes both complete and incomplete trailing DHT length fields. It still reports the checked_add overflow outcome at the next condition as unobserved. The marker length is a u16 and its position is inside a valid slice, so that overflow is not reachable through a public input and does not warrant a parity row. The selected report records 2,831/142,880 lines, 369/32,128 branches, 235/9,183 functions, and 4,025/221,266 regions. Coverage MCP marks source identity unverified and test attribution unknown; these are selected-run totals, not an aggregate coverage claim. The accompanying receipt is local evidence, not a Coverage MCP source/build receipt.

Selected report: .coverage-mcp/local-evidence/selected/20261111T004831.265337Z-9e06b707c43441e1a56fafd9b604c00b/coverage.json (SHA-256 14e6c06b9b21975dde1c42f23c11b66eac548d1f81c5e756081ac9cd2ed8cb25). Its local receipt SHA-256 is 2a8174d2909f541c210e45eaa992599684eec6c02368e802ea23c51f4e22c4b4.

AVIF 12-bit 4:2:0 alpha mode identity parity — 2026-11-10

Appended decode:avif:high_bitdepth_still_12bit_420_alpha_odd_edge_17x9 to the append-only mode_decode_cases index, which now contains 52 entries. Its Rgba8 header and transfer pair was already represented by another AVIF layout; this separate 17×9, 12-bit 4:2:0 auxiliary-alpha input covers odd right and bottom chroma edges in the specialized reconstruction path. The indexed row checks owned and borrowed header identity independently from the decoded transfer identity, then compares all 612 decoded bytes with the exact Pillow reference.

The focused parity run passed 1/1 row. Coverage MCP was queried against the selected report and reports 13,929/142,865 lines, 2,158/32,126 branches, 992/9,182 functions, and 18,786/221,250 regions. Its source identity is unverified and test attribution is unknown, so these are selected-run totals, not an aggregate coverage increase. The query lists six missing invalid-shape arms in convert_subsampled_420_12bit_alpha; the retained full-matrix report has the same source hash for src/codecs/avif/decode.rs and records those shape-error arms as observed by the existing fault-contract rows. No ordinary unit tests or codec implementation changes were added.

Selected report: .coverage-mcp/local-evidence/selected/20261110-avif-12bit-420-alpha-mode/coverage.json (SHA-256 d2cb74598515f8feab756a77c46f6ba72b037c690c4c11934c1da5c8838d0296). Its local receipt SHA-256 is fe061f064b629c5594b1291ddde890e021804ea0021c11f817a640f67cc15d05.

JPEG and PNG sequence-option decoder parity — 2026-11-10

For image-slash-star#dgby, enabled the public token-aware and work-budget sequence decode operations on the existing JPEG subsampling_444 and PNG apng_animated parity rows. The JPEG case covers sequence fallback when no sequence codec is available; the APNG case exercises the incremental sequence codec. Both paths compare format, sequence validity, and exact reference pixels; still-image fallback also checks decoded transfer and raster identity. The selected parity run passed 2/2 rows, covering all four option/case pairs.

Coverage MCP comparison with the retained full report observed four branch coordinates in decode_sequence_token_format_with_mode that were absent from the selected cases' previous measurement, with no remaining queried branch group. Coverage MCP marked the comparison limited because source/build identity is unverified. The selected report records 4,092/142,880 lines, 551/32,132 branches, 315/9,183 functions, and 5,998/221,268 regions. These are selected run totals, not an aggregate project coverage claim. The accompanying receipt is local evidence and is not a Coverage MCP source/build receipt. No ordinary unit tests or decoder implementation changes were added.

Selected report: .coverage-mcp/local-evidence/selected/20261110T184641.825120Z-5b3f7eef216349f8bf2a58ae25738bc4/coverage.json (SHA-256 3801ec85846f3bd2651fe6b02af964d6bda10ceb71083393448fb822b327ad8c). Its local receipt SHA-256 is 05123d713b023a552d2b123b923ae05adcb65e33120e19e44c50ed89e8a302f3.

JPEG and GIF token-aware append-only sink parity — 2026-11-10

For image-slash-star#9h5w, extended two existing encoding parity rows through token-aware append-only sinks. The JPEG progressive 4:2:0 restart case checks still-image and one-frame sequence sink delivery; the animated GIF case checks two-frame sequence sink delivery. Each call preserves the existing sink prefix, reports the exact appended length, and matches both Pillow's encoded-byte reference and the ordinary Rust encoder. The focused run passed 2/2 rows with 12 counted public encode calls and no panics.

Coverage MCP comparison with the retained full report observed two branch coordinates in encode_sequence_to_sink_with_token, covering JPEG dispatch and its typed JPEG options. The comparison is limited because source/build identity is unverified and test attribution is unknown. The selected report records 8,032/142,880 lines, 1,077/32,132 branches, 582/9,183 functions, and 12,246/221,268 regions. These are selected-run totals, not an aggregate project coverage claim. No ordinary unit tests or codec implementation changes were added.

Selected report: .coverage-mcp/local-evidence/selected/20261110T193453.903506Z-14a596dd251b4131a79de76c391f66d8/coverage.json (SHA-256 ac885f241917b01430869ae7bcab9209d5bb233402c8b13a55998aff37e52373). Its local receipt SHA-256 is 73b2d44d71ffee139d1888d5ccf7669c84080e44172d4f32838d86c98ebe9479.

JPEG YCCK mode identity and CMYK encode parity — 2026-11-10

Appended decode:jpeg:ycck_h2v2_even_upsample_edges_18x10 to the append-only mode_decode_cases index, which now contains 53 entries. This 18×10 YCCK input exercises the even-edge 4:2:0 interpolation layout separately from the existing odd-edge YCCK representative; the index checks the CMYK header and decoded transfer identities independently before exact pixel parity.

The focused parity run passed 2/2 rows. The YCCK decode matched all 720 Pillow reference bytes. The prioritized existing encoding row encode:jpeg:enc_cmyk_subsampling_420_odd_edges emitted 544 bytes and re-decoded to exact 13×9 CMYK pixels. The encode-mode pair remains represented by its existing unique index entry. Fixture integrity, capability documentation, and matrix-hash receipts pass after regeneration.

Coverage MCP was queried against the selected report. It marks source identity unverified and test attribution unknown, so the result is not an aggregate coverage claim. The remaining YCCK and row-upsampling gaps point to cfg(coverage) malformed-buffer fault hooks; no additional public-input case was inferred from those hooks. No ordinary unit tests or codec implementation changes were added.

Selected report: .coverage-mcp/local-evidence/selected/20261110T110012.212196Z-a5e3784124ac4bf280a4fe8cae2b54ca/coverage.json (SHA-256 53197dcfca5b14ccecf7c8bcdcf62d20f1a924dcb448bd78986c241ac9e738e7); its local receipt SHA-256 is 72d1a778a0733903ec85ae4ef7cd7de47879390cbfe048352906e3cc9939dee4.

TIFF CIELAB SampleFormat parity — 2026-11-10

For image-slash-star#y81n and image-slash-star#dgby, added five active TIFF decode rows around CIELAB SampleFormat and ExtraSamples: zero-count, signed, three explicit unsigned values, mixed signedness, and an unmatched extra sample. The three Pillow-accepted inputs preserve exact LAB header and decoded transfer identity; the other three reject with the same public malformed-input outcome. The focused parity run passed 6/6 rows, including the existing lab baseline. The mode-decode index remains at 40 because LAB → LAB was already represented. Restored the existing palette associated-alpha error row to the manifest after matrix regeneration showed that the row had been present only in the generated matrix.

Coverage MCP reports no missing branch at src/codecs/tiff/inspect.rs:443-446 in this six-case local measurement. The measurement is source-unverified with unknown test attribution, so this is focused branch evidence rather than a verified repository-wide coverage increase. Report SHA-256: 7626d1b9bcea67190c63d5293f4bae3ebf57be2ff6500cb317f1992f8886501c; local receipt SHA-256: 993466b8136a5864a692c0704193e5f21712ebb75554d36739b7cd6832859b7c.

Report: .coverage-mcp/local-evidence/selected/20261109T235936.686964Z-fbbb0ad80a5446f28fbffbc60782ccc5/coverage.json.

The complete matrix then passed 3,899/3,899 active decode/encode parity rows and 206/206 fault contracts (4,105 active selections including fault contracts); 27 planned encode rows remain unexecuted. Its LLVM report records 100,752/142,863 lines (70.5235%), 20,920/32,126 branches (65.1186%), 5,471/9,180 functions (59.5969%), and 152,980/221,254 regions (69.1423%). Coverage MCP comparison reports four newly observed branches in layout_and_palette at lines 443–445 and no missing branches at lines 443–446; one separate branch remains at line 440. The report source and test attribution are unverified, so these are local measurements rather than a confirmed project-wide coverage increase. Full report SHA-256: c29b68d6eaa6b51be15eb1c95f1682783f08aa883f91edf6d190e3cd5596b8e1; local receipt SHA-256: 354d7b001237a9acc8198cffaa657b2ee7d2d8b99860efcd878e24308a11d367.

Full report: .coverage-mcp/local-evidence/selected/20261110T000200.834727Z-48aad626c926404dbdb92819486bbd00/coverage.json.

WebP animated VP8L alpha-hint mode parity — 2026-11-10

For image-slash-star#y81n and image-slash-star#dgby, added decode:webp:animated_animated_vp8l_alpha_hint_without_vp8x_alpha_flag. It clears the animation's VP8X alpha flag while preserving alpha-bearing VP8L frames. Pinned Pillow accepts the stream as RGB and returns both exact frames, pixel data, and frame durations. The focused parity run passed 1/1. Appended frame-indexed mode-decode entries for both frames; the index now contains 51 cases.

Coverage MCP comparison against the retained full report found one newly observed branch arm at src/codecs/webp/native/lossless.rs:155, where an alpha-bearing VP8L frame enters the RGB animation path. This is a focused local observation: source/build identity and test attribution are unverified, so it does not prove an aggregate coverage increase. The selected LLVM report records 1,824/142,865 lines, 195/32,126 branches, 176/9,182 functions, and 2,513/221,250 regions. Report SHA-256: 7c82b4836a6493dd2b9fcd08a3614304a9c1b1f822adc21b57e9abe810b1d3d4; local receipt SHA-256: 8e172d97b20f450234dc8fc0c36e91c408b23b4abd6672a70623cf713a295de0.

Report: .coverage-mcp/local-evidence/selected/20261110T084306.932359Z-3139debbf6ad408babae26fc6100894c/coverage.json.

WebP signed I-mode token parity — 2026-11-10

For image-slash-star#9h5w, extended active case encode:webp:enc_lossless_i32_signed_clamp to run the public token-aware WebP encoder as well as the ordinary encoder for signed 32-bit TIFF I input. The selected parity run passed 1/1: both Rust paths matched Pillow's 48-byte output, and the decoded result retained exact 257×1 RGB pixels. The runner made five public encode calls and observed no panics. The mode-encode index remains at 59 entries because I → Rgb8 was already represented.

Coverage MCP's focused branch query no longer reports a missing branch in expand_i32_to_rgb at src/codecs/webp/encode/mod.rs:1222. This is local selected-case evidence only: Coverage MCP marks the report source unverified and test attribution unknown, so it does not establish a repository-wide coverage change. Report SHA-256: 640f4bfd8a9d77ce1431c7af242e1ce3a4102bfcd47e481869a4d9c73c54a197; local receipt SHA-256: 0bf2f1b43423aae4a51671299133d99f7b22da4bc9532e2b5cf83da046c9a5bb.

Report: .coverage-mcp/local-evidence/selected/20261109T230156.077554Z-39daa69e321b4ea598261d917316a1c4/coverage.json.

The full matrix run passed 3,894/3,894 active decode/encode parity rows and 206/206 fault contracts (4,100 active selections including fault contracts); 27 planned encode rows remain unexecuted. Its local LLVM report records 100,752/142,863 lines (70.5235%), 20,916/32,126 branches (65.1061%), 5,471/9,180 functions (59.5969%), and 152,980/221,254 regions (69.1423%). Coverage MCP comparison reports the expand_i32_to_rgb branch as newly observed against the prior snapshot, but source/build identity is unverified, and the aggregate branch count is unchanged. Treat this as local evidence, not a verified project-wide coverage increase. The local receipt records no source changes during the run, but the checkout was dirty.

Full report SHA-256: 30178374b94d956263146e43e5377f0886e99af11f77a9bf6c38c1ce9462310b; local receipt SHA-256: 780b1e599747ca0e34f70282ff693529d78838c2912612453cb5ec274d2b316e.

Full report: .coverage-mcp/local-evidence/selected/20261109T230549.983972Z-643456c7952c4f0296395cb93ac51c1a/coverage.json.

WebP lossless EXIF metadata without prefix — 2026-11-10

For image-slash-star#9h5w, added active parity case encode:webp:enc_lossless_exif_unprefixed_metadata_reuse. It gives the lossless WebP metadata-reuse path a valid EXIF TIFF payload without the optional Exif\0\0 prefix, covering the fallback arm in attach_metadata_reusing_output. Pinned Pillow 12.2.0 and the Rust encoder produce the same 74-byte output; re-decoding preserves exact 1×1 RGB pixels.

The selected parity run passed 1/1, with four public encode calls and zero panics. Coverage MCP's retained full-parity report had identified the unprefixed-payload arm at src/codecs/webp/encode/mod.rs:949 as uncovered. The selected report no longer lists that arm as missing; other branches in the metadata-reuse function remain uncovered. Coverage MCP marks this local report source identity unverified and test attribution unknown, so this confirms the focused branch hit rather than an aggregate coverage change. The report's SHA-256 is bd252dfeefda56fadbdab053add8710b4cdc7a6dae7767ad5481307f1a6a37e1; its local receipt SHA-256 is 3bb9f9d92f22c97164cb16453102ae99cd7af0af5cb61b1c1bf0dc001aaddc38. Mode case indexes remain at 40 decode entries and 59 encode entries.

Report: .coverage-mcp/local-evidence/selected/20261110-webp-exif-unprefixed/coverage.json.

Sequence-frame mode decode parity — 2026-11-09

Extended the append-only mode_decode_cases index to represent an exact sequence frame with frame_index. The new entries cover Pillow's P header → Rgb8 second-frame transfer in decode:gif:netscape_loop_split_subblocks, and Rgb8 header → L8 second-page transfer in decode:tiff:multi_page_multipage_mixed. Mode-pair completeness now includes every exact Pillow-backed sequence frame, not only each file's first decoded image. The index contains 40 entries.

The selected parity run passed both rows (2/2), including exact frame pixels, sequence metadata, and frame modes. cargo fmt --all -- --check passed; no codec implementation changes or unit tests were added.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261109T180744.736818Z-6fd7f340e09746c486e36a0bd6b4cb0a/coverage.json (SHA-256 5e0e95258194cea3f22f57fe6196901b7b5fb115cb646e313f4fe441d87878bc). The local receipt SHA-256 is a04ea08b8ec6c6e300b5f19259c9f8741eff5b22cf8a585ccfbf1f2e125a642b. This selected report measures 2,593/142,863 lines (1.8150%), 307/32,126 branches (0.9556%), 260/9,180 functions (2.8322%), and 3,819/221,254 regions (1.7261%). Coverage MCP was not queried; the local receipt marks source identity unverified and test attribution unknown. These selected counts are not aggregate project coverage.

JPEG multi-scan restart markers without DRI — 2026-11-09

Added decode:jpeg:baseline_444_multiscan_restart_markers_without_dri by removing only the DRI=1 segment from the pinned two-scan JPEG fixture. Pillow 12.2.0 accepts the complete JPEG and returns the pinned 16×8 RGB pixels. The selected parity run passed 2/2, including the existing single-scan no-DRI case. The mode decode index did not need a new entry because JPEG RGB was already indexed. decode.rs no longer checks scans.len() == 1 inside the single-scan reconstruction helper: public dispatch sends every multi-scan image to the multi-scan helper first.

The selected local LLVM report measures 3,458/142,785 lines (2.4218%), 435/32,112 branches (1.3546%), 246/9,180 functions (2.6797%), and 5,359/221,185 regions (2.4229%). This selected report is local-only; Coverage MCP was not queried, so these totals do not establish repository-wide coverage.

Report: .coverage-mcp/local-evidence/selected/20261109T114509.280683Z-607c42b1162749c6ac7d522f62b2e897/coverage.json (SHA-256 4f9f939883c1b91855a13e79cd3e997d82cf63a3758471a662468614e668c8fb).

ICO source dimension parity — 2026-11-09

For image-slash-star#9h5w, the full parity coverage snapshot 20261109T090133.287637Z-1797a898ca364af99e0fda666ed44339 passed all 3,881 active decode and encode rows; 27 planned rows remained unexecuted. Two ICO encoder parity cases exercise the public source-size guard with valid requested 16×16 entries: a 257×129 JPEG source covers the width limit, and a 192×272 PNG source covers the height limit. Pillow 12.2.0 encodes and reopens both ICOs; the Rust encoder returns the declared dimensions error in each case. The selected case run passed 2/2 rows.

The parity-only LLVM report records 97,871/142,788 lines (68.5429%), 20,349/32,114 branches (63.3649%), 5,272/9,180 functions (57.4292%), and 148,896/221,186 regions (67.3171%). Coverage MCP reports 11,765 unobserved branches, concentrated in AVIF AV1 block decoding. Its local query labels this run's source as unverified and test attribution as unknown because no managed receipt-registration action is connected; the local execution sidecar records 3,881 passes, zero failures, and no source changes during the run. In ICO encoding, the remaining four reported branches are in directory_header's defensive invalid-input path, which is precluded by public source-size validation. No unit tests or runtime codec changes were added.

WebP scalar-mode encoder parity — 2026-11-09

Added five Pillow 12.2.0 parity rows for WebP encoding from TIFF I;16B, I, and F sources. They cover big-endian source metadata, signed 32-bit clamp boundaries, float conversion, and the token-aware preparation checkpoint on a 128×128 float image. WebP converts the scalar transfer samples to grayscale RGB using the same native-order sample interpretation and saturating conversion as Pillow. The public-mode error contract now keeps I and F in the accepted mode set and continues checking structured errors for unsupported modes. The append-only mode encode index now includes I;16B → Rgb8, I → Rgb8, and F → Rgb8.

The focused selected parity run passed 5/5 rows with exact encoded bytes and pixel output. make lint and make lint-x86-simd pass, including the strict x86-64 SSE2 baseline and AVX2 Clippy builds. No unit tests were added. The selected LLVM report measures 6,752/142,788 lines (4.7287%), 1,130/32,114 branches (3.5187%), 455/9,180 functions (4.9564%), and 9,578/221,186 regions (4.3303%) for this run. Coverage MCP was not queried; its local receipt marks source identity unverified and test attribution unknown, so these selected counts are not a repository-wide coverage claim.

Report: .coverage-mcp/local-evidence/selected/20261109T061152.051311Z-3c05f788dd644b3eb82e8a57779bd4e0/coverage.json (SHA-256 a1dc51f16caa38542ac6c7fc5d873ca4f13a05d3077bc483001410aea577bf1a).

TIFF palette-extra mode identity — 2026-11-09

Added decode:tiff:palette_alpha_separate_planar: Pillow inspects and verifies the separate-plane header as PA, then rejects pixel decoding. The new decode:tiff:palette_unspecified_extra_sample row covers a contiguous indexed image with ExtraSamples=0; Pillow retains P identity and drops the second sample. TIFF inspection now preserves these header identities independently of pixel storage, while decoding keeps Pillow's malformed result for separate PA planes. The existing PA encoder parity row verifies encoded header and decoded transfer identity through the append-only sink.

The focused selection passed 5/5: decode:tiff:compression_none, decode:tiff:palette_alpha, decode:tiff:palette_alpha_separate_planar, decode:tiff:palette_unspecified_extra_sample, and encode:tiff:enc_palette_alpha. Coverage MCP reports no missing branch groups at inspect.rs:439 or the decode_ifd guard at decode.rs:253. Matrix validation checked the append-only mode decode/encode case indexes, and the encoder row exercised the append-only sink. Its selected LLVM report records 2,551/142,734 lines (1.7872%), 266/32,112 branches (0.8284%), 244/9,174 functions (2.6597%), and 3,540/221,113 regions (1.6010%) across the instrumented crate. Coverage MCP labels this local report source identity unverified and test attribution unknown; these selected-case totals are not a repository-wide coverage claim.

Report: .coverage-mcp/local-evidence/selected/20261109T035617.440441Z-48d4a4b2422f41cb8869af6fda5c812f/coverage.json (SHA-256 a5012a8c32501582f9438a5dd87aa65493ae6b07b962697637643c901ab66ecba).

TIFF short ColorMap palette identity — 2026-11-09

Added decode:tiff:palette_alpha_short_color_map and decode:tiff:palette_unspecified_extra_sample_short_color_map. Pillow accepts these complete TIFF files, retains PA and P sample identities, and returns the exact samples while exposing no palette table. The latter also ignores the second sample declared with ExtraSamples=0. These cases exercise both palette-present/absent decisions in ordinary and token-aware decoding without changing the decoder implementation.

The selected parity coverage run passed 2/2 rows. Coverage MCP's report leaves only the palette-present arms unobserved at decode.rs:2191, 2199, 2470, and 2479, confirming that both palette-absent arms were reached. The local report measures 1,725/142,734 lines (1.2085%), 193/32,112 branches (0.6010%), 174/9,174 functions (1.8967%), and 2,450/221,113 regions (1.1080%). Coverage MCP labels this local report's source identity unverified and test attribution unknown; the captured matrix run itself records exactly these two case IDs, unchanged source/fixture hashes during execution, and zero failures. These selected totals are not a repository-wide coverage claim.

Report: .coverage-mcp/local-evidence/selected/20261109T045141.584220Z-f057cbc475184f558b9d92be1f35fa8d/coverage.json (SHA-256 3508735588798726bcb196fde79f851b48fd270a9b5234198588fb551be5e6eb).

Big-endian 16-bit TIFF encoder identity — 2026-11-09

Added two Pillow parity rows for a source decoded as I;16B. Uncompressed TIFF output now retains the big-endian MM header and I;16B raster identity; Deflate with horizontal prediction matches Pillow's little-endian II output and normalized I;16 identity. The encoder converts carrier samples only for the raw big-endian path and includes Pillow's single-sample tag on compressed 16-bit grayscale output. A new manifest-driven parity row covers a two-page I;16 TIFF sequence whose second frame is converted to I;16B; Pillow and Rust both reject that mixed-byte-order save.

The new focused parity selection passed 1/1: encode:tiff:enc_error_mixed_sample_byte_order_sequence. The earlier TIFF selection at commit 431c3e6 passed 66 encode rows, one big-endian decode row, and the now-retired target-only sequence contract (68/68 total). The combined selection was not rerun after replacing that contract with the Pillow parity row. No unit tests were added.

The current focused report is retained at .coverage-mcp/local-evidence/selected/20261109T023700.826628Z-e73d13e2f2c44d6fa0c060ddbb529cc1/coverage.json (SHA-256 e477f22c95d3fab74c09f8215f3f5825060019df545be041ca149b2256d22185). Coverage MCP was not queried; this is local selected-case evidence, not an aggregate coverage-gain claim. The previous selected report is retained at .coverage-mcp/local-evidence/selected/20261109T015929.647840Z-1c5c4218abe545d68c06482986e4694b/coverage.json (SHA-256 0fde190b49b1d7e0b20c09e7c2f41185794ec0df28a8c9253831506e3cee7ba1). That earlier receipt marks source identity unverified and test attribution unknown.

TIFF indexed encoding with no retained palette — 2026-11-08

Added encode:tiff:enc_indexed_missing_palette, using Pillow 12.2.0's short_color_map.tiff input. TIFF encoding now preserves its indexed P8 samples and emits the required palette ColorMap even when the decoded source has no retained palette entries. The exact encode and decode-back parity row passes. The unsupported-mode contract no longer lists P8 for TIFF.

PYTHON=.oracle-venv/bin/python make coverage-parity passes all 3,861 active decode/encode rows (3,200 decode and 661 encode); 27 planned encode rows were not run. The run did not execute separate fault-contract cases. Its matrix-run LLVM report measures 97,670/142,643 lines (68.4716%), 20,312/32,080 branches (63.3167%), 5,256/9,170 functions (57.3173%), and 148,610/220,959 regions (67.2568%). These figures describe this parity-matrix run, not full-suite coverage or the managed release baseline.

Report: .coverage-mcp/local-evidence/selected/20261108T171104.159617Z-9aab56d3b8864d3091ce6335eebfeec6/coverage.json (SHA-256 464de80a08252c239055b850cc2c3033a422736beadcd363c8e895ff24d1e089). Coverage MCP was not queried for this local report; its receipt marks source identity unverified and test attribution unknown.

CIELAB TIFF identity and PA encoder parity — 2026-11-08

Added active decode row decode:tiff:lab from Pillow 12.2.0. Basic and full header inspection, EncodedImage, EncodedImageView, normal decode, and token-aware decode retain the Pillow-visible LAB identity over the RGB8 transfer carrier; all six three-channel samples match exactly. The TIFF decoder accepts unsigned 8-bit CIELAB samples and reports Mode::ImageLab8 without converting them to RGB.

The existing PA encoder rows were also confirmed together: TIFF preserves PA indices, per-pixel alpha, and palette colors; PNG rejects PA with Pillow's cannot write mode PA as PNG error. The focused parity selection passed 3/3 rows (one decode and two encodes), with zero panics.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261108T152700.992871Z-2c0d00c6b484489e8ff2f534ace3dd9c/coverage.json (SHA-256 8288c824bf0fd5f0dc9e7d181225704f710651d6d3c39227b4d782a52da3d4e6). Coverage MCP marks this retained selected report's source as unverified and test attribution as unknown; it supports the focused parity outcome, not an aggregate coverage-gain claim.

CIELAB TIFF compression parity — 2026-11-08

Added Pillow 12.2.0 CIELAB inputs for LZW, Adobe Deflate, and PackBits TIFF. The four selected rows (decode:tiff:lab and the three compressed variants) all pass 18-byte exact pixel parity and retain LAB identity through basic inspection, ordinary decode, and token-aware decode. The compressed fixtures are generated and pinned by scripts/generate_tiff_lab_compressed_fixtures.py; their TIFF tags retain PhotometricInterpretation 8 and the requested compression.

The Coverage MCP gaps query on the selected report still ranks tiff::inspect::layout_and_palette and decoder branches as remaining gaps. This report is selected evidence only; MCP marks the source unverified and test attribution unknown, so it does not support an aggregate coverage claim.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261108T161041.861067Z-4c0d6fe5d8754ba696b01168977b5c03/coverage.json (SHA-256 39924a91884f9cfb07e0d05de82a27b7d55762499fecba973c5edcb02eca7fee). Its local receipt has SHA-256 c0176a586c60de58512644f9dec2ad9966dd7ee8c61522627d36bf5ee206caad.

F-mode encoder rejection parity — 2026-11-08

Added active encode rows for float32.tiff (Pillow mode F) to BMP, JPEG, and ICO. Pinned Pillow 12.2.0 rejects them with cannot write mode F as BMP, cannot write mode F as JPEG, and cannot write mode F as PNG for ICO's PNG-backed entry. The Rust encoder returns the corresponding structured Unsupported errors. Focused parity passed 3/3 rows with no panics.

The existing I32-to-PNG transfer was also rechecked: little- and big-endian signed TIFF inputs both match Pillow's 16-bit grayscale output after clamping to 0..65535; focused parity passed 2/2 rows.

TIFF associated-alpha identity was checked across contiguous raw, contiguous Deflate, separate raw, and separate Deflate strips. The successful decode paths match Pillow's straight-RGBA samples; separate raw retains the RGBa inspected header identity and the Pillow-compatible decode rejection. Focused parity passed 4/4 selected rows across two runs.

Selected LLVM reports are retained under .coverage-mcp/local-evidence/selected/:

• F-mode BMP/JPEG/ICO: 20261108T141847.357857Z-9a8c1d70713649da9527a49fac6f26f8/coverage.json (SHA-256 a623052732ad32af4cdc48930b4d8b3eea57cfcc6df2d5c257546b5b0e46f6ba).
• I32 PNG little/big endian: 20261108T142634.812024Z-5b451ed7275e4c928cee1cc7197c71fd/coverage.json (SHA-256 ae10f26072f8a46ca044f5f88af46075e49c8250bd1e176b0e8d7b16f1c02f2e).
• TIFF associated-alpha raw strips: 20261108T141417.735466Z-92637700e538406487c40a196b6884d9/coverage.json (SHA-256 8dc919465acc235c449271f96ba766455773027595b934df072019545067fd30).
• TIFF associated-alpha compressed strips: 20261108T142949.995633Z-86bf6264e36a49a8b13d27a2b37077b1/coverage.json (SHA-256 c9f03a541550733025cf549e4a22aaa74252356107a38a9faaee73b4660dbb99).

Coverage MCP reports these selected measurements as source=unverified and tests=unknown; they support the focused parity outcomes, not an aggregate coverage-gain claim.

JPEG grayscale restart markers without DRI — 2026-11-08

Added the active parity row decode:jpeg:grayscale_sampling_420_128x128_restart_markers_without_dri. Its deterministic source retains the entropy-coded restart markers while removing the preceding restart-interval (DRI) segment. Pinned Pillow 12.2.0 accepts the complete grayscale image. The selected public parity run passed 1/1 row with exact 16,384-byte pixel output and no panic.

The selected LLVM report records the previously unobserved outcome at src/codecs/jpeg/decode/decode.rs:2896 with branch counts 4/0 for this run. Coverage MCP's local gaps query returned status=measured and 285/32,024 branches for the selected report, with the other arm still unobserved. The report's source identity is unverified and test attribution is unknown; these are local selected observations, not a verified aggregate gain.

Report: .coverage-mcp/local-evidence/selected/20261108T000622.475420Z-17fe23a16c234b878586bc49da2aa5ba/coverage.json (SHA-256 67565ae163e90a75b53c91afb21d13f365e5d838de843eb5e42fb1603992dd22). The adjacent coverage.local-evidence.json records the exact selector, fixture hashes, toolchain, and passing execution.

JPEG baseline 4:2:2 restart markers without DRI — 2026-11-08

Added active parity row decode:jpeg:baseline_422_restart_markers_without_dri, generated by removing only the DRI=1 segment from the existing Pillow baseline 4:2:2 fixture. Its first selected run found a 782-byte pixel mismatch. Later RST-delimited entropy segments were being mapped to the first MCUs because the input supplied no DRI interval from which to calculate their MCU positions. The baseline decoder now uses the first segment for this single-scan, no-DRI case; selected output then matched Pillow exactly.

Selected parity passed 3/3 for the new row, the existing 4:2:2 DRI=1 row, and the existing grayscale no-DRI row. The local LLVM report records src/codecs/jpeg/decode/decode.rs at 1,519/4,311 regions, 1,032/2,652 lines, 162/454 branches, and 30/108 functions. Its whole-report totals are 5,318/220,945 regions, 3,424/142,632 lines, 448/32,070 branches, and 240/9,169 functions. Coverage MCP was not queried; the local receipt marks source attribution unverified and test attribution unknown. This selected run is not an aggregate coverage claim. No Rust unit tests were added.

Report: .coverage-mcp/local-evidence/selected/20261108T093025.740487Z-f02ed3bc3d90476fa11024ba1a9e0851/coverage.json (SHA-256 431973dea87ae8eaa6507bec97a4db363c07dfd9dda8c698b06282cdfa6e2058); its local receipt and captured command output are adjacent.

JPEG small baseline 4:4:4 entropy parity — 2026-11-08

Added encode:jpeg:enc_8x8_444_independent_entropy_no_optimize, using the existing 8×8 RGB JPEG source with baseline 4:4:4 sampling and Huffman optimization disabled. Pinned Pillow 12.2.0 produces the exact 672-byte reference; selected parity passed 1/1 and re-decoded to pixel-identical 8×8 RGB. The selected report records the baseline_444_independent_entropy_is_compatible true arm at src/codecs/jpeg/encode/mod.rs:4717 three times. Targeted checks of the existing 16×16 4:2:0 and 32×16 4:2:2 rows also pass and reach their matching independent-entropy helpers.

Coverage MCP reports 523/32,064 branches for the one-row report. The false arm of the 4:4:4 sampling predicate remains unobserved. MCP marks source identity unverified and test attribution unknown, so this is selected-case evidence and not an aggregate coverage claim. Report: .coverage-mcp/local-evidence/selected/20261108T071608.429017Z-70390c41963a420aa4d42e9929e03a52/coverage.json (SHA-256 464de2355f13b8539e18b06fa22f51b0d64fa2ab641a29ff06208bacd41ac18c). The 4:2:0/4:2:2 selected report is .coverage-mcp/local-evidence/selected/20261108T072051.187354Z-f147db75ef3f4ec190a949692a23b6ff/coverage.json (SHA-256 e669869098ee86114adaea06596166a705440c6fc39cf54c55ba955dc040b136).

GIF local color table under metadata limit — 2026-11-08

Split animated_gif_animated_3frame into its own active manifest row and set rust_decode_with_metadata_limit to 1,725 bytes. Its three-frame GIF contains a global color table, one local color table, four extensions, and 24,207 bytes of compressed LZW payload inside a 25,932-byte container. Selected public decode parity passed 1/1 with the exact 16,384-byte Pillow pixel reference in P mode.

The selected LLVM report observes the metadata preflight's local color-table read at src/codecs/gif/decode.rs:408-410 once per line; the file summary is 703/1,101 regions, 430/652 lines, 66/140 branches, and 21/34 functions. The selected report totals are 1,891/220,940 regions, 1,339/142,623 lines, 148/32,064 branches, and 141/9,169 functions. Coverage MCP was not queried in this session; its local receipt marks source identity unverified and test attribution unknown. These are selected local observations, not an aggregate coverage claim. No Rust unit tests were added.

Report: .coverage-mcp/local-evidence/selected/20261108T081716.234967Z-441ed5026fe34bb9ba830e6c02b1970d/coverage.json (SHA-256 34dd567a8795afa429d3124fc41bc57e3340bb3fa9b0217f37f762f7be1c79f2); its local receipt and command log are adjacent.

The existing post_frame_zero_padding and valid_frame_missing_trailer parity rows also passed together (2/2) at their exact metadata limits. Their selected report observed the end-of-input-after-frame and padding-block outcomes in metadata_bytes at src/codecs/gif/decode.rs:382-383 and :423. Coverage MCP was not queried; the selected report and local receipt are .coverage-mcp/local-evidence/selected/20261108T082216.233656Z-8eb2d55d1dc64672a277c7bc30099811/coverage.json (SHA-256 392b2603a399f8d9696b05049bfb52e920cfbba60345275f04a70d602b9d1ff8).

After merging the current main history into develop, the three rows above passed together (3/3) against the merged tree. The selected report records 710/1,101 regions, 435/652 lines, 73/140 branches, and 21/34 functions in src/codecs/gif/decode.rs. The receipt marks Coverage MCP as not queried, the source as unverified, and test attribution as unknown; these remain local selected-run observations, not aggregate coverage claims. Report: .coverage-mcp/local-evidence/selected/20261108T083132.867282Z-b869ddaedb8244ecaab61e5d4a60806c/coverage.json (SHA-256 1b00597a814ad6adbc86058b232764ef2d5cd0895cf9f21e7720c8b32a284d03).

AVIF sequence mode mismatch alpha fault contract — 2026-11-07

Added target-only row fault-contract:avif:avif_sequence_mode_declaration_mismatch_alpha, backed by the active five-frame RGBA8 decode:avif:high_bitdepth parity fixture. Together with the existing RGB sequence contract, both variants verify the structured sequence-decode mismatch and that a retry without fault injection succeeds. The row has oracle_status: not_applicable; it adds no Pillow parity result.

The selected local LLVM run passed both fault-contract rows. It observed both outcomes of mode == ImageMode::Rgb8 at src/codecs/avif/decode.rs:234 (one taken for each mode), where the prior RGB-only selection observed only the true outcome. Report: .coverage-mcp/local-evidence/selected/20261107T181346.208410Z-28512009f3ff444ab5ff56c187c001df/coverage.json (SHA-256 f23dd1ed448e0e908173cae0792d2979115d381b8424597fcb863adace01269e); the captured run log and local receipt are in the same directory. Coverage MCP was not queried; the local receipt marks MCP source attribution unverified. This case-only result does not update aggregate coverage totals. No Rust unit tests were added.

AV1 monochrome palette parity and selected coverage — 2026-11-07

Added active parity row decode:avif:coverage_monochrome_palette_16x16 for a deterministic 8-bit YUV400 still image with palette coding enabled. The generator checks pinned libavif 1.4.1/libaom 3.13.2 output, AV1 sequence-header monochrome signaling, deterministic AVIF bytes, and the Pillow 12.2.0 RGB reference. The fixture SHA-256 is 64d2f38fe719b898ad11c4c84e36ef26653daa2596844b2ff8cff782f1a75ff0; the 768-byte RGB reference SHA-256 is 7da6d6dc0cb94021c2425b4fc418377c69c69b03b494a8a9a1080461a8e77e72. Selected public parity passed 1/1.

The selected local LLVM report records the monochrome palette validation arm at src/codecs/avif/av1/block.rs:338 as taken 12 times, while the paired color-format palette case does not execute this arm. Report: .coverage-mcp/local-evidence/selected/20261107T170748.811387Z-007b8abc8bd24ecfb6de2b689e5c8252/coverage.json (SHA-256 ce2f9f2052077148dd279089a539db44faa2b881b39a2b8e81a3b003d3356c84); execution receipt: .coverage-mcp/local-evidence/selected/20261107T170748.811387Z-007b8abc8bd24ecfb6de2b689e5c8252/coverage.local-evidence.json. Coverage MCP is unavailable in this session, so the local receipt marks source attribution unverified and test attribution unknown. This selected run is evidence for this case only and does not change aggregate coverage totals.

ICO malformed-header decoder contracts — 2026-11-07

Added target-only contracts for the ICO reserved-field and container-type guards. Each reuses an existing Pillow-backed malformed ICO parity input, preserves Pillow's public unknown-format result, and calls the ICO decoder below format detection to require a structured Malformed error at offset 0 or 2. The six-row selected campaign passed both healthy icon/CUR parity rows, both malformed-input parity rows, and both direct-decoder contracts.

The selected LLVM branch report observed both sides of the reserved-field guard at src/codecs/ico/decode.rs:45 (1/7), both outcomes of the first type comparison at :51 (3/4), and both outcomes of the second comparison (1/2). Report: .coverage-mcp/local-evidence/selected/20261107T052654.028960Z-9b30b1442d3a4000ab8d05674e1ba6fa/coverage.json (SHA-256 81f19f0a759065d1d2db4f6ef137264334e8549b41428acceef971f07172c1b2); receipt: .coverage-mcp/local-evidence/selected/20261107T052654.028960Z-9b30b1442d3a4000ab8d05674e1ba6fa/coverage.local-evidence.json. Coverage MCP is unavailable in this session, so the receipt labels source attribution unverified and test attribution unknown. This is selected local evidence, not an aggregate coverage update.

AVIF grid with orphan dimg reference — 2026-11-07

decode:avif:grid_orphan_dimg_reference preserves the primary color-grid references, removes the two auxiliary-alpha relationships, and adds a dimg reference from auxiliary item 5 to auxiliary item 6. A sibling free box fills the removed iref bytes, preserving the enclosing metadata extent and every iloc item payload offset. Pinned Pillow accepts the 2,373-byte file as RGB and returns the shared 19,200-byte pixel reference used by grid_unreferenced_alpha_items.

The selected parity and LLVM coverage run passed 1/1. Its local report observes both outcomes of the color_items.contains(&reference.from_id) branch in src/codecs/avif/container.rs:1457 and :1484; the retained full report had zero hits on the previously missing outcomes. This selected report does not change full-suite coverage percentages. The report, command log, and local execution receipt are retained under .coverage-mcp/local-evidence/selected/avif-grid-orphan-dimg-20261107-retry/.

AVIF monochrome padded-edge context parity — 2026-11-07

The 2026-11-06 sweep passed 244 active grayscale and monochrome AVIF decode parity rows but did not execute the right-starting arm at src/codecs/avif/av1/block.rs:43768. The new public parity row decode:avif:lossless_monochrome_padded_right_context_1x128 uses a pinned 1x128 all-lossless monochrome image. Its 4x4 coded leaves extend into AV1's padded right edge, so the complete streamed-lossless path declines the one-pixel width and the monochrome fallback must decode those leaves to build neighbor context.

The case first exposed an extent error when a decoded leaf lay entirely beyond the visible canvas. The canvas now validates the decoded leaf extent, then skips copying leaves outside its storage boundary; the caller retains each decoded leaf for subsequent neighbor context. The selected public parity run passed 1/1 rows with exact Pillow RGB8 output. Branch counts at line 43768 were [372, 93], covering both the left-starting and right-starting leaf arms. No unit tests were added.

Report: .coverage-mcp/local-evidence/selected/20261106T194911.355296Z-b547351b67784b919797bd8f766d4ba2/coverage.json (SHA-256 d93ee9e114bc60d7479f8d49a1ab7374ad252567e54875bb76773ced41876b85); receipt: .coverage-mcp/local-evidence/selected/20261106T194911.355296Z-b547351b67784b919797bd8f766d4ba2/coverage.local-evidence.json (SHA-256 a3413cb2fd6a292e0921691a22cd0da5051593b7472cab4b8ab588e7dea4384a). Coverage MCP is not connected, so the receipt marks source attribution unverified and test attribution unknown. This is selected local evidence, not an aggregate coverage update.

BMP direct inspection rejects an invalid signature — 2026-11-06

Added the target-only fault-contract:bmp:bmp_inspect_invalid_signature_rejected to exercise the BMP inspector signature guard below public format detection. The contract decodes the existing Pillow-backed decode:bmp:depth_24 fixture, checks its pixel parity, changes its first signature byte, and requires a structured BMP inspection error. The existing decode:bmp:error_malformed_truncated_magic case remains public parity for a one-byte B input; detection rejects it before dispatching to the BMP codec. The new inspection seam exists only in coverage builds.

The combined selected coverage run passed all four rows: two BMP parity rows and the BMP/PNG target-only inspection contracts (2/2, oracle not_applicable). Coverage MCP gaps reports no missing branch outcome at src/codecs/bmp/inspect.rs:13. This is a selected local report, not an aggregate coverage update; Coverage MCP labels its source identity unverified and test attribution unknown. Report: .coverage-mcp/local-evidence/selected/20261105T224352.555287Z-d9bf2dc18d524dcc8ab77765bad53e42/coverage.json (SHA-256 af96402ba566233ae7849f35f0e52d5e86ffb29a05be3a729cb545e927fb68be), with receipt .coverage-mcp/local-evidence/selected/20261105T224352.555287Z-d9bf2dc18d524dcc8ab77765bad53e42/coverage.local-evidence.json (SHA-256 358521f4b580b463496d131139e09946d083539d4663ccece8a70ab5f21ac82e). No unit tests or normal-build dispatch changes were added.

AVIF exact inter-block geometry coverage attribution — 2026-11-06

Coverage MCP showed the exact-plan geometry gate once per callback monomorphization in decode_inter_translation_impl. The validation now lives in the non-generic validate_inter_transform_plan_geometry helper so branch observations aggregate across callbacks. Its original plan gate remains conditional; release builds inline the helper, while coverage builds keep one attributed body.

The selected 11-row AVIF parity run passed 11/11. Its LLVM report covers 5,581/32,020 selected branches; that selected total is not an aggregate coverage result. Coverage MCP attributes the validation to one group and reports 243 branch outcomes unobserved in this selection. The exact geometry predicate still has 20 unobserved outcomes. A line-specific query identifies the missing false outcome for visible_height == 8 on B16x8.

Report: .coverage-mcp/local-evidence/selected/20261106T024555.293798Z-40ec0dcc56144ae1b4dc97a421c773b8/coverage.json (SHA-256 667c24f081b595ab2968429954d4f19b24f608a48b0d7b32d6bd56fc71b504b1), with receipt SHA-256 76cf804050d52b347d72b61d42cb13a9a048b294702249e4bba0910be50abcfa. Coverage MCP labels source identity unverified and test attribution unknown; the retained runner log records the 11 active parity rows.

A release A–B–B–A probe used the 2048×128 animated AVIF on an Apple M3 Pro with Rust 1.96.1, three cycles, 25 timed decodes per block, and 75 samples per version. The baseline median was 9.414 ms and the helper candidate was 9.308 ms (1.13% lower). The first cycle had high timing variance, so this is evidence against a material penalty on this workload, not a speedup claim. Raw samples, build logs, commands, and source hashes are retained at .coverage-mcp/local-evidence/perf/avif-geometry-helper-abba-20261106/.

The follow-up adds quality-70 and quality-99 two-frame parity inputs with a 16x15 clipped-height B16x8 partition. The fixture generator's pinned-oracle checks passed for both inputs, and the selected run passed all 1,393 active AVIF decode rows plus five encode rows. Coverage MCP still reports the false outcome for visible_height == 8 as missing at src/codecs/avif/av1/block.rs:49555; these cases expand clipped-height pixel parity but do not close that transform-plan geometry branch. The selected report covers 12,563/32,020 branches and is local evidence, not an aggregate coverage result. Report: .coverage-mcp/local-evidence/selected/20261106T060522.104147Z-73614bcc1f98460c905bb85edc0352f0/coverage.json (SHA-256 888d892e7216ca76f29c940e29b8c3bc86efbe5c949176cabb2d1b2a3adecd0a); receipt SHA-256 80abf08ed054a1371aab458f224f0c733affe2c1cf9ffbe16629b06e86712f82.

AVIF B16x8 16×7 reachability probe — 2026-11-06

A 16×7 8-bit I420 sequence was produced from a fixture-only copy of libaom configured to force a horizontal split. Pillow 12.2, dav1d 1.5.3, and AOM 3.13.2 decoded the sequence. The temporary selected-matrix run checked exact pixels for frame 0 and sequence decoding and structure; it did not assert exact pixels for frame 1. A temporary coverage-instrumented build did not call exact_inter_block_geometry, and the selected Coverage MCP query still reported the false visible_height == 8 outcome at src/codecs/avif/av1/block.rs:49555 as missing.

This probe does not qualify as a parity fixture for that branch. It also does not prove the branch unreachable for all valid AV1 inputs. These reports are exploratory; Coverage MCP marks source identity unverified and test attribution unknown. The probe did not add a permanent fixture or matrix row. Reports: .coverage-mcp/local-evidence/selected/20261106-b16x8-forced-height7-probe/coverage.json (SHA-256 626110884caa6935ecf564969c0b5c85737069e63f4d67824b9f6a6e71bb9bd9; receipt SHA-256 91acdbdd95198bf27c6cac7fc9c58c1e48e16f435aa3d52b8d1539950e4ad4ab) and .coverage-mcp/local-evidence/selected/20261106-b16x8-forced-height7-instrumented-probe/coverage.json (SHA-256 c73712e56050bbf8dcd1461dece49d9fe717c261eec5b86647f3fedcc8465b9c; receipt SHA-256 eb631124713e46455e827b3b2c16c87c06114d9b9592ab114ac9cfe47a943ef9).

The current source path explains why this input did not reach the predicate. decode_inter_transform_size admits a lossy B16x8 split plan only for a full 16×8 visible extent. Its lossless-grid admission allows clipped extents only for the separately bounded B32 profile. validate_inter_transform_plan_geometry calls exact_inter_block_geometry only for non-single plans. Thus the current admitted plan paths cannot call the B16x8 predicate with width 16 and a clipped height. This is a source-path finding for the current implementation, not a claim that every valid AV1 stream has this restriction. No public parity case has yet shown a supported way to reach the false height comparison; revisit it if the admitted B16x8 plan grammar changes.

AVIF bounded C-string parser consolidation — 2026-11-06

The container and sample readers each had a missing-terminator path that reported NeedMore when their bounded payload lacked a NUL byte. Both readers are reached only after the enclosing box or sample extent has been validated; an incomplete outer box is rejected by the whole-input parser first. The incremental branches were therefore unreachable through the public API. A shared c_string_len helper now returns the existing malformed-input contract for an unterminated bounded payload and keeps the common search inline in production builds. No fixture or private unit test was added.

Selected parity coverage passed 3/3: decode:avif:error_infe_missing_item_name_terminator, decode:avif:high_bitdepth_still_12bit_420_alpha_odd_edge_17x9, and decode:avif:animated_equal_picture_interval_two_ticks. make lint and cargo fmt --all -- --check passed. Coverage MCP queried c_string_len on the selected report and returned no missing branch groups; its source identity is unverified and test attribution is unknown.

A full all-feature make coverage run passed 57 parity/fault-matrix cases, 7 decode-policy cases, 1 determinism case, and 70 feature-contract cases. It measured 103,007/142,447 lines (72.312509%), 21,181/32,020 branches (66.149282%), 5,699/9,153 functions (62.263739%), and 156,758/220,692 regions (71.030214%). These are local LLVM totals; the report's SHA-256 is dd4691342a89bda868f96847043ebe5a7b009b274aee34e6e9c6e4b6feab8753. The 100% coverage goal remains open.

JPEG trailing DHT without EOI parity — 2026-11-05

Added decode:jpeg:baseline_444_single_scan_trailing_dht_no_eoi. Its 768-byte fixture removes only the terminal EOI marker from the valid trailing-DHT JPEG; the input SHA-256 is d011b9970ca7e690525a2db582647406828ede4d02c1c97a61224642668cfcd7. Pillow 12.2.0 verifies the structure and decodes the completed 8×8 RGB scan to 192 bytes with SHA-256 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f.

Before the parser change, Rust reached EOF after parsing the valid trailing DHT and returned a marker-stream error. It now preserves the entropy boundary at that DHT, accepts EOF after the completed baseline scan, and reports the entire input as consumed. The selected parity row passed 1/1, and the ten-row trailing-DHT parity selection passed 10/10, including malformed-DHT rejection cases. make lint passed across standard, all-feature, release, coverage-hook, AVIF-only, and JPEG benchmark configurations.

Coverage MCP gaps for parse_jpeg at line 554 returned status=measured and no missing branch outcome in the ten-row report. The MCP result labels source identity unverified and test attribution unknown; the local receipt records the exact selected parity pass. Report: .coverage-mcp/local-evidence/selected/20261105T201133.725391Z-c1a95409f7f64ae991ee5430333fe2f3/coverage.json (SHA-256 28080dc29ffda8ca8a18e34733cbbd9d24d7159a52bf01ac91655a9f7489472f), with receipt .coverage-mcp/local-evidence/selected/20261105T201133.725391Z-c1a95409f7f64ae991ee5430333fe2f3/coverage.local-evidence.json (SHA-256 ce4b4998e71a2a9ac3b099815073e7be225f0352c1889b6bce92ead503f19551). This selected result does not establish an aggregate coverage increase; the 100% coverage goal remains open. No unit tests or SIMD changes were added.

AVIF empty-movie container guard contract — 2026-11-05

The existing error_avis_moov_without_trak parity row is rejected during sample validation, before the separate container-inspection pass can evaluate container::parse_movie's empty-track guard. Extended the existing avif_container_inspection_invariant_guards target-only integration contract with a minimal AVIS ftyp plus empty moov, routed through a cfg(coverage) inspection seam. The runner checks the externally returned AVIF malformed inspection error; the normal decode and inspection paths are unchanged. No private unit tests were added.

The selected fault contract passed 1/1 with the oracle marked not applicable. Its local LLVM report records one true-arm execution at src/codecs/avif/container.rs:1518: .coverage-mcp/local-evidence/selected/20261105-avif-container-empty-movie-contract/coverage.json (SHA-256 dc5e039e084476aa0fe89deb3d8f879d51fc8f66468fe824a0030699ab146c87), with local receipt .coverage-mcp/local-evidence/selected/20261105-avif-container-empty-movie-contract/coverage.local-evidence.json (SHA-256 a26a9488f575e0959c53c53a0573fcf2dff9c36f63cb735047eeb8e8be45a824). The Coverage MCP interface is unavailable in this session, so the report remains local-only with unverified source identity and unknown MCP test attribution; this selected result does not update aggregate coverage totals.

A fresh full make coverage run on the same source tree passed, including all 57 coverage-matrix tests and 70 feature-gate tests. It measured 102,939/142,402 lines (72.287608%), 21,156/32,020 branches (66.071205%), 5,686/9,141 functions (62.203260%), and 156,664/220,621 regions (71.010466%). The report is .coverage-mcp/local-evidence/full/20261105-develop-avif-empty-movie-contract/coverage.json (SHA-256 27763b8ff91d159663cad7dfae9a706a67209d9033d665b15b438319be7782f3). These are local LLVM totals, not Coverage MCP-verified totals, and remain below the 100% goal.

AVIF duplicate track-box inspection parity contracts — 2026-11-05

Added target-only inspection contracts backed by the existing error_animated_duplicate_minf and error_animated_duplicate_stbl Pillow malformed-input parity rows. Each contract verifies the fixture hash, confirms normal inspection returns a structured malformed AVIF inspection error, then passes the same bytes through the coverage-only unvalidated container path. This reaches the duplicate minf and stbl guards in the second-pass parser without adding codec-private unit tests or changing normal decode behavior.

Both selected contracts passed (2/2), with oracle_status: not_applicable. The local LLVM report records the true arm at src/codecs/avif/container.rs:1589 for duplicate minf and line 1609 for duplicate stbl. Report: .coverage-mcp/local-evidence/selected/20261105T103824.192393Z-b883404e07d244db972bf7ede32f2ea6/coverage.json (SHA-256 924b1ad21fcd247bbe336f13015f8ea1c74ec0a0c098275711fb6a1f644255c1), with local receipt .coverage-mcp/local-evidence/selected/20261105T103824.192393Z-b883404e07d244db972bf7ede32f2ea6/coverage.local-evidence.json (SHA-256 9f0518b9cf2609407d78f12831314fff1e91f7ea4b9e12e772a54871a9f4ee7d). The Coverage MCP interface is unavailable in this session, so the evidence remains local-only with unverified source identity and unknown MCP test attribution; this selected result does not update aggregate coverage totals.

AVIF missing track-box inspection contracts — 2026-11-05

Added coverage-only inspection contracts for four existing active Pillow malformed-input rows: error_animated_missing_minf, error_animated_missing_sample_table, error_animated_missing_sample_size, and error_animated_missing_sample_description. Each source row still passes its public malformed-inspection parity assertion. The contract then routes the same hash-checked bytes through the unvalidated second-pass container parser, covering the missing minf, stbl, stsz, and stsd error paths. No fixture, normal decode path, or codec-private unit test was added.

The four Pillow parity rows and four target-only fault contracts passed 8/8. The selected LLVM report records the missing-minf arm at src/codecs/avif/container.rs:1598, missing-stbl at line 1616, and both missing sample-table checks at line 1643. Report: .coverage-mcp/local-evidence/selected/20261105T120826.837944Z-95426933047e4b1a8cdc714c51171970/coverage.json (SHA-256 dfcfb70c1926cc2d501455c88229a7be8580a9b2cceb9ca90dbef2a202612d28), with local receipt .coverage-mcp/local-evidence/selected/20261105T120826.837944Z-95426933047e4b1a8cdc714c51171970/coverage.local-evidence.json (SHA-256 e3e0d8870061f2bff0cc486682df1913096b684e87d3965376de5c06073680de). The receipt records a dirty source tree and unknown test attribution; this is selected local evidence only and makes no aggregate coverage claim.

Full LLVM coverage after missing track-box contracts — 2026-11-05

The full make coverage PYTHON=.oracle-venv/bin/python run passed after the four missing-track-box inspection contracts were added. The coverage matrix passed 57/57 cases and the feature-gate matrix passed 70/70; the remaining full-run targets also passed, and all configured coverage floors passed. Coverage measured 102,944/142,402 lines (72.291120%), 21,162/32,020 branches (66.089944%), 5,686/9,141 functions (62.203260%), and 156,673/220,621 regions (71.014545%).

The retained report is .coverage-mcp/local-evidence/full/20261105-develop-avif-missing-track-box-contracts/coverage.json (SHA-256 c84d9b26cd42eb619a0d28d60ae5c24c8460ab5f705940e415aa4281feef616c). It was generated from source revision e5ce3f22761d42ffd2c4b6269207432ad69311d1 with the AVIF contracts and generated evidence changes present in a dirty working tree. Coverage MCP was unavailable, so this is local LLVM evidence without MCP build or per-test attribution; the aggregate remains below the 100% goal.

Full LLVM coverage refresh after duplicate-box contracts — 2026-11-05

The full make coverage PYTHON=.oracle-venv/bin/python run passed after the duplicate minf and stbl inspection contracts were added. The 57 coverage- matrix tests and 70 feature-gate tests passed, along with the other full-run targets; all configured coverage floors passed. The report measures 102,941/142,402 lines (72.289013%), 21,158/32,020 branches (66.077452%), 5,686/9,141 functions (62.203260%), and 156,669/220,621 regions (71.012732%).

The local LLVM report is .coverage-mcp/local-evidence/full/20261105-develop-3e88e28/coverage.json (SHA-256 fb5ea175c1d28ff2492c64dc065374a639c5c2c592a534510b93c6f41ddae472), generated from source revision 3e88e28bca547c25a46ff2da7b661c16955dc53a. Coverage MCP was unavailable, so this report has no MCP build or test attribution. The aggregate remains below the 100% goal.

JPEG partial trailing DHT length parity — 2026-11-05

Added decode:jpeg:baseline_444_single_scan_dht_partial_length. The fixture appends one byte of a DHT length field after the trailing DHT marker in a completed baseline scan. Pillow 12.2.0 accepts the JPEG and returns the pinned 192-byte RGB reference; the parser now treats the incomplete trailing length as the end of that completed scan. The fixture SHA-256 is bee79bee58292421431950ef3ee8f0b3b09d93a8a3d0e990e1eab76abb6015be; the RGB output SHA-256 is 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f.

The selected parity row passed 1/1, and the nine-case trailing-DHT bundle passed 9/9. Its report is .coverage-mcp/local-evidence/selected/20261105T025920.650568Z-7bbdba25dcab4b6f9896271d50c86950/coverage.json (SHA-256 ce56d9a45b2a52f6337f1f2cffa0df53d9810960edb71ebd6da6142959e3bdce) with local execution receipt .coverage-mcp/local-evidence/selected/20261105T025920.650568Z-7bbdba25dcab4b6f9896271d50c86950/coverage.local-evidence.json (SHA-256 abf806063812e35dfea6809e5e1b5e42ea279e2b4b5445485a0bda1eee84d05e). Coverage MCP identifies this receipt as local-only with source unverified and tests unknown, so the selected run makes no aggregate coverage claim. No unit tests or SIMD/performance changes were added.

The fresh full make coverage run passed and measured 102,910/142,381 lines (72.2779%), 21,156/32,026 branches (66.0588%), 5,680/9,136 functions (62.1716%), and 156,632/220,604 regions (71.0014%), above the configured floors but below the 100% goal. Its local report is .coverage-mcp/local-evidence/full/20261105-develop-jpeg-partial-dht/coverage.json (SHA-256 c53bba19c1f5f61a818b9c86f69aea424f69fda4ebf8a0e82e74f7c281822e9c). The full-run report has no Coverage MCP source/build receipt, so these totals are local make coverage evidence only.

JPEG bare trailing DHT parity — 2026-11-05

Added decode:jpeg:baseline_444_single_scan_dht_missing_length. The fixture replaces a trailing comment and EOI in a baseline 4:4:4 JPEG with a bare DHT marker at EOF. Pillow 12.2.0 accepts the completed scan and returns the pinned 192-byte RGB reference. Before the parser change, the Rust decoder rejected the missing DHT length; it now stops at that marker only after a completed single baseline scan. The seven neighboring trailing-DHT rows also passed, including malformed length and truncated table cases.

The fixture SHA-256 is 7c8f8b67f671325d938bb236da0d4d702b89f636128ae3328dfa494b669b345d; the Pillow RGB SHA-256 is 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f. The selected eight-row parity run passed 8/8. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261104T222908.928036Z-e30160c11127480c9d407eaf528cf437/coverage.json (SHA-256 1a26547544e9ea51be81301d867a94e750efabe6cb7ec5e4ae00377803db71c7) and its execution receipt is .coverage-mcp/local-evidence/selected/20261104T222908.928036Z-e30160c11127480c9d407eaf528cf437/coverage.local-evidence.json (SHA-256 2e3590a0f92e7789ba8df8f82a81d7f7708ec326a3761592b09b0aebd06aca85). The receipt marks source identity unverified and test attribution unknown, so this selected result makes no aggregate coverage-gain claim. No unit tests or SIMD/performance changes were added.

AVIF I422 B8x4 qindex-zero parity — 2026-11-05

Updated decode:avif:animated_lossy_inter_422_b8x4_qindex0_mode_select_64x64 with a reproducible 64x64 8-bit I422 witness. The fixture-only AOM patches create a non-lossless qindex-zero inter frame and preserve a horizontal B8x4 partition at the top-left root. The generator's pinned --check passed; the 11,725-byte AVIF hash is 5c2fd79d69b2fb1a96542c30ea4eb6d103993982f9f322b1e64d040730f946f9. Pillow 12.2.0 frame hashes are 246f2904b49d857c90295a1a379d1eadea4058a6e04c8df8639aac4392732d50 and 2daef02f6cde1d7914f04e930bf65f36a0bc74273f1a1029a5ec054434611b14.

The updated selected parity row passed 1/1. A temporary diagnostic trace observed split_b8x4=true, exact_b8x4=true, and axis_q0=true for the target I422 block. The selected LLVM report records the line 49910 condition as true once and false zero times. This local report is not a verified Coverage MCP attribution: its receipt says source=unverified and tests=unknown, so no aggregate coverage gain is claimed. The report is .coverage-mcp/local-evidence/selected/20261104T205205.022074Z-52dd75df25c24e5ab2704c3745243932/coverage.json (SHA-256 e62dd245728da4bb95e220c4f7750e08f2fc0729f3e34bda108b377d41016160); its local execution receipt is .coverage-mcp/local-evidence/selected/20261104T205205.022074Z-52dd75df25c24e5ab2704c3745243932/coverage.local-evidence.json (SHA-256 fc0d2bf99b19f6fb6d3efe11609039dd4bdd8409ac2c0ca19d9f4e0f9125bfae). No Rust decoder, SIMD, or performance code changed, and no unit tests were added.

TIFF tiled grayscale edge parity — 2026-11-04

Integrated three public TIFF parity rows for big-endian 17x17 grayscale images stored in 16x16 Deflate-compressed tiles with clipped right and bottom edges: decode:tiff:tiled_gray16_be_deflate_clipped_edges, decode:tiff:tiled_gray16_be_deflate_predictor_clipped_edges, and decode:tiff:tiled_gray32_signed_be_deflate_predictor_clipped_edges. The cases cover unsigned Gray16 with and without horizontal Predictor=2, plus signed Gray32 with Predictor=2. The pinned Pillow 12.2.0 references contain 578 bytes for each Gray16 image and 1,156 bytes for Gray32; selected parity passed 3/3.

The local selected coverage report is .coverage-mcp/local-evidence/selected/20261104T115324.874376Z-d3b6c49b337b45549ed281d7443afd1a/coverage.json. It records the three selected rows only; no full-suite coverage or marginal global coverage claim is made. No production codec code, unit tests, or SIMD changes were added.

JPEG oversized trailing COM parity — 2026-11-04

Added decode:jpeg:baseline_444_single_scan_com_oversized_length. The fixture is an 8x8 baseline 4:4:4 JPEG with one scan and a trailing COM length that extends beyond EOI. Before the decoder change, it failed with a truncated metadata payload error; Pillow 12.2.0 decodes it as RGB. The parser now stops at EOI for this completed single-scan case, and entropy reconstruction ends at the completed scan. The decoded 192-byte output matches Pillow exactly.

Input SHA-256: b554f0b32009da0282d524952288a3dd561c85f7d50591af6a3a997ba13c15f0; raw RGB SHA-256: 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f. The pinned fixture generator passes --check. The fresh one-row parity run passed 1/1; its local report is .coverage-mcp/local-evidence/selected/20261104T054723.457215Z-b5ffbd42328743bb8fd6ae04e8397890/coverage.json (SHA-256 fd00cca8e5c1aecc21a08b24c1778ada33aa5252b900700ce9cc9f37155bdf60) and its execution receipt is .coverage-mcp/local-evidence/selected/20261104T054723.457215Z-b5ffbd42328743bb8fd6ae04e8397890/coverage.local-evidence.json (SHA-256 37b26ab729274e762d7400c1038e5b563457038db4c549eb74f846bab96bba4e). Coverage MCP records the true side of the decoder condition at line 3051 and reports the false side as the remaining selected-report gap. The receipt says the selected row passed, but MCP source identity is unverified and test attribution is unknown; treat this as local measurement evidence, not a managed attribution receipt.

The final full coverage report is .coverage-mcp/local-evidence/full/20261104-jpeg-com-oversize/coverage.json (SHA-256 4bad12103c6f554a4e2f0399cfaf4b12b72798db7b7da036e09b8d0b7a0a9b69). The coverage matrix passed 57/57 rows. The report records 102,857/142,351 lines (72.2559%), 21,109/32,010 branches (65.9450%), 5,680/9,137 functions (62.1648%), and 156,551/220,549 regions (70.9824%). Coverage MCP's full-scope comparison is limited: source identity is unverified and tests are unknown, so its coordinate deltas are not a verified gain or regression. make lint, make lint-x86-simd, and fixture-integrity refresh passed. No unit tests or SIMD changes were added, and no performance gain is claimed.

JPEG oversized trailing APP1 parity — 2026-11-04

Added decode:jpeg:baseline_444_single_scan_app1_oversized_length for an 8x8 baseline 4:4:4 JPEG whose post-scan APP1 length extends past EOI. The pinned Pillow 12.2.0 oracle verifies and decodes the file as RGB. The JPEG parser now applies its completed single-scan tolerance to oversized APP and COM segments; both cases produce the same 192-byte pixels as Pillow.

Input SHA-256: 53a5354d026c35b5a1f105af5192e1213fb873bae48b253728a85fcbc07add4f; raw RGB SHA-256: 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f. The pinned generator passes --check. The focused COM and APP1 parity run passed 2/2. Its local selected report is .coverage-mcp/local-evidence/selected/20261104T125849.464658Z-6ab952a8b202434bbc4f770b94197d6f/coverage.json (SHA-256 cbd227a50f6343693931269991a4e2bfac8f19ce48bec298b3029aa14f931141) and its execution receipt is .coverage-mcp/local-evidence/selected/20261104T125849.464658Z-6ab952a8b202434bbc4f770b94197d6f/coverage.local-evidence.json (SHA-256 18b7c93551cbd3b7b783729a96fd7cfd2dcd8563a9c7a9f980ebd32a91847362). Coverage MCP still reports 27 branch observations missing across single_baseline_scan_entropy_end in this selected report. Source identity is unverified and test attribution unknown; this is local evidence, not a managed attribution receipt. No performance gain is claimed.

JPEG oversized trailing DHT parity — 2026-11-04

Added decode:jpeg:baseline_444_single_scan_dht_oversized_length for an 8x8 baseline 4:4:4 JPEG whose post-scan DHT length extends past EOI. The complete file verifies and decodes through Pillow 12.2.0 as RGB. The parser stops at EOI for this oversized DHT after the completed single baseline scan; the decoded 192-byte output matches Pillow.

Input SHA-256: 3a948d8d4900f6b30d6cfef147dbe7a1a84b02ff8e628fb728e79b74d9576211; raw RGB SHA-256: 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f. The focused COM, APP1, and DHT parity run passed 3/3. Its local selected report is .coverage-mcp/local-evidence/selected/20261104T133654.454668Z-1addb5ea4768434d92ffdc5d4dee3a85/coverage.json (SHA-256 18b4aef9b87f84b469400b7740dff791787d5dc39e8f6ec27a1423e2649f9c3c) with execution receipt .coverage-mcp/local-evidence/selected/20261104T133654.454668Z-1addb5ea4768434d92ffdc5d4dee3a85/coverage.local-evidence.json (SHA-256 0459ec12a3423d6e2c9327a274df7c0d864d42716ea054836ed35708db631258). Coverage MCP reports no missing branch observations at decoder line 3052 in this selected report; it still lists two false edges in the parser guard at line 539. Source identity is unverified and test attribution unknown, so this is local evidence only.

Added decode:jpeg:baseline_444_three_scans_dht_after_second_scan to cover the second false edge with a valid three-scan baseline JPEG. It repeats the four header Huffman tables between the second and third scans; Pillow 12.2.0 verifies and decodes it to the same 192 RGB bytes as the source. The input SHA-256 is 8fa86b39601dc652d6a6a7f65c3e15d48568d7498071b1f1fd390f87787fc353, and the pixel SHA-256 is 0d4dccc69dc0ee4ae956be8c624186ddb2b5f3d411671361056c51a7ea7f9e66.

A five-case selected run also included decode:jpeg:progressive_spectral to cover the progressive false edge, plus the COM, APP1, and oversized-DHT rows. All 5/5 parity rows passed. The selected report is .coverage-mcp/local-evidence/selected/20261104T134938.253878Z-c88b364b31b4436eaf2b1b02421c82b0/coverage.json (SHA-256 1037fae1434d560027da3bd6ecffb31113445576fe68a998aed3d5e9a17e4a7d), and its local receipt is .coverage-mcp/local-evidence/selected/20261104T134938.253878Z-c88b364b31b4436eaf2b1b02421c82b0/coverage.local-evidence.json (SHA-256 700acca8621e54de29943481a8c70e1ef4b5460c29a9ae209ba6f3a62850398c). The selected aggregate is 3,779/142,382 lines (2.6541%), 546/32,032 branches (1.7045%), 258/9,137 functions (2.8237%), and 5,959/220,601 regions (2.7013%). Coverage MCP reports zero missing branch observations at parser line 539 and decoder line 3052 for this report. Source identity remains unverified and test attribution unknown; these selected totals are not a full-project coverage claim.

JPEG row upsampling overflow fault contracts — 2026-11-04

The prior full Coverage MCP report identified uncovered checked-overflow exits in fancy_upsample_row: row-start multiplication, required-source-length addition, and destination-height multiplication. Valid JPEG dimensions and sampling ratios cannot reach these usize overflow states in the 64-bit coverage build. Added three target-only fault-contract rows that inject those states through the existing public YCCK decode case and require an error followed by a successful uninjected retry. The hooks are cfg(coverage) only; production decoding has no added checks.

The selected fault-contract run passed 3/3. Its local report is .coverage-mcp/local-evidence/selected/20261104-jpeg-row-overflow-fault-contracts/coverage.json (SHA-256 a511e62430c8c2f350e0c13cc9bc8501e2d104a0d46d91b36ca5844f039c0519) and its execution receipt is .coverage-mcp/local-evidence/selected/20261104-jpeg-row-overflow-fault-contracts/coverage.local-evidence.json (SHA-256 689b07131d293030cd09740630070b346d012e5258bfa22d0f6fac587016baf3). Coverage MCP finds no remaining branch gaps at upsample.rs lines 386, 389, and 400 in the selected report. Source identity remains unverified and test attribution unknown; this is local selected evidence, not a managed receipt. No unit tests were added, and the full-project report was not refreshed for these three coverage-only hooks.

AV1 partition walker even-grid invariant — 2026-11-04

The AV1 partition walker derives frame extents as twice the number of 8-pixel blocks, so frame bounds are even in its four-pixel grid. Tile origins and superblock roots are aligned to at least 16 grid units, and recursive offsets before level 4 are even. A level-4 node inside its root therefore has at least two grid units remaining and cannot enter the old no-split boundary-leaf path. That path and its redundant frame-bound checks were removed; valid partition and block parsing is unchanged, with fewer checks in the recursive walk.

Four existing Pillow-backed AVIF parity rows passed: 10-bit I420 CDEF at 15x16, a 73x64 lossless monochrome grid, 10-bit lossless I444, and lossless I444 film grain. The selected report is .coverage-mcp/local-evidence/selected/av1-partition-even-grid-20261104/coverage.json (SHA-256 561e37ac…2f81d6). Its local execution receipt records 4/4 passed and no source changes during the run; Coverage MCP identity and test attribution remain unverified. make lint passed formatting and all configured strict Clippy lanes, including coverage and AVIF-only builds. No parity rows or unit tests were added.

An ARM64 A-B-B-A release probe of the 2048x128 AVIF sequence used two runs of 42 and 120 timed decodes per revision. Their directions differed (+3.4% and -2.2%); pooled medians were 9.887 ms before and 9.857 ms after. This is no measurable speed change, not a speedup claim. Raw samples and host/build details are retained under .coverage-mcp/local-evidence/perf/av1-partition-even-grid-20261104/. The measurement is ARM64-only and says nothing about SSE2 or AVX2 runtime performance.

AVIF all-lossless I422 B16x16 parity and selected coverage — 2026-11-04

Added decode:avif:animated_lossless_inter_i422_fixed_b16x16_64x64, a two-frame 64x64 8-bit I422 all-lossless sequence with fixed 16x16 inter partitions. The pinned Pillow 12.2.0/libavif 1.4.1/libaom 3.13.2 generator reproduces the input hash 43866d1b…e4343 and both exact RGB frame hashes. Both decoded frames match the pinned Pillow output, and a separate pinned native loop observation confirms the two-frame sequence and infinite repetition. The manifest's older B4x8 I420 row now reflects its supported sequence parity instead of retaining a stale unsupported expectation.

A selected cargo llvm-cov parity run passed all 1,391 AVIF rows: 1,386 decode rows and five encode rows. The source and fixture inventories did not change during that run. Its local report is .coverage-mcp/local-evidence/selected/20261103T185507.555297Z-5a1d2c210a464100a0853b8e4de45f06/coverage.json (SHA-256 e109b0859b01039590b374f0aab1dccc985044fc935a54fb4644da639b856fc4). For this selected profile, LLVM reports 53,253/142,370 lines, 12,541/31,998 branches, 2,917/9,138 functions, and 76,721/220,595 regions covered. These are selected-run totals, not a full-project baseline or a 100% coverage claim.

The coverage-mcp gaps query for src/codecs/avif surfaced missing branches in AV1 inter-translation paths in src/codecs/avif/av1/block.rs. The report is local-only: Coverage MCP marks its source as unverified and tests as unknown, because this CLI has no receipt-registration action. No unit tests were added; the next coverage work is to map the remaining gaps to public parity inputs and target-only fault contracts.

AV1 CDEF aligned chroma edge parity — 2026-11-03

Added decode:avif:coverage_i420_intra_cdef_10bit_15x16 to cover a CDEF boundary not reached by the existing odd-size cases. With a 15-pixel I420 luma width, the corresponding visible chroma width is 8 and ends on a complete four-sample CDEF block. This reaches the in-plane boundary path for chroma while the luma plane still exercises its partial right edge.

The case exposed an incorrect edge extension in frame_coordinate: samples beyond a coded plane were clamped to its last coded sample. AV1 treats those tap locations as unavailable. The decoder now rejects coordinates at or past the coded extent and still preserves hidden samples that lie inside it. The new row initially differed from the pinned Pillow output in 30 of 720 RGB bytes at the final column; after the fix, the exact output matches. The existing 9x9 and 9x16 CDEF rows plus this 15x16 case pass 3/3.

The final one-row selection passes 1/1 and records 798 in-plane and 819 out-of-plane decisions at the coded-extent guard. Its selected LLVM report is .coverage-mcp/local-evidence/selected/av1-cdef-chroma-align-15x16-final-20261103/coverage.json (SHA-256 743609b3a4f1b4fd910d3c9a4815c8e03b07ec21cf5032d2306862f0b9908eb); the adjacent local evidence receipt has SHA-256 6d5c4bfa70ae8f21d7c26c9971d6641d3716fb463ac710a81632626258b9e6c5. The source inventory hash remained the same before and after this selected run. This is local selected evidence, not a Coverage MCP receipt or a full-suite coverage result. No unit tests were added and the full coverage baseline was not refreshed.

AV1 CDEF low-variance parity — 2026-11-03

Added decode:avif:coverage_i420_intra_cdef_10bit_low_variance_16x16, a 16x16 full-range 10-bit I420 key frame with active CDEF and nonzero but low luma direction variance. The parity row passes 1/1 against the pinned Pillow 12.2.0/libavif 1.4.1 RGB output. Its selected LLVM report records nine takes of the variance >> 6 == 0 arm in adjust_primary_strength and three takes of the zero-variance early return.

The report is .coverage-mcp/local-evidence/selected/cdef-low-variance-final-20261103/coverage.json (SHA-256 bfc56e8b6f934ee20309936f509ba30e913b84ab724d3c9f6efe958840f4d021); the adjacent local evidence receipt has SHA-256 9725baf0e278cfa0f50f747209e4713ff064b2fa87094890d66bd3512fbf41a9. This is local selected evidence, not a Coverage MCP receipt or a full-suite coverage result. No unit tests were added and the full coverage baseline was not refreshed.

AV1 chroma-grain overlap and scaling invariants — 2026-11-03

Two more film-grain branches were unreachable after public parameter checks. Scaling points are strictly increasing before generate_scaling, so its zero-width interval skip was redundant; zero intervals now reach the existing checked-division error. Chroma overlap spans one sample along a subsampled axis, so blend always receives index zero when using chroma weights. Removed that redundant index condition while retaining both luma weight pairs.

The existing public I422 U-only, I422 10-bit overlap/restricted-range, and malformed non-increasing-Y parity rows passed 3/3 with exact Pillow outcomes. The selected local LLVM report is .coverage-mcp/local-evidence/selected/20261103T053658.094666Z-f975453674d64bc1a05c35c50f741bed/coverage.json (SHA-256 de1567295f1b69a93e95a3ae398745701635d2bd9a64fee606ccea76505a627f). It records both chroma and luma blend branches in this selected run. This is local selected evidence, not a Coverage MCP receipt or a full-suite coverage result; the full baseline was not refreshed. No new matrix rows or unit tests were added.

AV1 chroma-only film-grain guard cleanup — 2026-11-03

apply_chroma_ar_lut already exits the central coefficient loop when Y scaling points are empty. The later luma contribution therefore only runs with non-empty Y points. Removed its redundant empty-Y conditional, whose zero arm was unreachable and obscured that invariant. The existing public decode:avif:filmgrain_422_8bit_u_only_64x64 parity row exercises the legal zero-Y/active-chroma path and passed 1/1 with exact Pillow RGB output. Its selected local LLVM report records 7,980 visits to the empty-Y guard: .coverage-mcp/local-evidence/selected/20261103T050420.721871Z-1837669f8c8a41da8131bacb50624d65/coverage.json (SHA-256 4635095f6bb4713ce868e4bb86e40d1096e0becfb8a1b78cd5a7c5ad1f1dbf5e). This is local selected evidence, not a Coverage MCP receipt or a full-suite coverage result. The full coverage baseline was not refreshed. make lint passed all configured format and strict Clippy lanes; no unit tests were run.

AVIF mixed-segment super-resolution with CDEF and film grain — 2026-11-03

Added decode:avif:animated_mixed_lossless_superres_420_8bit_cdef_filmgrain_80x48. The pinned libavif 1.4.1/AOM 3.13.2 input combines mixed-segment 4:2:0 super-resolution, active inter-frame CDEF, and display film grain. Both 80×48 RGB frames match the pinned Pillow 12.2.0 output exactly. The generator checks the fixture digest and active CDEF strengths.

The local selected cargo llvm-cov run passed all 34 selected mixed-superres rows and one ordinary AVIF control. Its source and fixture inventories stayed unchanged during execution. The retained report is .coverage-mcp/local-evidence/selected/20261103T021139.218417Z-43ec103ff51e4576adebd5638867eac1/. Coverage MCP was not queried: this session has no MCP receipt-registration or CLI bridge, and the local receipt records source as unverified and test status as unknown. This selected run does not establish global coverage; the four 100% coverage metrics remain open.

AV1 mixed-super-resolution active deblocking parity — 2026-11-03

Added decode:avif:animated_mixed_lossless_superres_420_8bit_loopfilter_80x48. The 80×48 8-bit 4:2:0 sequence uses super-resolution denominator 10 and nonzero Y/U/V deblocking on both its key and inter frames. Pinned AOM 3.13.2 accepts the sequence, and the two RGB frames match Pillow 12.2.0 exactly (abcb8903…2305 and df65607b…f02ca). The focused selected parity run passed 1/1 with exact 11,520-byte RGB output.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261103T030016.796649Z-3deb9e53bf524471bc6a97fef91aa91f/coverage.json (SHA-256 a283fb33b4c3a3cd79b0296d3860f453a76806524f8b242efbf63c946e9d2f70); its local receipt SHA-256 is 3c67077b3407e32b43eb958d93581a193c873b36ea51c12123bd814cca8715b4. This is local selected evidence, not a Coverage MCP receipt or full-suite coverage result. No Rust unit tests or production-source changes were added.

AV1 10-bit 4:4:4 mixed-super-resolution deblocking parity — 2026-11-03

Added decode:avif:animated_mixed_lossless_superres_444_10bit_loopfilter_80x48. The two-frame 80×48 10-bit 4:4:4 sequence uses a coded inter width of 64, denominator-10 super-resolution, mixed lossless/lossy inter segments, and nonzero Y/U/V deblocking on both frames. The pinned libavif/AOM producer reproduces the 3,810-byte fixture twice; an independent pinned libavif observation decodes both frames and reports infinite repetition. Pillow 12.2.0 produces exact 11,520-byte RGB references for both frames (abcb8903…2305 and 00068330…eefe5). The selected parity run passed 1/1.

The local selected LLVM report is .coverage-mcp/local-evidence/selected/av1-mixed-superres-444-10bit-loopfilter-20261103/final/coverage.json (SHA-256 af4815dd99946029456343e6ab54ed79dece84c625997fd2eca2c52c3663c383); its local receipt SHA-256 is 04ab0586b5010948f749487ee45c47291bf0360073636cd2340228ae023c3de0. In this selected run, src/codecs/avif/av1/filter.rs covered 135/252 branches (53.57%). This is local selected evidence, not a Coverage MCP receipt or a whole-repository coverage result. No Rust unit tests or production-source changes were added.

AV1 loop-filter sharpness parity — 2026-11-03

Added decode:avif:avif_loopfilter_sharpness_420_8bit_still_128x128, a 128x128 8-bit 4:2:0 still whose key frame carries sharpness 7 and active Y/U/V deblocking. The pinned libavif 1.4.1/AOM 3.13.2 producer reproduced the input twice with identical bytes (SHA-256 0a00c49e15b5b66fdb7c0b2ac130698c3f4ab52a2863b5a762b5e938351beb78)). Pillow 12.2.0 supplied the exact 49,152-byte RGB reference (5e2824bb560253f7dfdfff3a641c73217d35ca0b62cce96910039df1bd2721a0`); the selected public parity run passed 1/1.

The local selected LLVM report is .coverage-mcp/local-evidence/selected/20261103T042707.955830Z-d4a9dab2d48c4a94b137b9e978336c6f/coverage.json (SHA-256 fd5c3aa8cfbce28e6088a93cda7cf3ce93fc1dfb734348697b44205b31415570); src/codecs/avif/av1/filter.rs covered 88/252 branches for this selected row, and the sharpness branch at line 528 recorded 384 hits. Its local receipt SHA-256 is 125cec8c4d4b00e5926468fe65fd3a45d4d2f23448101bc2525f95e49b5b1f9f. Coverage MCP was unavailable, so this is local selected evidence only, not a managed attribution or full-suite coverage claim. No Rust unit tests or production-code changes were added.

AVIF implicit layer IDs and frame timing — 2026-11-03

Absent AV1 OBU extensions supply temporal/spatial IDs of zero. The decoder now applies its selected operating-point mask to those IDs instead of rejecting a frame whenever any operating point has a nonzero mask. The obsolete cached flag and sequence-wide scan are removed. A sample containing only excluded layers is malformed rather than an unsupported implementation subset; OBU bounds are still validated before layer selection. This makes no measured latency claim.

Twenty new complete-container parity inputs cover twelve valid timestamp/layer layouts and eight malformed neighbors. They distinguish absent and explicit zero IDs, explicit temporal-one IDs, excluded implicit layers, absent/mixed operating-point parameters, multiple admitted points, one/two-bit timestamps, timestamp EOF and six bounded frame-header prefixes. All sixty complete frame buffers and observable durations from the twelve valid inputs match pinned Pillow 12.2.0. Twelve fresh repeated libavif 1.4.1 observations independently retain their loop counts. All 577 preceding native observations are unchanged.

The fresh canonical selection passes 26/26 cases: twenty additions and six existing controls. Its actual executable, two profiles, 139 source files, 128 fixtures and eight producers are retained. The initial 25/26 run exposed the unsupported-versus-malformed classification mismatch and remains recorded as a failure. The corrected run's Coverage MCP context reports source matches_receipt and tests passed; it is explicitly locally derived evidence, not managed MCP execution.

A fresh full all-feature campaign passes six integration executables with 140 checks, all 3,775 active parity rows and 167 separate target-only fault rows. Every executed case ID occurs exactly once in the final pass ledger. Fault oracles remain not_applicable; 27 planned AVIF encoder rows are unexecuted. All 657 source/setup files and 11,205 fixture files remain byte-identical during execution. The actual base revision is 9f94c0b7b with the retained dirty-tree changes. Actual executables, profiles, sources, inputs and original reports are retained. Coverage is 102,450/142,191 lines (72.0510%), 20,950/31,980 branches (65.5097%), 5,667/9,136 functions (62.0293%) and 156,021/220,396 regions (70.7912%). Alpha floors pass; strict 100% exits 2 and remains unmet. No coverage exclusions or lower floors are introduced. The fresh full report replaces the older frame-parser mapping for current gap planning; source changes affect its denominators. Historical managed measurements remain unchanged.

All 3,782 preceding matrix rows, 1,330 preceding AVIF JSON rows and 167 fault rows retain their observations. Prior AVIF loop-evidence index digests refresh because the index gains twelve witnesses; earlier pixel files remain exact. Pinned fixture generation, repository verification and strict default, all-feature, release, nightly coverage and AVIF-only Clippy checks pass. No codec unit tests, unsafe code, runtime dependencies or public APIs are added. Original selected and full execution evidence remains under .coverage-mcp/local-evidence/parity/avif-frame-timing-canonical-20261103/ and .coverage-mcp/local-evidence/full/20261103-9f94c0b7b-avif-layer/.

AVIF timing, display-delay and depth EOF neighbors — 2026-11-03

Eight additional complete-container inputs stop inside decoder-buffer and frame-presentation delay widths, the low-delay-mode flag, initial-display-delay value, twelve-bit selector, monochrome color range, and horizontal or vertical subsampling selectors. Valid picture-interval UVLC values and complete repeated operating points align these fields without changing the frame payloads. The pinned Pillow oracle and public Rust decoder match all 92 complete frame buffers from 28 healthy layouts. Header verification accepts the eight bounded neighbors; decoding rejects each one at its intended sequence-field EOF path.

A fresh canonical selection passes all eight new cases and four existing healthy controls. Its actual executable, two profiles, 139 source files, 32 fixtures and eight producer files are retained. Coverage MCP reports source matches_receipt and tests passed through an explicitly locally derived context. This is not managed MCP execution. The unchanged sequence-parser region mapping gains eight observed regions: the compatible retained union is 487/492, up from 479/492. This is not a fresh full run or a new global coverage percentage; five regions in this mapping remain unobserved.

The fixture producer preserves all 29 preceding generated input files exactly. All 3,774 preceding matrix rows, 1,322 preceding AVIF JSON rows, 7,666 preceding output artifacts, the native-loop index and 167 target-only fault rows are unchanged. Pinned producers, fixture integrity and repository verification pass. These additions change no production Rust and add no codec unit tests, new fault rows, coverage exclusions or lower coverage floors. Original execution receipts remain in .coverage-mcp/local-evidence/parity/avif-sequence-timing-depth-alignment-20261103/.

AVIF operating-point alignment and EOF neighbors — 2026-11-02

Eight further complete-container cases align later sequence fields by repeating valid default operating points. They cover EOF at the delta and additional frame-ID widths, inter/intra and joint-compound flags, integer-motion selector, explicit screen-content-tools value, CDEF flag, and monochrome selector. The live pinned oracle preserves all 96 complete frame buffers across 24 healthy layouts; the public Rust decoder matches every buffer. Both reject each shortened neighbor, and its retained profile hits the intended EOF region.

A fresh canonical selection passes all 17 new cases from this combined batch and nine existing controls. Its actual executable, two profiles, 139 source files, 85 fixtures, and eight producer files are retained. Coverage MCP reports source matches_receipt and tests passed through a locally derived context; this is not managed MCP execution. The identical owned sequence-parser region mapping has a compatible observation union of 479/492, up from 463/492 before this batch. These 16 additional observed regions do not constitute a fresh full run or a new global coverage percentage.

All 3,766 preceding matrix rows and 1,314 preceding AVIF JSON rows retain their exact outcomes after the eight additions. The native-loop index, all 167 target-only fault rows, and 7,666 preceding output artifacts are unchanged. Pinned producers, fixture integrity, and documentation checks pass. No production Rust changes, codec unit tests, coverage exclusions, or lower coverage floors are introduced.

AVIF sequence EOF fields and accepted padding neighbor — 2026-11-02

Nine additional public manifest cases cover eight sequence-field EOF paths and one complete header with an extra zero padding byte removed. Every input retains a bounded complete container and consistent sample/primary-item extents. Pinned Pillow 12.2.0 verifies each container, rejects the eight EOF neighbors through still and sequence decode, and preserves all five complete frames and durations for the padding neighbor. A fresh repeated libavif 1.4.1 observation independently retains that input's infinite repetition count.

Canonical selected coverage passes all nine new cases and eight healthy controls. The 139 codec/build/test source hashes and 73 selected fixture hashes remain unchanged during execution; the actual executable and profiles are retained. Coverage MCP reports source matches_receipt and tests passed through an explicitly locally derived selected-execution context.

The identical owned sequence-parser mapping has 492 regions. Combining the retained full baseline and two canonical selections covers 471 regions, up from the preceding union of 463. This is a compatible observation union, not a fresh full run or a new global coverage percentage. The 3,757 preceding matrix rows retain their public outcomes; their only observation-metadata change is the loop-index digest after appending one native observation. All 576 preceding native loop records, 167 target-only fault rows, and 7,652 preceding output artifacts retain their exact contents. No codec unit tests, production Rust changes, new fault rows, coverage exclusions, or lower floors are introduced.

AVIF selected and ignored operating-point layers — 2026-11-02

Three new complete animation inputs exercise AV1 operating-point selection through ordinary public parity. The existing animated_opidc_0x101 control selects temporal and spatial layer zero with explicit frame extensions. Two neighbors insert an empty frame OBU on unselected temporal layer one or spatial layer one before the first selected frame. Pinned Pillow ignores those OBUs and preserves all five complete RGB frames and their durations. A third input claims a payload larger than its bounded sample on an ignored layer; both Pillow and Rust reject decoding after successful header verification. Layer selection does not bypass the envelope bounds check.

The pinned producer repairs BMFF sample lengths and the primary-item extent, checks the rewritten container independently, and compares every accepted frame and duration with the live source animation. Only then do positive manifest rows share its pixel references. These cases require no production Rust change, codec unit test, target-only fault, lint exception, dependency, unsafe code, or coverage exclusion.

Complete files, live Pillow frame buffers, standalone public still/sequence release clients and actual executables, source identities, and receipts are retained in .coverage-mcp/local-evidence/parity/avif-operating-point-lead-20261102/. The independent sequence client matches all fifteen complete accepted frame buffers and the malformed outcome. Canonical selected coverage uses the original animation, retained selected-layer control, and three new rows; its execution and source/fixture guards determine whether a coverage claim is compatible. The preceding raw AVIF profile located the skip-layer gap but includes additional integration-test and standard-library paths, so its totals are not a full-suite measurement. Historical measurements and release floors remain unchanged.

AVIF final OBU without a size field — 2026-11-02

Pinned Pillow accepts a complete baseline AVIF whose final frame OBU omits its ULEB128 size field. It also accepts that frame with a zero-layer-ID extension header whose reserved bits are set. Both inputs produce the same complete 49,152-byte RGB buffer as the baseline. The previous Rust parser rejected both at its mandatory-size-field check.

The parser now gives an unsized OBU the remaining bytes of its bounded sample, matching Pillow/dav1d. It never searches those payload bytes for another OBU. Explicit sizes retain their existing bounds checks, and every iteration still consumes at least a header byte. This adds no allocation, dependency, unsafe code, lint exception, or coverage exclusion.

Five ordinary public manifest rows cover the two complete accepted inputs and three malformed neighbors. Unsized temporal-delimiter and sequence-header OBUs consume the rest of their samples without producing a frame. Removing the final byte of the unsized frame also remains malformed. All three containers pass Pillow header verification but fail pixel decoding. The producer repairs the BMFF lengths and item extent and independently checks live pinned Pillow pixels or failures before sharing baseline pixel data.

Before/after public executables, complete input files, live Pillow pixels, source and fixture snapshots, selected coverage receipts, raw profiles, and Coverage MCP queries belong under .coverage-mcp/local-evidence/parity/avif-obu-implicit-size-20261102/. Validation uses the canonical selected workflow for the baseline and five new rows, followed by the complete AVIF matrix on its retained executable. These are local parity receipts; no refreshed full-suite percentage or managed Coverage MCP run is claimed. Historical measurements remain intact.

AVIF tolerated OBU headers — 2026-11-02

Thirty-three complete baseline AVIF mutations expose observable decoder mismatches: pinned Pillow accepts forbidden/reserved OBU header bits, extension headers on temporal delimiters and sequence headers, redundant frame extensions for an all-layer operating point, and all eight values of the three reserved extension bits. Each mutation preserves the complete 49,152-byte baseline RGB output. The previous Rust parser rejected all thirty-three before reconstructing pixels.

The parser now masks the header fields it uses and ignores the reserved bits as Pillow does. A nonzero operating point still requires layer IDs; selected layer membership, sequence/frame validation, and sample/payload bounds remain checked. Three complete malformed neighbors set both header flag bits on different OBUs and remove the final frame byte, updating the container extent. Pillow verifies their headers but rejects pixel decoding.

All thirty-six inputs are ordinary manifest parity rows, with live pinned Pillow observations. Positive rows share the baseline pixel reference only after the generator independently checks every complete pixel buffer. They add no codec unit tests, target-only fault cases, runtime dependencies, or unsafe code. Before sources and matrix, actual public decoder executable, input mutations, full Pillow pixels, and producer receipts are retained under .coverage-mcp/local-evidence/parity/avif-obu-header-compatibility-20261102/ and the preceding avif-obu-header-flags-lead-20261102/ and avif-obu-extension-lead-20261102/ directories.

The retained instrumented executable passes all 1,285 AVIF decode rows, with zero failures or skips, including the existing operating-point error cases. Canonical selected coverage runs the baseline and thirty-six new rows (37/37); its final source and fixture guards must remain unchanged. The selected report and Coverage MCP query are retained in the compatibility directory. This is focused local evidence, not a refreshed full-suite percentage or a managed Coverage MCP run.

Strict Clippy passes default/all-feature, release, nightly coverage, AVIF-only coverage, and SSE2/AVX2 cross-compile lanes. No lint exception, coverage exclusion, or release floor changes accompany the parser fix.

AVIF padding-heavy samples — 2026-11-02

Three public decode rows prepend empty padding OBUs to the complete baseline AVIF, producing samples with 4,096, 4,097, and 8,192 total OBUs. The original temporal delimiter, sequence header, and frame bytes remain intact. Pinned Pillow accepts all three and returns the same 49,152 RGB bytes. The previous Rust decoder rejected the latter two at an arbitrary 4,096-OBU limit.

The parser now relies on its bounded sample and advancing byte offset. Each accepted OBU consumes at least its header and size byte, including empty padding. All envelope and payload checks remain. A fourth row retains the padding but removes the final frame byte, with a correctly bounded BMFF item extent; Pillow and Rust still reject frame and sequence decoding after successful header verification.

The original baseline and four new rows pass canonical selected coverage (5/5). The retained executable also passes all 1,249 AVIF decode rows, with zero failures or skips. Strict Clippy, its SSE2/AVX2 cross-compile lanes, fixture verification, and workflow lint pass. Existing matrix row values and all 3,369 existing output files remain unchanged.

Before/after public probe executables, exact live Pillow witnesses, selected fixtures, source snapshots, raw profiles, and Coverage MCP queries are retained outside target/ in .coverage-mcp/local-evidence/parity/avif-padding-count-20261102/. The selected query reports matching source and passed tests from a locally derived receipt, not a managed Coverage MCP execution. This fixes an observable decoder mismatch; it does not claim a refreshed full-suite percentage.

JPEG full-range samples in AVX2 batch geometry — 2026-11-02

Six public encode rows combine complete 64x16 and 113x17 RGB sources with baseline 4:2:0 at Q1, Q85, and Q100. Each block row mixes black, white, checker, inverse-checker, stripe, and ramp patterns. Equal RGB channels preserve the full luma range, including the large signed DC coefficients that smaller alternating-color cases do not produce.

The 64x16 image reaches an eight-block luma packet on AVX2. The odd 113x17 image also exercises right and bottom replication. Pinned Pillow supplies complete JPEG bytes; a separate native ARM64 public encoder probe matches all six outputs exactly. The manifest-driven matrix checks those same complete outputs, and native x86 CI executes the rows under SSE2 and AVX2. These are numerical boundary parity cases, not a claim of newly covered global branch outcomes or a refreshed full-suite percentage.

Inputs, live Pillow references, public probe outputs and executable, and source receipts are retained outside target/ in .coverage-mcp/local-evidence/parity/jpeg-eight-lane-extremes-staging-20261102/. The rejected reciprocal experiment and its measured regression limits are documented in Benchmarking; codec arithmetic is unchanged.

AVIF color grids with unattached alpha items — 2026-11-02

decode:avif:grid_unreferenced_alpha_items removes the two auxiliary-alpha relationships from the existing 80x80 color grid. A sibling free box keeps all item offsets and AV1 payload bytes unchanged; the alpha items remain well-formed but unattached. Pinned Pillow accepts the complete file as RGB, with the exact color channels of the original RGBA grid. The 2,373-byte input SHA-256 is 4f687d744f2afefcf00d387b5c21607d6e52922593b249e9dcf194a1da13926b; its 19,200-byte RGB output SHA-256 is f9a11555c837abeb321bdedd737638cc4a62c1784ad58f9b699fd49d3288c019.

The canonical selected run passes the original and unattached-alpha grid rows (2/2). Source and fixture guards remain unchanged during execution. Compared with byte-identical source files in the retained full report, the pair observes three previously unobserved branch outcomes in validate_grid_with_token: absent cell alpha, absent alpha canvas, and no alpha placement. Duplicate LLVM records are combined by source span and arm using OR; these observations do not establish a refreshed full-suite percentage. All 1,244 existing AVIF decode rows, other format rows, fault contracts, and existing raw output bytes remain unchanged.

The report, actual test executable, raw and merged profiles, 139 source/setup files, fixture receipts, and producer recipe are retained outside target/ in .coverage-mcp/local-evidence/parity/avif-grid-unreferenced-alpha-20261102/. This is local selected-test evidence, not a managed Coverage MCP execution. No codec implementation or runtime dispatch changes are required.

Reduced AV1 inter transform alphabet — 2026-11-02

decode:avif:animated_lossy_inter_420_b16x64_reduced_transform_set_64x64 adds a 2,550-byte I420 animation with two 64x64 RGB frames. Both picture headers signal the reduced transform set; the inter frame uses TX_MODE_SELECT at positive qindex with B16x64 leaves. The fixture encoder uses the ordinary AOM reduced-tx-type-set option and its existing pinned partition controls. Its input SHA-256 is 3a52bdb0573571d5b9d6c5f79cbf4f41816fa84e4ec052034a9e418b9797511e.

Pinned Pillow 12.2.0 provides both exact 12,288-byte RGB frames and 100 ms durations. A separate clean-source libavif 1.4.1 observer decodes both frames, reports repetition count zero (one total play), and repeats the observation. Two normalized native encodes agree byte for byte. The existing normal and qindex-zero B16x64 fixtures retain their exact input and frame hashes after the encoder gains the new option.

The targeted public probe reaches the true reduced-set branch in decode_inter_transform_type; that outcome has count zero in the retained full report against the identical entropy source. This is selected-case evidence, not a refreshed full-suite percentage. The canonical selected run passes the normal and reduced-set rows (2/2), with unchanged source and input guards throughout execution. The reduced-set branch records four true observations; the normal alphabet remains exercised in the same run. Raw coverage, producer identity, native observations, and receipts are retained in .coverage-mcp/local-evidence/parity/avif-reduced-transform-set-20261102/. Codec arithmetic, runtime dependencies, coverage exclusions, and release floors are unchanged.

Incomplete TIFF integer subsampling pairs — 2026-11-02

Five public decode cases retain Pillow's default 2-by-2 YCbCr clumps when tag 530 contains only one value. They cover BYTE, LONG, SBYTE, SSHORT, and SLONG; the existing SHORT cases remain unchanged. Each incomplete tag stores 1, so using that value instead of ignoring the incomplete pair changes decoding. The pinned Apple ARM64 Pillow oracle independently reproduces the exact RGB pixels, inspection, verification, and sequence observations.

The five-case selected run passes, and a fresh selected run of all 438 active TIFF decode cases passes with stable source and fixture identities. In that run, src/codecs/tiff/inspect.rs covers 140/140 branches, compared with 135/140 in the retained pre-publication full report. Its other metrics remain 460/483 lines, 27/32 functions, and 677/711 regions in the TIFF-only run. Duplicate LLVM source spans for the integer match alternatives are preserved in the raw report; the Coverage MCP coordinate view coalesces those spans. No full-suite percentage or named-case coverage attribution is inferred.

Reports and local receipts remain outside target/ under .coverage-mcp/local-evidence/selected/20261102T072413.107722Z-1cbcb9ce611d4565965d53342ebac1c0/ and .coverage-mcp/local-evidence/selected/20261102T072657.671780Z-fe371f157bc748a2a56cb8a4bd622dde/. Codec source, dependencies, feature selection, and lint policy are unchanged; this fixture-only change makes no latency claim. All 3,684 previous matrix rows and their canonical observations are preserved.

Publication and canonical x86 JPEG word boundaries — 2026-11-02

The accumulated work is committed to the existing develop branch in PR #154. GitHub requires its Required CI checks status before publication to main. No new local branch or worktree is created. The fixture-integrity job now supplies the same hash-locked Python/Pillow environment on Apple ARM64 as the primary oracle; its complete regeneration and observation checks remain intact. Fixture setup steps have distinct names so the existing workflow-policy mutation checks continue to target the quality job.

Initial native x86 Linux SSE2 and Windows MSVC execution both find the same 38 JPEG mismatches among 570 decode rows. The affected complete grayscale inputs cover sequential/progressive signed-word dequantization, wide quantizers, partial blocks, both column halves and dense coefficients. Their pinned Pillow outputs are unchanged. The preceding ARM64-only parity and x86 compile checks had not established native x86 behavior.

The SIMD IDCT now uses the pinned ARM64 oracle's signed-word truncation and four-column zero-vertical-AC grouping on every SIMD target. SSE2/AVX2 workspace clamping no longer changes canonical pixels for extreme values. When an AVX2 DC workspace wraps, an outlined complete four-column transform handles each half independently; the normal eight-lane transform retains its existing admission test. No scalar fallback, unsafe code, dependency, production fault hook or codec unit test is added. Native x86 parity remains a required CI gate; this change makes no latency or world-ranking claim.

Local ARM64 JPEG decode parity passes all 570 rows. Strict stable/default/ all-feature/release/coverage Clippy and SSE2/AVX2 compile checks pass. The complete local workflow/release tooling, formatting, verification, parity and feature lanes pass before the x86 correction; package verification requires a clean checkout and is deferred to CI because pending changes and pre-existing local files are preserved. The full coverage report below predates the x86 correction and retains its exact source identity; it is not relabeled as a new measurement. Raw CI failures, local checks and source comparisons are retained locally in target/jpeg-x86-word-parity-20261102/ and the publication evidence directory. All 3,657 active parity cases and 167 separate fault contracts remain required; strict 100% and the 27 planned AVIF encoder rows remain open.

AVIF integer-motion precision parity — 2026-11-02

Nine complete public input sequences cover I420/I422/I444 at 8/10/12 bits, with mixed lossless/lossy key segments and inter-frame super-resolution from coded width 102. Native screen-content tuning on equal varied source frames selects integer-only motion precision. Palette and intra-block copy stay disabled. The recipe contains only input and encoder settings; the standard collectors obtain exact still and sequence output from live pinned Pillow. Both frame headers independently confirm screen-content tools and integer motion precision. All 72 maintained color recipes reproduce complete pinned bytes twice, preserving the preceding 63 inputs.

Coverage MCP 0.16.0's installed CLI identified the unobserved true side of MotionVector::reduce_precision at motion.rs:35. The nine-case selected run passes exactly nine cases and records 432 true evaluations. The fresh full run preserves the preceding 53,424 false evaluations and records the same 432 true evaluations. The unchanged motion file gains one covered line, one branch and four regions; the unchanged frame parser gains another branch. Imported source remains locally unverified and individual-case attribution unknown. Queries, raw overlapping branch rows and both full report identities are retained; counters are not summed across overlapping rows.

The full campaign passes 139 integration checks in six executables, all 3,657 active parity cases and 167 separately reported existing fault contracts. Twenty-seven planned AVIF encode rows remain unexecuted. Source and fixtures stay stable throughout measurement. A runner completion interleaved one GIF case marker; reconciliation retains the raw log and joins only the observed fragments of a declared active identifier. All case markers reconcile exactly. No private unit-test executable runs.

Metric	Covered / total	Percent
Lines	102,327 / 142,071	72.0253%
Branches	20,938 / 31,992	65.4476%
Functions	5,660 / 9,128	62.0070%
Regions	155,766 / 220,198	70.7391%

Alpha floors pass; strict 100% remains unmet. Global denominators differ from the preceding translated-source run: concurrent, owner-approved mode() getters in src/source.rs add six lines, two functions and six regions, which remain uncovered. Those edits are preserved. An initial const getter through Arc failed compilation and was corrected by the other editor before the successful campaign. This fixture work changes no Rust codec algorithm. Fresh strict Clippy (including coverage configuration), SSE2/AVX2 compile and native/WASM/WASI feature gates pass against the final stable source. A fresh source-bound release executable also matches all nine complete inputs through public still and sequence APIs. No runtime speed measurement is claimed; SSE2/AVX2 execution still needs matching hardware.

All 3,675 previous matrix rows, 7,296 canonical outcomes, 564 native observations and 10,823 preceding fixture paths are preserved. Nine rows add 63 fixture files; shared index identities and metadata receipts refresh without changing old outcomes. The native index now contains 573 cases and 1,980 artifacts. The current matrix has 3,684 rows, including 1,243 active AVIF decode rows. The parent AVF-SEQUENCE-001 remains planned. AVIF encoder completion, broader reconstruction, all-four 100% coverage and native x86 speed comparisons remain unfinished.

The source-bound full evidence is .coverage-mcp/local-evidence/full/20261102-integer-motion/; the selected report is .coverage-mcp/local-evidence/selected/20261102T060331.725547Z-38b4ef6978a8461aa4dde2b3075ba9b8/. The retained parity checkpoint is .coverage-mcp/local-evidence/parity/avif-integer-motion-20261102/. Local inventories, profiles, native observations, repeated recipes, failed validation attempts and final checks remain outside target/ in that checkpoint. Local reports and build artifacts are excluded from the source commit. All work uses /Users/lazytrot/work/image-slash-star and the existing develop branch; no branch or worktree is created. Publication to main is owner-authorized.

AVIF fixed-four CDF shared-shift trial — 2026-11-02

The fixed-four adaptive-symbol reader accounts for 1,240 of 4,602 leaf samples in the retained lossy compound profile. Its three CDF adaptation branches motivated a bounded shared-shift experiment. Writing a probability as p = q * 2^r + t, the upward adjustment is exactly 2^(15-r) - q - [t != 0] for AV1 rates 5 through 7. The candidate shares p >> r between both directions, with an explicit remainder correction; symbol selection, normalization, count updates and failure handling stay intact. It adds no unsafe Rust, dependency, public API or runtime hook.

Native ARM64 assembly replaces all three adaptation branches with conditional selections. Each matching routine has 133 instructions instead of 135, while the 96-byte stack frame and refill path stay the same. This does not establish a performance gain: more of the arithmetic executes on common downward updates. Both source-bound binaries match live pinned Pillow pixels and shapes on all 13 complete still/sequence workloads before timing, including translated motion and split/disjoint extent controls.

One predeclared independent cohort retains 156 process samples: three A-B-B-A cycles over 13 workloads, ten warmup calls and a three-second sample target, with 30 to 500,000 iterations. Complete public decode and result destruction are timed after reading the input. No Cargo build or test campaign overlaps the measurements. The shared Apple M3 Pro ARM64 host runs macOS 15.7.7 and Rust 1.96.1. This cohort is not pooled with earlier experiments.

Workload	Overall median latency change	Changes in the three cycles
Lossy compound sequence	-1.104%	-1.127%, -1.630%, -0.640%
Lossless compound sequence	+1.879%	+1.443%, +2.215%, +0.819%
Ordinary 10-bit monochrome super-resolution control	-4.254%	-4.079%, -3.672%, -3.801%

The admission rule requires at least a 3% overall gain and a 3% gain in at least two cycles on either profiled compound workload, with no control repeatedly more than 3% slower overall. Neither profiled workload qualifies. The ordinary monochrome control's repeatable improvement cannot replace that declared gate. One noise-monochrome cycle has a +55.674% ratio excursion and an OBMC cycle has +6.486%; all samples remain included. No outlier is discarded, threshold changed or follow-up cohort used to seek a pass. The runtime candidate is rejected and entropy.rs is restored byte for byte. The full 129-file accepted runtime/build identity matches the preceding translated-source checkpoint.

No selected/full codec or SIMD campaign is run for the reverted candidate. Fresh formatting, documentation, no-source-unit-test, roadmap, claim-ledger and capability-document checks pass. The unchanged implementation retains the previous exact-source style/feature checks and complete coverage evidence at .coverage-mcp/local-evidence/full/20261102-translated-mixed-key/: 139 integration checks, 3,648 parity cases and 167 separate fault contracts pass. Its measured figures remain 102,326/142,065 lines (72.0276%), 20,936/31,992 branches (65.4414%), 5,660/9,126 functions (62.0206%) and 155,762/220,192 regions (70.7392%). Alpha floors pass; strict 100% remains unmet. All 10,823 fixtures remain byte-identical.

Coverage MCP 0.16.0 queries of that source-matched full report, raw fixed-four branch rows, exact candidate/baseline source, disassembly, arithmetic review, live parity, environment, timing samples and the failed gate are retained at .coverage-mcp/local-evidence/performance/avif-cdf-shared-update-20261102/. The connector is unavailable; the installed CLI is used. Imported source status remains locally unverified and named-case attribution unknown. Further entropy work needs a different measured cause; branch removal by itself is insufficient for these profiled requests. Native SSE2/AVX2 execution, world rankings, the AVIF semantic encoder and all-four 100% coverage remain unfinished. Work stays local and uncommitted in the sole develop checkout; no branch or worktree is created.

AVIF translated-source scaled-motion parity — 2026-11-02

Nine new public parity cases cover I420/I422/I444 at 8/10/12 bits with distinct source patterns in two 128x48 frames. The second source samples the pattern at luma offsets (+4, +2), with corresponding chroma offsets. Mixed lossless/lossy segments and neutral filters are retained; the inter frame uses horizontal super-resolution from logical coded width 102. The encoder chooses motion vectors and residuals. This adds ordinary complete-file stimuli, with no expected output in recipes and no forced decoder paths.

All nine inputs are deterministic across two native encodes after timestamp normalization, and both public still and sequence APIs match live pinned Pillow exactly. The maintained color generator now has 63 named recipes; all 54 existing recipes reproduce their complete pinned bytes twice as well. Standard Pillow collectors own decoded references; the independent native observer records both frame headers, pixels, timing and repetitions.

Coverage MCP's installed CLI guided the preceding encoder-gap review. The reviewed JPEG/GIF gaps are internal geometry/histogram invariants, and AVIF's 27 planned encode rows still require a Rust semantic compressor. Native entropy replay is not an image encoder. Those findings are retained rather than adding private tests for unreachable states. The translated-source family addresses a missing temporal input pattern in the prior AVIF corpus. No Rust runtime, integration-test source, Cargo configuration or Makefile changes are needed.

The focused run executes exactly nine selected cases, all passing, with stable source and fixtures. Its retained report is .coverage-mcp/local-evidence/selected/20261102T051954.392794Z-78868a886a474d3a8115cd7b47c6e9a1. The fresh complete run passes 139 integration checks in six executables, 3,648 active parity cases and 167 separately reported existing fault contracts; all case markers reconcile. The 27 planned encode rows remain unexecuted. All four denominators match the preceding complete report. Coverage gains 3 lines, 1 branch and 4 regions, with no function gain:

Metric	Covered / total	Coverage
Lines	102,326/142,065	72.0276%
Branches	20,936/31,992	65.4414%
Functions	5,660/9,126	62.0206%
Regions	155,762/220,192	70.7392%

The new branch is the negative-coordinate sign path in scaled motion compensation at motion.rs:1275; raw before/after branch rows and source spans are retained without summing overlaps. The gains also include two lines in block.rs. This is family-level full-report evidence, with no named-case attribution. Coverage MCP's local source status is unverified; separate hashes bind unchanged runtime source and stable measured fixtures. Alpha floors pass; make coverage-complete exits 2 solely because strict 100% remains unmet. The full report is .coverage-mcp/local-evidence/full/20261102-translated-mixed-key/, SHA-256 d2e633db6b21e1197d30f2c80a4d7da33b3ee1ecfc4ee1d02fe53c5524296134. It retains six instrumented executables, six raw profiles, one merged profile and 152 frozen source/setup files.

All 3,666 preceding matrix rows, 7,278 canonical outcomes and 555 native cases are preserved; shared native-index receipts update on 530 prior outcomes. There are now 3,675 matrix rows, 3,007 active decode rows, 641 active encode rows and 27 planned encode rows. AVIF has 1,234 active decode cases. The native bundle has 564 cases and 1,953 artifacts. All 10,760 preceding fixture paths remain, with 63 additions and seven metadata/receipt documents refreshed.

Fresh fixture integrity, documentation, roadmap, claim-ledger, formatting and no-source-unit-test checks pass. Strict Clippy, SSE2/AVX2 compile and feature-lane implementation results are reused from the exact unchanged Rust/build source at the color coded-tail checkpoint; this does not claim fresh cross-target execution of the new inputs. The first fixture-integrity failure from stale roadmap counts is retained alongside the corrected successful run. Final roadmap documentation refreshes only the claim-ledger roadmap receipt after measurement, with the measured fixture identities preserved separately.

The immutable checkpoint is .coverage-mcp/local-evidence/parity/avif-translated-mixed-key-20261102/. It retains independent inputs and observations, repeated encodes, exact pixels, source identities, all validation attempts, selected profiles and full-report bindings outside target/. There is no new unit test, runtime fault hook, coverage exclusion, relaxed threshold, unsafe Rust or dependency. There is no new runtime timing claim because runtime source is byte-identical. Strict 100%, AVIF encoding, broader reconstruction and native SSE2/AVX2/world-ranking performance remain unfinished. Work remains local and uncommitted in the sole /Users/lazytrot/work/image-slash-star checkout on existing develop.

AVIF compound-decoder profiling and rejected trials — 2026-11-02

Two complete three-frame 256x256 public AVIF sequences match live pinned Pillow before native sampling. The lossy sequence attributes 1,240 of 4,602 samples to fixed-four-symbol decoding and another 936 to the general adaptive-symbol reader. The lossless sequence also identifies the Golomb bit loops embedded in dequantization as material work. Retained-frame validation checks metadata and buffer geometry; it does not scan every retained sample. Sampling is diagnostic, separate from the paired timing measurements.

Four independent timing cohorts retain 432 process samples in total. Each uses the same nine material public still/sequence inputs, exact live pinned Pillow comparisons for both source-bound release binaries, three A-B-B-A cycles and ten warmup calls on the shared Apple M3 Pro ARM64 host running macOS 15.7.7 and Rust 1.96.1. The first three cohorts target one second per process sample; the last targets five seconds. Complete public decoding and result destruction are timed after reading input bytes. Cohorts are never pooled.

Trial	Lossy compound median change	Admission
Fixed-four window-refill outline	-0.61%	Failed
Golomb helper outline	-1.28%	Failed
Existing fixed-four helper at generic AC/DC base-token sites, short	-4.43%	Failed cycle rule
Same two call sites, independent longer cohort	-2.92%	Failed magnitude rule

The declared rule requires at least a 3% overall gain and a 3% gain in at least two of three cycles on a profiled compound workload, with no repeated overall regression above 3% on any control. The short third cohort's lossy compound cycle changes are -2.62%, -4.68% and -1.27%. The longer cohort shows roughly 5–6% lower latency on two other sequences, while every measured row is faster; those bounded observations do not satisfy the declared profiled-workload gate. All trial source changes are restored exactly. Smaller instruction counts and stack frames did not justify keeping either outlining trial.

At the profiling checkpoint, runtime, fixtures and test setup matched the color coded-tail checkpoint. Its complete coverage and style/feature results remained reusable; no codec campaign was repeated for that evidence-only update. Coverage MCP 0.16.0 queries of that retained full report are stored with the profiles because the connector is unavailable. Imported source status is unverified and named-case attribution is unknown; separate hashes bind the local source and binaries. This work adds no tests, runtime hooks, exclusions, dependencies or unsafe Rust. Further work should address the measured coefficient/entropy cost with new causal evidence rather than repeat these trials. The 100% coverage, AVIF encoder and native SSE2/AVX2 performance objectives remain unfinished.

The reproducible plans, failed gates, exact source snapshots, raw profiles, assembly, live parity receipts and timings are retained in .coverage-mcp/local-evidence/performance/avif-compound-profile-20261102/.

AVIF color mixed-key and coded-tail parity — 2026-11-02

Fifty-four new public parity cases match live pinned Pillow exactly for still output and both sequence frames. They cover I420/I422/I444 at 8/10/12 bits, flat and varied keys, and inter logical coded widths 71, 100 and 102. Display sizes are 80x20 and 112x20 with denominator 9, and 128x48 with denominator 10. The 20-row cases also exercise padded bottom edges. Varied keys require nonconstant residual reconstruction. The previous decoder passed ten complete cases; the other 44 sequences and all eighteen I422 first frames were unsupported. The bounded color follow-up under AVF-SEQUENCE-001 is closed; its parent sequence work item remains unfinished.

The retained public probes distinguish three causes. First, the mixed neutral super-resolution admission excluded non-four-aligned color coded widths even though color reconstruction already preserves physical padding and separates logical resize phase from source extent. That neutral profile now admits these widths; active filters, grain and restoration retain their prior restrictions. Second, I422 intra reconstruction rejected all segmented keys. It now reuses the existing strict mixed segment-map and quantization proof, while existing inter and restoration wrappers explicitly retain their frame-kind checks. The neutral-filter helper is named for its shared segment role.

Third, the first candidate was exact on 42/54 cases but failed twelve 8-bit sequences. Existing debug traces stopped at B8x8 inter blocks. Their legacy fixed 2x2 WHT helper required frame transform mode zero, despite segment losslessness selecting the same fixed TX4x4 grammar in mixed modes 1/2. It now uses the existing checked mixed-lossless mode predicate, retaining buffer, depth, plane, geometry and zero-quantizer checks. No transform or resize arithmetic, native runtime fallback or allocation strategy changes. Both runtime changes are limited to entropy.rs and block.rs.

The new input-only color generator has 54 named recipes, all encoded twice through the unchanged pinned mixed-key producer. Both complete files match pinned digests and independently parsed sequence/frame features. Existing inter-only and monochrome generators and complete input files remain unchanged. A single additional --check command joins ordinary Makefile fixture verification. Standard live Pillow collectors own expected pixels; independent native observers record complete frames, syntax, timing and repetitions.

Coverage MCP 0.16.0 queried the preceding and current full reports using its installed CLI because the connector is unavailable. Its ranked entropy gaps led to bounded source inspection and public profile probes. Raw branch rows for the shared segment proofs and new I422 intra selector are retained without summing overlapping spans or assigning observations to individual cases. Local LLVM source identity remains unverified and named-case attribution is unknown. The final selected run passed exactly 54 declared public cases with stable source and fixtures. Its report is .coverage-mcp/local-evidence/selected/20261102T035845.945500Z-74964e30acd241f8bf0c77af13313abc.

A fresh complete campaign passed all 139 integration checks in six executables, 3,639 active parity cases and 167 separately reported existing fault contracts. All case markers reconcile; 27 planned encode rows were not executed. Source and fixtures stayed stable. Alpha floors pass. make coverage-complete exits 2 only because the strict 100% target remains unmet:

Metric	Covered / total	Coverage
Lines	102,323/142,065	72.0255%
Branches	20,935/31,992	65.4382%
Functions	5,660/9,126	62.0206%
Regions	155,758/220,192	70.7374%

The report is .coverage-mcp/local-evidence/full/20261102-color-coded-tail/, SHA-256 4b6edd30c765df8f71424946a51a1770e69b6bf6dd08b722703ab7664e13e032. It retains six instrumented executables, six raw profiles, one merged profile and 152 frozen source/input files. The preceding full report at the prior coded-tail checkpoint contains 3,585 parity cases. This refresh adds 54 rows and changes two runtime files, with different denominators; global changes are not assigned solely to individual new fixtures. No source is excluded, defensive check hidden or threshold reduced.

Fresh strict Clippy, release/coverage-cfg lanes, SSE2/AVX2 compile checks and the final native/WASM/WASI feature matrix pass. The initial feature-matrix campaign overlapped fixture registration: all execution lanes passed and its generated document check failed. That failure is retained. Capability docs were regenerated and the complete feature matrix passed again with stable case index identities. Fixture and final documentation checks also pass. No new unit test, test executable, unsafe Rust, dependency or runtime fault hook is introduced.

The source-bound whole-call latency comparison passed 648 samples across 54 unchanged successful workloads using three ABBA cycles and the declared repeated 3% review threshold. Its largest median slowdown was 1.606%. All ten successful-before new cases are included as timing controls; the other 44 have no successful-before latency ratio. Both binaries match live pinned Pillow on every timed workload. The cohort measures accepted babffc16 against final a06302a3 on ARM64, with exact source and executable identities. It establishes neither zero overhead nor native x86/world-ranking performance. The earlier ordinary 10-bit monochrome performance investigation remains separate; cohorts are not pooled.

All 3,612 preceding matrix rows and 7,170 canonical outcomes are preserved; only the shared native-index receipt changes on 476 preceding canonical rows. The matrix now contains 3,666 rows, 2,998 active decode rows, 641 active encode rows and 27 planned encode rows. AVIF has 1,225 active decode rows. The native index contains 555 cases and 1,926 artifacts. All 10,382 preceding fixture paths remain; seven metadata documents change and 378 files are added. Existing fault contracts, native producer, dependencies and protected untracked files remain unchanged. Closing the bounded roadmap follow-up after testing refreshes only the claim-ledger roadmap digest; final fixture/document checks are rerun, and the original measured fixture receipt stays intact.

The immutable checkpoint is .coverage-mcp/local-evidence/parity/avif-color-coded-tail-20261102/. It retains final source, native inputs/observations, exact pixels, hypotheses, the incomplete first candidate and debug trace, all validation attempts, selected profiles, full-report bindings and fresh performance receipts. Inventories are independently rehashed outside target/.

Strict 100% coverage, broader sequence/reference reconstruction, encoder completion, native SSE2/AVX2 runtime speeds and world-ranking comparisons remain open. All work remains local and uncommitted in the sole checkout at /Users/lazytrot/work/image-slash-star on existing develop; no branch or worktree was created.

AVIF monochrome coded-tail reconstruction — 2026-11-02

Twelve public parity cases now match live pinned Pillow exactly for still output and both sequence frames. They cover mixed lossless/lossy monochrome keys and inter frames at 8/10/12 bits: 128x128 and 128x20 with denominator 10 (logical inter width 102), 112x20 with denominator 9 (width 100), and 80x20 with denominator 9 (width 71). Before this change, ten sequences returned Unsupported; the 10/12-bit width-100 sequences returned incorrect edge pixels. All first frames were already exact. AVF-SEQUENCE-001's width-102 follow-up is closed for these declared cases; the parent sequence work item remains unfinished.

Pinned dav1d reconstruction explains the edge mismatch: resize phase uses the logical coded width, while filter taps read reconstructed samples through the next eight-pixel coded boundary. The earlier admission-only experiment cropped that tail before resizing. The Rust decoder now moves the complete existing luma canvas through separate logical and physical resize geometry, limited to the neutral single-tile mixed-monochrome profile. Existing checked bounds, neutral-filter, film-grain and restoration restrictions remain. The 8-bit path also removes an unnecessary monochrome exclusion from the existing fixed TX4x4 lossless WHT grid; depth, quantization and geometry checks stay in place. No arithmetic kernel or native runtime fallback is introduced.

The input-only generator has 26 named recipes; all reproduce twice through the unchanged pinned producer, including the preceding fourteen complete files. Complete digests and independently parsed headers are validated. Standard live Pillow reference collectors and independent native observers own pixels, complete-frame syntax, timing and repetition evidence. The new inputs contain no expected Rust results.

The final selected run passed exactly twelve declared public cases with stable source and fixtures. Raw LLVM observations cover the geometry adapter and coded-padding path. Duplicate branch spans remain raw and are not summed; named-case coverage attribution is unknown. Coverage MCP 0.16.0 queried the new full report for entropy, block, frame and resize gaps through its installed CLI because the connector is unavailable. Local source identity remains unverified. The selected report is .coverage-mcp/local-evidence/selected/20261102T032935.917004Z-d0fad720b6204d7c93212912ddc88710.

A fresh complete campaign passed all 139 integration checks in six executables, 3,585 active parity cases and 167 separately reported existing fault contracts. Twenty-seven planned encode rows were not executed. Source and fixtures stayed stable; all case markers reconcile without normalization. Alpha floors pass. make coverage-complete exits 2 only because its strict 100% gate remains unmet:

Metric	Covered / total	Coverage
Lines	102,223/142,040	71.9678%
Branches	20,900/31,970	65.3738%
Functions	5,657/9,125	61.9945%
Regions	155,640/220,169	70.6912%

The report is .coverage-mcp/local-evidence/full/20261102-coded-tail/ with SHA-256 def73c5cafb1f0add34c0746368adf6ed78b754e811a5ae2c940dda21d9206f9. It retains all six instrumented executables, six raw profiles, one merged profile and 152 frozen source/input files. The preceding full campaign had 3,564 parity cases; this refresh includes the prior nine boundary cases and the new twelve, with four runtime files changed. Denominators differ, so movement is not attributed solely to these twelve inputs. Function coverage changes from 5,656/9,123 to 5,657/9,125; its slightly lower percentage is retained. No source is excluded and no coverage threshold is reduced.

Fresh make lint, make lint-x86-simd and make test-feature-matrix pass, including strict release/coverage-cfg Clippy and native/WASM/WASI lanes. The first Clippy run rejected a nonminimal boolean expression; the equivalent short-circuit form passed. Its rebuilt complete release executable is byte-identical to measured decoder babffc16, with both source identities and build receipts retained in an explicit bridge. No additional timing run is claimed for that textual simplification.

The whole-call latency guard passed 384 samples across 32 unchanged successful workloads using three ABBA cycles. Its largest median slowdown was 1.995%, below the declared repeated 3% review threshold. Formerly failing or incorrect cases have separate correctness proof and no successful-before latency ratio. This ARM64 cohort establishes neither zero overhead nor native x86/world-ranking performance. The earlier ordinary 10-bit monochrome performance investigation remains separate; cohorts are not pooled.

All 3,600 preceding matrix rows and 7,146 canonical outcomes are preserved; only the common native-index receipt changes on 464 preceding canonical rows. The matrix now has 3,612 rows, 2,944 active decode rows, 641 active encode rows and 27 planned encode rows. AVIF has 1,171 active decode rows. The native index contains 501 cases and 1,764 artifacts. All 10,298 preceding fixture paths remain; seven metadata documents change and 84 files are added. Existing fault contracts, dependencies, Makefile, native producer and protected untracked files remain unchanged. No unit test or additional test executable is added.

The immutable checkpoint is .coverage-mcp/local-evidence/parity/avif-coded-tail-20261102/. It retains final source, public inputs and pixels, native observations, selected profiles, full-report bindings, source/build/performance receipts, prior partial trials and failed validation logs. The timing campaign for the incorrect unaligned-only intermediate source was stopped and excluded from acceptance. The earlier width-only trial remains rejected evidence. Inventories are independently rehashed outside target/.

Strict 100% coverage, broader sequence reconstruction, encoder completion, native SSE2/AVX2 runtime measurements and world-ranking comparisons remain open. All changes remain local and uncommitted in the sole checkout at /Users/lazytrot/work/image-slash-star on existing develop; no branch or worktree was created.

AVIF mixed-segment key boundary parity — 2026-11-02

Nine new public parity cases exercise varied 8/10/12-bit monochrome key/inter sequences at 40x16, 60x20 and 128x128. Their inter coded widths are 32, 48 and 64 respectively; the first two use denominator 10 and the largest uses 16. The 60x20 inputs expose four-pixel key-frame and bottom-edge tails, while the 128x128 key exercises the admitted size bound. Still output and both sequence frames match live pinned Pillow exactly. Separate native observers confirm complete frames, timing and repeat payloads for all nine sequences.

The maintained input-only generator now uses named recipes for dimensions, depth, speed, restoration, key variation, denominator and complete digest. All fourteen recipes reproduce twice through the unchanged pinned producer; the preceding five IDs, parameters and input bytes remain unchanged. Complete file hashes and independently parsed AV1 segment, quantization and scaling features are checked before writing. Inputs own no expected pixels or Rust results; standard live reference collectors own observations.

Coverage MCP 0.16.0 queried the preceding full report and the selected report. The connector is unavailable, so the installed CLI inspected the retained LLVM JSON. An initial functions metric query was rejected by that CLI; its failure is retained, and raw LLVM function counts informed the subsequent source inspection. Local source verification remains unavailable and named-case coverage attribution is unknown.

The selected run executed and passed exactly nine declared public cases with stable source and fixture identities. Comparing unique raw branch spans on identical runtime source found four newly observed arms among 14,428 compared spans; 1,609 nonunique spans were excluded. These include the non-eight-aligned height rejection in the filtered-profile selector and three reference-tool predicates in the large-frame inter admission path. Counts are not assigned to individual cases. Baseline observations absent from this selected subset are not regressions. No replacement or additive full-coverage percentage is claimed.

All 129 runtime source identities, Cargo inputs and the accepted public wrapper remain unchanged from accepted decoder 7bdc1ab7. Fresh make lint, make lint-x86-simd, make test-feature-matrix, fixture validation and final documentation/preservation checks pass. SSE2/AVX2 validation remains compile-only on ARM64. No optimization or runtime change is retained, and no new speed measurement is claimed. The preceding source-bound performance guard remains historical evidence for the same accepted binary.

The nine cases preserve all 3,591 preceding matrix rows and all 7,128 canonical outcomes. Only the common native-index receipt changes on 455 preceding canonical rows. There are now 3,600 matrix rows, 2,932 active decode rows, 641 active encode rows and 27 planned encode rows. AVIF has 1,159 active decode rows. The native index contains 489 cases and 1,728 artifacts. All 10,235 preceding fixture files remain; seven fixture metadata documents are refreshed and 63 assets are added. Existing fault contracts are unchanged. No unit test or additional test framework is introduced.

A distinct, unresolved public input class remains recorded under AVF-SEQUENCE-001: denominator-10 128x128 sequences have coded width 102. All three accepted-source key frames match Pillow, while sequence rendering returns Unsupported at 8/10/12 bits. A one-condition neutral-monochrome admission trial left 8-bit unsupported and returned unequal right-edge pixels at 10/12 bits (198 and 222 differing RGB bytes in the second frame). The trial was rejected and every runtime source byte restored. Complete inputs, feature reports, live Pillow pixels, before/trial commands, rejected source, patch and binary are retained. The successful denominator-16 boundary cases do not resolve this two-pixel-tail reconstruction issue. Coded-plane reconstruction and scaled-reference borders need first-divergence tracing before another admission proposal. These failures remain parity mismatches, not fault cases. The wrong-edition standalone formatter diagnostic from the rejected experiment is also retained; the later project-aware formatting/lint checks passed.

The selected report is .coverage-mcp/local-evidence/selected/20261102T025630.954087Z-77f90e37c53c4ab980eebb5643e30fa9. The checkpoint is .coverage-mcp/local-evidence/parity/avif-mixed-key-boundaries-20261102/. It retains the selected executable and raw/merged profiles, complete new fixtures/native observations, immutable accepted-parent bindings, all failed probe evidence and an independently rehashed inventory. No full campaign was rerun for this fixture-only increment. The latest full baseline remains .coverage-mcp/local-evidence/full/20261102-monochrome-mixed-key/: 71.9570% lines, 65.3406% branches, 61.9972% functions and 70.6843% regions; its strict 100% gate remains unmet. Full coverage, the newly exposed coded-width-102 class, native x86 speeds, encoder completion and a world-ranking comparison remain unfinished. Work remains local and uncommitted in the sole checkout at /Users/lazytrot/work/image-slash-star on existing develop.

AVIF monochrome mixed-segment key admission — 2026-11-02

Five new public manifest sequences cover a monochrome key frame containing both lossless and lossy segments, followed by super-resolution inter output. The preceding accepted decoder rejected the key frame before reconstructing it. The corrected admission reuses the checked depth-parametric intra residual path for neutral-filter, single-tile 8/10/12-bit mixed segmentation. Frame-kind checks move to the existing inter callers so their prior restrictions remain. No kernel, allocation strategy, error conversion, retained Option category, unsafe Rust, runtime fault hook or dependency changes in this increment. Only entropy.rs differs among the 129 captured runtime source identities.

The cases include a flat 8-bit key, varied 8/10/12-bit keys at native speed 3, and a varied 8-bit key at speed 7. Both frames of every sequence match live pinned Pillow exactly, with separate native full-frame, timing and repeat observations. The retained original investigation input c553936d10bdd28d7911e4f15ea094c57b9af7d34054529ff9ecf348ff27b474 also now matches Pillow through both still and sequence APIs. The new flat recipe is a different complete file and does not claim to reproduce that original input's bytes. All five new sequences were unsupported before this admission change; their successful after results have no before latency ratio.

The maintained input-only generator is scripts/generate_avif_monochrome_mixed_key_fixtures.py. It reproduces each complete file twice and checks pinned digests and independently parsed AV1 features. Its separate AOM profile applies libaom-mixed-key-segmentation.patch after the preceding mixed-superres patch. All five actual sequence headers disable restoration and all frame restoration types are NONE, including the fast flat recipe's ignored restoration request. Varied key inputs exercise nonconstant first-frame residuals. Rebuilding the updated C producer against the preceding libraries also reproduced all 29 preceding mixed/ordinary monochrome/I422 recipes twice with their original digests. Expected pixels remain owned by the normal live Pillow/native collectors.

The initial static native link failed because decoder entry points were omitted from AOM. Resuming the owned build with CONFIG_AV1_DECODER=1 fixed that link. The initial link failure and corrected build, producer-version pin and actual-header corrections, and setup assertion correction remain recorded. No dependency was installed and no additional Git checkout was created.

All 3,586 preceding matrix rows and 7,118 canonical outcomes are preserved; 450 canonical rows update only their common native-index receipt. The current matrix contains 3,591 rows, with 3,564 active parity rows and 27 planned encode rows. AVIF has 1,150 active decode rows. The native index contains 480 cases and 1,701 artifacts. The 10,200 prior fixture files remain, with seven fixture metadata documents refreshed and 35 new assets added.

The source-bound performance plan paired accepted baseline 93a40366 with candidate 7bdc1ab7 using the same optimized public wrapper. Both match live Pillow on 23 previously supported complete public-call workloads. Three ABBA cycles retain 276 timed samples. The declared guard passed; the largest measured median increase was 2.62%, below its 3% threshold. This bounds this fix on the ARM64 shared host. It does not settle the separate before-admission monochrome cost investigation or establish zero cost for all inputs, native x86 speed, SIMD gains, or a world ranking.

Fresh make lint, make lint-x86-simd and make test-feature-matrix passed. The SSE2/AVX2 lanes are strict compile checks on this ARM64 machine. The selected coverage run passed all nine declared public parity cases with unchanged source and fixture identities. Its report, receipt, instrumented executable, raw profile and merged profile are retained. The full run passed all 139 integration checks, all 3,564 parity rows and 167 separately reported existing fault-contract rows. No private unit-test executable ran; all 27 planned encode rows remained unexecuted. Full source and fixture identities were stable. One JPEG pass marker was split by a concurrent test-runner prefix/status; exact raw fragments were reconciled only against a declared active ID. The original log, first unreconciled analysis and correction receipt are retained; tests were not rerun to repair the accounting.

Metric	Covered/total	Coverage	Covered/total delta from preceding full run
Branches	20,875/31,948	65.3406%	+43/+10
Functions	5,656/9,123	61.9972%	+2/+0
Lines	102,179/142,000	71.9570%	+57/+6
Regions	155,596/220,128	70.6843%	+79/+7

Coverage MCP 0.16.0 inspected the retained LLVM measurements. These are local dirty-source results: source verification is unavailable and named-case attribution is unknown. A separate raw comparison of identical mapped entropy.rs source lines found 37 newly observed arms and 0 no-longer-observed arms among 5,585 unique spans; 23 nonunique spans were excluded. Changed-source denominators are reported explicitly; these counts do not assign coverage to individual new cases. The owner-approved alpha coverage floors passed. make coverage-complete exited 2 at the retained strict 100% gate; the broader coverage/performance/encoder goal remains open.

The immutable local checkpoint is .coverage-mcp/local-evidence/parity/avif-monochrome-mixed-key-20261102/. The complete full report, frozen source, six executables and raw/merged profiles remain in .coverage-mcp/local-evidence/full/20261102-monochrome-mixed-key/. The selected report is .coverage-mcp/local-evidence/selected/20261102T022905.119739Z-3f42b86d36ca4ae5887c4d4e4582255d. The checkpoint binds their artifact inventories and independently rehashes its own inventory after atomic rename. All work remains local and uncommitted in /Users/lazytrot/work/image-slash-star on existing develop; no branch, worktree, staging, commit or remote mutation is introduced.

AVIF I422 neutral super-resolution — 2026-11-02

Four public sequences expose ordinary 8-bit I422 super-resolution with neutral filters and no segmentation. The preceding executable rejects all four sequences; the current executable matches every live pinned Pillow frame exactly. They cover 40x16, 80x48 and 128x64 display extents, denominators 9/10/16, an odd coded width of 71, and height beyond the separate active-restoration profile's limit.

The causal change is the generic I422 inter root-geometry proof in entropy.rs. It now uses checked padded coded dimensions, matching the existing I444 geometry rule, instead of requiring an active-restoration or mixed-segment profile to prove super-resolution dimensions. The shared checked I422 compositor already reconstructs, filters and resizes complete coded planes. Layout, depth, references, transform grammar, film-grain and active-restoration checks remain in their existing predicates. No kernel, postfilter plan, allocation, Option category, unsafe block, dependency, source exclusion, threshold or fault hook is changed.

scripts/generate_avif_i422_neutral_superres_fixtures.py is an input-only producer using the existing pinned native source recipe. All four complete files reproduce twice and pass independent AV1 feature checks. Normal fixture verification checks them. Live Pillow/native collection supplies the standard sequence observations and complete exact pixels; no private unit test or alternate test framework is added. All 3,582 previous matrix rows, 7,110 canonical outcomes, 167 fault contracts and 10,172 previous fixture paths are preserved. Twenty-eight files are added; seven existing fixture metadata documents change, including 446 native-index SHA receipts. The matrix now has 3,586 rows, 3,559 active parity rows and 27 planned encoder rows. Canonical outcomes number 7,118; native observations number 475.

The source-bound full-call ARM64 performance guard compares accepted pre-fix e5f696f9 with current 93a40366: 16 previously successful complete workloads, three ABBA cycles, and 192 samples. Both executables match live pinned Pillow on all 16 workloads. No overall latency increase above 3% repeats above 3% in two cycles; the largest overall increase is 1.30%. This is a bounded nonregression result, not proof of zero overhead or a general speedup. The four previously unsupported sequences have no successful pre-fix latency ratio. This cohort also does not resolve the separate before-admission 10-bit monochrome slowdown.

Fresh strict lint, coverage-configuration lint, native/WASM/WASI feature checks, and SSE2/AVX2 strict compile lanes all pass. Native x86 runtime and speed remain unproven on this ARM64 host. Seven focused public cases pass, covering the new four and three existing restoration/mixed-segment guards. The fresh full native all-feature run passes all 139 integration checks, all 3,559 active parity cases, and 167 separately reported fault contracts. All case markers reconcile; no private unit-test executable runs. Twenty-seven planned encoder rows remain unexecuted. Source and fixture identities stay stable during both coverage runs.

Full LLVM coverage is 102,122/141,994 lines (71.919940%), 20,832/31,938 branches (65.226376%), 5,654/9,123 functions (61.975227%), and 155,517/220,121 regions (70.650688%). Compared with the preceding full report, covered/total deltas are lines -1/-4, branches +6/-8, functions 0/0 and regions -2/-5. The causal geometry edit changes denominators; these percentages are not a test-only coverage gain. A separate comparison finds 13 newly observed arms on identical mapped source lines among 5,587 unique entropy spans, excluding duplicate spans. None of those compared arms loses observation. This is bounded source-span evidence with no per-case attribution; it is not a repository-wide no-regression claim. Coverage MCP still reports missing branches and labels this dirty source unverified and test attribution unknown. Alpha floors pass; strict 100% fails, so the full make command exits 2 despite all executed tests passing.

Fixture, documentation, roadmap, claim-ledger, generated-capability, no-source-unit-test and whitespace checks pass. The first fixture check caught one stale AVIF count in the human roadmap; it is corrected and the complete fixture check passes. That failed receipt remains in the local investigation.

Selected and full reports stay outside target/ at the paths recorded by .coverage-mcp/local-evidence/parity/avif-i422-neutral-superres-20261102/. The checkpoint retains before/current source-bound executables, public wrappers, producer/observer/link inputs, input recipes, complete native observations, performance plans/timings/pixels, strict-check logs, and coverage source/profile identities. The full report has its own complete artifact inventory. All work remains local and unstaged on existing develop in the sole checkout at /Users/lazytrot/work/image-slash-star. The 100% coverage, general performance, encoder, native SSE2/AVX2 and world-ranking goals remain unfinished.

AVIF ordinary restoration parity and rejected caching — 2026-11-02

Two ordinary monochrome 8/10-bit SGR super-resolution sequences now have public manifest parity cases. They are the complete retained workloads used for the restoration performance follow-up. Their pixels and frame/sequence metadata come from live pinned Pillow and the independent native collector. The input-only producer is generalized and renamed to scripts/generate_avif_monochrome_superres_fixtures.py: all three preceding neutral inputs keep their case IDs and bytes, and all five recipes reproduce twice. The normal fixture check validates all five complete files and AV1 features. No Rust runtime or test source changes are retained in this increment.

A longer unchanged-binary ABBA control uses 24 samples on two workloads. The 10-bit latency increase repeats at 1.21% overall, with cycle ratios 1.020932/1.002925/1.010524. Assembly disproves a segmentation-copy hypothesis: the helper contains no copy call. It shows two static admission-helper call sites. A proposed shared proof also bypasses unused mixed-profile checks, but 156 samples over thirteen exact-live-Pillow workloads miss the predeclared 1% target gain: the affected workload is 0.41% slower. The original 3% safety gate passes, but that is insufficient to keep the optimization. Its exact source, binary, timings, commands and rejection are retained; entropy.rs is restored byte-for-byte to the preceding accepted source. No speedup or zero performance cost is claimed. Both bounded macOS sampling attempts time out without reports; the second owned worker is retired explicitly. The dynamic cause of the small slowdown remains unproven. Geometry validation in retained views must not be confused with sample-range validation at surface creation.

Two temporary registration-helper mistakes (a wrong parser and stale count constants) are retained with repairs. Written state is independently verified: all 3,580 preceding matrix rows, 7,106 canonical outcomes and 167 fault-contract rows keep their behavior; 444 native-index SHA receipts refresh. Current totals are 3,582 matrix rows, 3,555 active public parity rows, 27 planned encode rows, 7,110 canonical outcomes and 471 independent native observations. All 10,158 previous fixture paths remain; fourteen files are added.

Selected coverage passes all five ordinary monochrome cases, with zero selected faults. The unique neutral-restoration decision records three neutral and four active continuations, and Coverage MCP reports zero gaps for that condition within this cohort. This improves the preceding three-case focused cohort, whose opposite outcome was absent; it does not close a new full-suite gap. The fresh full run passes all 139 integration checks, 3,555 public parity rows and 167 separately counted fault contracts. No private unit-test executable runs; source and fixture hashes remain stable during measurements.

Full totals remain unchanged: lines 102,123/141,998 (71.918619%), branches 20,826/31,946 (65.191260%), functions 5,654/9,123 (61.975227%) and regions 155,519/220,126 (70.649991%). Alpha floors pass; strict 100% fails. Existing strict Rust, feature and SSE2/AVX2 compile evidence is reused for byte-identical Rust/Cargo inputs; fixture and documentation checks are fresh. No new native x86, SIMD speed, ranking or whole-file closure result is claimed. Local Coverage MCP source status remains unverified and individual case attribution unknown.

The selected report is retained at .coverage-mcp/local-evidence/selected/20261102T012621.167559Z-1f3acf9a68e247d3b5e5579d30d660c1/ and the fresh full baseline at .coverage-mcp/local-evidence/full/20261102-monochrome-sgr-parity/. The complete checkpoint is .coverage-mcp/local-evidence/parity/avif-neutral-restoration-cost-20261102/. Other public parity defects, the restoration performance follow-up and 100% coverage remain unfinished. Work remains on the existing develop branch in the sole working checkout.

AVIF neutral monochrome super-resolution admission — 2026-11-02

Three complete ordinary monochrome sequences at 8/10/12 bits expose a missing inter-frame admission: their first frame decodes, but the neutral-filter super-resolution inter frame previously produced Unsupported. The frozen pre-fix executable fails all three new public matrix cases. Sharing the existing bounded structural/reference proof with the neutral-restoration case now produces exact live Pillow pixels for both frames. Reconstruction, resizing, geometry, motion and reference validation stay in the existing checked paths. Active restoration alone creates a restoration plan; the intra restoration admission remains unchanged. Only entropy.rs changes at runtime.

The input-only producer's optional ordinary argument omits its fixture ROI control. All three inputs reproduce twice and match the retained original failing files byte-for-byte; its default invocation also reproduces all twenty preceding mixed-segment inputs twice without changing their digests. Independent AV1 header checks confirm actual frame features. Standard Pillow and native collectors own reference observations. A manifest registration check caught an initial insertion under the wrong format; that attempt and its correction are retained before the runtime change.

Focused coverage passes 3/3 selected public parity cases, with no selected fault contracts. The fresh full native run passes all 139 integration checks, 3,553 active public parity rows and 167 separately reported fault contracts; 27 planned encode rows remain unexecuted. No private unit-test executable runs. Source and fixtures stay stable during both measurements. Current totals are 3,580 matrix rows, 2,912 active decode rows, 641 active encode rows, 7,106 canonical cases and 469 independent native loop observations. All 3,577 previous matrix rows and 7,100 canonical outcomes retain their behavior; 441 native-index SHA receipts refresh. Existing fault-contract rows remain unchanged.

The fresh full report covers 102,123/141,998 lines (71.918619%), 20,826/31,946 branches (65.191260%), 5,654/9,123 functions (61.975227%) and 155,519/220,126 regions (70.649991%). Alpha floors pass; the strict 100% gate fails. At the new neutral-restoration decision, raw LLVM branch counts are three neutral continuations and ten active-restoration continuations. Coverage MCP reports zero gaps for that one condition, not whole-file closure. Local source verification remains unverified and individual case attribution is unknown.

Fresh strict Clippy, coverage-cfg Clippy, SSE2/AVX2 compile checks and native, WASM and WASI feature lanes pass. Ten complete public decode workloads match live Pillow on both binaries before three paired ABBA timing cycles. All 120 samples satisfy the predeclared regression rule (reject an overall increase above 3% repeated in at least two cycles). The largest median increase is 2.01% on the existing 10-bit monochrome restoration control; all three cycles are slower, so this remains a performance follow-up. This correctness fix does not establish zero overhead, a speedup, native x86 performance or a ranking. No dependency, unsafe Rust, runtime fault hook, unit test, source exclusion or threshold reduction is added.

The source-bound full baseline and selected report are retained in .coverage-mcp/local-evidence/full/20261102-monochrome-neutral-superres/ and .coverage-mcp/local-evidence/selected/20261102T005449.353034Z-859c2dd85f4f49b0b15a992343981bd1/. The complete investigation and checkpoint are in .coverage-mcp/local-evidence/parity/avif-monochrome-neutral-superres-20261102/. The other retained I422 and mixed-key public parity defects, broader coverage and performance work remain unfinished. Work stays on the existing develop branch in the sole working checkout.

AVIF mixed-segment super-resolution parity — 2026-11-02

Twenty input-only native recipes cover a lossy key followed by a mixed lossless/lossy inter frame, coded at 64x48 and displayed at 80x48. Monochrome, 4:2:0, 4:2:2 and 4:4:4 cover 8/10/12-bit samples with neutral filters; eight additional 8/10-bit variants within those twenty use active luma SGR restoration. Pinned libavif disables 12-bit encoder restoration, making four attempted recipes byte-identical to neutral inputs. Those attempts remain retained and are not registered as extra cases. Every distinct input reproduces twice. Independent AV1 header parsing checks the actual features; standard live Pillow and native collectors own the reference observations.

All twenty exact public decode/sequence cases pass in focused coverage, with source and selected fixture identities unchanged during measurement. The previous full baseline records 178,170 rejecting outcomes and no admissions at entropy.rs:4236; this selected cohort records no rejections and 6,700 admissions on identical runtime source. The rest of the restoration profile also executes. Coverage MCP still reports one gap for the opposite outcome within this selected report. No whole-file closure, summed generic gaps, per-case attribution or new full-suite coverage percentage is inferred. The selected report and its receipt remain in .coverage-mcp/local-evidence/selected/20261102T003221.843140Z-6d1d1c9111264b10b617b5e015f457cd/.

All 3,557 previous matrix rows and 7,060 canonical outcomes retain their public behavior; 421 native-index receipts refresh. Current totals are 3,577 matrix rows, 3,550 active public parity rows, 27 planned encode rows, 7,100 canonical cases and 466 independent native loop observations. The 167 existing target-only fault contracts are unchanged and none is selected in this run. No Rust runtime or test source changes; strict Rust/feature/SSE2/AVX2 compile and full-baseline evidence from the preceding source remains applicable to that source. No new performance or native x86 runtime result is claimed.

The native producer investigation retains unsuccessful builds, speed-8 native crashes, a retired bounded debugger attempt, non-mixed control inputs and valid inputs that pinned Pillow decodes but the current Rust implementation rejects as unsupported. Those are unresolved parity defects, not passing rows or target-only faults. Full coverage and codec performance remain unfinished. The producer recipe, source snapshots, all attempts and scoped verification are retained in .coverage-mcp/local-evidence/parity/avif-mixed-superres-20261102/. Work stays on the existing develop branch in the sole working checkout.

AVIF super-resolution admission cost — 2026-11-02

Five source-bound public decode profiles identify repeated super-resolution eligibility checks on the current decoder. ARM64 assembly confirms a 264-byte segmentation copy before structural rejection. Borrowing that immutable state removes the copy. Restoration admission now rejects incompatible structure and layout before filter classification, and neutral profiles avoid classification whose result they do not use. All existing predicates and checked fallbacks remain. This changes two private helpers in entropy.rs only.

The borrow-only trial retains exact live Pillow parity but misses the predeclared 3% full-call gain threshold; its source, executable and all 96 paired timing samples remain retained. A second source-bound A–B–B–A trial combines the borrow with deferred filter classification. Across eight unchanged public decode workloads, both frozen binaries match live pinned Pillow before timing. All 96 samples from three cycles are retained. The profiled 12-bit 4:2:0 16x4 inter sequence improves by 3.50% overall, with per-cycle changes of -1.71%, -4.62% and -3.66%. Changes across all eight workloads range from -3.50% to +0.37%; none crosses the repeated 3% regression gate. This is a bounded Apple M3 Pro shared-host latency result, without native x86 execution or a world-ranking claim. The initial formatting-only build is retained separately and was not timed.

Fresh full native all-feature coverage passes all 139 integration checks in six executables. All 3,530 active public parity rows and the existing 167 separately reported fault contracts execute and pass exactly once; 27 planned encode rows remain unexecuted. No new test or fixture is added. All 150 source/setup identities and all 9,997 fixture-file identities remain unchanged during measurement. No private unit-test executable runs.

Metric	Covered / total	Coverage
Lines	101,918 / 141,993	71.776778%
Branch outcomes	20,648 / 31,942	64.642164%
Functions	5,649 / 9,123	61.920421%
Regions	155,234 / 220,122	70.521802%

Alpha floors pass; the unchanged strict 100% gate still fails. These fresh metrics describe the refactored source and do not replace historical managed claims. Coverage MCP imports remain source-unverified with unknown test attribution; retained source identities bind this local measurement. Full coverage, raw profiles and six instrumented executables remain in .coverage-mcp/local-evidence/full/20261102-superres-admission/.

The actual restoration-admission decision records 178,170 rejections and no admissions in this corpus. Its admitted path remains uncovered; a public mixed-segment super-resolution input is a concrete next coverage target. A function-header gap query is not evidence that the decision is fully covered.

Formatting, strict stable/coverage Clippy, SSE2/AVX2 compile checks and the native/WASM/WASI feature matrix pass. There is no new allocation, unsafe Rust, dependency, optional-state category, runtime fault hook or coverage exclusion. Both trials, current profiles, source snapshots, assembly and raw timings remain in .coverage-mcp/local-evidence/parity/avif-superres-admission-20261102/. Work remains on develop in the sole /Users/lazytrot/work/image-slash-star checkout, without staging, commits, new branches, worktrees or remote writes. The full coverage and codec performance goal remains active.

AVIF adjacent square-64 chroma neighbor parity — 2026-11-02

Eighteen five-frame 128x128 inputs cover adjacent 64x64 inter blocks in 4:2:2 and 4:4:4, at 8/10/12 bits and qualities 70/95/99. A gray key frame precedes four colored checker periods. Ordinary encoder controls retain square roots; no native partition patch is needed. The high-depth planar sources preserve nonzero low sample bits. Every source reproduces twice byte-for-byte, and independent observed/unmodified scalar dav1d decoders produce identical YUV on all eighteen inputs and six additional mixed-pattern investigation guards. Expected pixels and native sequence observations are collected separately from input generation through the existing reference workflows.

All eighteen checker sequences fail on the preceding Rust decoder. A bounded trace confirms the first divergent U terminal in a deep 64x64 block: both decoders have arithmetic range 39,176, but Rust selects coefficient-skip context 11 instead of native context 12. Its lower left chroma edge remains neutral because SplitB64Deep is absent from the full-grid loading predicate. The existing reconstruction path already traverses that complete grid. Including the deep plan beside shallow and mixed plans fixes all eighteen regressions; the six mixed-pattern guards also retain exact live Pillow parity. All five complete RGB frames and sequence metadata are checked. Only entropy.rs changes among runtime files. Temporary Rust tracing and diagnostic field visibility are removed after retaining their evidence.

The existing fixture-verification target now checks the input-only square-64 generator. All 3,539 prior matrix rows and 7,024 canonical outcomes remain unchanged, apart from 403 native-index receipts. The matrix has 3,530 active public parity rows, 27 planned encode rows, 7,060 canonical cases and 446 independent native loop observations. The existing 167 target-only fault contracts remain separately counted. An investigation-helper count assertion failed before bundle mutation; its corrected assertion and original failure are retained. A copied summary field was independently corrected from 42 to the actual eighteen new rows without rerunning registration.

Fresh full native all-feature coverage passes all 139 integration checks in six executables. Every active parity and fault-contract row executes and passes exactly once; planned rows remain unexecuted. No private unit-test executable runs. All 150 source/setup identities and 9,997 actual fixture-file identities remain unchanged during measurement. A runner status fragment splits one BMP pass marker; the initial failed reconciliation, exact raw span and catalog-checked rejoining rule are retained without editing the raw log.

Metric	Covered / total	Coverage
Lines	101,924 / 141,991	71.782014%
Branch outcomes	20,652 / 31,942	64.654687%
Functions	5,649 / 9,123	61.920421%
Regions	155,244 / 220,122	70.526344%

Alpha floors pass; make coverage-complete returns 2 solely because the unchanged strict 100% gate fails. Coverage MCP reports no gap at the deep-plan and chroma-grid decisions. Its LLVM import remains source-unverified with unknown test attribution; separate local identities bind the source. Full coverage, raw profiles, six instrumented executables and reconciliation receipts remain in .coverage-mcp/local-evidence/full/20261102-square64-neighbors/.

A fresh source-bound ARM64 A–B–B–A comparison checks eight unchanged public decode workloads. Both frozen binaries match live pinned Pillow before timing. All 96 samples from three cycles are retained; median latency changes range from -1.24% to +1.75%, with no repeated regression above 3%. This supports a bounded shared-host Apple M3 Pro regression check, without a speedup, native x86/SIMD execution or world-ranking claim.

Strict stable/coverage Clippy, SSE2/AVX2 compile checks, native/WASM/WASI feature matrix and fixture integrity pass. The change adds no allocation, unsafe Rust, dependency, runtime fault hook, private unit test, optional-state category or coverage exclusion. Five fresh, untimed public decoder profiles on the preceding source retain exact live Pillow parity and identify entropy decoding as a material follow-up cost; sampled runs are not performance comparisons. Investigation, source/input reproduction, public regressions and validation evidence remain in .coverage-mcp/local-evidence/parity/avif-square64-neighbors-20261102/. The full coverage and codec performance goal remains active on develop in /Users/lazytrot/work/image-slash-star, with one checkout and no staging, commit, new branch, worktree or remote mutation.

AVIF 16x64 and 64x16 chroma reconstruction parity — 2026-11-02

Forty-two complete-file parity inputs exercise thin inter leaves in 128x64 and 64x128 sequences. Monochrome, 4:2:0, horizontal 4:2:2 and 4:4:4 cover 8/10/12-bit samples and qualities 70/99. Independent scalar dav1d observations witness shallow, mixed and fully split transform trees; its observed and unmodified decoders produce identical YUV on all 42 inputs. The input producer reads no Rust output or expected pixels. Six vertical 4:2:2 requests return clean producer errors before writing a file because the native chroma geometry is invalid; these are neither public parity nor target fault-contract cases.

The original decoder matches 18 of the 42 valid inputs. Extending the existing inherited-transform mapping to deep and mixed thin-64 chroma paths brings that to 35. Mixed 4:4:4 rectangular plans also omitted the complete above/left context grid. At the first divergent terminal, native and Rust arithmetic ranges agree, but the missing neighbor context selects skip context 11 instead of 12 and changes a nonzero transform into a skipped one. Loading the complete grid for those existing plans fixes the remaining seven cases. Both complete frames, exact RGB pixels and sequence metadata now match live pinned Pillow for all 42 cases. Initial failures, bounded first-divergence traces and both intermediate/final executable identities remain retained. Temporary Rust diagnostics have been removed.

All 125 maintained narrow inputs reproduce twice byte-for-byte, preserving the previous 83 inputs. All 3,497 previous matrix rows and 6,940 canonical cases retain their public outcomes; 361 native-loop index receipts update. There are now 3,512 active public parity rows, 27 planned encode rows, 7,024 canonical cases and 428 independent native loop observations. The existing 167 target-only fault contracts remain separately reported.

A fresh all-feature native coverage run passes all 139 integration checks in six executables. Every active parity row and fault-contract row is reconciled exactly once; planned rows remain unexecuted. A test-runner completion message split one TIFF execution marker. Its exact raw span, the initial failed reconciliation and the bounded rejoining rule are retained; the raw log is unchanged. All 150 source/setup identities and 9,763 fixture-file identities remain unchanged during measurement. No private unit-test executable runs.

Metric	Covered / total	Coverage
Lines	101,905 / 141,991	71.768633%
Branch outcomes	20,639 / 31,942	64.613988%
Functions	5,647 / 9,123	61.898498%
Regions	155,219 / 220,122	70.514987%

The alpha floors pass. make coverage-complete returns 2 solely because its unchanged strict 100% gate fails. Both outcomes of the previously missing 16x64 and 64x16 all-children-split decisions are now observed: counts 37/80 and 93/63 respectively. Coverage MCP reports no remaining gap at either decision. Its LLVM import remains source-unverified with unknown test attribution; separate local identities bind the source. Full report, raw profiles, instrumented binaries and reconciliation receipts remain in .coverage-mcp/local-evidence/full/20261102-wide16-inter/.

A fresh paired ARM64 check compares the frozen accepted and corrected release binaries on the same eight unchanged public decode workloads. Both binaries match live pinned Pillow before timing. Three A–B–B–A cycles retain all 96 raw samples; median latency changes range from -0.65% to +0.75%, with no repeated regression above 3%. These shared-host Apple M3 Pro measurements support a bounded regression check, without a new speedup or world-ranking claim.

Strict stable/coverage Clippy, SSE2/AVX2 compile checks and the native/WASM/WASI feature matrix pass. Only two runtime files change; the fixes add no allocation, private unit tests, unsafe Rust, dependencies, runtime fault hooks, new optional state categories or coverage exclusions. Work remains uncommitted on the existing develop branch in /Users/lazytrot/work/image-slash-star, with one checkout. Investigation and reproduction evidence is retained in .coverage-mcp/local-evidence/parity/avif-wide16-inter-20261102/. Full 100% coverage, further performance improvements and native x86 runtime evidence remain unfinished.

AVIF 8x32 and 32x8 inter transform parity — 2026-11-02

Forty-two complete-file public parity rows cover fine-detail 64x32 and 32x64 sequences at 8, 10 and 12 bits. Monochrome, 4:2:0, horizontal 4:2:2 and 4:4:4 inputs use qualities 70/99. Independent scalar dav1d traces witness narrow inter leaves with shallow, mixed and fully split transform trees; observed and unmodified native decoders produce identical YUV for every valid probe. Exact live pinned Pillow RGB frames and sequence metadata match the unchanged Rust runtime. All 83 maintained narrow inputs reproduce twice byte-for-byte, including the unchanged 41 earlier inputs.

The six forced vertical 4:2:2 native producers fail before writing a public input. A compiled lookup against the pinned native source confirms that its chroma-size table maps an 8x32 4:2:2 leaf to BLOCK_INVALID. The maintained producer now rejects that geometry before allocation; its partition-forcing patch also preserves the native validity test. All six requests then return a clean error with no output file. These are producer diagnostics, not Pillow parity failures or target fault-contract results. The initial native failure, its attempted commands and the build preflight failure remain retained.

All 42 new selected matrix rows pass. Identical-source coordinate comparison against the compatible prior 1,007-row and twelve-row reports adds 86 observed branch outcomes: 72 in block reconstruction and 14 in entropy decoding. Both outcomes of the previously unobserved 8x32 child-offset decision are reached; Coverage MCP reports no remaining gap at that decision. Generic instances are OR-merged by source coordinate. Unselected prior hits absent from this subset are not measured losses. MCP imports remain source-unverified with unknown test attribution; separate identities bind local source. Reports and receipts remain outside target/ in .coverage-mcp/local-evidence/selected/20261102-avif-wide8-inter/.

All 3,455 prior matrix rows and 6,856 canonical cases retain their public outcomes. Only 319 canonical native-loop index receipts update. The matrix now has 6,940 canonical cases and 386 independent native loop observations. All 138 Rust/harness/build identities and 129 runtime/build identities match the prior accepted implementation; 2,780 unaffected fixture hashes also match. The prior 1,019 selected-case evidence and strict Rust/native/WASM/WASI/SIMD compile checks are reused under those identities. The eight performance inputs and accepted ARM64 confirmation remain unchanged, with no new speed claim. No Rust edits, private unit tests, unsafe Rust, dependencies, fault hooks, new optional-state categories or coverage exclusions are added. Full aggregate coverage, encoder/decoder optimization and native x86 performance remain open. Evidence is retained in .coverage-mcp/local-evidence/parity/avif-wide8-inter-20261102/.

AVIF frozen and selective entropy CDF parity — 2026-11-02

Twelve complete-file public parity rows cover ordinary encoder CDF controls. Nine inputs freeze probability tables on both key and inter frames across 8, 10 and 12 bits in 4:2:0, horizontal 4:2:2 and 4:4:4. Three inputs retain adaptive key-frame tables and freeze the following inter-frame tables. Exact live pinned Pillow RGB frames, dimensions, mode and sequence metadata match the current source-bound release decoder for every input. Independent native loop observations confirm both frames and repetition behavior. The input producer reads no target output or expected pixels; its optional CDF control uses the pinned libaom API. All 41 maintained narrow inputs reproduce twice byte-for-byte, including the unchanged 29 earlier inputs.

All twelve new selected matrix rows pass. Compared by identical runtime source coordinates with the prior 1,007-row report, they add six observed branch outcomes: two in block reconstruction, three in entropy, and one in frame parsing. The public image subset now observes both outcomes of all five branches in the specialized four-symbol method. Coverage MCP reports no remaining gap there, closing the complete-file follow-up recorded below. Generic instances are OR-merged by source coordinate; unselected prior hits absent from the subset are not measured losses. Imported MCP source remains unverified with unknown test attribution; local identities bind source separately. The selected report and receipt are retained in .coverage-mcp/local-evidence/selected/20261102-avif-frozen-cdf/.

All 3,443 previous matrix rows and 6,832 previous canonical cases retain their public outcomes. Only 307 canonical native-loop index receipts update. There are now 6,856 canonical cases and 344 independent native loop observations. The prior 1,007-case result is reused under identical Rust runtime, harness and build identities, equivalent old public cases and verified unaffected fixture hashes. All 129 runtime/build identity files and performance inputs are unchanged, so the preceding strict Rust, target, SIMD compile and ARM64 performance evidence remains applicable. No private unit tests, runtime hooks, unsafe Rust, dependencies, new optional-state categories or coverage exclusions are added. Full aggregate coverage, further codec optimization and native x86 performance remain open. Investigation, reproduction and registration evidence is retained in .coverage-mcp/local-evidence/parity/avif-frozen-cdf-20261102/.

AVIF fixed four-symbol entropy decoding — 2026-11-02

Fresh untimed profiles of five complete public decode workloads identify adaptive symbol decoding as a material cost. A fixed four-symbol method now uses three explicit probability boundaries and a fixed three-probability CDF update. Eighty-five statically typed four-entry table callers use it, including coefficient low/high tokens and motion tables. Variable-size tables retain the general decoder. The final count slot remains bounded to 32, so its shifted probability is the same implicit zero boundary as pinned dav1d. Normalization, wrapping arithmetic, update rates and trace observations retain their order. The common trace completion helper has no separate release symbol.

Both source-bound release binaries match live pinned Pillow on all eight predeclared timing workloads. A high-token-only trial failed the greater-than-3% profiled-workload gain gate and remains retained. The broader trial narrowly passed provisionally, then received five-times-longer confirmation with the same workload cohort, three cycles and A–B–B–A order. All 96 confirmation samples remain available. Overall median latency changes range from -3.23% to +0.90%; two profiled workloads improve by approximately 3.2%. No control triggers the predeclared repeated greater-than-3% regression rule. These are bounded public-call observations on a shared Apple M3 Pro ARM64 host; native x86 runtime, SIMD execution and world rankings are not established.

All 1,007 active selected AVIF rows pass, including exact pixels and structured failures. The report and unchanged-source/fixture receipt are retained in .coverage-mcp/local-evidence/selected/20261102-avif-symbol4/. A freshly built unmodified pinned scalar dav1d independently reproduces all 103 committed entropy states; the existing Rust integration parity test matches those exact values, CDFs and decoder states, including frozen CDF behavior. That trace run observes both outcomes of all five source branches in the specialized method. The public image subset alone leaves the disabled-CDF-update branch unobserved; a complete-file Pillow parity companion remains useful follow-up work.

Strict make lint, SSE2/AVX2 compile checks and all seven relevant native, WASM and WASI checks pass. No unit tests, coverage exclusions, unsafe Rust, dependencies, fault hooks or new optional-state categories are added. Imported Coverage MCP source status remains unverified with unknown test attribution; separate hashes bind the local source. Full aggregate percentages remain the historical measurement. The current manifest receipt is refreshed after an earlier whitespace cleanup changed its byte hash, preserving historical coverage and measured-input fields. Frozen source, every trial, native oracle, profiles and receipts are retained in .coverage-mcp/local-evidence/parity/avif-symbol4-20261102/.

AVIF fully split vertical narrow transforms — 2026-11-02

Four input-driven public parity rows cover fine-detail 16x64 sequences at 10 and 12 bits in 4:2:0 and 4:4:4. Pinned scalar dav1d observations establish fully split 4x16 inter transform trees. All twelve exploratory inputs, including 8-bit and lower-quality controls, match exact live Pillow RGB frames and metadata. The observed and unmodified native decoders produce identical YUV. The maintained producer's optional fine input pattern changes source pixels; no target output or private target state enters fixture generation. All 29 registered narrow-inter inputs reproduce twice byte-for-byte, including the unchanged 25 earlier inputs.

All four new selected parity rows pass. Their source-bound report in .coverage-mcp/local-evidence/selected/20261102-avif-vertical-deep/ adds twelve observed branch arms to the prior 1,003-row AVIF measurement: eleven in block reconstruction and one in entropy. Coverage MCP reports no missing arm at the previously untested fully split vertical decision. This comparison merges generic instances by identical source coordinates; the four-row subset does not remeasure unselected baseline hits or establish a full regression result. The prior 1,003-row evidence is reused because the runtime is identical, all old public cases are equivalent, and all 2,716 unaffected fixture file hashes still match. MCP imports remain source-unverified with unknown attribution; local hashes bind the reports and runtime separately.

All 3,439 prior matrix rows and 6,824 prior canonical cases retain their public outcomes. Only append-only native loop-index receipts change. The matrix now has 6,832 canonical cases and 332 independent native loop observations. Rust runtime, integration harness, build policy and performance controls are unchanged; the prior strict style, target and public-call performance checks remain applicable. Full aggregate coverage and native x86 runtime measurements remain open. Investigation and registration evidence is retained in .coverage-mcp/local-evidence/parity/avif-vertical-deep-20261102/.

AVIF high-depth narrow transform companions — 2026-11-02

Ten input-driven parity rows extend the narrow 16x4 and 4x16 inter sequences to 10 and 12 bits at quality 99: four 4:2:0, two horizontal 4:2:2 and four 4:4:4 inputs. The maintained input-only producer reproduces every registered input twice byte-for-byte. Live pinned Pillow supplies both exact RGB frames and sequence metadata; independent native observations supply loop evidence. All 6,804 prior canonical cases preserve their public outcomes, with only append-only loop-index receipts updated. The matrix now has 6,824 canonical cases and 328 native loop observations.

All thirty exploratory 10/12-bit probes at qualities 45, 70 and 99 match live Pillow. Six of the ten registered inputs expose pixel mismatches in the source-bound release build preceding the two narrow-inter fixes described below. Current Rust source is unchanged. Additional scalar dav1d transform observations witness deep horizontal and mixed vertical split trees, and observed and unmodified native decoders produce identical YUV on all thirty inputs. Deep vertical trees remain an unmeasured case.

All 1,003 active selected AVIF rows pass: 998 decode and five encode rejection rows. The source-bound report in .coverage-mcp/local-evidence/selected/20261102-avif-narrow-depth/ records 51 newly observed source branch arms, 41 in block reconstruction and ten in entropy, with zero lost arms. The comparison uses identical runtime source and merges repeated generic instances by source coordinate. It reaches the deep horizontal and mixed vertical narrow-transform branches. Coverage MCP imports remain source-unverified with unknown test attribution; separate local hashes bind the source and fixtures. This selected run does not update full aggregate percentages or establish 100% coverage.

The prior strict Rust style, native/WASM/WASI, x86 SSE2/AVX2 compile checks and 120-sample public-call performance regression campaign are reused because all 129 runtime/build source identities and their validation inputs are unchanged. This fixture expansion makes no new SIMD runtime or speed claim. Frozen probe outputs, native observer changes and registration receipts are retained in .coverage-mcp/local-evidence/parity/avif-narrow-depth-20261102/.

AVIF narrow inter chroma and transform contexts — 2026-11-02

Fifteen input-driven parity rows add two-frame 64x16 and 16x64 sequences at qualities 45, 70 and 99: six 4:2:0, three horizontal 4:2:2 and six 4:4:4 inputs. Pinned native leaf traces establish 16x4 or 4x16 inter geometry. The maintained native producer reproduces all fifteen complete inputs twice byte-for-byte. Live Pillow supplies exact frames and independent native observations supply loop evidence. All 6,774 prior canonical cases retain their public outcomes; only 278 receipts change to reference the append-only loop index. There are now 6,804 canonical cases and 318 complete native loop observations.

The probes exposed two decoder defects. Shared sub-eight chroma now assembles its two or four prediction parts using each causal luma owner's reference, motion vector and interpolation filter. An intra or unavailable neighbor uses the complete checked current-block predictor. The private pending predictor is optional complete prepared state, cleared before every inter leaf and taken once; its absence selects that complete fallback. The two-element iterator's optional result is ordinary collection exhaustion. Neither category suppresses malformed-input errors. Existing chroma residual reconstruction is reused.

The narrow transform parser also preserves the zero width context of TX4x8 and the zero height context of TX8x4. A preceding child's split cannot lower that four-pixel axis context. This fixes the quality-99 horizontal 4:4:4 mixed tree as well as the six 4:2:0 pixel mismatches. All 171 oracle-success probes match exact Pillow dimensions, modes and every frame byte in the final release build, with zero regressions. Three vertical 4:2:2 producer probes are rejected by pinned Pillow on frame two and remain separately retained negative evidence.

All 993 active AVIF selected rows pass: 988 decode and five encode rejection rows. The retained report and its receipt are in .coverage-mcp/local-evidence/selected/20261102-avif-narrow-inter/. All 129 runtime/build identities and the selected fixtures remain unchanged through that run. Coverage MCP imports remain source-unverified with unknown test attribution; the local source hashes provide separate binding. This selected report does not refresh full aggregate percentages or establish 100%.

A fresh pre-fix release build differs only in the two edited AVIF modules and uses the same public wrapper and build options. Both binaries match live Pillow on ten declared timing controls before measurement. All 120 ABBA samples across three cycles are retained; median changes range from -2.06% to +2.67% on the shared Apple M3 Pro ARM64 host. No control triggers the repeated greater-than-3% regression rule. These observations establish the bounded regression gate, not a universal speed gain or x86/SIMD speed claim. The original and observed pinned scalar dav1d builds also produce identical YUV for all fifteen accepted new inputs, keeping the geometry witnesses independent of instrumentation effects.

Exact equal-source span mapping finds 90 newly observed branch arms in the block module and thirteen in entropy, with no lost arms. Other unchanged runtime modules have zero additions or losses. New, changed and deleted source branches remain in the selected report; they are outside this coordinate comparison. Coverage MCP still identifies unmeasured inter-transform branches.

Frozen sources, inputs, exact outputs, failed probes, command receipts, native trace observers, raw timings and the verified inventory are retained in .coverage-mcp/local-evidence/parity/avif-narrow-inter-20261102/. The checkpoint contains the new fixture evidence and hashes for the complete selected corpus; full replay also requires the unchanged repository fixture corpus. Everything remains local and uncommitted in the requested checkout on develop.

Strict default/all-feature/release/nightly-coverage Clippy, native AVIF and all-feature contracts, WASM AVIF/all-feature Clippy and rustdoc, WASI Clippy, and SSE2/AVX2 compile checks pass. The host is ARM64; x86 runtime parity and benchmark evidence remain open. No dependency, unsafe code, private unit test, fault hook, coverage exclusion, project branch or worktree is added.

WebP histogram candidates not retained — 2026-11-02

Six histogram candidates were evaluated against the accepted sparse-predictor checkpoint. Seven source-bound builds, including a freshly rebuilt baseline, each match live Pillow in all 168 alpha calls: 1,176 exact public calls total. Seven three-cycle ABBA pilots retain 144 samples each across twelve controls, for 1,008 samples total. Eight ordinary controls include varied-color lossless RGB/RGBA, method-five RGBA, palette chains and the large plane transition; four token-aware controls check caller-budgeted encoding. The zero-block prototype also matches 72 live-Pillow lossless calls through both public APIs.

The table shows median latency changes for five ordinary controls; negative values mean lower latency. Every control, cycle, byte gate and sample is retained in the pilot JSONs, including token-aware misses. The initialization pilot uses the freshly rebuilt baseline; the earlier pilots use the accepted binary.

Candidate	Raw alpha	Combined alpha	Method-four RGBA	Method-five RGBA	Large transition
Occupied bounds	+3.79%	+2.12%	+4.22%	+1.19%	+1.89%
Eight-bin zero probe	+4.81%	-1.08%	+4.51%	-3.67%	-1.06%
Eight-zero admission	+2.85%	+0.06%	+1.68%	-1.13%	-1.56%
One histogram group	-0.58%	+0.25%	+0.85%	+1.67%	+2.62%
Contiguous populations	+2.87%	+6.71%	-1.09%	+0.44%	-5.39%
Single initialization	-0.22%	-1.47%	-0.10%	+0.30%	+1.23%

No candidate is retained. Occupied bounds add bookkeeping without a repeatable full-call gain. Unconditional zero-block probing helps palette inputs but repeatedly regresses raw alpha and method-four RGBA. Admitting probes only after eight observed zeros reduces those regressions but retains mixed results. A single-group shortcut and avoiding duplicate initialization give only marginal gains. Contiguous population storage improves the large transition but regresses combined alpha. The independent same-source baseline control spans -1.01% to +1.69%, insufficient to explain the repeated 4–7% misses. The rejected block probe compiles to ARM64 vector loads and OR reductions; that static evidence does not establish a SIMD speed improvement.

Both touched runtime modules were restored byte-for-byte. All 129 runtime/build identities and all 9,414 source/setup identities match the accepted checkpoint; its 502-row WebP parity, strict lint, target and fixture results remain reusable. No fixture, canonical expectation, manifest case, dependency, unsafe code, private unit test, fault hook, coverage exclusion or new branch was introduced. Documentation checks are rerun for this record. The original performance gap, full coverage and x86 runtime validation remain unfinished.

Coverage MCP navigation confirms one remaining histogram gap group at the defensive pair-queue capacity guard; the guard is retained. All four PNG source files match the complete retained baseline, whose PNG query returns no missing branch groups. The unchanged AV1 block module has 723 gap groups, many involving generic inter-decoder instances, and remains a higher-return coverage target. The entropy module differs from that full baseline, so its old query is only navigation evidence and cannot prove current coordinates or a denominator. No full coverage percentage is refreshed by this investigation.

All frozen candidates, binaries, live-oracle outputs, producers, decisions, paired samples, build-environment receipts and source-bound navigation records are retained with a verified inventory in .coverage-mcp/local-evidence/parity/webp-histogram-no-go-20261102/. Its accepted source/setup anchor is the independently verified webp-spatial-entropy-20261102 checkpoint, manifest SHA-256 00a138142c113977ffe5d7a5a293551ee5ac77f0d8a560f1f4cb8eaf1f641a56. Everything remains local and uncommitted on develop in /Users/lazytrot/work/image-slash-star.

WebP cached sparse predictor entropy — 2026-11-02

Two new input-driven parity rows encode a 259x259 RGBA PNG at methods four and six. Its blue plane changes after a zero prefix longer than 65,536 pixels, across clipped predictor tiles. The existing input-only generator supplies the source independently of encoded output; pinned Pillow supplies exact encoded bytes, decoded modes and pixels. All 3,412 prior matrix rows and all 6,770 prior canonical JSON cases remain unchanged, including 1,000 WebP canonical cases. The matrix now has 6,774 canonical JSON cases.

The private predictor caches each accumulated bin's fixed-point entropy term and its per-plane sum while the fourteen modes compete. A tile histogram also records its populated symbols once. Cost evaluation starts with the cached previous sum and replaces only populated bins with the same two terms as the original complete scan. Adding the winning histogram refreshes the cache once. Each subtracted term is still present in its plane sum; validated WebP geometry bounds populations and sums. This preserves the exact integer entropy, zero-bin bias, tie order and full transform/reference search. Guards, structured errors, hidden-RGB behavior and cancellation checkpoints remain unchanged. State stays on the stack, using about 10 KiB more than the previous three count arrays; there are no new heap allocations. The module documentation now describes both the method-four grid and the bounded method-five/six sampling search.

All 502 selected WebP parity rows pass: 266 decode and 236 encode rows, with 978 public encode calls and zero panics. Five existing target-only fault contracts pass separately. The cache-only prototype, sparse prototype and final build each preserve all 168 live-Pillow alpha probe bytes and pixels. Another 72 lossless calls and eight baseline/candidate calls for the new cases match bytes, modes and pixels through ordinary and token-aware encoding.

The retained cache-only pilot has 72 ABBA samples across six controls; medians improve by 5.14–21.69%. The sparse pilot has 96 samples across eight controls, including ordinary method-five RGBA and the large transition; medians improve by 4.35–34.17%. Their frozen sources, binaries, byte gates and all samples remain. The final benchmark keeps all seventeen previous controls and adds the large transition. Both builds match fresh Pillow output for all eighteen controls before timing. Across 216 ABBA samples and three cycles on the shared Apple M3 Pro ARM64 host, median changes range from -34.60% to +2.97%. No control exceeds the 3% regression threshold in two cycles. Raw-alpha latency improves by 34.60%, ordinary method-five RGBA by 34.36%, lossless RGB noise by 13.48%, and the large transition by 7.81%. Palette chains with sixteen and seventeen colors improve by 28.58% and 27.90%. These are complete public-call latency measurements; uniform-RGB alpha controls are excluded from codec throughput ranking.

The original performance regression remains open. Twelve separately retained paired samples against the earlier incomplete-search implementation measure 0.288 ms versus 3.032 ms on the raw-alpha control, a 10.53x median latency ratio (cycle ratios 6.77–10.57x). That earlier build fails other ordinary parity inputs and cannot replace full native search. A fresh diagnostic profile has histogram clustering entropy as its leading collapsed codec frame, ahead of the predictor cost calculation. Profiling timings are not benchmark rankings.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261101T193234.821110Z-336cf241bff844dab5dd83376031e711/coverage.json. Coverage MCP reports three remaining predictor branch-gap groups, two encoder groups, eight backward-reference groups and one cross-color group. All forty branch outcomes across the fifteen selected predictor helper instantiations are observed, including the first/repeated-symbol branch. Unchanged WebP source coordinates have zero newly observed and zero lost observations. The changed predictor module is excluded from that coordinate comparison. Importer source identity remains unverified and per-test attribution unknown; independent local hashes bind 129 runtime/build files and the validation inputs. This is selected coverage, not a refreshed complete aggregate or a 100% coverage claim.

Strict default/all-feature/release/coverage lint, SSE2/AVX2 compile checks, native WebP/all-feature contracts, WebP WASM Clippy/rustdoc, all-feature WASI Clippy, fixture integrity and documentation checks pass against unchanged source/setup identities. No unit test, fault hook, unsafe code, dependency, coverage exclusion, extra branch, worktree or remote write was introduced. All work remains local and uncommitted on develop in /Users/lazytrot/work/image-slash-star. Reproducible producers, all variants, paired samples, source snapshots, checks and the selected report are retained in .coverage-mcp/local-evidence/parity/webp-spatial-entropy-20261102/, with an independently verified inventory. Full aggregate coverage, the original latency gap, x86 runtime parity/speed and world ranking remain unfinished.

WebP predictor cost reduction — 2026-11-02

Four new input-driven parity rows cover zero color planes and transitions between zero and nonzero planes across clipped 33x35 predictor tiles, at methods four and six. The existing input-only generator supplies two complete RGBA PNGs; pinned Pillow independently supplies exact bytes, decoded modes and pixels. All 3,408 prior matrix rows and 992 prior WebP canonical JSON rows remain unchanged. The whole matrix now contains 6,770 canonical JSON rows.

The private predictor histogram writer fills a borrowed buffer. Two local arrays retain trial and winning counts; swapping their mutable references avoids repeated 4 KiB copies. Exact tile and accumulated pixel counts also prove when both residual histograms contain only zeros. Their combined entropy is exactly zero under the existing fixed-point tables, and the prediction bias reduces to the same nonnegative rounding expression. The proof uses histograms after residual calculation and hidden-RGB cleanup. Mode order, strict tie order, complete transform/reference search, guards, errors and cancellation checkpoints remain unchanged. Only the predictor runtime module changes in this checkpoint.

All 500 active WebP parity rows pass: 266 decode and 234 encode rows, 968 public encode calls and zero panics. Five existing target-only fault contracts pass separately. Both intermediate variants retain all 168 alpha probe byte hashes and pixel matches. Seventy-two live-Pillow lossless calls match exact bytes, modes and pixels. The four new cases also pass through both public APIs in both the complete-search baseline and the optimized build, for sixteen calls.

The first buffer-only pilot reduces six public-call medians by 4.38–10.99%. The combined pilot reduces them by 4.01–31.55%; both pilots retain every sample. The final benchmark keeps all eleven previous controls and adds six method-six controls, including varied-color palette and zero-plane inputs. Both builds first match live Pillow in all seventeen controls. Across 204 ABBA samples and three cycles on the shared Apple M3 Pro ARM64 host, median changes range from -41.77% to +2.26%. No control exceeds the 3% regression review threshold in two cycles. The raw-alpha control improves by 16.40%, the ordinary lossless RGB-noise control by 10.74%, and the ordinary method-five RGBA control by 30.11%. Palette chains with sixteen and seventeen colors improve by 25.56% and 30.94%.

The original performance regression remains open. A separate twelve-sample paired comparison against the earlier incomplete-search implementation measures 0.292 ms versus 4.678 ms on the raw-alpha control, a 16.00x latency ratio. Both outputs match Pillow for this control; the older build fails other parity inputs. The final diagnostic profile still places predictor entropy and histogram clustering among the largest costs. The measured reduction validates this optimization, without establishing the broader performance objective.

Timing includes public encoding, output materialization and drop, with input reading and image construction outside the timed boundary. Uniform-RGB alpha controls measure alpha/overhead behavior and remain excluded from codec throughput ranking. No world ranking, full-codec speed ratio or x86 runtime speed claim follows from these ARM64 latency measurements.

Coverage MCP leaves three predictor gap groups, two encoder groups and eight backward-reference groups. LLVM observes all eight branch outcomes in spatial cost, including both zero-population conditions, and all twenty in the borrowed histogram writer. All ten selected predictor-helper instantiations have no missing branch outcomes. Unchanged WebP modules show no newly observed or lost outcomes against the prior selected report; the changed predictor is excluded from coordinate comparison. No guard or coverage total is removed. Importer source identity remains unverified and per-test attribution unknown; separate hashes bind 129 runtime/build files and fixture/test setup before and after validation. These selected observations do not establish a new full-suite percentage or 100% coverage. Selected report: .coverage-mcp/local-evidence/selected/20261101T185906.474877Z-4883ca79950248fd88a3458f89c57d95/coverage.json.

Strict default/all-feature/release/coverage Clippy, fixture/documentation guards, native WebP/all-feature contracts, WASM WebP Clippy/rustdoc, WASI all-feature Clippy and SSE2/AVX2 compile checks pass. No unit tests, unsafe code, dependencies, fault hooks, safety-check removals or coverage exclusions are added. Optional cancellation and neighboring predictor modes retain genuine absence meanings; the histogram helper continues to return Result.

Checkpoint: .coverage-mcp/local-evidence/parity/webp-crunch-cost-20261102/. It retains baseline and candidate identities, both pilots, canonical parity references, selected coverage, every final and legacy-control timing sample, profiles and validation receipts. The original slowdown, remaining parity and coverage gaps, and x86 runtime measurements remain unfinished. All changes remain local and uncommitted on develop in /Users/lazytrot/work/image-slash-star; no additional branch or worktree is used.

WebP method-six search and opaque alpha flag — 2026-11-02

Fourteen new input-driven parity rows cover method-six alpha ramps, palette boundaries, single-row and single-column inputs, modified-Zeng palette ordering, and opaque RGBA lossless headers. Five complete PNG sources come from the new input-only generator; pinned Pillow supplies all canonical expectations. Both ordinary and fresh-token public encoding must match exact bytes, decoded modes and pixels. All 3,394 prior matrix rows and 964 prior WebP canonical JSON rows remain unchanged. The whole matrix now contains 6,762 canonical JSON rows.

Method six at internal quality 100 now evaluates the native transform order, including palette-plus-spatial prediction and both palette orderings. Strict size comparisons retain the first winner on ties. Cached and uncached backward references compete independently, and the original palette cardinality selects the native box-chain configuration. Trial pixels, palette adjacency and token buffers reuse bounded scratch allocations. An existing RGBA scan also records actual transparency for the VP8L header; opaque storage no longer sets an alpha hint that changes Pillow's decoded mode. Lower-method alpha palette settings and the method-five palette-plus-spatial search remain separate unfinished work.

All 496 active WebP parity rows pass: 266 decode and 230 encode rows, 948 public encode calls and zero panics. Five existing target-only fault contracts pass separately. The 168-call alpha probe improves from 152 to 168 exact byte matches, with all pixel comparisons passing. A 36-input lossless probe matches bytes, modes and pixels through both public APIs, for 72 calls. Before the header fix, all 72 differed only in the opaque-alpha hint; that diagnostic observation did not alter canonical expectations. The independently built pinned native reference matches Pillow in twelve alpha and thirty-six lossless calls. Native traces identify eight inputs whose winning palette order is modified Zeng.

Coverage MCP reports two encoder gap groups, both at the bounded-palette cardinality check in the method-six wrapper. The selected run observes all 32 branch outcomes in modified-Zeng ordering and all 28 in each public writer instantiation. No guard or coverage total is removed. The predictor retains three gap groups and backward-reference selection retains eight. Unchanged WebP modules show no newly observed or lost outcomes against the prior selected report; the two changed modules are excluded from coordinate comparison. The importer still labels source identity unverified and per-test attribution unknown; separate hashes bind 129 runtime/build files and validation inputs. These selected observations do not establish a new full-suite percentage. Selected report: .coverage-mcp/local-evidence/selected/20261101T183246.230908Z-ebd4865f55d249d7b68fddc2e7a83961/coverage.json.

Performance remains unfinished. The unchanged eleven-control benchmark retains 132 ABBA samples across three cycles on the shared Apple M3 Pro ARM64 host. Both builds first match live Pillow in all controls. The method-six raw-alpha control regresses from 0.285 ms to 5.490 ms, a 19.25x latency ratio; all three cycles confirm the regression. The other ten median changes range from -1.39% to +1.22%, with none exceeding the 3% review threshold in two cycles. Sampling the complete public call places the largest costs in predictor entropy and histogram clustering during the expanded search. The profile is diagnostic, not a timing rank. Faithful search pruning and entropy/scratch optimization still need measurement; this checkpoint has not passed performance acceptance.

The timing boundary includes public encoding, output materialization and drop; input reading and image construction are outside it. Cases that fail the old build remain correctness evidence, outside paired performance comparisons. Uniform-RGB alpha controls measure alpha/overhead behavior and are excluded from codec throughput ranking. No world ranking or x86 runtime speed claim follows.

Strict default/all-feature/release/coverage Clippy, fixture/documentation guards, native WebP/all-feature contracts, WASM WebP Clippy/rustdoc, WASI all-feature Clippy and SSE2/AVX2 compile checks pass. No unit tests, unsafe code, dependencies, fault hooks, safety-check removals or coverage exclusions are added. Optional tokens, filters, metadata and unused search alternatives retain absence meanings; the optional earlier-method alpha path retains its complete checked fallback.

Work-in-progress checkpoint: .coverage-mcp/local-evidence/parity/webp-alpha-crunch-20261101/. It retains source and artifact identities, intermediate negative results, native traces, parity references, coverage reports, validation receipts and every timing sample. The broader coverage and performance goal remains active. All changes remain local and uncommitted on develop in /Users/lazytrot/work/image-slash-star; no additional branch or worktree is used.

WebP alpha entropy and exact prediction — 2026-11-01

Seventeen new input-driven parity rows cover method-dependent alpha entropy selection, a vertical ramp, discontinuous palettes with and without zero, transparent predictor row edges, and a single-row nonzero palette. Five new complete RGBA PNG sources extend the existing input-only generator. Pinned Pillow independently supplies encoded-byte and decoded-pixel references; ordinary and fresh-token public encoding must both match. All 3,377 prior matrix rows and 930 prior WebP canonical JSON rows remain unchanged. The whole matrix now contains 6,734 canonical JSON rows.

Internal ALPH images store the alpha plane in green with A/R/B zero. Their predictor must preserve that green data even though the internal alpha channel is zero. A private predictor configuration now carries this exactness choice; ordinary lossless encoding retains its existing transparent-RGB cleanup. Non-palette ALPH candidates share the complete VP8L writer while omitting the standalone frame header. A three-histogram alpha entropy analysis preserves native cost, hash, predictor bias and tie order without building four-channel histograms. Method-zero palettes also retain the native implicit final zero entry when there are more than seventeen colors. This fixes the corresponding ordinary lossless palette case as well. The pinned libwebp 1.6.0 sources are the alpha encoder, lossless encoder, alpha dispatch, predictor and palette ordering.

All 482 active WebP parity rows pass: 266 decode and 216 encode rows, 878 public encode calls and zero panics. Five existing target-only fault contracts pass separately. The source-bound 168-call alpha probe improves from 96 to 152 exact byte matches, with no previously exact result lost; all 168 pixel comparisons pass. Two further ordinary lossless method-zero calls become byte-exact. Sixteen ordinary-input method-six calls still differ in ALPH bytes and remain open parity failures. Complete native method-six transform/palette-order crunching and cache selection remain pending.

Coverage MCP leaves two gap groups in the native encoder, both in the existing Huffman writer. LLVM observes both arms of every branch in all sixteen selected alpha-helper function instantiations. The predictor retains three gap groups, including constant-generic alternatives; no guard or coverage total is removed. A same-source comparison before entropy-cost optimization shows ten newly observed outcomes and none lost after adding the four palette/predictor edge rows. Relative to the preceding accepted WebP selection, unchanged modules show one newly observed outcome and none lost. The three changed modules are excluded from that coordinate comparison. These are selected-lane observations, without per-test attribution or a new full-suite percentage or 100% claim. The importer still marks source identity unverified; separate local hashes bind 129 runtime/build files and the fixture/test setup before and after validation. Selected report: .coverage-mcp/local-evidence/selected/20261101T175729.088752Z-d79ca607efdd4f35b6791ea79d45dc69/coverage.json.

The first complete candidate caused a repeated 14.80% slowdown on the small method-six raw-alpha control. Profiling identified entropy cost evaluation in backward-reference selection. Bounded lookup tables replace repeated logarithms with the same rounded fixed-point values; the existing population streak walk now accumulates totals and evaluates repeated counts once. All 168 probe output hashes remain identical across these optimizations. The initial and intermediate measurements, including the regression, remain retained.

On the shared Apple M3 Pro ARM64 host, the final 132 ABBA samples across three cycles and eleven live-Pillow-gated, unchanged-output controls show median changes from -23.09% to +1.04%. No control exceeds the 3% regression review threshold in two cycles. The ordinary lossless RGB-noise, RGBA-predictor and method-five RGBA controls measure -7.51%, -23.09% and -18.03% respectively. Input reading and image construction remain outside timing; public encode, output materialization and drop are timed. Uniform-RGB alpha controls measure alpha/overhead behavior and are excluded from codec throughput ranking. Fixed cases that fail the baseline are excluded from timing comparisons. No world ranking or x86 runtime speed claim follows.

Strict default/all-feature/release/coverage Clippy, fixture/documentation guards, native WebP/all-feature contracts, WASM WebP Clippy/rustdoc, WASI all-feature Clippy and SSE2/AVX2 compile checks pass. x86 runtime execution remains unavailable on this host. No unit tests, unsafe code, dependencies, fault hooks, safety-check removals or coverage exclusions are added. The private optional non-palette result selects the complete checked palette fallback; optional filters, tokens and preceding rows retain documented absence meanings.

Checkpoint: .coverage-mcp/local-evidence/parity/webp-alpha-entropy-20261101/. The verified inventory retains the final source, earlier variants, live probes, canonical references, selected-report identities, validation receipts and all benchmark samples. Changes remain local on develop in /Users/lazytrot/work/image-slash-star.

WebP low-effort alpha parity — 2026-11-01

Eight new ordinary-input encode rows cover alpha palettes at the 16/17-color filter boundary, horizontal and combined ramps, and a deterministic noisy alpha plane at clipped 17x19 geometry. Their generator constructs five complete RGBA PNG inputs without consulting an encoder. Pinned Pillow independently generates exact encoded-byte and decoded-pixel references. The shared public runner checks ordinary and fresh-token encoding. All 3,369 prior matrix rows and 914 prior WebP canonical JSON rows remain unchanged; the current whole matrix has 6,700 canonical JSON rows.

The lossy caller previously discarded its selected method before encoding alpha. The correction carries the method through private helpers and applies libwebp's method-zero palette order and low-effort reference/hash-chain policy, method-dependent quality for methods zero through three, and the FAST filter candidate policy. Methods zero through three skip the unfiltered trial when the estimated filter is non-NONE and there are at most 192 alpha values. NONE-first ties remain stable whenever both candidates are tried. The pinned primary sources are libwebp 1.6.0's alpha encoder and lossless encoder. Only two runtime modules change relative to the preceding method-two checkpoint. The existing default/high-effort single-configuration alpha settings remain pending complete entropy/transform and cruncher parity.

All 465 active WebP parity rows pass: 266 decode and 199 encode rows, 793 public encode calls and zero panics. Five existing target-only fault contracts pass separately. A source-bound live probe across six alpha distributions, all seven methods, qualities zero/eighty and both public encode entry points improves from 80/168 to 96/168 exact byte matches, with no previously exact call lost. All 168 decoded pixel comparisons pass. The 16 newly exact calls use method zero. The remaining 72 ordinary-input failures differ only in ALPH; they remain open parity failures and are never counted as fault-contract successes.

Coverage MCP reports two remaining branch-gap groups in the native encoder, both in the existing Huffman writer. LLVM observations cover both arms of every branch in all nine alpha-helper function instantiations. Unchanged WebP modules show 0 newly observed and 0 previously observed outcomes absent relative to the preceding complete WebP selection. Changed modules are excluded from coordinate comparisons. This is selected-lane evidence; no new full-suite percentage, managed aggregate gain or 100% claim follows. The importer labels source identity unverified and test attribution unknown; separate local hashes bind 129 runtime/build files and the fixtures/test setup before and after. Selected report: .coverage-mcp/local-evidence/selected/20261101T170626.125051Z-447babf52aab4da69eef68e94c940192/coverage.json.

On the shared Apple M3 Pro ARM64 host, 96 ABBA samples across three cycles and eight unchanged-output, live-Pillow-gated controls show median changes from -41.91% to +1.33%. No control exceeds the 3% regression review threshold in two cycles. Input reading and image construction remain outside timing; public encode, output materialization and drop are timed. Uniform-RGB alpha controls measure bounded alpha/overhead behavior and are excluded from codec throughput ranking. Fixed method-zero cases fail the baseline and are excluded from timing comparisons. A candidate that expanded histogram work and raised high-effort quality was rejected after repeated default/high-effort regressions; an independently rejected cache-cap change lost twenty previously exact calls. Both experiments and their failures remain retained. No world-ranking or x86 runtime speed claim is made.

Strict default/all-feature/release/coverage Clippy, fixture/documentation guards, native WebP/all-feature contracts, WASM WebP Clippy/rustdoc, WASI all-feature Clippy and SSE2/AVX2 compile checks pass. x86 runtime execution remains unavailable on this host. No unit tests, unsafe code, dependencies, new fault hooks, safety-check removals or coverage exclusions are added. The new private Option categories mean an absent filter or a deliberately omitted filter candidate; fallible work continues to return Result with its existing failure cause.

Retained checkpoint: .coverage-mcp/local-evidence/parity/webp-low-effort-alpha-20261101/. It binds sources, inputs, references, binaries, commands, coverage observations, rejected experiments and timing receipts. All changes remain local on develop in /Users/lazytrot/work/image-slash-star. The complete alpha parity, 100% coverage and fastest encoder/decoder goals remain unfinished.

WebP method-two encoder parity — 2026-11-01

Six new ordinary-input encode rows cover neutral 16x16, clipped neutral 17x19 and sparse 64x64 RGB sources at qualities zero and eighty. Their PNG generator constructs only input samples and complete stored-DEFLATE files; pinned Pillow independently generates exact encoded-byte and decoded-pixel references. Both ordinary and fresh-token public encode paths match. All 6,672 prior canonical JSON rows and 3,363 prior matrix rows remain unchanged.

The inputs exposed two implementation errors: method two incorrectly used rate-distortion mode selection, and its single-segment statistics path finalized skip probabilities when libwebp retains defaults. The correction uses prediction distortion, fixed I4/I16/chroma mode penalties, the flat-border I16 rule and the macroblock header limit. Existing methods keep their original scoring work. The version-matched sources are libwebp 1.6.0's mode refinement and statistics pass. Only four WebP runtime modules change relative to the preceding accepted monochrome-canvas checkpoint. No unit tests, unsafe code, dependencies, fault hooks, safety-check removals or coverage exclusions are added.

All 457 active WebP parity rows pass: 266 decode and 191 encode rows, 753 public encode calls and zero panics. Five existing target-only fault contracts pass separately. Thirty-two additional live comparisons on thin horizontal/vertical, textured and interior-flat RGB inputs also match pinned Pillow at qualities zero, forty, eighty and one hundred. Measured sources, fixtures and test setup remain unchanged during the final complete WebP selection.

Coverage MCP confirms that both token-aware skip-signaling true arms now execute. The ordinary path already observed these source branches in the prior full report: unchanged-source globally merged outcomes show zero new outcomes and 24 full-suite observations absent from this narrower WebP selection. This is path-specific evidence, not a managed aggregate gain or a new full-suite percentage. The shared I4 selection has zero missing branch groups in this selection; rejected specialization variants and their constant-branch gaps are retained separately. Current selected report: .coverage-mcp/local-evidence/selected/20261101T163848.787996Z-5f51d9245caf4bf4a83fda6abf3a1035/coverage.json.

On a shared Apple M3 Pro ARM64 host, 144 ABBA samples across three cycles and twelve byte-parity-backed controls give median latency changes from -4.05% to +0.85%. No control exceeds the 3% regression review threshold in two cycles. Inputs and construction stay outside timing; each public encode call, output materialization and drop are timed. Uniform controls are correctness/overhead checks and are not throughput-ranking evidence. The baseline fails the new method-two cases, so those cases are excluded from performance comparisons. Earlier candidates with small consistent legacy-method slowdowns or a repeated method-six regression were rejected and retained. No world-ranking or x86 speed claim follows from these ARM64 measurements.

Strict default/all-feature/release/coverage Clippy, fixture/documentation guards, native WebP/all-feature contracts, WASM WebP Clippy/rustdoc, WASI all-feature Clippy and SSE2/AVX2 compile checks pass. x86 runtime execution remains unavailable on this host. Ordinary RGBA method-two probes still differ in their ALPH chunks at qualities zero/eighty, while their VP8/VP8X chunks and decoded pixels match; these are retained open parity failures, never fault-contract passes.

Retained checkpoint: .coverage-mcp/local-evidence/parity/webp-method-two-parity-20261101/. Its manifest binds sources, inputs, references, binaries, failures, commands, coverage observations and timing receipts. The full 100% coverage and fastest encoder/decoder goals remain open.

AVIF monochrome canvas allocation — 2026-11-01

The shared block walker now leaves normatively absent monochrome chroma planes and their coverage masks unallocated. It retains the coded/visible geometry, fallible luma allocation, overlap checks, completeness validation and all existing profile/tool limits. Color canvas callers explicitly retain all three planes. Only entropy.rs, frame.rs and raster.rs change among 129 runtime/build files; no unit tests, fault hooks, dependencies, unsafe Rust, safety-check removals or coverage exclusions are introduced.

An independent external malloc/calloc/realloc observer measures 4–24 fewer allocation events and 4,352–417,792 fewer requested bytes per complete public decode call across seven monochrome workloads. Three color controls have identical allocation traffic. A padded 256x256 monochrome tile omits 69,632 requested bytes and four allocation events. Slopes across 100/200 iterations cancel fixed setup and warmups. These are requested allocation traffic counts, not peak/live/RSS memory; instrumented timings are excluded from latency results.

Both source-bound release binaries match every live pinned Pillow frame on ten declared timing inputs. Across 120 ABBA samples in three cycles on a shared Apple M3 Pro ARM64 host, median changes range from -1.88% to +0.81%; none triggers the repeated 3% regression review threshold. The 12-bit 256x256 mixed sequence improves in all three cycles, with a 1.88% lower overall median. The partial-edge counterpart improves 1.04% overall with mixed cycle results. Other modes, native x86/SIMD speed and world ranking are not inferred.

All 978 active AVIF parity rows pass: 973 decode and five encode rejection rows, six public encode calls and zero panics. Measured sources, fixtures and setup remain unchanged during execution. The new constructor branch is observed both ways. Unique branch outcomes in unchanged AVIF modules have no additions or losses; changed entropy/frame/raster coordinates are excluded from that comparison. Coverage MCP CLI queries retain the remaining gaps. Four existing malformed track-container cases fail in the earlier sample parser, before the inspector's repeated guards; those guards remain counted. Imports remain source-unverified with unknown test attribution, with separate local hashes binding measured files. This is selected evidence, not a full aggregate, managed numeric coverage gain or 100% claim.

Strict stable/default/all-feature/release/nightly-coverage Clippy, native AVIF/all-feature contracts, WASM Clippy/rustdoc, WASI Clippy and SSE2/AVX2 compile checks pass. Fixture/docs/whitespace checks and the source-unit-test guard pass. Sources, before/after release binaries, active AVIF inputs and references, raw resource/timing observations, selected reports and validation receipts are retained locally under .coverage-mcp/local-evidence/parity/avif-monochrome-canvas-20261101/.

AVIF monochrome multi-superblock parity — 2026-11-01

Twenty-one complete monochrome sequences add 8/10/12-bit parity across 256x256 frames and 132x128, 128x132, 252x256 and 256x252 partial-edge frames. The six previously unsupported high-depth inputs are reused byte for byte. Every new complete input returns Unsupported before this change and matches all live pinned Pillow frames afterward. Repeated native encodes reproduce both planar source and complete-input pins; construction reads no expected pixels and executes no Rust.

The neutral single-tile lossy profile now admits frame axes through 256 pixels. It uses the existing checked multi-superblock walker, dynamic tile state and frame canvas; block/transform extents remain independently bounded. Grain, active post-filter and multi-tile admission retain their 128-pixel limits. The shared base helper takes the explicit dimension limit, preserving its other geometry, quantization, filter and tool checks. Existing block and safety checks remain; no unit tests, fault hooks or coverage exclusions are introduced. Only entropy.rs changes among 129 runtime/build files.

All 978 active AVIF parity rows pass: 973 decode rows and five encode rejection rows, with six public encode calls and zero panics. All 6,630 preceding canonical reference rows preserve their public outcomes; only 257 loop-index receipt digests change when appending the new observations. There are now 6,672 canonical input/output rows, 303 native loop cases and 278 validated sequence references.

The selected native LLVM comparison observes no additional or missing unique branch outcomes in unchanged AVIF modules. Changed entropy.rs is excluded from that coordinate comparison; duplicate generic observations are merged by OR. These cases expand the supported public input space; they are not claimed as an unchanged-source numeric coverage gain. Coverage MCP CLI queries retain the remaining entropy, reconstruction, raster and frame gaps. Imports remain source-unverified with unknown test attribution, and separate local hashes bind the measured sources, fixtures and setup. This is selected evidence, not a full aggregate, managed incremental gain or 100% claim.

Ten previously supported workloads match live Pillow before timing. Across 120 ABBA measurements in three cycles, median latency changes range from -0.85% to +1.27%; none triggers the repeated 3% regression review threshold. The newly supported inputs are excluded from equivalent-work timing because the baseline rejects them. These shared Apple M3 Pro ARM64 measurements are a latency guard, not evidence of a speedup or a world ranking.

Strict stable/default/all-feature/release/nightly-coverage Clippy, native AVIF-only and all-feature contract tests, strict WASM Clippy/rustdoc, WASI Clippy and SSE2/AVX2 compile checks pass. Native x86 execution and speed are not inferred from cross-compilation. Complete sources, before/after public outcomes, selected reports and validation receipts are retained locally under .coverage-mcp/local-evidence/parity/avif-monochrome-wide-20261101/.

AVIF wide color OBMC parity — 2026-11-01

Thirty complete 256x256 sequences add gray and colored 8-bit I420/I422 controls and fractional-sample 10/12-bit I420/I422/I444 controls. The sinusoid, checker and localized-change recipes vary transform selection and retained frames. Repeated pinned Pillow/native encodes reproduce every complete input. The input-only generator reads no expected pixels and executes no Rust.

Three 12-bit checker sequences exposed incorrect pixels in presented frame 3. The mismatch was already present in reconstructed YUV. Native scalar/NEON outputs agreed, and parsed motion vectors and references matched. The wide color path parsed OBMC but replaced its context with None. Passing the parsed context to the existing subsampling-aware predictor fixes all three complete-file regressions. Every frame now matches live pinned Pillow exactly. The other 128 runtime/build source files are unchanged; diagnostic edits are restored. No guards, unit tests, fault hooks or coverage exclusions are added.

All 957 active AVIF parity rows pass: 952 decode rows and five encode rejection rows, with six public encode calls and zero panics. All 6,570 preceding canonical reference rows preserve their public outcomes; only 227 loop-index receipt digests change when appending the independent native observations. There are now 6,630 canonical input/output rows and 282 native loop cases. At this checkpoint, six exploratory 256x256 high-depth monochrome inputs returned Unsupported despite successful Pillow decoding. The later monochrome multi-superblock checkpoint above resolves these exact inputs.

The selected native LLVM report observes eight additional unique branch outcomes in unchanged block.rs, with no prior outcome missing in unchanged AVIF modules. The coordinate comparison excludes changed entropy.rs and merges duplicate generic observations by OR. Coverage MCP CLI gap queries are retained for entropy, reconstruction and motion compensation. Imports remain source-unverified with unknown test attribution; separate local source hashes bind the executed campaign. This is selected evidence, not a refreshed full aggregate, managed incremental gain or 100% claim.

Strict stable/default/all-feature/release/nightly-coverage Clippy and SSE2/AVX2 compile checks pass. AVIF-only and all-feature native contract tests, strict AVIF/all-feature WASM Clippy and rustdoc, and all-target/all-feature WASI Clippy pass. Compile checks establish no native x86 runtime or speed result. A latency guard runs nine previously correct public workloads with 108 ABBA samples over three cycles on Apple M3 Pro ARM64. Both binaries match live Pillow for each timed workload. Median changes range from -0.06% to +2.24%; none triggers the predeclared repeated 3% regression rule. Incorrect pre-fix inputs are excluded from equivalent-work timings. These shared-host controls do not establish a universal performance bound or an optimization gain. The source-bound probes, failed diagnostic attempts, complete inputs, exact frames, source snapshots, selected reports and validation receipts are retained locally under .coverage-mcp/local-evidence/parity/avif-wide-obmc-20261101/.

AVIF short reference signaling — 2026-11-01

Twenty-four complete 64x64 I444 sequences add public lossless/lossy parity for short reference signaling. Two-frame cases cover aliased and distinct slots, tied order hints, the seven-bit half-range boundary and wraparound. Three-frame cases retain different key/inter images and reorder their hints. The input generator preserves every tile byte, sample extent and file length; it never consults expected pixels. Each pinned source encode is repeated.

All 927 active AVIF parity rows pass: 922 decode rows and five encode rejection rows, with six public encode calls and zero panics. Live pinned Pillow supplies all new frame pixels; repeated native libavif observations supply loop counts. All 6,522 preceding canonical reference rows preserve their public outcomes. Only 203 existing loop-index receipts change when the 24 native observations are appended. There are now 6,570 canonical input/output rows.

The selected native LLVM report observes 39 additional unique AVIF branch outcomes against the preceding 903-row selection: 24 in frame.rs, 13 in entropy.rs and two in block.rs. Runtime/build source hashes match across all 129 files, LLVM schemas and static outcome keys match, and duplicate generic observations are merged with OR. No previously observed AVIF outcome is absent. Coverage MCP identified the short-reference gap and retains the follow-up queries; imports remain source-unverified with unknown test attribution. This is selected evidence, not a refreshed full aggregate or 100%.

Strict stable/default/all-feature/release/nightly-coverage Clippy, fixture and documentation checks, and the source-unit-test guard pass. All 8,853 measured source, fixture and setup hashes remain stable during coverage. Subsequent cleanup removes trailing spaces on 25 already-dirty manifest description lines; the measured manifest is retained and parsed YAML equality is verified. Current receipt/count updates retain historical coverage evidence. Matching runtime hashes reuse the preceding SSE2/AVX2 compile, AVIF feature and WASM checks; this fixture addition makes no new performance or native x86 claim. There are no new unit tests, Rust source changes, fault hooks or exclusions.

Evidence is retained in .coverage-mcp/local-evidence/parity/avif-short-reference-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T142647.085234Z-fb13a823232b4cfabd8871fe97a93215/coverage.json.

AVIF equiprobable entropy refill — 2026-11-01

The private range decoder now keeps window refill out of the equiprobable-bit reader's hot path. General symbol readers retain their original refill policy. A const parameter selects the policy at compilation; range arithmetic, CDF updates, overread checks, cancellation, error behavior and coverage observers are preserved. The native release equiprobable reader shrinks from 63 to 29 instructions. General symbol code has identical relocation-normalized instructions; its placement and latency are still checked independently. Untimed native sampling observes the changed reader and outlined refill.

Both source-bound release binaries match live pinned Pillow pixels, dimensions, modes and frame counts on nine declared public still/sequence workloads. Three ABBA cycles pass the initial and five-times-longer confirmation cohorts, with 108 process samples each. In the longer cohort, three grain workloads show 3.05%–3.25% lower latency and lossless monochrome shows 4.41% lower latency than the preceding Rust decoder. The other controls span 2.89% lower to 0.60% higher latency. No control exceeds the declared 3% overall plus two-of-three- cycle regression rule. These are shared-host Apple M3 Pro observations, not native x86 performance, a SIMD acceleration ratio or a world ranking.

Four earlier candidates are rejected and retained with their exact source, binaries, plans, live parity gates and 432 timing samples. The broad refill outline regressed wide lossy animation by 5.43%; restricting the policy to equiprobable bits passes that control. No rejected CDF arithmetic remains.

All 903 active AVIF parity rows pass: 898 decode rows and five encode rejection rows, with six public encode calls and zero panics. Strict stable/default/ all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile checks, 68 AVIF feature contracts, AVIF-only WASM Clippy/rustdoc and fixture/documentation checks pass. All 8,293 measured source, fixture and setup hashes stay unchanged during the coverage run. Only src/codecs/avif/av1/entropy.rs differs among the 129 runtime/build files from the preceding grain checkpoint. There are no new parity rows, codec unit tests, fault hooks, dependencies, unsafe code, coverage exclusions or Option categories.

Retained evidence is in .coverage-mcp/local-evidence/parity/avif-range-refill-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T135603.559569Z-b04775a09fe441d799923389e4ed451d/coverage.json. Coverage MCP CLI queries retain the remaining entropy gaps. Imports remain source-unverified with unknown test attribution; local hashes provide separate provenance. This selected run does not refresh the full aggregate or establish 100% coverage. Work remains uncommitted on develop in the single checkout at /Users/lazytrot/work/image-slash-star; the broader goal remains open.

AVIF film-grain depth and inactive-plane parity — 2026-11-01

Thirty-four new complete 64×64 AVIF manifest inputs cover 10/12-bit monochrome, I420, I422 and I444 film-grain displays, overlap with restricted clipping, and 8/10/12-bit U-only, V-only and zero-active-point controls. Deterministic full-range Y4M sources include saturated endpoints and fractional scaling indices. Repeated pinned native encodes are byte-stable; all header rewrites preserve their lossless tile bytes and sample/file extents. Every input matches live pinned Pillow pixels through the public Rust decoder. All 6,454 preceding JSON reference rows across 32 documents remain unchanged.

The selected campaign passes all 898 active AVIF decode parity rows, with 8,293 source, fixture and setup hashes unchanged across execution. Strict stable/default/all-feature/release/nightly-coverage Clippy, fixture and documentation checks, and the source unit-test guard pass. The new generator has an encoder-free read-only check; the existing color-grain writer now accepts valid chroma-only updates and accurately labels checked inputs. All 129 runtime/build hashes match the preceding JPEG FDCT checkpoint, so its matching-source SSE2/AVX2 compile checks and performance evidence remain reusable. No runtime arithmetic, dispatch, dependencies, unsafe code, codec unit tests, fault hooks, coverage exclusions or Option categories changed.

A local LLVM review identifies 21 AV1 branch outcomes absent from the preceding full native baseline: sixteen in grain synthesis and five in entropy admission. Both files retain identical source hashes and static branch identities. Selected grain coverage is 174/224 branches (77.6786%), versus 159/224 (70.9821%) in the preceding full baseline. One previously observed grain outcome and 223 entropy outcomes are absent from this narrower selection; these are not established regressions. This comparison is not an updated full aggregate or a managed incremental coverage claim. Defensive checks and the remaining gaps stay in the denominator.

Retained source, complete inputs, oracle outputs, byte-stability and tile receipts, actual Coverage MCP CLI queries, and acceptance logs are in .coverage-mcp/local-evidence/parity/avif-high-depth-grain-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T131048.532671Z-3a6057d0b01044b8afc7b23987d363c4/coverage.json. Coverage MCP imports remain source-unverified and test attribution unknown, with summary/detail reconciliation limits; source hashes provide separate local provenance. The runtime is unchanged, so no new speed claim or native x86 runtime result is inferred. Work remains local and uncommitted on develop in /Users/lazytrot/work/image-slash-star, with one registered checkout. The broader coverage and performance goal remains open.

JPEG FDCT constant-vector broadcasts — 2026-11-01

The private SIMD vector trait now const-evaluates complete fixed broadcasts. FDCT arithmetic, scaling, rounding, layouts, and dispatch are preserved. Both native release four-block kernels contain zero memory-fill call sites, down from forty each; untimed native sampling observes the affected FDCT in both binaries. Fixed vector construction remains safe Rust.

Twelve new ordinary public encode parity cases cover minimum/maximum samples, saturated checkerboards and stripes, aligned block batches and tails, all three grayscale/RGB/CMYK modes, baseline Q100, and progressive Q1. Both release binaries and live pinned Pillow produce identical bytes for all twelve. All 6,430 preceding JSON reference rows across 32 documents remain unchanged. The affected selection passes 715 JPEG parity rows (570 decode, 145 encode), including 699 public encode calls with zero panics, plus thirteen existing target-only fault contracts counted separately.

All fifteen predeclared full-encode workloads pass baseline/candidate/live Pillow byte gates and the unchanged 3% overall plus two-of-three-cycle regression review rule. Their 180 ABBA samples span RGB 4:4:4/4:2:2/4:2:0, 128/512-pixel square inputs, baseline/progressive, quality endpoints, optimized/restart, grayscale, CMYK, and small-image controls. Observed latency is 6.82%–51.63% lower than the preceding Rust implementation. These are local shared-host Apple M3 Pro observations; native x86 performance and a world ranking remain unmeasured.

Formatting, strict stable/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile checks, JPEG-only WebAssembly Clippy/rustdoc, and all 68 JPEG-feature integration contracts pass. Source receipts bind the same 129 runtime/build files. Fixture/documentation checks and the source unit-test guard pass. No codec unit tests, fault hooks, dependencies, unsafe code, coverage exclusions, or Option categories were added. The defensive default descale arm remains visible and unexecuted in the selected coverage report.

Complete inputs, outputs, binaries, source snapshots, rejected preparation attempts, profiles, disassembly, commands, timing samples, and Coverage MCP CLI queries are retained in .coverage-mcp/local-evidence/parity/jpeg-fdct-const-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T124941.097512Z-7b83de8eec4249999654a67cdb1725e2/coverage.json. Imports remain source-unverified and test attribution unknown, with summary/detail reconciliation limits. The full baseline below predates this encoder change; no updated full aggregate, incremental gain, or per-file 100% claim is inferred. Work remains local, uncommitted and unpushed on develop in /Users/lazytrot/work/image-slash-star, with one registered checkout. The broader coverage and performance goal remains open.

Full native baseline after JPEG dequantization — 2026-11-01

The full native campaign passes all 139 checks in six executables (4, 1, 57, 7, 1, and 69). All 8,195 source, fixture, and test-setup hashes remain unchanged across execution. Native LLVM reports 100,033/141,130 lines (70.8800%), 20,056/31,738 branches (63.1924%), 5,580/9,083 functions (61.4334%), and 152,576/218,929 regions (69.6920%). Release floors pass without exclusions.

This is the local pre-FDCT-constant optimization baseline, based on develop 69a79d4c4 with uncommitted changes. It does not extend to later source or new fixtures and does not replace the historical managed claim ledger. Coverage MCP CLI imports remain source-unverified and test attribution unknown. Source snapshots and before/after hashes supply separate local provenance; function-group gaps are not unique LLVM branch totals.

The largest missing branch totals remain in AV1 entropy and block reconstruction. The retained full report and actual CLI query commands are in .coverage-mcp/local-evidence/full/20261101-dequant-final/.

JPEG signed-word dequantization and IDCT parity — 2026-11-01

Native JPEG reconstruction now retains low signed-word dequantized products and the upstream butterfly's signed-word pre-additions. Sequential DC storage narrows to the signed 16-bit JCOEF boundary while the predictor retains full precision. Complete const evaluation of SIMD broadcasts avoids release memory-fill calls; fixed eight-element transforms avoid out-of-line array mapping. The final kernel uses the complete native-word arithmetic throughout, without the experimental bounded-column admission or a new fallback category.

Fifty-eight complete grayscale JPEG manifest inputs cover 35 preceding-target pixel bugs and 23 preserved controls. They include sequential and progressive scans, 8×8 and partial 17×9 blocks, positive and negative coefficients, wide quantizers, both horizontal halves, and dense coefficient patterns. All 528 exploratory inputs now match pinned Pillow: 226 previously mismatched and 302 were already exact. All 99 preceding public probes were rerun successfully. Official instrumented libjpeg-turbo 3.1.4.1 independently reproduces all 528 Pillow outputs; every native C command exits zero. These diagnostics are not additional canonical parity rows. All 6,314 preceding JSON reference rows across 32 documents remain unchanged.

The final affected selection passes 703 JPEG parity rows (570 decode and 133 encode), including 639 public encode calls with zero panics, plus thirteen existing target-only fault contracts reported separately. Formatting, strict stable/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile checks, JPEG-only WebAssembly Clippy and rustdoc, and all 68 JPEG-feature integration contracts pass. Source receipts bind the same 129 runtime/build files. Fixture/documentation checks and the source unit-test guard pass. No codec unit tests, fault hooks, dependencies, unsafe code, source exclusions, or Option categories were added. The existing checked-dequantization admission and its complete checked fallback remain visible.

All failed arithmetic and code-generation experiments and their measurements remain retained. The first final-kernel short campaign triggered review at 6.43% higher latency on one progressive RGB control while cycles varied and background workloads were active. The follow-up repeats every one of the ten exact baseline/candidate/live-Pillow controls with the same binary and input identities and fivefold samples. Every control clears the unchanged 3% overall plus two-of-three-cycle rule. Observed latency ranges from 1.28% higher to 0.66% lower; the DC-only control is 0.19% higher. Both campaigns remain bound to the review. These shared-host Apple M3 Pro observations establish neither zero overhead nor native x86 speed or a world ranking.

Coverage MCP CLI branch queries and their selected report are retained. Imports remain source-unverified and test-attribution unknown, with summary/detail reconciliation limits. Static arithmetic review is not execution coverage. No full-repository refresh, per-file 100% claim, or incremental aggregate gain is inferred.

Retained evidence is in .coverage-mcp/local-evidence/parity/jpeg-dequant-width-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T121938.974472Z-a03c2a3184144f7c8a2dbec9d5a26d93/coverage.json. All work remains local, uncommitted and unpushed on develop in /Users/lazytrot/work/image-slash-star. No new branch or worktree was created. The broader coverage and performance goal remains open.

Empty progressive JPEG scans with declared restart intervals — 2026-11-01

Empty progressive scans now reach the existing padded-bit reader even when a restart interval is declared. Previously an empty DC scan before a comment marker was dropped, preserving coefficients that pinned Pillow replaces. The nonempty restart-segment extractor and defensive empty-list check remain. The optional extracted-segment value describes the absence of extraction; its alternate path is the complete existing reader. No fallible operation was changed to return Option.

Twenty complete 17×9 grayscale manifest inputs cover positive and negative coefficients, DC and AC scans, intervals 1 and 65,535, absent DRI, and following comment, scan, and EOI markers. Four reproduce incorrect preceding-target pixels; sixteen are preserved controls. All twenty now match live pinned Pillow, and all 79 preceding public probes were rerun successfully. The native official libjpeg-turbo diagnostic also reproduces all twenty Pillow outputs; its warning exit status is 2, recorded separately from canonical parity. All 6,274 preceding JSON reference rows across 32 documents remain unchanged.

The affected selection passes 645 JPEG parity rows (512 decode, 133 encode), including 639 public encode calls with zero panics, plus thirteen existing target-only fault contracts reported separately. Formatting and strict stable/default/all-feature/release/nightly-coverage Clippy pass. SSE2/AVX2 Clippy compile checks, JPEG-only WebAssembly Clippy and rustdoc, and all 68 JPEG-feature integration contracts pass. The receipts bind the same 129 runtime/build source hashes. Fixture/documentation checks and the source unit test guard pass; no codec unit tests, fault hooks, dependencies, unsafe code, or source exclusions were added.

Eight exact baseline/candidate/live-Pillow full-decode controls clear the unchanged 3% overall plus two-of-three-cycle regression review rule. They include ordinary progressive images with actual restart markers. Observed latency ranges from 0.46% higher to 10.57% lower; paired cycles vary, and the DC-only control is 0.38% higher. These local Apple M3 Pro observations establish neither zero overhead nor a native x86 or world-speed result.

Coverage MCP CLI branch queries retain no missing IDCT function groups and three progressive groups. The empty-scan investigation found real parity bugs, while the defensive empty-segment-list observation remains uncovered. A parser-invariant review explains why that state appears unreachable after the fix. The zero-denominator and checked-dequantization guards also remain visible. Imports are source-unverified, test attribution is unknown, and summary/detail reconciliation limits apply. No full-repository coverage refresh, per-file 100% claim, or incremental aggregate gain is inferred.

Retained evidence is in .coverage-mcp/local-evidence/parity/jpeg-empty-progressive-scans-20261101/. The selected report is .coverage-mcp/local-evidence/selected/20261101T112711.504752Z-7c5199cace634205ae08c7fae2e8f5f2/coverage.json. All work remains local, uncommitted and unpushed on develop in /Users/lazytrot/work/image-slash-star. No new branch or worktree was created. The broader coverage and performance goal remains open.

Progressive JPEG partial smoothing and general workspace boundary — 2026-11-01

The decoder now follows the precision of the first AC bands when estimating unknown zero coefficients. Accurate zeros and received nonzero coefficients are preserved; positive precision limits the prediction magnitude. DC-only interpolation retains any coefficients received in higher bands and follows upstream's current-iMCU row selection, including padded neighbors at a partial final MCU. Unknown DC or a zero first-ten quantizer disables optional smoothing. Missing tables still reach the existing checked reconstruction error.

The diagnostic smoothing phase matched all 60 retained upstream coefficient inputs but still differed on twelve final images. The next observed boundary was the general first-pass workspace: upstream stored -4629 where the preceding target retained 60907. The native general transform now narrows that workspace with NEON truncation or SSE2/AVX2 signed saturation. The existing zero-vertical-AC correction remains. This is a correction of the observed boundary, not a claim that every arithmetic state or target has been exhaustively verified.

Thirty-one new complete-input manifest cases cover 27 actual pixel regressions and four nearby controls. All 79 public probes match pinned Pillow: the 60 coefficient probes now all pass, eighteen smoothing/scan controls pass, and a complete AC-only file with no DC scan exercises disabled smoothing. All 52 previously matching probes remain exact. The twelve mismatches from the preceding checkpoint are resolved. Existing 6,212 JSON reference rows across 32 documents remain unchanged; all 6,272 rows present before the final AC-only addition also remain unchanged. No codec unit tests, fault hooks, dependencies, unsafe code, or coverage exclusions were introduced.

The final affected selection passes 625 JPEG parity rows (492 decode and 133 encode), including 639 public encode calls with zero panics, plus thirteen existing target-only fault contracts reported separately. Strict formatting, default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, and all 68 JPEG-feature integration contracts pass. These receipts share 129 runtime/build source hashes; fixture integrity, documentation, and the source-unit-test guard pass.

Every timed full decode first matched baseline/candidate/live pinned Pillow pixels. Initial width-correct candidates regressed progressive RGB controls; outlining alone and a packed-workspace experiment were rejected. Contiguous natural-order coefficient reconstruction and short-circuit sparsity checks recovered the common-path cost. A separate DC-only control caught a 22.14% regression. Inlining neighbor lookup reduced it to 6.91%; avoiding copies of known-zero AC storage and narrowing only newly synthesized coefficients reduced the final observed cost to 2.72%. Every trial remains retained.

The final ordinary-production-link A-B-B-A campaign clears the unchanged 3% overall plus two-of-three-cycle review rule on eleven exact-output controls. Progressive RGB 4:4:4 latency is 5.44% lower locally; the other ordinary-image controls range from 0.71% higher to 2.49% lower. Some paired cycles vary in sign. The DC-only cost remains explicit. These Apple M3 Pro results establish neither zero overhead, native x86 speed, nor a world ranking.

Coverage MCP CLI branch queries on the final selected report list no missing IDCT observations and three progressive function groups. The AC-only input closes the unknown-DC observation. Remaining observations concern empty entropy segment lists, a zero smoothing denominator, and the checked dequantization fallback and its caller. The empty-segment path needs complete-input investigation; the arithmetic guards remain visible with a static reachability review. Imports remain source-unverified and test-attribution unknown, with summary/detail reconciliation limits. No fresh full-repository total, per-file 100% claim, or aggregate incremental coverage gain is inferred.

Retained evidence is in .coverage-mcp/local-evidence/parity/jpeg-partial-smoothing-20261101/. The final selected report is .coverage-mcp/local-evidence/selected/20261101T110957.120180Z-f5066647d1754d289bcebccc9907b245/coverage.json. The preceding immutable checkpoint's 764 files were reverified before reusing its official libjpeg-turbo 3.1.4.1 source, native trace executable, and pinned Pillow reproduction. Diagnostic phases retain their distinct source identities. All changes remain local, uncommitted and unpushed on develop in /Users/lazytrot/work/image-slash-star; no new branch or worktree was created. Native SSE2/AVX2 execution, complete coverage, and the broader speed goal remain open.

JPEG zero-vertical-AC workspace boundary — 2026-11-01

This preceding checkpoint is retained below; the partial-smoothing section above records the subsequent correction of its twelve remaining probes.

The native IDCT now preserves the signed 16-bit workspace of upstream's zero-vertical-AC shortcut when its first-pass result overflows that width. The common transform first checks the scaled DC range; the bitmap check and workspace correction are outlined. Neon admits four columns at a time; SSE2 and AVX2 require zero vertical AC across all eight. Raw coefficients select the shortcut, so a zero quantizer cannot change admission. No general transform, defensive fallback, dependency, feature, or unsafe policy changed.

An instrumented build from the official libjpeg-turbo 3.1.4.1 source archive reproduces default pinned Pillow 12.2.0 on all 60 retained complete coefficient probes. Bounded traces show the first storage difference for coefficient 8192 and quantizer one: upstream stores -32768 after its word-sized shift, while the preceding target stores 32768. Feeding the observed reference coefficient block to the preceding transform reproduces the public target's wrong pixels. The Neon shortcut and SSE2 shortcut are retained with the original archive, trace patch, executable, and hashes. Only initialized workspace cells are traced; no tracing enters production.

The correction fixes 29 probe mismatches and preserves all 19 previously matching files. Twelve multi-block first-scan files remained mismatched at that checkpoint. Their reference traces insert partial-smoothing coefficients that the current decoder omits: for example, natural-order positions 2, 8, and 16 become 352, 6880, and -1920. The current smoothing path handles DC-only scans, while upstream also estimates zero coefficients whose precision is incomplete. Precision-aware partial smoothing and the general transform's intermediate widths were the next work. The current section above resolves these files; they were not counted as passing parity in the preceding checkpoint.

Forty-two new input-only manifest cases add the 29 regressions and thirteen nearby controls; six earlier coefficient guards are reused. Selected execution passes all 594 JPEG parity rows (461 decode and 133 encode), including 639 public encode calls and zero panics, plus thirteen existing target-only fault contracts reported separately. All 6,128 prior reference rows remain unchanged. No codec unit tests, fault hooks, or coverage exclusions were added.

Strict formatting/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contracts, fixture integrity, documentation, and the no-source-unit-test guard pass. After the cold-hint experiment was reverted, all 129 runtime/build source hashes exactly matched the checked outlined version, so its unchanged-source receipts are reused. This batch has affected selected LLVM evidence; it does not refresh full-repository totals or establish an aggregate incremental coverage gain. Coverage MCP imports remain source-unverified with summary/detail reconciliation limitations. Its IDCT query lists two missing branch observations for the same remaining path: an overflowing column group with nonzero vertical AC makes the helper decline the shortcut and the caller retain the general transform. These are kept visible while the general transform's width behavior is investigated.

Every timed full decode first matched baseline/candidate/live Pillow pixels. The eager bitmap implementation was 10.63–16.35% slower on three progressive RGB controls and was rejected. Outlining put nine of ten overall controls within 2.6% of baseline; CMYK progressive was 3.63% slower overall, with only one paired cycle beyond 3%. A cold compiler hint then regressed progressive RGB controls 7.13–13.50% and was reverted. All three cohorts and exact executables remain retained. Five-cycle diagnostics with tenfold iterations on four concerning controls measured RGB progressive 4:2:0 and 4:2:2 latencies 0.78% and 0.62% higher, baseline RGB 4:4:4 2.01% higher, and CMYK progressive 2.57% lower. Both cohorts are retained; CMYK results vary between them. The restored candidate clears the declared 3% review trigger on these controls, without changing that threshold. The small observed costs remain explicit: no zero-overhead, native x86 speed, or global ranking claim follows.

Retained evidence is in .coverage-mcp/local-evidence/parity/jpeg-idct-workspace-20261101/. The restored candidate's selected report is .coverage-mcp/local-evidence/selected/20261101T100532.208699Z-e777a791754743a694aede511138a6f7/coverage.json; the cold-hint report is separately retained with that rejected experiment. All work remains local, uncommitted and unpushed on develop in /Users/lazytrot/work/image-slash-star. Native SSE2/AVX2 execution, complete coverage, and the broader performance goal remain open. The current section above resolves the twelve smoothing cases.

Progressive JPEG coefficient storage — 2026-11-01

Progressive coefficient blocks now store signed 16-bit JCOEF values directly, reducing their payload from 256 to 128 bytes per block. DC predictors, smoothing, dequantization, and IDCT arithmetic retain their wider types. First-scan writes still narrow explicitly; refinement uses equivalent 16-bit wrapping arithmetic. No defensive branch, overflow fallback, dependency, feature, or unsafe code was added or removed. The pinned coefficient definition and progressive decoder sources are retained with hashes.

Six new complete public Pillow parity fixtures cover signed coefficient writes at category 15 / Al 12 and both signs through all twelve DC/AC refinement stages. The affected selection passed 552 JPEG parity rows (419 decode and 133 encode), including 639 public encode calls and zero panics, plus 13 pre-existing target-only fault contracts reported separately. All 6,116 prior reference rows remain unchanged. No unit tests, new fault hooks, coverage exclusions, or regenerated canonical results for mismatching inputs were used.

Strict formatting/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contracts, fixture integrity, documentation, and the no-source-unit-test guard passed. Build, lint, target, and selected coverage receipts identify the same 129 source/build files. The full native report in the JFIF section below is the preceding baseline; the current coefficient representation and six new fixtures have affected selected coverage evidence, not refreshed full-repository totals. Coverage MCP remains source-unverified with summary/detail reconciliation limitations, so no aggregate incremental-gain claim is made.

With ordinary production linking, a three-cycle A-B-B-A campaign compared ten complete public decode workloads against the preceding Adobe-marker baseline. Every timed input first matched full baseline/candidate/live Pillow pixels. Overall latency medians stayed within 1.4% of baseline. A five-cycle diagnostic with tenfold iterations measured RGB 128×128 progressive 4:2:0, 4:2:2, and 4:4:4 latencies 2.16%, 2.87%, and 2.15% lower; grayscale was 1.57% higher. Both cohorts are retained. The combined JFIF fix and coefficient change clear the declared 3% regression review trigger on these controls. These local Apple M3 Pro measurements establish neither zero overhead nor native x86 SIMD speed.

A separate historical 60-input coefficient-boundary probe found identical baseline and candidate pixels for every file. Only 19 matched default pinned Pillow; the other 41 exposed pre-existing IDCT differences at that checkpoint. The workspace correction above resolves 29, and the latest partial-smoothing checkpoint resolves the remaining twelve. Six matching guards were added to the matrix without counting the mismatches as parity. A diagnostic Pillow process with SIMD disabled changed 52/60 oracle outputs and matched the target on only eight, so it is not substituted for the default oracle. The full inputs and all observed pixels remain available for tracing the first arithmetic divergence.

Retained source, executables, all timing cohorts, 60 probes, six fixture references, verification logs, coverage receipts, and checksums are in .coverage-mcp/local-evidence/performance/jpeg-progressive-i16-20261101/. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261101T093923.951210Z-21c71ef685a4454089d80e56743a0915/coverage.json. An earlier diagnostic forced equal progressive function placement and changed the timing gaps, supporting placement sensitivity as a contributor; it is retained separately under performance/jpeg-progressive-placement-20261101/. An outlined Huffman fallback was slower and reverted; its evidence is retained with this batch. No production linker flags changed. The workspace checkpoint above records progress on the 41 IDCT differences. Native SSE2/AVX2 execution, complete coverage, and a global performance ranking remain open. Work remains local on develop, uncommitted and unpushed.

JPEG JFIF payload boundaries — 2026-11-01

Historical minimal-fix checkpoint: correctness passed; performance was open. The combined source is evaluated in the coefficient-storage section above. The minimal parser/inspector fix rejects recognized pre-scan JFIF payloads that omit either mandatory version byte. It preserves Pillow's acceptance of missing density/thumbnail fields, a missing NUL after JFIF, unrecognized APP0 signatures, and short APP0 metadata after the scans. The pinned installed Pillow 12.2.0 JPEG handler and its hash are retained with the reproductions.

Thirty new input-only public parity rows cover baseline and progressive RGB JPEGs, payload lengths 0, 4–8, and 11–14, signature variations, and three short post-scan payloads. The original implementation matched 24 and incorrectly accepted six malformed headers. The minimal fix matches all 30 complete files and all 90 direct detection/inspection/decode outcomes against live pinned Pillow. The affected campaign passed all 546 JPEG parity rows (413 decode and 133 encode), 639 public encode calls with zero panics, and all 13 existing target-only fault contracts reported separately. All 6,056 prior reference rows remain unchanged. No unit tests, fault contracts, hooks, or exclusions were added.

The fresh full native coverage run passed 139 integration checks across six binaries, with all 7,881 source, fixture, and setup file hashes unchanged during the run. Native LLVM reports lines 99,965/141,061 (70.87%), branches 20,027/31,708 (63.16%), functions 5,564/9,067 (61.37%), and regions 152,467/218,819 (69.68%); the release floors pass. The unchanged JFIF payload length condition's false arm increased from zero to 36 hits, and the Coverage MCP parser query lists four missing-branch groups instead of five. These are bounded observations, not an aggregate incremental-gain claim: imports remain source-unverified and the summary/detail reconciliation limitation remains.

Strict formatting/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contracts, fixture integrity, documentation, and the no-source-unit-test guard passed on the recorded minimal source. After the optimization experiments were reverted, all 129 recorded runtime, Cargo, and benchmark source hashes matched that checked source exactly, so the unchanged-source test evidence is reused.

The minimal fix's three-cycle, ten-workload local A-B-B-A campaign flagged progressive controls: RGB 128×128 4:2:0 was 9.39% slower, 4:2:2 was 12.04% slower, 4:4:4 was 5.06% slower, and grayscale was 6.38% slower. Timed inputs first passed exact baseline/candidate/live Pillow pixel comparisons. Profiling places most CPU time in progressive entropy decoding; baseline and candidate progressive reconstruction have the same instruction count and mnemonic counts, with relocation differences. This does not establish the regression's cause. Validator/refinement call boundaries, bounded counter increments, and four-byte/full-word refill experiments did not resolve the concern and were reverted. Both saved executables rebuilt byte-identically. Five-cycle diagnostics with tenfold iterations confirmed RGB medians 9.30%, 11.76%, and 5.74% slower; grayscale was 3.00% slower overall with mixed cycle results. Both campaigns remain retained, and the original 3% review threshold was not widened. Diagnostic-only optimization trials do not constitute parity or accepted optimization evidence. The x86-64 runtime availability probe on this host failed with Bad CPU type in executable; SSE2/AVX2 evidence remains compile-only. No SIMD speedup, zero-overhead, native x86 runtime, 100% coverage, or global ranking claim follows from this batch.

Retained evidence is in .coverage-mcp/local-evidence/parity/jpeg-jfif-boundaries-20261101/, including the open performance status, immutable executables, exact source snapshots, rejected experiments, profiles, coverage receipts, and artifact hashes. The full native report remains at .coverage-mcp/local-evidence/full/20261101-jfif-final/coverage.json. All work remains in /Users/lazytrot/work/image-slash-star on local develop, uncommitted and unpushed. The performance concern described here applies to this saved minimal-fix checkpoint; its measurements remain retained.

JPEG Adobe marker precedence and color defaults — 2026-11-01

JPEG color interpretation now follows the last valid Adobe APP14 marker before the first scan. Later markers remain retained metadata and cannot change the header's color choice. Previously the parser kept the first recognized marker, and a first marker after the scans could incorrectly reinterpret unmarked CMYK. Four-component JPEGs also follow libjpeg's YCCK default for unsupported nonzero Adobe transforms. The parser normalizes those values once when it captures the header interpretation; the raw APP14 payloads remain intact. Baseline and progressive reconstruction source files are identical to the preceding batch. The pinned marker reader and header color defaults are retained with source hashes alongside the live Pillow observations.

Forty new ordinary public decode rows cover both RGB and CMYK, baseline and progressive scans, conflicting and matching duplicate markers, first and conflicting post-scan markers, eleven-byte Adobe payloads, unrecognized APP14 signatures, and unsupported transform values. The original source matched 26/40 complete inputs and returned different pixels for the other 14. The first 32-row matrix reproduction passed 22 rows and failed 10; the eight additional live probes exposed four more mismatches. The final campaign passed all 516 JPEG parity rows (383 decode and 133 encode), including 639 public encode calls and zero panics, plus all 13 existing JPEG fault contracts reported separately. Live pinned Pillow comparisons passed all 126 public decode executions across 112 unique complete inputs. All 5,976 pre-existing reference rows remain unchanged. No unit tests, fault contracts, hooks, or source exclusions were added.

Performance review rejected an initial reconstruction-predicate variant after three controls crossed the predeclared 3% regression review threshold. A saved baseline rebuilt byte-identically. The final fix changes only parser source and retains the existing reconstruction checks. Ten local Apple M3 Pro controls used three A-B-B-A cycles, 100 warmups per process, Rust 1.96.1, and complete public decode calls through output destruction. Every timed input first passed full baseline/candidate/live Pillow pixel equality. The short-process medians ranged from 6.59% faster to 3.10% slower, triggering review of one workload. Five-cycle diagnostic runs with tenfold process iterations on the three previously affected workloads measured medians from 1.32% faster to 1.32% slower; none had a majority-cycle regression beyond 3%. Both campaigns and the rejected implementation are retained. This bounds local regression risk; variable timings do not establish a speedup or zero overhead.

Strict formatting/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contracts, fixture integrity, documentation, and the no-source-unit-test guard passed. Coverage-origin inventory remains 267 guards across 36 files. The Coverage MCP CLI parser query still lists five missing-branch groups; this batch closes observed behavior gaps without claiming an aggregate coverage gain. Imports remain source-unverified and the summary/detail reconciliation limitation remains. The preceding full native baseline predates the RGB row-assembly and Adobe-marker batches; the current receipt is the affected JPEG selection. Native x86 parity/performance, 100% coverage, and a global codec speed ranking remain unproven.

Retained local evidence:

• .coverage-mcp/local-evidence/parity/jpeg-adobe-precedence-20261101/: complete reproductions, pinned generators and inputs, source identities and focused patch, immutable executables, byte-identical baseline rebuild, reference-preservation receipts, both timing campaigns and rejected variants, acceptance logs, primary sources, Coverage MCP queries, and artifact hashes.
• The final selected report path and SHA-256 are recorded in that directory's selected-report.json; it remains separately retained outside target/.

RGB JPEG color semantics and progressive row assembly — 2026-11-01

Raw RGB JPEG components now bypass YCbCr conversion in baseline and progressive decoding. The parser captures three-component color interpretation at the first SOS marker: JFIF implies YCbCr, Adobe transform zero selects RGB, and unmarked R/G/B component identifiers select RGB. The new cases check JFIF precedence, an explicit Adobe YCbCr override, missing Adobe metadata, and a conflicting Adobe marker after the scan, which cannot change the header-time color choice. Previously, those RGB inputs returned different pixels from pinned Pillow 12.2.0.

Both decode paths also match libjpeg's replication rule when horizontally subsampled chroma is only one or two samples wide. The full-plane dispatcher now uses the same threshold as the row dispatcher. Direct baseline 4:2:2 and 4:2:0 paths delegate these tiny widths to the general reconstruction path; raw RGB also uses the checked component assembler. Ordinary direct YCbCr paths remain eligible for larger widths.

Progressive three-component output now uses reusable image-width scratch rows instead of cropping and expanding two complete chroma planes. Full-resolution rows are borrowed directly. Each component retains its own stride, visible extent, and sampling ratios, and output/scratch reservations are fallible. YCbCr rows still use the existing safe SIMD color converter; raw RGB rows are interleaved directly. The baseline YCbCr full-plane fallback and its existing fault contracts remain exercised.

Twenty-two new public decode parity rows cover tiny chroma widths, the three-sample transition, minimal/odd/aligned RGB dimensions, both scan modes, and the marker cases above. The original source passed only 6/22 of these rows. The final selected campaign passed all 476 JPEG parity rows (343 decode and 133 encode), including 639 public encode calls and zero panics, plus all 13 existing JPEG fault contracts reported separately. The 64-case size/sampling probe and 22 fixture probes also passed all 86 public decode executions, representing 74 unique complete JPEGs. All 5,932 pre-existing input/output reference rows are unchanged. No unit tests, fault contracts, coverage hooks, or source exclusions were added.

Local Apple M3 Pro release measurements used Rust 1.96.1, an immutable saved baseline executable, and the recorded dirty source identities. Three A-B-B-A cycles measured complete public decode calls through owned output destruction after 100 warmups per process. Input generation, file I/O, builds, and exact comparisons were outside timing. All eight timed inputs passed full baseline, candidate, and live Pillow pixel comparisons before timing. Incorrect raw RGB and tiny-width baseline outputs were excluded from speed comparisons.

Progressive RGB input, Q85	Baseline median (ms)	Candidate median (ms)	Latency reduction
128×128, 4:2:0	0.219729	0.203938	7.19%
512×512, 4:2:0	5.491146	5.192146	5.45%
128×128, 4:2:2	0.323688	0.286584	11.46%
128×128, 4:4:4	0.504000	0.474375	5.88%

Every progressive RGB cycle improved. The baseline RGB, progressive grayscale, and progressive CMYK controls ranged from 0.25% slower to 1.00% faster. These are bounded local observations, not an x86 runtime result or a global codec ranking.

Formatting, strict default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contracts, and fixture integrity passed. The selected coverage receipt represents the affected JPEG cases and existing fault lane; it does not replace the preceding full native baseline. Coverage MCP imports remain source-unverified and the summary/detail reconciliation limitation below still prevents an aggregate incremental-gain claim. The 100% goal and native SSE2/AVX2 parity/performance validation remain unfinished. All ongoing work stays in the primary checkout on local develop.

Retained local evidence:

• .coverage-mcp/local-evidence/performance/jpeg-progressive-rows-20261101/: before/after cases and probes, immutable executables, exact paired controls, source identities and focused patch, reference-preservation receipts, check logs, Coverage MCP gap queries, and artifact hashes.
• .coverage-mcp/local-evidence/selected/20261101T074525.204567Z-fb03c801e1bf479d87e88b27bfc881ba/: final 476-row JPEG and 13-fault-contract LLVM report, local receipt, and log.

Fractional JPEG sampling rejection parity — 2026-11-01

The decoder now rejects fractional component sampling ratios before pixel reconstruction can truncate them through integer division. Previously, eight baseline/progressive CMYK and YCbCr inputs with horizontal or vertical 3:2 ratios incorrectly decoded successfully; pinned Pillow 12.2.0 rejects their pixel loads. Detection, header inspection, and verification remain successful, matching Pillow. Valid integer 3:1 layouts still decode exactly.

Sixteen public decode parity rows pair those eight malformed inputs with eight successful integer-ratio controls. Each complete 8×8 file has explicit quantization/Huffman tables, zero-coefficient entropy, and EOI. SOF2 controls contain an interleaved DC-first scan. Every MCU has at most ten blocks, so the fractional cases isolate ratio acceptance rather than exceeding libjpeg's interleaved MCU limit. The pinned generator generate_jpeg_sampling_ratio_fixtures.py --check verifies complete file hashes, header verification, successful pixels, and Pillow's fractional-load errors. All 5,900 pre-existing input/output reference rows remain unchanged. No unit tests, fault contracts, coverage hooks, or source exclusions were added.

The parser bounds component factors to 1 through 4. Maxima of one or two therefore guarantee integer ratios; only larger layouts call the outlined validator. A first inline guard and an unconditional outlined guard measured 10.84% and 9.21% higher RGB progressive decode medians respectively and were rejected. Their sources, executables, and raw samples are retained. Rebuilding the saved baseline produced a byte-identical benchmark executable.

Final local Apple M3 Pro controls used Rust 1.96.1 and three A-B-B-A cycles, measuring complete public decode calls through output destruction after 100 warmups per process. Each of four 128×128 Q85 controls passed full baseline, candidate, and live Pillow pixel comparisons before timing. The final controls ranged from 0.14% lower to 1.29% higher median latency; RGB progressive decode was 0.205750 ms versus 0.208396 ms. This bounds the local regression check, without establishing zero overhead or a general speedup. Incorrect fractional baseline outputs are excluded from timing comparisons.

The final full native all-feature coverage run passed 139 checks across six integration binaries, with source and fixture identities unchanged throughout execution. Native LLVM summary totals are 70.859518% lines, 63.117498% branches, 61.354098% functions, and 69.671003% regions. These are current local totals, not a Coverage MCP incremental gain: imported reports remain source-unverified, and the summary/detail reconciliation limitation described below remains. Formatting, strict default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy and rustdoc, all 68 JPEG-feature integration contract checks, fixture integrity, documentation checks, and the no-source-unit-test guard passed. Coverage-origin inventory remains 267 exact guards across 36 files. Native x86 parity/performance and the 100% coverage goal remain unfinished.

Retained local evidence:

• .coverage-mcp/local-evidence/parity/jpeg-fractional-sampling-20261101/: original eight-failure reproduction, 16-case before/after probes, reference preservation receipts, final paired controls, rejected attempts, byte-identical baseline rebuild, source identities, focused patch, check logs, raw sampling guard observations, Coverage MCP gap query, and artifact hashes.
• .coverage-mcp/local-evidence/full/20261101-fractional-sampling-final/coverage.json: final complete LLVM report. The preceding inline-guard report remains at .coverage-mcp/local-evidence/full/20261101-fractional-sampling/coverage.json and does not represent the final runtime source.

Explicit CMYK JPEG subsampling parity — 2026-11-01

Explicit CMYK 4:2:2 and 4:2:0 encoding now matches pinned Pillow 12.2.0 instead of silently writing 4:4:4. The first C component retains full resolution; M, Y, and K use the requested sampling factors and the existing downsampling filter. Unspecified CMYK sampling still defaults to 4:4:4. The public sampling option documentation now explains that distinction.

The encoder fix exposed a second discrepancy: baseline and progressive CMYK decoding replicated sampled components instead of applying IJG interpolation. Both paths now share a checked, fallibly allocated output assembler. Sampled images use four image-width scratch rows; unsampled images read borrowed component rows directly. Horizontal 2:1 interpolation uses replication when the component width is one or two samples, following the dispatch conditions in the pinned libjpeg-turbo source. This narrow-width rule also applies to the existing shared YCCK row helper.

Nineteen ordinary encode parity cases cover both sampling layouts, optimized and progressive output, restart rows, odd dimensions, partial MCU boundaries, and single- and two-sample component widths. Three pinned lossless CMYK TIFF sources provide varied K values, which the existing JPEG sources lack. generate_jpeg_cmyk_subsampling_fixture.py --check verifies their complete file and decoded-pixel hashes through the fixture-integrity target. All 5,862 pre-existing input/output reference rows remain unchanged. No unit tests or target-only fault contracts were added.

The final selected campaign passed all 438 JPEG parity rows: 305 decode and 133 encode, exercising 639 public encode calls with zero panics. A separate 42-input public probe passed full-byte encode and decoded-pixel comparisons against live Pillow for seven tiny dimensions, all three sampling layouts, and baseline/progressive output. Retained intermediate failures distinguish the original sampling discrepancy, the decoder interpolation discrepancy, and the narrow-width dispatch discrepancy.

Local release controls compare the immutable preceding progressive-buffer candidate with this candidate on the Apple M3 Pro, Rust 1.96.1. All four 128×128 Q85 RGB/CMYK baseline/progressive sources passed complete baseline, candidate, and Pillow comparisons for both encoding and decoding before timing. Three A-B-B-A cycles measured whole public calls through owned output destruction after 100 warmups per process. Progressive CMYK 4:4:4 decoding changed from 1.008667 ms to 0.876979 ms median latency (13.06% lower); all three paired cycles improved. Encoding control medians ranged from 0.24% faster to 1.11% slower, and baseline CMYK decoding was 0.37% slower. The retained report contains all eight controls, including RGB progressive decoding, which also improved despite not being the targeted path. These observations do not establish a universal speedup, an x86 runtime result, or a codec ranking. Incorrect subsampled baseline outputs are excluded from timing comparisons.

Formatting, strict native/default/all-feature/release/nightly-coverage Clippy, SSE2/AVX2 compile-only Clippy, JPEG-only WebAssembly Clippy, strict JPEG-only rustdoc, all 68 existing JPEG-feature integration contract checks, and complete fixture-integrity verification passed. The coverage-origin inventory remains 267 exact guards across 36 files, with no source exclusions. Coverage MCP's selected encoder/decoder branch queries still identify gaps and are source-unverified imported evidence; the summary/detail reconciliation limitation below prevents an aggregate coverage-gain claim. The 100% goal and SSE2/AVX2 runtime parity and performance validation remain unfinished.

Retained local evidence:

• .coverage-mcp/local-evidence/performance/cmyk-subsampling-20261101/: paired controls, exact probes, reproduction and intermediate failure logs, source identities, immutable probe/benchmark executables, focused runtime patch, fixture/reference preservation receipts, check logs, and artifact hashes.
• .coverage-mcp/local-evidence/selected/20261101T070138.839597Z-0e1aa073fe53490980d38c946812cedd/: final 438-row LLVM report, local receipt, and captured output.

Progressive JPEG buffers and partial MCU parity — 2026-11-01

Progressive AC refinement now uses fixed 64-entry coefficient and correction buffers instead of allocating temporary vectors for each block. A separate correctness fix makes interleaved DC scans without restart markers retain partial-MCU dummy blocks. These repeat the preceding DC value, contributing a zero initial difference and its low refinement bit. The old path skipped them; the varied 63×65 input produced 3,670 bytes versus Pillow's 3,675 bytes and different decoded pixels. The corrected output matches Pillow byte for byte.

Three public encode parity rows cover bottom, right, and combined partial MCU edges: enc_progressive_bottom_partial_mcu_420, enc_progressive_right_partial_mcu_420, and enc_progressive_partial_mcu_420. The first two use pinned deterministic RGB PNG sources at 63×65 and 65×63; the third reuses the existing 33×33 JPEG. Existing input/output reference rows are unchanged. All 114 JPEG encoder matrix rows passed, exercising 544 public encode calls with zero panics. The new rows are ordinary Pillow parity cases; no unit tests or target-only fault contracts were added.

Local paired release measurements used the Apple M3 Pro, Rust 1.96.1, the same dirty workspace snapshot, and an immutable saved baseline binary. Only src/codecs/jpeg/encode/mod.rs differs in the recorded runtime source identities. Each of three A-B-B-A cycles measured complete public encode calls through owned output destruction, after 100 warmups. Input generation, builds, and file I/O were outside timing. Every timed baseline and candidate output matched pinned Pillow 12.2.0 exactly before timing.

Progressive workload	Baseline median (ms)	Candidate median (ms)	Latency reduction
RGB 128×128 Q85, 4:2:0	0.680	0.545	19.76%
RGB 512×512 Q85, 4:2:0	12.187	10.515	13.72%
RGB 128×128 Q10, 4:2:0	0.256	0.218	14.78%
RGB 128×128 Q100, 4:2:0	0.770	0.581	24.58%
Grayscale 128×128 Q85	0.524	0.393	24.92%
CMYK 128×128 Q85, 4:4:4	2.518	2.084	17.24%
RGB 128×128 Q85, 4:2:0, restart every MCU row	0.682	0.539	20.90%

Every progressive cycle improved; the unchanged baseline-encoding control moved 0.52%. The odd-size correctness case is excluded from timing claims because the original output failed Pillow parity. An initial random CMYK 4:2:0 comparison also differs from Pillow in both original and optimized binaries; it was a pending compatibility gap at that measurement point, excluded from ranking and subsequently resolved by the CMYK work above. The final CMYK timing uses the existing production workload's 4:4:4 sampling. The rejected first buffer variant, including its Q10 regression, remains in the retained attempt report. These are local observations, not a published ranking, an x86 speed claim, or evidence for the world's fastest codec.

Formatting, strict native/default/all-feature/release/coverage Clippy, SSE2/AVX2 cross-compile Clippy, JPEG-only WebAssembly Clippy, fixture integrity, and all 68 existing JPEG-feature integration contract checks passed. Compile checks do not establish SSE2/AVX2 runtime parity or speed. Coverage MCP's full baseline query still lists encoder gaps, and raw baseline observations already cover both partial-MCU guard outcomes: the new parity cases catch a correctness gap that a branch percentage alone missed. The summary/detail reconciliation limitation described below remains; no aggregate coverage gain is claimed.

Retained local evidence:

• .coverage-mcp/local-evidence/performance/jpeg-progressive-buffers-20261101/: final and attempted reports, paired runner, source identities, focused patch, native sample profile, raw samples, and local artifact hashes.
• .coverage-mcp/local-evidence/selected/20261101T063448.953572Z-6aec4f56094745b2988315c7bc49618b/: the 114-row LLVM report, local receipt, log, and raw DC branch observations.

Coverage cache isolation and full native baseline — 2026-11-01

cargo-llvm-cov 0.8.7 collects executables from both host and explicit-target output trees. The previous shared cache retained old host executables when selected runs cleaned only their explicit target. Repeating the same four PNG parity rows in a fresh cache kept every covered count and all 112 source paths identical, while removing stale mappings from the reported denominators:

Metric	Shared-cache denominator	Fresh-cache denominator	Covered in both selections
Lines	155,778	140,930	1,095
Branches	41,441	31,632	114
Functions	10,107	9,043	109
Regions	239,846	218,582	1,462

Both selections have identical source manifests. This is a correction to the measurement inventory, not a codec coverage gain. The original reports and cache contents remain intact. make coverage now uses target/cargo-llvm-cov/full; make coverage-selected and direct selected script calls default to target/cargo-llvm-cov/selected. Their parent and each individual cache can be overridden as documented in Testing. The selected receipt records its resolved CARGO_TARGET_DIR.

The changed default selected command passed 4/4 parity rows and reproduced the fresh control's exact totals. A new full native all-feature run passed all six integration binaries (139 checks), including the complete matrix harness, with unchanged source and fixture hashes during execution. Its input inventory contains 2,372 active decode rows, 556 active encode rows, and 167 target-only fault contracts; fault contracts remain separate from Pillow parity. All four alpha floors passed:

Metric	Covered / total	Percent
Lines	99,860 / 140,930	70.857873%
Branches	19,958 / 31,632	63.094335%
Functions	5,546 / 9,043	61.329205%
Regions	152,261 / 218,582	69.658526%

The clean full and selected runs have matching denominators for all four metrics. These are local LLVM producer totals, not managed Coverage MCP measurements or a replacement for the retained historical claim ledger.

Cache isolation does not resolve LLVM summary/detail reconciliation. A fresh JSON self-comparison is still incomparable in Coverage MCP. A native LCOV export from the same profile has the same producer totals, but its detail has 136,242 line records versus LF=140,930 and 31,616 branch records versus BRF=31,632. Its limited line-coordinate comparison is therefore not an exact whole-report percentage. Neither export is rewritten or trimmed to force a combined coverage claim. No production Rust code or unit tests were added.

Retained local evidence:

• .coverage-mcp/local-evidence/diagnostics/coverage-cache-isolation-20261101.json
• .coverage-mcp/local-evidence/full/20261101-cache-isolation/coverage.json, coverage.log, coverage.local-evidence.json, and coverage-compare-selected.json
• .coverage-mcp/local-evidence/selected/20261101T061649.456759Z-0ee9625ff3e9477c826bad9ea97e9683/coverage.json
• .coverage-mcp/local-evidence/selected/20261101T061040.532913Z-c1e316eade284c778e6dff3c2fcf0977/coverage.json and coverage.lcov retain the fresh-control exports.

PNG zlib header and DEFLATE repeat rejection parity — 2026-11-01

Four ordinary PNG inputs retain the complete one-pixel RGB container, valid chunk CRCs, and IEND. Pinned Pillow 12.2.0 accepts detection, inspection, and structural verification, then rejects both still and sequence decoding:

Public parity row	Input SHA-256
decode:png:error_zlib_window_size_above_limit	85f3908b8187264634018450f6a3f7b75b82e62fee6f073b01141d78607f731b
decode:png:error_zlib_header_checksum_mismatch	e19795bb1425702730cfa038b17e2a2ed52556b63e3d01ceb054942aa2c0fb0c
decode:png:error_zlib_preset_dictionary	8bd1ca9a90c24d35a1048cc4fbfc90c0e397cbe42c1105370268c31699d84969
decode:png:error_zlib_dynamic_repeat_without_previous	499e28c39f5b6528ee9af60f0b4d953d7cbd14f4f7e3927074982114ba96c044

The window case keeps CM=8 and valid FCHECK while requesting a 64 KiB window. The checksum case changes only FCHECK within IDAT and recomputes the PNG CRC. The dictionary case contains a complete zlib stream that inflates to the source raster when supplied its dictionary, which PNG forbids. The dynamic-tree case uses a complete code-length alphabet but emits repeat symbol 16 before any prior length. The dictionary case retains Pillow's image file is truncated (0 bytes not processed) error; the other three retain its broken-stream error. All four public rows passed their generated operation and structured-error contracts in the selected Rust run (4/4, zero fault-contract rows).

Coverage MCP identified the unobserved header and repeat paths in the retained full baseline. Raw LLVM branches at unchanged deflate.rs spans confirm the following previously unobserved outcomes, each observed three times in the new selection: excessive window (line 92, true), incorrect checksum (lines 93–97, true), preset dictionary (line 98, true), and missing previous code length (line 424, false). Both reports' local receipts match the current DEFLATE source hash; zero-count duplicate mappings remain in the original reports. These are selected-run observations, without managed source/test attribution or a new whole-repository percentage. Coverage MCP's incremental branch comparison returned incomparable because the baseline details do not reconcile with its reported totals; the four raw branch observations above are retained separately from that aggregate result.

scripts/generate_png_deflate_header_edges.py --check verifies all four deterministic inputs through make verify; --verify-pillow also validates the pinned oracle. Reference regeneration additionally repaired a stale generator allow-list for four existing CDEF fault points already supported by the runner. No production Rust source or unit tests were changed for these cases.

Reports under .coverage-mcp/local-evidence/selected/20261101T060537.075590Z-48ac44e2e03043638c4f1de3053c643a/:

• coverage.json and coverage.local-evidence.json
• deflate-branch-observations.json, retaining the source and report hashes
• coverage-compare-deflate.json, retaining Coverage MCP's comparison result

AVIF CDEF and Wiener stripe boundary parity — 2026-11-01

decode:avif:coverage_i420_intra_cdef_restoration_10bit_16x64 is an ordinary 10-bit I420 key frame combining active luma CDEF with Wiener restoration. Its 64-row height crosses the first 56-row restoration stripe boundary. This checks the handoff between post-CDEF samples inside a stripe and saved deblocked rows in its halo, with CDEF disabled for the chroma planes.

Pinned libavif 1.4.1/libaom 3.13.2 encodes are repeated and required to match. The source SHA-256 is 7d30b4c3eb9b0157a01e54afa6b011dfb54701ebfd919a5ddc52f047474e3bc6, the AVIF SHA-256 is ccf7cb2dc6c81749955e09853587f7b1047e3c89b17f2832a4196303d8302727, and the 3,072-byte Pillow 12.2.0 RGB reference SHA-256 is a6535b59e9da0eb66ee1bf768e080739bc8d88b2afc9554388b7620849900f1e. The generator pins CDEF damping 5, Y strength 47, UV strength 0, and one Wiener luma restoration unit; no deblocking or super-resolution is enabled.

The exact selected public parity row passed 1/1. Its LLVM report records three calls to restore_striped_plane, six stripe iterations, and both saved halo paths. No production decoder behavior or unit test was changed. This selected run does not replace the complete baseline; Coverage MCP marks the local report source as unverified and test attribution as unknown.

Coverage MCP's incremental region comparison with the earlier full baseline returned incomparable: its detailed baseline regions do not reconcile with the reported totals. The comparison is retained without a coverage-gain claim; the selected parity result and observed stripe execution remain separate evidence.

Reports:

• .coverage-mcp/local-evidence/selected/20261101T055203.084075Z-b6be961d1182457284ae5e61ab17af7d/coverage.json
• .coverage-mcp/local-evidence/selected/20261101T055203.084075Z-b6be961d1182457284ae5e61ab17af7d/coverage.local-evidence.json
• .coverage-mcp/local-evidence/selected/20261101T055203.084075Z-b6be961d1182457284ae5e61ab17af7d/coverage-compare-restoration.json

CDEF output reuse benchmark rejected — 2026-11-01

A candidate removed the second CDEF plane clone and wrote filtered blocks into the consumed canvas. Two A-B-B-A sequences compared immutable release executables on an Apple M3 Pro with Rust 1.96.1 and all features. The timed boundary was decode_sequence through output drop, excluding file I/O. Each cohort used 200 warmups and 4,000 samples for color inputs or 1,000 samples for the larger monochrome control. Source, binary, input, and reference hashes are retained with every command and raw sample file.

Median changes across the four cohorts for each executable were:

Fixture	Candidate latency change
I420 CDEF 16x16	+3.46%
I420 CDEF 9x16	+0.34%
I422 CDEF 16x16	+3.24%
I420 CDEF/restoration 16x16	-0.99%
I420 restoration without CDEF, control	+2.64%
Monochrome CDEF 128x64, control	+0.46%

Positive changes mean slower calls. The candidate did not establish a repeatable latency gain, and untouched controls also drifted. Its source change was reverted exactly. Candidate parity was not run after the timing rejection; these measurements are a rejected local experiment, not a verified speed improvement or an SSE2/AVX2 result.

Report: .coverage-mcp/local-evidence/performance/cdef-output-reuse-20261101/report.json.

AVIF redundant-frame-header guard parity — 2026-11-01

Added four cases from animated_lossless_inter_420_derived_skip_refs_b32x32_64x64.avif. The size-preserving decode:avif:error_animated_redundant_frame_header_with_pending mutation replaces the first OBU_FRAME with an OBU_FRAME_HEADER, its matching OBU_REDUNDANT_FRAME_HEADER, and OBU_PADDING, leaving a pending frame without tile data. The decode:avif:error_animated_redundant_frame_header_without_pending mutation replaces it with OBU_REDUNDANT_FRAME_HEADER and OBU_PADDING without an original frame header. Their fixture SHA-256 values are 46c2a6f033820f828209f9a81ef8da4318c5f3255cee99d866321ce4635a86d5 and 9c29fa97ff57041eb15a7b49a067b2fb2f6f141f003a835d7a786089d1c2dee8. The decode:avif:error_animated_frame_header_before_tiles case repeats the ordinary frame header before tile data; the decode:avif:error_animated_redundant_frame_header_mismatch case changes the redundant header's order_hint. Their fixture hashes are 380c025386ee770a6573d88fa1bdf12adbe345149026c46a3aee78c922f06c78 and 4e004fa44966ae7fc63f2ce5214283e4138e8cc6658e12fcf7b38fbd0b9897b0.

Pinned Pillow 12.2.0 rejects frame 0 for all four cases, and the selected public Rust parity rows passed 4/4 with the same malformed outcome. The combined six-case selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T224014.242315Z-28db627af2da40cba9d691d9eccd2fc7/coverage.json (SHA-256 2bd95f92f0796bcc7e855995cd55363a6550a81c6342120e8ad96fbc7c4f5068); its local receipt SHA-256 is 0bbf85abbbc3ba5adac6974ce2cdbae31b14bbcd0f344e25161ad2d4644c40b7. The selected mapping records the Some/None paths at line 1230 as 6/3, the matching/mismatched header paths at line 1248 as 3/3, and the pending/not-pending paths at line 1253 as 3/15. It also records temporal-layer comparison outcomes at line 1387 as 3/9 and spatial-layer comparison outcomes at line 1388 as 3/6; the mismatch rejection at line 1390 ran 6 times. LLVM emits duplicate zero-count mappings for these branches. Coverage MCP was unavailable, so this is local selected evidence without managed attribution or an aggregate coverage claim. No unit tests or production Rust changes were added.

AVIF tile-group layer identity parity — 2026-11-01

Added decode:avif:error_animated_tile_group_temporal_id_mismatch and decode:avif:error_animated_tile_group_spatial_id_mismatch from animated_opidc_0x101.avif (SHA-256 25b79a856ea2767e02e5a509f72e7af3f9563202301779be65b0745724ab23be). Each mutation expands the first operating-point IDC to admit two layer identities, then splits the first OBU_FRAME into an OBU_FRAME_HEADER and a tile group whose temporal or spatial ID differs from the pending frame. Both preserve the AVIF and sample lengths. Their fixture hashes are 0c23f3e5db7b1d9d7150144f5204044c2bee0804edd6eb022148fc7a4ef4a1d9 and 2c23b60cc7f4e5951b24ba1309aa7ec1afda18fd97b74d66b54e982899a6963d.

Pinned Pillow 12.2.0 rejects both at frame 0 with its color-plane decode error. Both public rows passed in the combined six-case selection above (6/6 total). That selection covers the temporal comparison at frame.rs:1387 in both directions and the spatial mismatch at line 1388. The preexisting full report showed only matching layer identities at these comparisons; this selected report is kept separate and is not presented as a merged aggregate. Coverage MCP returned Transport closed, so this remains local LLVM evidence without managed attribution. No unit tests or production Rust changes were added.

AVIF sequence-header UVLC limit parity — 2026-10-31

Added decode:avif:error_animated_equal_picture_interval_uvlc_32_leading_zeroes to exercise the public AV1 uvlc() boundary with a complete animated AVIF. The deterministic mutation sets the first equal-picture interval value to 32 leading zeroes while preserving the BMFF sample layout. The fixture SHA-256 is 842854d4e586bf3b84607f45c85479cb37c3357a78296b7bf39da5ad71ad74e8. Pinned Pillow 12.2.0 opens the five-frame container and fails loading frame 0 with RuntimeError: Failed to decode frame 0: Decoding of color planes failed; the selected Rust parity row passed 1/1 with the matching malformed outcome.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T211948.321091Z-d295b971f2584401b7b0fcd54827a080/coverage.json (SHA-256 1649e225367edcec6c54eee8060d0dad1ea399ecbeb7b5f02a915c85f3b79356); its local receipt SHA-256 is 78aaedd311fd848818990485f6345bdf7b72a5c228558e380b025e0f96db5ba0. At src/codecs/avif/av1/bit_reader.rs:243, the report records the true arm three times in one LLVM mapping and a second zero-count mapping for the same branch. These are selected-run counts, not whole-repository totals. Coverage MCP returned Transport closed for this report, so the result is local evidence without managed attribution or an aggregate coverage claim. No unit tests or production Rust changes were added for this case.

AVIF nonuniform tile-grid parity — 2026-10-31

Added decode:avif:error_nonuniform_tile_grid_tile_group_mismatch and decode:avif:error_nonuniform_tile_grid_ns_threshold_false from the pinned uniform_tile_rows_monochrome_256.avif input (SHA-256 782568b37a63b44e632aee68896bcee3c59c5492081c7ac2ac6a31fc0ca1df37). The first fixture clears uniform_tile_spacing_flag, making the header describe a nonuniform 2×4 grid while the encoded tile group retains its 1×4 layout. The second also sets the first ns(3) prefix bit, selecting the extended-value arm and a 2×3 grid. Their fixture hashes are 31f9bc09f7a52b56a9059a51d96c464bad715135557bfbf649c38501f55d6411 and b7a9dc5b14f8115b21f131700351a26cb679f6c23ded975a47489291e074f9fa.

Pinned Pillow 12.2.0 opens both files and fails loading frame 0 with RuntimeError: Failed to decode frame 0: Decoding of color planes failed. The public Rust parity selection passed 2/2 with matching malformed outcomes. Its LLVM report is .coverage-mcp/local-evidence/selected/20261031T213419.047311Z-a534b74bb4ce4fedbcbf26de1b348cfb/coverage.json (SHA-256 2865aceb69ac8180336bea8ed0207f93d8788fe8f97c32a775386dae26325f21); the local receipt SHA-256 is 092f1f576cec2a52837c7b2ff25fd15f37b44df803c9b5c0944d95e8910ae037 and records no source or fixture changes during the run. At src/codecs/avif/av1/bit_reader.rs:143, the count <= 1 outcome remains unobserved while the other side ran 27 times. At line 149, both ns() threshold outcomes ran (24 true, 3 false). Coverage MCP returned Transport closed for a selected-report query during this session, so these remain local selected-run counts without managed attribution or a whole-repository coverage claim. No unit tests were added.

AV1 global-motion subexponential endpoint parity — 2026-11-01

Added decode:avif:animated_lossy_global_subexp_endpoint_i444_b128x128, a deterministic same-length mutation of the existing four-frame RotZoom AVIF. The frame-2 global-motion parameter reaches the terminal ns() arm in BitReader::subexp while preserving the AV1 frame-header and tile-data boundaries. Pinned Pillow 12.2.0 decodes all four exact RGB frames; the separate pinned libavif 1.4.1 observation also decodes all four and records the existing infinite-repetition behavior. The selected public parity run passed 1/1.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T214641.701534Z-11d75f008d7d4eef85e8011ae0410890/coverage.json (SHA-256 471112a0d0d31d215b0a481f89dc90d46d941f2cb1fde13f32e70c8869871c3f); its local evidence receipt SHA-256 is b67bf5a0167277d1bdd2846bb7fdaaaadd56f5f57ba51c42495ea2edeb33d003. At src/codecs/avif/av1/bit_reader.rs:191, the selected report records the previously unobserved terminal outcome once (106 non-terminal outcomes in that mapping). This is selected-run evidence, not a full-suite coverage result. Coverage MCP returned Transport closed for the report query, so no managed attribution or aggregate coverage claim is made. No production Rust code or unit tests were added.

AV1 frame-before-sequence-header parity — 2026-11-01

Added decode:avif:error_animated_frame_before_sequence_header. The deterministic generator changes the first frame sample's sequence-header OBU to same-length OBU_PADDING, leaving the following frame OBU before any AV1 sequence state. Pinned Pillow 12.2.0 rejects frame 0 with its existing RuntimeError: Failed to decode frame 0: Decoding of color planes failed contract; the selected public parity row passed 1/1.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T215751.068273Z-7a83c84d5c2348a69f4578f4835febf7/coverage.json (SHA-256 56160ed9d4dfd4f67099b23fb0260e55fc3645771de2300ad25c7a281d451746); its local receipt SHA-256 is 11caa264eb9f113243f1598fbb06cfeebe677b035bf17641f91d115ac7095df2. The selected report records the missing-sequence error arm at src/codecs/avif/av1/frame.rs:937 three times. A retained earlier full local report also showed hits for that arm, but it has no source/build receipt that binds it to this selected run, so no aggregate coverage increase is claimed. The deeper begin_frame guard at line 1226 remains unreachable through this public input: the OBU-admission check rejects it first. Coverage MCP returned Transport closed; these counts are local-only. No production Rust code or unit tests were added.

Coverage gap triage — 2026-10-31

The source-matched public parity report .coverage-mcp/local-evidence/selected/20261031T114852.863923Z-addc0604926f4f39a298fa98bc588d3e/coverage.json ran 2,891 active rows (2,345 decode and 546 encode); all passed. Its source manifest hash matches the current checkout at 1e2a75755c7341b6d14d426996680a9c8e1a000e586825241e4d86b089a3889e. The remaining active row, decode:avif:alpha_item_icc_profile_ignored, passed in its own selected run above with the same source manifest and target. A local coordinate union adds two branch outcomes, from 18,749/32,492 to 18,751/32,492. This union is local evidence, not a Coverage MCP measurement or a single full-matrix run.

Coverage MCP returned Transport closed for the current gap query. Local inspection found defensive branches in the AVIF container's second parsing pass that have no distinct public outcome: the existing parity cases error_iinf_child_not_infe, error_ispe_zero_width, error_ispe_zero_height, error_animated_duplicate_minf, and error_animated_duplicate_stbl are rejected during the earlier sample validation pass, before the second pass can reach those guards. No case was added solely to execute those private branches. The 100% coverage goal remains open; other gaps still need triage.

The existing TIFF parity row decode:tiff:error_lzw_invalid_first_token_checkpoint was also run by itself and passed 1/1. Its source-matched report records the invalid initial-code outcome at decode.rs:3562 and :3655; the separate already-full-output outcome remains unobserved. No distinct Pillow-visible input for that guard was established, so no duplicate case was added. The report is .coverage-mcp/local-evidence/selected/20261031T122220.769882Z-1ac0025535144f09bdab10c3b765f3df/coverage.json (SHA-256 23a4d36d8d5f53e45bee5e2ecd7158d789ff4464afc9f4fe7456b5fd85fc206b); its local receipt SHA-256 is b009851d7efbb013c38275e6dff8c6567429686b4d679d5694a84225d3d4bf16.

Added decode:jpeg:ycck_fractional_vertical_3x2_sampling after the full report showed no true outcome for the vertical YCCK sampling-ratio check at src/codecs/jpeg/decode/decode.rs:1134. Its deterministic complete-file JPEG uses 2:3 luma/black and 1:2 chroma sampling. Pinned Pillow 12.2.0 rejects pixel loading with OSError: broken data stream when reading image file; the selected public parity row passed 1/1 with the matching malformed error category. The fixture SHA-256 is a2bbff78c082139a2760232d613216f6a3f799b5770a30bc7f51bccd0da960b1.

The selected report is .coverage-mcp/local-evidence/selected/20261031T123218.880013Z-8dd1d2deef3a4dd7baa8cd912b9d36ef/coverage.json (SHA-256 89836811921dc7bab7b11b8e6c2bc12b05f47b5301907a269bb4e59f3574f6d2); its receipt SHA-256 is 77841d4c7e2c200775bdd57b959fd31f946eeaea3cd9e5b9b37dcb7ad0a79455. Its report records both branch outcomes at line 1134 (3 true, 3 false); the earlier full public report records 0 true and 183 false there. Both reports have the same source-manifest hash, Rust source-file hashes, target, instrumentation, features, target-directory identity, and 32,492-branch denominator. Full-report totals are 93,451/144,616 lines, 18,749/32,492 branches, 5,054/9,327 functions, and 142,425/224,412 regions. The one-row selected report covers 1,545/144,616 lines, 189/32,492 branches, 129/9,327 functions, and 2,154/224,412 regions; these are selected-run totals, not a full-suite result. Coverage MCP returned Transport closed for the gap query and the first incremental comparison attempt. I then reran the parity row with the baseline's absolute target-directory identity; MCP has not returned a comparison for that aligned report. This remains local source-matched evidence without MCP attribution or a managed aggregate union. No unit tests ran.

Added encode:webp:enc_lossy_rgba_alpha_zero_palette_gap_token for a transparent 121-value alpha palette with both small and large palette deltas. The deterministic 512×512 PNG fixture has SHA-256 0d5a554fec44c2de7f6e04f7c03f7c4fa9da67fb5acbc6cbd392a91cedd3d168; its pixel bytes hash is 7c8bee506bf44fffd787780a3324fe9090a06062e486d4552246cb0680752dd2. Pillow 12.2.0 produces a 650-byte WebP reference with SHA-256 f28f4b210e224dbdc8cdfc8b7def089847ae19b029b58fc40b98b9a0088f57e8. The selected public encode parity case passed 1/1 and exercised the ordinary, sink, and token-aware encode paths.

Its LLVM report is .coverage-mcp/local-evidence/selected/20261031T124737.010668Z-be682779a72d4fbda61117b7b88a6a18/coverage.json (SHA-256 b99e4d4ea9cf1309df3af129039ec38c3f209700c4d0f4e0f9bb9cae1eaa7577); the local evidence receipt SHA-256 is 472b0307f77a48d98c2afeca8a6fb6e7cb29eb9022ade18a0edda0d7ffa8be2e. Against the matching full public report, the first true outcome for palette_values[0] == 0 at src/codecs/webp/native/encoder.rs:3431 is recorded four times, and the true outcome of the 64-candidate checkpoint at line 3452 is recorded 57 times. The full report had no true outcome for either branch; source-manifest and encoder-file hashes, target, toolchain, target-directory identity, and branch denominator match. Coverage MCP returned a Transport closed error for both the gap query and incremental comparison, so this is source-matched local evidence without managed attribution or an aggregate coverage claim. No unit tests ran.

Added encode:gif:enc_rgb_low_color_token_checkpoint for a token-aware 33×33 two-color RGB image. The selected public GIF parity case passed 1/1, including exact Pillow bytes and re-decoded pixel parity. Its local LLVM report records both outcomes of the token checkpoint conditions at src/codecs/gif/encode.rs lines 1311 and 1343, with the checkpoint arm taken once in each loop at pixel 1024. The earlier local all-public-parity report .coverage-mcp/local-evidence/full/20261031-current-all-public-parity/coverage.json (SHA-256 086f373d8dfa08b309e027832922b421b60eae7ff6c7e0326fc093d3a8996f1d) records no taken checkpoint outcome at either location; its GIF encoder source hash matches this selected report. Their local source-file coordinate union adds two observed branch outcomes, without establishing current whole-matrix coverage. The fixture SHA-256 is fa3e4abe97d4e9ad76d9326571fe279878f9d4dc7a53d6e7507df07f90ea48cd. The report is .coverage-mcp/local-evidence/selected/20261031T134635.726253Z-7202311c8f19489aad1b1ccb3d19a98c/coverage.json (SHA-256 a7eff4da144f24e452be81b8efb9756672111b7bfd8417af2b51bd2f4dab6213); its local receipt SHA-256 is 20b565e28b272673ca687d2dac3efb167f6a02744e94474a4c1feb10380cee93. Coverage MCP again returned Transport closed, so this is local selected-case evidence only; it is not a managed measurement or aggregate coverage claim. No unit tests ran.

Added encode:gif:enc_rgba_single_color_token_partition_base for a 33×33 single-color RGBA input. Its selected public parity case passed exact Pillow GIF-byte and re-decoded pixel comparisons. The local report records the true outcome of left_length <= 1 at src/codecs/gif/encode.rs:2547 once; the prior local all-public-parity report recorded zero true and 28 false outcomes. The GIF encoder source hash matches across those reports, so the local source-file-coordinate union adds one branch outcome. Fixture SHA-256: cbd18abee6ca2801675d763c078349b173d8f4148f8ab60f56f98f5cae65bd58. Selected report: .coverage-mcp/local-evidence/selected/20261031T135715.020282Z-40a3b6ccb0484151be3a29394c647132/coverage.json (SHA-256 a8f2c13e5aaadc4bff342467b32ad4ae5b44a42c9162ec2bc028b18c3f5728f1); local receipt SHA-256: 82dcfd207d3375832e92c7bfef1b54d45a1c908f76844b5e5a6b4fa5a5a98267. Coverage MCP returned Transport closed; this remains local selected-case evidence without an aggregate coverage claim. No unit tests ran.

Ran all 162 active target-side fault-contract rows (AVIF 101, TIFF 33, JPEG 13, BMP 5, PNG 5, WebP 5); all passed. The BMP allocation contracts include the public error and successful Pillow-parity retry. The selected LLVM report records the previously missing true outcomes at src/codecs/bmp/decode.rs:164 and :720 once each; the source-matched public report recorded 0 true / 100 false and 0 true / 61 false respectively.

A local coordinate union restricted to 97 source files whose SHA-256 matches both receipts and the current checkout adds 400 covered branch outcomes, from 17,572/30,148 to 17,972/30,148. The wider source-manifest hashes differ, so this is not a whole-matrix coverage union. Coverage MCP returned Transport closed for the incremental comparison; no managed attribution or aggregate coverage claim is made.

Selected report: .coverage-mcp/local-evidence/selected/20261031T140947.812054Z-ea50004fb5044154940050080a07e054/coverage.json (SHA-256 097eb8c5f3cd01e81bf94635351cea3eb3069e564552327f6b1893f98bd692e6); local receipt SHA-256: 59d4f6da1a8efd13e256ed71279ce55326e907cb6a38f3769bcb134910ce916a. No unit tests ran.

AV1 color multi-tile super-resolution parity — 2026-10-31

Added active parity row decode:avif:coverage_color_multitile_superres_8bit_256x64 for an 8-bit full-range I420 still with two tile columns and AV1 super-resolution from coded width 228 to output width 256. The AVIF fixture SHA-256 is 5a1c05d8f225ef1c73f73010089ab0d5ddf7e495620f117673321a248e71b044; its exact 49,152-byte RGB reference SHA-256 is 42703be2059382a9c3dce70c4795ea5e085fcd87e30ca361d9bfc443213273f3.

The selected public parity row passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261031-avif-color-multitile-superres-padded/coverage.json (SHA-256 70359916c47ea228f261e4ceb0ffd8ca26be3313b294809e09d8cdefaebce388); its local receipt SHA-256 is 517f6d29373f35ec83356c6fe5f0a15217128e2939b31723d05e615c72c54ab6. The receipt records unchanged source and fixture identities during the run. The selected report records the true outcome of pending.header.superres_enabled at src/codecs/avif/av1/frame.rs:1682 three times.

This case exposed a multi-tile reconstruction defect: assembly cropped each tile to visible width before super-resolution, while the resize filter can read the padded coded tail. Color tile assembly now retains each tile's padded source extent through filtering and resizing. The new case and the existing multitile_color_split_groups and multitile_skipped_cdef_color_alpha rows passed together, 3/3, with exact pixel parity. The regression report is .coverage-mcp/local-evidence/selected/20261031-avif-color-multitile-superres-regressions/coverage.json (SHA-256 a58d2514bf14ecaf91af6f4f90053193f22fb2acedc16d58372a139215c4c945); its local receipt SHA-256 is 6b176fb5af01cd6a2f8ae375f9b1f5b236fa0769e02287c491eac0229932cd96.

A fresh all-feature LLVM coverage run passed and is retained at .coverage-mcp/local-evidence/full-20261031-unknown-top-level-box/coverage.json (SHA-256 c2e7f97488df2b4e7db6a17e1f6eb729a85bac5c7ac347b81a1f8e8d5781c20d). It records 99,469/140,549 lines (70.7718%), 19,860/31,520 branches (63.0076%), 5,528/9,017 functions (61.3064%), and 151,708/218,036 regions (69.5793%). Coverage MCP returned Transport closed; this is local LLVM evidence without managed source attribution. The 100% goal remains open. No codec unit tests were added.

AVIF unknown top-level box parity — 2026-10-31

Added active row decode:avif:unknown_top_level_box_ignored. Its deterministic 379-byte fixture appends a bounded 12-byte zunk box after the complete 8×8 lossless I420 still. Pillow 12.2.0 preserves the exact 192 RGB bytes. Fixture SHA-256: ebd1e037026559f6a2f7dc12271c94a7440b2c06c79843eed5380afb92072d64; RGB reference SHA-256: 8099fa1157400c228f24ce0e41a6f9c59cc73c8be02953024a92761dba0db709.

The selected public parity run passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261031-avif-unknown-top-level-box/coverage.json (SHA-256 25ef24f3682d3e8650e3c9e0d784e2b52ca6f0f950d54b9e1d3e140a4e1e55f0); its local receipt SHA-256 is 87137c0030806c4f9e6ce3223e195c056359ebda73499e3b9f27c14c3cb0fb7e. The selected report records the unknown-box fall-through at src/codecs/avif/samples.rs:2915 four times. The case adds a public input witness for this box form; it does not change the full report's aggregate coverage totals.

Auxiliary-item ICC metadata parity — 2026-10-31

Added active public parity row decode:avif:alpha_item_icc_profile_ignored. The fixture associates the pinned prof ICC property from icc_profile.avif with only the auxiliary alpha item in alpha.avif; the AV1 payloads are unchanged and both file-backed item extents are relocated. Pillow 12.2.0 accepts the full 6,476-byte AVIF and returns the same 16,384 RGBA bytes as the source image. Fixture SHA-256: 4dfa9e87d65e9365b3e38ab13e67bdceadd9b8eb5ddef273da03eb3057b553d3; decoded pixel SHA-256: 7b62ff36a098d8bdea49e0b72c834b6fd3e4e04f70d884eee274fc69ed869ddd.

make coverage-selected COVERAGE_CASES='decode:avif:alpha_item_icc_profile_ignored' passed 1/1 active parity rows, with no fault-contract rows selected. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T115701.863084Z-64a314be74a24678a7a1b3857cbadd0c/coverage.json (SHA-256 bf5c6f91f25ff11ebbb6d1207655c090da1b0892ac70a537a25d39798c05b47f); its local evidence receipt is SHA-256 2a39ef48184bbe15f4c1b22d395b5afd682b8e2437a0f93b7e83f98eb2254d57. A local comparison with the prior full public run (2,891 active rows) has matching Rust source identity, target, and 32,492-branch denominator. It finds two newly covered branch outcomes: non-empty non-primary ICC projection at src/codecs/avif/container.rs:1123 and descriptor propagation at src/codecs/avif/decode.rs:116. Their union is 18,751/32,492 branches, up from 18,749/32,492. Coverage MCP returned Transport closed; this is local selected evidence and does not claim a managed snapshot or a fresh full-suite run.

10-bit I422 intra CDEF and restoration parity — 2026-10-31

Added active parity row decode:avif:coverage_i422_intra_cdef_restoration_10bit_16x16 for a valid 16×16 10-bit I422 key frame with one CDEF strength set and Wiener restoration on luma. The pinned normal libaom encoder emits both filters without the fixture-only patch used by the separate I420 SGR case. Pillow 12.2.0/libavif 1.4.1 decodes 768 exact RGB bytes. AVIF SHA-256: aa368cf810ef5d48ce300f3582f9574744a1929beeb5525497675176b6b8beac; RGB reference SHA-256: afb7a71a8c86bf53df63a3735752e299ced6712e8b718cf4725fb3a2b61eaec6.

The selected public parity run passed 1/1 with exact 768-byte RGB8 parity. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T114414.774704Z-90300a4cf42540e8801bbdc45efce653/coverage.json (SHA-256 feb1523b659857bb0843b099bb451465290f36e2dfe74f651187869855c929eb); the execution receipt is .coverage-mcp/local-evidence/selected/20261031T114414.774704Z-90300a4cf42540e8801bbdc45efce653/coverage.local-evidence.json (SHA-256 85a86eac52f692d521ba84b16b5ade88a92347f00bf16ac0e8a01134095599ad). The selected report records the intra side of the I422 CDEF || restoration admission at entropy.rs:10851 three times; the earlier full public-parity report, which predates this case, records only the other side there (1,976 hits). Both local receipts report the same entropy.rs source hash. This is a source-matched local coordinate union, not a full-suite or Coverage MCP measurement. Coverage MCP returned Transport closed; no unit tests ran.

AV1 screen-content sequence-flag parity — 2026-10-31

Added active parity rows decode:avif:animated_screen_content_tools_disabled and decode:avif:animated_integer_mv_disabled for the missing selector outcomes in sequence.rs. The first fixture fixes screen-content tools off and removes the now-absent per-frame flag while preserving tile payloads; the second retains selectable screen tools and sets the explicit integer-MV value to zero. The fixtures are SHA-256 d0c88a39ca31c30f56afa5540505d7e20892ed0d9d5339ff843cdf6d9040a357 and 47b3767081913f190e0473842a466a9a81ae4acce5e5099c323c9793187cdcce. Pillow 12.2.0 decodes both with the same five exact frames and 33 ms timing as the source; the independent pinned native observer reports infinite repetition.

The selected public parity run passed 2/2. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T103842.788936Z-e076f8b34a45491a86231c593c1b451f/coverage.json (SHA-256 48035173c8c951419b1ad0a789011a2b033cf6225dd2882f33383ea021ce504c); the execution receipt is .coverage-mcp/local-evidence/selected/20261031T103842.788936Z-e076f8b34a45491a86231c593c1b451f/coverage.local-evidence.json (SHA-256 011343789803c2ad8443f24ac11e54196eae3c548169ef3f1771ced087301cf2). In the selected report, sequence.rs:270 and :275 each record both outcomes, and :276 records the false selector outcome twice. Coverage MCP returned Transport closed for the gap query, so these are local selected-run results, not MCP attribution or a full-repository coverage measurement. No unit tests ran.

AV1 short sequence-header payload parity — 2026-10-31

Added active parity row decode:avif:error_animated_sequence_header_short_payload. Its generator shortens the first sequence OBU by two bytes and uses those bytes for a zero-length OBU_PADDING, preserving the sample length and BMFF offsets. The second sequence header remains intact. Fixture SHA-256: 801608c817468a05bbf62f04ebee2cf5fbe324296c48e98560e7f74350357197. Pillow 12.2.0 fails while loading frame 0 with Failed to decode frame 0: Decoding of color planes failed; the Rust public decode path returns the typed malformed AVIF result after a bounded read past the shortened sequence payload.

The selected public parity run passed 1/1. Its LLVM report records both outcomes at src/codecs/avif/av1/bit_reader.rs:105, including three reads that exceed the OBU payload. The report is .coverage-mcp/local-evidence/selected/20261031T110054.971190Z-f9abe410a4a14c90ae1a0f31e578b01e/coverage.json (SHA-256 aae8efa20a839ec6d73b9d4a3ac35ce14cf1721ae3515f63766dddd488ffd178); its receipt SHA-256 is e2cea0a5f68ddc5533010e44ad9eda7c9e45836cb3e5d2673118ef54af1e6afe. Coverage MCP returned Transport closed for the focused branch query, so this is local selected-run evidence without MCP attribution or a full-suite coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 BT.709 transfer-characteristic parity — 2026-10-31

Added active public parity row decode:avif:animated_transfer_characteristics_bt709. Its deterministic five-frame 64×64 RGB AVIF carries CICP values 1/1/6: BT.709 primaries and transfer characteristics with the BT.601 matrix. The sequence header remains an ordinary 8-bit 4:2:0 AV1 header. Fixture SHA-256: 8b7c981b052241b55112e6ae3ce64b00681c101a25c7d9bd9c9091d727417af2. Pillow 12.2.0 and pinned libavif 1.4.1 decode all five exact RGB frames at 33 ms; the independent native observer reports infinite repetition.

The selected public parity run passed 1/1. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T095637.229277Z-94cba16d6ab042808ecd28a357c4dda7/coverage.json (SHA-256 1dd7df9cd507c60a7b98925856c322e9111cb2fe3c9be406247fdf42b652dfd7); the execution receipt is .coverage-mcp/local-evidence/selected/20261031T095637.229277Z-94cba16d6ab042808ecd28a357c4dda7/coverage.local-evidence.json (SHA-256 d528800b599a9e555c0564e3d28ed8830f8ce36a149064ff8f657bdf2f53f468). Both report inputs remained stable during execution. The selected report shows the false side of the transfer_characteristics == 13 check at sequence.rs:325 three times; the retained 835-case AVIF report has 1,293 true-side hits and no false-side hits at that coordinate. Across seven source-matched local reports, the sequence parser's branch-outcome union is 97/106, leaving nine outcomes uncovered. Coverage MCP returned Transport closed for the gap query and incremental comparison, so these are local measurements, not MCP attribution. No unit tests ran.

AV1 order-hint-disabled public parity — 2026-10-31

Added the active public parity row decode:avif:animated_order_hint_disabled. Its deterministic five-frame, 64×64 RGB AVIF uses ordinary AV1 sequence headers with enable_order_hint=0; the generator clears only BMFF creation/modification timestamps. Fixture SHA-256: 565363788fd1a30cc51b2f3f3d4852a447292646de0b37ab81589590a93e706d. Pillow 12.2.0 and pinned libavif 1.4.1 both decode all five 33 ms frames; the independently compiled libavif observer reports infinite repetition.

The selected public parity run passed 1/1 and retained exact RGB references. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T094727.789608Z-cb2ab3e25ef943ada7b483dd5d2b9f3c/coverage.json (SHA-256 3bd0ca3c0a4e5ea57c27e5754aaad84cb120dff19d4437b75504976add88a0a9); the local execution receipt is .coverage-mcp/local-evidence/selected/20261031T094727.789608Z-cb2ab3e25ef943ada7b483dd5d2b9f3c/coverage.local-evidence.json (SHA-256 a1c063d7b7de2e820c697abb2f14de787eb71032389de43344d048c4b578d714). The receipt records stable source and fixture inputs during execution. In the selected report, sequence.rs has 31/106 covered branch records; lines 268 and 269 take the enable_order_hint false side three times each. The retained 835-case AVIF report had only the true side at those coordinates (450 hits, zero false hits), so this is a new parity-reachable branch outcome. These are selected-run figures, not full-repository coverage. Coverage MCP returned Transport closed for both the gap query and incremental comparison; this is local evidence, not MCP attribution. No unit tests ran.

AVIF encoder option-rejection parity — 2026-10-31

Promoted four Pillow-backed public error cases to active parity: invalid subsampling, the rejected 444 alias, invalid range, and the decoder-only dav1d codec. All four pass through the public AVIF option parser with the expected structured parameter errors before the unimplemented valid encoder path. The selected integration parity run passed 4/4 rows with four public encode calls and no panics. AVIF now has five active encode parity rows and 27 planned encoder rows; this does not establish valid AVIF encoding support.

The local selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T083615.570074Z-46e71977acec41069cdcc45849b07f1f/coverage.json (SHA-256 b270554b7d70455a2a15c1aaff4541d437d5cc633bc71a74066d9ed4569bb491); its receipt is .coverage-mcp/local-evidence/selected/20261031T083615.570074Z-46e71977acec41069cdcc45849b07f1f/coverage.local-evidence.json (SHA-256 0b29aa74101eda5c512dfbe21835b1064ac6efd05323ffe057a28fe7a2a0b0bc). Coverage MCP returned Transport closed for this report, so these results are local selected-run evidence only, not MCP attribution or a full-repository coverage measurement. No unit tests ran.

The complete active AVIF matrix then passed 835/835 rows: 830 decode rows and five encode-error rows. Compared with the previous 831-row AVIF selection, the four newly active option cases added 26 covered source lines, 24 regions, and one function; the selected branch count did not change. Its report is .coverage-mcp/local-evidence/selected/20261031T084427.545666Z-485e0356e2dd4e5eaef3b2d8b5402dfc/coverage.json (SHA-256 4e1804aaa6b54fde293b894e2ed7098e059c44a9704d552a25bc0a95da3f371f), with receipt .coverage-mcp/local-evidence/selected/20261031T084427.545666Z-485e0356e2dd4e5eaef3b2d8b5402dfc/coverage.local-evidence.json (SHA-256 aa48ecaaae3541af54784040cf2645e2cffe850e79cb21cb858cd32360eee0d4). The receipt confirms the matrix and source were stable during execution.

AVIF still-mux native parity — 2026-10-31

The exact integration parity case avif_mux::still_mux_matches_complete_independent_native_files passed 1/1 and checked all 28 complete native mux cases against the Rust still-container writer, including repeat writes and output-size limits. In this selected test only, src/codecs/avif/encode/container.rs covered 451/501 lines, 99/142 branches, 28/49 functions, and 860/1,064 regions. The local report is .coverage-mcp/local-evidence/selected/avif-mux-native-parity-20261031083949Z.json (SHA-256 6d5c95e112ab80ab470a80d0c906a4d91572791f9eb3499db9a97da13aa17d53). These figures are a focused report for that parity test, not full-suite coverage or proof that public AVIF encoding is implemented.

AVIF ICC full-range 4:4:4 pixel parity — 2026-10-31

The complete active AVIF parity selection exposed five ICC and mastering- display fixtures that the portable decoder rejected. Their container CICP is 2/2/6: primaries and transfer are unspecified, while matrix coefficients select BT.601. Added admission for this observed 8-bit, full-range, 4:4:4, no-alpha class in portable_color_conversion; it reuses the existing BT.601 converter, with no change to the per-pixel loop. The five rows icc_profile, icc_ricc_type, icc_mdcv, icc_mdcv_trailing, and duplicate_mdcv_first_wins each passed exact 48-byte RGB parity.

The complete selected AVIF run passed all 831 active rows: 830 decode rows and the active invalid-quality encode row. The local LLVM report is .coverage-mcp/local-evidence/selected/20261031T082030.433884Z-19ab5338b2bd45adbdebab9746728498/coverage.json (SHA-256 0695f404c223aaf6a38e33af9a6aabeeb266beefa2899e50023f888a5bed15f); its receipt is .coverage-mcp/local-evidence/selected/20261031T082030.433884Z-19ab5338b2bd45adbdebab9746728498/coverage.local-evidence.json (SHA-256 25a502c1e74789fa6375b1414e230d99742c1a18412dfd44f8948eeb35ae48a1). The receipt reports stable source and fixture state during the run. Coverage MCP returned Transport closed, so this remains local selected-run evidence, not MCP attribution or a full-repository coverage result. No unit tests ran.

AV1 sequence-header syntax-error parity — 2026-10-31

Added active parity rows decode:avif:error_animated_reduced_header_nonstill, decode:avif:error_animated_invalid_operating_point_idc, and decode:avif:error_animated_initial_display_delay_over_10. Each fixture changes the first sequence header of the five-sample animated_decoder_model_parameters_change.avif. The first sets reduced_still_picture_header while still_picture remains clear (SHA-256 61d55ddcaafde6347e60cc7b9ffe4e2c18ac448f85e14c8d3b6a9a2f0056ff6f); the second changes operating_point_idc from zero to temporal-only value 1 (SHA-256 d5553ed290d398d26ef3e731c98e4bee6b2d8d06b8a00dd4c876d851c61196c0); the third sets initial display delay to 11 (SHA-256 5b1c2097577d75e116016f0760f6c589c12e1304fb42e7ef9a2c982f020b555a). Pinned Pillow 12.2.0 opens each AVIF and fails loading frame 0 with Failed to decode frame 0: Decoding of color planes failed. Rust public decode and decode_sequence return the typed malformed AVIF contract. The selected public parity run passed 3/3.

The local LLVM report is .coverage-mcp/local-evidence/selected/20261031T074426.293493Z-aaa6dabc6484430482a45f6a9a45631e/coverage.json (SHA-256 d34c3037aa56b776e3695fdf9932eb7ba981712459e86e08d745f9b8e6ceb9b6), with its adjacent coverage.local-evidence.json receipt. It records execution at the AV1 sequence-parser conditions sequence.rs:127, :195, and :212; the receipt reports no source or fixture changes during the run. Coverage MCP again returned Transport closed for gap discovery and incremental comparison, so this is local evidence without MCP attribution or an aggregate coverage gain claim. The generator is scripts/generate_avif_sequence_header_errors.py. No decoder source changes or unit tests were added.

A focused follow-up re-ran those three public parity rows and passed 3/3. The selected local LLVM report is .coverage-mcp/local-evidence/selected/20261031T105108.549888Z-f413b92a289a4061ab325c8f5c25f613/coverage.json (SHA-256 b4d672b86a50d8fc6203232720508754025e2c21d493470e6ec15b85be48b81a); its receipt is .coverage-mcp/local-evidence/selected/20261031T105108.549888Z-f413b92a289a4061ab325c8f5c25f613/coverage.local-evidence.json (SHA-256 0d08d18804417ab3d65ae64866001c696e28dab1d4a662692cca608ab95c33bc). Across 16 local reports with matching source manifest and sequence.rs hashes, the branch-outcome union is 102/108 across 54 coordinates. The six absent outcomes are the two sides of three zero-count records at sequence.rs:347 columns 8–32 and 36–67, and sequence.rs:352 columns 31–42. Two ranges extend beyond their current source lines; the existing malformed cases return before the final sequence fields. No additional reachable parity case is indicated. Clearing the trailing marker in a candidate AVIF does reach the Rust public error AV1 trailing marker bit is not set, but Pillow 12.2.0 recognizes its five frames and decodes frame 0. That candidate was not promoted because it would assert behavior that differs from the reference decoder. Coverage MCP returned Transport closed for the focused report as well, so this remains local evidence without MCP attribution. No unit tests ran.

Repeated AV1 sequence-header color-primaries parity — 2026-10-31

Added active parity row decode:avif:error_animated_sequence_color_primaries_change. The fixture changes only color_primaries from 1 to 9 in the second AV1 sequence header of a two-frame AVIF. Its SHA-256 is 3a4039604a7bf10739a7bcdf5a32c406c3ed5b772b9fdad58a88e73bc6571588. Pinned Pillow 12.2.0 opens the first frame and reports Failed to decode frame 1: Decoding of color planes failed; the Rust public sequence decoder returns the Malformed contract. The selected parity case passed 1/1 with exact 67,500-byte RGB8 parity for frame 0 and the expected sequence error.

Before this row was added, the full active public parity selection passed 2,866 cases (2,324 decode and 542 encode). Its local LLVM report is .coverage-mcp/local-evidence/full/20261031-current-all-public-parity/coverage.json; the adjacent coverage.local-evidence.json is its local receipt. The new selected report is .coverage-mcp/local-evidence/selected/20261031T072616.189147Z-05c9273289c9438784a950f05ae1f8be/coverage.json; its adjacent receipt records the src/codecs/avif/av1/frame.rs sequence-header mismatch branch as executed. Coverage MCP returned Transport closed for the gap and comparison queries, so these are local LLVM observations without MCP source/build attribution. This is not a full-coverage claim. No Rust decoder source change or unit test was added.

AV1 frame-ID wrap reference-slot parity — 2026-10-31

Added active parity row decode:avif:animated_frame_id_wrap_contiguous. This valid two-frame sequence changes the IDs from 4,626 and 4,627 to 32,760 and 10, with all seven reference deltas updated from 1 to 18. The IDs wrap in the 15-bit range while preserving the decoded reference. Its AVIF SHA-256 is 8a53bf96c97b66d07b849ec6e4a6dcf18f37ab9db5b3edb045f2b357bd59e35e. Pillow 12.2.0 and the pinned native libavif observer preserve both exact 16x16 RGB frames; the selected Rust parity case passed 1/1 with exact 768-byte output.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T065142.055821Z-aee60d3386414efb9e57745ca09fac8c/coverage.json (SHA-256 419acd20d6901b9105cf3b658ce42bd8985e4b52721a464fc1c6a7a6204481ee); its local receipt is .coverage-mcp/local-evidence/selected/20261031T065142.055821Z-aee60d3386414efb9e57745ca09fac8c/coverage.local-evidence.json (SHA-256 4875ac0a4575dd7d07bfed568a87c4edb97475b478c15ff10256fc1634ae6f77). The frame.rs source hash is 2fac0b2d4395417b17ca45b9a0dcfa432d3dc44601e762628c935bcff6229549 in both this report and the retained full-active report. At line 840, invalidate_reference_slots records 8/0 for the wrapped reference comparison; the full-active baseline records 0/8. A second zero-count instrumented crate instance remains. Coverage MCP again returned Transport closed for both the filtered gap query and incremental comparison, so this is local same-source evidence only, not MCP attribution or full-suite coverage. Source and fixture hashes remained stable during the selected run. No unit tests or decoder-source changes were added.

The current fixture matrix contains 2,915 total rows: 2,342 decode / inspect / verify rows and 573 encode rows. Of those, 2,342 decode rows and 546 encode rows are active; 27 encode rows are planned. AVIF has 842 active decode rows.

High AV1 frame-ID reference-slot parity — 2026-10-31

Added active parity row decode:avif:animated_frame_id_high_contiguous. The deterministic fixture advances the source sequence's frame IDs from 4,626 and 4,627 to 20,000 and 20,001, preserving the one-step reference delta while crossing the 14-bit delta range. Its AVIF SHA-256 is 25c5e52ca0759816ce94f4aa5d2be42ed99353a004da85e1cf80e8006925eecf. Pillow 12.2.0 preserves both exact 16x16 RGB frames; the pinned native libavif observer decodes both frames and confirms the infinite-loop count. The selected Rust parity case passed 1/1 with exact 768-byte pixel output.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T064556.796593Z-81144245b41744e08257b6a4ff49d114/coverage.json (SHA-256 1f480551f013385ea93f95f76d3591209be466360dbc977f4930c3984eba1acd); its local receipt is .coverage-mcp/local-evidence/selected/20261031T064556.796593Z-81144245b41744e08257b6a4ff49d114/coverage.local-evidence.json (SHA-256 be8b31dbf69d1251a25b14edd9de04a33f5876c231300a0555d7c638800e9ef9). The source hash for src/codecs/avif/av1/frame.rs is 2fac0b2d4395417b17ca45b9a0dcfa432d3dc44601e762628c935bcff6229549 in both the selected report and the retained full-active report. At line 836, invalidate_reference_slots records 8/0 for the high-ID comparison in this selected run; the full-active baseline records 0/8. A second zero-count instrumented crate instance remains in the selected report. Coverage MCP returned Transport closed for both the filtered gap query and the incremental comparison, so these counts remain local same-source evidence, not MCP attribution or a complete-coverage claim. Source and fixture hashes remained stable during the selected run. No unit tests or decoder-source changes were added.

One-pixel AV1 super-resolution edge-tile fallback parity — 2026-10-31

Added active parity row decode:avif:portable_lossless_monochrome_multitile_superres_narrow_edge_145x64 for a 145x64 all-lossless monochrome frame coded at width 129 with two tile columns. The final coded tile contains one visible pixel; denominator-9 super-resolution restores the display width to 145. The deterministic narrow-edge-tile generator profile double-encodes and pins the AV1 seed, checks the two-column geometry, and verifies Pillow's exact 27,840-byte RGB reference (1a3a18cc362bf40b0001563429b6446baca238f80a7a23adb6fbb54a3d12fd55). The 8,491-byte AVIF SHA-256 is aa73cdf640627b55ea1cc7a35af26a42f92bce39c504911c0e0fee6124905320. Selected parity passed 1/1. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T063147.868326Z-5fdf2f844d654d97b5436b743e691c46/coverage.json (SHA-256 54c407b9e67c3391072f91c256b359d409a67af7d782ac76b8866d25fa7e0b11); the receipt is .coverage-mcp/local-evidence/selected/20261031T063147.868326Z-5fdf2f844d654d97b5436b743e691c46/coverage.local-evidence.json (SHA-256 ffc1485c57dadff1d49278b2fc2cb6c7bebf3361118fbca0dc87dac0d294f8ad).

Compared with the retained 2,847-case full-active report at .coverage-mcp/local-evidence/selected/20261031-full-active-parity-current/coverage.json (SHA-256 1381ecc6baa8789346d4b32ce36ca365457515050eef7f5dabca96f601794d2e), whose frame.rs (2fac0b2d4395417b17ca45b9a0dcfa432d3dc44601e762628c935bcff6229549) and entropy.rs (17895a0a44369f11eb95a4d34923a295e2f8868eabeb0492cf587f0d10720399) source hashes match this selected receipt, this input newly covers two branch spans in src/codecs/avif/av1/frame.rs and 66 in src/codecs/avif/av1/entropy.rs. At the targeted frame fallback spans :3157 and :3158, one LLVM observation records 3/0 and another remains 0/0. This is a local same-source coordinate comparison, not Coverage MCP attribution; Coverage MCP returned Transport closed for the filtered branch query. The source did not change during the selected run, and the receipt binds the row to the fixture and Pillow reference. No Rust unit tests or decoder source changes were added.

After adding the high-frame-ID parity row, the fixture matrix contained 2,894 total rows: 2,321 decode / inspect / verify rows and 573 encode rows. Of those, 2,321 decode rows and 542 encode rows were active; 31 encode rows were planned. AVIF had 821 active decode rows.

Lossless multi-tile AV1 super-resolution parity — 2026-10-31

Added active parity row decode:avif:portable_lossless_monochrome_multitile_superres_256x64 for a 256x64 all-lossless monochrome frame coded at width 228 with two tile columns and denominator-9 super-resolution. Its deterministic generator double-encodes the pinned seed, validates the patched AV1 and AVIF headers, and pins a 49,152-byte Pillow RGB reference (bc51fcf2f5bfe8ddd2d500f0ac1ef8fface82095da5127792ca79461518553a3). The 14,762-byte AVIF SHA-256 is 47d5096e64a5d61a6247575f645490813a55ba2ddd4c77379987c1a37ea6dd91. Selected parity passed 1/1. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T062505.670607Z-f98aef99a4354c728c51ad3edf237fdd/coverage.json (SHA-256 4d2f3ec78f1df5c4359b3791eda31c53c6cab8980d1fc1a8561da6c6831e0510); the local receipt is .coverage-mcp/local-evidence/selected/20261031T062505.670607Z-f98aef99a4354c728c51ad3edf237fdd/coverage.local-evidence.json (SHA-256 e303517212bde0049082d0f44d218728cdb1e7dfdcd64ca21b73af94652de36d). Compared with the retained 2,847-case full-active report .coverage-mcp/local-evidence/selected/20261031-full-active-parity-current/coverage.json (SHA-256 1381ecc6baa8789346d4b32ce36ca365457515050eef7f5dabca96f601794d2e), this selected run newly covers the multi-tile guard branch at src/codecs/avif/av1/entropy.rs:18123 (0/0 to 12/0). The source file SHA-256 is identical in both reports (17895a0a44369f11eb95a4d34923a295e2f8868eabeb0492cf587f0d10720399). This is a local same-source branch comparison, not Coverage MCP attribution. The full-width input leaves the frame fallback at src/codecs/avif/av1/frame.rs:3157 unhit (0/0); the one-pixel edge parity case above now covers it. Coverage MCP returned Transport closed for the branch query, so no MCP source attribution or full-suite coverage claim is made.

At the time this full-width parity row was added, the fixture matrix contained 2,892 total rows: 2,319 decode / inspect / verify rows and 573 encode rows. Of those, 2,319 decode rows and 542 encode rows were active; 31 encode rows were planned. AVIF had 819 active decode rows. No Rust unit tests or decoder source changes were added.

AV1 lossless monochrome super-resolution branch parity — 2026-10-31

Added active parity row decode:avif:portable_lossless_monochrome_superres_clamped_3x3 for a 3x3 all-lossless monochrome key frame that enables super-resolution at the minimum-width clamp. The deterministic generator validates the AV1 syntax, pins the asset, and verifies Pillow's exact 27-byte RGB reference (d3032e6d59449568a19027d012277ab23dc9843f5293220df001c16217a6e35f). The selected parity run passed 1/1. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T060823.106357Z-6f30555f91514a92bfc0001557e86c6c/coverage.json (SHA-256 53509c58f49232f85e4c163e688c045a09f0797e672f6674089e9e24b2e4d870); the local receipt is .coverage-mcp/local-evidence/selected/20261031T060823.106357Z-6f30555f91514a92bfc0001557e86c6c/coverage.local-evidence.json (SHA-256 14f5039902259448ecf48efd133fc724e9ea62e72d4e9b192032170a51dd6f9b). At src/codecs/avif/av1/frame.rs:3139, one exported branch observation has counts 3/0 and a second observation at the same span has counts 0/0. The report thus records the true edge in one instance; it does not establish coverage of every instance. The receipt records the selected case and that source did not change during the run. Coverage MCP returned Transport closed for the branch query, so this remains local selected-coordinate evidence without MCP attribution or a full-suite coverage claim.

At the time the clamped 3x3 parity row was added, the fixture matrix contained 2,891 total rows: 2,318 decode / inspect / verify rows and 573 encode rows. Of those, 2,318 decode rows and 542 encode rows were active; 31 encode rows were planned. AVIF had 818 active decode rows. No Rust unit tests or decoder source changes were added.

AV1 monochrome super-resolution sequence parity — 2026-10-31

Added active parity row decode:avif:animated_monochrome_superres_sequence_17x16 for a two-frame, 8-bit monochrome sequence with super-resolution and SGR restoration. The deterministic generator validates the AV1 profile and pins Pillow 12.2.0 frame bytes. Selected parity passed 1/1 with exact 816-byte RGB output per frame. The local LLVM report is .coverage-mcp/local-evidence/selected/20261031T054246.676014Z-eee15edc148f45e496c4333669768089/coverage.json (SHA-256 6d9a7967449a7bd234d01223f4154b094dea352a1581e723013bcdf2c373febe). It does not record hits on the intended AV1 frame fallback branch at frame.rs:3139; Coverage MCP closed the connection, so no MCP attribution is claimed. This parity case does not close that coverage gap. At the time this sequence row was added, the public fixture matrix contained 2,890 total rows: 2,317 decode / inspect / verify rows and 573 encode rows. Of those, 2,317 decode rows and 542 encode rows were active; 31 encode rows were planned. AVIF had 817 active decode rows. No Rust unit tests or decoder source changes were added.

Full coverage refresh and JPEG fast-path trial — 2026-10-25

At cf4ff290adf7ffd3296a9aea16be1884f458b644 (the merged PR #87 revision), make coverage passed the all-feature matrix and the configured release floors: 93,692/139,473 lines (67.175726%), 18,575/32,068 branches (57.923787%), 5,213/8,917 functions (58.461366%), and 143,029/216,455 regions (66.077938%). The local LLVM report is retained at .coverage-mcp/local-evidence/full-20261025-pr87-main-refresh/coverage.json with SHA-256 b91003d65bc8581a6d69f1e63a39493a0a0ecf1943dd16e9db7c0b23a1cce431. The report has no Coverage MCP source/build receipt. A branch-gap query against it failed because the local Coverage MCP daemon did not become healthy, so no MCP gap groups or test attribution are claimed from this refresh. Raw LLVM data still contains repeated AV1 monomorphization observations; inspect each source path and establish a valid public input before adding parity rows. The 100% coverage objective remains open.

AV1 mixed-lossless B32 specialization probes — 2026-10-25

The existing public rows decode:avif:animated_mixed_lossless_inter_b32_i420_64x64 and decode:avif:animated_mixed_lossless_inter_b32_i420_residual_64x64 each passed their selected Pillow pixel-parity run (1/1, 12,288 output bytes). The second fixture changes every pixel in its qindex-zero B32 ROI between frames, so it also tests nonzero residual data. Their selected LLVM reports are retained at .coverage-mcp/local-evidence/selected/20261025T073910.795480Z-8a6d417b1768484fa50917b63d8c5b26/coverage.json and .coverage-mcp/local-evidence/selected/20261025T074319.862204Z-46ea5372d9c04f43ace4546c46a5da66/coverage.json. Both local receipts record that source did not change during execution.

Neither selected report records branch hits at block.rs:48152 or block.rs:48160 in the active decode_inter_translation_impl instances. The residual case reaches the mixed 8-bit lossless geometry admission path in entropy.rs, but it does not exercise the decoder specialization behind those branches. These are useful parity controls, not coverage gains; no additional fixture was added from them. Coverage MCP reports the selected reports as source-unverified with test attribution unknown, so the local branch data is coordinate-only and makes no aggregate coverage claim. Find a public input that reaches the decoder specialization before adding a parity row.

A temporary JPEG 4:2:0 encoder fast path passed a constant all-present mask to the DC predictor for complete MCUs. Seven release A–B–B–A rounds on the Apple M3 Pro measured the public 1024×1024 RGB, quality-85, 4:2:0 encode. The candidate's median paired ratio was 1.016× the baseline (about 1.6% slower), with host load averages between 6.3 and 7.5. Both builds emitted 793,139 bytes with FNV-1a d748543a168ce6aa in every measured call. The candidate was discarded; this experiment did not run the Pillow parity lane and establishes no speedup.

10-bit I420/I422 intra filter parity — 2026-10-31

Coverage MCP identified the missing positive arm of bounded_i420_intra_restoration at src/codecs/avif/av1/entropy.rs:10827. Added active parity row decode:avif:coverage_i420_intra_restoration_10bit_16x16. The deterministic generator creates a 10-bit I420 source, repeats the pinned libavif/libaom encode, validates the AV1 OBU syntax, and checks the exact Pillow 12.2.0 RGB reference. AVIF SHA-256: c508ed4754d696d6b3240ca552dd61a1481c062c9537904183c4657b13bc5f7f. Selected parity passed 1/1 with exact 768-byte Rgb8 output. Its LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-i420-intra-restoration-10bit/coverage.json (SHA-256 1dcffa5b2cc25b6aed718a141105fe7617d4c90b3237a028d5333a5dbd1a4317). Coverage MCP finds no remaining branch gap at the I420 admission branch in the parent validator at entropy.rs:10827. The positive Some(quantization) path is covered in complete_bounded_i420_restoration_intra_reconstruction_context; its no-quantization early-return branch at entropy.rs:14353 remains uncovered.

Added the active parity row decode:avif:coverage_i422_intra_restoration_10bit_16x16 for a 10-bit I422 still frame with Wiener luma restoration and no CDEF. Its selected parity run passed 1/1 with exact 768-byte Rgb8 output. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-i422-intra-restoration-10bit/coverage.json (SHA-256 5a4fc31f6ea948cc086c21c2876029b24ebd1be5c7cc60e6ca9a79e810dd9d91). On the final full report, Coverage MCP shows the I422 restoration admission path covered: the parent branch at entropy.rs:10821 has no remaining gap, and the Some(quantization) path is covered in complete_bounded_i422_restoration_intra_reconstruction_context. Its no-quantization early-return branch at entropy.rs:14209 remains uncovered.

Added active parity row decode:avif:coverage_i420_intra_cdef_10bit_16x16 for a 10-bit I420 key frame with CDEF enabled and restoration disabled. Its generator repeats the pinned libavif/libaom encode, checks the AV1 OBU profile and CDEF strengths, and pins the Pillow 12.2.0 RGB bytes. The AVIF SHA-256 is 3407c458add1348d2e0f0a73f8aaaa862fd435a18eb7c563b8461d89541656d2. Selected parity passed 1/1 with exact 768-byte Rgb8 output. Its LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-i420-intra-cdef-10bit/coverage.json (SHA-256 edb903e6a41bb879b332b9bf6eaf5b7f1d88d45174d109aa41f6b2803f13e84e). Coverage MCP finds no remaining branch gap at the parent CDEF admission at entropy.rs:10832; the positive quantization path is covered. The no-quantization early return at entropy.rs:14504 remains uncovered.

Added the matching 10-bit I422 case, decode:avif:coverage_i422_intra_cdef_10bit_16x16, with CDEF enabled and restoration disabled. It passed selected parity 1/1 with exact 768-byte Rgb8 output. Its AVIF SHA-256 is 40e0090f85088bdef2e7cf08910002dd2dc48e95637c976173e71a9326a22352; its selected LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-i422-intra-cdef-10bit/coverage.json (SHA-256 ef3a7ab7a8ae3162749be88f052dcc65174dedadbc819bce34d86146b43aedff). Coverage MCP finds no remaining branch gap at the parent I422 CDEF admission at entropy.rs:10837; the positive quantization path is covered. Its no-quantization early return at entropy.rs:14596 remains uncovered.

The refreshed full all-feature coverage run passed, including all 57 coverage-matrix tests and 69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full/20261031-av1-intra-filters-i420-i422-current/coverage.json (SHA-256 283711e7dd2539c825642c64d2ec5bdef7a68b965a0fb3e89a8ec10b214a079a). It records 98,559/140,221 lines (70.288331%), 19,640/31,498 branches (62.353165%), 5,458/8,998 functions (60.657924%), and 150,308/217,537 regions (69.095372%); all configured floors pass. Relative to the preceding full report, this run adds 11 covered lines, 9 branches, 1 function, and 10 regions. Coverage MCP still reports 139 missed branch observations in validate_complete_lossy_420_partition, 11 in bounded I422 CDEF/restoration inter admission, and 6 in monochrome multi-tile CDEF admission. The report has unverified source identity and unknown test attribution, so it does not establish named-test attribution or a regression comparison. The matrix now contains 2,875 rows, including 2,302 active decode rows and 802 active AVIF decode rows. No Rust unit tests were added.

AV1 monochrome multi-tile filter parity — 2026-10-31

Added active parity row decode:avif:coverage_monochrome_multitile_cdef_8bit_128x64 for an 8-bit monochrome key frame with two tile columns, CDEF, and no loop filtering or restoration. Its AVIF SHA-256 is ea6c16c86c07414bfa3f71f1132af6494c4d7f6cb5015d5b98bfc94e09e5d73b; the 24,576-byte Pillow RGB reference SHA-256 is 0d9fa687322831cf61ae6cd8b2cba87ee78bbb071641aada0f2879667bebd3b8. Selected parity passed 1/1. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-multitile-cdef/coverage.json (SHA-256 7451ba741cee29590e5704b18cd51a832e0c3ec665aff251494e095386937e1a).

Added the combined-filter row decode:avif:coverage_monochrome_multitile_loop_cdef_8bit_128x64. It uses the same source and tile layout with nonzero luma deblocking and CDEF syntax. Its AVIF SHA-256 is f81ad82e033b3d36cd1c92ab97e296a1b4c3ea5308cd12c919e748a8304ce282; the 24,576-byte Pillow RGB reference SHA-256 is 2b228a77b35dad05b440b250ee3eee71d858a8561dde92a71634e8cccfffbb57. The pinned generator checks both profiles using libavif 1.4.1, libaom 3.13.2, and Pillow 12.2.0. Selected parity passed 1/1 with exact RGB output. Its retained LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-multitile-loop-cdef-receipted/coverage.json (SHA-256 d0b90f4c16d0366192fde9d5970f57201f6cdc10dad8cdd9d75416b21043d325); the local evidence receipt SHA-256 is a378aa4b622ad8661457ef117331849ec1f33bec2dbcaa78ad9933684afa29b7.

Added the active-strength case decode:avif:coverage_monochrome_multitile_loop_cdef_active_8bit_128x64. It uses the same source and tile layout with CDEF strength 44, luma deblocking level 56, and no restoration. Its AVIF SHA-256 is 229af13b8ae6f1e69ce316e74c42d2d225d3ce479bececd45c5ff2059502d763; the 24,576-byte Pillow RGB reference SHA-256 is 04fe662bfb299b49c6f8117c02278c3b94a80c18f388ca2c5f7370732af460e5. Selected parity passed 1/1 with exact RGB output. Its retained LLVM report is .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-multitile-loop-cdef-active/coverage.json (SHA-256 28daed932a725a3604f4db32d33a6b40d6fbca35d8ee73b0c132d9e29047265e); the local evidence receipt SHA-256 is f9ed0ca51d21a0fb58b892d70c0263ffe73e61ad2f7aaf7cf7d3e2182689eab7. Coverage MCP's selected comparison against the zero-strength combined-filter case reports 15 newly observed branch outcomes: 8 in direction_for_block, 3 in constrain, 2 in adjust_primary_strength, and 2 in finish_monochrome_with_cdef. It reports no added branch universe. Source identity is unverified and test attribution is unknown, so these are report coordinate observations rather than verified source or named-test attribution.

The refreshed all-feature coverage run passed all 57 coverage-matrix tests and 69 feature-gate tests. The latest report is .coverage-mcp/local-evidence/full/20261031-av1-monochrome-multitile-active-loop-cdef-current/coverage.json (SHA-256 6fdb2012499226fda522ba3be73e678ad2a3244241a19d43b6cd55f728879e68). It records 98,559/140,221 lines (70.288331%), 19,641/31,498 branches (62.356340%), 5,458/8,998 functions (60.657924%), and 150,308/217,537 regions (69.095372%); all configured floors pass. Its aggregate totals match the preceding full report. Coverage MCP's full comparison reports no changed branch observations; source/build identity is unverified and test attribution is unknown, so this does not establish a verified regression or named-test attribution. The latest report still has 18 missed branch observations in complete_monochrome_multitile_loop_cdef_reconstruction_context; in src/codecs/avif/av1/cdef.rs, the largest reported groups are 11 in filter_block_into, 5 in direction_for_block, 2 in sample_at, and 1 in maximum_sample. The matrix now contains 2,878 rows, including 2,305 active decode rows and 805 active AVIF decode rows. No Rust unit tests, decoder source changes, or SIMD benchmarks were added in this parity slice.

AVIF reordered meta handler parity — 2026-10-31

Coverage MCP identified the unobserved first-child handler rejection in the container projection parser. Added active parity row decode:avif:error_meta_reordered_handler, derived from baseline.avif by moving its valid picture hdlr child after pitm while preserving file size and all AV1 media bytes. Fixture SHA-256: 75d67ac340bfec40e5bce5e0f5d19d769053ec5fe774989fd56cb90b32392516. Pillow 12.2.0 rejects the complete input at open. The first parity run showed that inspection rejected the file but full decode accepted it. The sample parser now enforces the required first-child handler for both paths, and the container projection no longer repeats that check. Selected parity passed 3/3 with the new case and the two existing metadata-handler error controls. Its LLVM report is .coverage-mcp/local-evidence/selected/20261030T195351.283475Z-c5a2286e179e40aa9ff2938157a1d568/coverage.json (SHA-256 a5be17a1d858e08d1dbb5d23d52fdfb8d3d4b593190e3a412cdd49d00b5398c2). Coverage MCP reports no remaining branch gaps at samples.rs:522 or in container::parse_meta for that full run's inventory.

The refreshed full all-feature LLVM run passed. Its report is .coverage-mcp/local-evidence/full/20261031-meta-handler-order-parity/coverage.json (SHA-256 6c7809dfece5341bed6a054bb0ea66e29bc9e75784d13e4499b910dace2a5502). It records 98,506/140,282 lines (70.219985%), 19,945/32,086 branches (62.161067%), 5,435/8,981 functions (60.516646%), and 150,307/217,737 regions (69.031446%); all configured floors pass. The report has unverified source identity and unknown test attribution, so it is not used to claim a regression or a percentage-point gain against managed historical measurements.

The current public fixture matrix contains 2,882 total rows: 2,309 decode / inspect / verify rows and 573 encode rows. Of those, 2,309 decode rows and 542 encode rows are active; 31 planned encode rows remain. AVIF has 809 active decode rows. No Rust unit tests were added.

AVIS movie without a picture track parity — 2026-10-31

Coverage MCP identified the uncovered empty-track rejection in samples::parse_movie at samples.rs:2136. Added the active parity row decode:avif:error_avis_moov_without_trak. Its full-file fixture derives from animated.avif by removing the sole moov/trak while retaining ftyp, meta, moov/mvhd, and the complete mdat media payload. Pillow 12.2.0 rejects the file at open. Fixture SHA-256: b7bad81724df0c975c0ba70935f07ade291f5aa55f9b539b230bbb7bfe00562f. The deterministic generator validates the box layout, preserved media bytes, fixture hash, and Pillow rejection. Selected parity passed 1/1; the selected LLVM report is .coverage-mcp/local-evidence/selected/20261030T193551.913677Z-700fd071206e458cbcf56d745ee61d1c/coverage.json (SHA-256 486111d1262c13a7f38e9efe108cfbc925b3bbb6269968be7e5d69b06f8d4ee1).

The refreshed full all-feature LLVM run passed, including 57/57 coverage-matrix tests and 69/69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full/20261031-avis-moov-track-parity/coverage.json (SHA-256 76b5ec93f1fea8010fa0fde49c736159b3684b51f4f0d8663a8e4c08b6853460). It records 98,508/140,282 lines (70.221411%), 19,947/32,086 branches (62.167300%), 5,436/8,981 functions (60.527781%), and 150,315/217,736 regions (69.035437%); all configured floors pass. Coverage MCP no longer reports the missing branch at samples.rs:2136; the separate container projection parser still has an uncovered empty-track guard at container.rs:1525. The local report has unverified source identity and unknown test attribution, so it is not used to claim a regression or a percentage-point gain against managed historical measurements.

The current public fixture matrix contains 2,868 total rows: 2,296 decode / inspect / verify rows and 572 encode rows. Of those, 2,296 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 796 active decode rows. No Rust unit tests were added.

AVIF primary item missing spatial extent parity — 2026-10-31

Coverage MCP's retained full report left one missing branch in container::inspect_inner_with_grid. Added the active public parity row decode:avif:error_primary_item_missing_ispe. Its full-file input derives from baseline.avif by clearing the primary AV1 item's ispe association; box sizes and encoded AV1 media bytes remain unchanged. Fixture SHA-256: 475d45c0c712b011983d6d946a2e3ce4512d7968664853b0a6953fa7da0c06f7. Pillow 12.2.0 rejects the complete file at open. The first Rust parity run accepted its pixels, exposing a decoder validation gap. The decoder now rejects an av01 primary item without spatial dimensions, while inspection still reaches the container's missing-details rejection. The focused parity run passed 3/3: this row, the unsupported-primary-type error control, and the AVIF baseline pixel control.

Its selected LLVM report is .coverage-mcp/local-evidence/selected/20261030T192341.164267Z-3d05e558fab94ebd9f9ce2ad37f3f7c3/coverage.json. The fresh full all-feature LLVM run passed, including 57/57 coverage-matrix tests and 69/69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full/20261031-primary-ispe-parity-final/coverage.json (SHA-256 b821c8af1f464dfde0e0cdac95204d6a44aba5fd51e241724c4773aacd825d67). It records 98,507/140,282 lines (70.220698%), 19,946/32,086 branches (62.164184%), 5,436/8,981 functions (60.527781%), and 150,314/217,736 regions (69.034978%); all configured floors pass. Coverage MCP's filtered branch queries return no missing groups for samples::parse_ftyp or container::inspect_inner_with_grid. Other AVIF parser and container gaps remain. The local report has unverified source identity and unknown test attribution, so it is not used to claim a regression or a percentage-point gain against managed historical measurements.

The current public fixture matrix contains 2,867 total rows: 2,295 decode / inspect / verify rows and 572 encode rows. Of those, 2,295 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 795 active decode rows. No Rust unit tests were added.

AVIF lossless 4:2:0 grayscale texture parity — 2026-10-30

Added the active public parity row decode:avif:portable_lossless_420_gray_texture_8x8 for an 8x8 full-range, all-lossless I420 image with nonzero luma residuals and neutral chroma. The deterministic generator verifies the pinned Pillow/libavif versions, AV1 headers, repeated encoded bytes, and exact 192-byte RGB output. The fixture SHA-256 is 4d4caeb830d6775b0c82172b60cacae07b0945a419cecb44680394f4337eef65; the expected RGB SHA-256 is 6596205a5d46da184e167b8f3b5eb0aa586091b0e83f7368b79f3992a4786242. Selected public parity passed 1/1. Its LLVM report is .coverage-mcp/local-evidence/selected/20261030T174112.238658Z-a451598c3be04a80998eb593288d9435/coverage.json (SHA-256 ab47bff39c7630e59c956bdeb7e99b4c17031dd18b91bfdb2a31173eec1e4f4a). The report is selected-scope evidence with unverified source identity and unknown test attribution. Coverage MCP confirms this input does not execute the previously targeted decode_syntax_with_cdef_with_lossless_square64_arena branch at block.rs:21001; no branch-gain claim is made for that location. No Rust unit tests were added.

AVIF lossless 4:2:0 color texture parity — 2026-10-30

Added the active public parity row decode:avif:portable_lossless_420_color_texture_8x8 for an 8x8 full-range, all-lossless I420 image whose 2x2 cells cycle through red, green, blue, and yellow. The pinned Pillow/libavif generator checks repeatable AVIF bytes, sequence/frame headers, and exact 192-byte RGB output. Fixture SHA-256: eba2565967dbab65b88d58c6855ee920d06f69ef39ed610306cff3e322beb0a2; expected RGB SHA-256: 8099fa1157400c228f24ce0e41a6f9c59cc73c8be02953024a92761dba0db709. Selected public parity passed 1/1. Its LLVM report is .coverage-mcp/local-evidence/selected/20261030-color-texture-8x8-r1/coverage.json (SHA-256 1f5cc7617d2f5af967998fb3a218c8bcd9e690d35990d387cab965e1f8bb8bfe).

The selected report records zero invocations of decode_dc_coefficients and the targeted lossless 4:2:0 leaf decoders. Coverage MCP still reports the branch group at block.rs:21001 and the conditional at block.rs:8753 as unobserved. A selected run of the existing 16x16 lossless I420 case also passed 1/1 without invoking those decoders. Its report is .coverage-mcp/local-evidence/selected/20261030-existing-lossless-square-16x16-r1/coverage.json (SHA-256 0b8d2afd6a2f70204c4d7163bb8cfc91e9164570fa153fb4624325a5154f04de). The incremental comparison with the retained full report is incomparable because its branch detail is incomplete; this fixture is useful parity coverage, but no coverage gain is claimed. The public fixture matrix now contains 2,866 total rows: 2,294 decode / inspect / verify rows and 572 encode rows. Of those, 2,294 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 794 active decode rows. No Rust unit tests were added.

AVIF still duplicate top-level metadata after mdat parity — 2026-10-31

Coverage MCP's retained full report grouped missing branches in samples::extract_inner_with_metadata at samples.rs:2857. The existing animated duplicate-metadata row uses the avis brand and takes the earlier sequence-specific branch at samples.rs:2852. Added the active public parity row decode:avif:still_duplicate_top_level_meta_after_mdat, derived from grid.avif by appending its complete top-level meta box after mdat while preserving every original byte. The fixture SHA-256 is 2279761c577c985f0c3ccfbe19a02a89f05c5fa16fb3dc1516bd5ebeb3c6702d. Pillow 12.2.0 preserves the original RGBA 80x80 metadata and exact 25,600 pixel bytes; selected public parity passed 1/1. The expected pixel SHA-256 is 4ede0d909351b9b09c7e3e9475bfd3baf458141dbdd08f08aee19c11d2ec2983.

The selected report is .coverage-mcp/local-evidence/selected/20261031-still-meta-after-mdat-r1/coverage.json (SHA-256 b0970b5aaf9ac4b2b8481b94357beb47dafbed1292dcd8f0f0836e3abe628220). Its local receipt binds the run to source manifest hash e66ba336597b9c6ee8e58f9e57e74f41160adeb0bd716cbb4ef1145e931d197a, records the selected row passing, and confirms source files did not change during the run. Raw LLVM branches record four true-outcome hits at samples.rs:2857 in the lazy and bounded item-extent parser instantiations. Coverage MCP still lists missing observations in other monomorphizations and reports source identity unverified and test attribution unknown. The incremental comparison against the retained selected report is incomparable because its branch detail is incomplete; no aggregate coverage gain is claimed. The matrix now contains 2,866 rows, including 794 AVIF decode rows. No Rust unit tests were added.

AVIF unsupported primary item type — 2026-10-30

Coverage MCP reports had grouped missing observations in samples::item_ids. Source inspection identified an unsupported primary-item kind as a public edge case. Added the active parity row decode:avif:error_unsupported_primary_item_type. Its full-file input derives from grid.avif by changing only the primary item's declared type from grid to Exif; all box sizes and AV1 payloads are unchanged. The fixture SHA-256 is 9285db1aa6df2d36c4d02fa8f2efedeac2f3ca48fc5f6aec64488893c3e3b9b8. Pillow 12.2.0 rejects it with Failed to decode image: Missing or empty image item, and selected Rust parity passed 1/1 with the same rejection. The input passes through both supported-kind comparisons and reaches the unsupported-kind fallback.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261030T151646.164961Z-db210ab045ec49339a6588488b31700a/coverage.json (SHA-256 42644ebe7948b11f74deae21718c07137a088645bef6f987f4da374068a36ba7). Its raw branch records at samples.rs:1984 and samples.rs:1985 each show six visits to the false arm. Coverage MCP returns duplicate groups and marks source identity unverified and test attribution unknown, so this is targeted path evidence rather than an aggregate coverage-gain claim. An incremental comparison was incomparable because the saved full report lacks complete branch detail. The current public evidence matrix contains 2,864 total rows: 2,292 decode / inspect / verify rows and 572 encode rows. Of those, 2,292 decode rows and 541 encode rows are active. AVIF has 792 active decode rows. No Rust unit tests were added.

AVIF duplicate container empty-grid guard — 2026-10-30

A fresh full make coverage run passed all six integration executables, including 57/57 coverage-matrix cases. It measured 98,483/140,287 lines (70.2011%), 19,936/32,104 branches (62.0982%), 5,434/8,983 functions (60.4920%), and 150,318/217,777 regions (69.0238%), above the configured floors but below the 100% goal. The retained report is .coverage-mcp/local-evidence/full/20261030-after-unsupported-primary-item-type/coverage.json (SHA-256 f560d1ae113c094d87a1719ae6e86bd178db6d1568ef5c107f19128bc0b89ec3). Coverage MCP returned no missing branch groups for samples::item_ids; its source identity is unverified and test attribution is unknown.

The same report marked the empty-list error arm in container::Meta::grid_item_ids as unobserved. Public inspection first creates an InspectedAvif in the sample parser, whose still_payload rejects a grid without dimg children. The container projection then reparses the same references, so its empty-list error duplicated that earlier public-input check. Removed the second guard while retaining the existing Pillow-compatible error at the sample-parser boundary. After the change, decode:avif:error_grid_without_dimg_references passed 1/1; strict make lint and make lint-x86-simd passed, including SSE2 and AVX2 cross-target Clippy. The full report predates this source edit. No Rust unit tests were added.

AVIF grid alpha sample-count mismatch — 2026-10-30

Coverage MCP's full report identified the alpha/color tile-count guard in still_payload at src/codecs/avif/samples.rs:2036. Added the active public parity row decode:avif:error_grid_alpha_sample_count_mismatch. Its complete input is derived from grid.avif by repointing the second alpha cell's auxl reference from color tile 3 to tile 2, leaving tile 3 without alpha. Box sizes and AV1 payloads are unchanged. The fixture SHA-256 is e63f9dfda938353e27c05834e4b736fd855bbdb273d9b8c2d661348e710e3e50. Pillow 12.2.0 rejects the file with Failed to decode image: Invalid image grid; the selected Rust parity row passed 1/1 with matching rejection.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261030T145636.990698Z-d9d2e3894f364d68a67de334889f662b/coverage.json (SHA-256 347cd1c8e516a0973d8f46a7a1c83ea18b7a3ffd0ad069be830f5e993bd8db9e). At the guard span, its raw branch records include counts (6, 0) and a duplicate zero-count record. Coverage MCP returns two groups at that same span and reports the false arm missing in selected scope; it marks source identity unverified and test attribution unknown. This confirms the selected input reaches the mismatch outcome, but does not establish an aggregate coverage gain. The full coverage report has not been refreshed. The matrix now contains 2,861 rows: 2,289 decode / inspect / verify rows and 572 encode rows, with 2,289 active decode rows and 541 active encode rows. AVIF has 789 active decode rows. No Rust unit tests were added.

AVIF grid non-AV1 color tile — 2026-10-30

Coverage MCP's full AVIF report marked the non-AV1 item-type arm in item_sample as uncovered. Added the active public parity row decode:avif:error_grid_non_av1_color_tile. Its complete input derives from grid.avif by changing only item 2's declared type from av01 to Exif; all box sizes and AV1 media payloads remain unchanged. The fixture SHA-256 is 1721f82f4ea1f128a97041d867fc1a1c1c0a69663ef9e12d26b02e90b5285803. Pillow 12.2.0 rejects it with Failed to decode image: Invalid image grid, and the selected Rust parity row passed 1/1 with matching rejection.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261030T150957.740166Z-68654b770b70401f82f493352a7e45ab/coverage.json (SHA-256 eacd42a6a577b96f165f9bc2fbbd17555a5ebadee2a6083977ccdeb26b1b20be). Its raw LLVM record at samples.rs:1968 has branch counts (6, 0), showing the non-AV1 rejection arm was reached six times. Coverage MCP returns duplicate groups at the branch span and marks source identity unverified and test attribution unknown. This is targeted branch evidence, not an aggregate coverage-gain claim; the full report has not been refreshed. No Rust unit tests were added.

AVIF duplicate empty-grid guard — 2026-10-30

Coverage MCP's full AVIF report marked the empty-child arm in Meta::grid_item_ids at samples.rs:1714 as uncovered. Source order showed that this guard duplicates an earlier public-input check: extract_inner_with_metadata validates still_payload(meta) before constructing the grid metadata, and still_payload calls item_ids, which rejects an empty dimg list using the same Meta::dimg_children projection. Removed the later empty-list check while keeping the existing Pillow-compatible error at the earlier check.

The existing public parity row decode:avif:error_grid_without_dimg_references passed 1/1 after the change and was rejected as Pillow rejects it. Selected report: .coverage-mcp/local-evidence/selected/20261030T150350.831696Z-ca1ca5b3b0e940b98332608ef28da1f2/coverage.json (SHA-256 be08cacec24612ca56c9d8ee56146c3788c81e3ee355d917483797b06e655862). Its raw LLVM record for the earlier item_ids check at samples.rs:1987 has counts (6, 0). Coverage MCP returns duplicate groups at that span, while the report also retains a zero-count record at the removed source coordinate; source identity is unverified and test attribution is unknown. This targeted run confirms the public error path only, not an aggregate coverage gain. The full coverage report was not refreshed. No matrix row or Rust unit test was added.

AVIS trailing metadata after track media — 2026-10-30

Coverage investigation found that Meta::details_with_grid had no public AVIS input for its missing-primary-item result. Added the parity fixture animated_sequence_only_trailing_meta_after_mdat: it appends a valid, handler-only top-level meta box after the complete mdat of animated_sequence_only_no_meta. Its input SHA-256 is a58d67aaece0bd6502b9f3bb63467e22de4452d4d99d9fb21d088d371f0e0c1f. Pillow 12.2.0 and pinned libavif 1.4.1/dav1d 1.5.3 decode the same five RGB frames, 33 ms timing, and one total play. Rust now ignores this trailing AVIS metadata after track media has been seen and uses the existing sequence-track details. The selected public parity row passed 1/1 with all 67,500 RGB bytes matching Pillow.

The selected LLVM report records five visits to the missing-primary outcome at container.rs:1071 (raw branch counts (0, 5)): .coverage-mcp/local-evidence/selected/20261030T144143.942794Z-290ee03a075947edb4768cfb3280385f/coverage.json (SHA-256 fb191116e7cc16ab092d59c46bfbad99876d9fa1bfb7ae5060cf291731be7084). Coverage MCP returned no grouped branch at that coordinate and marks source identity unverified and test attribution unknown. This is targeted local evidence, not an aggregate coverage-gain claim; the full coverage report has not been refreshed. The public matrix now has 2,861 rows, including 2,289 decode rows. No Rust unit tests were added.

AVIF IREF and inspection invariants — 2026-10-30

Coverage MCP identified zero-ID and trailing-payload branches in the container's second-pass parse_iref projection. The sample parser already rejects those inputs before it constructs InspectedAvif, so the projection checks were redundant. Removed the duplicate validation while retaining bounds-checked reads and budget accounting. The existing Pillow parity rows error_iref_zero_from_id, error_iref_zero_to_id, error_iref_trailing_payload, and iref_version_1_alpha_auxl passed together (4/4). Selected report: .coverage-mcp/local-evidence/selected/20261030T132610.180464Z-2258eed75b3c4b9cbecbe3d511e4837e/coverage.json (SHA-256 6a5dda680d9a8305d8106c1af4f392943d5b8eee7898c8685f3b8b8fe686736f).

Added the active target-only fault-contract row fault-contract:avif:avif_container_inspection_invariant_guards. It calls the container projection below its private InspectedAvif wrapper with synthetic non-ftyp, incomplete, missing-structure, and detail-free inputs, asserting structured inspection errors. The clean retry uses the active AVIF baseline and checks its Pillow inspection metadata. Its oracle status is not_applicable; these internal probes are not counted as Pillow parity. The selected contract passed 1/1. Report: .coverage-mcp/local-evidence/selected/20261030T134518.040498Z-5370b4d65f254e93967497c12dc1a267/coverage.json (SHA-256 d12c5527151515d89993d6a2106e238bee732cb3d9a189e0dc00165e65444971).

Added fault-contract:avif:avif_container_meta_full_box_version_rejected for the container parser's duplicate FullBox-version guard. A normal malformed file is rejected earlier by the sample parser, so this target-only contract passes a nonzero version to a coverage-only parser hook, checks the structured inspection error, and then checks that inspection of the Pillow baseline still succeeds. Its not_applicable oracle status keeps the internal probe separate from Pillow parity. The selected contract passed 1/1. Report: .coverage-mcp/local-evidence/selected/20261031T193102.285636Z-a5e675b53f094ae4ae7879b7b202ec7a/coverage.json (SHA-256 fa885359894c1b249f499c0f64470296df815619b1f5b8788ef41c5ecc6e6ada).

The refreshed full make coverage run passed every test executable and the configured floors: lines 98,479/140,288 (70.1977%), branches 19,928/32,100 (62.0810%), functions 5,434/8,983 (60.4920%), and regions 150,314/217,778 (69.0217%). Report: .coverage-mcp/local-evidence/full/20261030-after-avif-inspection-invariant-contract/coverage.json (SHA-256 4fbbec56faf48c865dec6fdd97ed8c3f94bed8a763c68c8274ffebd37bb65870). Coverage MCP found no missing branch group for parse_iref, the duplicate auxiliary AV1C property readers, or inspect_inner_with_grid in this report. MCP marks source/build identity unverified and test attribution unknown, so these are local run measurements; no verified aggregate-gain claim is made. The project remains below 100% on all four metrics.

The same full report left the media_data_seen = true outcome uncovered at samples.rs:2855 for the bounded-item, metadata-omitting specialization of extract_inner_with_metadata. Extended the existing active Pillow parity row animated_duplicate_top_level_meta_after_mdat to repeat decode with a 1,265-byte metadata limit, the exact bound consumed by this valid fixture. The focused selected-coverage parity run passed 1/1 and preserved all 67,500 RGB bytes. Its LLVM function record changed the target branch from true=0, false=1 in the prior full report to true=1, false=0 in the selected run. Report: .coverage-mcp/local-evidence/selected/20261030T140240.399161Z-29ab42c338c742719c853dbb32c6a99e/coverage.json (SHA-256 46fc412d612c742467a1c3dcc7b537a82869edf275fb03bdc91eeadb40373ad4). This confirms the targeted policy outcome only; the full aggregate has not been refreshed for this added path, other generic instantiations remain separate, and MCP still marks source/build identity unverified and test attribution unknown.

AVIF duplicate auxiliary codec-property parity — 2026-10-30

Coverage MCP's AVIF container report identified duplicate associated av1C branches in both container inspection and sample parsing. Added decode:avif:duplicate_non_primary_av1c_first_wins, using a deterministic second auxiliary-item av1C property declaring 10-bit depth after the original 8-bit configuration. The fixture SHA-256 is 5c06b67ebc29379bc0dd58c61865dd28927ab3669d59d75a08afcdeb7bcd832f. Pillow 12.2.0 accepts the complete file and produces the same 64×64 RGBA mode, all 16,384 pixel bytes, image information, and EXIF bytes as the source. Both Rust metadata readers and the independent bitstream inspector now retain the first associated codec declaration. The decode path selects that first configuration without allocating or parsing later duplicate payloads.

The selected parity run passed all three auxiliary first-wins rows: duplicate_non_primary_ispe_first_wins, duplicate_non_primary_pixi_first_wins, and duplicate_non_primary_av1c_first_wins. Report: .coverage-mcp/local-evidence/selected/20261030T131308.980041Z-877af55aeff5447a948ea23ab7d01c3e/coverage.json (SHA-256 d184c504191d53db0a08f34abe3ec3b317dba924c9b78441d5df5f7874397658). Coverage MCP reports source/build identity as unverified and test attribution as unknown for this selected report; it supports targeted branch investigation, not an aggregate coverage-gain claim. The public fixture matrix now contains 2,861 total rows: 2,289 decode / inspect / verify rows and 572 encode rows. Of those, 2,289 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 789 active decode rows. No Rust unit tests were added.

AVIF empty XMP item parity — 2026-10-30

Coverage MCP's prior full report identified the unobserved empty-extent path in Meta::metadata. Added the Pillow parity row decode:avif:empty_xmp_metadata_item_extent. Its deterministic mutation adds an XMP MIME item with no iloc extents to baseline.avif and rebases the primary item's unchanged AV1 payload. The fixture hash is 98c1a14618e4577354d82b758a8840d079990364b10ce94b6ef49debc87c1642. Pillow 12.2.0 returns the same 49,152 RGB bytes and image information as the baseline and does not expose the empty XMP item. Rust now skips metadata items with no extents; the parity row also asserts that no opaque metadata is retained. The focused parity run passed 1/1.

Coverage MCP still reports duplicate branch coordinates at samples.rs:1277 for the selected report. The raw LLVM record has an eight-count hit on the true arm at the current source location, matching this fixture, plus a zero-count duplicate record. Source/build identity is unverified and test attribution is unknown, so this is targeted evidence only and no aggregate coverage gain is claimed. Report: .coverage-mcp/local-evidence/selected/20261030T114102.606404Z-864b4044914349bda1c0b8aae114d0b0/coverage.json (SHA-256 adf6bb2a4f91e3f29eb63a4f402c0e11920f4b9ed84c86ebbb40c77c2083e827). The fixture matrix now contains 2,851 rows, including 2,279 active decode rows; AVIF has 779 active decode rows. No Rust unit tests were added.

AVIF duplicate mastering-display property parity — 2026-10-30

Coverage MCP identified the second-associated-mdcv path in Meta::source_color. Added the Pillow-backed parity row decode:avif:duplicate_mdcv_first_wins and a deterministic generator that appends a conflicting second property, updates its association, and rebases the file-backed item extent. The fixture keeps the AV1 payload unchanged and has SHA-256 a81d3f13b2412488464d461f9c81ab496ce5758bfba3f5f94de237b37b77faa8. Pillow 12.2.0 accepts it and returns the same 48 RGB bytes and ICC profile as the one-property control. Pillow does not expose mdcv in Image.info, so the row checks the first property against the existing specification-backed metadata assertion.

The decoder now projects the first associated mastering-display property with find_map, matching the existing inspection path and avoiding a duplicate scan/error branch. The baseline, one-property control, and duplicate-property parity rows passed together (3/3). Coverage MCP reports no missing branch group at the current samples.rs:1362 condition. It also lists two zero-count branch locations at line 1364 in the same report; source/build identity is unverified, so that coordinate mismatch is unresolved and no aggregate coverage gain is claimed. Report: .coverage-mcp/local-evidence/selected/20261030T113105.734184Z-0ac4dd27a0e74a9fb58dc7723b9b3f50/coverage.json (SHA-256 aac455a966a27986fb9d254ad48eb97e251b84a6e17fb2d3dd8062d46981e502). The fixture matrix now contains 2,850 rows, including 2,278 active decode rows; AVIF has 778 active decode rows. No Rust unit tests were added.

AVIF duplicate alpha-reference parity — 2026-10-30

Coverage MCP identified the unobserved duplicate-match outcome in Meta::alpha_targeting at samples.rs:1462 and container.rs:1538. Added the active Pillow parity row decode:avif:duplicate_alpha_auxl_reference_first_wins. Its generated complete-file fixture changes the auxl relationship count from one to two, repeats the same destination ID, relocates both file-backed iloc extents, and verifies both AV1 payloads remain byte-identical to alpha.avif. Fixture SHA-256: 680204d0a9bb9dd0f058b2539e0ccb527c265f6b2ee5e863f2f3674fbe9d03a6.

Pillow 12.2.0 accepts the duplicate relationship and returns the same 16,384 RGBA bytes as alpha.avif. Both metadata paths now select the first matching alpha relationship, matching Pillow and stopping the iterator at that match. Metadata retention and sample-payload validation also use named static policies instead of boolean mode switches. This preserves inspection/decode validation behavior without a per-sample runtime branch. The focused parity run passed 1/1. Coverage MCP reports no missing branch locations for Meta::alpha_targeting in the selected report .coverage-mcp/local-evidence/selected/20261030T110325.340701Z-dcfc222d93864dbd94f4daaaa42637c7/coverage.json (SHA-256 d09893977c2507ff63093857928e62f2117e53557cbaec321e67ff739b712f52). The report has unverified source/build identity and unknown test attribution. Its incremental comparison is incomparable because the retained baseline detail does not match its reported totals, so no aggregate coverage gain is claimed. A subsequent full make coverage run passed all test executables and cleared the configured floors: 98,479/140,308 lines (70.1877%), 19,930/32,122 branches (62.0447%), 5,429/8,979 functions (60.4633%), and 150,314/217,800 regions (69.0147%). Coverage MCP found no missing branch group for Meta::alpha_targeting in .coverage-mcp/local-evidence/full/20261030-after-static-policy-dispatch/coverage.json (SHA-256 bc3392905e14e2c9f1f604fcea201611cb38c66b5fff81b290da6b54a27618d2); it still marks source/build identity unverified and test attribution unknown, so these are local full-run totals rather than a verified aggregate gain. make lint, make lint-x86-simd, documentation lint, AVIF fixture generation checks, and fixture-integrity verification all passed. Coverage remains below 100%; no Rust unit tests were added.

AVIF metadata parity and preceding full coverage baseline — 2026-10-30

Added four public AVIF error cases. error_avif_missing_meta retains complete ftyp/mdat boxes but omits meta. error_avis_missing_moov retains the sequence's complete ftyp/mdat, omits meta/moov, and rewrites the compatible avif brand to avis so the missing-movie condition is reached. error_pitm_zero_item_id changes only the complete version-zero meta/pitm identifier; Pillow rejects it with Failed to decode image: Missing or empty image item. error_iinf_duplicate_item_id duplicates the primary infe entry; Pillow opens it and fails while decoding frame zero. The generator pins hashes, checks box layouts and unchanged AV1 media bytes, and verifies each Pillow result.

The missing-container cases plus baseline passed 3/3; the zero-primary-ID case plus baseline passed 2/2. Coverage MCP observed the true movie.is_none() arm at samples.rs:2857. For parse_pitm at samples.rs:596, selected raw LLVM data records both outcomes in one instrumented entry; MCP still lists zero-count duplicate coordinates, and the incremental comparison is incomparable. Both selected reports have unverified source identity and unknown test attribution, so they are targeted evidence, not verified aggregate gains: .coverage-mcp/local-evidence/selected/20261030T052822.034279Z-16278491ae83412c8e031271d5cbe54d/coverage.json (SHA-256 604353a08a121a6a11459186388e4b639a761ad95e10e2a0927ae76a08981247) and .coverage-mcp/local-evidence/selected/20261030T053751.057822Z-eb90df0082fe4d6686fc73ea0ad1fb68/coverage.json (SHA-256 93a268406c922328fc4708717b6153ba8592b62d146f130347e8b9d4d14d4b99).

The existing AV1 translation-sample-depth fault-contract expectation was corrected to the decoder's public AVIF sequence rendering has no completed color surface error; its focused run passed 1/1. The full report after the duplicate-item parity change clears every configured floor: lines 98,444/140,278 (70.178%), branches 19,934/32,132 (62.038%), functions 5,426/8,974 (60.464%), and regions 150,266/217,755 (69.007%). Its SHA-256 is 178c937a2427cf81cccea2239d9860d7044d90478c67fa9ac25bd13083171123 at .coverage-mcp/local-evidence/full/20261030-current-full-parity-refresh-with-duplicate-iinf/coverage.json. Compared with the preceding zero-primary-ID full report, the totals rise from 19,931/32,130 to 19,934/32,132 branches. Coverage MCP marks the comparison limited because source/build identity is unverified and test attribution is unknown, so this is not a verified aggregate gain. The earlier comparison against the required-container baseline observed the true parse_pitm arm at samples.rs:596, also with limited identity. Coverage remains below 100%, and no Rust unit tests were added.

The public fixture matrix now contains 2,857 total rows: 2,285 decode / inspect / verify rows and 572 encode rows. Of those, 2,285 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 785 active decode rows.

AVIF duplicate item-info ID parity — 2026-10-30

Coverage MCP's full-report gaps included the duplicate-item branch in samples::parse_iinf. Added decode:avif:error_iinf_duplicate_item_id, generated by duplicating the baseline's primary infe under iinf while preserving both entries' ID and all AV1 media bytes. Pillow 12.2.0 opens the file, then rejects frame decoding with Failed to decode frame 0: Decoding of color planes failed.

The first selected run exposed a public timing mismatch: Pillow inspection retains the first item entry, while Rust rejected during inspection. Lazy inspection now retains that first entry; bounded decode validation still rejects the duplicate before reading sample payloads. The parser policy uses static dispatch; the error handler is called only for duplicate IDs. The duplicate case and baseline passed 2/2. Coverage MCP's selected report still has unverified source identity and unknown test attribution; use it as targeted evidence only, not as an aggregate coverage claim. Report: .coverage-mcp/local-evidence/selected/20261030T091738.193673Z-2e6c43a4f64346f2ba50222099d6b1ed/coverage.json (SHA-256 0fb7036b039d9292df9677434aa941920c88a2d0be688bbf6251a673a07fb5b2).

AVIF XMP pixi-only metadata parity — 2026-10-30

Coverage MCP's full report had one missing branch in container::Meta::non_primary_item_plane_properties: the true arm of bit_depth.is_some() when the item has no dimensions. Added decode:avif:xmp_metadata_item_pixi_only, which associates the existing pixi property with an empty XMP metadata item without an ispe or data extent. Pillow 12.2.0 accepts it and preserves the base AVIF's mode, size, pixels, and metadata. The generator pins both fixture hashes and verifies Pillow's full observation; the case passed selected pixel parity (1/1).

The refreshed all-feature LLVM report passes all configured coverage floors: 98,473/140,296 lines (70.189457%), 19,926/32,112 branches (62.051570%), 5,430/8,979 functions (60.474440%), and 150,302/217,781 regions (69.015203%). Coverage MCP reports no remaining gaps in the plane-property projection and observes the targeted branch as newly covered. Its comparison is limited because source/build identity is unverified and test attribution is unknown; the totals are report evidence, not a verified aggregate gain. Full report: .coverage-mcp/local-evidence/full/20261030-after-xmp-metadata-pixi-only/coverage.json (SHA-256 eeeaf8c034adbb24b5514d508a8253f6e96b4d897b9872f08e329c487545126a). No Rust unit tests were added.

AVIF trailing box size-form parity — 2026-10-30

Coverage MCP identified unobserved extended-size, oversized-size, and header-length outcomes in the top-level AVIF box parser. Added four Pillow parity rows: an open-ended UUID box, a well-formed extended-size UUID box, a UUID declaring a 4 GiB size with only its header present, and a free box declaring size 4 despite its 8-byte header. Pillow 12.2.0 opens and fully decodes all four with the baseline RGB mode, dimensions, pixels, and metadata. Each selected row passed pixel parity (1/1). The incomplete trailing-box reference enrichment now ignores a final size-below-header box after a complete mdat, matching its existing policy for incomplete trailing headers/payloads.

The selected LLVM report for the size-4 case observes the true size < header_size branch in container::next_box; the UUID size variants exercise the UUID, zero-size, extended-size, and over-32-bit declarations. Full coverage passes all configured floors: 98,468/140,288 lines (70.189895%), 19,927/32,110 branches (62.058549%), 5,430/8,979 functions (60.474440%), and 150,302/217,778 regions (69.016154%). Coverage MCP reports no remaining branch gaps in container::next_box. Removing its nested size-zero guard was safe because only sample-parser-validated InspectedAvif values reach this projection; the malformed nested case still rejects during sample parsing. The report has unverified source/build identity and unknown test attribution, so its comparison with earlier totals is limited. Report: .coverage-mcp/local-evidence/full/20261030-after-container-next-box-projection/coverage.json (SHA-256 2cf99a661be75d59e69d5e15f445a47a123ffae906fa5ec30ba33f35523b27b7). No Rust unit tests were added.

AVIF 12-bit 4:2:0 alpha extent mismatch parity — 2026-10-30

Added the Pillow parity case decode:avif:error_12bit420_alpha_ispe_extent_mismatch. Its complete-file fixture changes only the auxiliary item's ispe from 17x9 to 16x9; the generator pins both file hashes, rebases item extents, and verifies the encoded AV1 item bytes are unchanged. Pillow 12.2.0 opens the file as 17x9 RGBA and fails on load with Failed to decode frame 0: Decoding of alpha plane failed.

The first selected Rust run exposed a parity bug: Rust decoded the file as 17x9 RGBA despite the auxiliary extent. The decoder now checks paired still color/alpha item extents before AV1 reconstruction, while inspection and verification retain their lazy metadata behavior. The malformed case and its matching 12-bit 4:2:0 and 4:4:4 alpha controls passed together (3/3) through make coverage-selected. Coverage MCP reports no missing branch groups at decode.rs:24 in the selected report (2,241/48,483 branch observations); the report has unverified source identity and unknown test attribution, so this is selected evidence only, not a verified aggregate coverage gain. No Rust unit tests were added. Report: .coverage-mcp/local-evidence/selected/20261030T050243.598352Z-797d832dcb604acab0a8c34b2ea29f9a/coverage.json (SHA-256 9f620a5780f9ebcc1d07c463cbb343cccb43411ce1fa2ece16c03760b3ff6f93).

AVIF odd-size color plane-placement parity — 2026-10-30

Coverage MCP's all-active report showed an unobserved height-alignment outcome in decode_portable_inner at decode.rs:578. Added two deterministic public Pillow parity rows: portable_lossless_i420_odd_17x17 exercises odd width and height, while portable_lossless_i420_aligned_width_odd_height_16x17 keeps the width aligned and exercises an odd height. Both fixtures are 8-bit full-range lossless I420 key frames, generated and checked by scripts/generate_avif_portable_color_odd_fixture.py.

The selected run with both new rows and the existing aligned 16x8 parity control passed 3/3 exact RGB pixel comparisons. Its raw LLVM report records nonzero counts for both arms of the width and height alignment decisions at decode.rs:578 in the executed function. Coverage MCP still lists missing coordinates for that line from a zero-count symbol variant; the measurement has no verified source/build identity and reports test attribution as unknown. Treat the local counters as selected evidence only; no managed aggregate coverage gain or full-coverage claim is made. No Rust unit tests were added. Report: .coverage-mcp/local-evidence/selected/20261030T022158.847718Z-43b5764300e84bf6aef82920dc19c0a4/coverage.json (SHA-256 3ac9b56100dafb1759e0394447d1133ecd90ebd8a5f17000bebe5063935f27fd).

AV1 lossless I444 first-partition fallback coverage — 2026-10-30

Coverage MCP identified the missing true outcome of the admission branch in validate_first_partition. Added target-only contract fault-contract:avif:av1_lossless_i444_first_partition_fallback_matches_parity using the active high_bitdepth_still_10bit_444_lossless Pillow parity input (SHA-256 c49589983c8492a12c3920123f9535c887b8715bf5cbdb25b57dfdad0d8c3c7e). The coverage-only fault makes the streamed decoder yield to the existing first-partition fallback. The contract requires its pixels to match the stored Pillow reference and a clean retry to return the same image.

make coverage-selected COVERAGE_CASES='fault-contract:avif:av1_lossless_i444_first_partition_fallback_matches_parity' passed 1/1. Coverage MCP queried branch outcomes at entropy.rs:21787; only the false arm remains missing in this selection, so the true arm was observed. This is selected-test evidence, not a full-suite or aggregate coverage result. Coverage MCP reports source identity unverified and test attribution unknown; the local receipt records the exact selector and passing process. Report: .coverage-mcp/local-evidence/selected/20261030T011438.699850Z-66a7ea3318a44327b80c6d9c5ec9c667/coverage.json (SHA-256 85d0e117982a607921a34ab6eb2dfcd469c14f513d52d0dfe9276304718ea020).

AV1 distance-compound parity — 2026-10-30

Added the public parity row decode:avif:animated_lossy_interinter_distance_i420_b16x16_64x64 for a three-frame 8-bit I420 AVIF whose final frame uses distance-weighted compound prediction. The fixture is deterministic and has SHA-256 7abfec6d36ae819aaea9a9dc814c33c538488ba87362cd174b5cd62dfcaaab13. Its generator checks that AV1 order hints and joint compound are enabled, masked and warped motion are disabled, and the final frame exposes both references. The focused selected-coverage parity run passed 1/1 with exact RGB pixel parity. All four generated Pillow pixel references matched the retained files byte-for-byte, and native loop evidence verifies all 173 AVIF sequence references against the refreshed loop index.

Coverage MCP queried the selected branch report for distance_weight. The helper executed 16 times and covered the d0 > d1 path, including both outcomes of its threshold comparison. Four of its eight branch outcomes remain uncovered: the false arm of d0 > d1, the true arm of d0 <= d1, and both outcomes of the d0_c0 > d1_c1 comparison. The selected report measures 3,480/32,118 branches (10.835%); this is selected-test diagnostic evidence, not a full-suite coverage result. Coverage MCP marks source identity unverified and test attribution unknown, so no verified aggregate gain or 100% coverage claim is made. Report: .coverage-mcp/local-evidence/selected/avif-distance-compound-nowarp-20261030/coverage.json (SHA-256 31b724e9a89f9ca3f4519c2bd976b5bb69169b47cc600ede14574e9630acd11c).

AVIF auxiliary-item plane-property parity — 2026-10-30

Coverage MCP identified missing outcomes for duplicate ispe and pixi associations and for bit-depth-only plane metadata. Pillow accepts conflicting duplicate item properties and keeps the first declaration: the second ispe declares 32×64 after 64×64, and the second pixi declares 16-bit after 8-bit. Pillow still returns 64×64 RGBA for both. It rejects an alpha auxiliary item without ispe. Added the successful parity rows decode:avif:duplicate_non_primary_ispe_first_wins and decode:avif:duplicate_non_primary_pixi_first_wins, plus the malformed row decode:avif:error_alpha_auxiliary_missing_ispe. Their deterministic full-file fixtures are generated by scripts/generate_avif_non_primary_property_duplicate_fixtures.py and scripts/generate_avif_alpha_missing_auxiliary_ispe_fixture.py. Both AVIF metadata paths now retain the first ispe and pixi declaration and reject alpha auxiliary items without spatial extents. The selected all-feature parity run, including the existing with_alpha control, passed 4/4.

The earlier selected Coverage MCP query reported no missing outcomes for the first-property guards in the selected samples.rs projection. It still listed the no-plane-properties arm at samples.rs:1643 and the separate container.rs projection as unobserved. That query used the earlier selected report .coverage-mcp/local-evidence/selected/20261029T211615.021967Z-2152aafc6e34456194145d69e42e72ff/coverage.json (SHA-256 ba8c0ea9be2331bc2edcc906bb11107191955ae8baa3f0d6a0979dc562e2b947).

After strengthening the duplicate fixtures to contain conflicting property values, the final selected all-feature parity run passed 4/4. Its report is .coverage-mcp/local-evidence/selected/20261029T212255.276233Z-bc20dba5e3d942c595ae720afc223750/coverage.json (SHA-256 fd9af142f52b41d28d758578283b779d20707fc5d26a0adffa4434ebac9bdbf6). Coverage MCP could not analyze this report because its local daemon did not become healthy. The local receipt marks source identity unverified and test attribution unknown; no aggregate coverage gain is claimed.

AVIF edit-box and edit-list parity — 2026-10-30

Coverage MCP identified missing outcomes in parse_edit_box and parse_edit_list_box. Added four public malformed-input rows for a missing elst, duplicate elst, entry_count != 1, and zero segment_duration. Their deterministic full-file fixtures are generated by scripts/generate_avif_track_box_parity_fixtures.py. The combined selected all-feature parity run passed 4/4; pinned Pillow rejects every input at open. No Rust unit tests were added.

Coverage MCP finds no missing branch outcomes at samples.rs:2187, :2188, or :2209 in the selected report, and lists only the false arm as missing at :2217. This is consistent with the four new cases exercising both parse_edit_box outcomes, both entry_count outcomes, and the zero-duration error arm. Source identity and test attribution are unverified. Incremental comparison with target/coverage-all-active-parity-20261030.json was incomparable because the baseline's detailed observations are incomplete; no aggregate coverage gain is claimed. Report:

.coverage-mcp/local-evidence/selected/20261029T205301.665320Z-edaa68f597c844e6a96d16cb2e2eb25d/coverage.json (SHA-256 ca3e23fc9b3a04d58684e2600b4905ba79814b669e2d213675b09809b89382a5).

AVIF irot edge parity — 2026-10-29

Coverage MCP identified an uncovered trailing-payload outcome in the two AVIF parse_irot paths. Pillow accepts a trailing property byte and uses the leading rotation value, so both parsers now preserve that behavior. Added the active success row decode:avif:primary_item_irot_trailing_payload and the active malformed-input row decode:avif:error_primary_item_irot_invalid_value; the pinned Pillow oracle accepts the former and rejects the latter. The exact selected parity run passed 2/2. No Rust unit tests were added.

The fixture generator pins both input hashes and verifies that AV1 media bytes remain unchanged. It runs from make verify-fixture-integrity. Coverage MCP was queried on the selected report for parse_irot, but its returned branch spans still point to the removed trailing-byte guards; the current source has the compatibility comments at those lines. The local LLVM JSON retains zero-count objects with the old branches, and its receipt reports source identity unverified and test attribution unknown. Those spans are stale coordinate evidence, not a current coverage gap or an aggregate coverage gain. Report: .coverage-mcp/local-evidence/selected/20261029-avif-irot-edge-parity/coverage.json (SHA-256 520f80b2ddeb7fa7c51e6759db98882213fa49f1020912580c33be3bfa3b8bc3).

The current fixture matrix contains 2,842 total rows: 2,270 decode / inspect / verify rows and 572 encode rows. Of those, 2,270 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 770 active decode rows.

TIFF YCbCr rational inspection bounds contract — 2026-10-29

Coverage MCP found the unobserved out-of-range arm in Directory::rational. Normal inspection validates the YCbCr rational field count before reading each value, so this internal bounds failure is not reachable through the ordinary Pillow input. Added the target-only fault-contract:tiff:tiff_ycbcr_rational_index_out_of_range row using the active ycbcr_custom_coefficients_reference_black_white_lzw_2x2 parity input. Its coverage-only fault selects the count as the requested index; inspection returns TIFF YCbCr tag 529 is truncated, and retry succeeds. The selected run passed 1/1; the fault row is not_applicable to the Pillow oracle and is not counted as parity. No private unit tests were added.

Coverage MCP reports no remaining missing branch groups for Directory::rational in the selected report. Source identity is unverified and test attribution is unknown, so this target-only result is not a verified aggregate coverage gain or a 100% coverage claim. Report: .coverage-mcp/local-evidence/selected/20261029T012251.792502Z-41e34f0c0d55446e8d785ad565f45ddd/coverage.json (SHA-256 49fc1d0ac576c20a8a4dddcc6d331197cd53091d71fb8fe74412ed96d71e8c4d).

TIFF YCbCr floating-value inspection bounds contract — 2026-10-29

Normal TIFF inspection validates the YCbCr FLOAT field count before requesting each indexed value, so this out-of-range index is not reachable from the ordinary parsed input. Added the target-only fault-contract:tiff:tiff_ycbcr_floating_index_out_of_range row using the active Pillow parity input ycbcr_coefficients_float_type_lzw_2x2. Its coverage-only injection selects the entry count as the index; inspection returns TIFF YCbCr tag 529 is truncated, and retry succeeds. The selected fault-contract run passed 1/1; the injected failure is not_applicable to the Pillow oracle and is not counted as parity. No private unit tests were added.

Coverage MCP reports no remaining missing branch groups in Directory::floating_value for the selected report. Source identity is unverified and test attribution is unknown, so this is selected diagnostic and coverage evidence, not a verified aggregate coverage gain or a 100% coverage claim. Report: .coverage-mcp/local-evidence/selected/20261029T012809.747931Z-2e1c5071175a476e94e012f54496fc3a/coverage.json (SHA-256 75db412ee621a48ae0d81915e40a58a77196d71844c21a83981e6f12d3d6d544).

TIFF numeric-value inspection guard contracts — 2026-10-29

Coverage MCP found missing branches in Directory::numeric_values_are_nonempty_and_uniform. Valid parsed TIFF fields derive byte length from a nonzero type width and count, so zero-width and non-divisible-width states cannot come from ordinary inputs. Added three target-only inspection contracts using the active decode:tiff:multi_page Pillow parity input: tiff_directory_numeric_value_width_invalid, tiff_directory_numeric_value_width_remainder, and tiff_directory_numeric_value_remainder_nonempty. The injections reach the zero-width, non-divisible byte-length, and trailing-byte guards. Each inspection reports an incomplete IFD chain; a clean retry matches the two-page parity metadata. All are oracle_status: not_applicable, not Pillow parity. The zero-width and trailing-byte selection passed 2/2, and the non-divisible-width selection passed 1/1. No private unit tests were added.

The hooks are compiled only with cfg(coverage), leaving release behavior and runtime performance unchanged. The selected reports are .coverage-mcp/local-evidence/selected/20261029T014540.437831Z-870bd3f41656416a924b05b9e4de6cd8/coverage.json (SHA-256 1c65cc01d268098135c1c035b30b5fc47516d2d9ce48776dde2ac93d0863e206) and .coverage-mcp/local-evidence/selected/20261029T020254.583462Z-f94019da788c4fa0931e13a6e0c5934c/coverage.json (SHA-256 3e74bc2186283846a552f727296fdf9c3c5212a59f2bbcab0815d9dd8de3a2e9).

The all-feature coverage run after the TIFF contracts passed its six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,329/140,033 lines (68.076096%), 19,032/32,092 branches (59.304500%), 5,286/8,958 functions (59.008707%), and 145,448/217,391 regions (66.906174%), above the configured floors. Coverage MCP reports no remaining missing branch groups for this helper. It reports 13,060 missing branches overall, led by AV1 decode_inter_translation_impl (largest group: 1,574 missing outcomes). Source identity is unverified and test attribution is unknown, so these measurements do not prove per-case attribution or a verified aggregate gain. The 100% objective remains open. Report: .coverage-mcp/local-evidence/full/20261029-current-after-tiff-directory-numeric-width-remainder-final/coverage.json (SHA-256 57c20d8c32857a967c6a62836af3c65bbdb8a096a221d4fa5172ad46d2339fea).

AV1 inter-translation sample-depth fault contract — 2026-10-29

Coverage MCP identified the quantization sample-depth equality branch in Lossy420Decoder::decode_inter_translation_impl among the largest remaining AV1 gaps. Ordinary validated sequence data keeps decoder tools and quantization at the same depth, so the opposite outcome requires a target-only fault contract. Added fault-contract:avif:av1_inter_translation_sample_depth_mismatch using the active animated_lossy_inter_420_b16x64_mode_select_64x64 parity input. The coverage-only injection supplies 10-bit quantization to the 8-bit source; the public sequence API returns decode sequence: AVIF sequence validation failed: AVIF sequence rendering has no completed color surface. The clean retry succeeds and restores the source row's parity result. The fault is oracle_status: not_applicable, not Pillow parity. The selected run passed 1/1; no private unit tests were added.

The injection is behind cfg(coverage). A non-generic helper isolates the coverage branch from decoder monomorphizations, while the non-coverage helper is an inline identity. This preserves release-path work without claiming a measured speedup. Coverage MCP still lists seven specialization-specific groups at the sample-depth predicate's source line in the selected report, so this case exercises one mismatch path without closing the broader generic function gap. The selected report is .coverage-mcp/local-evidence/selected/20261029T021950.482913Z-6f8d13ad1e394fcfb0dc7690591eb7d3/coverage.json (SHA-256 4bda2fecf7e541d749598654e15d2ef14ff60f949f8c1db75c59752d5976b4ef).

The latest all-feature coverage campaign passed six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,339/140,043 lines (68.078376%), 19,034/32,094 branches (59.307036%), 5,287/8,959 functions (59.013283%), and 145,455/217,398 regions (66.907239%), above the configured floors. Coverage MCP still reports 13,060 missing branches overall; the leading AV1 decode_inter_translation_impl group has 1,574 missing outcomes. Source identity is unverified and test attribution is unknown, so these measurements do not prove per-case attribution or a verified aggregate gain. Report: .coverage-mcp/local-evidence/full/20261029-current-after-av1-inter-translation-depth-contract-final/coverage.json (SHA-256 d9a44e2d346b04e47f22240e993918b21de62b394f997f8c01f799595ea7848e). The 100% coverage objective remains open.

AVIF item-location extent policies and inspection fault contracts — 2026-10-29

Coverage MCP showed that the const-Boolean branches in parse_iloc had an unreachable opposite arm in each monomorphization. Extent validation now uses statically selected BoundedItemExtentPolicy and LazyItemExtentPolicy implementations, preserving decode and inspection bounds behavior without a runtime policy branch. The calls remain monomorphized and inline; this change does not claim a measured speedup.

Added two target-only inspection fault contracts for item-location table and extent-span reservation failures. Both reuse the baseline AVIF input, require the public inspection error, and retry successfully; they are marked not_applicable to the Pillow oracle. The selected run passed 2/2 fault contracts. Four adjacent public Pillow parity rows for baseline, split idat extents, a zero-length file extent, and ignored trailing iloc payload passed 4/4. No private unit tests were added.

The fresh all-feature coverage campaign passed six integration executables (4, 1, 57, 7, 1, and 69 cases). It measured 95,297/140,013 lines (68.062966%), 19,017/32,082 branches (59.276230%), 5,284/8,958 functions (58.986381%), and 145,407/217,363 regions (66.895930%), above the configured floors. Coverage MCP reports zero missing branch groups for samples::parse_iloc. Its report marks source identity unverified and test attribution unknown, so these results do not establish per-case attribution or a verified aggregate coverage gain. The 100% objective remains open. Report: .coverage-mcp/local-evidence/full/20261029-after-avif-iloc-inspection-reservation-contracts/coverage.json (SHA-256 5fcd25437cf23df00dc7eb351efeeb1ae400f29705021e2b318a5f01e24a5a28).

AVIF I422 TX_MODE_SELECT direct-grid parity — 2026-10-29

Added two exact Pillow parity rows for 8-bit I422 transform-select sequences. The 64x64 row covers a single-reference positive-qindex profile. The 128x64 row has two 64x64 regions and its final frame repeats the right source region while blending the left. Both generated inputs retain pinned Pillow pixels and independent libavif loop observations. The selected run passed 2/2 rows:

make coverage-selected COVERAGE_CASES='decode:avif:animated_lossy_inter_422_mode_select_b64x64 decode:avif:animated_lossy_inter_422_direct_grid_mode_select_mixed_b128x64'

Coverage MCP queried the selected report at src/codecs/avif/av1/block.rs:48518. The 128x64 case produced one true-arm hit in the mode-select direct-grid validation; the full report still has 15 missing outcomes across eight function groups at that location. An incremental comparison with the earlier full report is incomparable because the baseline lacks exact branch detail. The selected report is .coverage-mcp/local-evidence/selected/20261029T004640.007954Z-5e5a1daea18644f794461fafd464854e/coverage.json (SHA-256 ee4e41405c6d24417958dec89bc251c140e79a1eea538766c63946163d81f436).

The refreshed all-feature coverage campaign passed its six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,291/140,009 lines (68.060625%), 19,019/32,086 branches (59.275073%), 5,280/8,954 functions (58.968059%), and 145,387/217,351 regions (66.890421%), above the configured floors. Its report is .coverage-mcp/local-evidence/full/20261029-after-avif-i422-mode-select-parity-final/coverage.json (SHA-256 46548b2c0f810b4f3beef506a98644469c8679a023ea045bf44c00e98dd10590). Coverage MCP marks source identity unverified and test attribution unknown, so these measurements are not a verified aggregate gain or proof of 100% coverage. No Rust implementation changes or private unit tests were added; the 100% objective remains open. The current fixture matrix contains 2,790 total rows: 2,218 decode / inspect / verify rows and 572 encode rows. Of those, 2,218 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 718 active decode rows.

AVIF 12-bit 4:2:0 alpha converter guard contracts — 2026-10-29

Coverage MCP found five uncovered rejection outcomes in convert_subsampled_420_12bit_alpha: zero width, luma length not divisible by width, zero height, and short U or V planes. Ordinary validated AVIF input cannot reach these internal states, so five typed target-only fault rows reuse the active high_bitdepth_still_12bit_420_alpha_odd_edge_17x9 Pillow parity input. Together with the existing alpha-count mismatch contract, the selected run passed all six fault contracts (oracle not_applicable); the adjacent ordinary parity row passed 1/1 with exact RGBA8 pixel parity. All injected failures produced the public unsupported-subset result, and retry without the fault matched the fixture. No private unit tests were added.

The selected report is .coverage-mcp/local-evidence/selected/20261029T001949.649666Z-7052f79d302b4cb39943e18a4d527a8a/coverage.json (SHA-256 948dde93ad264e2725ba8d9abb43f5a03562c100f5024b9fbccb68c573e8fc05). The fresh all-feature campaign passed all six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,134/140,009 lines (67.948489%), 18,987/32,086 branches (59.175341%), 5,272/8,954 functions (58.878713%), and 145,174/217,351 regions (66.792423%), above the configured floors. The report is .coverage-mcp/local-evidence/full/20261029-after-avif-i420-12bit-alpha-faults/coverage.json (SHA-256 47f3150cb8dcaf6be09aa5ac5cd98a48a038a63685c793ffcd6ecff302a1ed2a). Coverage MCP now reports zero missing branch groups in convert_subsampled_420_12bit_alpha. It still reports 1,599 missing branch groups overall, led by AV1 decode_inter_translation_impl (largest group: 1,574 missing outcomes). The report has unverified source identity and unknown test attribution; the measurements are not proof of per-case attribution or a verified aggregate coverage gain. The 100% objective remains open.

AVIF 8-bit 4:2:0 RGB lane conversion — 2026-10-29

decode_portable_inner now converts eligible 8-bit 4:2:0 RGB output in eight-pixel lanes using the existing safe wide fixed-point conversion. The lane path applies when the image has no alpha and its width is at least eight and divisible by eight; alpha, odd-width, 4:2:2, and other conversion paths retain their existing handling. The interleave writes the same RGB24 byte order. make lint-x86-simd passed its SSE2-baseline and AVX2 Clippy builds; this host is ARM64, so those checks do not establish x86 runtime performance.

The focused AVIF parity selection passed 10/10 rows, including ordinary 4:2:0 inputs and the 2048×128 temporal sequence. Its report is .coverage-mcp/local-evidence/selected/avif420-rgb-vector-arm64-20261029/coverage.json (SHA-256 036dda3846262580a524299e9b1ff4356821f2394df801a6c12156c1da059f30). The full all-feature coverage campaign passed all six integration executables (4, 1, 57, 7, 1, and 69 cases). The report measured 95,076/139,954 lines (67.933750%), 18,957/32,066 branches (59.118693%), 5,272/8,954 functions (58.878713%), and 145,080/217,258 regions (66.777748%), above the configured floors. Its report is .coverage-mcp/local-evidence/full/20261029-after-avif-420-rgb-vector/coverage.json (SHA-256 f8ba86b378b9a711c2256115062d62cc061fcdefe274dcd2453c8873078a7e11). Coverage MCP marks source identity unverified and test attribution unknown; these reports document passing parity and observed coverage, not verified per-case attribution or a 100% coverage result.

An A-B-B-A probe used five cycles of 100 public decode_sequence calls per run on animated_motion_temporal_mv_range_2048x128.avif (SHA-256 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a). On macOS 15.7.7 ARM64 with rustc 1.96.1, the median of run medians changed from 14,085,312.5 ns to 13,578,187.5 ns per decode, a 3.60% reduction. The full timing samples and binary hashes are retained at .coverage-mcp/local-evidence/performance/avif-420-rgb-arm64-20261029/arm64-420-rgb-abba-final-routing.json (SHA-256 b705734f4102e1cd8f552b3622a839aa625927767d10b6a5a091e53ef8a82d00). This is one workload on one ARM64 host; it does not establish a general codec ranking or an SSE2/AVX2 runtime gain. cargo fmt --all -- --check, make lint, make lint-x86-simd, and the full make coverage campaign passed.

AVIF reconstructed Y-plane length fault contract — 2026-10-29

Coverage MCP identified the uncovered true outcome of the reconstructed-plane length guard in decode_portable_inner. Added fault-contract:avif:avif_portable_y_plane_length_mismatch, using the existing decode:avif:baseline Pillow parity input. Its coverage-only injection shortens the reconstructed Y plane after canvas assembly. The public decoder returns the unsupported-subset error; retry without the fault matches the existing Pillow pixels. The selected run passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261028T235124.724344Z-2b00bfb7e8bf44e3a1fd5ca6a77534e3/coverage.json (SHA-256 226611031fef4a21d7a671ab6649fc51624d3abf80a204c02771e085bb63a94d). The coverage-only hook is absent from release builds; no private unit test was added, and this target-only result is not Pillow parity.

The fresh full all-feature coverage campaign passed all six integration executables (4, 1, 57, 7, 1, and 69 cases). It measured 95,085/139,963 lines (67.935812%), 18,960/32,068 branches (59.124361%), 5,272/8,954 functions (58.878713%), and 145,090/217,268 regions (66.779277%), above the configured floors. The report is .coverage-mcp/local-evidence/full/20261029-after-avif-portable-plane-fault/coverage.json (SHA-256 bcaf3b8f0eedb29d18a11b13ddea5ac39d898dd976aa38f2c2ffb4a59a97f56d). Coverage MCP no longer lists the Y-plane mismatch outcome among this function's missing branches. Its full-report comparison remains limited because source identity is unverified and test attribution is unknown, so no verified aggregate coverage gain is claimed. The 100% coverage goal remains open.

AVIF portable-plane and routing fault contracts — 2026-10-29

Coverage MCP's refreshed report still showed missing U-, V-, and alpha-plane length outcomes in decode_portable_inner, plus an unsupported identity-color conversion outcome for subsampled planes. Added target-only rows fault-contract:avif:avif_portable_u_plane_length_mismatch, fault-contract:avif:avif_portable_v_plane_length_mismatch, fault-contract:avif:avif_portable_alpha_plane_length_mismatch, and fault-contract:avif:avif_subsampled_identity_conversion_rejected. Each coverage-only injection checks the stable unsupported-subset error and then retries the active Pillow parity input successfully. The three plane-shape rows passed 3/3; the identity-conversion row and an existing 10-bit 4:2:2 alpha parity row passed 2/2. The target-only rows have oracle status not_applicable; no private unit tests were added.

The full-resolution route now uses the already validated subsampled result and horizontal-subsampling flag to distinguish 4:4:4 from 4:2:2. The final all-feature campaign passed all six integration executables (4, 1, 57, 7, 1, and 69 cases). Coverage MCP reports no remaining branch gaps in decode_portable_inner. The full report measured 95,109/139,986 lines (67.941794%), 18,972/32,076 branches (59.147026%), 5,272/8,954 functions (58.878713%), and 145,121/217,300 regions (66.783709%), above the configured floors. It is .coverage-mcp/local-evidence/full/20261029-after-avif-portable-routing/coverage.json (SHA-256 9d26004cd2993069516ef1ab0bd9e0824f49109a44afd9b53c1385ef1fe86676). Source identity is unverified and test attribution is unknown, so these observations do not establish a verified aggregate coverage gain.

The 100% objective remains open. A function-filtered query still reports 40 monomorphized groups in av1::block::decode_inter_translation_impl, with the largest group missing 1,574 branch outcomes, and five remaining branch gaps in convert_subsampled_420_12bit_alpha.

AVIF container projection trusts validated metadata — 2026-10-29

Coverage MCP's preceding full report showed five uncovered branch outcomes in container::parse_iloc and five in container::parse_ipma. These guards duplicated validation already performed by the sample parser before it can construct the sealed InspectedAvif passed to container inspection. The projection now relies on that validated-input boundary and retains its own record-budget, bounded-read, and checked-offset handling. No parity behavior changed, and no unit tests were added.

Ten existing public AVIF parity rows passed: malformed version, width, item-ID, construction-method, and association cases remain rejected like Pillow, while valid version-two, indexed-extent, and optional-association inputs preserve exact pixels. The selected LLVM report is .coverage-mcp/local-evidence/selected/avif-container-projection-invariants-20261029/coverage.json (SHA-256 b233cd35a981bb57373beb013f8641d8e4490b4aca159d52de568cdf6933ebb6). Coverage MCP reports no missing branch outcomes in either container projection parser in the refreshed full report. The full all-feature run passed all six integration executables (4, 1, 57, 7, 1, and 69 tests) and measured 95,044/139,931 lines (67.922047%), 18,936/32,058 branches (59.067939%), 5,271/8,953 functions (58.874120%), and 145,000/217,186 regions (66.763051%), above the configured floors. Its report is .coverage-mcp/local-evidence/full/20261029-after-container-projection-invariants/coverage.json (SHA-256 04ee7c25fa33a91924ce0594f27c505f8e13530987cdd32e19d3546d46f81f76). Compared with the preceding report, ten missing branch outcomes were removed with the redundant guards; this is a denominator reduction, not ten newly covered outcomes. Coverage MCP marks source/build identity unverified and test attribution unknown. Formatting, strict Clippy (including release and coverage-hook lanes), and the native/WASI/WASM feature matrix passed. The configured 100% coverage goal remains open.

AVIF size-zero top-level skip parity — 2026-10-29

Added active public row decode:avif:size_zero_top_level_skip. Its complete input appends a size-zero top-level skip box and trailing payload to baseline.avif; the pinned Pillow oracle verifies and decodes it to the same 128×128 RGB pixels (49,152 bytes, SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf). The input SHA-256 is 02a2791f3c182f175019224d62d658ed1c5b7654bb15eed98840b38628e81584.

The preceding full-report Coverage MCP query listed the kind == b"skip" true arm in samples::extract_inner_with_metadata::<false> at samples.rs:2793 as missing. The selected public parity row passed 1/1, and its LLVM report records that arm in both metadata-bound specializations. The report is .coverage-mcp/local-evidence/selected/avif-top-level-skip-20261029/coverage.json (SHA-256 a1e10dd474934020c431d53fb7641b6edebc2496e86b7b9d379717402ce56ff2). Its local receipt records no source changes during collection; Coverage MCP still marks source/build identity unverified and test attribution unknown, so this is a focused parity and branch observation, not an aggregate coverage gain claim. No unit tests were added.

A fresh full all-feature coverage run passed all six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,044/139,931 lines (67.922047%), 18,936/32,058 branches (59.067939%), 5,271/8,953 functions (58.874120%), and 145,000/217,186 regions (66.763051%), unchanged from the preceding full report. Coverage MCP no longer lists the skip true arm as missing; its full-report coordinate comparison reports one newly observed branch location and no removed locations. Both reports lack verified source/build identity, and MCP does not confirm named-test attribution, so this remains limited coordinate evidence rather than a verified aggregate coverage gain. The full report is .coverage-mcp/local-evidence/full/20261029-after-top-level-skip/coverage.json (SHA-256 35d987c8f13e29531412954fff6472b5e589409dccec36d1a4d801d6bbc62864).

AVIS truncated top-level header after a complete movie — 2026-10-29

Coverage MCP's preceding full report identified missing outcomes in the brands.has_avif and brands.has_avis checks at samples.rs:2816. Added the active parity row decode:avif:error_animated_sequence_only_stsz_common_size_short_samples_truncated_tail. It derives from the existing malformed five-frame AVIS fixture (fe2666ad9cf9fe32d6b4a35d64f1b9f1a101ae9a65e8055fab6cd62bc63e827c) and appends the four-byte incomplete top-level size field 00 00 00 10. Pillow verification succeeds; pixel loading still fails with Failed to decode frame 0: Decoding of color planes failed.

The selected all-feature parity run passed 1/1. Its LLVM report records the brands.has_avif == false and brands.has_avis == true outcomes at line 2816 in both metadata-bound specializations. The fixture SHA-256 is 704aa89ebb2866a5c6b457a28bd2e85317c0b5bb77bf40e151f7e9ab0618bda2; the selected report is .coverage-mcp/local-evidence/selected/avif-sequence-truncated-tail-20261029/coverage.json (SHA-256 23dc24bbf1e97e487c5e09232d9af7e46be7a8cfa6f899b0405d0a32eb8af230). Its local receipt records that fixture and source files did not change during collection. A fresh full make coverage run passed the six integration executables (4, 1, 57, 7, 1, and 69 tests) and measured 95,044/139,931 lines (67.922047%), 18,940/32,058 branches (59.080417%), 5,271/8,953 functions (58.874120%), and 145,005/217,186 regions (66.765353%), above the configured floors. Coverage MCP now reports no missing outcomes at samples.rs:2816; its full-report coordinate comparison shows four newly observed branch outcomes and no removed locations. The full report is .coverage-mcp/local-evidence/full/20261029-after-avif-tail-parity/coverage.json (SHA-256 97a191d4e95590b5e870ad86439d3db24038087b57bb70418b6fa231147f1fdb). Both reports lack verified source/build identity, and MCP marks test attribution unknown, so this is limited coordinate evidence rather than a verified aggregate gain. No unit tests were added.

AVIF stsd parser parity and ignored hint-track entry — 2026-10-29

Coverage MCP identified missing samples::parse_stsd error outcomes for an unsupported FullBox version, an unknown sample-entry type, and an undersized av01 entry. Added three malformed-input parity rows plus a successful trailing-payload row. All four fixtures derive from the pinned five-frame AVIS-only source animated_sequence_only_no_meta.avif (SHA-256 c861761e45518018150dc52302da7ff5015d1f259ff2c1309eea94eaf8176fdb). The successful mutation appends one byte after its declared stsd entry, rebases stco, preserves file samples, and yields the same five 67,500-byte RGB frames in Pillow 12.2.0 and pinned libavif 1.4.1. The native loop oracle records one total play. Pillow rejects each of the other three complete files at open.

Fixture SHA-256 values are 153ead664b729f1854c738ddd2e771e18c7488457f7716d8516df626eb2543ef for animated_stsd_trailing_payload.avif, aeace2695e5ce994805cc52b298cbed8f4354f025ff58431da591b83956a790b for error_animated_stsd_nonzero_version.avif, 48318a79ccba0b03ec54fb991dc9125d6a79a2fba64a34fb710d97c36343c402 for error_animated_stsd_unknown_sample_entry.avif, and 2fd1bb9882767e930ab717a2e8c970de48643788b11546af73cf91a09582af91 for error_animated_stsd_short_av01_entry.avif.

Added animated_unknown_sample_entry_ignored_hint_track.avif as an accepted public parity case. It adds a hint track with one bounded sample pointing at existing media data and an unknown sample-entry type. The pinned Pillow and libavif observers preserve the original five frames and one-play result; its SHA-256 is dcc55d191d0f5e9cbabcd1dfbc9119b2f8e712ec1cea33880873739ed9987a49.

The selected parity run passed 4/4 rows. It first exposed the trailing-byte mismatch in samples::parse_stsd, then in the parallel container::parse_stsd; both parsers now stop after the declared entries and ignore bounded trailing bytes. The separate ignored-hint-track parity row passed 1/1 with exact 67,500-byte frame parity and exercises the container parser's non-av01 entry path. The unsupported-version check in that second parser was redundant: its sealed InspectedAvif input can only be constructed after the public sample parser accepts versions zero or one. The reference bitstream inspector likewise parses exactly the declared entry count. No unit tests were added.

The selected LLVM report is .coverage-mcp/local-evidence/selected/avif-stsd-parity-green-20261029/coverage.json (SHA-256 a1d7b2cab9ab99ed1bd118793b34d43f6de674cfef747e37c688b005d7139d64). The new row's selected LLVM report is .coverage-mcp/local-evidence/selected/avif-ignored-hint-track-stsd-20261029-v2/coverage.json (SHA-256 1b805730291e4254099311c4a9df9538cc73f99979915cbb266a7b371e755185). Coverage MCP reports no missing branch outcome in container::parse_stsd for this selection. A fresh full all-feature run then passed all six integration executables (4, 1, 57, 7, 1, and 69 tests). Coverage measured 95,075/139,969 lines (67.925755%), 18,944/32,076 branches (59.059733%), 5,273/8,955 functions (58.883305%), and 145,034/217,228 regions (66.765794%), passing the configured floors. The report is .coverage-mcp/local-evidence/full/20261029-after-missing-leading-ftyp/coverage.json (SHA-256 0152da4b31764fae4ce0a2bc0c051bd71d3dbc72eed3503bcefb7702e5411874). These totals match the preceding full report; the extra malformed signature row adds parity protection but does not increase covered coordinates. Both full reports have unverified source/build identity and unknown test attribution in Coverage MCP, so they do not support a verified aggregate coverage-gain claim. Formatting and strict all-target, all-feature Clippy passed on the earlier source state; this latest change is fixture-only.

The selected report records no missing branch outcomes in container::parse_stsd after the non-av01 path is reached by the ignored hint track. The report does not establish a complete-suite coverage regression comparison or test attribution. No SIMD or benchmark change was made; 100% remains open.

Added error_animated_missing_leading_ftyp.avif as a full-file Pillow parity case that changes only the leading box type from ftyp to free. The selected parity row passed. Coverage MCP shows the first-box branch remains unobserved for this selection. Code inspection shows public dispatch rejects the missing signature before samples::extract_inner_with_metadata runs, so this protects format detection but does not cover the parser's defensive first-box check. The selected LLVM report is .coverage-mcp/local-evidence/selected/avif-missing-leading-ftyp-20261029/coverage.json (SHA-256 a00c65408d7d017a2cb157e7fc48f107726a32cc2077b2eb11085ce7605eb66a).

The current fixture matrix contains 2,774 total rows: 2,203 decode / inspect / verify rows and 571 encode rows. Of those, 2,203 decode rows and 540 encode rows are active; 31 planned encode rows remain. AVIF has 699 decode rows.

AVIF ipma and iref parser parity — 2026-10-29

Coverage MCP identified uncovered parse_ipma item-ID validation branches. Added parity cases for a zero item ID and a repeated, non-increasing item ID; both selected cases pass and match Pillow's open-time rejection. A separate trailing-payload case reproduced a mismatch: Pillow inspects and decodes the image while Rust rejected the bounded trailing ipma byte. The parser now ignores bytes after its declared association records, and the selected pixel parity case passes (49,152 bytes, Rgb8). The reference metadata inspector was adjusted to read the declared associations while ignoring the same tail. The selected reports are .coverage-mcp/local-evidence/selected/avif-ipma-invalid-item-ids-20261029/coverage.json and .coverage-mcp/local-evidence/selected/avif-ipma-trailing-payload-20261029-confirmed/coverage.json. Coverage MCP then identified three uncovered parse_iref rejection branches. Added zero source-ID, zero target-ID, and trailing-reference-payload fixtures; all three selected parity rows pass and match Pillow's open-time rejection. The trailing-byte mutation shifts the alpha file extents by one byte while preserving the referenced AV1 payloads. Its selected report is .coverage-mcp/local-evidence/selected/avif-iref-item-id-errors-20261029/coverage.json. The refreshed full all-feature report is .coverage-mcp/local-evidence/full/20261029-after-avif-iref-parity/coverage.json (SHA-256 5d69ddbf50fc288a91fb77c766813b064edd65b5d1f3a10971a0de365d2d9cd3). All integration tests passed and the configured floors passed at 95,046/139,928 lines (67.9249%), 18,944/32,056 branches (59.0966%), 5,271/8,953 functions (58.8741%), and 145,007/217,183 regions (66.7672%). Coverage MCP reports no missing branch observation at samples.rs:979 or samples.rs:1037 in this report. Its comparison with the preceding local full report identifies three newly observed samples::parse_iref branch arms, but source/build identity is unverified, so this is coordinate evidence rather than a verified aggregate gain. Three defensive true arms remain in container::parse_iref; public AVIF inspection first constructs InspectedAvif through samples::inspected, so the malformed references are rejected before this second parser runs. The parity-only matrix cannot reach those duplicate checks. The 100% goal remains open.

AV1 compound tall lossless I420 parity — 2026-10-28

Added the active public parity row decode:avif:animated_lossless_compound_vertical_i420_b64x128 for a three-frame, 128x128, all-lossless 8-bit I420 sequence. The final frame is the exact per-sample average of its two references; a fixture-only pinned libaom patch forces the inter root into two vertical B64x128 leaves. Pillow 12.2.0 frame hashes are 8d5970545b72ff383366ee05a687ef5c1b2ad9c077423325499abca2d36207ca, c046f748dfe1bd899697d6cde047f11239987ec1cf83782334a2c5aa5e5de2e0, and 64c3d0552abe271f84a6f59d0d179877485829b79e48fbafabf8daf4cafbe028; independent pinned libavif loop evidence reports three frames and infinite repetition (-1). The selected public parity run passed 1/1 rows (49,152 output bytes per frame). No unit tests were added.

The selected LLVM report is .coverage-mcp/local-evidence/selected/current-lossless-compound-tall-i420-20261028/coverage.json (SHA-256 6aab7acb128f5e171a7a3066ea5451ac111032e36fa95b325a95276c0c63869d). A fresh full make coverage run passed all six integration executables (4, 1, 57, 7, 1, and 69 tests) and measured 95,065/139,980 lines (67.913273%), 18,936/32,088 branches (59.012715%), 5,272/8,955 functions (58.872138%), and 145,020/217,240 regions (66.755662%), passing configured floors. The report is .coverage-mcp/local-evidence/full/current-final-after-compound-tall-lossless-20261028/coverage.json (SHA-256 b12fbc40994d3cf94b6d730e7517e9d2209d7a89d4559f416c82bf97861b362f). Coverage MCP observed the luma_height > 64 true arm at src/codecs/avif/av1/block.rs:48440 compared with the previous full report. The report totals are unchanged, and source/build identity and test attribution are unverified, so this is coordinate evidence rather than a verified aggregate coverage gain. A subsequent gap query still reported missing branch outcomes at this predicate across six generic decoder specializations. The matrix contains 2,746 rows: 2,175 active decode rows and 540 active encode rows, with 31 planned encode rows.

AV1 compound wide lossless I420 parity — 2026-10-28

Added the active public parity row decode:avif:animated_lossless_compound_wide_i420_b128x128 for a deterministic three-frame, 128x128-superblock, all-lossless 8-bit I420 AVIF sequence. Pillow 12.2.0 exact RGB hashes and independent pinned libavif loop evidence cover all three frames. The selected public parity run passed 1/1 rows (49,152 output bytes per frame). No unit tests were added.

The retained selected LLVM report is .coverage-mcp/local-evidence/selected/current-lossless-compound-wide-i420-20261028/coverage.json. Its branch counter observes the wide lossless arm in decode_inter_compound_translation_lossless_grid; Coverage MCP marks source and build identity unverified, so this is targeted local evidence rather than a verified aggregate coverage gain. The current fixture matrix contains 2,746 total rows: 2,175 decode / inspect / verify rows and 571 encode rows. Of those, 2,175 decode rows and 540 encode rows are active; 31 planned encode rows remain. A refreshed full make coverage run passed all six integration executables (4, 1, 57, 7, 1, and 69 tests). It measured 95,065/139,980 lines (67.913273%), 18,936/32,088 branches (59.012715%), 5,272/8,955 functions (58.872138%), and 145,020/217,240 regions (66.755662%), passing the configured floors. The report is .coverage-mcp/local-evidence/full/current-final-after-compound-wide-lossless-20261028/coverage.json (SHA-256 48ffd4f369fa78923af2b32752411e7974536999aae2fd05a97a60a3fe119c87). Coverage MCP found nine newly observed branch coordinates against the previous full report, including the luma_width > 64 arm at src/codecs/avif/av1/block.rs:48440; the separate luma_height > 64 arm was not observed by that run. MCP marks source/build identity unverified and tests unknown, so no verified aggregate coverage gain is claimed.

JPEG RGB 4:2:0 SSE2/AVX2 runtime comparison — 2026-10-26

The merged PR #106 added a 16-pixel RGB 4:2:0 conversion path for AVX2, while retaining the existing SSE2 packet path. Its x86 benchmark run completed five rounds for each of 40 JPEG encode/decode workloads on one AVX2-capable Ubuntu host. The SSE2 lane ran before the AVX2 lane. All 40 Rust output lengths and hashes matched across the two builds.

For RGB Q85 4:2:0 encoding, the recorded median was 159,989 ns under SSE2 and 123,933 ns under AVX2 at 128x128 (1.291x), 3,340,953 ns and 2,830,304 ns at 512x512 (1.181x), and 13,394,850 ns and 11,414,454 ns at 1024x1024 (1.174x). In the same artifact, AVX2 Rust medians were 1.417x, 1.684x, and 1.729x the TurboJPEG 3.2.0 medians for those workloads. These hosted sequential runs show an AVX2-over-SSE2 improvement for the sampled workload, while leaving a clear gap to the oracle; they do not support a fastest-in-the-world or project-wide claim. The retained benchmark artifact has SHA-256 fecb3cf22f5f92a1da9c825a05ae010bf5be21af02f50a4e3b3c836d0ee44aeb.

AVIF I420 chroma reuse — 2026-10-28

The public decode_sequence profile for animated_motion_temporal_mv_range_2048x128.avif showed substantial time in the scalar 4:2:0 chroma filter. The decoder now advances row and column coordinates without per-pixel division, shares U/V filter geometry, and reuses each vertically filtered chroma sample across its adjacent output columns. The fixed-point weights, pre-filter high-depth shift, edge replication, and single final rounding operation are preserved. No unsafe code or unit tests were added.

On an Apple M3 Pro running macOS 15.7.7 with Rust 1.96.1, paired A–B–B–A runs timed the complete public sequence decode and output destruction 42 times per run in locked release builds (--no-default-features --features avif). The checkout was based on 69a79d4c4, with locked dependencies and matching release settings; the only codec-source change between the A/B builds was src/codecs/avif/decode.rs. The fixture SHA-256 is 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a, and the decoded output totals 2,359,296 RGB bytes. Baseline medians were 14.953 ms and 14.865 ms; the optimized medians were 12.238 ms and 12.194 ms. Averaging the two run medians gives an 18.06% latency reduction. This is one AVIF decode workload, not an encoder result or an x86 runtime result. A portable eight-lane RGB conversion experiment passed parity but did not improve the paired end-to-end result, so it was removed. make lint-x86-simd confirms the retained source still compiles under SSE2 and AVX2 flags; it does not measure runtime speed on those CPUs.

The final selected parity run passed seven public rows spanning 4:2:0 and 4:2:2, odd dimensions, 10-bit and 12-bit samples, alpha, and the timed animation. Coverage MCP found no missing branch coordinates in the new vertical-geometry or cached-sampling helpers for that run. The report is .coverage-mcp/local-evidence/selected/avif-420-filter-cache-final-20261028/coverage.json (SHA-256 406fa5e215d8b347b4a1b2b7f1cf86533f7e18ae47b366b7d5f70bc55fb20896). Its source/build identity and test attribution are unverified by Coverage MCP, so this is selected coordinate evidence, not an aggregate coverage claim. Timing logs are retained under .coverage-mcp/local-evidence/perf/avif-sequence-2048x128-arm64/.

WebP vertical dimension-limit parity — 2026-10-28

Added four active public encode parity rows for the WebP encoder's vertical dimension boundary: lossless and lossy success at 1x16,383, followed by the matching Pillow errors at 1x16,384. The selected parity run passed all four rows against Pillow 12.2.0. The cases extend the existing horizontal boundary fixtures and bring the matrix to 2,710 rows, with 540 active encode rows.

The refreshed full make coverage run passed all six integration test executables (4, 1, 57, 7, 1, and 69 tests; zero failures). It measured 94,615/140,050 lines (67.5580%), 18,816/32,142 branches (58.5402%), 5,259/8,957 functions (58.7139%), and 144,357/217,340 regions (66.4199%). The report is .coverage-mcp/local-evidence/full/webp-vertical-dimension-edges-20261028/coverage.json (SHA-256 d96b0ec4b0144942778dcf0c5cf53384670b6a1b7864e37aff463b4766ca8e11). Coverage MCP compared it with the previous full report and returned two newly observed branch coordinates, including the height-limit outcome in validate_dimensions at src/codecs/webp/encode/vp8/encoder.rs:119. The reports have unverified source/build identity and unknown test attribution, so this is coordinate evidence and not a verified aggregate coverage gain. The selected report is .coverage-mcp/local-evidence/selected/webp-vertical-dimensions-20261028/coverage.json (SHA-256 642b26ff047f1572b0cf71e08083406ff18e4c6824d32421e38b326d982e5a41). No production codec changes, Rust unit tests, or performance claims were added.

AV1 wide I420 compound parity — 2026-10-28

Added two active animated AVIF parity rows generated by scripts/generate_avif_lossy_compound_wide_i420.py. The mixed-residual case changes pixels in each 128x128 region of the final frame; the unsplit case uses the exact average of its two reference frames. Both compare all three 196,608-byte RGB frames against Pillow 12.2.0. The selected parity runs passed 1/1 each.

Coverage MCP's selected comparison found five additional branch outcomes for the unsplit case relative to the existing wide-I420 parity case. The reports have unverified source/build identity and unknown test attribution, so this is bounded selected evidence; no aggregate full-coverage increase is claimed. The refreshed full make coverage run passed all six test executables (4, 1, 57, 7, 1, and 69 tests). It measured 94,615/140,050 lines (67.5580%), 18,814/32,142 branches (58.5340%), 5,259/8,957 functions (58.7139%), and 144,357/217,340 regions (66.4199%). The report is retained at .coverage-mcp/local-evidence/full/avif-compound-wide-parity-20261028/coverage.json. Coverage MCP reports seven newly observed branch coordinates against the previous full report, but both reports have unverified source/build identity and unknown test attribution; no verified aggregate gain is claimed. Selected reports are retained under .coverage-mcp/local-evidence/selected/avif-compound-wide-parity-fixed-20261028/ and .coverage-mcp/local-evidence/selected/avif-compound-wide-unsplit-fixed-20261028/. No decoder implementation or Rust unit tests were added.

AVIF lossless B128 inter-grid parity — 2026-10-28

Coverage MCP's latest full report identified missing outcomes at src/codecs/avif/av1/block.rs:48440 in the lossless wide-grid predicate. Added two active public Pillow parity rows: the existing wide-grid witness and a new vertical B64x128 witness. The vertical fixture uses a fixture-only pinned libaom partition override to split the 128x128 inter I420 root into two valid B64x128 leaves; runtime code is unchanged by the encoder patch.

The selected parity run passed both rows (2/2), comparing 49,152 RGB bytes per frame with Pillow 12.2.0. Its LLVM counters show the tall predicate luma_height > 64 true twice in one decoder specialization. Coverage MCP still reports other branch outcomes at this source line across generic specializations. The selected/full incremental comparison is incomparable because the baseline branch detail does not match its reported totals; both reports also have unverified source identity and unknown test attribution, so no aggregate coverage gain is claimed. The selected report is .coverage-mcp/local-evidence/imported-worktree/selected-b128-both-20261028/coverage.json.

The last full coverage report before this selected run measured 94,404/140,013 lines (67.4252%), 18,766/32,158 branches (58.3556%), 5,252/8,953 functions (58.6619%), and 144,120/217,320 regions (66.3170%). It is retained at .coverage-mcp/local-evidence/imported-worktree/full-coverage-next-edge-20261028/coverage.json; the four-metric 100% gate remains open. make verify, make lint, and make lint-x86-simd passed. No Rust unit tests or SIMD implementation were added.

AVIF required sample-table parity — 2026-10-28

Coverage MCP identified the missing-offset, missing-stsc, and missing-stsd outcomes in samples::parse_stbl. Added three public AVIF parity rows whose fixtures replace exactly one required table with a same-size free box. The pinned Pillow oracle rejects each full file with UnidentifiedImageError: cannot identify image file <bytes>. The selected run passed all three rows, and the fixture generator is part of make verify-fixture-integrity.

The refreshed full make coverage run passed all six integration test executables (4, 1, 57, 7, 1, and 69 tests; zero failures) and the configured coverage floors: 94,102/139,678 lines (67.3707%), 18,712/32,056 branches (58.3728%), 5,246/8,947 functions (58.6342%), and 143,642/216,753 regions (66.2699%). Its report is .coverage-mcp/local-evidence/imported-worktree/full-avif-required-sample-tables-20261028/coverage.json (SHA-256 9578878af400a9200a1564101c73d28417ddcfab3dd92e5dfe17647cce2cce13). The Coverage MCP comparison reports three newly observed branch coordinates in samples::parse_stbl at samples.rs:2360; its remaining two branch outcomes are in container::parse_stbl. Both reports lack matching source/build receipts and MCP marks test attribution unknown, so the comparison is limited coordinate evidence. Public AVIF inspection parses the sample tables before the container tables, making those remaining missing-stsz/stsd container branches unreachable through the current public parity path. No Rust unit tests or production-code changes were added.

AVIF duplicate media-box parity — 2026-10-28

Added an animated AVIF success row combining repeated mdhd, hdlr, stts, stsz, stss, and stsd boxes with an unknown free child. Pinned Pillow accepts it with five RGB frames matching the source pixels. Pillow also accepts the missing-hdlr variant with matching pixels. Duplicate minf, duplicate stco, duplicate sample-size, missing-mdhd, and missing-minf error fixtures match Pillow's rejection behavior. The selected parity run passed all seven rows. The focused cases are generated and checked by scripts/generate_avif_media_box_edges.py; its checks rebase and verify the container offsets.

The fresh full make coverage run passed all six existing integration test executables (4, 1, 57, 7, 1, and 69 tests; zero failures) and the configured coverage floors: 94,102/139,678 lines (67.3707%), 18,709/32,056 branches (58.3635%), 5,246/8,947 functions (58.6342%), and 143,642/216,753 regions (66.2699%). Its report is .coverage-mcp/local-evidence/imported-worktree/full-avif-media-box-edges-20261028/coverage.json (SHA-256 1bc3c1d6fd16b78f4715e04d5fb3b009adea880b97de872429d4339b70e5e240). Coverage MCP marks report source identity unverified and test attribution unknown. Its coordinate queries list additional outcomes in AVIF parse_mdia, parse_stbl, and sequence_payload; these require source and test inspection before they can be treated as verified gaps. No SIMD path or performance claim was added, and no Rust unit tests were added. make lint, make lint-x86-simd, and make test-feature-matrix passed, including strict Clippy for debug, release, coverage, SSE2, and AVX2 targets, plus the native, WASI, and WASM feature lanes.

The current fixture matrix contains 2,714 total rows: 2,143 decode / inspect / verify rows and 571 encode rows. Of those, 2,143 decode rows and 540 encode rows are active; 31 encode rows remain planned. The roadmap and generated capability counts now reflect this matrix.

AVIF top-level duplicate-box parity — 2026-10-28

Added four active parity rows for duplicate top-level AVIF boxes around mdat. Pillow 12.2.0 ignores duplicate meta and moov boxes after media data, preserving the original five-frame metadata and pixels. Before mdat, a duplicate meta fails at image open; a duplicate moov opens and verifies but fails when Pillow decodes frame zero. The selected public parity run passed all four rows. Its report is .coverage-mcp/local-evidence/selected/avif-top-level-duplicate-order-20261028-final/coverage.json (SHA-256 2c5595219ddce35a70b8787e9d500841e226d59d7fbbcaa4021f8197fed22000).

Coverage MCP's selected comparison with the earlier after-mdat-only selection reports two newly observed branch coordinates in the extract_inner_with_metadata specializations at src/codecs/avif/samples.rs:2765. Source/build identity is unverified and test attribution is unknown, so this is bounded coordinate evidence rather than a verified aggregate coverage gain. The duplicate-mutation generator pins all four fixture hashes and checks each Pillow observation. No Rust unit tests, SIMD changes, or performance claims were added.

AVIF iloc payload-span parity — 2026-10-28

Coverage MCP's earlier full report listed unobserved outcomes in pixel_payload_bytes at src/codecs/avif/samples.rs:2939, :2943, and :2961. Added active parity row decode:avif:iloc_idat_disjoint_extents, whose two iloc extents have an eight-byte unreferenced gap in idat while reconstructing the exact original AV1 payload. The fixture hash is 999b5f5f5fabcc4b8ab75a8fbd85b4997cf5b2a4aa96861038a27e534db5d6e6. Its selected parity run passed with all 49,152 RGB bytes matching Pillow.

Added error parity row decode:avif:error_iloc_zero_length_file_extent for an empty file extent. Pillow rejects the empty image item, and the selected public Rust decode run matched that error with the exact metadata preflight limit of 3,077 bytes. The fixture hash is e97d452d82637dce3b2a03a514098486d185f03623c3f940c02730a2728c3818. The disjoint-extent case uses a 3,131-byte metadata limit to reach span collection while preserving the full pixel payload.

The refreshed full make coverage run passed all six test executables (4, 1, 57, 7, 1, and 69 tests; zero failures) and all configured coverage floors: 94,056/139,653 lines (67.3498%), 18,709/32,072 branches (58.3344%), 5,235/8,937 functions (58.5767%), and 143,593/216,726 regions (66.2555%). Its report is .coverage-mcp/local-evidence/imported-worktree/full-avif-payload-span-parity-20261028/coverage.json (SHA-256 493b02dfebd5a1568e881abe25bf1079a053e7a067560e8b6d0b4c61a8bc1ef5). The Coverage MCP comparison reported newly observed outcomes for all three target branches in pixel_payload_bytes. Both reports lack matching source/build receipts, and MCP marks test attribution unknown, so this remains coordinate evidence rather than a verified coverage gain. The matrix now has 2,680 rows, including 2,124 active decode rows and 624 active AVIF decode rows. No production decoder change, performance/SIMD claim, or Rust unit test was added.

PNG chunk iterator failed-state contract — 2026-10-27

The ordinary PNG decode path returns on its first chunk parse error, so no public input can call the private iterator again after that error and reach its failed short-circuit. Added the target-only row fault-contract:png:png_chunk_iterator_failure_stops_iteration, marked not_applicable for the Pillow oracle, to inject a deterministic parse failure under cfg(coverage) and verify that the following iterator call stops. The case checks the public malformed-input error and that a retry succeeds. Paired it with public parity row decode:png:pillow_tolerated_malformed_missing_iend, which covers the neighboring end-of-input branch and matched all 49,152 RGB bytes.

The combined selected run passed both rows (parity 1/1, fault contract 1/1). Its report is .coverage-mcp/local-evidence/selected/png-chunk-iterator-failure-20261027/coverage.json (SHA-256 865e434eb6638fcf2d8ff8e727246e63b4c3f46664a72f939643fe1f6ddbeb57). Coverage MCP returned no missing branch observations for src/codecs/png/decode.rs:2056 in this selected report. The report's source identity is unverified and its test attribution is unknown, so this is selected-coordinate evidence only. A subsequent full make coverage run passed all six test executables (4, 1, 57, 7, 1, and 69 tests; zero failures) and reported 93,981/139,644 lines (67.3004%), 18,683/32,072 branches (58.2533%), 5,230/8,934 functions (58.5404%), and 143,498/216,707 regions (66.2175%). Its report is .coverage-mcp/local-evidence/full-png-chunk-iterator-20261027/coverage.json (SHA-256 2b01d51753c01d2cee7d5e691457469440fcef9b4eda0cafda33b6b28cf8832b). Coverage MCP found no missing branch group at line 2056 in that full report. The raw report has no MCP source/build receipt, so these totals are a local baseline, not a verified aggregate gain; the remaining global gaps need source inspection. No performance gain, source coverage exclusion, or Rust unit test is claimed.

WebP method-zero 32-color palette parity — 2026-10-27

Coverage MCP's filtered older full report listed missing branch outcomes in apply_palette. Its source/build identity and test attribution were unknown, so the report was used to choose a candidate, not to claim a current suite gap. Added active parity row encode:webp:enc_lossless_method_0_palette32 using the existing 32-color WebP input. The method-zero path exercises the palette size-over-17 encoding branch and its one-index-per-byte packing case.

The selected parity run passed 1/1: Pillow and Rust encoded the input to the same 126 bytes, token and ordinary Rust encodes matched, and re-decoding matched all 64x64 RGB pixels. Its selected LLVM report is .coverage-mcp/local-evidence/selected/webp-method0-palette32-20261027/coverage.json (SHA-256 66f592f30727490741d38b0b5a543e214444bdbcb26aa4524581b0fdb3e6b84d). The Coverage MCP selected-report comparison against the existing 16-color case returned limited, with six newly observed and six not-observed outcomes across the token and ordinary apply_palette paths. The report records the true outcome for palette.len() > 17 and the false outcome for the transparent tail check at src/codecs/webp/native/encoder.rs:2315. Because MCP source/build identity and test attribution are unverified for these local reports, this is selected-row coordinate evidence, not a verified full-suite coverage gain. No production codec code or Rust unit tests were added, and no aggregate coverage or performance claim is made.

AVIF decoder-model parameter parity — 2026-10-27

Coverage MCP's imported full baseline identified the true arms in SequenceHeader::consistent_with at src/codecs/avif/av1/sequence.rs:87 and :96 as missing. Added active row decode:avif:animated_decoder_model_parameters_change and a deterministic mutation of the pinned animated AVIF that changes the decoder-buffer delay in a repeated sequence header. Pillow 12.2.0 and Rust matched all five frames; the selected parity run passed 1/1 with 67,500 RGB bytes matching.

The selected local LLVM report is .coverage-mcp/local-evidence/selected/avif-decoder-model-parameter-20261027/coverage.json (SHA-256 1b4056a457fb9eec1c4901f00a84349ad0cf33a3d69c0681bc8863be4b9f8422). It records one hit on each true arm at lines 87 and 96. Coverage MCP cannot read reports in this managed worktree, so the selected result has no MCP source/build attribution or MCP incremental comparison. The full coverage suite was not rerun. No production codec change or Rust unit test was added.

WebP VP8 sharpness-4 parity — 2026-10-27

Added active row decode:webp:lossy_vp8_filter_variants_lossy_strong_sharp4, generated with pinned libwebp 1.6.0 strong filtering and sharpness 4. Pillow 12.2.0 expects a 128x128 RGB result; the selected parity run passed 1/1 with all 49,152 bytes matching.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261027T035807.061420Z-4b00478634e347d2ac4abf91f352db84/coverage.json (SHA-256 22d39a55d0400d2cd2e565187ab27aba13478723df12f79678a88a697cc46b7d). It records 192 visits to the nonzero sharpness path and 192 false outcomes for sharpness_level > 4 at src/codecs/webp/native/vp8.rs:1926. The previous full report recorded no false outcomes there, and Coverage MCP's baseline gap lookup identified that missing arm. Its incremental comparison was incomparable because the baseline lacked complete exact branch detail; source identity and test attribution remain unverified, so no aggregate coverage gain is claimed. No production code or Rust unit tests were added.

WebP hash-chain index guard contract — 2026-10-27

Added the target-only contract fault-contract:webp:webp_hash_chain_index_overflow_rejected for the private VP8L hash-chain index bound. Public WebP encoding caps each axis at 16,384 pixels, so a Pillow parity input cannot exceed the i32 sample-index range. The cfg(coverage) fault point drives this defensive guard through the public encoder while leaving release builds without fault controls.

The case first decodes the active Pillow lossless_vp8l input, injects the failure, and checks the structured WebP Dimensions error. An uninjected retry must match the existing enc_lossless Pillow byte reference, produce the same bytes as a fresh retry, and decode to the Pillow RGB reference. The range check now runs once before the low-effort/high-effort const-generic split. In the focused run, both outcomes of the i32 conversion check were observed; Coverage MCP reports no missing branch at that guard. The selected run passed 1/1. Its report is .coverage-mcp/local-evidence/selected/webp-hash-chain-index-overflow-20261027-attempt-3/coverage.json (SHA-256 42919ee848aeab78d179ec885552704279c8a6eb3acde2855b779a84505165bb).

The refreshed full make coverage run passed, including 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its current report is .coverage-mcp/local-evidence/full-20261027-webp-alpha-raw-token/coverage.json (SHA-256 379e6fe31021fce03cf965be6aa903938c93d70df50e226e549b80fc56c98ba3). Totals are 93,817/139,562 lines (67.2225%), 18,626/32,042 branches (58.1300%), 5,224/8,928 functions (58.5125%), and 143,267/216,612 regions (66.1399%). The raw full-report branch counters now record one true and 14 false outcomes at the token-aware raw-alpha choice (encoder.rs:2959); line, branch, and function totals did not increase, while covered regions increased by one. Coverage MCP cannot open this managed-worktree report, so no verified aggregate gain or regression is claimed. This is target-only fault-contract evidence, not a Pillow parity pass. The coverage-only fault hook is absent from release builds; no performance speedup is claimed, and no Rust unit tests were added.

WebP RIFF sink header fault contracts — 2026-10-27

Coverage MCP's imported full report marked the true arms of write_riff_to_sink's short-header, RIFF signature, and WEBP form-type checks as missing. That baseline has no source/build receipt, so the gaps were treated as candidates and confirmed against the current encoder before adding tests.

Added target-only cases fault-contract:webp:webp_riff_header_too_short_rejected, fault-contract:webp:webp_riff_signature_mismatch_rejected, and fault-contract:webp:webp_form_type_mismatch_rejected. Each references the active encode:webp:enc_lossless parity row and checks the structured Malformed/StillEncode result, preservation of caller sink contents, and a clean retry against exact Pillow bytes and decoded RGB pixels. All three selected cases passed. Their local LLVM report is .coverage-mcp/local-evidence/selected/webp-riff-sink-headers-20261027-attempt-4/coverage.json (SHA-256 777f29b2f7b95157fbc83818328c001991e6842fb7426a6ff7659a0f349b390b). It records one true and respectively 8, 7, and 6 false-arm hits at src/codecs/webp/encode/mod.rs:189, :194, and :199; every decision arm in the new fault hook also has nonzero true and false counters. The managed-worktree report is local-only; Coverage MCP cannot verify its source/build identity or attribute its test run. No aggregate coverage increase is claimed. Fault mutation is compiled only for coverage builds; its three guards are recorded as defensive_model in the coverage-origin inventory. No Rust unit tests were added.

WebP RIFF declared-size fault contract — 2026-10-31

Added target-only case fault-contract:webp:webp_riff_declared_size_mismatch_rejected for the declared-size validation in write_riff_to_sink. It uses the existing encode:webp:enc_lossless Pillow parity row, flips one bit in the generated RIFF size field only in coverage builds, and checks the public inconsistent-size error, unchanged caller sink, and exact-byte/pixel parity on retry.

The four selected WebP RIFF fault contracts passed 4/4. Their local LLVM report is .coverage-mcp/local-evidence/selected/20261031T133341.469954Z-246b71b216ef4e648f27548b77a48617/coverage.json (SHA-256 de72c855db8284ff307c99c33038c60b2b47401e69d6bc9ee7ee872f2403e767). It records one true and 11 false-arm hits at src/codecs/webp/encode/mod.rs:191, one true and 10 false at :196, one true and 9 false at :201, and one true and 8 false at :208. The source hash before and after this selected run was 98abc70a153da4be50d9b63d27545c55ef735a8839a414550a9f48d486e2852d. Coverage MCP returned Transport closed, so this is local-only evidence and claims no managed aggregate coverage gain or regression. The fault result is target-only, not a Pillow parity pass. The fault point and enum exist only in coverage builds; no release-path or performance change is claimed.

WebP token-aware raw-alpha parity — 2026-10-27

Added active parity row encode:webp:enc_lossy_rgba_alpha_raw_token, reusing the seeded high-entropy alpha input from enc_lossy_rgba_alpha_raw and adding the public cancellation-token encode path. The pinned Pillow 12.2.0 reference is 4,210 encoded bytes (SHA-256 c3fed186ee97cc2418fd1815880646118e73fdaa3fed896bf977118972b13e4d); decoding the result matched all 16,384 RGBA bytes. The selected parity run passed 1/1.

The selected LLVM report is .coverage-mcp/local-evidence/selected/webp-alpha-raw-token-20261027/coverage.json (SHA-256 22bd017a9a5aad3a041ac86326483301ed97ec255b1bc94e2e3a70b319dac0a7). Its raw branch counters record the previously unobserved true arm of encode_alpha_stream at src/codecs/webp/native/encoder.rs:2959 once in the TokenBitWriterCheckpoint specialization; the earlier full report recorded zero true-arm hits at that coordinate. Coverage MCP could not open reports from the managed worktree, so this remains selected LLVM evidence with no verified aggregate gain. No production code changed, and no Rust unit tests were added.

AVIF qindex-zero non-lossless inter parity — 2026-10-27

Added active rows decode:avif:animated_lossy_inter_420_b16x64_qindex0_mode_select_64x64 and decode:avif:animated_lossy_inter_monochrome_b16x64_qindex0_mode_select_64x64. Both deterministic 64×64 sequences use a lossless key frame and a non-lossless qindex-zero TX_MODE_SELECT inter frame. The I420 inter frame has chroma quantizer deltas of 2; the monochrome inter frame has a luma DC delta of 2. Their pinned generators verify repeatable timestamp-normalized AVIF output, frame headers, and exact Pillow RGB frame hashes.

The decoder now passes the segment qindex to inter transform-type decoding. Qindex zero selects the default DCT transform even when quantizer deltas make the segment non-lossless. This avoids consuming a transform-type symbol that these inputs do not signal. The focused public parity run passed 2/2, with 12,288 RGB bytes matching Pillow for each case. The full make test run also passed, including the complete matrix suite and native, WASI, and WASM feature lanes. The local LLVM report is .coverage-mcp/local-evidence/selected/avif-q0-final-coverage-20261027/coverage.json (SHA-256 72010b8a5d9436661980a8d941c26b2b7f12382109386d40287c3c4236cfc4d0). Its selected counters record seven hits on the new qindex-zero DCT path, two hits on the I420 qindex-zero single-terminal guard, and three on the monochrome guard. Other generic instantiations remain unobserved in this selected run.

Coverage MCP's saved full report identified missing transform-type branch observations, but has no source/build receipt and reports source identity as unverified and test attribution as unknown. It cannot read the refreshed report from this managed worktree, so the local counters are selected-scope evidence only; no full-suite or marginal coverage gain is claimed. No Rust unit tests were added.

AVIF narrow qindex zero inter parity — 2026-11-03

Added active row decode:avif:animated_lossy_inter_420_b4x8_qindex0_mode_select_64x64. The deterministic 64×64 8-bit I420 sequence has a lossless key frame followed by a TX_MODE_SELECT inter frame with base qindex zero and chroma quantizer deltas of 2. Its narrow B4×8 transform geometry exposed an intra-coded block where generic intra transform selection checked segment_lossless but not the base qindex. Passing the segment qindex preserves the implicit DCT_DCT choice and keeps coefficient decoding aligned.

The selected public parity run passed 1/1 with all 12,288 RGB bytes matching Pillow. The pinned fixture generator check also passed. Its selected report is .coverage-mcp/local-evidence/selected/20261103T155915.218400Z-e016d2ff385040159ad7c0daa314d31e/coverage.json. Its SHA-256 is d9cf5279002d0d3da1f61b6f11278305b1c0732c40c27552db8e5f3e48befa67. This is selected-scope evidence, not an aggregate coverage claim. No SIMD performance measurement was part of this correctness fix, and no Rust unit tests were added.

I444 compound split parity — 2026-10-26

Added active row decode:avif:animated_lossy_inter_i444_compound_split_b16x32_mode2. The deterministic 1,457-byte fixture pins its normalized AVIF hash and all three Pillow RGB frame hashes. The final frame header permits compound selection and exposes both earlier frame references. The pinned native loop observer reports three decoded frames and infinite repetition.

The selected parity/coverage run passed 1/1 with exact RGB output. Its LLVM report is .coverage-mcp/local-evidence/selected/i444-compound-probe-20261026/coverage.json (SHA-256 07edc4ef031fafcc623a061136ca8023157be78ed6d489a391419f138a992b37). At src/codecs/avif/av1/block.rs:48314, the target decode_inter_compound_translation specialization recorded two true-arm hits; the saved full report recorded zero true-arm and 67 false-arm hits for that specialization. This is branch-specific evidence, not an aggregate coverage union. The saved full and selected reports lack Coverage MCP source/build receipts; MCP therefore marks source identity unverified and test attribution unknown. Its incremental comparison is incomparable because baseline branch detail is incomplete. Other generic specializations at this location remain uncovered. No production Rust code or unit tests were added.

AV1 temporal motion-vector range parity — 2026-10-26

Added active rows decode:avif:animated_motion_temporal_mv_range_2048x128, decode:avif:animated_motion_temporal_mv_range_positive_x_2048x128, decode:avif:animated_motion_temporal_mv_range_negative_y_128x2048, and decode:avif:animated_motion_temporal_mv_range_positive_y_128x2048. The four A/B/A sequences use 16-pixel texture runs or bands and translate 600 pixels in each signed axis direction. The deterministic generator pins complete AVIF hashes and all exact Pillow RGB frame hashes; the independent native observer records infinite repetition for each sequence.

The combined selected parity run passed 4/4, with every 786,432-byte RGB frame matching its Pillow reference. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261026T143900.923631Z-bec51189f9e34b9aa76a14cd518a81bb/coverage.json (SHA-256 6dc06570ffd077bfd47027fe31154e937cd43a2d78071bdf462f085a78a5039b). Raw branch counters at src/codecs/avif/av1/tile_state.rs:995 record all four signed motion-vector boundary false arms: 2,304 hits for y > -4096, 2,083 for y < 4096, 2,560 for x > -4096, and 2,336 for x < 4096.

Coverage MCP's line-specific branch lookup returned no gap at line 995. The report had to be copied temporarily from the managed worktree because the MCP cannot read that worktree directly; it therefore marked source identity unverified and test status unknown. The incremental comparison with the prior full AVIF selection was incomparable because the provider lacked complete branch detail, so no marginal coverage gain is claimed. In this selected run, the spatial_block absence and ineligible-reference outcomes in temporal_entry_at remain unobserved and are pending public-parity discovery. No Rust source or unit tests were added.

AVIF tall TX_MODE_LARGEST parity — 2026-10-26

Added active row decode:avif:animated_lossy_inter_420_mode_largest_16x64. Its pinned generator verifies a two-frame 16x64 8-bit I420 sequence, an inter frame signaling TX_MODE_LARGEST with positive base qindex, and exact Pillow RGB frame hashes. Native libavif evidence records two decoded frames, infinite repetition, and 100 ms frame durations.

The selected parity run passed 1/1 with 3,072-byte RGB output. Its report is .coverage-mcp/local-evidence/selected/20261026-avif-i420-mode-largest-16x64.json. Coverage MCP's baseline lacked the false arm of the 16x16 reference-height guard at src/codecs/avif/av1/entropy.rs:14344; the selected report records that arm for one generic instantiation. A coordinate-level comparison found seven new false-arm observations across related 16x16 guards, while other generic instantiations remain uncovered. Coverage MCP marks source identity unverified and named-test attribution unknown, so this is selected evidence, not a verified aggregate gain. This earlier case did not reach the candidate wide_lossy_single path; the fixture claims the signaled transform mode, not a particular transform size. No Rust code or unit tests were added.

AVIF coded B64x16 inter parity — 2026-10-26

Added active rows decode:avif:animated_lossy_inter_420_b64x16_mode_largest_64x64, decode:avif:animated_lossy_inter_420_b64x16_mode_select_64x64, decode:avif:animated_lossy_inter_420_b64x16_10bit_mode_select_64x64, and decode:avif:animated_lossy_inter_420_b64x16_12bit_mode_select_64x64. The fixture-only encoder forces PARTITION_HORZ_4 at the 64x64 inter-frame root, creating four coded B64x16 leaves with positive qindex. The 8-bit pair signals TX_MODE_LARGEST and TX_MODE_SELECT; the 10-bit profile-0 and 12-bit profile-2 companions preserve the select-mode pattern at high bit depths. The generator requires deterministic timestamp-normalized encodes, exact Pillow 12.2.0 RGB frames, and the pinned AV1 frame-header profile. An independent pinned dav1d trace confirms the inter-frame root partition for the 8-bit pair.

The combined selected public parity run passed 4/4 with exact RGB output. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261026-avif-i420-b64x16-depth-coverage-r2.json (SHA-256 efc1a82884be25317b04465bf151728161006500a8d15a4db59ba120b62c5c63). Across the selected binary it observes 3,829 of 32,078 branch outcomes, 294 more than the earlier 8-bit-pair-only selected report; this is selected-scope evidence, not a full-suite union. At src/codecs/avif/av1/block.rs:48406, one of eight generic branch records has four true-outcome hits and three false-outcome hits; the other seven records have no hits. The mode-select cases reach the false outcome at 8, 10, and 12 bits. The positive-qindex outcome at line 48407 is observed three times; its qindex-zero alternative remains uncovered. Coverage MCP cannot read this report from the managed worktree. Its saved full baseline reports 13,447 of 32,078 branches missing, with source identity unverified and test attribution unknown, so this selected run does not establish an aggregate gain. No Rust source or unit tests were added.

AVIF thin B16x64 lossy TX_MODE_SELECT parity — 2026-10-26

Added active row decode:avif:animated_lossy_inter_420_b16x64_mode_select_64x64. Its fixture-only pinned libaom patch forces PARTITION_VERT_4 at the 64x64 inter root, producing four B16x64 leaves. The first leaf has a low-frequency residual; the other leaves retain texture so the frame signals TX_MODE_SELECT. The deterministic generator verifies the pinned Pillow 12.2.0 RGB frames and AV1 headers. A temporary decoder trace confirmed the first inter leaf is 16x64 at qindex 76 and selects the wide single transform; both public Rust frame outputs match Pillow exactly. The pinned native loop observer records both frames and infinite repetition.

The one-row selected parity run passed 1/1. Its LLVM report is .coverage-mcp/local-evidence/selected/20261026T124731.508781Z-b6bb2feb74784ffca8ae467eac027ce1/coverage.json (SHA-256 dcd5fd136ea83db1da78563e4758f1098fdc9f31e8c689b2fbdafb0d57bb724f). The full active AVIF decode selection then passed 607/607; its retained report is .coverage-mcp/local-evidence/selected/20261026T125143.028760Z-27bd0323559441969424d44b79b1ec82/coverage.json (SHA-256 0961e684dee04a06af1e1f2314866711d218571a45503933eeda12dc801d010f). The selected report records the thin-block and positive-qindex outcomes at src/codecs/avif/av1/block.rs:48418 and :48420. Coverage MCP reports source identity unverified and test attribution unknown for the selected evidence; the full report lookup timed out. No aggregate or marginal coverage gain is claimed. This case remains a distinct B16x64 regression witness. No Rust unit tests were added.

JPEG trailing DHT segment-boundary parity — 2026-10-26

Added active decode rows decode:jpeg:baseline_444_single_scan_trailing_dht_short_length_with_tail_counts and decode:jpeg:baseline_444_single_scan_trailing_dht_short_length_with_tail_value. The first declares only one DHT count byte and places the remaining count bytes outside the segment; the second declares one symbol and places its value byte outside the segment. Both complete JPEG inputs pass Pillow structure verification, while Pillow 12.2.0 rejects pixel decoding with OSError: broken data stream when reading image file; the Rust public decoder matches the malformed-input result.

The two selected parity cases passed 2/2. Their retained LLVM report is .coverage-mcp/local-evidence/selected/20261026T014941.848086Z-38eb7f1cd96f4921ae3377a017f4025c/coverage.json (SHA-256 49be79c7021c13ad6d18c4d8667fb86355d166bf232164a37e7110a006eac206). Raw branch counters observed the DHT count-table and symbol-value boundary guards in src/codecs/jpeg/decode/decode.rs. Coverage MCP marked source identity unverified and test attribution unknown, so this is selected local evidence, not a verified aggregate coverage gain. No Rust source changed and no unit tests were added.

The current fixture matrix contains 2,639 total rows: 2,111 decode / inspect / verify rows and 528 encode rows. Of those, 2,111 decode rows and 497 encode rows are active; 31 planned encode rows remain.

JPEG duplicate grayscale SOS selector parity — 2026-10-26

Added the active decode row decode:jpeg:baseline_grayscale_duplicate_sos_component. Its deterministic fixture duplicates the sole grayscale component record within one baseline SOS and updates the segment length while preserving the entropy-coded scan. Pinned Pillow accepts inspection and verification but rejects pixel decoding; the Rust decoder matches its malformed-input outcome. This case covers the equal component-index boundary in validate_scan_component_order, distinct from an out-of-order selector.

The focused selected parity run passed 1/1. Its retained LLVM report is .coverage-mcp/local-evidence/selected/jpeg-duplicate-sos-component-20261026/coverage.json (SHA-256 8508f00520443c50f370fe471049afbb5be832c4d91ffbcbe0bc1856db174f3b), with an unchanged source and fixture set during execution. It does not cover the previously observed scan.components.as_slice() else arm at src/codecs/jpeg/decode/decode.rs:2669: decode rejects duplicate scan indexes in validate_scan_component_order before reaching the grayscale fast path, and the parser rejects an empty SOS. No ordinary one-component JPEG scan can reach that arm, so no parity input or unit test was added for the private state. Coverage MCP was unhealthy during the gap query; its local receipt is not a verified source/build receipt and records test attribution as unknown.

JPEG duplicate grayscale scan parity — 2026-10-26

Added the active decode row decode:jpeg:baseline_grayscale_duplicate_component_scan. Its deterministic fixture duplicates the sole full baseline scan in the pinned grayscale source and passes Pillow's container verification, while Pillow pixel loading rejects the repeated scan. The JPEG grayscale direct-safe path now rejects a repeated single-component scan as malformed; color multi-scan duplicate-component behavior remains covered by its existing parity row.

The four-row selected parity batch passed 4/4, including the malformed input, baseline grayscale, progressive grayscale, and color multi-scan regression cases. Raw LLVM branch counters observed both outcomes at reconstruct_single_scan_grayscale_direct_safe; Coverage MCP marked the report unverified and did not attribute those outcomes to tests, so this is selected local branch evidence only. The retained selected report SHA-256 is 5845b9223258a5771661bcf65196ce88cf366203e2727d6e417145292098c4df.

The subsequent full all-feature LLVM run passed the complete integration suite and retained .coverage-mcp/local-evidence/full-20261026-gray-multiscan/coverage.json (SHA-256 de5ee2500bf23f4d6002f6405607250cf225e2db66456bca01730cbcb5557917). It measured 93,857/139,522 lines (67.2704%), 18,638/32,078 branches (58.1021%), 5,225/8,928 functions (58.5237%), and 143,367/216,563 regions (66.2011%), above the configured floors. Coverage MCP read an imported copy with source unverified and test attribution unknown; its branch gaps are leads, not verified test attribution or regression claims. The four-metric 100% goal remains open.

The current fixture matrix contains 2,618 total rows: 2,091 decode / inspect / verify rows and 527 encode rows. Of those, 2,091 decode rows and 496 encode rows are active; 31 encode rows remain planned.

JPEG baseline 4:4:4 unaligned-width parity — 2026-10-25

Added active encoder parity row encode:jpeg:enc_sub_444_unaligned_large_width_fallback, reusing the 33×33 RGB JPEG source. Its area (1,089 pixels) passes the baseline row-streaming threshold, while width 33 fails the 8-pixel alignment guard at src/codecs/jpeg/encode/mod.rs:683 and selects the generic fallback. The pinned Pillow reference is 1,470 encoded bytes with SHA-256 2e3477bd6c8e471005723e5a7c86a3aa2e6ba060a8fae116eae11a86eb4a71f8; the decoded 3,267-byte RGB reference has SHA-256 1c215933edf3484516304582490a95e0d64d38ae506d992b5fe7ed6ac548cb63.

The exact selected parity run passed 1/1, matched all encoded bytes, and re-decoded to 33×33 RGB pixel parity. Its report is .coverage-mcp/local-evidence/selected/jpeg-444-wide-20261025/coverage.json (SHA-256 e2eccb6e0f1143a1b542a936b09f094b3687576aa11798277d61d7846a5baa94). Coverage MCP reports the true arm of the width guard as still missing in this selection, consistent with this unaligned input covering the false edge. MCP marks source/build identity unverified and test attribution unknown; the local receipt records source revision f916e810ed7d435e0e1fc4493da3a881d9e2b469, no source change during execution, and an unchanged fixture snapshot. The report is selected-case evidence only, not a project-wide coverage claim. No Rust source changed and no unit tests were added.

The current matrix contains 2,616 total rows: 2,089 decode / inspect / verify rows and 527 encode rows. Of those, 2,089 decode rows and 496 encode rows are active; 31 encode rows remain planned.

AVIF B32 lossless coverage follow-up — 2026-10-25

Kept the 32x32 10-bit I420 all-lossless sequence with a translated 31x31 texture patch as a public parity case. The finalized five-row selection passed 5/5 exact Pillow pixel comparisons; its two-row control selection passed 2/2. Coverage MCP's selected comparison observed 71 additional branch coordinates across 32 function groups, with the same 32,056-branch denominator. Its result is limited because source/build identity is unverified and test attribution is unknown. The local receipts for both selections record the same source-manifest SHA-256 c06ebd6afe7cc9dcc5dda317bb59c2b606bba236d52b95646d1e0bf9f3399c5c, no source change during either run, and all selected parity rows passing.

The five-row report is .coverage-mcp/local-evidence/selected-from-worktree/av1-final-five/coverage.json (SHA-256 df5052e93991f4dad8fb5be78211f4651fab05912fc9d01cb41f796ac5afd5eb); the controls are in .coverage-mcp/local-evidence/selected-from-worktree/av1-final-controls/coverage.json. The five-row LLVM data records both outcomes of the partial-grid geometry check at block.rs:47999 (one true, six false); controls recorded three false outcomes. The combined selection does not isolate which clipped case produced the true outcome, and selected evidence does not establish full-suite or release coverage. No Rust unit tests were added; all selected cases use the public Pillow parity matrix.

The current matrix contains 2,609 total rows: 2,083 decode / inspect / verify rows and 526 encode rows. Of those, 2,083 decode rows and 495 encode rows are active; 31 encode rows remain planned.

AVIF 10-bit I420 lossless input variants — 2026-10-25

Retained two distinct two-frame 16x16 all-lossless AVIF parity inputs: a near-full-frame texture shifted by one pixel and a moving 4x4 luma patch. Both have exact Pillow RGB frame references and independent native infinite-loop observations. The exact selected parity run passed 2/2 cases. Its LLVM report is .coverage-mcp/local-evidence/selected/20261025T155900.516310Z-a23aa3bbec5b4d718a3af53a981d7a71/coverage.json (SHA-256 f9370f8dd76b8fc308283d017c27b985ef6e2518d1e969bb1ce5b72ce9782145).

Coverage MCP's selected-test comparison with the earlier small-patch selection observed 39 additional branch locations and no missing observations. Its receipt leaves source/build identity unverified and test attribution unknown, so this is selection-level evidence rather than a verified aggregate coverage gain. At that source revision, the branch at src/codecs/avif/av1/block.rs:48152 remained uncovered; the fixtures did not assert a particular encoder leaf geometry. No Rust unit tests were added. At that checkpoint, the matrix contained 2,608 total rows: 2,082 decode / inspect / verify rows and 526 encode rows. Of those, 2,082 decode rows and 495 encode rows were active; 31 encode rows remained planned.

TIFF later-IFD BitsPerSample parity — 2026-10-25

Added public sequence-decode parity rows for a second TIFF directory with empty or nonuniform BitsPerSample. Both fixtures derive from the pinned multipage.tiff source; the generator checks source and output digests, first page pixels, and Pillow 12.2.0's sequence error. TIFF inspection now marks a sequence count incomplete when a later directory has empty or nonuniform sample depths, while the normal decoder retains the matching malformed-data error.

The seven-row selection covering these cases and existing multipage controls passed 7/7. The LLVM report is .coverage-mcp/local-evidence/selected/20261025T132428.639043Z-6c94ed7ecadd415b95c0894d8a57d1f2/coverage.json (SHA-256 aebd9cbeec4296e7e330293e9ec26400aea3a7c8597f39d483d523398e936457). Its branch counters show both outcomes for the two BitsPerSample checks at decode_ifd:201. Coverage MCP still labels this selected report's source as unverified and test attribution as unknown, and reports four missing branch observations at that line; this is local selected-run evidence, not an aggregate coverage or regression claim. No Rust unit tests were added.

AVIF variable-luma loop-filter parity — 2026-10-25

Added the active animated_lossy_i420_mode2_variable_tx_loopfilter_b128x128 row, a deterministic two-frame 256x256 I420 AVIF whose inter frame exercises variable luma transforms with nonzero loop-filter levels. The pinned Pillow 12.2.0 references match both decoded RGB frames, and the native libavif loop evidence parses successfully.

The exact selected parity run passed 1/1 case. Its LLVM report is .coverage-mcp/local-evidence/selected-from-worktree/av1-variable-luma-loopfilter-final-2026-10-25/coverage.json (SHA-256 26bac7919731c1c27d8a16e0f35de3a617af63de874fdb17557a4d27b47d8565). At filter.rs:247, the report has one build_masks instance with both branch counters observed and a separately mangled zero-count copy. Coverage MCP lists the true and false observations as gaps; it labels source identity unverified and test attribution unknown. Direct LLVM records at the same source revision show the active function's true counter moving from 0 in the full baseline to 1 in the selected run (with 7 false-edge hits); the zero-count copy remains. Coverage MCP's incremental comparison is incomparable because the baseline's branch detail is incomplete. This is a precise local edge observation, not an MCP-verified aggregate coverage gain. No Rust unit tests were added.

The current matrix contains 2,606 total rows: 2,080 decode / inspect / verify rows and 526 encode rows. Of those, 2,080 decode rows and 495 encode rows are active; 31 encode rows remain planned.

WebP color-transform size-field truncation parity — 2026-10-25

Added a malformed VP8L stream that completes a subtract-green transform and leaves only two of the following transform's three size bits. Pinned Pillow accepts it in verify and reports OSError: failed to read next frame during decode. The independent VP8L parser classifies the failure as a truncated transform header at bit offset 46. The selected public parity case passed 1/1. The current matrix contains 2,605 total rows: 2,079 decode / inspect / verify rows and 526 encode rows. Of those, 2,079 decode rows and 495 encode rows are active; 31 encode rows remain planned.

WebP lossy-alpha filter parity — 2026-10-25

Added seven active public encode rows for horizontal, vertical, and gradient alpha prediction, nonzero palette gaps, palette wraparound, and the token-aware horizontal-filter path. The alpha encoder now compares the unfiltered and estimated-filter candidates and emits the exact pinned Pillow WebP bytes. The selected alpha set passed 28/28 rows, including 124 public encode calls with no panics. No Rust unit tests were added.

make fmt, strict make lint, make lint-x86-simd, make verify PYTHON=.oracle-venv/bin/python, and make test-feature-matrix passed. The full coverage matrix passed all 57 matrix tests, 69 feature-gate tests, and four animation-loop checks. Configured coverage floors passed at 93,688/139,473 lines (67.172858%), 18,573/32,068 branches (57.917550%), 5,213/8,917 functions (58.461366%), and 143,021/216,455 regions (66.074242%). Strict make coverage-complete still fails its 100% requirement. The retained local report is .coverage-mcp/local-evidence/full-20261025-webp-alpha-filter-option-final/coverage.json. Coverage MCP reports no missing branches in the new filter estimator or filter-plane helpers in that report. Its source identity is unverified and test attribution is unknown; the largest remaining WebP groups include fill_hash_chain_impl, write_huffman_tree, write_token_stream, and apply_palette. Inspect their source paths before adding parity rows because some gaps belong to mutually exclusive generic token/no-token paths.

A six-input A–B–B–A comparison against pinned Pillow confirmed exact encoded bytes for every input. The Rust/Pillow speed ratio ranged from 0.35× to 0.81×; this records an open encoder-performance gap and is not a speedup claim. The x86 SSE2 and AVX2 builds pass strict cross-target lint, but runtime timing on x86 hardware remains outstanding.

Full local coverage snapshot — 2026-10-25

make COVERAGE_REPORT='.coverage-mcp/local-evidence/full-20261025-jpeg-even-upsampling/coverage.json' coverage passed the full matrix and configured floors. The retained report is .coverage-mcp/local-evidence/full-20261025-jpeg-even-upsampling/coverage.json: 93,362/139,140 lines (67.099324%), 18,508/32,020 branches (57.801374%), 5,201/8,903 functions (58.418511%), and 142,637/216,056 regions (66.018532%). All 2,070 active decode rows, 486 active encode rows, 93 target-only fault contracts, four animation-loop checks, and 69 feature-gate tests passed. Coverage MCP reports no branch gap in the packed-tile row copier, either bit-order implementation, the 2-by-2 converter, or the custom-coefficient 1-by-2 converter. It also reports no remaining branch gaps at the even-width YCCK h2v1 and h2v2 final-sample checks in src/codecs/jpeg/decode/upsample.rs:494 and :541. It still reports the defensive zero-subsampling guard in the general converter at src/codecs/tiff/decode.rs:2434; public TIFF validation rejects unsupported pairs at src/codecs/tiff/decode.rs:307 before this helper is called. That private guard remains a documented coverage limitation, not a target-only test target. Other TIFF gaps remain, including decode_ifd. The report source identity is unverified and test attribution is unknown. The overall 100% coverage objective remains open. The report's fixture snapshot contained 2,587 total rows: 2,070 decode / inspect / verify rows and 517 encode rows. Of those, 2,070 decode rows and 486 encode rows were active; 31 encode rows remained planned. Typed target-only fault contracts are tracked separately from Pillow parity rows.

AVIF mixed-lossless B32 residual parity — 2026-10-25

Added active parity row decode:avif:animated_mixed_lossless_inter_b32_i420_residual_64x64. Its deterministic 64×64 two-frame AVIF has a full-visible unsplit qindex-zero inter B32 ROI whose 1,024 RGB pixels all change between frames. The fixture SHA-256 is 58552db6049a5220936acccbb483fd0366224744e7a2f81058a099b4016d5d36; pinned Pillow frame hashes are 90ce523631e9fd385bcae414317ca29e655e9fa26a022e09d50795e71b32d634 and f99f8c1c96218f4dde446f18003ec53ae2c35e57a4f1e1b46ce406a2dbe6ef61. The native loop evidence confirms two frames and infinite repetition, normalized to loop count zero. The exact selected parity row passed 1/1.

Coverage MCP still reports missing branch arms at src/codecs/avif/av1/block.rs:48152. The selected report did not observe either arm for this row, so it does not close that gap and no aggregate coverage gain is claimed. MCP marks source identity unverified and test attribution unknown. The current matrix contains 2,592 total rows: 2,074 decode / inspect / verify rows and 518 encode rows. Of those, 2,074 decode rows and 487 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 102 cases.

TIFF compressed FillOrder 2 parity — 2026-10-25

Added three 17×13 grayscale TIFF parity rows covering Deflate, LZW, and PackBits with FillOrder=2. Their complete fixture SHA-256 values are 359ce018950a1959a1fc1f621e2313177817772bc42545346cd191b744d1e851, 688b5355bd642d870c6d8450fb943ad189d9dbd7b9df834127bdbbc3f060dae7, and 68b28cdf7af702becd02ccb328da7680593873563b51c14844c4305feef54924. All three decode to the same 221-byte grayscale payload with SHA-256 b03d7423b9aaf79161be9a0f1a119cd3a814f4d81815f10b80aad8bdc2f5c4f4; the selected Pillow parity run passed 3/3.

The decoder now reverses bits in compressed FillOrder 2 block bytes before decompression, using cancellation-aware chunks and fallible allocation. The FillOrder 1 path continues to borrow the encoded input. The focused 23-row FillOrder selection passed 23/23. Local LLVM recorded both outcomes of the compression == COMPRESSION_NONE branch at src/codecs/tiff/decode.rs:254 (51 true and 12 false observations). Coverage MCP returned no remaining missing location for that line in the selected report at .coverage-mcp/local-evidence/selected-tiff-fillorder2-20261025/coverage.json. The complete TIFF decode selection passed 431/431 rows. Coverage MCP then identified two remaining decode_ifd allocation-failure arms at lines 802 and 923; the corresponding existing target-only fault contracts passed 2/2, and MCP returned no missing locations for those lines in .coverage-mcp/local-evidence/selected-tiff-fault-contracts-20261025/coverage.json. The 431-row report is .coverage-mcp/local-evidence/selected-tiff-parity-431-20261025/coverage.json. Comparison with the retained full report is incomparable because branch detail is incomplete and the reported branch totals differ (32,020 versus 32,040). The selected reports have unverified source identity and unknown test attribution, so no aggregate coverage gain or full-suite closure is claimed.

The current matrix contains 2,592 total rows: 2,074 decode / inspect / verify rows and 518 encode rows. TIFF has 431 decode rows. Of the total, 2,074 decode rows and 487 encode rows are active; 31 encode rows remain planned.

Focused AVIF monochrome and WebP token parity — 2026-10-25

After synchronizing the preserved AVIF work with merged main, the selected run at .coverage-mcp/local-evidence/selected/20261024T225938.861678Z-7396731e19e64c819484d6e32561f3a7/coverage.json passed all 17 cases: four Pillow pixel-parity controls for portable AVIF monochrome conversion, four WebP encode-parity rows using a fresh cancellation token, and nine target-only AVIF fault contracts. The WebP rows produced exact Pillow bytes; the new transparent-alpha case emitted 2,282 bytes and re-decoded to the expected 128×128 RGBA pixels. The selected encoder made 20 public calls with no panics. The nine fault rows returned the expected unsupported-subset result and succeeded on an uninjected retry; they remain not_applicable to the Pillow oracle and outside parity counts.

The current fixture matrix contains 2,588 total rows: 2,070 decode / inspect / verify rows and 518 encode rows. Of those, 2,070 decode rows and 487 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 102 cases.

Coverage MCP reports missing branch coordinates in decode_monochrome_portable and the test-only inject_monochrome_portable_fault guard. The local receipt confirms 17 selected cases passed and that sources stayed unchanged during the run, but MCP marks source identity unverified and test attribution unknown. The coordinates are leads rather than source-verified closure; no aggregate coverage gain is claimed. The broader 100% objective remains open.

TIFF LZW cancellable decode parity — 2026-10-25

Enabled the existing cancellable decode API for the TIFF LZW parity fixtures. This runs the same Pillow-backed inputs through both decode and decode_with_token; it adds no Rust unit tests or duplicate fixtures. The focused run passed 3/3 selected rows, and the latest retained full report passed all 2,070 active decode rows, 486 active encode rows, 93 fault contracts, four animation-loop checks, and 69 feature-gate tests. Aggregate coverage totals are unchanged by the LZW token rows, so no gain is attributed to that API check.

Coverage MCP still reports the true arm of the output.len() >= expected operand in decode_lzw and decode_lzw_with_token at src/codecs/tiff/decode.rs:3449 and :3542. A public TIFF cannot provide a zero-row strip for this branch: image geometry is validated as positive, and the decoder skips surplus strips with zero rows at src/codecs/tiff/decode.rs:958. This remains a defensive private-path limitation rather than a parity case target. Coverage MCP source identity remains unverified and test attribution unknown.

TIFF packed-tile bit-order dispatch — 2026-10-25

Coverage MCP previously reported opposite unobserved arms for if LSB_FIRST inside the two boolean-const-generic packed-row specializations. A valid TIFF input could select one specialization, but could never take the other specialization's impossible arm. Replaced those conditionals with statically dispatched PackedTileBitOrder implementations for most-significant-first and least-significant-first samples. Their optimized per-sample methods are marked inline(always) so orientation dispatch does not add calls to the inner loop. The optimized AArch64 release assembly contains no emitted symbols for those methods. This checks code generation for that target; it is not an end-to-end benchmark or SSE2/AVX2 performance result.

The existing 14 Pillow parity rows for packed TIFF tiles passed, covering both fill orders, aligned and unaligned copies, compressed tiles, and rejected inputs. The selected report is .coverage-mcp/local-evidence/selected/20261024T194637.006124Z-b901994420c34603a3d1d2278d50e3fb/coverage.json. The full report above passes all 2,070 active decode rows, 486 active encode rows, 93 fault contracts, four animation-loop checks, and 69 feature-gate tests. Coverage MCP reports zero remaining branch groups for copy_packed_tile_row. MCP source identity remains unverified and test attribution unknown; no aggregate gain is attributed to these rows.

TIFF custom-coefficient 2-by-2 odd-edge parity — 2026-10-25

Added active parity row decode:tiff:ycbcr_custom_coefficients_lzw_2x2_checkpoint_33x33_odd_edges. Its complete 2,453-byte input clips the final 2-by-2 YCbCr clump on both axes and processes more than 1,024 pixels in the custom-coefficient converter. Pinned Pillow 12.2.0 verifies the TIFF and returns 3,267 RGB bytes (SHA-256 d6f82880d7c317dc0dab9a3a5c76fa388ac55fddafaabcf57e7a16419567902e). The input SHA-256 is 9bf19211ac287e1d586cc0e2d037caff2dacfbfa6076bbe4e867bb64eda437f8. The deterministic generator validates those tags and pixels; the selected public parity case passed 1/1.

The full report above adds no aggregate branch count, but Coverage MCP no longer lists a missing branch group for the custom-coefficient 2-by-2 converter specialization. Its full-report source identity remains unverified and test attribution unknown, so this is recorded as a covered specialization rather than an aggregate percentage gain. The report retains the full suite's configured floors and includes the new row.

TIFF custom-coefficient 1-by-2 checkpoint parity — 2026-10-25

Added active parity row decode:tiff:ycbcr_custom_coefficients_lzw_1x2_checkpoint_33x33_odd_edges. The 33×33 TIFF uses custom Rec. 709 coefficients, clips the odd final row, and reaches the converter's 1,024-pixel cancellation checkpoint. Pinned Pillow 12.2.0 returns 3,267 RGB bytes (SHA-256 4dbccd036ff2c6e28e6986c751ea075a6ba4d29345109390a131cbf325730100). The input SHA-256 is fa1f4ca256be97295b75647cd992f879778b41b30651203518ad5d093812a872. The exact selected parity row passed 1/1. Coverage MCP reports zero remaining branch groups for convert_ycbcr_subsampled_1x2_with in the retained full report. Aggregate coverage totals are unchanged; no percentage gain is claimed.

Coverage MCP still reports the general converter's zero-subsampling guard at src/codecs/tiff/decode.rs:2434 for the default and custom monomorphizations. The public decoder rejects unsupported subsampling pairs before calling the converter, and the existing zero-pair Pillow case verifies that public error. Per the parity policy, no extra case was added solely to reach this private defensive guard. The report's source identity is unverified and test attribution is unknown.

TIFF custom-table YCbCr fault contracts — 2026-10-25

Added four target-only fault rows for clump-length mismatch and RGB output reservation failure in the custom general and custom 1-by-2 converter paths. They reuse the active Pillow inputs decode:tiff:ycbcr_custom_coefficients_lzw_4x2 and decode:tiff:ycbcr_custom_coefficients_lzw_1x2_odd_height. The selected run at .coverage-mcp/local-evidence/selected/20261024T201532.328967Z-cbfbf8bca61a4755bd61969194807191/coverage.json reported 4 selected, 4 executed, 4 passed, 0 failed, with oracle=not_applicable. These contracts verify stable public errors and retry success; they remain separate from Pillow parity counts. An incremental comparison to the previous full report was incomparable because its branch detail did not reconcile with its totals, so no aggregate coverage gain is attributed to these fault rows.

AVIF 12-bit I420 alpha sample-count fault contract — 2026-10-25

Added target-only row fault-contract:avif:avif_12bit_i420_alpha_sample_count_mismatch, reusing the active odd-edge 17×9 Pillow parity input. The coverage-only injection shortens the reconstructed alpha slice before the specialized 12-bit I420 converter; the public decoder returns the existing unsupported-subset error and a retry without the fault succeeds with the Pillow reference. The selected run passed 1/1. Coverage MCP no longer lists the alpha-length mismatch arm at src/codecs/avif/decode.rs:950; zero-width and remainder guards in that condition remain uncovered. The injection is excluded from release builds, so this coverage change does not add a production-path branch. The full report above includes the new contract. MCP source identity remains unverified and test attribution unknown.

The exact fault-contract selection was rerun on 2026-10-28 and passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261028T162733.149537Z-e8b91d4448be45bb8fa8265ea2c14bfa/coverage.json. Raw LLVM counters at the current mismatch condition in src/codecs/avif/decode.rs:1071 show one mismatch and two matching samples in the exercised specialization. The zero-width and remainder guards were false in that run, and another specialization was not invoked. Coverage MCP's incremental comparison with the retained full report was incomparable because its branch detail did not reconcile with the totals; no aggregate gain is claimed.

A selected refresh on 2026-11-09 ran the normal 17x9 Pillow parity row together with the six 12-bit I420 alpha fault contracts for sample-count mismatch, zero width, nondivisible luma length, zero height, and U/V plane-length mismatches. All seven rows passed (one parity row and six target-only fault rows; fault rows report oracle=not_applicable). Coverage MCP found no missing branch groups in convert_subsampled_420_12bit_alpha for this selected report. The selected instrumented crate totals were 13,998/142,863 lines (9.7982%), 2,171/32,126 branches (6.7578%), 1,001/9,180 functions (10.9041%), and 18,863/221,254 regions (8.5255%); these totals describe only the selected cohort, not full project coverage. The receipt records revision ea9fea6d7931fc128cb39889198e71eea0ce91a9 and no source or fixture changes during execution. Coverage MCP still marks source identity unverified and test attribution unknown.

Report: .coverage-mcp/local-evidence/selected/20261109T202357.806967Z-1af440b998034a89bdf13a7d2aebffce/coverage.json (SHA-256 2d65c2c3f57b898a1c2f2eb8ee07a5189f61451f499f67582b75e0850b942052; local receipt SHA-256 6abd183dccfb8055971fa2c25e631d4a9c0f46936527487b49ca7c3a3d4b32ad).

TIFF surplus-strip parity — 2026-10-25

Added active parity row decode:tiff:ycbcr_subsampled_lzw_2x2_unaligned_rows_per_strip_3_predictor_2_extra_strip. The complete TIFF declares three LZW strips for 4x4 image geometry that needs two; the third entry points to a valid duplicate strip. Pillow 12.2.0 opens, verifies, and decodes the image to the same 48-byte RGB output as the two-strip control (ee406bf055bf628b9b0a3b6d3ea29a5f32d97e963d3eb4964d5942c37f04881a). The exact selected parity row passed 1/1. Its selected LLVM report contains positive true/false counters for strip_rows == 0; the full report has no remaining Coverage MCP branch gap at that source line. The selected-only MCP query still grouped an unexecuted decoder instantiation at the same location, so the full report is the evidence that closes the grouped gap. The incremental comparison against the prior report was incomparable because its branch detail did not reconcile with the reported totals; no marginal gain is claimed from that comparison.

The unaligned subsampled-strip assembler receives only compressed YcbcrSubsampled8 layouts; uncompressed YCbCr uses Ycbcr8. The redundant compression == COMPRESSION_NONE decode arm was removed, with no change to the compressed path. Runtime benchmark evidence was not collected, so no speedup is claimed. Coverage MCP marks the full report's source identity unverified and test attribution unknown.

TIFF unaligned strip error parity — 2026-10-25

Added active parity row decode:tiff:ycbcr_subsampled_lzw_2x2_unaligned_rows_per_strip_3_predictor_2_zero_first_byte_count for a zero first StripByteCounts entry. Pillow opens and verifies the metadata, then reports OSError("decoder error -2") during pixel loading. The target previously decoded this file, so the unaligned compressed-strip path now rejects the explicitly zero count; the separate fallback for a missing count array is unchanged. The selected parity row passed 1/1.

Added active parity row decode:tiff:ycbcr_subsampled_uncompressed_2x2_unaligned_rows_per_strip_3 for odd-height uncompressed 2-by-2 YCbCr strips with a three-row strip boundary. Pillow verifies metadata and rejects pixel loading with OSError("image file is truncated (4 bytes not processed)"); the target matches the error contract. Its selected parity row passed 1/1. The case adds a distinct malformed-input contract but did not change aggregate coverage counts.

Added active parity row decode:tiff:ycbcr_subsampled_lzw_2x2_unaligned_rows_per_strip_3_predictor_2_oob_first_offset with the first strip offset set beyond the complete input. Pillow opens and verifies the metadata, then reports OSError("decoder error -2") during pixel loading; the selected parity row passed 1/1. The updated full report no longer has a branch gap at src/codecs/tiff/decode.rs:817. Its aggregate increased by one branch, four lines, and two regions, although Coverage MCP cannot attribute those observations to a named test. The false arm at line 804 remains open.

The compression != COMPRESSION_NONE test in the unaligned YCbCr assembly loop was redundant: inspect.rs only supplies subsampling parameters when compression is enabled, and maps uncompressed YCbCr to Ycbcr8. Removing that impossible arm reduces two branch edges and one covered edge without changing the reachable TIFF contract; the zero-count rejection and offset-boundary parity cases still pass. Coverage MCP now reports no branch gaps at lines 804 or 817.

TIFF predictor edge parity — 2026-10-24

Added active parity rows decode:tiff:ycbcr_subsampled_uncompressed_predictor_3 and decode:tiff:ycbcr_subsampled_predictor_2_jpeg_compression_error. The first pins Pillow's 2x2 raw YCbCr interpretation for an uncompressed Predictor=3 directory (input SHA-256 601a3c6a6ce74cbfdd92c442efc0901f8d77f6a13f2a926e3aa261a53621d6a6; pixel SHA-256 b122cbf873524577a50522805777fb18d2fa2434b53a8bb6c0c0236ec118e80f). The second changes the compression tag of the LZW Predictor=2 control to TIFF JPEG compression tag 7 (input SHA-256 c692b5925e26200fe58d9679b6b176313560f602939c749d9ad10ec790c4499c). Metadata inspection and verification succeed, while decode rejects the unsupported compression/predictor combination as Pillow does. The two-row selected parity run passed 2/2; the full coverage run also passed the complete 2,578-row public matrix and all configured floors. The TIFF predictor guard at line 337 has no remaining missing branch observations in the refreshed full report.

TIFF compressed tile byte-count omission — 2026-10-24

Added active parity row decode:tiff:tiled_deflate_without_byte_counts for a complete Deflate-tiled RGB16 TIFF whose directory omits TileByteCounts. Pillow opens and verifies the header, then returns OSError("decoder error -2") when loading pixels. Input SHA-256: ed0b0e058f8fb8a7113c498f8a7a063d7f2ff28f9e45aa4bb33b63019cf86a7f. TIFF inspection now accepts this metadata shape; decode rejects the missing compressed tile lengths. The selected parity row passed 1/1 at .coverage-mcp/local-evidence/selected/tiff-compressed-tile-missing-counts-20261024/coverage.json. The refreshed full report includes this case and passes the configured coverage floors. Coverage MCP's full-report comparison identified one newly observed branch at src/codecs/tiff/decode.rs:398; source/build identity is unverified, so that coordinate change does not establish an aggregate gain or regression.

JPEG even-width YCCK upsample parity — 2026-10-25

Added active Pillow parity rows decode:jpeg:ycck_h2v1_even_width_18x9 and decode:jpeg:ycck_h2v2_even_upsample_edges_18x10. Each starts from a complete, pinned 17×9 libjpeg-turbo YCCK input and changes only the SOF dimensions to expose the padded final MCU samples at an even output edge. Pillow 12.2.0 verifies and decodes both inputs as CMYK. The 18×9 h2v1 input SHA-256 is 3aa91b3831f8b82d66d978cc217ac4a00953c5b40e9c51d46eb93fdad9feb922, with pixel SHA-256 cfd5480dc9878c522f1fad89048331ff773c45d871a893223d743d3b909c9f45. The 18×10 h2v2 input SHA-256 is ad0e70ac2a81695d5a41379d8b9931d1333330514b0a1a930c0e835b9aa5a8c8, with pixel SHA-256 e580c178a9dee525ef95849529c3f4ca0a7e1238cc77027d4133732fe78ea2a6. The focused parity run passed 2/2, and the refreshed full report passed all 2,070 active decode rows.

Coverage MCP's full-report comparison reports two newly observed branch coordinates at the final-sample checks in src/codecs/jpeg/decode/upsample.rs:494 and :541; targeted gap queries now return no missing observations at either line. The report totals increased by two branches, two lines, and four regions with unchanged denominators. MCP marks source identity unverified and test attribution unknown, so the coordinate comparison is not a source-verified or named-test attribution.

JPEG reserved post-scan marker parity — 2026-10-24

Added active parity row decode:jpeg:baseline_444_single_scan_reserved_jpg0 for an 810-byte complete JPEG with a reserved JPG0 segment after a valid trailing DQT. The pinned input SHA-256 is 8cac78f1ec5ba03d629ac828e27d12eb579084476639c90155069457d2728c55; its standalone generator also checks the Pillow lifecycle. Pillow inspection and structural verification succeed, while decode and sequence decode return the broken data stream when reading image file error. The selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/20261024T163312.730669Z-9747674b11f040a28c6ac17ecb02fbae/coverage.json. Its LLVM report records both outcomes at src/codecs/jpeg/decode/decode.rs:2890 (true: 3, false: 3). Coverage MCP's selected-report gap lookup still lists both arms; source identity is unverified and test attribution is unknown, so no aggregate or marginal coverage gain is claimed. The full coverage snapshot above includes this row; named-test attribution remains unavailable.

AVIF clipped derived-skip compound parity — 2026-10-24

Added active parity row decode:avif:animated_lossless_inter_420_derived_skip_refs_clipped_b32x32_56x64 for a deterministic five-frame, 56x64 lossless 8-bit 4:2:0 sequence. The fixed-B32 sample has a clipped 24x32 right-edge grid; its pinned input SHA-256 is b801ab1e84328dfe552543858fad84a59c7edeb7ac7497972c2499b0736d6eb5. Pillow 12.2.0 frame references and independent loop evidence from libavif 6543b22b5bc706c53f038a16fe515f921556d9b3 were generated and validated. The exact selected parity case passed 1/1, including all five frames' pixels, at .coverage-mcp/local-evidence/selected/20261024T160814.722483Z-fb991bd6146846538984b6647018796f/coverage.json.

That raw LLVM report records three calls through decode_inter_compound_translation_lossless_grid; the compound specialization records both outcomes of the lossless_partial_grid predicate at src/codecs/avif/av1/block.rs:48160 (true: 1, false: 2). Coverage MCP still reports uncovered generic instantiations at the same source coordinate. Its incremental comparison with target/release-evidence/coverage.json was incomparable because the baseline lacks compatible exact branch detail; its source identity is unverified and test attribution is unknown. No aggregate coverage gain is claimed from that comparison.

The public fixture matrix now contains 2,576 total rows: 2,059 decode / inspect / verify rows and 517 encode rows. Of those, 2,059 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 88 cases.

TIFF subsampled YCbCr Predictor=2 parity — 2026-10-24

Added twelve active parity rows for Predictor=2 with LZW, Deflate, and Adobe Deflate compression over 2-by-1, 4-by-1, 4-by-2, and 4-by-4 YCbCr clumps. Pillow 12.2.0 decodes each fixture to an exact 192-byte RGB reference. The rows are decode:tiff:ycbcr_subsampled_lzw_2x1_predictor_2, decode:tiff:ycbcr_subsampled_lzw_4x1_predictor_2, decode:tiff:ycbcr_subsampled_lzw_4x2_predictor_2, and decode:tiff:ycbcr_subsampled_lzw_4x4_predictor_2, decode:tiff:ycbcr_subsampled_deflate_2x1_predictor_2, decode:tiff:ycbcr_subsampled_deflate_4x1_predictor_2, decode:tiff:ycbcr_subsampled_deflate_4x2_predictor_2, decode:tiff:ycbcr_subsampled_deflate_4x4_predictor_2, decode:tiff:ycbcr_subsampled_adobe_deflate_2x1_predictor_2, decode:tiff:ycbcr_subsampled_adobe_deflate_4x1_predictor_2, decode:tiff:ycbcr_subsampled_adobe_deflate_4x2_predictor_2, and decode:tiff:ycbcr_subsampled_adobe_deflate_4x4_predictor_2. Before the decoder change, the four new LZW rows failed with unsupported TIFF subsampled YCbCr storage layout. The decoder now accepts Pillow-supported predictor/compression combinations and follows libtiff's complete three-sample accumulator groups. The LZW selected run passed 4/4 at .coverage-mcp/local-evidence/selected/tiff-ycbcr-predictor2-final-20261024/coverage.json; the eight Deflate and Adobe Deflate rows passed 8/8 at .coverage-mcp/local-evidence/selected/tiff-ycbcr-deflate-predictor2-20261024/coverage.json. The cases cover scanline strides both divisible and not divisible by three. The refreshed full report includes all twelve rows and passed the configured coverage floors. Coverage MCP returned unverified source identity and unknown test attribution for the selected reports, so no per-case aggregate gain is claimed.

TIFF RGB16 ExtraSamples rejection parity — 2026-10-24

Added active parity row decode:tiff:error_rgb16_extra_sample_without_fourth_channel for a complete 188-byte big-endian RGB16 TIFF declaring one ExtraSamples value with only three samples per pixel. Pillow 12.2.0 rejects it during opening. Fixture SHA-256: 086d099af708225e89e39ab59ab2e62576636da3e3083f3bb606bdffd4a2975a. It passed with the mixed and signed SampleFormat rejection cases and unsigned RGB16 controls in a 7/7 selected parity run at .coverage-mcp/local-evidence/selected/tiff-rgb16-layout-edges-20261024/coverage.json.

The public fixture matrix now contains 2,562 total rows: 2,045 decode / inspect / verify rows and 517 encode rows. Of those, 2,045 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 88 cases.

TIFF RGB16 contiguous tiled Deflate parity — 2026-10-24

Added active parity row decode:tiff:rgb16_contiguous_tiled_deflate_edges for a 17x17 RGB16 TIFF in four contiguous Deflate tiles, including clipped right and bottom edges. Pillow 12.2.0 returns the exact 867 RGB bytes. The 2,015-byte fixture is pinned at SHA-256 3b29709ca7a616ada00ca7ca800378fed328f7353d6574ecb8c30181145d2031. The target now admits contiguous Deflate tiles through its existing tile decoder; the selected case and planar-tile/strip controls passed 4/4 at .coverage-mcp/local-evidence/selected/tiff-rgb16-contiguous-tiled-deflate-20261024/coverage.json.

The public fixture matrix now contains 2,561 total rows: 2,044 decode / inspect / verify rows and 517 encode rows. Of those, 2,044 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 88 cases.

TIFF RGB16 mixed SampleFormat rejection parity — 2026-10-24

Added active parity row decode:tiff:error_rgb16_mixed_sample_format for a complete 188-byte big-endian RGB16 TIFF whose SampleFormat values are [1, 2, 1]. Pillow 12.2.0 rejects this file during opening. Fixture SHA-256: e6c535b10127e845fa911f375f7e88bfefa4a39a0dd9f1bff6dcfb95b3649b55. The new row, the all-signed rejection case, and two unsigned RGB16 controls passed 4/4 at .coverage-mcp/local-evidence/selected/tiff-mixed-sampleformat-20261024/coverage.json. This exercises the mixed-channel rejection in layout_and_palette; selected coverage does not establish aggregate gains.

The public fixture matrix now contains 2,560 total rows: 2,043 decode / inspect / verify rows and 517 encode rows. Of those, 2,043 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 88 cases.

TIFF RGB16 uncompressed Predictor 3 parity — 2026-10-24

Added active parity row decode:tiff:rgb16_le_uncompressed_predictor3_strips for a deterministic 180-byte little-endian RGB16 TIFF. Pillow 12.2.0 ignores Predictor 3 with uncompressed strips and returns the exact expected 12 RGB bytes. Fixture SHA-256: 1528a4d7a519f6a2f1b24c0f88cdee98b566d813533621cdf6971fd8f4aedec9. The selected run passed five TIFF parity rows and three separate JPEG target-only fault contracts (8/8 total) at .coverage-mcp/local-evidence/selected/tiff-predictor3-jpeg-fault-20261024/coverage.json. The three fault contracts remain outside Pillow parity counts. Coverage MCP reports only selected-run coordinates; its source identity is unverified and test attribution is unknown, so no aggregate coverage gain is claimed.

Uncompressed TIFF decoding now ignores Predictor values as Pillow does; compressed inputs retain the existing supported Predictor 1 and 2 checks.

The public fixture matrix now contains 2,559 total rows: 2,042 decode / inspect / verify rows and 517 encode rows. Of those, 2,042 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 88 cases.

TIFF RGB16 Deflate FillOrder 2 rejection parity — 2026-10-24

Added active parity row decode:tiff:error_rgb16_deflate_fill_order_2 for a complete 196-byte RGB16 Deflate TIFF with FillOrder=2. Pillow 12.2.0 rejects it during opening. Fixture SHA-256: 36a010a79dfeacec61408c2535b19eb7bdedbca460057604c407c2929d35dcbb. The new case and the FillOrder 1 RGB16 Deflate control passed together (2/2) at .coverage-mcp/local-evidence/selected/tiff-rgb16-fill-order2-20261024/coverage.json. Raw LLVM records both outcomes at layout_and_palette line 391. Coverage MCP's selected-to-full comparison is incomparable because exact branch detail is incomplete; its source identity is unverified and test attribution is unknown. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,557 total rows: 2,040 decode / inspect / verify rows and 517 encode rows. Of those, 2,040 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

TIFF RGB16 Deflate horizontal-predictor parity — 2026-10-24

Added active parity row decode:tiff:rgb16_le_deflate_predictor2_contiguous_strips. Its deterministic 196-byte TIFF uses two contiguous Deflate strips with 16-bit RGB horizontal differencing (Predictor 2); Pillow 12.2.0 decodes the exact expected 12 RGB bytes. Fixture SHA-256: 37fc7bcedd0f550626fab36b6cfa772f925aa33e1b1bebb4c4f3e832fe4c978e. The new case and the Predictor 1 control passed together (2/2) at .coverage-mcp/local-evidence/selected/tiff-rgb16-deflate-predictor2-20261024/coverage.json. Coverage MCP still reports unobserved groups in layout_and_palette; source identity is unverified and test attribution is unknown, so this selected run does not establish an aggregate coverage gain.

The decoder now admits Predictor 2 for Deflate-compressed RGB16 strips. It uses the existing horizontal-predictor reversal path; no per-sample conversion loop was added.

The public fixture matrix now contains 2,556 total rows: 2,039 decode / inspect / verify rows and 517 encode rows. Of those, 2,039 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

TIFF signed RGB16 SampleFormat parity — 2026-10-24

Added active parity row decode:tiff:error_rgb16_signed_sample_format for a complete 188-byte RGB16 TIFF whose SampleFormat tags declare signed samples. The fixture is pinned at SHA-256 acf7ac21e19739826a6f4783d36150ff139dd70a632b6223f55cee23f3fac142; the fixture generator verifies that Pillow 12.2.0 rejects it while opening. The new row and the unsigned RGB16 control passed the selected parity run 2/2 at .coverage-mcp/local-evidence/selected/20261024T141450.184628Z-861a69d552174765889f4646202f9212/coverage.json. Coverage MCP returned no missing groups for the selected layout_and_palette query. The report contains 173/32,010 observed branches; source identity is unverified and test attribution is unknown, so it does not support an aggregate coverage claim.

The TIFF YCbCr rational limit check now follows the parser's unsigned u32 denominator contract and widens values before comparing them. Five existing YCbCr boundary and SampleFormat parity rows passed after this change.

The public fixture matrix now contains 2,555 total rows: 2,038 decode / inspect / verify rows and 517 encode rows. Of those, 2,038 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF nonzero auxC FullBox version parity — 2026-10-24

Added active parity row decode:avif:error_auxc_nonzero_version. The deterministic fixture changes only the meta/iprp/ipco/auxC FullBox version in alpha.avif, preserving its complete AV1 payload and 6,441-byte file size. Pinned Pillow 12.2.0 rejects the complete input at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>. The fixture SHA-256 is 2357cdc2bc511390a97c6f84cdf1bbf03b0debe3b7bda4090b397d7bd20c3822.

The focused public parity and coverage command passed 1/1 at .coverage-mcp/local-evidence/selected/avif-auxc-nonzero-version-20261024/coverage.json. Raw LLVM records six visits to the nonzero-version arm in src/codecs/avif/samples.rs::parse_property at line 734. The full report before this row recorded zero visits to that arm and 340 visits to the version-zero arm; the refreshed full report records six and 340 visits, respectively. Coverage MCP confirms no remaining gap at line 734. Its full comparison reports one newly observed branch coordinate but remains limited because report source/build identities and test attribution are unverified. No aggregate gain is claimed from that comparison.

The refreshed full parity coverage is 93,218/139,046 lines (67.0411%), 18,488/32,028 branches (57.7245%), 5,189/8,891 functions (58.3624%), and 142,454/215,942 regions (65.9686%).

The public fixture matrix now contains 2,554 total rows: 2,037 decode / inspect / verify rows and 517 encode rows. Of those, 2,037 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF nonzero pixi FullBox version parity — 2026-10-24

Added active parity row decode:avif:error_pixi_nonzero_version. The deterministic fixture changes only the baseline still's pixi FullBox version from zero to one, preserving the complete AV1 payload and 3,077-byte file size. Pinned Pillow 12.2.0 rejects the complete input at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>. The fixture SHA-256 is a50bd4126788de5efdeefa05ec6583267311fe021af9168928850589d9fd5689.

The focused public parity and coverage command passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pixi-nonzero-version-20261024/coverage.json. Raw LLVM records six visits to the nonzero-version arm in src/codecs/avif/samples.rs::parse_property at line 699. The full report before this row recorded zero visits to that arm and 243,967 visits to the version-zero arm; the refreshed full report records six and 243,967 visits, respectively. Coverage MCP confirmed the arm is now covered in the refreshed report. Its incremental comparison is incomparable because the baseline's exact branch detail is incomplete and report source/test receipts are unverified. No aggregate gain is claimed from that comparison.

The refreshed full parity coverage is 93,217/139,046 lines (67.0404%), 18,487/32,028 branches (57.7214%), 5,189/8,891 functions (58.3624%), and 142,453/215,942 regions (65.9682%).

The public fixture matrix now contains 2,553 total rows: 2,036 decode / inspect / verify rows and 517 encode rows. Of those, 2,036 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF zero-plane pixi parity — 2026-10-24

Added active parity row decode:avif:error_pixi_zero_planes. The deterministic fixture changes only the baseline still's pixi plane count from three to zero, preserving the complete AV1 payload and 3,077-byte file size. Pillow 12.2.0 reports builtins.RuntimeError: Failed to decode image: Not implemented; the public parity runner confirms Rust and Pillow both reject the input as malformed. The fixture SHA-256 is b29a15defd39037aebaa7dffdd878c828201d1d9adc852302e8c76b123036431.

The focused parity and coverage run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pixi-zero-planes-20261024/coverage.json. Raw LLVM records six visits to the invalid plane-count outcome in src/codecs/avif/samples.rs::parse_property at line 703; the saved full report recorded zero visits to that outcome and 243,955 visits to the valid plane-count outcome. Coverage MCP returned incomparable for the incremental comparison because the baseline's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,552 total rows: 2,035 decode / inspect / verify rows and 517 encode rows. Of those, 2,035 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF over-16 pixi depth parity — 2026-10-24

Added active parity row decode:avif:error_pixi_depth_above_16. The deterministic fixture changes only the baseline still's first pixi channel depth from eight to 17, preserving the complete AV1 payload and 3,077-byte file size. Pillow 12.2.0 reports builtins.RuntimeError: Failed to decode image: Not implemented; the public parity runner confirms Rust and Pillow both reject the input as malformed. The fixture SHA-256 is bdf5ecf32956f1c05ed93c9b3e5a9fb2381f5429c1996ccb6b5701201fdbd34d.

The focused parity and coverage run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pixi-depth-above-16-20261024/coverage.json. Raw LLVM records six visits to the over-limit depth outcome in src/codecs/avif/samples.rs::parse_property at line 707. The refreshed full baseline recorded zero visits to that outcome and 243,949 visits to the in-range depth outcome. Coverage MCP returned incomparable for the incremental comparison because the baseline's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,551 total rows: 2,034 decode / inspect / verify rows and 517 encode rows. Of those, 2,034 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF mismatched pixi channel-depth parity — 2026-10-24

Added active parity row decode:avif:error_pixi_channel_depth_mismatch. The deterministic fixture changes only the second of three channel-depth entries in the baseline still's pixi property, preserving the complete AV1 payload and 3,077-byte file size. Pillow 12.2.0 reports builtins.RuntimeError: Failed to decode image: Not implemented; the public parity runner confirms Rust and Pillow both reject the input as malformed. The fixture SHA-256 is 420568bd6387e4262a2b3076a466b0d39efe35f9c01c99a66364352389b92242.

The focused parity and coverage run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pixi-channel-depth-mismatch-20261024/coverage.json. Raw LLVM records six visits to the mismatched-channel outcome in src/codecs/avif/samples.rs::parse_property at line 711. The refreshed full baseline recorded zero visits to that outcome and 487,078 visits to the matching channel-depth outcome. Coverage MCP returned incomparable for the incremental comparison because the baseline's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,550 total rows: 2,033 decode / inspect / verify rows and 517 encode rows. Of those, 2,033 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF zero-depth pixi parity — 2026-10-24

Added active parity row decode:avif:error_pixi_zero_depth. The deterministic fixture sets only the first channel depth in the baseline still's pixi property to zero, preserving the complete AV1 payload and 3,077-byte file size. Pillow 12.2.0 rejects the full input at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>. Its fixture SHA-256 is 7c815a023acc909df7a21d80d11aa1ca92aaae6ce0748bfc989288cae91d3c5f.

The focused parity and coverage run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pixi-zero-depth-20261024/coverage.json. Raw LLVM records six visits to the invalid-depth outcome in src/codecs/avif/samples.rs::parse_property at line 707. The saved full report recorded zero visits to that outcome and 3,511 visits to the valid-depth outcome; its source/build receipt is unverified. Coverage MCP therefore returned incomparable for the incremental comparison because the baseline's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,549 total rows: 2,032 decode / inspect / verify rows and 517 encode rows. Of those, 2,032 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF handler rejection parity — 2026-10-24

Added active parity rows decode:avif:error_meta_hdlr_nonzero_version and decode:avif:error_meta_hdlr_nonzero_predefined. Each fixture mutates only one field in the baseline meta/hdlr box and preserves the complete AV1 payload and 3,077-byte file size. Pillow 12.2.0 rejects both complete inputs at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>. Their fixture SHA-256 values are e5d7f45c33cc3aec2868d57bddaad27b62df23210326822382f81e2cb344dc62 and b9119779779df0addfdfcd92927ae06127109846796ca6806c1a0bc20ce7391d.

The focused parity and coverage run passed 2/2 rows at .coverage-mcp/local-evidence/selected/avif-handler-errors-20261024/coverage.json. Its raw LLVM records six visits to each rejection outcome in src/codecs/avif/samples.rs::parse_handler at line 542. The saved full report .coverage-mcp/local-evidence/parity-full-20261024-after-iloc-reserved/coverage.json records 4,051 visits to each corresponding normal outcome, but its source/build receipt is unverified. Coverage MCP therefore returned incomparable for the incremental comparison because the baseline's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,548 total rows: 2,031 decode / inspect / verify rows and 517 encode rows. Of those, 2,031 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF duplicate idat parity — 2026-10-24

Added active parity row decode:avif:error_meta_duplicate_idat. The deterministic generator appends an empty second idat box to the pinned indexed-idat still, growing the complete file from 5,906 to 5,914 bytes while preserving the original AV1 payload. The fixture SHA-256 is 466e3ecd6e89e4cbd2dba8084642fc2ddbda83e196e005819a31aa54cc3c960b. Pillow 12.2.0 rejects the complete input at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>.

The selected parity coverage command passed 1/1 at .coverage-mcp/local-evidence/selected/avif-duplicate-idat-20261024/coverage.json. Raw LLVM records four and two visits to the idat.is_some() true arm at src/codecs/avif/samples.rs:522 across parse_meta::<false> and parse_meta::<true>. Coverage MCP's incremental comparison is incomparable because the full baseline's exact branch detail is incomplete; no aggregate coverage gain is claimed.

The public fixture matrix now contains 2,546 total rows: 2,029 decode / inspect / verify rows and 517 encode rows. Of those, 2,029 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF version-two infe zero item identifier parity — 2026-10-24

Added active parity row decode:avif:error_infe_zero_item_id. The deterministic generator sets the baseline still's version-two infe item identifier to zero inside meta/iinf, preserving the 3,077-byte file and complete AV1 media payload. The fixture SHA-256 is 9cd1623b8c3cf615b708968e90f6b9bb0fb081dbda2185348ebf087db82e7e7f. Pinned Pillow 12.2.0 rejects it at open with PIL.UnidentifiedImageError: cannot identify image file <bytes>.

The selected parity coverage command passed 1/1 at .coverage-mcp/local-evidence/selected/avif-infe-zero-item-id-20261024/coverage.json. Coverage investigation isolated the zero-ID rejection in src/codecs/avif/samples.rs:617; raw LLVM records six visits to the taken arm for this selected case. The prior full-parity report has the same source hash for samples.rs and recorded zero hits to that arm. Coverage MCP's incremental comparison is incomparable because exact branch detail is incomplete, so no aggregate coverage gain is claimed.

The public fixture matrix now contains 2,546 total rows: 2,029 decode / inspect / verify rows and 517 encode rows. Of those, 2,029 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF version-one pitm wide item identifier parity — 2026-10-24

Added active parity row decode:avif:pitm_version_1_wide_item_id. The deterministic generator upgrades the pinned indexed-idat still's pitm primary item field from version zero's 16-bit form to version one's 32-bit form, retaining item ID 1. The file grows by two bytes while preserving the full encoded media payload; its SHA-256 is 985e27b0dbaa32a2835d940ac0729db4b43addf80d207f4598b11d518719874c. Pinned Pillow 12.2.0 output is unchanged at 49,152 bytes of RGB pixel parity.

The selected parity row passed 1/1 at .coverage-mcp/local-evidence/selected/avif-pitm-v1-wide-item-id-20261024/coverage.json. Raw LLVM at src/codecs/avif/samples.rs:554 shows eight visits to the version-one 32-bit branch in parse_pitm. Coverage MCP had identified that arm as uncovered in the full parity report. Its local reports have unverified source/build identity and unknown test attribution; incremental comparison is incomparable because the full report's exact branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,544 total rows: 2,027 decode / inspect / verify rows and 517 encode rows. Of those, 2,027 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF reserved iloc construction-method bit parity — 2026-10-24

Added active parity row decode:avif:error_iloc_reserved_construction_method_bits. The deterministic generator sets one reserved bit in the iloc construction method of the pinned indexed-idat still. The 5,906-byte file size and complete encoded media payload are preserved; the fixture SHA-256 is 14045959d327207b120b345879a1c83a6a0cb252526ce9c9a06101244cc60c2f. Pinned Pillow 12.2.0 rejects inspection, verification, and decode with UnidentifiedImageError("cannot identify image file <bytes>").

The selected parity row passed 1/1 at .coverage-mcp/local-evidence/selected/avif-iloc-reserved-construction-method-bits-20261024/coverage.json. Raw LLVM records at src/codecs/avif/samples.rs:1124 show four and two visits to the reserved-bit rejection arm across the two parser instantiations. The full parity-only report at .coverage-mcp/local-evidence/parity-full-20261024/coverage.json had this arm uncovered before the case. Coverage MCP marks local report source/build identity unverified and test attribution unknown; no aggregate coverage gain is claimed.

The public fixture matrix now contains 2,543 total rows: 2,026 decode / inspect / verify rows and 517 encode rows. Of those, 2,026 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF duplicate item identifier parity — 2026-10-24

Added active parity row decode:avif:error_iloc_duplicate_item_id. The deterministic generator duplicates the complete sole record in the pinned file-backed iloc table, retaining the same item ID and AV1 media payload. The fixture grows by 14 bytes to encode both records; its SHA-256 is 37b723c1e183488bbf0ddf7c0cad7ae271f54dfe912b040c4721e0af7e1d48fd. Pinned Pillow 12.2.0 rejects inspection, verification, and decode with UnidentifiedImageError("cannot identify image file <bytes>").

The exact selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-iloc-duplicate-item-id-20261024/coverage.json. The raw LLVM records at src/codecs/avif/samples.rs:1115 show 4/4 and 2/2 outcomes across the two parser instantiations. Coverage MCP marks the selected report's source/build identity unverified and test attribution unknown; its incremental comparison with the saved full report is incomparable because the baseline branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,542 total rows: 2,025 decode / inspect / verify rows and 517 encode rows. Of those, 2,025 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF zero item identifier parity — 2026-10-24

Added active parity row decode:avif:error_iloc_zero_item_id. The deterministic generator changes the sole item ID in the pinned file-backed iloc table from one to zero while preserving the file size and AV1 media payload. The fixture SHA-256 is 6628085ef24f7bb3a62eb656950f609d585ebcb5e27b3fd1c2f9d04ad50c06fa. Pinned Pillow 12.2.0 rejects inspection, verification, and decode with UnidentifiedImageError("cannot identify image file <bytes>").

The exact selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-iloc-zero-item-id-20261024/coverage.json. The raw LLVM branch records at src/codecs/avif/samples.rs:1114 show the zero-ID rejection arm with counters 4/0 and 2/0 across the two parser instantiations. Coverage MCP marks the selected report's source/build identity unverified and test attribution unknown; its incremental comparison with the saved full report is incomparable because the baseline branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,541 total rows: 2,024 decode / inspect / verify rows and 517 encode rows. Of those, 2,024 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF overlong grid descriptor extent parity — 2026-10-24

Added active parity row decode:avif:error_grid_descriptor_overlong_extent. The deterministic generator changes the primary grid item's declared extent from eight bytes to nine while preserving the file size and encoded AV1 media payload. The fixture SHA-256 is e0ef3f8597d7ae703cd5ccf7ee8eb24293a857ea4c1e86c8828a899508e54e4f. Pinned Pillow 12.2.0 rejects inspection, verification, and decode with UnidentifiedImageError("cannot identify image file <bytes>").

The exact selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-grid-overlong-descriptor-20261024/coverage.json. The raw LLVM branch record for src/codecs/avif/samples.rs:1746 has outcome counters 6/0, exercising the exact-extent rejection. Coverage MCP marks the selected report's source/build identity unverified and test attribution unknown; its incremental comparison with the saved full report is incomparable because the baseline branch detail is incomplete. No aggregate coverage gain is claimed.

The public fixture matrix now contains 2,540 total rows: 2,023 decode / inspect / verify rows and 517 encode rows. Of those, 2,023 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF short grid descriptor extent parity — 2026-10-24

Added active parity row decode:avif:error_grid_descriptor_short_extent. Its deterministic generator changes the primary grid item's declared descriptor extent from eight bytes to three while preserving the file length and media payload. The fixture SHA-256 is 95670f2861407e944391adfdd75bbc97e6ebd010aedda7850dd65a7286cb49e5. Pinned Pillow 12.2.0 rejects inspection, verification, and decode with UnidentifiedImageError("cannot identify image file <bytes>").

The exact selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-grid-short-descriptor-20261024/coverage.json; its local receipt records the selected, executed, and passed row IDs. The raw LLVM branch record for src/codecs/avif/samples.rs:1712 has outcome counters 6/0, exercising the short-extent error path. Coverage MCP returned measured selected-run coordinates but marks source/build identity unverified and test attribution unknown. Incremental comparison with the saved full report is incomparable because that baseline's branch detail is incomplete; no aggregate coverage gain is claimed.

The public fixture matrix now contains 2,539 total rows: 2,022 decode / inspect / verify rows and 517 encode rows. Of those, 2,022 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF grid without dimg references — 2026-10-24

Added active parity row decode:avif:error_grid_without_dimg_references. The fixture renames the source grid's only dimg reference box to zzzz without changing box sizes or encoded media payloads. Pillow 12.2.0 rejects it with RuntimeError("Failed to decode image: Invalid image grid"). The fixture SHA-256 is a283fb5590e31db1f491fe1e010a22fec3f55da99080dd4dcc61b95e89d6316a.

The selected parity run passed 1/1 at .coverage-mcp/local-evidence/selected/avif-grid-no-dimg-current-20261024/coverage.json. The local LLVM report records the missing-child error arm in src/codecs/avif/samples.rs:1908; Coverage MCP lists only the opposite arm as unobserved in this selected run. It does not reach the similar container check at src/codecs/avif/container.rs:1590, because sample extraction rejects the input first. Coverage MCP marks source identity unverified and test attribution unknown for the report, and its query against the saved full report timed out; no full-suite coverage delta is claimed.

The public fixture matrix now contains 2,538 total rows: 2,021 decode / inspect / verify rows and 517 encode rows. Of those, 2,021 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

JPEG oversubscribed Huffman fallback parity — 2026-10-24

Added active row decode:jpeg:malformed_markers_dht_oversubscribed_retained_tables. The full-file fixture keeps the baseline AC and chroma Huffman tables while replacing DC0 with three one-bit codes, an oversubscribed table. Its generator is scripts/generate_jpeg_oversubscribed_dht_fallback_fixture.py; input SHA-256 is d308eee3946fdfa39f65045ee77d49ba407868dbea4a8a421fde3179b45bc457. Pinned Pillow 12.2.0 verifies the JPEG and reports OSError("broken data stream when reading image file") on decode. The exact selected public parity row passed 1/1 with the same malformed result.

The three new JPEG parity rows passed together (3/3) in .coverage-mcp/local-evidence/selected/jpeg-oversubscribed-dht-parity-main-20261024/coverage.json. Coverage MCP's decode_slow_fast query observes the length-greater-than-16 path and the false arm of the invalid-table sentinel check at src/codecs/jpeg/decode/huffman.rs:389-390; the opposite arms remain unobserved. The report has no verified source/build identity or test attribution, so these are coordinate observations, not a verified coverage gain. No full coverage campaign was run.

The public fixture matrix now contains 2,537 total rows: 2,020 decode / inspect / verify rows and 517 encode rows. Of those, 2,020 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

JPEG progressive oversubscribed Huffman parity — 2026-10-24

Added active row decode:jpeg:malformed_markers_progressive_dht_oversubscribed. It mutates progressive_gray.jpg by replacing only its DC0 DHT with three one-bit codes, preserving the other tables. Input SHA-256 is 883582bb9b9d43c06f950dca99782441350fa25262ad30247a0d87d2d7bff1b3. Pinned Pillow 12.2.0 verifies the file and reports OSError("broken data stream when reading image file") on decode. The selected public parity row passed 1/1.

Coverage MCP's gap query for the three-row report lists 38 unobserved branch coordinates in progressive_reconstruct. The report has no verified source/build identity or test attribution, so the row-level observations do not establish marginal or aggregate coverage gain. No full coverage campaign was run.

JPEG scalar Huffman sentinel parity — 2026-10-24

Added active row decode:jpeg:malformed_markers_dht_oversubscribed_scalar_fallback. The fixture starts from sampling_3x1.jpg, retains its sibling Huffman tables, and oversubscribes DC0. Its generator is scripts/generate_jpeg_oversubscribed_dht_fallback_fixture.py; input SHA-256 is 7e895799133d2308b6e0eef0795c67da67675771693cde3aad1f49dc81bd6625. Pillow 12.2.0 verifies the input and returns the same malformed-stream decode error; the selected public parity row passed 1/1.

Coverage MCP's selected query for HuffTable::decode_slow at src/codecs/jpeg/decode/huffman.rs:349 lists only the true outcome, showing the false outcome in the invalid-table sentinel predicate was observed. Both arms at line 360 remain missing in the three-row report. Source/build identity and test attribution are unverified, so no marginal or aggregate coverage gain is claimed. No full coverage campaign was run.

AVIF auxiliary alpha sample-count parity — 2026-10-22

Added decode:avif:sequence_alpha_sample_count_mismatch for the pinned 10bit.avif sequence with only the alpha track's stsc.samples_per_chunk field changed from five to four (input SHA-256 89a13baeb503ace10bea0f07d9c2aa296235d2ca8ed0471f3ee99751deccafcf). Pillow 12.2.0 verifies the file and decodes its first four 64×64 RGBA frames; loading frame four raises RuntimeError: Failed to decode frame 4: No images remaining. The first-frame reference is 16,384 bytes with SHA-256 cef05e2501d6fe214a10be9acd4aeef15db8263529bcfb0111bf2cdc98285b57.

The selected public matrix case passed 1/1. It exposed and fixed an early Rust sample-count rejection that made inspection fail before Pillow's late sequence error: inspection and first-frame decoding now retain the mapped samples, and full-sequence decoding reports the malformed color/alpha count before building frames. Coverage MCP identified the gap in sequence sample-count validation at src/codecs/avif/samples.rs:2671. The selected LLVM report is target/release-evidence/selected/avif-alpha-sample-count-mismatch-v2-20261022.json. Its comparison with the saved full report is incomparable because baseline branch detail does not reconcile with reported totals and neither report has a verified source/build receipt. The selected gaps query shows the expected unvisited time-scale and equal-count arms in src/codecs/avif/decode.rs:307,312-313; no marginal or aggregate coverage gain is claimed. No full coverage campaign was run.

The public fixture matrix now contains 2,532 total rows: 2,015 decode / inspect / verify rows and 517 encode rows. Of those, 2,015 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 85 cases.

AVIF 12-bit 4:2:0 alpha odd-edge parity — 2026-10-22

Added public decode parity row decode:avif:high_bitdepth_still_12bit_420_alpha_odd_edge_17x9 for a 17×9, full-range, 12-bit AV1 profile-2 all-lossless 4:2:0 image with 12-bit auxiliary alpha. The fixture exercises odd right/bottom edges and distinct low-nibble chroma. Its deterministic generator, pinned provenance, and exact pixel digest are recorded in the AVIF fixture README.

The selected native coverage run passed all five decode rows and the allocation fault contract. That fault contract now uses this fixture, so the injected reservation failure traverses the new 12-bit route; the public result and retry contract pass. The selected LLVM report is target/release-evidence/selected/avif-12bit420-alpha-odd-edge-20261022-final-r4/coverage.json. Coverage MCP reports 2,974/32,174 branch observations for this selected workload and six unobserved true arms in the helper's defensive plane-shape guards at src/codecs/avif/decode.rs:939. The report has no verified source or build identity and no test attribution. Its baseline comparison is incomparable because the saved baseline's branch detail does not reconcile with its totals. These selected observations do not establish marginal, aggregate, or full-suite coverage gains.

The public fixture matrix then contained 2,531 total rows: 2,014 decode / inspect / verify rows and 517 encode rows. Of those, 2,014 decode rows and 486 encode rows were active; 31 encode rows remained planned. The separate target-only fault lane contained 85 cases.

AVIF subsampled RGB output reservation fault contract — 2026-10-22

Added target-only case fault-contract:avif:avif_subsampled_rgb_output_reservation_failure using the active decode:avif:baseline 8-bit 4:2:0 input. The coverage-only failpoint forces the subsampled RGB output reservation to fail without requesting a large allocation. The public result must be a Dimensions error at StillDecode with message decode: unable to allocate AVIF subsampled RGB output; retry must match a fresh decode. The selected run passed 1/1 with oracle_status: not_applicable, so this is fault-contract evidence, not Pillow parity. Its report is target/release-evidence/selected/20261022T055920Z/coverage.json (SHA-256 f9e744f74dc6b44dca3f5809b311baf0d0580db96adec4a042cd617943b51878).

Coverage MCP found no missing branch location at the output reservation check in this selected report. Overall it reports 1,985/32,908 branch observations; source/build identity is unverified and test attribution is unknown, so this is selected-run exploration only. No verified marginal gain, aggregate coverage gain, or full-coverage result is claimed.

ICO embedded PNG partial-signature parity — 2026-10-22

Added active parity row decode:ico:error_malformed_png_entry_signature. Its complete 2,690-byte ICO preserves the embedded PNG's four-byte dispatch prefix and flips only the fifth signature byte; input SHA-256 is 69864fbd1392610d04953ca7ff3de0b0e9643a24f3edeabee748e06fe251549e. Pinned Pillow 12.2.0 reports OSError("Truncated File Read") for inspection, verification, decode, and sequence decode. The exact selected Rust parity run on the current main base passed 1/1.

Coverage MCP's selected-test coordinate comparison against the prior PNG selection found the false arm of the full PNG signature check at src/codecs/png/decode.rs:2036 as newly observed. The one-row report leaves the true arm unobserved, as expected for this malformed input. Both reports have unverified source/build identity and unknown MCP test attribution, so this is coordinate evidence only; no verified marginal gain or full-coverage result is claimed. The current-base local report is .coverage-mcp/local-evidence/20261022/ico-png-partial-signature-main/coverage.json.

Selected coverage artifact retention — 2026-10-21

The selected coverage runner now defaults to a unique .coverage-mcp/local-evidence/selected/<run-id>/ directory outside target/. The report, captured command log, and local execution receipt remain adjacent. Explicit SELECTED_COVERAGE_REPORT paths retain their repository containment and no-overwrite checks.

The selected-only verification ran RUSTC_WRAPPER= PYTHON=/Users/lazytrot/work/image-slash-star/.oracle-venv/bin/python CARGO_NET_OFFLINE=true make coverage-selected COVERAGE_CASES='decode:webp:lossy_vp8' from source revision 65d094e0bf2024735f5db932f7e7621b034a9576. It passed 1/1: selected, executed, and passed IDs were all decode:webp:lossy_vp8; no row failed or remained planned. The local receipt records a clean worktree before and after the run, source_changed_during_run: false, and fixtures_changed_during_run: false.

The retained report is .coverage-mcp/local-evidence/selected/20261021T125859.070656Z-544ea994e4de47c8b33548801213f084/coverage.json (SHA-256 b40b8a5d2e0491dfd80ca5ae96f6efd47ae4397fbb1338b020f74d66a1cf5454). Its adjacent files are coverage.log and coverage.local-evidence.json.

Selected-run metric	Covered / total	Percent
Lines	2,744 / 139,295	1.97%
Branches	267 / 32,016	0.83%
Functions	227 / 8,908	2.55%
Regions	4,587 / 216,342	2.12%

Coverage MCP coverage_gaps was queried with this report, metric=branches, and query=src/codecs/webp. It returned status=measured, with 267/32,016 branches in the report and 757 matching groups (five shown on the first page). Source identity is unverified, test attribution is unknown, and build ID and recorded revision are null. These missing provider receipts prevent a compatible incremental union or a marginal coverage claim. Missing observations are selected-run locations, not regressions; selected reports do not establish full coverage or enforce full-suite floors.

GIF NETSCAPE loop-payload parity — 2026-10-21

Added active input-only parity rows decode:gif:netscape_loop_split_subblocks and decode:gif:netscape_loop_empty_payload. Their deterministic inputs are derived structurally from animated.gif, with SHA-256 values f37bed09e23a28e757415e9a2e238743ca8e14010bc8f2a9f4203560e193326a and 20dad1519e7cd65f7f2aff71ca773bfedea1eb4d475b9ac795d0b71eb26202db. Pillow 12.2.0 verifies and decodes both as two-frame 128x128 animations, leaves loop metadata unspecified, and returns identical frame references: frame 0 (P, SHA-256 5c14fc6f08efde212c935cb3f9e414e282357d8ceca54b8cb932023c15e4f5f9) and frame 1 (Rgb8, SHA-256 589579c365ba1aee1b7f5eb46af957d2d5f9dc32c22bc35c8f5d331263ebb4fb).

The first case splits the loop record across data sub-blocks. The second has an empty first sub-block; a following zero padding marker lets Pillow finish its extension-data loop and is ignored by the Rust GIF block parser. The decoder now reads the first NETSCAPE2.0 sub-block, matching Pillow's loop metadata behavior. The coverage harness checks exact frame pixels while preserving the decoder's indexed frame representation.

The selected run passed 5/5 rows (the two new cases, two loop controls, and the existing ANIMEXTS1.0 control). Its local LLVM report is .coverage-mcp/local-evidence/20261021/gif-netscape-loop-edge-parity-r6/coverage.json (SHA-256 540056e37567817f86d1b1c13ae9976981b0a6735eb163ba0d496083ca2a7df0). Coverage MCP measured 142/32,016 branch observations overall and found no missing observations under read_first_sub_block_and_skip_rest. Source identity is unverified and test attribution is unknown, so this is selected-run evidence only; no full-coverage result or aggregate gain is claimed.

AVIF monochrome super-resolution parity — 2026-10-21

Added active case decode:avif:superres_actual_upscaled_monochrome_17x16 for a 17x16, 8-bit YUV400 AVIF with denominator-9 super-resolution (coded width 16, visible width 17), one tile, and luma SGR restoration. The deterministic fixture generator uses the pinned libavif 1.4.1/libaom 3.13.2 fixture tool; the AVIF SHA-256 is d2c485bd5da5d3ea1a6c7af4c95807176f71949c312ca37756caed3e2eae6446. Pinned Pillow 12.2.0 returns 816 RGB bytes with SHA-256 90cb1ee739f1819fd58c121b50d8ed032e298361ec5a897a1b88b3e61d103dd6.

The decoder now admits this bounded intra monochrome super-resolution restoration profile. Its matrix-quantization guard remains closed for inter reconstruction. The selected new row passed 1/1, and the existing monochrome and super-resolution controls passed 3/3 on the final formatted source. Reports: target/release-evidence/selected/avif-mono-superres-new-combined-final.json and target/release-evidence/selected/avif-mono-superres-controls-rechecked-final.json.

Both Coverage MCP incremental branch comparisons (new parity and target-only fault against the controls report) are incomparable because the baseline branch detail does not reconcile with its totals. All selected reports have unverified source identity, null build/revision receipts, and unknown test attribution, so no union or branch gain is claimed. The new-row gaps query reports 55 missing observations in lossy_monochrome_superres_restoration_common and six in its closure; both result arms of the matrix guard at src/codecs/avif/av1/entropy.rs:17927 remain unobserved. The fault-report query reports the true arms of the sequence-support and frame-dimension guards at src/codecs/avif/av1/mod.rs:503 and :504 as unobserved; it reports no missing branch at the plane-dimension comparison on line 512. These are selected-report gaps only. No full coverage campaign was run.

AVIF monochrome alpha-plane fault contract — 2026-10-21

Added target-only case fault-contract:avif:avif_monochrome_alpha_plane_length_mismatch using the active Pillow-backed limited-alpha monochrome 16x16 fixture. A cfg(coverage) hook removes one sample from the validated alpha plane immediately before monochrome_alpha_matches. The runner requires Unsupported(NotImplemented, StillDecode) and then compares an uninjected retry with a fresh decode. The selected target-only run passed 1/1 with oracle_status: not_applicable; this result is diagnostic fault-contract evidence, not Pillow parity. Its local report is target/release-evidence/selected/avif-mono-superres-alpha-fault-combined-final.json. The hook is recorded as defensive_model in the coverage-origin inventory, which verifies 196 exact cfg(coverage) guards across 28 files.

Adam7 RGB16 PNG parity — 2026-10-21

Added active public parity case decode:png:interlace_adam7_rgb_16bit. Its 9x9 RGB16 source serializes all seven Adam7 passes and has input SHA-256 243f253a436c595237e54fddb58f7b5b9fa5fbf07a18b35531399a821cb7a5dc. Pinned Pillow 12.2.0 decodes it as RGB with 243 bytes and SHA-256 fdd488e078dac07ca3813a65dce0146ee1b9fc2f451301d579356f95f512920e.

The selected parity run passed 1/1 on the combined matrix. Coverage MCP measured 167/31,900 branches and reported both unpack_into arms at src/codecs/png/decode.rs:1794 as missing from this selected report. Source/build identity is unverified and test attribution is unknown. The saved full report comparison was incomparable because its branch detail does not reconcile with its totals; no aggregate coverage gain is claimed. The refreshed report is target/release-evidence/selected/png-adam7-rgb16-merged-main-20261021.json. No full coverage campaign or production decoder change was made.

BMP top-down odd-width 24-bit parity — 2026-10-21

Added active parity case decode:bmp:top_down_24_odd_width. Its 194-byte 9x5 INFO-header BMP uses a negative height, 27-byte BGR pixel rows, and one padding byte per row. The complete input SHA-256 is e33cd8541c6e05f96d02f256fdc94baa80d072ec4146f08129ef9f87053d0b19. Pinned Pillow 12.2.0 returns 135 exact RGB bytes with SHA-256 3ea707e3df8c76a38c8c72d2c3e263806f92aef645741ed183127b35ce04f925.

The exact selected parity run passed 1/1; its report records 94/31,900 branch observations. Coverage MCP found the bottom-up arm missing at decode.rs:710. A follow-up run with the existing bottom-up BMP control passed 2/2 and recorded 95/31,900 branch observations. The selected-report comparison found one newly observed branch arm, but remains limited because source/build identity is unverified and test attribution is unknown. Comparing with the saved full report was incomparable: its branch detail is incomplete and its denominator is 31,800. No marginal coverage gain or full coverage result is claimed. The local reports are target/release-evidence/selected/bmp-top-down-odd-width-merged-main-20261021.json and target/release-evidence/selected/bmp-top-down-odd-width-with-bottom-up-control-merged-main-20261021.json.

The saved full BMP report still lists a missing false arm at decode.rs:801 in palette attachment. Existing no-palette BMP input is rejected by Pillow as truncated, so the branch remains a reachability question rather than a justified new parity case.

The current fixture matrix contains 2,530 total rows: 2,013 decode / inspect / verify rows and 517 encode rows. Of those, 2,013 decode rows and 486 encode rows are active; 31 encode rows remain planned. The separate target-only fault lane contains 82 rows.

TIFF 2x2 Predictor=2 odd-edge parity — 2026-10-22

Added active parity rows for a 5x4 TIFF with an odd-width padded clump and a 4x5 TIFF with a padded final clump row. Both use LZW, contiguous 2x2 YCbCr, Predictor=2, and RowsPerStrip=4. Pinned Pillow 12.2.0 / libtiff 4.7.1 decodes the inputs to RGB; input and pixel SHA-256 values are 3aba39db3897b58eebb6a54769267ca7c0c46c3111fd06748a08c258d862b86c / 6d8e08b0b2dd2e2620535846b713064c48abca47c6d57ad654433136c0735e70 and 363e81d857d75ba4b3ecf5a7da2db8cb8e35ff825abcd2856f292eb1c902ddef / a8f4c5318a22ef4da79c4febbf6d8d838ba9415afacc1fe55a568a4c93fcdc30.

The Rust TIFF gate admits odd-edge 2x2 Predictor=2 geometry. The existing ceiling-based clump and predictor-row calculations handle the padding. A focused selected run passed 5/5 exact decode rows, including both new cases and three controls; the control-only run passed 3/3. Coverage MCP selected-test comparisons reported zero new branch and line coordinates. Both reports lack source/build receipts, so the comparison is limited to coordinates and does not establish a verified coverage gain. Reports: .coverage-mcp/local-evidence/selected/20261022/tiff-ycbcr-odd-predictor-2-controls/coverage.json and .coverage-mcp/local-evidence/selected/20261022/tiff-ycbcr-odd-predictor2-controls-only/coverage.json.

TIFF 1x2 Predictor=2 odd-height parity — 2026-10-22

Added active parity rows for 4x3 and 3x3 contiguous YCbCr TIFFs using LZW, 1x2 subsampling, and Predictor=2. Both images end with a padded clump row. The 4x3 fixture has an 8-byte predictor row, so Pillow/libtiff preserves its residual bytes; the 3x3 fixture has a 6-byte predictor row and takes horizontal predictor reversal. Pinned Pillow 12.2.0 / libtiff 4.7.1 produces RGB references. Input / pixel SHA-256 values are f6e68880226a3e0d995cc73a931cd5b2905709d0bea15299aa572b0c62eef046 / 7e55ac763e029f17ce869538b69db5f9a3c61078802c4a0ce8a254c992cd11e3 and 4dca2e6335e895e6b88a6f8caa8b5c6aece3c1dac43b568044f283f74afd6967 / c52188185662eb2a565288b837ba81c29535ca8ddfa9a1fdfd3eecd7b077dfd9.

Both exact selected parity rows passed individually and together (2/2). Coverage MCP found the missing false arm at src/codecs/tiff/decode.rs:957 when measuring the 3x3 selector alone. The paired LLVM report covers both arms there (false=4, true=5), and the focused coverage_gaps query returns no missing group at that line. Coverage MCP marks source identity unverified and test attribution unknown; the incremental comparison is incomparable because the earlier LLVM branch detail is incomplete. This evidence is limited to these selected rows and is not a full-suite coverage claim. The paired report is target/release-evidence/selected/tiff-1x2-odd-height-predictor2-pair.json.

PNG chunk-type byte parity — 2026-10-22

Added malformed input decode:png:error_malformed_structure_invalid_chunk_type_non_letter with a complete, CRC-correct a@Cd chunk before IDAT. Pinned Pillow 12.2.0 rejects the file during Image.open with UnidentifiedImageError. Its chunk name check also accepts ASCII digits and underscores, so the positive control decode:png:pillow_tolerated_chunk_type_digit_underscore covers a1cd and a_cd; the Rust parser preserves those Pillow-observed outcomes. The malformed and accepted fixture SHA-256 values are edac414911843c23dac2cba7f194ed34fc43addfd40877440e29b676dce55ae8 and 92f4b333a2dc484ceae684e89dac4cac8d3c11c96c03e287b0e2a0e4a71785de.

The shared chunk-type validator now runs in both decode iteration and PNG inspection. The focused selected run passed 4/4 rows: the malformed case, the digit/underscore control, and the existing lowercase-reserved-bit and post-IDAT ancillary controls. Coverage MCP found no missing branch groups in validate_chunk_type. Its report marks source identity unverified and test attribution unknown; the local receipt records the four selected cases and no source changes during the run, so this remains selected-scope evidence rather than an aggregate coverage claim. Report: .coverage-mcp/local-evidence/20261022/png-chunk-type-parity-final/coverage.json.

AVIF full-width multi-tile monochrome super-resolution — 2026-10-21

Added public Pillow parity case decode:avif:multitile_monochrome_superres_288x64. The pinned libavif 1.4.1 / libaom 3.13.2 generator verifies two deterministic encodes and an actual denominator-9 AV1 frame with a 256x64 coded plane, a 288x64 upscaled plane, and two full-width tile columns. The source Y4M, AVIF, and Pillow RGB pixel hashes are c8ebdc997141ba1718abe3b81819e6383f2d3724f54a646525f98e3059c30b60, cc88ed36062a37989bef826649d01c2fa872f41c3668c59509f310ff081a93d4, and 30ba32d9eda130257562b74f7fa6a49025176071264bfca20a3d87cae6951479.

The Rust decoder now admits only two complete tile columns, one tile row, monochrome 8/10/12-bit reconstruction, actual super-resolution, and neutral CDEF, deblocking, restoration, and film-grain settings for this path. The existing frame assembler combines coded tile planes before applying the shared upscaler. The initial 256x64 candidate had a cropped second tile and differed from Pillow in 171 bytes at the right edge; it was replaced and is not active.

The selected public case passed exact RGB parity. The focused controls decode:avif:multitile_monochrome and decode:avif:superres_actual_upscaled_monochrome_17x16 also passed. The local selected LLVM report is .coverage-mcp/local-evidence/selected/avif-mono-288-final-20261021/coverage.json. Coverage MCP observed the super-resolution true arm at src/codecs/avif/av1/frame.rs:1714; its false arm was absent from this selected run. MCP reports 1,785/31,970 branches in this small selected report, with source identity unverified and test inventory unknown, so it is only coordinate-level evidence and not an aggregate coverage claim.

AVIF monochrome grid parity and reservation failure — 2026-10-21

Added active parity case decode:avif:portable_lossless_monochrome_grid_73x64. Its deterministic 73x64 monochrome 2x1 AVIF input SHA-256 is 3e69167291d846470673b297e9a30e51d7027e182918b0a8c1d95f24719e9828; pinned Pillow 12.2.0 produces the exact 18,688-byte RGBA reference with SHA-256 a553e8c265e29b0644101cff0da8cb54ac351ac4541b86d095ad960445cea987.

Added target-only contract fault-contract:avif:avif_monochrome_grid_cell_reservation_failure using that active parity input. The coverage-only failpoint forces the monochrome grid's cell-vector reservation to fail; the runner checks the public StillDecode error and a successful retry. The exact selected run passed both selectors (1/1 parity and 1/1 fault contract, oracle not_applicable). Its local report is target/release-evidence/selected/avif-monochrome-grid-mono-fault-final-20261021.json. The report is local-only and has no Coverage MCP source/build receipt; no full coverage claim is made.

AVIF monochrome grid edge parity — 2026-10-21

Added active parity cases decode:avif:portable_lossless_monochrome_grid_no_alpha_73x64 and decode:avif:portable_lossless_monochrome_grid_bottom_clip_64x73. The first fixture has no auxiliary-alpha items, references, or properties; its input SHA-256 is a33a40230675d388722a13e45849205e24ff7f36486502907472c5f9ebd719d0. Pinned Pillow 12.2.0 returns RGB 73x64 with 14,016 exact bytes and SHA-256 1b4a716a8f76555d37d08901f0582e195b2bdcedad46b00f781995d42e4cb1b6. The second is a 1x2 monochrome grid clipped to 64x73; its input SHA-256 is 453945fc2524dabc77162d97896b21d8399a7171a909d19babb908603c0a4201. Pillow returns RGBA with 18,688 exact bytes and SHA-256 20b867857750340cae5d682bb6f5a162508395c242dfe331321cbff0bae90bb4.

The deterministic generator checks the BMFF item graph and extents, encodes both cell variants twice, and verifies the complete decoded pixels through the pinned oracle. The selected run passed 2/2 new parity rows. Coverage MCP's focused branch query for validate_monochrome_grid_with_token returned 30 remaining observations in the selected report: the no-alpha still.alpha branch at line 693 and visible-height calculation at line 807 had no missing locations; it still listed the first-leaf arm at line 625, the unsupported monochrome-dimension arm at line 628, the reservation-failpoint arm at line 636, and both zero-visible-sample rejection arms at line 811. The report is target/release-evidence/selected/avif-grid-edge-cases-20261021.json; Coverage MCP marks its source/build identity unverified and test attribution unknown. The prior selected local report was unavailable after cleanup, and Coverage MCP could not resolve the recorded 2026-08 baseline snapshot (composite snapshot not found), so no marginal coverage gain is claimed. No full coverage campaign or production decoder change was made.

Fixture declarations, executed comparisons, source coverage, and release publication have different identities and denominators. The latest local all-feature report and the historical managed coverage baseline are recorded separately; later entries retain the report-specific observations made when each entry was recorded.

JPEG row-upsample fault contracts and TIFF Predictor=2 parity — 2026-10-21

Added target-only fault contract fault-contract:jpeg:jpeg_fancy_upsample_row_invalid_geometry using the active Pillow-parity YCCK input. Its coverage-only fault sets the row upsampler's source width to zero, checks the public malformed-decode error, then verifies retry against a clean decode. The selected fault-contract run passed 1/1 with oracle_status: not_applicable. Coverage MCP returned fancy_upsample_row branch locations for the selected report, but its source identity is unverified and test attribution is unknown; no coverage gain is claimed.

Added three target-only fault contracts on the same active YCCK parity input for zero source height, zero horizontal upsampling ratio, and zero vertical upsampling ratio. Valid JPEG frame dimensions and sampling factors cannot produce these internal states. Each coverage-only hook exercises one guard, asserts the public malformed-decode result, and verifies a clean retry. These rows report oracle_status: not_applicable and remain separate from Pillow parity counts. The combined selected report .coverage-mcp/local-evidence/selected/jpeg-parity-and-faults-20261024.json passed all 286 active JPEG decode parity rows and all 13 JPEG fault contracts (299/299). Coverage MCP reports no missing branch at the row-geometry guard for this selection. Its source identity remains unverified and test attribution unknown, so the selected report does not support an aggregate coverage-gain claim.

Added target-only fault contract fault-contract:jpeg:jpeg_fancy_upsample_row_short_stride, injecting a stride one byte shorter than the component width. This state is unreachable through valid JPEG component setup and must be rejected before any row slice can use the undersized stride. The public malformed-decode error and retry against a clean decode are checked using the same active Pillow-parity YCCK input. The selected fault run passed 1/1. In its local LLVM report the short-stride condition recorded true/false counts of 1/36; the selected valid YCCK row recorded 0/72 for the same condition. Coverage MCP surfaced remaining missing arms in the row helper. An incremental comparison of the earlier selected fault report with the valid YCCK report returned incomparable because baseline branch detail does not reconcile with report totals, so no aggregate coverage gain is claimed. The current selected fault report is target/release-evidence/selected/20261020T201245Z/coverage.json; comparison inputs were target/release-evidence/selected/20261020T200320Z/coverage.json and target/release-evidence/selected/20261020T200430Z/coverage.json.

Added target-only fault-contract case fault-contract:jpeg:jpeg_row_upsample_source_length_mismatch on the active decode:jpeg:color_ycck_app14_transform_2 input. Its coverage-only one-shot hook shortens the selected component sample slice below the computed row requirement. The public result must be a malformed JPEG StillDecode error, followed by a retry that matches a clean decode. The selected run passed 1/1; its local receipt records the exact selected ID, oracle_status: not_applicable, clean source state before and after, and no fixture changes. At revision 936bc563111847de84d8926c4eae4f2ed9f80a4a, the retained report is .coverage-mcp/local-evidence/selected/jpeg-row-source-length-mismatch-20261021-clean/coverage.json with SHA-256 51a038f39db8f0c26f9acd3abf6b208e885a0e8e44f821cd5f25c063ed13d063. Its single-case totals are 1,891/138,817 lines (1.3622%), 274/31,906 branches (0.8588%), 132/8,881 functions (1.4863%), and 3,155/215,542 regions (1.4638%). Coverage MCP returned measured; the focused helper query listed 17 remaining branch observations, while the line-filtered query for the source-length guard returned no missing group. MCP source identity is unverified, test attribution is unknown, and build ID and recorded revision are absent. No compatible full baseline was queried for this source revision, so no aggregate gain is claimed. No full coverage run was made.

Added active parity case decode:tiff:ycbcr_subsampled_lzw_2x2_two_strips_predictor_2. The 224-byte little-endian input SHA-256 is bf76628b4a022f6c6891f65fc572d3af75760777dab85e70ef1e0e933072c6c1; pinned Pillow 12.2.0 produced the exact 48-byte RGB output SHA-256 7a2b02a725a8988a4e716873f80fe8290c26e274536c6716b4474c31b8379df4. The selected parity run passed 1/1. Coverage MCP returned both branch arms at decode_ifd:323, but source identity is unverified and test attribution is unknown, so no coverage gain is claimed. The reports are target/release-evidence/selected/20261020T194137Z/coverage.json and target/release-evidence/selected/20261020T194437Z/coverage.json. No full coverage campaign was run.

Added Pillow-backed 1-by-2 YCbCr LZW Predictor=2 parity cases. The 4-by-4 fixture has 8-byte predictor scanlines, so libtiff reports horAcc8: (cc%stride)!=0. and leaves the residual bytes untouched; the 3-by-4 fixture has 6-byte scanlines, which libtiff reverses normally. With pinned Pillow 12.2.0 / libtiff 4.7.1, the 235-byte input and 48-byte RGB output hashes are e5dd405646c7e6f44ea0c82e5f01cd770cd395ad38b93bb1011ccc176c17a095 and b394ef5f5e2680867b09884393d2ee73a2ce9491a21c905c9b40d99074d9671a; the 224-byte input and 36-byte RGB output hashes are b1ebb064f9f7f330ce1a1e0b7e8abdab9919791f6c364067542dc656e09e6681 and 384d5eeb323cb3f719d2203a0602ba2fcd42f95cd981568a4e9c4c2b084de219. One selected run passed both new rows and the neighboring 1-by-2 Predictor=1 and 2-by-2 Predictor=2 rows (4/4). Coverage MCP still lists branch arms at decode_ifd:323, but the selected report records source identity as unverified and test attribution as unknown. Comparing it with the saved full report was incomparable because baseline branch detail does not match its reported totals; no coverage gain is claimed. The selected report is target/release-evidence/selected/20261020T213209Z/coverage.json. No full coverage campaign was run.

The fixture matrix now contains 2,487 total rows: 1,972 decode / inspect / verify rows and 515 encode rows. Of those, 1,972 decode rows and 483 encode rows are active; 32 encode rows remain planned. The separate target-only fault lane contains 78 rows. The coverage-origin inventory records 195 exact cfg(coverage) guards across 28 Rust files.

TIFF unaligned subsampled YCbCr Predictor=2 parity — 2026-10-21

Added active public parity rows for 2-by-2 and 1-by-2 subsampled YCbCr LZW strips with Predictor=2 and RowsPerStrip=3. The 238-byte 2-by-2 input SHA-256 is 45aef5c7eea83c4600240c0d4836d826b910723dc205b8f224187edcb40f63c0; Pillow returns 48 RGB bytes with SHA-256 ee406bf055bf628b9b0a3b6d3ea29a5f32d97e963d3eb4964d5942c37f04881a. The 253-byte 1-by-2 input SHA-256 is 047e56f7916f1dca93eb034f622171ec39da0881f4679dc7f1681b075f0d243f; Pillow returns 48 RGB bytes with SHA-256 83c2ac29ff7d103f160792e45e42d13c3cd1c5b36f7b70b62e3ed5117f207666. In the 1-by-2 case, libtiff leaves the 8-byte predictor scanline residuals untouched; in both layouts, Rust reverses eligible prediction in the existing strip buffer before the unaligned conversion path, without adding an allocation.

The selected run passed five Pillow parity rows and the existing unaligned strip reservation fault contract (1/1; oracle not applicable). Coverage MCP returned both outcomes around decode_ifd:323, but reports source as unverified and test attribution as unknown. Comparing to the saved full report was incomparable because branch details differ; no coverage gain is claimed. The local report is target/release-evidence/selected/tiff-unaligned-ycbcr-predictor-parity-20261021.json. No full coverage campaign was run.

TIFF tiled subsampled YCbCr parity and resource bounds — 2026-10-21

Added Pillow-backed TIFF cases for patterned 2-by-2 YCbCr clumps across four 16-by-16 Deflate tiles, an accepted 15-by-16 clipped tile with compressed output ending after the visible clumps, mismatched tile byte-count arrays, and an out-of-bounds tile offset. Added a typed not_applicable fault contract for the bounded decoded-prefix failure path alongside the existing tile-buffer reservation fault. The padded tile prefix is capped at the maximum RGB byte count permitted by TIFF's existing decompression-bomb pixel limit.

The selected coverage run passed four parity rows and both TIFF fault contracts. Coverage MCP reported no missing branches in decode_subsampled_ycbcr_tiles for this measurement. The local report is .coverage-mcp/local-evidence/20261021/tiff-ycbcr-tiles-fault-prefix.json; its source identity is unverified and test attribution is unknown, so this is localized evidence only. No full coverage campaign was run.

Before the follow-up cases above, the fixture matrix contained 2,479 total rows: 1,964 decode / inspect / verify rows and 515 encode rows. Of those, 1,964 decode rows and 483 encode rows were active; 32 planned encode rows remained. The target-only fault lane contained 75 rows. The coverage-origin inventory recorded 192 exact cfg(coverage) guards across 28 Rust files.

WebP VP8 method-zero sampling parity — 2026-10-20

Corrected libwebp parity in VP8 coefficient adaptation: method 0 samples the first 50 macroblocks through 200 macroblocks, then samples one quarter of the frame; skip probability uses the full frame macroblock count. Token-buffer methods no longer signal skip probability, and an Intra4 macroblock skipped after zero residuals preserves the Y2 contexts as libwebp does. These changes reuse the existing macroblock decisions and add no extra per-macroblock pass.

Added Pillow-backed parity rows enc_lossy_quality_0_method_0_capped_statistics and enc_lossy_quality_0_method_0_large_frame_skip_sample. The first uses the existing 128x128 rgb.png (64 macroblocks) and matches a 698-byte WebP (SHA-256 66771f67573da043e1b72af996adf0d8b694ae86e03332369361be65ff305860). The second uses large.png at 513x257 (561 macroblocks; 140 sampled) and matches a 506-byte WebP (SHA-256 79e192628a654aa8745d528b5eef7537cfcb9463fafc24ddf7f28afe5bdc1a96).

The selected all-feature run passed 10/10 existing and new WebP encode rows, with 40 public encode calls and no panics. The capped-statistics row also passed alone (1/1, four public calls). Reports are target/release-evidence/selected/webp-skip-method0-sampling-final-20261020.json (SHA-256 61db78820e9506dfd16c93731b5f4fccb3b1480bd5b6dc2533dab0c13f748621) and target/release-evidence/selected/webp-method0-capped-statistics-only-20261020.json (SHA-256 80227fb8b4a5ad8149831f684c6810e077de62a9e9beb506cd68ac1922b33fa7).

Coverage MCP's focused branch query returned missing outcomes in adapt_coefficients and the VP8 residual skip branch at line 531. These are selected-report locations only: source/build identity is unverified and test attribution is unknown. The attempted incremental comparison is incomparable because the prior report's detailed branch inventory does not reconcile with its totals. No aggregate coverage gain or full-suite claim is made, and no full coverage campaign was run. These are ordinary input parity cases, not target-only fault contracts.

The follow-up row enc_lossy_quality_0_method_0_sampling_boundary_204_macroblocks uses a 192x272 RGB source (204 macroblocks). Method 0 samples 51 decisions at this size, the first sample count above the 50-macroblock cap; the 51st sampled macroblock has a deterministic high-frequency pattern. The source is generated by scripts/generate_webp_method0_sampling_boundary_fixture.py from the pinned rgb.png input. Pillow 12.2.0 emits 2,218 bytes (SHA-256 02b3bde54171c43bee921746dd3398a6f0a35649f0735f2a376b31a9640749b3), and the selected all-feature run passed this row alone (1/1, four public encode calls, zero panics). Its one-row LLVM report observed 7,099/140,521 lines, 609/32,044 branches, 481/8,971 functions, and 11,236/218,427 regions. Coverage MCP identified the total > 200 false arm as unobserved in this one-row selection, while the prior 10-row selected report observed both arms. The selected-tests comparison found no newly observed branch locations; the incremental comparison is incomparable because the earlier report's branch detail does not reconcile with its totals. Both reports have unverified source identity and unknown test attribution. Keep this row for the exact public sampling-boundary regression contract; it does not establish marginal or aggregate coverage gain. The report is target/release-evidence/selected/webp-method0-sampling-boundary-204-20261020.json (SHA-256 048ed9d35829a3ed4da16db92e2610bdf5c7b172934727a9d28246d082996548).

The current public fixture matrix contains 2,471 total rows: 1,957 decode / inspect / verify rows and 514 encode rows. Of those, 1,957 decode rows and 482 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows.

ICO/CUR entry-selection parity — 2026-10-20

Added five active Pillow parity rows covering ICO directory selection and CUR hotspot handling: equal-area lower-depth preference, stable equal-depth ties, both zero-bit-count depth fallbacks, equal-size CUR entries with different y-hotspots, and a CUR entry whose width and height both increase. The CUR equal-size witness uses a 1x11 canvas, keeping y-hotspots 10 and 2 in bounds. The larger-dimensions CUR witness orders a 1x1 green entry before a 2x2 red entry and confirms Pillow selects the later entry.

The ICO decoder and inspector now share area-then-depth selection for ICOs, including Pillow's palette-derived ceil(log2(color_count)) fallback and the maximum-depth fallback when the palette count is absent. CUR selection follows Pillow's raw directory rule: a later entry replaces the current one only when both raw dimensions are strictly larger. ICO bit-depth bytes are not treated as CUR hotspot coordinates.

The focused all-feature branch-coverage run passed all seven selected rows:

RUSTC_WRAPPER= PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:ico:cursor_equal_size_different_y_hotspots decode:ico:cursor_larger_dimensions decode:ico:multi_res_multi_descending decode:ico:multi_res_equal_area_bit_depth_tiebreak decode:ico:multi_res_equal_area_same_depth_stable decode:ico:multi_res_zero_bpp_depth_fallbacks decode:ico:cursor_cursor_24bit' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/20261020/ico-selection-branches-final/coverage.json

Coverage MCP reports no missing branches in entry_color_depth, prefers_entry, or prefers_cursor_entry for this measurement. The selected report is .coverage-mcp/local-evidence/20261020/ico-selection-branches-final/coverage.json; its source identity is unverified and test attribution is unknown, so this is localized branch evidence, not an aggregate coverage-gain claim. These cases are reachable through normal image inputs and remain Pillow parity rows; no fault-contract row is appropriate.

The fixture matrix contains 2,468 rows: 1,957 decode / inspect / verify rows and 511 encode rows. Of those, 1,957 decode rows and 479 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows.

WebP method-zero quality-window parity — 2026-10-20

Added active Pillow encode rows enc_lossless_method_0_quality_40 and enc_lossless_method_0_quality_60 using the existing 128x128 lossless.webp source (SHA-256 20eb48b4ef2a42d4842684930c2023f7d14ac343b825d19a185e8dda5b25f8b2). Both select lossless: true and method: 0, at qualities 40 and 60. With Pillow 12.2.0, Rust encoding matched the exact reference streams: 3,358 bytes at quality 40 (SHA-256 21af1c4ce50d605d46ea838a65660bb4219b9bee2d47fb21deb1718ea69d13d5) and 3,276 bytes at quality 60 (SHA-256 d9d39a23393d2418af4eea5bf80cac9fbcfff5a5ede79a126ec600c5bc3a18c9). Both re-decoded to the exact 128x128 RGB pixel reference.

The focused two-row selection passed both new cases and made eight public encode calls. A follow-up selection including the existing quality-80 control passed 3/3 rows and made 12 public encode calls; its report is target/release-evidence/selected/webp-method0-quality-windows-control.json (SHA-256 362613df5133960f80abccdeb71bdc91e3449dc917c0a3c503a4a43992a45e98). The active LLVM function record counted both outcomes at backward_refs.rs:307 (6 true, 12 false) and :309 (6 true, 6 false), plus six true outcomes at :311. Coverage MCP also returned missing groups for duplicate zero-hit function records at these coordinates. Its comparison with target/release-evidence/coverage-main-full-20261020.json was incomparable because the baseline branch detail does not match its reported totals; its source/build identity is unverified and test attribution unknown. These remain selected parity and branch-location evidence, not an aggregate coverage-gain claim.

WebP method-zero quality-25 window parity — 2026-10-20

Added active Pillow encode row enc_lossless_method_0_quality_25 on the same 128x128 RGB lossless.webp source. At lossless: true, method: 0, and quality: 25, Pillow 12.2.0 produces a 3,638-byte WebP with SHA-256 90f3b669c6d09675a56cadb39a9bb794baa9899595fb09f6e4d8b787e485f588; the re-decoded RGB reference is 49,152 bytes with SHA-256 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131.

The focused selected case passed 1/1 with exact encoded-byte and pixel parity. Its report is target/release-evidence/selected/webp-method0-quality-25.json (SHA-256 466d08a74507cb1010c8474a1bb2f07470337c6884bec70009ae91840975e351). The active fill_hash_chain_impl::<true> record counted six false outcomes at the quality > 25 predicate on backward_refs.rs:311, selecting the width << 4 search window. Coverage MCP returned that false outcome as observed in one function record while retaining duplicate zero-hit groups; its incremental comparison with the saved full report was incomparable. This is local selected evidence only.

Direct odd-width 1-bit PNG decode parity — 2026-10-20

Added Decode row decode:png:depth_1_1bit_odd_width for the existing complete 9x3 mode 1 1bit_odd_width.png fixture, previously used only for encoding. The source SHA-256 is ab470446e941a51011e157e861e3f920b911686d3e592e1b7cb1d6a683bdd675; its six Pillow pixel bytes have SHA-256 36e3c5d288415910fd696272299e53b64a80b66782e965c506b57e7dd2d8d203. The odd row width exercises public unpacking of the ninth 1-bit pixel before the seven unused tail bits in each row.

The selected Decode row and the existing encode:png:enc_1bit_odd_width row both passed exact pixel parity. The command and report are PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:png:depth_1_1bit_odd_width encode:png:enc_1bit_odd_width' SELECTED_COVERAGE_REPORT=target/release-evidence/selected/png-one-bit-odd-width-roundtrip.json and target/release-evidence/selected/png-one-bit-odd-width-roundtrip.json (SHA-256 7aac9adf9c0bc71f044c3cc5b8d98400914c95485aed2788aa9cba63d181022f). Coverage MCP returned no missing branch groups for unpack_into at line 1774. Its query for pack_one_bit at line 1900 reported a duplicate zero-hit function record, while the selected LLVM export contains nonzero branch counters for an active function record there. The selected report and saved full baseline have no source/build receipts, and their incremental comparison is incomparable; this is localized evidence, not an aggregate coverage-gain claim.

JPEG progressive correction-buffer parity — 2026-10-20

Added the public encode row encode:jpeg:enc_progressive_correction_buffer_flush_256x256. Its source is a 256x256 L8 PNG whose 256-byte rows repeat [0, 32, 64, 96, 128, 160, 192, 224] 32 times. The generated PNG is 371 bytes with SHA-256 a50cef6ddd8ace094ab3db04f0d205abbd8d6a70b2b618d93fb03e494c47eca9. Pillow 12.2.0 encodes it as JPEG with quality 75, progressive scans enabled, and optimization disabled. The exact 3,228-byte JPEG has SHA-256 7bf0311dd950a11befc00859db41ae78298875a015be7958dcdafaf71c091b18.

The selected all-feature branch-coverage case passed 1/1 and made five public encode calls, including sink and token parity. The local LLVM report is .coverage-mcp/local-evidence/20261020/jpeg-progressive-correction-256/coverage.json (SHA-256 6cfefcf4cb26ef7e31efcf10cdf0669668b58cf9fb36226b7e6400a105064487). Its branch counters recorded six true evaluations of correction_bits.len() > 937 for NoopProgressiveScanCheckpoint and two for TokenProgressiveScanCheckpoint; the eob_run == 0x7fff condition remained false in this case. Coverage MCP marks source identity unverified and test attribution unknown, and incremental comparison with the saved full baseline is incomparable because baseline detail does not match its reported totals. This records selected-path evidence only and makes no aggregate coverage-gain claim.

The branch is reached through ordinary public encoding, so this case remains in Pillow parity and does not need a target-only fault-contract row. The fixture matrix now contains 2,468 total rows: 1,957 decode / inspect / verify rows and 511 encode rows. Of those, 1,957 decode rows and 479 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows.

WebP lossy quality-zero bitstream parity — 2026-10-20

Added two active Pillow encode rows for lossy WebP at quality 0 and method 0. The solid 32x32 RGB source is (54, 83, 112) throughout; its exact 64-byte WebP has SHA-256 6f7a1d39acaa69a091365e2f0f40056123e3e32557716ff641b00c74908d2467 and its decoded RGB reference has SHA-256 400ee6b557d526d51bf44bf9bb5a134f1c4180f2735f5024e6a1b4caafd902f7. The nonuniform 17x17 RGB source is the existing webp_subtract_green.png fixture; its exact 158-byte WebP has SHA-256 dd356bbf484bad7659696b03b904f19eda8cf6a78f243ac2b2ff03ebdf09e054 and its decoded RGB reference has SHA-256 0e2113aada69ce5552318e82fb2a0187b4e90328b59cecd40323d9c389028100.

Exact byte parity required matching libwebp's flat-border Intra16 mode choice, the sharpness-zero filter-delta cap, and skip-probability signaling plus zero-coefficient macroblock context resets. Skip counts are collected during the existing coefficient-statistics traversal. Both quality-zero rows and the quality-100 control passed the selected public encode run: 3/3 rows, 12 encode calls, no panics. The report is target/release-evidence/selected/webp-q0-nonuniform-20261020.json (SHA-256 37315b6153679a21dd847a27dca58940882fabf12742ebe93c0cd7286476d466). Coverage MCP found no missing branch groups in skip_probability or flat_border_mode for this selected slice. The report remains local evidence: Coverage MCP marks source identity unverified and test attribution unknown, so it does not support an aggregate coverage claim.

These branches are reachable through ordinary public inputs and remain Pillow parity cases. No target-only fault contract is appropriate for them; the separate fault-contract lane remains at 72 rows.

AVIF odd-size I420 film-grain chroma parity — 2026-10-20

Added active Pillow parity row decode:avif:portable_lossless_filmgrain_420_chroma_from_luma_65x65. The fixture uses the pinned lossless 4:2:0 chroma-from-luma grain recipe at 65x65. Its 33x33 chroma planes end in a one-pixel grain block. The final chroma sample maps to the last luma row and column, and its horizontal interpolation neighbor clamps at the right image edge. The 8,189-byte AVIF has SHA-256 5f881e4c6eed5bb4c554004d72ca5e992f6b704bc39672b01d8b3a3236bb2330; Pillow 12.2.0 returns 12,675 RGB bytes with SHA-256 d3c620ef7742e8702d1351c33b4ae9386a67fa1a761b6c4b9ea695a6fe08f0c9.

The selected coverage-matrix run passed 1/1 on aarch64-apple-darwin with all features and branch instrumentation using:

PYTHON=./.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:avif:portable_lossless_filmgrain_420_chroma_from_luma_65x65' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/20261020/avif-filmgrain-odd-i420/coverage.json

Its LLVM report is retained at .coverage-mcp/local-evidence/20261020/avif-filmgrain-odd-i420/coverage.json (SHA-256 69ebe07ee9fe26967cc7a2e0c5d7470ad7409c715e7bff11a077744182d5496a). The local receipt records the exact selected row passing and fixture hashes unchanged during the run. Coverage MCP reports 1,928/32,484 branch observations for this selected report and still lists missing outcomes in film_grain::apply_plane and apply_with_sampling specializations. Source identity is unverified and test attribution is unknown; the comparison with the saved full baseline is incomparable because its detailed branch data does not match its reported totals. This run records selected-path evidence only; it does not establish aggregate coverage gain or complete branch closure.

The row exercises behavior reachable through a normal image decode, so it remains in the Pillow parity lane. No target-only fault-contract case is needed. The fixture matrix now contains 2,456 total rows: 1,951 decode / inspect / verify rows and 505 encode rows. Of those, 1,951 decode rows and 473 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows.

AVIF auxiliary-alpha duration parity — 2026-10-20

Added active Pillow parity row decode:avif:sequence_alpha_duration_mismatch. The input is derived from the existing 10-bit AVIF sequence by changing only the auxiliary alpha track's sample duration from 1 to 2; its sample payloads and color track are unchanged. The generated input is 2,267 bytes with SHA-256 b70e900cbe163b4e394aaa0bab6f283fec8f7f0093cc8dbf9ea790b85103902d. Pillow 12.2.0 accepts the 64×64 RGBA sequence and yields five 16,384-byte frames, each with a 1,000 ms duration. The public decoder previously rejected this input solely because corresponding color and auxiliary-alpha sample durations differ; the decoder now keeps the sample-count and track-timescale checks while allowing Pillow-compatible duration differences.

The exact selected parity case passed 1/1 after the fix using:

PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:avif:sequence_alpha_duration_mismatch' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/20261020/sequence-alpha-timing-final.json

The selected LLVM report is retained at .coverage-mcp/local-evidence/20261020/sequence-alpha-timing-final.json (SHA-256 ed93cf3ead23150f44100c598cbb2a7227d7425eec6b2d16cb6681b519efabcd). The local receipt records the selected case passing; Coverage MCP labels source identity unverified and test attribution unknown, so this report is not used to claim aggregate coverage gain. Incremental comparison with the retained full baseline is incomparable because baseline branch detail does not match its reported totals. Pillow supplies exact frame pixels and the independent libavif observation supplies loop semantics. This parity case tests accepted public input behavior; it does not claim support for every AVIF track arrangement.

The current fixture matrix contains 2,455 total rows: 1,950 decode / inspect / verify rows and 505 encode rows. Of those, 1,950 decode rows and 473 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows. The coverage-origin inventory records 189 exact cfg(coverage) guards across 28 Rust files.

JPEG marker-tail and YCCK singleton parity — 2026-10-20

Added active Pillow-backed rows decode:jpeg:baseline_444_single_scan_com_tail_junk, decode:jpeg:baseline_444_single_scan_com_eoi_marker_fill, decode:jpeg:baseline_444_single_scan_com_ff00_tail, decode:jpeg:baseline_444_single_scan_two_trailing_com, and decode:jpeg:ycck_h2v2_single_sample_1x1. The COM-tail rows derive from the 8×8 baseline COM control by inserting a 00 junk byte, a legal FF marker-fill byte, or an FF00 stuffed pair before EOI; the fourth case adds a second valid COM segment before EOI. Pillow 12.2.0 verifies and decodes all four to the control's same 192 RGB bytes. The FF00 candidate SHA-256 is 7ee7bd8d0fd0734f5b51cc0cd29e8fae262b29f0d6366ab5dcf081ea787e5dc3; its pinned base SHA-256 is cf8e4443dcff4df7858b6573664aa3fe73dd401827aa293d0eca84eb0667f666. The YCCK case changes only the SOF0 dimensions from 2×2 to 1×1; Pillow returns one CMYK pixel, ff ff fd ff. The second-COM candidate SHA-256 is c23f18f246085b1b088d82f9c660e1939d9d3198dda3c05ea5fe1dcf961a78e8.

The COM-tail rows exposed that the baseline decoder's validated single-scan fast path rejected bytes after a trailing marker, then sent the valid scan through generic extraction with the post-scan marker bytes included as entropy. It now skips intervening bytes and FF00 stuffed pairs only after a valid allow-listed trailing segment and bounds repeated marker-fill scanning at parsed EOI. parse_jpeg guarantees the initial cursor is at an FF marker, so the previously uncovered pre-segment non-marker guard was unreachable for parser-produced input and was removed instead of adding an artificial test. This preserves the entropy boundary and accepts the Pillow-observable inputs.

The exact selected regression run passed 7/7 rows on aarch64-apple-darwin with all features and branch instrumentation, including the existing trailing COM control and DQT marker-fill case:

PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:jpeg:baseline_444_single_scan_trailing_com decode:jpeg:baseline_444_single_scan_com_tail_junk decode:jpeg:baseline_444_single_scan_com_eoi_marker_fill decode:jpeg:baseline_444_single_scan_com_ff00_tail decode:jpeg:baseline_444_single_scan_two_trailing_com decode:jpeg:baseline_444_single_scan_dqt_marker_fill decode:jpeg:ycck_h2v2_single_sample_1x1' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/20261020/jpeg-tail-parity-seven/coverage.json

The selected LLVM report is retained at .coverage-mcp/local-evidence/20261020/jpeg-tail-parity-seven-final-code/coverage.json (SHA-256 16086ef71e98c042dec010bedb8d59be50ee21aecd5d3bc83e87edfc850f3932); its local execution receipt records all seven cases passing with no fixture changes during the run. Coverage MCP reports no missing branches at the post-segment byte check (line 2766) or FF00 condition (line 2789) in this report. The selected report totals 408/32,484 observed branches, while Coverage MCP marks source identity unverified and test attribution unknown. Incremental comparison is incomparable because the saved full baseline has incomplete branch detail, so this run does not establish an aggregate coverage gain or regression.

Signed-tag TIFF and singleton YCCK coverage — 2026-10-22

Added active public parity rows decode:jpeg:ycck_h2v1_single_sample_1x1 and decode:tiff:grayscale_unknown_signed_private_tags. The JPEG fixture changes only the SOF0 dimensions of the pinned 2×2 H2V1 YCCK input; its SHA-256 is 6ef8f392eb8f93b3afccc85b36981cbad1c080d92c81ce99a9bce32c80f5ca40. Pillow 12.2.0 verifies it and returns one CMYK pixel, fb ff fd ff (SHA-256 fe4cfd863d3977883fd52b5794e14c8ea1cadd264db6925f83b128d1df2ce3e3).

The TIFF fixture adds private SBYTE, SSHORT, and SLONG fields 65000–65002, each with value −1, to the pinned grayscale input. Its SHA-256 is 5e7b1dfc00abf38207e020dc3b39d6fe37fb32e77c7b5382227590057bc63c38. Pillow 12.2.0 reads all three signed values and produces the same 128×128 grayscale pixels as gray.tiff (SHA-256 1928fc10cb7c056f9c5de7ee534445e876fac9fd1ea050bc3c8b6eb29371c707).

Both selected public parity runs passed 1/1 on aarch64-apple-darwin with all features and branch instrumentation:

PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:jpeg:ycck_h2v1_single_sample_1x1' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/selected/jpeg-ycck-h2v1-singleton-20261022/coverage.json
PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:tiff:grayscale_unknown_signed_private_tags' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/selected/tiff-signed-private-tags-20261022/coverage.json

Coverage MCP's selected-test comparison against the active 2×2 YCCK control observed the previously missing false arm of upsample_h2v1_row at src/codecs/jpeg/decode/upsample.rs:436. Comparing the TIFF row with the existing grayscale row observed six false-arm branch observations at src/codecs/tiff/decode.rs:3915–3917, where the signed private tags take the non-YCbCr path. Both comparisons are coordinate-only: the local reports have no source revision or build identity, and Coverage MCP marks test status unknown. They establish the selected inputs' observed paths, not an aggregate coverage gain or regression.

JPEG post-scan junk followed by another marker — 2026-10-22

Added active parity row decode:jpeg:baseline_444_single_scan_com_tail_junk_then_com. The 750-byte JPEG is derived from the pinned single-scan COM fixture by adding one junk byte and a second COM segment before EOI. Its SHA-256 is 1cc70897b39aad9b13eade241695dd0628c4aade3f660ab4d8557d013ea7952c. Pillow 12.2.0 verifies and decodes it as an 8×8 RGB image. The 192 output bytes match the existing post-scan COM reference exactly (SHA-256 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f).

The new row and the existing two-trailing-COM control each passed 1/1 in separate selected coverage runs. Coverage MCP's selected-test comparison observed three additional branch coordinates: the post-scan marker search in decode.rs:2766 and decode.rs:2771, plus junk skipping in parser.rs:107. The reports use the same branch denominator, but have no source revision or build receipt and Coverage MCP reports test status unknown; the comparison is coordinate-only and does not establish an aggregate gain. The parser's false arm remains an open candidate for a different input.

AVIF version-1 item-reference alpha parity — 2026-10-20

Added active public parity row decode:avif:iref_version_1_alpha_auxl. The generated fixture widens alpha.avif's existing auxl reference from 16-bit to 32-bit item IDs, preserving the item 2 → item 1 relationship and encoded AV1 payloads. The version-1 iref grows metadata by four bytes; both file-backed iloc extents are rebased by four bytes. The 6,445-byte input SHA-256 is b6f3b78c98b33b32b679d07a91b3f3030aba7c49def8bc8bad8b64243eb2c710. Pinned Pillow 12.2.0 produces the exact 64×64 RGBA reference: 16,384 bytes with SHA-256 7b62ff36a098d8bdea49e0b72c834b6fd3e4e04f70d884eee274fc69ed869ddd.

The exact selected coverage row passed 1/1 using:

PYTHON=.oracle-venv/bin/python make coverage-selected COVERAGE_CASES='decode:avif:iref_version_1_alpha_auxl' SELECTED_COVERAGE_REPORT=.coverage-mcp/local-evidence/20261020/avif-iref-v1/coverage.json

The LLVM report is retained at .coverage-mcp/local-evidence/20261020/avif-iref-v1/coverage.json (SHA-256 453f03ef1136e645062c84287a3153301381ad7f7e3f18ce5bd04ac02d4fb289). The local receipt confirms the exact row passed and fixtures stayed unchanged during the run; Coverage MCP still labels source/build identity unverified and test attribution unknown. Its selected report has 2,063/32,138 branches. At the from_id and to_id width checks in container::parse_iref (lines 1131 and 1141) and samples::parse_iref (lines 1028 and 1039), the selected report no longer lists the false arm as missing in one parser group at each site, consistent with the version-1 path being exercised. Duplicate groups still list both arms as missing. The saved full-baseline query lists the false arm as missing at all four sites. Coverage MCP's incremental comparison is incomparable because baseline branch detail is incomplete or inconsistent with its 31,800-branch summary; no aggregate gain or regression is claimed.

The case reaches the version-1 reference parser through public image decode and retains exact Pillow pixel parity. The remaining missing clone groups do not establish additional missing input variants.

Separate-planar TIFF Deflate faults and WebP quality-50 parity — 2026-10-20

Added two public TIFF parity inputs derived from the active separate-planar RGB tiled Deflate fixture. The invalid-zlib-header input planar_separate_rgb_tiled_deflate_invalid_stream.tiff has SHA-256 fb0a43f73dc8a957f59f56cbe6d924c449ad4d0d8306649b1ab2f97c33b79ba5; Pillow 12.2.0 verifies the TIFF header and raises OSError: decoder error -2 while loading pixels. The short-output input planar_separate_rgb_tiled_deflate_short_tile.tiff has SHA-256 2756d3f21cda37ea4aa2b5f02b6f40511e3ce0654bdf1a922a928e64c5ab4454 and has the same Pillow decode error. It exposed a decoder panic when a valid Deflate stream produced only three bytes; the decoder now returns a structured malformed-input error after checking the requested sample range.

Added encode:webp:enc_lossless_quality_50 on the existing lossless WebP source. The exact Pillow encoded reference is 3,584 bytes with SHA-256 46dc365fb19ed82270953c05d810df4c43e0aea7d5bff836f60e271de9e861a5; its re-decoded 128×128 RGB reference SHA-256 is 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131.

The three selected parity cases passed. The report is retained at .coverage-mcp/local-evidence/20261020/tiff-webp-deflate-outcomes/tiff-webp-deflate-outcomes-final.json (SHA-256 a47a5359edcaaa554578fa4613302c918dacdd19a879afad9aaf7cd2f505230f). Its local receipt confirms source and fixture hashes stayed fixed during the run. Coverage MCP marks source/build identity unverified and test status unknown. The LLVM report records the separate-planar decode_block error-mapping closure and truncated-output guard. It also records the quality-50 path through the quality > 50 false edge. The full-baseline comparison remains incomparable because baseline branch detail does not reconcile with aggregate totals; no aggregate coverage gain is claimed.

These inputs reach behavior through public Pillow-compatible calls, so they remain parity cases. The 72 typed target-only fault-contract rows remain in their separate not_applicable oracle lane.

WebP VP8L run-cap parity and benchmark path filter — 2026-10-20

Added active Pillow parity row encode:webp:enc_lossless_method_0_run_cap. Its 4,356×1 RGB source contains 4,099 repeated white pixels followed by 257 distinct colors, keeping the input off the small-palette path. With lossless method 0, the public encoder reaches the VP8L hash-chain checkpoint at an internal run of 4,096 and clamps the run to 4,095. The PNG source SHA-256 is 038d4a47bb2b7f22b62eaac823a897c74607b20ee0ab6999e30b5dc84f6a1a93; the 13,068-byte Pillow-decoded RGB reference SHA-256 is 3206f3f36cf23cf01f6a3f2b696cb407eee7c80c81c05a0373154b4a165a6016; the 186-byte encoded WebP SHA-256 is d99c88b7b040f8f34dd8048f54ef0fcb4db4f43a7ffa1a048ddd9008dc863f7c.

The selected parity run passed 1/1 and re-decoded to 4,356×1 with exact pixel parity. Its report is retained at .coverage-mcp/local-evidence/20261020/webp-run-cap-62daa243/coverage.json (SHA-256 c86f0bc2a039065003df89e788f7def9b9f26812d0939d963bbeb03e8342c16f). In the active fill_hash_chain_impl::<true> specialization, the report records both outcomes at the periodic-run check (48 / 13,206) and maximum-run check (3 / 9). The local receipt marks source/build identity unverified and named test attribution unknown. Coverage MCP groups untouched sibling monomorphizations separately, and its comparison with the full baseline is incomparable because the baseline branch detail does not reconcile with its aggregate totals. These are local path observations, not an aggregate coverage gain claim.

This input reaches the behavior through normal public encoding, so it remains Pillow parity. The 72 typed target-only fault-contract rows remain in their separate lane with oracle status not_applicable.

WebP method-six hash-chain run-cap parity — 2026-10-22

Added active Pillow parity row encode:webp:enc_lossless_method_6_run_cap. It reuses the 4,356×1 RGB run-cap source with lossless quality 80 and method 6, which selects fill_hash_chain_impl::<false>. The selected all-feature coverage run passed 1/1 and re-decoded to exact 4,356×1 RGB pixels. Pillow's 616-byte WebP reference has SHA-256 8abd0df9e4f0d5292902f75bc9e0be22261b7045b2266ebf895d0c17a46e00d4; its pixel reference is the existing 13,068-byte source result with SHA-256 3206f3f36cf23cf01f6a3f2b696cb407eee7c80c81c05a0373154b4a165a6016.

The selected report is retained at .coverage-mcp/local-evidence/20261022/webp-method-6-run-cap/coverage.json (SHA-256 8264ac4c3cbfdd41fb53820c6c4221533a7bd1f877ef493a77cf9fc47e4f6ad9). In the executed false specialization, the periodic-run check recorded 57 true and 15,453 false outcomes; the run > MAX_LENGTH check recorded 3 true and 12 false outcomes. The source file hash at measurement was b9cb0e990625fe385ce49f4d96e84acc609242353e949d89be17093939e787cc. The runner log records the selected test passing. Coverage MCP marks the report's source/build identity unverified and test attribution unknown; comparison with the older selected report is limited. These observations do not establish an aggregate coverage gain.

The x86 benchmark workflow's pull-request path filter now includes src/cancel.rs, which the benchmark uses for cancellation-aware encodes. Its release-policy regression test and the local selected parity test passed. The CI filter fix is committed on main as 62daa2436d7802294ed253f2e54953862a6509aa; the GitHub CI, documentation, and paired SSE2/AVX2 benchmark runs were triggered on that commit.

The current fixture matrix contains 2,444 total rows: 1,941 decode / inspect / verify rows and 503 encode rows. Of those, 1,941 decode rows and 471 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows. The coverage-origin inventory records 189 exact cfg(coverage) guards across 28 Rust files.

Full coverage baseline and AV1 film-grain overlap parity — 2026-10-20

Refreshed the local all-feature coverage baseline on source revision 34c3930f2e7f6fdad102a421e15170fc2e202688. The report is retained at .coverage-mcp/local-evidence/20261020/main-full-34c3930f/coverage.json (SHA-256 0b28133d95eb8c736f83dccc87cfbcf7eaea57a89c9031dade323c2e8716383b). The run used:

CARGO_INCREMENTAL=0 RUSTC_WRAPPER= PYTHON=.oracle-venv/bin/python CARGO_BUILD_JOBS=2 make coverage COVERAGE_REPORT=target/release-evidence/coverage-main-full-20261020.json

The all-feature coverage gate passed. The run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, 68/68 feature-gate tests, 4/4 animation-loop tests, and the capability-table test. The full report measures 91,909/138,417 lines (66.4001%), 18,108/31,800 branches (56.9434%), 5,079/8,855 functions (57.3574%), and 140,584/214,895 regions (65.4199%). Coverage MCP labels its source identity unverified and test attribution unknown; this is a fixed local exploration baseline, not a registered source/build receipt.

Coverage MCP located uncovered outcomes in src/codecs/avif/av1/film_grain.rs::overlapped_grain. Added the public parity row decode:avif:portable_lossless_filmgrain_i444_overlap_64x64 by enabling only the inspected AV1 overlap flag in the existing 64x64 all-lossless I444 source. The generator confirms unchanged BMFF sample extents and all 15,555 tile-payload bytes. The input is 15,960 bytes with SHA-256 345a3e16a1d9574a6ac39c4b14eaa93ba70b5d49714cae2188fdff03c252e03a; its 12,288-byte Pillow RGB reference has SHA-256 46bfc877578f36fc8d3b376c3ac41e6be9ff98bb14fda447a0b0baeeba0b97d7.

The selected coverage-matrix run passed 1/1. Its LLVM report is retained at .coverage-mcp/local-evidence/20261020/avif-filmgrain-overlap-34c3930f/coverage.json (SHA-256 418c268e65838ac45a232cc52b119b894843c94b84f321721b5eb1fbafbe72b8). The hit-bearing overlapped_grain specialization recorded 36,864 calls and both outcomes at its branch conditions. Coverage MCP still reports missing branch coordinates for another linked specialization. The incremental comparison with the full baseline is incomparable because the baseline's detailed branch data does not reconcile with its aggregate totals. No aggregate coverage gain or complete branch-closure claim is made.

The parity matrix now contains 2,439 total rows: 1,938 decode / inspect / verify rows and 501 encode rows. Of those, 1,938 decode rows and 469 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows. The coverage-origin inventory records 189 exact cfg(coverage) guards across 28 Rust files.

Unaligned TIFF YCbCr strips and CI gate hardening — 2026-10-20

Added a Pillow-parity fixture for subsampled YCbCr TIFF strips whose RowsPerStrip boundary cuts through a vertical clump. The public decoder now converts each strip using its own clump rows. A separate typed fault-contract row fault-contract:tiff:tiff_unaligned_strip_assembly_reservation_failure injects strip-output reservation failure on this path and checks the structured error followed by a successful retry; its oracle is not_applicable, so it is excluded from Pillow parity totals. The workflow policy checker now rejects continue-on-error on required CI jobs and their steps, with regression mutations for both levels.

The TIFF input SHA-256 is fec83d5c16fb6b391c5bb7bf3273a3f9e009dcd6937ba4ce795f1ad086f84a4d; its exact 48-byte RGB output SHA-256 is ee406bf055bf628b9b0a3b6d3ea29a5f32d97e963d3eb4964d5942c37f04881a. The selected coverage run passed 1/1 parity rows and 1/1 fault-contract rows. Its report is target/release-evidence/selected/tiff-unaligned-ycbcr-fault-contract-final.json (SHA-256 498567163da32491699c14b375c48d4d7030002a7be9c7f73c7ba31ca661cc3b). Coverage MCP reports the unaligned-strip predicate's false arms as missing in this selection and no missing branch outcomes at the reservation hook. The report has unverified source/build identity and unknown named-test attribution, so this is coordinate evidence only. No full coverage campaign was run.

cargo fmt --all -- --check, strict all-target/all-feature Clippy, make workflows-check, the focused workflow-policy regression test, fixture integrity, and the typed fault-contract validator passed.

The current fixture matrix contains 2,439 total rows: 1,938 decode / inspect / verify rows and 501 encode rows. Of those, 1,938 decode rows and 469 encode rows are active; the other 32 encode rows are planned. The separate fault-contract lane contains 72 rows. The coverage-origin inventory records 189 exact cfg(coverage) guards across 28 Rust files.

AV1 odd-width I420 super-resolution parity — 2026-10-20

Added decode:avif:superres_actual_upscaled_i420_17x17, a lossy 17x17 AVIF still that signals super-resolution denominator 9. Its coded luma width is 16 and upscales to 17; ceil-rounded I420 chroma width grows from 8 to 9. The fixture generator validates the AV1 geometry, repeat-encodes byte-identically, and checks Pillow 12.2.0 verify()/load() plus the exact RGB output. Input SHA-256: 5824f2bd3c3fa431a0c0c57509f34e11ec148e36bac9531bff083394eab59d2f; the 867-byte decoded pixel SHA-256 is 0140c8dab75efad711db2af0b7f1f837e76e2a8d578ac43052fea15b7693d926.

The selected public parity row passed 1/1. Coverage MCP lists branch coordinates in upscale_subsampled_leaf and resize_plane, including the unobserved injected header-mismatch arm and invalid-plane-geometry arms. It also lists the unsampled non-subsampled width arms at resize.rs:223 and resize.rs:228; this fixture follows the 4:2:0 subsampled arms. The report is local-only with unverified source/build identity and unknown test attribution, so these are coordinate observations rather than a marginal coverage claim. Separately, the existing target-only fault-contract:avif:avif_superresolution_header_geometry_mismatch row passed 1/1 with oracle status not_applicable; it remains outside Pillow parity counts. The gap query for that selected report omits the injected mismatch arm at resize.rs:206, while still listing non-subsampled width and invalid-plane geometry arms. Its report is also local-only with unverified source/build identity and unknown named-test attribution, so this does not establish an aggregate or marginal coverage gain. No full coverage campaign was run.

The selected report is target/release-evidence/selected/20261020T000909Z/coverage.json (SHA-256 ad5903cec36bcdcb8f8c9d7a219c2e902d2fd5d8e571de08ac50c0f6943b8c3d). The selected fault-contract report is target/release-evidence/selected/20261019T234822Z/coverage.json (SHA-256 f102498b91b8b11e8034b16ec7315cc4edf802e9998d0608dd02f2639676feba).

JPEG trailing JFIF APP0 parity — 2026-10-19

Added decode:jpeg:baseline_444_single_scan_trailing_app0, a complete baseline 4:4:4 JPEG with a valid JFIF APP0 segment after its only entropy scan. Pinned Pillow 12.2.0 accepts the file in both verify() and load(); it decodes to 8×8 RGB and the exact 192-byte pixel output matches the existing trailing-COM and trailing-APP1 cases. The input SHA-256 is 507c2cf54fb8d6c38bf75020b6371df6e74b639eefc5c8e7091b6657b1c9e646; the pixel SHA-256 is 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f.

The JPEG parser already accepts APP0 segments. The baseline single-scan fast boundary recognizer now treats APP0 like the supported APP1, COM, DHT, and DQT segments, keeping valid metadata after the scan out of entropy extraction. This is a bounded marker match with no extra allocation or pixel-loop work. The selected coverage run passed 1/1 and checked that decoded opaque metadata retains the exact APP0, COM, APP0 order and bytes. Coverage MCP's line-filtered branch query reports only the invalid-marker (true) arm at decode.rs:2774 as missing in this selection, consistent with APP0 taking the accepted (false) arm. The incremental comparison with coverage-main-20261019.json is incomparable because its branch detail does not reconcile with the totals. Both MCP measurements lack source/build receipts, and MCP test attribution is unknown. The local selected-run receipt records the exact case, source and fixture hashes, and passing test process. No aggregate coverage gain or full-suite claim is made; no full coverage campaign was run.

The focused report is target/release-evidence/selected/20261019-jpeg-trailing-app0-as-chunks-f4e98437/coverage.json (SHA-256 eec4c738e6ef1eba9d853d47ce6e88682bba93a3413a534fd4f8b827329b3c75).

TIFF RGB16 Deflate-compressed contiguous strips — 2026-10-19

Added decode:tiff:rgb16_le_deflate_contiguous_strips for a little-endian 16-bit RGB TIFF with two independently Deflate-compressed, one-row contiguous strips. It relies on the default unsigned sample format and omits the default contiguous planar configuration and predictor tags. Pinned Pillow 12.2.0 opens it as 2×2 RGB and returns the exact pixel bytes 12569aab00ff0080ffff017f. The fixture generator verifies the RGB photometric tag, compression, strip offsets and lengths, and the omitted default tags. Input SHA-256: b3a35c9135e45daf9016229f803eaade5923b506830b491cd001c9db1899e369; output SHA-256: d7973d0ab7bfd18e2fe3666bcdb5367d84d3b854b58bab793799d0803fb63c1b.

The generic TIFF strip decoder already bounds each strip, decompresses to the expected row size, and converts RGB16 samples to RGB8. The inspection predicate now accepts this contiguous Deflate layout, with no pixel-loop or allocation change. The final selected coverage run passed 1/1. Coverage MCP's line query lists two missing observations at inspect.rs:396. The report's raw branch records show ten executions of the planar == 1 and !tiled outcomes, but zero counts for a wider joined span on the same line. MCP marks the report's source unverified and test attribution unknown, so this mapping remains a coordinate lead and does not establish marginal coverage. Its incremental comparison with coverage-main-20261019.json was incomparable because baseline branch detail does not reconcile with its totals. The local receipt records the selected case, passing process, matching source-file hash, and fixture hashes; no aggregate coverage gain or full-suite claim is made. No full coverage campaign was run.

The focused report is target/release-evidence/selected/20261019-tiff-rgb16-deflate-strips-b3c311c69-clippy/coverage.json (SHA-256 ed984dbed71d978fab31b2f11b4d81055c7049ab36f371fdb4617e4bab258544).

TIFF unsigned RGB16 strip parity and allocation fault contract — 2026-10-19

Added little- and big-endian, uncompressed 2×2 RGB16 TIFF fixtures with two one-row strips. The little-endian input relies on TIFF's default unsigned sample format, while the big-endian input stores SampleFormat=1 for all three channels. Pinned Pillow 12.2.0 converts each unsigned sample to RGB8 by retaining its high byte; both files produce the exact 12-byte pixel sequence 12569aab00ff0080ffff017f. The input SHA-256 values are aebc7d664d848fe2d4e5054c4926ea6b38b99665d2d31bd6c86419aa07b7874b (little endian) and 9b91240255da2d849d12be62e59c3d868721112253ed46f1284578597567b0e3 (big endian).

The selected matrix run passed both parity rows and the target-only fault-contract:tiff:tiff_rgb16_output_reservation_failure row. The fault returns the structured TIFF RGB16 output allocation error, then a retry matches a fresh decode. This contract has oracle_status: not_applicable and is reported outside Pillow parity. Its source case is the little-endian parity fixture.

The selected branch report is target/release-evidence/selected/20261019T040515Z/coverage.json (SHA-256 249d565c2daacb13aa16001744aa85e33a07f4ba451c30bded8cbf94f9c69ef9). Coverage MCP records 174/31,674 observed branches and no missing branch groups in the RGB16 conversion or output-reservation helpers; it reports 24 missing branches in the shared TIFF layout function. The report has unverified source/build identity and unknown test attribution, so these are coordinate-only observations and do not establish an aggregate coverage gain. The focused runner log records 2/2 Pillow decode rows and 1/1 fault contracts passing. No full coverage campaign was run.

TIFF subsampled YCbCr checkpoints and odd clump edges — 2026-10-19

Added five Pillow-backed decode rows for 1×2 and 4×2 subsampling. The three 32×32 inputs exercise the 1,024-pixel conversion checkpoint through the specialized 1×2 path, the general 4×2 path, and custom-coefficient tables. Two 33×33 4×2 inputs add odd final clumps; both clip the final row and column while still reaching the checkpoint. Pinned Pillow 12.2.0 generated the exact RGB references for all five cases.

Selected branch runs passed all five rows: the individual 1×2, default 4×2, and custom 4×2 reports are under target/release-evidence/selected/tiff-ycbcr-checkpoint-1x2.json, target/release-evidence/selected/tiff-ycbcr-checkpoint-4x2-retry1.json, and target/release-evidence/selected/tiff-ycbcr-checkpoint-custom-4x2-retry1.json; the two odd-edge rows passed in target/release-evidence/selected/tiff-ycbcr-checkpoint-4x2-odd-edges.json. Coverage MCP finds no missing branch groups at the general converter's current checkpoint and clipping conditions (decode.rs:2124, 2131, 2155) in the combined odd-edge report. Its selected-tests comparison with the even 4×2 report observes 13 new branch coordinates, including both true clipping arms. The MCP marks the comparison limited because source/build identity is unverified and test attribution is unknown. Its incremental comparison cannot combine the selected reports because exact detail does not reconcile with the reported totals. The 1×2 report's raw LLVM record shows both checkpoint outcomes (5 and 5,115), while MCP still lists that specialized line as missing; therefore no aggregate gain or regression is claimed. No full coverage campaign was run.

AVIF mixed-segment inter parity and TIFF YCbCr fault contract — 2026-10-18

Added the active public parity case decode:avif:animated_mixed_lossless_inter_b32_i420_64x64. Its two-frame 64×64 8-bit I420 sequence contains both lossy and qindex-zero lossless segments in a full-visible inter-coded B32x32 leaf. The selected Pillow 12.2.0 comparison passed 1/1 with exact 12,288-byte RGB parity. The fixture hash is ecb244cfa33b1737f09246cf87ad20dbd8156108dc9b93da76a8bbe885007257; frame reference hashes are 90ce523631e9fd385bcae414317ca29e655e9fa26a022e09d50795e71b32d634 and aa3d0199115d1734da9065059f33f648e4f90151fbce35dc3cd670a5f6b479f4.

Added target-only fault-contract:tiff:tiff_ycbcr_general_rgb_output_reservation_failure for the generic 4×2 subsampled converter. Its coverage-only injection reuses the existing reservation fault point; production builds reserve the original exact output length. The selected contract passed 1/1, returning the public typed allocation error and then matching a fresh decode on retry. The Pillow-backed source parity control also passed 1/1. This row has oracle_status: not_applicable and remains outside Pillow parity totals.

Selected coverage reports are target/release-evidence/selected/20261018-avif-mixed-lossless-inter-b32-final.json (SHA-256 b49001beeaeca0880ad6b39743aac23eff5424ca507195f15ee1ed776f91f60f), target/release-evidence/selected/20261018-tiff-ycbcr-general-reservation-fault-final.json (SHA-256 8c48cebf2b1553581f10db116bc537da851d3341be80e8a4d5bdbb2ca452dcf7), and the two existing parity controls in target/release-evidence/selected/20261018-avif-tiff-edge-controls.json (SHA-256 c408ded30954b71475dca52e5c2136d60d40bf59b9d082b3efa5fc9209b44689). Coverage MCP's selected-tests comparison reported 285 newly observed branch coordinates for the AVIF entropy path and one for the generic TIFF reservation hook. These measurements have unverified source/build identity and unknown test attribution, so they are coordinate-only evidence; no aggregate coverage gain or regression is claimed. No full coverage campaign was run.

At the time this 2026-10-18 entry was recorded, the fixture matrix contained 2,434 total rows: 1,934 decode / inspect / verify rows and 500 encode rows. Of those, 1,934 decode rows and 468 encode rows were active; the other 32 encode rows were planned. The separate fault-contract lane contained 71 rows. The coverage-origin inventory recorded 188 exact cfg(coverage) guards across 28 Rust files.

BMP decoded-pixel reservation fault contract — 2026-10-17

Added the target-only row fault-contract:bmp:bmp_decoded_pixels_reservation_failure, which reuses the active decode:bmp:depth_24 Pillow input. The 24-bit decoder now reserves its RGB output with try_reserve_exact; the coverage-only fault makes that reservation fail and the public API returns a structured dimensions error. The normal retry is compared with a fresh decode. The selected fault contract passed 1/1 with oracle_status: not_applicable, outside Pillow parity, and the ordinary depth_24 parity row passed unchanged.

The selected branch report is .coverage-mcp/local-evidence/20261017/bmp-decoded-pixels-fault/coverage.json (SHA-256 1929fb205c059466e7957c8713a82cea5533f3afa4bc42bff20608727e1e481c). It contains 51/31,478 observed branches overall. Coverage MCP reports no missing branch group spanning src/codecs/bmp/decode.rs:696 or src/codecs/bmp/decode.rs:705. The report has no source/build receipt and unknown test inventory, so these are coordinate-only observations; the selected runner output is the evidence for the one fault case. The incremental comparison with the saved full report was incomparable because exact branch detail did not reconcile with its totals; no coverage union or regression claim is made. No full coverage campaign was run.

GIF pre-frame zero padding parity — 2026-10-17

Added decode:gif:pre_frame_zero_padding for a complete 1x1 indexed GIF with a zero padding block before its first image descriptor. Pinned Pillow 12.2.0 verifies and loads the input as one P frame with pixel 00; the fixture SHA-256 is 4c25c0da8eb0126a59c3b171a3316a9d8fed08697074a75f19dc0add1bb9a044 and the exact pixel-reference SHA-256 is 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d. The selected matrix run passed with the post-frame padding control and no-frame inputs. It also exercises basic inspection and the exact 34-byte metadata limit. A separate zero-padding-before-trailer input still matches Pillow's no-image error.

The selected branch report is .coverage-mcp/local-evidence/20261017/gif-pre-frame-zero-padding-selected/coverage.json (SHA-256 ac416dd62e5b1f608917d2c903e52feffa2903bf4682319cad7148e6ac28c12f). It contains 110/31,476 observed branches overall. Coverage MCP reports no missing branch group spanning src/codecs/gif/decode.rs:175, src/codecs/gif/decode.rs:420, or src/codecs/gif/inspect.rs:143, covering still/sequence parsing, metadata measurement, and inspection padding paths. The report has no source/build receipt and unknown test inventory, so these remain coordinate-only observations. The current fixture matrix contains 2,404 total rows: 1,904 decode / inspect / verify rows and 500 encode rows. Of those, 1,904 decode rows and 468 encode rows are active; the other 32 encode rows are planned.

TIFF equivalent-default YCbCr rational parity — 2026-10-18

Added decode:tiff:ycbcr_equivalent_default_rational_lzw_2x2, a complete 4×4 LZW TIFF with explicit coefficient and reference fractions that equal the YCbCr defaults but use noncanonical numerator/denominator pairs. Pinned Pillow 12.2.0 accepts the input as RGB and returns the same exact 48 bytes as the default-tag fixture. The input SHA-256 is 06a8a28ba0ebe1359d107ca2d7c442eb02dcc27cba8b85b06c16eaa610e7fa65; the pixel-reference SHA-256 is af15457a9372a158dd276ced4109b650b99def573093a49f70dbb469c2262668.

The focused selected matrix run passed 1/1. Its report is target/release-evidence/selected/ycbcr_equivalent_default_rational_final.json. Coverage MCP reports 234/31,634 observed branches for that selected report. The selected-tests comparison with three existing YCbCr rows found zero newly observed branch coordinates and three coordinates not observed by the new case. Both reports are source-unverified with unknown test attribution, so this is limited coordinate evidence, not a measured aggregate coverage gain. The old full report predates the current source and is not combined with this selection. The case remains useful as a distinct parity contract for explicit fractions equivalent to defaults; no fault injection or full coverage run was needed.

Codec edge and progressive JPEG restart parity — 2026-10-18

Added public Pillow parity rows for OS/2 core 4-bit BMP padding, GIF Plain Text Extension handling, two-page transparent TIFF output, 16-bit partial-frame APNG composition, and a trailing DHT after a single-scan baseline JPEG. Added progressive JPEG restart-row parity for RGB, grayscale, and CMYK, plus a 33x33 4:2:0 input that ends on partial MCUs. Two malformed trailing-DHT cases verify that Pillow accepts the JPEG structure but rejects truncated Huffman counts or symbol payloads during pixel loading.

The 33x33 case exposed missing dummy-block DC symbols in interleaved scans and missing inherited DC refinement bits. The encoder now emits the padded MCU events Pillow expects. The selected decoder matrix passed 5/5 format-edge rows and the focused trailing-DHT matrix passed 3/3 rows. The selected progressive JPEG matrix passed 4/4 rows with 20 public encode calls and zero panics. The new partial-MCU output is 1,331 bytes; its source SHA-256 is afdec16d964c39b1d8f8329f72d798669ce507bf0904f96388fd273ddf65cc45 and its Pillow encoded-reference SHA-256 is 0185f9326f806ea684d69619abaa48e1abebf62d1d511ba0ca349017a8566f29.

The selected target-only JPEG coefficient-reservation fault contract also passed 1/1 with oracle_status: not_applicable, separately from Pillow parity. Coverage MCP reports 726/31,634 branch observations in the final format-edge decoder report, 292/31,634 in the trailing-DHT report, and 715/31,634 in the progressive JPEG report. Its targeted query found no missing branch arms at the new partial-MCU block-bound checks. It still lists the internal malformed DHT bounds at decode.rs:2596 and :2602 as unobserved, despite the public error-parity rows; those coordinates need further reachability analysis. The reports have unverified source identity and unknown test attribution, so these are exploration coordinates, not measured coverage gains. Reports: target/release-evidence/selected/20261018-edge-decode-final.json, target/release-evidence/selected/20261018-progressive-jpeg-restarts-final.json, target/release-evidence/selected/20261018-jpeg-trailing-dht-boundaries.json, and target/release-evidence/selected/20261018-jpeg-fault-contract-coverage.json. No full coverage campaign was run.

TIFF YCbCr rational edge parity — 2026-10-18

Added public Pillow parity cases for negative-equivalent SRATIONAL coefficient and reference values, plus exact-count DOUBLE coefficients. Pillow displays the negative-equivalent pairs as positive ratios, while libtiff consumes their stored numerator as signed and denominator as unsigned during YCbCr conversion; the fixtures retain the exact pixel bytes from that behavior. A DOUBLE coefficient tag with the required three values opens and verifies but fails during pixel decoding, while unsupported coefficient counts continue to use libtiff defaults. These are Pillow-reachable input cases, so they remain ordinary parity rows rather than target-only fault contracts.

The final selected TIFF YCbCr rational matrix passed 25/25 active parity rows in target/release-evidence/selected/tiff-ycbcr-rational-edges-final-v3.json. Coverage MCP reports 260/31,512 branch observations for that report and lists remaining coordinates in ycbcr_parameters and read_ycbcr_rationals around inspect.rs:441, :465, :469, :506, and :520. The report has no recorded revision or build ID, an unverified source state, and unknown test attribution; these are exploration coordinates only and do not establish a measured source coverage gain.

After the reference-limit comparison was rewritten with checked arithmetic to satisfy strict Clippy, the accepted and rejected boundary rows were rerun and passed 2/2 in target/release-evidence/selected/tiff-ycbcr-reference-limit-checked-arithmetic-v1.json. Coverage MCP lists ten missing branch coordinates in ycbcr_reference_exceeds_conversion_limit, including spans around decode.rs:2332 and :2337. This selected report also has no source/build receipt or test attribution, so the coordinates remain exploratory rather than proof of current-source coverage.

TIFF LZW mid-stream CLEAR parity — 2026-10-18

Added decode:tiff:lzw_midstream_clear_width_reset, a complete grayscale TIFF whose LZW codes cross the 9-to-10-bit early-change boundary, issue CLEAR at 10 bits, and continue with 9-bit literals. The generator verifies the code width at the boundary and after CLEAR, then checks Pillow 12.2.0's mode L, 330×1 dimensions, exact pixels, and SHA-256 a50858b23acd18e82d5012a8a115b2a905f22610822f86e5622aef99ebfa3cf4. The selected public parity row passed 1/1.

Coverage MCP's selected LLVM report records 193/31,586 branch observations overall and has no missing branch groups on the LZW CLEAR conditions at decode.rs:2960 and decode.rs:3055. The report has unverified source and unknown test attribution. Its incremental comparison to the saved full report is incomparable because the baseline lacks compatible detail; no aggregate coverage gain or full-suite result is claimed. Report: target/release-evidence/selected/20261018T035838Z/coverage.json.

TIFF YCbCr FLOAT and DOUBLE parity — 2026-10-18

Added five valid public parity rows for IEEE FLOAT/DOUBLE coefficient and reference-black-white tags, including an accepted infinite DOUBLE coefficient. Four error-parity rows cover NaN coefficients and infinite reference values. The generated TIFFs contain real IEEE payloads; the malformed existing DOUBLE-coefficient row, which retains RATIONAL bytes, is unchanged. Pinned Pillow 12.2.0 produced the exact RGB bytes and decoder errors. These are ordinary parity cases because complete TIFF inputs reach each behavior; no target-only fault contract was needed for these paths.

The focused run selected all nine new parity rows, the retained malformed DOUBLE-coefficient row, and the five existing TIFF YCbCr fault contracts. All 10/10 parity rows and 5/5 target-only contracts passed. The LLVM report is .coverage-mcp/local-evidence/20261018/tiff-ycbcr-float-double-v3/coverage.json. Coverage MCP reports 277/31,568 branch observations in this selected report, but marks source identity unverified and test attribution unknown; it is not an aggregate coverage gain or full-suite claim. Its remaining floating_value index-bound arm is defensive: read_ycbcr_rationals checks exact field counts before requesting each array index, so no public TIFF input reaches an out-of-range call.

TIFF YCbCr subsampling and positioning parity — 2026-10-18

Added seven public Pillow parity inputs for the supported 2x1, 4x1, 4x2, and 4x4 clump layouts, including odd image edges and custom coefficients. Added three more inputs showing that libtiff ignores malformed YCbCr positioning metadata (tag 531) during RGB conversion. The selected run passed all 10 rows with pixel parity. The four existing TIFF YCbCr fault-contract rows also passed 4/4 with oracle_status: not_applicable.

The selected public report is target/release-evidence/selected/20261017T223455Z/coverage.json; the selected fault-contract report is target/release-evidence/selected/20261017T223916Z/coverage.json. Coverage MCP reports no missing branch groups for the general converter's odd-edge clipping checks at decode.rs:2011 and :2018. It still lists uncovered defensive validation arms for zero clump factors and mismatched sample lengths in the general converter. Both reports have no source/build receipt and unknown test inventory; they are selected-test exploration evidence and do not establish an aggregate coverage gain or full-suite coverage claim. The baseline comparison was incomparable because the saved baseline lacks matching coverage detail and verified receipts.

APNG duplicate control before the default image — 2026-10-17

Added the public decode:png:apng_duplicate_actl_before_idat row. Its CRC-checked fixture duplicates the acTL chunk before IDAT from apng_rgba_controls.png; the input SHA-256 is 18b489f5cea0c7e3e58550afcc2ce169a12d377d5f7e357b1de2714ab5c67022. Pinned Pillow 12.2.0 warns that the APNG is invalid, then verifies and loads the static default image as one 4x4 RGBA frame. The exact pixel reference SHA-256 is 21b7dac1be9dacf604fd4475304d962dc50a83b6b9623340f59de886d398b8c6. The selected public matrix run passed for this case and the existing duplicate acTL after IDAT control.

The selected branch report is .coverage-mcp/local-evidence/20261017/png-apng-pre-idat-duplicate-actl/coverage.json (SHA-256 b25cc6e2ac8dc97e8521c5a0dfe4e53e99a5758c925582ecd4998e1b7c4a32de). It contains 249/31,482 observed branches overall. Coverage MCP reports no missing branch group spanning src/codecs/png/decode.rs:1032, the duplicate-control fallback arm. The report has no source/build receipt and unknown test inventory, so this is coordinate-only reachability evidence. The current fixture matrix contains 2,296 total rows: 1,802 decode / inspect / verify rows and 494 encode rows. Of those, 1,802 decode rows and 462 encode rows are active; the other 32 encode rows are planned.

WebP oversized alpha ANMF height parity — 2026-10-17

Added the public pillow_tolerated_malformed_animated_alpha_anmf_height_mismatch row. Its deterministic 64x64 animated alpha WebP declares the first ANMF frame as 64x65 while retaining the original nested ALPH and VP8 bitstream. Pinned Pillow 12.2.0 verifies and decodes it as two 64x64 RGBA frames; the exact frame references match the existing oversized-width control. The selected test_decode_matrix_webp parity run passed 1/1.

A selected branch-coverage report at .coverage-mcp/local-evidence/20261017/webp-anmf-height-selected/coverage.json has SHA-256 148e3c20d0ed7b8964e2538635f3d20aab480d348faa00d1a592e6bf41ec4b3a. Coverage MCP reports both outcomes at src/codecs/webp/inspect.rs:310 in this selected report. The report has no source/build receipt and test inventory is unknown; it is coordinate-only reachability evidence. The incremental comparison with the saved 2026-10-16 full report is incomparable because its branch details do not reconcile with its totals. No aggregate coverage gain or full-suite regression conclusion is claimed. The current fixture matrix contains 2,288 total rows: 1,794 decode / inspect / verify rows and 494 encode rows. At that point, 1,794 decode rows and 462 encode rows were active; the other 32 encode rows were planned.

WebP VP8L alpha hint parity — 2026-10-17

Added a paired VP8X/VP8L alpha-flag parity case. The pillow_tolerated_malformed_vp8x_vp8l_alpha_flag_mismatch fixture sets the VP8L alpha hint while keeping the VP8X alpha bit clear, without changing the image bitstream. Pinned Pillow 12.2.0 accepts it as an opaque 128x128 RGBA image; the exact pixel reference SHA-256 is 6b4e0e27ac0a042958c1a976561c6d890fe2042e3e54c8e898cd859c87db332b. The complementary pillow_tolerated_malformed_vp8x_alpha_flag_without_vp8l_hint fixture sets only the VP8X alpha bit; Pillow reports RGB and the exact pixel reference SHA-256 is 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131.

The first selected Rust matrix run failed because inspection reported RGB. The public codec now takes still VP8L alpha metadata from its parsed image header, and the selected pair and complete WebP matrix tests pass. A selected branch-coverage report is at .coverage-mcp/local-evidence/20261017/webp-vp8x-alpha-pair-selected/coverage.json; its SHA-256 is 0631eeae65b1d0a7b8abcc1d49fe4a0aa4b5d675393e59282405af5fca40223e. Coverage MCP reports no missing branch group at src/codecs/webp/inspect.rs:247 and one unobserved false outcome at src/codecs/webp/native/decoder.rs:329. The report contains 256/31,460 observed branches, has no source/build receipt, and has unknown test inventory; it is coordinate-only reachability evidence. The selected-test absence at line 329 is not a regression. Comparison with the saved 2026-10-16 full report is incomparable because branch details do not reconcile with its totals. No aggregate coverage gain or full-suite regression conclusion is claimed. The current fixture matrix contains 2,291 total rows: 1,797 decode / inspect / verify rows and 494 encode rows. Of those, 1,797 decode rows and 462 encode rows are active; the other 32 encode rows are planned.

WebP extended duplicate image chunk rejection — 2026-10-17

Added four malformed extended-container parity rows for duplicate VP8L, duplicate VP8, and both VP8L/VP8 mixed-chunk orders, plus a simple WebP case where Pillow tolerates a duplicate VP8 chunk. The inputs are derived from pinned fixtures and have their RIFF extents updated. Pillow 12.2.0 recognizes each malformed WebP signature, then rejects inspection, verification, still decode, and sequence decode with OSError: could not create decoder object. The simple duplicate-VP8 file remains accepted. All five public matrix rows pass their recorded operation outcomes. Full inspection and the native extended decoder reject a second image chunk while the simple WebP path keeps Pillow's tolerant behavior; VP8L headers continue to be read through a chunk-bounded reader.

The selected five-row WebP branch report is at .coverage-mcp/local-evidence/20261017/webp-extended-image-chunk-parity/coverage.json; its SHA-256 is fbc64e64fb1f0e56ec79f2687180d49128133a222695fe2ff45d993b459b8a09. Coverage MCP shows the compound inspector guard's true path and the duplicate VP8 decoder error path were reached; the simple duplicate-VP8 path is included in this selected run. The report observes 313 of 31,460 branch coordinates; false short-circuit outcomes remain among the reported inspector gaps. Source/build identity is unverified and test inventory is unknown, so this is coordinate-only reachability evidence.

A Coverage MCP incremental regional comparison used the duplicate-VP8L and alpha-flag rows as a three-row baseline and the four additional chunk cases as the new batch. It returned limited: 2,998/212,096 baseline regions, 4,993 batch regions, 3,447 newly observed coordinates, and 1,546 already covered. The projected union is 6,445/212,096 regions (+1.625 percentage points on that denominator). Both reports lack source/build identity and test inventory, so the union is exploratory coordinate evidence, not a verified suite gain. Branch and line incremental comparisons were incomparable because detailed locations did not reconcile with report totals. The baseline report is .coverage-mcp/local-evidence/20261017/webp-image-chunk-baseline/coverage.json (SHA-256 37f1f634d90a92a5e9446aa507a38318f494a7e18190ce9600eb8b68e89b3b8f); the new-batch report is .coverage-mcp/local-evidence/20261017/webp-image-chunk-incremental/coverage.json (SHA-256 f23fdb42cb9f503ea3a35cb88b4c9938a297ccff35dabda99cee1108c88a056b). No full coverage run or full-suite regression conclusion is claimed. The current fixture matrix contains 2,295 total rows: 1,801 decode / inspect / verify rows and 494 encode rows. Of those, 1,801 decode rows and 462 encode rows are active; the other 32 encode rows are planned.

AVIF 12-bit I444 auxiliary-alpha parity — 2026-10-17

Added the public high_bitdepth_still_12bit_444_alpha_9x9 decode row. The deterministic 9x9 full-range profile-2 fixture contains 12-bit I444 color and a monochrome 12-bit auxiliary alpha item. Pinned libavif 1.4.1/libaom 3.13.2 produce two all-lossless one-tile frames; Pillow 12.2.0 verifies and loads the input as one RGBA8 frame. The 484-byte input SHA-256 is f7eb5b9edfdd7b11d00094aadb91320e7cc6cc01961470e3c2040d91e68610aa; the exact 324-byte Pillow reference SHA-256 is 4a644e661e4cc9eb2ab3b4548d7f2275061b058e14a9370cffb63826f5c7a014.

The selected test_decode_matrix_avif parity run passed. A selected cargo +nightly-2026-07-16 llvm-cov report at target/release-evidence/coverage-avif-12bit-444-alpha-9x9.json was queried with Coverage MCP. Its report contains 1,829/31,302 observed branches overall; the source and build are unverified and test attribution is unknown. The report shows the new case reaches both the eight-lane converter batches and the scalar tail. Coverage MCP also reports ten unobserved branch outcomes in the separate 10-bit alpha converter and eight in the full-resolution RGB shape checks. These are observations from the selected report, not claims about the full suite. An incremental union with the saved 2026-10-16 full baseline is unavailable: its detailed observations do not reconcile with its reported totals, so Coverage MCP returns incomparable. No aggregate gain or full-suite regression conclusion is claimed.

JPEG empty DC Huffman table grayscale fast-path parity — 2026-10-17

Added the public empty_dc_huffman_table_grayscale_fast decode row. Its full 3,887-byte baseline grayscale JPEG replaces DC Huffman table 0 with a valid zero-symbol table. Pinned Pillow 12.2.0 verifies and decodes it as one 128x128 L image. The complete input SHA-256 is 7fda920713bb5982e3dc04a8f1dc695189e8b62a22f2118e72a22a5efd5f96b8; the exact 16,384-byte Pillow pixel reference SHA-256 is f1dad3cb56362cf934f41278fe27f561f388fe8284f70dda72f98035de1f4f2f.

The selected test_decode_matrix_jpeg run passed exactly this row. A second selected run under cargo +nightly-2026-07-16 llvm-cov passed the same row and produced target/release-evidence/coverage-jpeg-empty-dc-huffman-grayscale-fast-20261017.json (SHA-256 c43650e94a75e035742262fbb95f59c1322d99445ff798fa6e29c39c7b9975f3). Coverage MCP reports 258/31,396 observed branches in this selected report and shows the optimized decode_slow_fast path reaching the overlong-code and empty-table recovery branches at lines 389–391. The saved 2026-10-16 full report lists arm=true at line 390 as missing; the selected report's LLVM branch data records the empty-values arm=true as taken. Both reports have unverified source/build identity and unknown test attribution, so this is coordinate-level reachability evidence only. The old report is stale and its observations do not reconcile with its totals; no aggregate coverage gain is claimed.

Selected 10-bit I444 alpha coverage — 2026-10-17

The existing high_bitdepth_still_10bit_444_alpha_lossy_16x16 Pillow parity row also passed alone under cargo +nightly-2026-07-16 llvm-cov. Its report is target/release-evidence/coverage-avif-10bit-444-alpha-16x16.json and records 2,426/31,302 observed branches. Coverage MCP's selected_tests comparison with the selected 12-bit I444 alpha report found five branch arms newly observed at coordinates in convert_full_resolution_rgb_10bit_alpha, with five outcomes still unobserved there. The comparison is limited because both reports have unverified source/build identities and unknown test attribution; it describes report-coordinate differences, not a verified gain. The incremental union was incomparable because the baseline's detailed observations do not reconcile with its totals. No aggregate coverage claim is made.

Latest full all-feature coverage — 2026-10-16

One complete local make coverage run on source commit 7fe6010a91b4b1732bf3f1f6fac99cdc418b4340 passed all 136 executed tests: 3 unit, 57 coverage-matrix, 7 decode-policy, 1 determinism, and 68 feature-gate tests. The run used:

env RUSTC_WRAPPER= PYTHON=.oracle-venv/bin/python CARGO_BUILD_JOBS=2 make coverage COVERAGE_REPORT=target/release-evidence/coverage-main-full-20261016.json

The report is retained at .coverage-mcp/local-evidence/20261016/main-full-7fe6010a/coverage.json and was also written to target/release-evidence/coverage-main-full-20261016.json. Its SHA-256 is 8425ebb15b6b2c2e2f2022afc4bf3d813c30eda6325ab723fcab936ac39dbafd.

Metric	Covered / total	Percent
Lines	89,333 / 135,876	65.745974%
Branches	17,470 / 31,282	55.846813%
Functions	5,003 / 8,694	57.545434%
Regions	136,514 / 210,887	64.733246%

The run passes the owner-approved alpha floors of 59% lines, 46% branches, 52% functions, and 58% regions. It does not meet the separate 100% goal. Coverage MCP can read the report, but its record has unverified source identity, no registered build receipt, and unknown test attribution. Keep this local exploration report separate from the historical managed baseline; no verified regression or aggregate incremental-gain claim follows from comparing them.

Local artifact availability and exporter investigation — 2026-10-05

An owner-confirmed routine cleanup removed the local target/ directories, including the raw profiles, compiled objects and receipts cited below. Their recorded digests remain historical identities; unavailable artifacts have not been recreated or represented as surviving originals. Fresh measurements are required for further comparisons. New essential receipts are being retained outside build directories.

Before cleanup, a native exporter investigation found positive raw-profile counts for 64 API functions reported as uncovered in the last full JSON. Reordering the identical complete object set changed the exported function coverage. The pre-cleanup AVIF table below preserves the original exporter output, but these mapping losses prevent interpreting its changes as missing execution or a test regression. The diagnosis retained after cleanup is a context reconstruction, and a native repair must be validated with fresh artifacts. The repair must prefer real mappings over unused mappings, including real functions with zero executions, while retaining genuinely unused functions and every reported source. No corrected result was admitted at that investigation checkpoint; the fresh validation below has its own artifacts.

Scoped JPEG grayscale and portable progressive parity — 2026-10-05

The maintained input generator adds 11 complete JPEG decode cases and 15 grayscale encode cases. Sizes 17x9, 128x128 and 512x512 cover omitted, 4:4:4, 4:2:2 and 4:2:0 sampling options, with optimized, progressive and restart variants. Two complete inputs redefine DQT or DHT after the first scan. Pinned Pillow 12.2.0 supplies all encoded-byte and decoded-pixel references through the normal producer.

The encoder preserves explicit grayscale SOF sampling descriptors while retaining one block per scan MCU. Non-1x1 singleton baseline scans use the existing sequential reconstruction path. Unsnapshotted quantization tables borrow the unchanged frame tables; missing captured tables remain errors. An explicit Huffman snapshot flag distinguishes uncaptured tables from captured absence, preserving first-scan provenance after later definitions. Lookup Options retain absence semantics and checked error conversion; omitted encode options retain the grayscale default.

WASI exposed a preceding progressive decoder bug: non-DC-only scalar IDCT received coefficients without dequantization. The correction multiplies in the existing reorder loop on portable targets. Native ARM/x86 expressions and the already dequantized DC-only path remain unchanged. The original main attempt passed 212/227 WASI decode cases and 92/96 encode cases; both failed receipts remain preserved. An isolated preceding-source reproduction also fails the old progressive case against its exact Pillow reference.

Fresh main acceptance passes all 14 formatting, verification, strict native, coverage-hook and WASI gates. Native and WASI each pass 227/227 JPEG decode and 96/96 encode cases, with 454 public encode calls and zero panics. Existing JPEG feature contracts pass 68 native and 66 WASI tests, with zero failures or ignored tests. All 4,212 prior input/reference payloads, old ordinary row objects and 26 fault rows remain exact. Fault contracts were not requested in this normal scoped run. The main receipt SHA-256 is ab2a02836cd8ed6f280b74055be6d326e52dbb5ce784a73bf7c6646fcc84823f; independent acceptance review is c6b5c05ba60d992b58850fc0fd65fd87f36be552aeaa09767ca8bbbfd4c04aaa. Proofs are outside target/, under the recovery root recorded below.

Before the portable correction, the frozen grayscale candidate was measured with 297 prior JPEG controls and then only 26 new ordinary cases, resetting profiles between runs. Native counters record ten newly exercised branch arms: five in JPEG and five in PNG deflate reached through the complete PNG inputs. Coverage MCP's line comparison is limited; branch comparison is incomparable because aggregate and normalized detail denominators differ. No aggregate incremental union or full-suite regression is claimed. The selected receipt SHA-256 is 2b7abd4fc08c566ff3faf2eac61cd7af94cc34f1f31454706d2007281d924744. The full totals below belong to their earlier source. Paired throughput timing remains pending.

Managed full-coverage baseline — 2026-10-05 (historical)

The fresh full run on ede1d7fa passes make coverage-with-exporter and all seven existing test binaries (3/4/1/57/7/1/68), with zero failures or ignored tests. Its ordinary inventory is 2,138 rows: 1,675 active decode, 431 active encode and 32 planned encode. All active rows pass. The 26 target-only fault contracts pass separately with oracle status not_applicable. There are 1,647 public encode calls and zero encode panics.

Metric	Covered / total	Percent
Lines	89,212 / 135,769	65.708667%
Branches	17,401 / 31,246	55.690328%
Functions	4,989 / 8,685	57.443869%
Regions	136,469 / 210,864	64.718966%

All alpha floors pass. The separate strict 100% verifier exits 1 because every metric remains incomplete. This is a native all-feature test and coverage run; the preceding scoped target checks retain their own evidence. No matching x86 throughput measurement or codec speed claim is added.

Proof paths below are relative to /private/tmp/image-slash-star-evidence-recovery-a761-20261005/. The fresh JSON is maintained-exporter-canonical-main-ede1d7fa-v5/maintained-producer.json, SHA-256 48ba281a9429f6610d526e791a44319d6ab3e493bd46506bd6d900bb5a581e49. The LCOV SHA-256 is 0de32869f420a49de6b849a69442c088e6320293088027c3ae63064bfd156b79. Independent completion audit has SHA-256 f73865355296d835be2da2650c7c634d8e81e41b0dac0ef90e115e2bd0ce7eb5. Its source, tool, log and report guards bind 5,388 source and fixture files, 113 compiled artifacts, seven fresh raw profiles and one merged profile. All eight profile copies are preserved outside build directories. Empty compiler wrappers, two build jobs, offline Cargo and disabled incremental compilation are explicit. Objects and profiles remain fixed across exports. This evidence prose is updated after the measured source freeze is released.

Coverage MCP reads byte-exact copies of the native reports and returns remaining JPEG, TIFF and AVIF branch locations. Its provider source and build identities are unregistered and test status is unknown; the local audit supplies the separate execution binding. Previous full source differs, so no incremental union or verified full-suite regression comparison is claimed from those queries. The failed preceding full attempt remains recorded below, without an accepted report.

Earlier full all-feature coverage at 2,134 rows — 2026-10-05

The implementation at the recorded 2,134-row checkpoint was measured through make coverage-with-exporter, which delegates to the existing full make coverage command with the independently audited LLVM 22.1.8 v3 exporter and pinned Rust llvm-profdata. The JSON is maintained-exporter-canonical-main-0460-v3/maintained-producer.json, SHA-256 24a01a758cbdb7dbf3a1c3d0444a18352cf9a5cc001733ec8912d0435563c7c5. All fresh proof paths in this section are relative to /private/tmp/image-slash-star-evidence-recovery-a761-20261005/ and are outside the removable build-target directories. Historical cleaned artifacts remain unrecovered.

Metric	Covered / total	Percent
Lines	89,211 / 135,769	65.707930%
Branches	17,399 / 31,246	55.683928%
Functions	4,989 / 8,685	57.443869%
Regions	136,465 / 210,864	64.717069%

All alpha floors pass. The separate strict verifier exits 1 because every 100% requirement remains unmet. The full run passes all seven existing test binaries (3/4/1/57/7/1/68), with zero failures or ignored tests. That run measured an ordinary inventory of 2,134 rows: 1,671 active decode, 431 active encode and 32 planned encode. TIFF has 264 decode rows; AVIF remains at 525 and JPEG at 216. All 26 target-only fault contracts retain separate results and oracle status not_applicable. The malformed ledger contains 592 entries and the static origin registry has 141 guards across 20 files.

The preceding same-code campaign explicitly binds 5,297 source, fixture, script, configuration, benchmark and documentation files, 113 compiled artifacts and seven fresh raw profiles. An empty RUSTC_WRAPPER, two build jobs and parent CARGO_INCREMENTAL=0 are recorded. Native reports use exactly the same objects and profiles; source and artifact hashes stay fixed through all exports. The full receipt has SHA-256 943194502182041a23802e5bcddb6a4398ebb47c3753d9d3d0dc5627b195580d. This evidence prose was updated after measurement. Its source and fixture identity remains bound to that recorded inventory; later additions have separate evidence.

All eight distinct formatting/strict-Clippy gates pass, including debug, release, coverage hooks, JPEG benchmark, SSE2 and AVX2 cross-compilation. All-feature check, strict rustdoc, doctests and existing tests pass. All 33 feature lanes pass: 11 native runtime, 11 WASI runtime and 11 browser compile/strict-Clippy/rustdoc lanes. The quality receipt has SHA-256 91fb461c28aa400ea37503763afa15706d772f0819c66176fb85981d6f29d62b. The verbose matrix log supplies the lane records; its nonverbose summary list is empty. Cross-compilation supplies no matching x86 throughput measurement. This slice adds no private unit tests, unsafe code, broad lint exceptions, source exclusions or ignored cases.

TIFF ExtraSamples and grayscale-alpha parity

The maintained input-only generator covers four families (RGBX and grayscale unspecified extras, associated LA and straight LA), contiguous/separate storage, strips/tiles, and raw/Deflate/LZW/PackBits compression: 64 complete 17x9 inputs with padded tile edges and alpha boundaries. Fresh pinned Pillow 12.2.0 owns all expected outcomes: 34 successful pixel references, 28 open failures and two successful opens followed by materialization failures. The 30 valid but unsupported layouts are classified ambiguous in the malformed ledger. They are ordinary oracle cases, separately from fault contracts.

A fresh isolated public comparison observes 56/64 mismatches in the preceding implementation and zero in this candidate; eight controls match both. All 264 TIFF cases pass. Every prior ordinary row, 25 prior fault contracts, 200 TIFF input/reference records and old encoded-input/raw-reference byte remains exact. Historical managed measurements and identities are preserved. The combined preparation receipt has SHA-256 4cc13292522e82dcf0fc0f7a59f692baabd4a9ccd649db240b95b048545eda49.

Inspection and decode share the ExtraSamples layout decision and raw ignored band-count validation. Compressed ignored planes are omitted from payload decoding. Retained samples are compacted in the existing checked assembly buffer with its allocation and capacity preserved; cancellation remains bounded. Optional alpha, color-map and extra-sample metadata retain genuine absence semantics. The existing private fast-path Option categories retain their checked fallbacks. New fallible conversion/compaction helpers return Result. No timing result is claimed for these changes.

AVIF SGR source reservation contract

avif_sgr_source_reservation_failure reuses the complete ordinary animated_lossy_inter_420_superres_sgr_8bit_160x56 input and introduces the typed av1.restoration.sgr_source_reservation fault point. Under coverage it requests usize::MAX through the actual Vec<u16>::try_reserve operation; normal builds use the original sample count. The public contract checks the structured SequenceDecode dimensions error and exact message, one-shot fault reset, and two fresh successful retries with complete sequence equality. The hook is absent from normal builds. This is target-only fault evidence; the adjacent ordinary source keeps its independent Pillow comparison.

On fixed source and instrumentation, the selected control run passes 201 ordinary cases (200 prior TIFF cases plus the AVIF source) and 25 prior faults. The next run passes only the new 64 TIFF cases and one fault. Profiles are reset between runs; all actual objects and all four native denominators stay fixed. The selected receipt has SHA-256 3aea95a9a9e4749b0ec8e1782be610b0b7eeaad54212dd4146fdcbaa2bba39ae.

Coverage MCP's unmodified LCOV comparison observes 56 new line coordinates, 55 in TIFF and one at the coverage-only SGR reservation hook, for the selected union 34,518 -> 34,574 / 131,268. Its status is limited: provider source, build and test contexts remain unbound, although the independent local receipt records fixed hashes and successful executions. The response SHA-256 is a094bb469b4a603957f6977ce0af8d312507214b953bccbebe0a321560e5413f. Both native JSON incremental queries are incomparable because summary and normalized detail counts differ. Reports and counters were preserved. These selected coordinates do not establish full-suite regression status or the full campaign's coverage delta.

Native exporter provenance and reporting boundaries

The v3 native patch is pinned to Rust LLVM commit 52ed14fcd56afc30f9cccd8ca8ce237c2eef7e04; patch SHA-256 is c79225c56592e5305169c006f5f17d432e80a11f0e9463eff04b387434061b91. The preserved exporter SHA-256 is 80b04f713478755ad311865a82ed2a3c49c7441f9398cfea37c06326d684e768. No installed toolchain files are replaced.

A fresh control on the preceding 056c502b source reproduces the original unpatched coverage totals. On identical objects and profiles the native repair restores 64 real functions whose exact mangled-name/CFG-hash profile tuples have positive counts. It retains all 110 source files and 397 unused-only function entries at zero, including 333 entries in measured source files. A separately labeled genuine capability-test profile proves that two real unexecuted mappings retain their branch records at count zero. Unused payloads contain the same coordinates with structural Zero counters, so LLVM folds and omits their exported branches; real CounterRef/expression payloads retain them. The full branch denominator increases by 14 for the seven SourceColor::is_empty branch regions. This producer correction is separate from execution gains caused by new cases.

The preceding native audit receipt has SHA-256 0b48887f8613126abf4d7d9d5054af7e0ab3afad3ca5b606ac2631c5fabdbb71; its payload-wording correction has SHA-256 464f449829a1829a65b04f18c9095f6c2e35e15b24ed75ae660ee88377b21957. The original strict Cargo/native JSON identity failure is preserved: Cargo adds metadata and slightly reserializes percentage floats. Native integer counters and literal LCOV fields agree; no original report is corrected. Natural unmatched-unused mappings with a positive foreign-hash profile record were not demonstrated. That edge retains source-policy evidence only. Admission is bounded to the pinned native macOS ARM64 producer and recorded artifacts.

An independent audit of the current combined campaign passes 34 direct native JSON/LCOV exports across 17 distinct complete nine-object orders. Every source, function, region, branch, instantiation and count field is retained and order invariant. Frozen source, full and incremental objects, profiles, tools and original reports/logs remain byte exact. The current audit receipt has SHA-256 87db2f9469abc3be885755ac7a7b9c2b869355da889a58a3534211f5ac95253d. Its 34 Cargo/native percentage-only scalar differences remain separately recorded. The first audit preparation fails on an incorrect assumption that the new sorted fault row is last; the corrected exact-ID guard succeeds. That failed preparation is preserved separately.

Maintained producer setup and canonical command

The opt-in coverage-exporter-setup and coverage-with-exporter targets now maintain the exact native patch and toolchain descriptor in the repository. The original coverage/check/complete recipe bytes remain unchanged. A narrow Git whitespace attribute preserves the serialized patch's blank context markers; its reviewed patch hash remains exact. The optional launcher preserves spaces and apostrophes in report names and rejects characters the inner recipes cannot represent literally. Final controlled checks pass 90/90; an independent outer-to-inner check passes 40/40, including GNU Make 3.81's -i behavior. Ignored shell errors can mask the Python rejection's outer exit status, but no coverage/context work runs for those rejected values. Dollar and line-feed guards fail during Make expansion. Earlier failed checks remain preserved.

A genuinely fresh maintained v3 setup uses the exact prepared LLVM source, two build jobs and an isolated prefix outside target/. Configure and all 759 build steps pass, followed by actual no-op and two concurrent receipt reuses. Its executable SHA-256 is 045227d446bfb7241b8e6febd2707ce82c6aee9aedb8cb725cb4d828bcec7004; its identity receipt is 49ff1dd42ff0afbae1745cb002c9c55c3ee256357c0c7cf970e66887c8fedb42. All 34 native JSON/LCOV exports across 17 complete object orders match the previously audited producer's fields. The actual setup/export verdict has SHA-256 db4e20acd783ca834861b25742bcb6c0fc452fc0baf75a041bc32f9128bdff9d. The first-source-fetch branch remains unexercised. Native admission and the foreign-hash limitation described above retain their recorded scope.

The integrated canonical command passes make verify, all seven existing test binaries, 1,671 active decode rows, 431 active encode rows and all 26 target-only fault contracts. Its 1,647 counted public encode calls have zero panics. The 32 planned encoder rows are reported separately from the active denominator. All alpha floors pass; the separate strict verifier exits 1. The integer totals above reproduce the preceding audited full campaign exactly.

The measurement runner's bookkeeping assertion incorrectly included planned skips in that active denominator and failed after the real commands exited 0. Its original failed receipt remains unchanged, SHA-256 01a969d5e64f4f0a54693aa95fe6e6f6fb68600718adc0346d901fb23e30a8d3. An independent completion supplement checks the actual runner source and literal results, then performs only a normal LCOV report export and strict verification. It reruns no tests and rewrites no counters or original receipt. Its SHA-256 is 54c7affcf9587c894a3580fd3bf4d38875a6bf572846e9f25b323a556f5977f0. The LCOV SHA-256 is 363c6078af91b6907c56a1843fa5f1c6eba4f215540bfdfc420a61830d1426ef.

The canonical run freezes 5,301 source/configuration files, 113 compiled artifacts plus the root executable used by the nine-object export, seven raw profiles and one merged profile. Its completion audit archives and checks these artifacts, original reports/logs, producer identities and all 110 measured sources before and after report-only work. The export's raw-profile argument list is captured after the export, explicitly as a later capture. Human evidence and command-reference prose are updated after measurement; codec, test, fixture and producer recipe contents remain unchanged. No provider receipt is invented, and this reporting repair is separate from a new-case coverage gain.

TIFF ignored-sample row boundary parity — 2026-10-05

Three complete raw RGB TIFFs retain an unspecified fourth sample in rows of 255, 256 and 257 pixels. Their stored row sizes are 1,020, 1,024 and 1,028 bytes. The normal input-only generator and pinned Pillow 12.2.0 reference producer preserve all previous 64 generator outputs, 2,134 ordinary rows and 26 separately typed fault contracts. Exact RGB observations contain 765, 768 and 771 bytes. The codec implementation is unchanged. The existing public cache check uses four cloned handles sequentially on the maintained WASI runner, which lacks thread spawning; native checks retain four worker threads and the same complete image, pointer-identity and cache-state assertions.

The fixed-source incremental run, preceding that harness portability update, selects all 264 previous public TIFF rows, then only the three new rows. Both selections pass without failures or ignored tests, with zero fault contracts selected or executed. Both native reports retain identical denominators: 135,754 lines, 31,228 branches, 8,682 functions and 210,844 regions. The previously missing true arm of compact_extra_samples at tiff/decode.rs:1517 changes from 0 to 1 in the native file and function records; the new row crosses the 1,024-byte token checkpoint within a row. This is no cancellation-response or throughput claim.

Fresh evidence resides in tiff-extra-sample-boundary-cases-8abb-20261005/ below the recovery directory named above. The original incremental receipt has SHA-256 271b2e8da2b981fa6456594e77b9089326ff4be2a5af933b42a9467e7701bb92; independent completion has SHA-256 1110d55f680fe9d0b182f7213a7f33b94c126a86ad0dba9cd338d14f825f576d. Preserved raw profiles re-merge byte-identically. Direct native exports match all counters, coordinates, names and shapes; distinct outputs retain only explicitly reported percentage display differences within two ULPs and one terminal LF in LCOV. Earlier strict reviewer attempts remain preserved.

Coverage MCP returns the missing branch for the controls and none at that location for the new-only report. Its LCOV line union records zero new lines. Its branch union is incomparable because reported totals and detail differ; provider source/build receipts remain unregistered. No report fields were rewritten. These selected results do not replace the last full all-feature measurement above or establish a full-suite regression check. The inventory at this checkpoint is 2,137 ordinary rows, including 267 TIFF decode rows; the 26 fault contracts remain outside Pillow parity totals.

After the harness update, all ten scoped commands pass: formatting, fixture verification, generator byte checks, strict native and WASI all-target/ all-feature Clippy, coverage-configured strict Clippy, native TIFF decode and encode, the normal WASI matrix build, and its three selected ordinary rows. Native parity passes 267/267 decode and 59/59 encode, with 205 public encode calls and zero panics. WASI passes 3/3 selected rows. No test is ignored. The completion receipt is main-scoped-acceptance-portable-v3-completion/completion.json, SHA-256 7ff0067677967b6f9f1141336412b050f411d3d183c03eeca62f50bfa88c4a55. Its final guards bind 5,374 source and fixture files and the rebuilt native and WASI binaries. The original failed bookkeeping receipt is preserved: it incorrectly expected a coverage-only fault summary from a normal binary, whose fault dispatcher is empty. No fault selector was requested or counted as Pillow parity. Four earlier WASI malformed-range classifications remain outside this selected scope; this is no full WASI or 33-lane campaign claim.

TIFF payload-range classification on 32-bit WASI — 2026-10-05

Four checked strip/tile offset additions now classify an unrepresentable payload range as malformed, using the adjacent out-of-bounds payload message. This matches the existing complete Pillow error fixtures for planar_separate_rgb_tiled_oob_tile, planar_separate_rgb_oob_strip, tiled_palette4_oob_tile and error_bad_ifd_oob_strip. Geometry errors and checked arithmetic remain unchanged. The correction has no dependency on the separate large-row diagnostic, which has not executed. Native 64-bit behavior remains unchanged; a representable incremental retry minimum on 64-bit can still differ from a terminal unrepresentable range on 32-bit.

All fourteen scoped commands pass on the candidate following f04ba130. Native and WASI each pass the full TIFF public matrix: 267/267 decode and 59/59 encode, with 205 public encode calls and zero panics per target. The existing TIFF-only feature tests pass 67 native and 65 WASI tests, with zero failures or ignored tests. Formatting, fixture verification, native and WASI all-target/all-feature strict Clippy, coverage-configured strict Clippy, and WASI TIFF-only strict Clippy also pass. All prior fixture bytes and observations are unchanged; no fault selector is requested or counted.

The receipt is tiff-range-only-f04ba130-scoped-acceptance-v1/receipt.json below the recovery directory above, SHA-256 392f5ba40a496f99b47fe00caefcc8488f49e7726fcde11fc772649024eade5d. Final guards bind 5,374 source files, tools, rebuilt test binaries and the two unrelated untracked files. This resolves the four classification failures left outside the preceding three-row WASI selection. It is no complete 33-lane campaign or fresh full coverage result.

Animated AVIF primary-item rotation parity — 2026-10-05

animated_primary_item_irot adds one essential primary-item rotation property to the existing complete five-frame AVIF. The input-only generator grows the file from 1,235 to 1,245 bytes, rebases its item and track offsets, and retains every coded sample byte. Pinned Pillow 12.2.0 observes the same five 150x150 RGB frames and 33-ms durations. Two fresh observations through the maintained native observer record repetition count zero. That observer uses the exact surviving ABI header and pinned Pillow shared library; no full clean native source checkout is claimed.

The isolated ordinary public comparison passes 1/1. Its fixed-source incremental run passes one existing animated control, resets raw profiles, then passes only the new row. No fault contract is selected or executed. All 63 compiled objects and all four native denominators remain identical: 135,754 lines, 31,228 branches, 8,682 functions and 210,844 regions. The true arm at avif/decode.rs:349 changes from 0 to 1 in file and function records; literal LCOV records agree. Coverage MCP returns the missing true arm for the control and the missing false arm for the new-only run. Its incremental union is incomparable because normalized detail and aggregate inventories differ. Reports retain all fields; no MCP union or full-suite gain is claimed.

The candidate preserves all 2,137 previous ordinary observations, 26 separate fault objects, old input/raw bytes and loop facts. Appending the fresh native loop observation changes the whole-index digest, so 132 old-row index-SHA fields are explicitly refreshed; those row objects are not byte-identical. The final handoff is animated-avif-primary-irot-f04ba130-20261005/final-handoff-v1.json, SHA-256 2509e87af0b47c2ade917d0edff80bcd473039598120e410a1e56310c57c6973, under the recovery directory above. The original selected-run bookkeeping failure is preserved and qualified by its actual command exit zero and literal 1/1 result. This update changes no Rust codec or test harness. The current inventory contains 2,138 ordinary rows, including 526 AVIF decode rows; fault contracts remain outside Pillow parity totals.

Normal main acceptance passes formatting, the pinned input-generator check, 526/526 native AVIF rows and the one selected WASI row, with zero failures or ignored tests. Existing executables are reused for actual current inputs; there is no recompile claim. The outcome receipt is animated-avif-primary-irot-f04ba130-20261005/main-normal-public-outcomes-v1.json, SHA-256 70594fd65d6370650667f3a7eea64fd85ce62240e81e91ce77bee2b9b5697e28. The initial fixture verification fails on two stale current roadmap AVIF counts; its original receipt and log remain preserved. Those derived fields are corrected to 526, with historical coverage records unchanged, and verification is rerun separately. The administrative correction changes no codec, test, fixture or generator byte measured by those runtime comparisons.

Full-campaign AVIF witness registration correction

The fresh full attempt on 7edbc034 passes all 1,675 ordinary decode rows, 431 active encode rows and 26 separate fault contracts, with 1,647 public encode calls and zero encode panics. It fails the existing complete native repetition witness test on its stale 285-artifact assertion: the current index contains 291 artifacts. This failed attempt produces no accepted coverage report. Its seven raw profiles, original receipt and log remain preserved in maintained-exporter-canonical-main-7edbc034-v4/; the failure audit has SHA-256 0ed60c841df220fd55a7736cfcfc58ec6e60674d63d484e8f8388b9fea69ed00.

The public witness harness now requires exactly 291 artifacts, appends the new case to its exact name list and resolves its source through the existing matrix sequence observer. All previous 91 case objects and 285 artifact bytes remain unchanged. Complete-input hashes, native repetition facts, every frame's pixels and timing, and public error checks remain enforced. The focused existing test passes 1/1 with zero failures or ignored tests, covering all 92 complete cases. Fresh pinned Pillow observes the new five frames and two native observations match the retained index. Formatting, strict all-feature public-test Clippy and fixture verification also pass.

The terminal review is animated-avif-primary-irot-f04ba130-20261005/witness-registration-fix-7edbc034-v1/completion-review.json, SHA-256 9a57980be1c9ee0445fda3e13ca7258f011f3e3ecdc52e402f7b5da5554aae73. Its guards bind 5,388 source and fixture files, tools, logs, the actually recompiled normal test binary and the two unrelated untracked files. Only the three harness registrations change. This focused correction does not replace the last full coverage measurement above.

Pre-cleanup AVIF full coverage — 2026-10-05

The last recorded full local report was target/release-evidence/coverage-avif-derived-skip-refs-v2-20261005.json, SHA-256 32b12a55dddb5a2488f8c09bfb67a02feb42dab40fa0ac21697c0b151983e0e3. make coverage uses nightly-2026-07-16, an empty RUSTC_WRAPPER, two build jobs, CARGO_INCREMENTAL=0 and a fresh target/llvm-cov-avif-derived-skip-refs-v2-full-20261005 target.

Metric	Covered / total	Percent
Lines	88,832 / 135,656	65.483281%
Branches	17,359 / 31,196	55.644954%
Functions	4,921 / 8,682	56.680488%
Regions	135,986 / 210,661	64.552053%

All alpha floors pass. The separate strict verifier exits 1: all four 100% requirements remain unmet. All seven test binaries pass 3, 4, 1, 57, 7, 1 and 68 tests, with zero failures or ignored tests. The measured AVIF checkpoint ordinary inventory contains 2,070 rows: 1,607 active decode, 431 active encode and 32 planned encode. AVIF has 525 decode rows, JPEG 216 and TIFF 200. All 25 target-only fault contracts retain oracle status not_applicable and separate results. The malformed-input ledger remains at 562 entries.

The incremental and full campaigns preserve all 5,190 measured source/configuration/script/fixture hashes: 5,189 repository files and one ignored ambient Finder file. The repository-local count includes the ignored .cargo/config.toml; 5,188 measured files are tracked in Git. The local configuration sets CARGO_INCREMENTAL=0 for child commands and selects a compiler wrapper. The campaign explicitly sets the parent Cargo environment to CARGO_INCREMENTAL=0 and overrides the wrapper with an empty RUSTC_WRAPPER. Both ignored files retain separately verified hashes. The full campaign has its own 113 instrumented artifacts and seven fresh profiles, unchanged across JSON and LCOV exports. The selected campaign's 63 artifacts and final profiles remain unchanged. Different test scopes use separately bound objects; no cross-scope object identity is claimed. The original full source receipt retains precommit base revision 61f4dfdc145f2a35526588667368d5873df07280 and SHA-256 dc6f39d09a0a1424857fd8c72ebb435bd084f6870cd47a752d8cdbf9549cf582. Human evidence documentation is outside that measured inventory.

All eight formatting/strict-Clippy gates pass, including coverage-nightly, JPEG benchmark and SSE2/AVX2 cross-compilation. Their v2 receipt has SHA-256 7ecdc21d94aa08a4c3f9ba76c947fdc2c3eed1e1607d9fbf2823c94aeafb892e. All 33 feature lanes pass: 11 native runtime, 11 WASI runtime and 11 browser compile/strict-Clippy/rustdoc lanes. The v2 feature receipt has SHA-256 5b5451ff599288230aeaae13b032bde06b0f5d7d6fea48065417d98d695da871. These cross-target checks provide compilation evidence, without matching x86 runtime or throughput measurements for this change. The origin registry retains 140 guards across 20 files. This change adds no private unit tests, unsafe code, lint exceptions, coverage exclusions or ignored cases.

Complete AVIF disabled-skip reference parity — 2026-10-05

Three complete ordinary lossless animations exercise I420, I422 and I444 sampling with five 64×64 frames and fixed 32×32 blocks. At the observed inter context, the header retains a derived skip-reference pair while skip mode is disabled. The reconstruction gate now permits that unused pair, retaining the existing exclusion of enabled skip mode and all reference, quantizer, geometry and safety checks. The change removes one context predicate and adds no pixel allocation, raster copy or block-loop operation. It has no measured speed claim. Execution evidence covers bounded reconstruction for these three complete inputs.

Ordinary input	Bytes	Complete input SHA-256
animated_lossless_inter_420_derived_skip_refs_b32x32_64x64	6,130	50d8bdd33c5a5e958d5991d25767748088ba3354d35d4b809d52e84a45713c15
animated_lossless_inter_i422_derived_skip_refs_b32x32_64x64	7,530	0eae260be09a74b98b1f525261a237ef3783105870de44224de91dd65ee5d168
animated_lossless_inter_i444_derived_skip_refs_b32x32_64x64	10,135	3769c145bb4d97f357a8b3c4660fb8a2f976c682643304e64833d06515901009

The maintained scripts/generate_avif_derived_skip_reference_fixtures.py runs through the normal AVIF asset hook. Recipes retain stimulus and complete input hashes; fresh pinned Pillow 12.2.0 owns expected pixel and lifecycle observations. Two separate output-directory generations and --check reproduce all three input files. The generator receipt has SHA-256 a618607002514ab86a69a686d24ecb6030c5c952678296526341600f9fb8d305. The normal native loop producer independently observes all five displayed frames, exact pixels, 100 ms timing and loop zero. Its index grows from 88 to 91 cases and 267 to 285 artifacts. All previous cases and artifact bytes remain exact. The new index SHA-256 is 38e8bf690190b189c26fb93876ef7c7b47b67ca57fa4c99c49b819b0ef58f13d.

Canonical regeneration preserves all 522 prior AVIF ordinary outcomes and every other format/encode block. Only the native index digest changes in the 63 existing AVIF sequence provenance fields in each of the matrix and output JSON. All 25 fault contracts and historical managed-ledger measurements, run identities and measured-input hashes remain exact. An isolated public probe also matches seven complete ordinary inputs, 29 sequence frames and seven first images against fresh Pillow observations; its receipt has SHA-256 9774993f56582350a1c7ce44e02295a14087d47f97d9cf069477223d1ee56a23. Independent source review finds no required repairs and binds the retained skip-mode exclusion, all 18 new first-image/sequence references, old outcomes and native artifacts. Its receipt has SHA-256 c8e17b450b2ba14ec348b861c1ac9ad5461babb3605475f18102637e437ee504.

The first full attempt fails on the existing native observer's stale 267-artifact assertion. The repair updates that observer to 285 artifacts, appends the three case registrations, shifts five origin line coordinates by one and refreshes the ledger's current origin digest. A subsequent manual formatting attempt also fails rustfmt; its unsuccessful evidence is kept. The authoritative cargo fmt output is used by every successful v2 campaign. The original incremental/feature successes, failed full attempt and formatting failures remain separate from the passing v2 receipts.

Incremental measurements and coverage limits

On the fixed v2 source, the baseline executes 522 prior ordinary AVIF rows and 24 applicable AVIF fault contracts, reported separately. Three subsequent runs execute one new ordinary input each through the existing matrix runner. All four runs pass, resetting raw profiles between runs and preserving all 63 actual instrumented objects. The incremental receipt has SHA-256 301313e5e2c007b55b3fdb88420d94e4abafd83e19a40649a73c3f8f3efc1609. The read-only producer audit binds original report hashes, 110 measured source files, all 5,190 frozen files, actual objects and passing selected-row logs. Its SHA-256 is d67650d5986a300b9038b0a18c77b0129a8bec462009fc5c37fd65e444b00104.

Coverage MCP verifies the LCOV line-coordinate union 43,973 → 44,032 / 131,155, with marginal gains of 58, one and zero. The 58 coordinates are in existing code: 40 forwarding-wrapper lines in block.rs and 18 compound-reconstruction lines in entropy.rs. The I422-only gain is a short-circuit right-hand evaluation in bounded_reference_mode_supported; it does not show enabled skip mode. The zero-gain I444 case retains independent parity value. Native LF/LH totals and the full report's aggregate metrics retain their separate denominators. JSON region and branch comparisons are incomparable: region summary/detail covered counts disagree, and native branch detail loses four identities. No JSON producer context, replacement counters or synthetic identities are introduced. The verbatim query receipt has SHA-256 0dee6bf2dc3a8842f191176cc4ddfed258f9018aae122e132168b9ba47263f53.

All four native full covered counts are lower than the preceding TIFF report. Source, fixture inventory and build identity differ, so these reports do not provide an exact full-suite regression comparison. The 59 selected line gains are not a claim that 59 preceding full-suite gaps disappeared. The current full report retains 46,824 missing lines, 13,837 missing branch outcomes, 3,761 missing functions and 74,675 missing regions. Proofs are under target/release-evidence/avif-derived-skip-v2-61f4dfdc-20261005/, with original reports and receipts beside it; canonical producer evidence is under target/release-evidence/avif-derived-skip-canonical-61f4dfdc-20261005/.

Preceding TIFF associated-alpha full campaign — 2026-10-05

The preceding TIFF full local report is target/release-evidence/coverage-tiff-associated-alpha-20261005.json, SHA-256 97b19bdff5d96774f0b4499a7177bbc25d0746eb51477cda829f201d44056e87. make coverage uses nightly-2026-07-16, an empty RUSTC_WRAPPER, two build jobs and the dedicated target/llvm-cov-tiff-associated-alpha-20261005 target.

Metric	Covered / total	Percent
Lines	89,044 / 135,657	65.639075%
Branches	17,363 / 31,216	55.622117%
Functions	4,984 / 8,682	57.406128%
Regions	136,223 / 210,663	64.663942%

All alpha floors pass. The separate 100% verifier exits 1; all four completion requirements remain unmet. All seven test binaries pass 3, 4, 1, 57, 7, 1 and 68 tests, with zero failures or ignored tests. The ordinary inventory has 2,067 rows: 1,604 active decode, 431 active encode and 32 planned encode. TIFF has 200 decode rows, JPEG 216 and AVIF 522. The 25 target-only fault contracts remain separately reported with oracle status not_applicable.

All 5,094 source/configuration/script/fixture hashes remain exact across the fixed-source incremental and full campaigns: 5,093 repository files and one ignored ambient Finder file. The original full source receipt preserves its precommit base revision 3489d205f3acd4698d4c336eadfd1e756e40ff7a; receipt SHA-256 is 009eff76925febd98014667645a7fae0233f87eaa02020fde320d48d56999d32. Human evidence documentation is outside that inventory. Native full aggregate totals and selected-report coordinate totals remain distinct.

All eight formatting/strict-Clippy gates pass, including coverage-nightly, JPEG benchmark and SSE2/AVX2 cross-compilation. All 33 feature lanes pass with all 5,004 captured file hashes unchanged: 11 native runtime, 11 WASI runtime and 11 browser-target compile/Clippy/rustdoc lanes. The feature receipt has SHA-256 b8773060f79d62247a44b732187028308116bbee26c47677a238778d41c910ba. The origin inventory remains 140 guards across 20 files. Private unit tests, unsafe code, coverage exclusions and ignored cases are absent from this change.

Complete TIFF associated-alpha parity — 2026-10-05

Twenty-two complete ordinary inputs cover contiguous/separate sample planes, multiple strips, clipped edge tiles, raw/Deflate/LZW/PackBits compression and per-plane horizontal prediction. The maintained scripts/generate_tiff_associated_alpha_fixtures.py is called by the normal TIFF asset hook. It includes nonzero hidden RGB at alpha zero, stored colors above alpha, alpha 1/2/17/254, opaque samples and payloads crossing cancellation checkpoints. Two output-directory generations and --check reproduce every input byte. All 180 previously tracked TIFF inputs and 178 prior decode rows, 59 encode rows, encoded reference JSON, other-format rows and 25 faults remain exact. Inputs contain storage samples and selectors; the live oracle owns all normalized expected pixels and failures. The final 22-input regeneration receipt has SHA-256 183af3b4daf63b2158bd59f8ea44dce8bc526c94a8b388c0ae5e39267adb6407.

Pinned Pillow 12.2.0 independently establishes inspection/verification success for all 22 inputs, 18 exact pixel successes and four materialization failures. The raw separate importer accepts three declared RGB planes with the alpha plane omitted, retaining colors with zero alpha. Declaring the first alpha block instead fails with ValueError: unknown raw mode for given image mode. These boundary inputs retain every payload and byte-count byte; only the offset count changes. They are ordinary parity cases. Their malformed-ledger specification status is ambiguous, because the complete TIFF storage is valid and the reference's raw band importer lacks that decoder. The ledger preserves 558 prior classes and adds four, for 562.

Associated RGBA normalization now runs in place: transparent pixels clear, opaque pixels retain their channels, and intermediate alpha uses truncated channel * 255 / alpha, clipped to 255. The source descriptor still records SourceAlpha::Premultiplied. Raw separate planes without an alpha block retain their reference-defined transfer samples. A shared pixel helper and 1,024-byte cancellation chunks add no pixel allocation or raster copy. One local Clippy expectation documents the exact arithmetic invariant: byte multiplication is at most 65,025 and the division arm's alpha is 1..=254. It excludes no source from coverage. This correction has no throughput claim.

The preserved old binary mismatches all 18 initial inputs: 16 wrong normalized rasters and two incorrectly successful raw planar decodes. Two further first alpha-block inputs also expose the error; two omitted-plane controls already match and preserve that leniency. The fresh public probe matches all 22 final cases, with all inspection/verification boundaries retained. The canonical matrix supplies wrapper, cancellation, metadata, sequence and structured-error checks. The focused green receipt has SHA-256 cdaa78609447990e5f58d2a92592c96257668cdcdd6adb3b3cd35360ee510e7b. The primary behavior is Pillow's Unpack.c RGBa unpacker and TiffDecode.c separate-plane completion, pinned to tag 12.2.0 and preserved in ignored proof. The tag resolves to commit 3c41c095064200a02672d89cc5ff629eaf4b0d4f; the saved commit-addressed source text is provenance and was neither compiled nor executed.

Incremental measurements and producer receipts

Changed source is measured afresh: 178 prior ordinary TIFF rows, then batches of eight contiguous, eight compressed separate and six raw boundary rows. Every run passes with all 387 instrumented artifact hashes fixed. Raw profiles are reset independently and fresh nonempty profiles are required. Initial Cargo execution including compilation takes 124.120 seconds; later batches take 0.843–1.003 seconds under concurrent checks. These are workflow timings.

Audited optional producer sidecars bind original report hashes, all 110 measured source files, the frozen build identity and passing canonical row logs. Coverage MCP verifies region union 6,116 → 6,153 / 210,643: gains are 28, one and eight. The separately audited LCOV line union is verified 3,967 → 3,999 / 131,156. These selected denominators differ from full aggregate totals and do not establish a full-suite regression comparison. JSON line and branch unions return incomparable; branch detail contains 31,210 coordinate arms against 31,216 native arms. Those responses are kept without replacing native totals or inventing missing branch identities.

The full run still has 46,613 missing lines, 13,853 missing branch outcomes, 3,698 missing functions and 74,440 missing regions. In particular, selected gains include newly implemented conversion behavior and are not a claim that 37 historical full-suite gaps disappeared. Historical managed ledger metrics, run/snapshot IDs and measured-input hashes remain unchanged. Evidence is under target/release-evidence/tiff-planar-alpha-3489d205-20261005/, with reports and feature receipts beside it. Wider ExtraSamples-zero and LA layout differences from the exploratory 128-input family remain unimplemented ordinary gaps.

Preceding JPEG scan-declaration full campaign — 2026-10-05

The preceding JPEG full local report is target/release-evidence/coverage-jpeg-sos-20261005.json, generated by make coverage with nightly-2026-07-16, an empty RUSTC_WRAPPER, two Cargo build jobs and the dedicated target/llvm-cov-jpeg-sos-20261005 target. Its SHA-256 is 5b6ca500bae7c9d3d2add1b9145c7ccf15afbc7879056e43853388a7cff67b0d.

Metric	Covered / total	Percent
Lines	88,995 / 135,609	65.626175%
Branches	17,343 / 31,196	55.593666%
Functions	4,983 / 8,681	57.401221%
Regions	136,168 / 210,608	64.654714%

All alpha floors pass. The separate strict verifier exits 1 because all four 100% requirements remain unmet. All seven test binaries pass 3, 4, 1, 57, 7, 1 and 68 tests, with no failures or ignored tests. Its report-era ordinary inventory contains 2,045 rows: 1,582 active decode, 431 active encode and 32 planned encode rows. JPEG has 216 ordinary decode rows and AVIF retains 522. All 25 target-only fault contracts remain separately counted, with their reference status not_applicable.

All 5,053 recorded source/configuration/script/fixture hashes are unchanged between the fresh incremental and full campaigns. This inventory contains 5,052 repository files and one ignored ambient tests/fixtures/.DS_Store. The original source receipt retains precommit base revision 455d66aa3a8aa7e2bf6ac1da8c75198c8d96f316; its SHA-256 is fa9e7c99f5d287bd28509077d2c6bd57608c0657e2f98b343b580aeeb5492977. Human evidence documentation is outside that measured inventory.

All eight formatting/strict-Clippy gates pass, including debug, release, coverage-nightly, JPEG benchmark and SSE2/AVX2 cross-target checks. All 33 feature lanes pass with 4,959 recorded file hashes and capability artifacts unchanged. Native/WASI lanes execute tests; browser WASM lanes compile and run strict Clippy/rustdoc. Cross-target SIMD checks establish compilation and lint evidence, without x86 throughput measurements for this change. The origin registry retains 140 guards across 20 files. No private unit tests, unsafe code, source exclusions, ignored cases or lint exceptions are added.

Coverage MCP reads the full report with source unverified and tests unknown. It groups 74,440 missing regions into 6,647 missing-region groups, with AV1 inter-translation instantiations still the largest displayed groups. Missing counts also include 46,614 lines, 13,853 branch outcomes and 3,698 functions. Local command/hash receipts do not create a managed MCP source/build binding or named-test attribution. Historical managed ledger metrics and identities remain unchanged; current integrity hashes and inventory counts are separate.

Complete JPEG scan-length and component-count parity — 2026-10-05

Eleven complete public inputs preserve the source entropy, scan order and final EOI bytes, changing only the selected SOS length and, where declared, component count. The maintained generate_jpeg_sos_edge_fixtures.py uses the normal JPEG asset hook, pinned source/output hashes, bounded shared marker walking and fresh pinned Pillow lifecycle calls. Two separate output-directory runs and --check reproduce all eleven bytes exactly; all 216 prior JPEG input files remain unchanged. Inputs contain no Rust outcomes.

Ordinary case	Bytes	Complete input SHA-256
error_sos_length_0	4,564	729419da5fe9727a0f6d751a6865c55e44bcd95094bf153c06cc7e382ce2e4d0
error_sos_length_1	4,564	a744fc417d07b52a16f2dd1f3ac0f7e784803c64b88423c2342f07c1d1ff7223
error_sos_length_2	4,564	066f03bcef810cb346ff6f55ffdb1cbab465b375d1832e894a542d2706062929
error_sos_length_11	4,564	5f235865d0e748c1f67a12d63ac883a43c73eea66cd255ae44f7e47a1534e960
error_sos_length_13	4,564	121633f20c3b9b7e4fc33e80ea817fbf6d7e4cab6a6eab2d4ab791cad029ed3d
error_sos_length_65535	4,564	63c54401762bd11614feb80554c736d1d8c80ba8be003c9d570224deefd47edb
error_sos_zero_components_length_6	4,564	538b1e21c0c658ef42b5d053ff6c379c0f7ea9a5f40ee2f53140ae3a4f8754fa
error_sos_five_components_length_16	4,564	e192d29496bf30ab3f4ea34e2f8dc5fb3608ad66942475153695dc10b5d2c393
error_sos_255_components_length_516	4,564	fffe6aba1f8e5ed5d232db2bc6eded2ddaaf20c4b4b13c11d1577cf6dbd3e4b8
error_progressive_second_sos_length_7	3,939	eb1f33e9234cb7b8ab4ebabfb199c3eb255107a67b3e9ce468eaf81b07c0298e
error_baseline_multiscan_second_sos_length_7	649	d5dd86cf6d57ea40449b16e137de0a9403512c831f5d4bcee6c995ea8ee6c232

Pinned Pillow 12.2.0 with bundled libjpeg-turbo 3.1.4.1 detects every input as JPEG. Ten inputs open, inspect and verify with the unchanged source metadata, then both pixel workflows fail with builtins.OSError and broken data stream when reading image file. The UINT16_MAX declaration instead fails at open with Truncated File Read. Three complete valid source controls and additional valid one-/four-component controls retain exact Pillow pixels.

The old target incorrectly materialized all six length mutations and both later-scan mutations. Lengths 0/1 also incorrectly failed inspection and source opening for verification. The three count mutations already failed as malformed input; they now validate the reference's scan-shape boundary before component reads. They are regression cases, not additional claimed old mismatches.

Inspection now stops at SOS lengths 0/1 after the bounded length read, matching Pillow's open behavior. Normal payload bounds, truncated length fields and other markers retain their existing handling. Pixel parsing reads the length and count, preserves the existing zero-component error, then requires at most four components and exactly 2 * count + 6 bytes before allocation or table reads. The saturated u16 arithmetic is exact for every byte-sized count (maximum 516); strict Clippy passes without a new allowance. The check runs once per scan and adds no pixel-loop work or copies. This is a compatibility and validation fix, without a measured throughput claim.

The exact primary source is tag 3.1.4.1, commit 9217719d3a58633923b096af4c1d50d304768a64. Stored tag and commit-addressed jdmarker.c bytes both have SHA-256 1dd922aff8f92ece4f8f2b11eea08cd49b2e232de797ee98db9e331f6d0e3296; its get_sos reads length and count before validating the shape. Independent review reproduced the complete inputs and verified all entropy/tails without calling the repository generator or either codec.

The preserved red probe matches the root dependency lock, including wide 1.7.0. The fresh green probe matches all eleven ordinary outcomes, preserves exact Debug/display diagnostics, stages, offsets and identities of all seventeen prior SOS rows, and preserves complete metadata/pixels for five normal controls. Static JPEG sequence failures retain their existing StillDecode stage. Initial observer field/lock/tooling failures and the first green observer's executable-mode failure remain unsuccessful separate evidence; no result from them becomes a passing receipt. The final green receipt is public-green-receipt-v2.json, SHA-256 13a8f62b4ed4346a1178bcbbdd8d16a343e7347f2adf3c6198dbb214469d2d79. Canonical Pillow regeneration preserves all 205 old JPEG decode rows, 81 encode rows, encoded/raw bytes, every other format row and all 25 fault rows. The malformed ledger preserves 547 prior classes and adds eleven, for 558 total.

Incremental execution and Coverage MCP limits

Changed source requires a fresh baseline. Twelve selections use the same finished source and identical hashes for all 387 compiled artifacts: the previous 205 ordinary JPEG rows plus its one existing target-only allocation fault, followed by the eleven ordinary cases individually. Every selection passes. The fault remains oracle_status: not_applicable; no new injected failure is needed for input-reachable scan validation.

Each selection resets only raw profiles, uses --no-clean, and requires fresh nonempty profiles before reporting. The first selection takes 95.456 seconds including the build; subsequent Cargo executions take 0.789–0.828 seconds. These are workflow timings with concurrent checks, not codec throughput.

Coverage MCP and the independent LCOV union agree on 5,630 to 5,634 covered line coordinates out of 131,108. The first length-zero case adds four; the other ten retain distinct boundary/later-scan regression value with zero additional line-coordinate gain. This selected coordinate denominator differs from the full aggregate line denominator above. No earlier-source report or selected-test absence is used to claim a regression.

Both LCOV and LLVM JSON branch-union requests return incomparable because normalized baseline detail does not match reported branch totals. Those responses are preserved; no aggregate branch union is claimed. Bounded raw parser/header observations and the full four-metric report remain separate from this provider limit. The original line query was limited, with source unverified and tests unknown. A subsequent read-only audit adapted the immutable producer receipts into optional sidecars before the TIFF source change. Coverage MCP then verified 9,155 → 9,157 / 210,588 regions for all eleven JPEG cases, with no report or source mutation. Branch union remained incomparable: 31,190 coordinate arms versus 31,196 native arms. This historical fixed-source result and its producer audit are preserved in the JPEG bundle; it is not a comparison against the later TIFF source.

The ignored evidence bundle is target/release-evidence/jpeg-sos-455d66aa-20261005/, with the original failed attempts, pinned primary source/inputs, generator and independent reviews, red/green outcomes, preservation/accounting receipts and strict checks. Incremental/full LLVM reports, source receipts, MCP responses and the 33-lane feature receipts are beside it in target/release-evidence/.

Rejected JPEG packed quantizer correction deletion (2026-10-05)

A separate worktree at 78fc8c8c24126b6c095f3746569dba0bfaf94921 tested removing the ceiling-reciprocal correction from the private packed four-block JPEG quantizer. An independent review checked all 13 byte-origin callers, the clamped quantization tables, pinned wide 1.7.0 arithmetic, and the reciprocal bound. The arbitrary-i32 quantizer retained its correction. The candidate passed strict Clippy and formatting, 81/81 public JPEG encode rows (379 calls, zero panics), 205/205 decode rows, and all 20 complete-byte baseline/candidate output comparisons before each timing campaign.

The fixed paired-five-rounds and paired-five-rounds-reversed campaigns (local sessions 53108 and 36102, both exit 0) each completed 40 whole-public-call workloads across 20 configurations and five rounds, with opposite starting order and the unchanged TurboJPEG 3.2.0 oracle following each Rust variant. Each campaign saved 800 raw records. Source, binary, and oracle-library hashes were unchanged. The Apple M3 Pro ARM64 host used macOS 15.7.7 and Rust 1.96.1 with LLVM 22.1.2; the Rust builds used ordinary release settings and the C harness used -O3 with TurboJPEG SIMD enabled.

Ratios below are candidate/baseline median paired times, first/reversed campaign. Values above 1 mean slower complete calls.

Encode workload	Raw ratio	Oracle-normalized ratio
RGB 128x128 Q10 4:2:0	1.0727 / 1.0729	1.0727 / 1.0725
RGB 512x512 Q10 4:2:0	1.0685 / 1.0825	1.0729 / 1.0886
RGB 1024x1024 Q85 4:2:0	1.0290 / 1.0433	1.0323 / 1.0411
RGB 128x128 Q85 4:2:2	1.0572 / 1.0597	1.0552 / 1.0324
Grayscale 128x128 Q85	1.0504 / 1.0628	1.0550 / 1.0586
Grayscale 512x512 Q85	1.0628 / 1.0749	1.0610 / 1.0728

Of the 17 configurations admitted to the changed encoder path, 15 had slower raw medians in both campaigns and 14 had slower normalized medians in both. None improved both raw and normalized medians in both campaigns. CMYK128's small raw improvement reversed after normalization; RGB512 Q85 changed direction between campaigns. Three unaffected encode configurations and all 20 decode workloads remain separately reported controls, not a combined score.

No repository Cargo, test or profiling jobs overlapped the timing window. The first-start process snapshot showed unrelated Python jobs and macOS media analysis consuming CPU. Those heavy jobs were absent from the reverse-start snapshot, which retained smaller background activity. Some controls also varied, including progressive decode; these measurements do not establish a physically idle host or attribute every timing change to the quantizer. Repeated material encoder penalties and the absence of a repeatable acceptable benefit justified rejection. Static ARM64 instruction deletion did not establish lower runtime cost. No numeric SSE2, AVX2, or world-fastest result is claimed, and the candidate was not applied to main.

The ignored evidence bundle is target/release-evidence/jpeg-packed-quantizer-78fc8c8c-20261005/: both raw campaigns and summaries, comparison.json/CSV, exact JPEGs, source snapshots, patch, binaries, build/check/range-review receipts, hardware/load snapshots, and the rejection and independent measurement review. The baseline encoder SHA-256 was 5451cb6570679fe9ea13b385900e5270581220e35cf1993c09eeb0b1a799afab; candidate encoder df73cfae0d0accc85e54a2e2d11412915d26a54d4778b38153797e59356ae7a7; candidate patch 85548d5ab3a7ee901d022b86a5ccf0e6acb25e2e0646ef934c1c28629a10c5e1.

Preceding AVIF container and multi-tile full campaign — 2026-10-05

This preceding full local report is target/release-evidence/coverage-avif-multitile-container-v2-20261005.json, generated by make coverage with nightly-2026-07-16, an empty RUSTC_WRAPPER, two Cargo build jobs and the dedicated target/llvm-cov-multitile-container-v2-20261005 coverage target. Its SHA-256 is 027665b7e2cb4e54182b7929ecd568ff83941b839f3708d29277747c4720103e.

Metric	Covered / total	Percent
Lines	88,986 / 135,603	65.622442%
Branches	17,338 / 31,192	55.584765%
Functions	4,983 / 8,681	57.401221%
Regions	136,157 / 210,598	64.652561%

All alpha floors pass. The separate strict verifier exits 1 because all four 100% requirements remain unmet. All seven test binaries pass 3, 4, 1, 57, 7, 1 and 68 tests, with no failures or ignored tests. They exercise 522 ordinary AVIF decode rows, 25 separate target-only fault contracts and 88 native loop witnesses. At that report’s source, the ordinary inventory contains 2,034 rows: 1,571 active decode, 431 active encode and 32 planned encoder rows.

All 5,041 recorded local source/configuration/script/fixture hashes remain unchanged between the fresh incremental and full campaigns. That inventory contains 5,040 files committed in the checkpoint and one ignored ambient tests/fixtures/.DS_Store; it is not a count of newly created source files. The original local receipt preserves its precommit base revision. A separate Git binding checks the measured files against committed blobs without rewriting that receipt. Documentation changed after execution is outside this measured source inventory.

All eight formatting/strict-Clippy gates pass, including debug, release, coverage-nightly, JPEG benchmark, SSE2 and AVX2 cross-target checks. All 33 feature lanes pass with the 4,940 recorded local file hashes unchanged and capability artifacts unchanged. Native/WASI lanes run tests; browser WASM lanes compile and run strict Clippy/rustdoc. Cross-target SIMD checks establish compilation/lint evidence. They supply no x86 throughput measurement. The coverage origin registry has 140 guards across 20 files, with no source exclusions. No new private unit tests, unsafe code, ignored cases or lint exceptions are introduced.

Coverage MCP reads this full report with source unverified and tests unknown. It groups 74,441 missing regions into 6,647 missing-region groups; these are not counts of wholly uncovered functions. Missing counts also include 46,617 lines, 13,854 branch outcomes and 3,698 functions. The largest displayed groups remain AV1 inter-translation instantiations. Local source/command/hash receipts do not create a managed MCP source/build binding or named-test attribution.

Complete AVIF container and multi-tile sequence cases — 2026-10-05

Thirteen new ordinary cases give 522 AVIF decode rows and 2,034 ordinary rows (1,571 active decode, 431 active encode, 32 planned encode). The 25 target-only fault contracts remain separate. These are current inventory/reference counts; execution and coverage claims require completed campaign receipts.

The maintained container-edge and multi-tile-motion generators use the normal AVIF asset hook, valid bounded BMFF boxes and byte-identical repeated inputs. Pinned live Pillow 12.2.0, with libavif 1.4.1/dav1d 1.5.3/libaom 3.13.2, supplies all public outcomes and raw pixels. No Rust outputs become ordinary inputs or references. Format detection succeeds for every input.

Ordinary case	Bytes	Complete input SHA-256	Live Pillow outcome
animated_tkhd_version_zero	1,223	eb7b131fb8288fbe8e67daf9e41e7f80bdf3f923d474177fac84a0b58550b674	Open, inspect, verify, decode and sequence decode succeed; all five frames, metadata and timing match the source.
animated_tkhd_version_zero_unknown_duration	1,223	ca1834317cd4b5b0db00130370cf3db3c94426ff7479c6414c4da2cabfef2a09	Open, inspect, verify, decode and sequence decode succeed; all five frames, metadata and timing match the source.
ipma_optional_zero_index	5,907	590514b40d0df05335861bf4345eb99068dc1264d38715f23f8e931c5376aaf3	Open, inspect, verify, decode and sequence decode succeed with unchanged still pixels and metadata.
error_ipma_essential_zero_index	5,907	b4f6f62f44d85c84a27bd98c1ad9529453c7ce31fa88602fc88eae0641b06c80	Open fails with PIL.UnidentifiedImageError; inspect, verify, decode and sequence decode report malformed input.
error_ipma_property_index_out_of_bounds	5,907	ca46ccb69a865f237092cf3ed7fb77862fa3faff112d311f860ecfb91eec77dd	Open fails with PIL.UnidentifiedImageError; inspect, verify, decode and sequence decode report malformed input.
iloc_file_data_reference_1	3,077	d4b06f63b3bd3ce2bd409930b7c2892236000ff4583e70e771f4a21573dbb6af	Open, inspect, verify, decode and sequence decode succeed with unchanged still pixels and metadata.
iloc_file_data_reference_65535	3,077	a9d263c7af3c3d1219cf2187bef5916ace90bf1018dfb6fa58650f99f51be0f7	Open, inspect, verify, decode and sequence decode succeed with unchanged still pixels and metadata.
iloc_idat_data_reference_1	5,906	b0689513b0693085ef11397fa967bcc56741ae79b80d8a81d4ef424ce561bea2	Open, inspect, verify, decode and sequence decode succeed with unchanged still pixels and metadata.
iloc_idat_data_reference_65535	5,906	756ea5b7a21c472cee85913fbb64260fccd5267f98900dd2b815760738f07eb4	Open, inspect, verify, decode and sequence decode succeed with unchanged still pixels and metadata.
animated_motion_multitile	1,264	c248f019a008e9dea4425e1d5f44d1418b44929604312d95a69a0a3ac5d4709f	Open, inspect, verify, decode and sequence decode succeed; four exact RGB 256×128 frames, each lasting 100 ms.
animated_motion_multitile_split_groups	1,280	eb19bcebc0698dfa3149c76fb6828705b22e37f45e213b70541a61b3abd20b89	Open, inspect, verify, decode and sequence decode succeed; four exact RGB 256×128 frames, each lasting 100 ms.
animated_lossless_motion_multitile	1,327	24612186624c6b470a50a549d876469c8265976633afee87fa030d910cd0532b	Open, inspect, verify, decode and sequence decode succeed; four exact RGB 256×128 frames, each lasting 100 ms.
animated_lossless_motion_multitile_split_groups	1,342	04b61cf8b3e9887ee651cec5dc055b5a102198de9f69e2ad64b4e183639cf596	Open, inspect, verify, decode and sequence decode succeed; four exact RGB 256×128 frames, each lasting 100 ms.

The two association errors retain cannot identify image file <bytes>. The essential-zero input asset is ipma_essential_zero_index.avif. Track mutations narrow tkhd version 1 to version 0 and rebase the file extent and chunk offset by twelve bytes, preserving other fields and media bytes. Both versions, including the UINT32_MAX duration sentinel, retain five frames and native one-play repetition. Association/data-reference mutations retain every media byte. Split-group variants preserve each encoded tile and parsed frame-header field, repacking complete sample extents and track tables.

Ordinary compatibility fixes

The Q100 pair exposed a real lossless sequence gap. Before the fix, public still decoding succeeded while both sequence decodes returned Unsupported/SequenceDecode/NotImplemented with decode sequence: AVIF sequence validation failed: AVIF sequence rendering has no completed color surface. Pillow decoded four RGB 256×128 frames. Source inspection traced the gate to comparing a full 256-pixel reference width with a checked 128-pixel tile width; the public probe alone did not locate the failing sample.

The generic lossless inter gate now admits validated, unreduced full references shared by checked tiles and preserves the previous admitted-width alternative. ScaleFactors still uses full current/reference dimensions; scaled == false requires exact dimensional equality. Depth/layout, surface, tile bounds and tool checks remain; local reconstruction/global prediction coordinates are unchanged. Fixed public sequence decodes of both Q100 variants match all four Pillow frames exactly, and still pixels equal frame zero. The Q80 source/split pair retains the same complete parity. This proves the bounded witnesses, not every possible multi-tile block grammar.

The four nonzero data-reference files exposed another ordinary gap: Pillow accepts 1 and 65,535 for construction method 0/file and 1/idat; the preceding Rust probe rejected all four at inspection, still decode and sequence decode. Pinned libavif read.c reads the field without storing/using it; idatStored selects local bytes. Both Rust parsers and the independent full sample inspector now consume the fallible u16 without rejecting its value. Reserved bits, supported methods, checked arithmetic and existing file/idat bounds remain. The field cannot select an external resource. Fixed public still/sequence pixels match the live Pillow witnesses without a fault label or private comparator.

Native provenance and preservation

Six new native observations cover both tkhd variants and all four motion inputs. All 82 prior record dictionaries and native artifact records/bytes remain exact. The 88-record bundle has 80 accepted complete decodes and eight malformed inputs; 267 artifacts total 9,816,480 bytes, including 9,293,948 Pillow frame bytes. Additional collections bind their actual compiler and observer-binary identities, preserving original metadata. Native repetition is 0 for both tkhd variants (one total play), and -1 for the motion inputs (infinite). The native index SHA-256 is 38b94714d241f811741a4116bb80cbb9e1479feb8360da99a001bad37037b159.

Canonical generation preserves all 509 prior AVIF operation observations, other-format observations and AVIF encode rows. Only sequence.loop_evidence.index_sha256 refreshes in 57 output rows and their 57 matrix rows. Existing native identities, input hashes, loop counts, pixels, durations, errors and flags stay unchanged. All prior 24 fault rows and 1,876 raw files retain exact values/bytes. The 37 new ordinary canonical raws match stored live Pillow bytes in full. Another 32 new files are six native witness inputs plus 26 Pillow frames. Only two association-error classes extend malformed accounting: all 545 prior class dictionaries remain exact, giving 547 classes. Later count/integrity updates are separately recorded accounting metadata.

Capacity-growth-only allocation contract

avif_retained_temporal_sample_reservation_failure is a separate target-only case using ordinary animated_motion_multitile_split_groups. Its av1.frame.retained_temporal_sample_reservation hook consumes only when a partial group's nonempty sample count exceeds spare vector capacity. Empty or already-fitting groups cannot consume it. usize::MAX additional nonzero-sized samples causes an actual deterministic try_reserve capacity failure without host OOM. Normal builds retain the actual sample request, existing error closure and ordering before pending-state publication.

The generic shared runner requires AVIF Dimensions at SequenceDecode and decode sequence: AVIF sequence validation failed: unable to reserve retained AV1 temporal-MV samples. Existing thread-local scoping consumes once and restores state on return or unwind. A successful retry must equal a fresh uninjected Rust sequence decode; its ordinary source independently checks exact Pillow frames. Injection/retry has oracle_status: not_applicable, not Pillow allocation attribution. The new hook is defensive_model; current origins total 140 guards across 20 files.

Identity and claim limits

Clean pinned libavif commit is 6543b22b5bc706c53f038a16fe515f921556d9b3; read.c SHA-256 is d2e4062f7030ffa5843a3c9cc4984e382a07782ce2241d8b5354fda888266e85. The Pillow handshake checks wheel/runtime pins. Public-probe receipts retain actual source/input hashes and locked dependency identities. Independent canonical/source audits are retained under target/release-evidence/avif-multitile-current-78fc8c8c-20261005/; generator, native and before/after proofs are under the companion next-public-gaps-78fc8c8c-20261005/ and avif-multitile-inter-candidate-78fc8c8c-20261005/ directories.

The existing native parity test now pins 267 artifacts and all 88 names, including the six new matrix source mappings. Its four existing test functions and preceding helper/assertion bodies are preserved. Fresh ignored native collections have their own build identity and ordering; publishing additions preserves the accumulated canonical index's record order and provenance.

Fresh incremental campaign and failed-run preservation

The first 15 selected runs pass on their recorded source. The subsequent full run fails only the old 235-artifact assertion in the existing native parity test. Its failed terminal receipt and log remain preserved; no successful full report is attributed to that run. The existing test's six new witness names and source mappings are added with the 267-artifact assertion. Source changed, so a fresh baseline and all 14 additions are remeasured in the separate v2 campaign; reports from the two source inventories are not combined.

The fresh baseline executes 509 preceding ordinary AVIF rows plus 24 preceding faults. Thirteen ordinary selections and one target-only fault then run separately. All 15 selections pass. Each case resets only profiles with cargo +nightly-2026-07-16 llvm-cov clean --profraw-only; the normal combined LCOV invocation uses --no-clean, followed by a separate JSON report. The receipt requires fresh nonempty profiles and keeps all 387 compiled-file hashes identical between selections. Profile absence cannot reuse stale profdata. The complete campaign takes 106.450857 seconds including its first build; subsequent selected Cargo calls take 0.809–0.866 seconds on this host. These are workflow timings, with no codec throughput claim.

The independent LCOV union and all 14 Coverage MCP incremental comparisons agree: 45,247→45,290 observed lines out of the fixed 131,102 selected-report coordinate denominator. Marginal gains in campaign order are 16, 3, 0, 0, 10, 1, 6, 1, 1, 0, 0, 0, 0 and 5 lines. The two Q100 sources and four data-reference inputs remain regression witnesses despite zero marginal lines after earlier selections. This selected denominator remains distinct from the full report's aggregate line total.

The retained allocation-error closure at frame.rs:1598–1602 has three LLVM regions, each with baseline count zero, selected fault count one and full-suite count one. The fault's structured error and retry assertions pass separately from its ordinary source's exact Pillow parity. Selected-report absences are not regressions. MCP retains limited coordinate evidence with source unverified and tests unknown. The 100% and fastest-codec goals remain open.

The avif-multitile-container-v2-* local receipts, immutable full source receipt, independent coverage audit and coverage-mcp-multitile-v2-* summaries retain these results. The current malformed and claim-integrity accounting is updated before the fresh campaigns, preserving all historical managed measurement IDs, counts, inputs and preceding report observations.

Preceding full AVIF location and temporal coverage — 2026-10-05

The preceding full local report is target/release-evidence/coverage-avif-iloc-temporal-20261005.json, generated by RUSTC_WRAPPER= CARGO_BUILD_JOBS=2 COVERAGE_REPORT=target/release-evidence/coverage-avif-iloc-temporal-20261005.json make coverage with nightly-2026-07-16. It records 88,946/135,595 lines (65.596814%), 17,313/31,190 branches (55.508176%), 4,982/8,681 functions (57.389702%), and 136,103/210,590 regions (64.629375%). All alpha floors pass. The strict 100% verifier exits with status 1 with all four requirements still unmet; that goal remains open. The report SHA-256 is 1de66283960b30d4afbf90213e54a0a111663a48a5d59ca37a341fe7a9de0f7f.

All seven test binaries pass: 3, 4, 1, 57, 7, 1 and 68 tests, with no failures or ignored tests. The matrix harness covers 509 ordinary AVIF decode rows, 24 separate target-only fault contracts and the native repetition bundle's 82 cases. The ordinary decode/encode inventory contains 2,021 rows: 1,558 active decode rows, 431 active encode rows and 32 planned encoder rows. All 505 preceding AVIF observations, other-format observations and 23 preceding fault rows remain unchanged.

The full local receipt records unchanged hashes for 4,957 local files: 4,956 tracked source, configuration, script and fixture files, plus one ignored ambient tests/fixtures/.DS_Store file. The expanded inventory includes 109 existing committed scripts and five new fixture files; it does not mean that 114 source files were created. The full receipt separately records the generated malformed_ledger.json and its claim_ledger.json integrity refresh after the incremental campaign. All executable source, input/reference and matrix hashes remain identical between those campaigns.

Relative to the preceding full report, covered counts increase by 36 lines, eight branch outcomes, four functions and 42 regions. Source totals increase by 30 lines, eight branches, two functions and 40 regions. Those changes span the generic inspection/decode staging fix and the new coverage hook; they are descriptive counts for different source. They remain separate from the 14 new line observations isolated by the same-source incremental campaign below. No source exclusions are used.

make fmt, make lint and make lint-x86-simd pass all eight recorded formatting/strict-lint gates with identical hashes for 153 Rust/configuration files. The SSE2 and AVX2 gates are cross-target compile/lint checks. All 33 feature lanes pass with all 4,855 recorded local hashes unchanged, including 4,698 codec fixture/observation files and the separate ambient Finder file. Native and WASI lanes execute runtime checks; browser WASM lanes compile and run strict Clippy/rustdoc checks. Capability artifacts remain unchanged. The two accounting-file updates made after these campaigns are recorded separately. The exact cfg(coverage) inventory is 139 guards across 20 files. No new private unit tests, unsafe code, ignored cases or lint exceptions are introduced.

Coverage MCP reads the full report with source unverified and test attribution unknown. It groups the 74,487 repository-wide missing regions into 6,648 missing-region groups; these are not counts of wholly uncovered functions. There are also 46,649 missing lines, 13,877 missing branch outcomes and 3,699 missing functions. The largest displayed groups remain repeated AV1 inter-translation instantiations. An AVIF display filter retains the global totals. Local command/hash receipts do not create a managed MCP source/build binding or named-test attribution.

Complete AVIF location cases and error staging — 2026-10-05

Four ordinary cases extend the existing indexed-idat input. All are complete files with valid enclosing BMFF box sizes. The maintained idat generator and normal AVIF asset hook construct their inputs; pinned live Pillow 12.2.0 produces the operation observations and raw reference. Its runtime is libavif 1.4.1, dav1d 1.5.3 and libaom 3.13.2. Repeated generation is byte-identical.

Ordinary case	Bytes	Complete input SHA-256	Live Pillow outcome
iloc_idat_split_extents	5,918	b92d22f904a48d380a99f7b91ff78aa73ab4fc73e9d2f8b71697d843881aa1bd	Open, inspect, verify, decode and sequence decode succeed with the original pixels and frame metadata.
error_iloc_truncated_extent_index	5,896	62f5d6dd3b3cfb368030407977a2af434659c178c1412844781e43c03e25d8ed	Open fails with PIL.UnidentifiedImageError; inspect, verify, decode and sequence decode report malformed input.
error_iloc_index_size_three	5,906	53be83151f9031fbc56c0f3bc91fd50f5c2b7b3376ac760fb662b458eadc572b	Open fails with PIL.UnidentifiedImageError; inspect, verify, decode and sequence decode report malformed input.
error_iloc_idat_extent_out_of_bounds	5,906	1e0f61d11eb4cf291f4af89d3636ff874f517358e2eecb20d8b92d1a4a05e46b	Open, inspect and verify succeed; decode and sequence decode fail with builtins.SyntaxError.

Format detection succeeds for all four. The two open failures retain the normalized Pillow message cannot identify image file <bytes>. The overrun retains the exact decode message Failed to decode frame 0: BMFF parsing failed. Its successful header is RGB, 128×128, one frame, so an inspection failure would violate the public contract.

The split input retains the nonzero base offset of eight. Its two zero-index extents use relative offsets eight and 1,405, with lengths 1,397 and 1,398; they concatenate to the original 2,795 AV1 bytes. The truncated-index case ends its bounded iloc after two of the four declared index bytes. The width case declares an unsupported three-byte index. The overrun changes only the extent length from 2,795 to 2,796: its relative end exceeds the 2,811-byte idat payload by one while remaining inside the outer file. Adjacent bytes cannot satisfy that item's source bound. All ftyp, original unreferenced mdat, non-iloc metadata children and idat/AV1 bytes remain unchanged. The AV1 payload SHA-256 is be0bf650b8612533577e4b47a60989bb3f092cfb256b81f3bd84e3b5ce8ea199. The split row compares all 49,152 decoded bytes with the independent reference.

The generic Rust inspection path now validates container/configuration metadata while retaining declared idat spans with checked arithmetic. Decode extraction checks every item's file/idat bound before using encoded payloads. Grid-descriptor and retained opaque-metadata reads remain bounded to the selected source; opaque extents are checked before reserving their declared size. File-backed items and sequence sample-table spans retain their existing bounds checks. This preserves Pillow's lazy item-payload failure stage without permitting a read outside idat or adding a case-specific comparator.

Independent bit-depth enrichment now uses inspect_color_configurations to read bounded item properties or track sample descriptions without reading item extents. The full sample inspector remains strict and rejects the overrun with item extent exceeds source bytes. All 29 preceding inspector function bodies and all 470 successful preceding inspection-depth values are unchanged. generate_decode_refs.py catches only public Pillow open failures when recording inspection errors; an independent enrichment failure now aborts generation instead of being mislabeled as a Pillow outcome.

During ordinary input/reference generation, 4,690 of 4,694 preceding fixture files stay byte-identical. The ordinary generator changes only the three AVIF aggregate JSON/index files; the concurrently changed origin registry belongs to the separate fault work. Four complete inputs and one raw reference are added, with no prior files deleted. All 505 preceding AVIF row dictionaries, other-format matrix rows and 23 preceding fault rows are unchanged. Later count/integrity updates are accounting metadata, separately recorded.

Nonempty temporal-sample allocation contract — 2026-10-05

The target-only row avif_tile_group_temporal_sample_reservation_failure reuses the ordinary animated_motion_chroma input. Its coverage-only point, av1.frame.tile_group_temporal_sample_reservation, is consumed only when a reconstructed tile has nonempty temporal-MV samples. Empty intra-frame work cannot consume it. A real try_reserve(usize::MAX) fails deterministically; the production request remains the actual sample count, with the same existing Dimensions error closure.

The shared public runner requires AVIF SequenceDecode and the exact message decode sequence: AVIF sequence validation failed: unable to allocate AV1 tile-group temporal-MV samples. It then checks a successful uninjected retry against a fresh Rust sequence decode, including all returned content. The ordinary source row separately supplies independent Pillow sequence/pixel parity. One-shot fault state is cleared before the retry. This row remains in the shared matrix's oracle_status: not_applicable lane; all 24 fault contracts are separate from the 2,021 ordinary rows. Ordinary image bytes cannot deterministically force this allocation failure.

Same-source incremental observations and accounting — 2026-10-05

The six selected runs first execute all 505 preceding AVIF rows plus 23 preceding fault contracts, then each of the four new ordinary rows and the new fault row separately. All selections pass. All 4,957 recorded local hashes remain unchanged throughout execution and the subsequent MCP comparisons. The independently checked LCOV coordinate union is 45,228→45,230→45,233→45,234→45,237→45,242 observed lines out of 131,094: gains of two, three, one, three and five lines, in the table order above followed by the temporal-sample fault. No coordinates are added or removed. This fixed selected-report denominator differs from the full report's 135,595 lines.

The truncated-index selection observes the error-return region at samples.rs:1122 in both inspection/decode instantiations: preceding counts zero/zero become four/two. The temporal-sample fault observes the existing allocation-error closure at frame.rs:2941–2943 once, from zero. Those exact regions are also observed in the full report. MCP's raw LCOV/LLVM results retain source unverified and tests unknown. These coordinate observations do not establish full-suite regressions, managed source binding or named-test attribution.

The preliminary make verify catches the stale generated malformed ledger. After all incremental tests and MCP comparisons finish, the maintained generator adds exactly the three ordinary AVIF error classes, increasing the ledger from 542 to 545 classes while preserving all preceding class values. Only that ledger and its current claim-ledger integrity digest change between the incremental and full receipts. Rust runtime tests do not read the malformed ledger; executable source, inputs, references and the shared matrix stay unchanged. Historical managed run/snapshot identities, metrics and measured inputs are preserved. The later verification passes. Receipts are retained in target/release-evidence/avif-iloc-edge-cases-d9efb879-20261005/, the avif-iloc-temporal-* campaign paths and the corresponding coverage-mcp-iloc-* summaries.

Rejected aligned JPEG 4:2:2 conversion fusion — 2026-10-05

An isolated experiment based on d9efb879 fused RGB conversion with h2v1 chroma downsampling for no-token Cs422 inputs whose width is divisible by 16. It removed two full-size chroma allocations while preserving saturation before averaging. Both frozen variants passed 205 JPEG decode and 81 JPEG encode public matrix rows, strict Clippy and all 20 exact JPEG benchmark-encoded-byte comparisons.

The append-based variant took 1.0191× the baseline's time on the affected RGB 128 Q85 Cs422 encode workload. A direct-store refinement measured 0.9958× and 0.9927× in opposite-start five-round campaigns, while its oracle-normalized direction crossed (1.0029× / 0.9974×). Normal RGB 512 Q10 Cs420 encodes measured 1.0148× / 1.0089× and Q85 Cs420 encodes 1.0039× / 1.0139×, with higher normalized medians in both runs. Every complete 40-workload campaign and raw sample remains in the ignored target/release-evidence/jpeg-next-performance-d9efb879-20261005/ evidence.

Both variants were rejected and reverted. No JPEG optimization or speed claim was retained; these local ARM64 results do not establish x86 performance.

Preceding indexed-idat, color CDEF and H4 full campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-avif-indexed-idat-cdef-20261005.json, generated by RUSTC_WRAPPER= CARGO_BUILD_JOBS=2 COVERAGE_REPORT=target/release-evidence/coverage-avif-indexed-idat-cdef-20261005.json make coverage with nightly-2026-07-16. It records 88,910/135,565 lines (65.584775%), 17,305/31,182 branches (55.496761%), 4,978/8,679 functions (57.356838%), and 136,061/210,550 regions (64.621705%). Every alpha floor passes. The strict verifier still fails all four 100% requirements; that goal remains open.

All seven test binaries pass, including 57 coverage-matrix harness tests, 505 AVIF decode rows, 23 separate target-only fault contracts, the native repetition bundle's 82 cases, seven decode-policy tests and 68 feature-gate tests. The ordinary matrix contains 2,017 rows. All preceding Pillow case observations and 21 preceding fault rows remain unchanged. The local full receipt records unchanged hashes for 4,843 local files, including 4,842 tracked source, configuration and fixture files plus one ignored Finder metadata file. The report SHA-256 is 6a4d058c0d3a2c6dad13eea36f71da69bfcce4bcf69b9151f2b54c9bbb95db0e.

Relative to the preceding full report, covered counts increase by 18 lines, six branch outcomes, two functions and 24 regions. Source totals decrease by 362 lines, 14 branches, 13 functions and 470 regions across the H4 cleanup and new coverage hooks. These source-total changes remain separate from the eight additional line observations isolated by the same-source incremental campaign below. No source exclusions are used.

make fmt, make lint, make lint-x86-simd, make verify and all 33 native, WASI and WASM feature lanes pass. Strict lint retains identical hashes for 153 Rust/configuration files; the feature campaign retains all 1,334 input hashes without capability-artifact drift. The two new defensive fault points increase the exact cfg(coverage) inventory from 136 to 138 guards across 20 Rust files. Existing guard origins are retained. No new unit tests, unsafe code, ignored cases or lint exceptions are introduced.

Coverage MCP reads the full report as source-unverified with test attribution unknown. It retains 74,489 missing regions and 13,877 missing branch outcomes. The largest groups remain repeated AV1 inter-translation instantiations; the retained luma-only H4 fallback still has 24 unobserved branch outcomes. Local command/hash receipts do not create managed MCP evidence. This checkpoint makes no measured performance or fastest-codec claim.

AVIF per-tile CDEF region-map reservation fault contract — 2026-10-16

fault-contract:avif:avif_tile_cdef_region_map_reservation_failure reuses the active decode:avif:multitile_color_split_groups Pillow input, SHA-256 654ef88dd8ebc71a554c03f721ad97581fcf2d2df0d825020d267939eb8f5e34. Its coverage-only fault point forces the per-tile CDEF region-map reservation in entropy.rs to fail before resizing. The selected target-only contract passed 1/1: the public AVIF StillDecode Dimensions error has message decode: AVIF AV1 validation failed: unable to allocate AV1 CDEF region map, and retry output equals a fresh uninjected decode. oracle_status is not_applicable; the separate fault result does not contribute to Pillow parity counts. The hook is compiled only for coverage builds.

Coverage MCP finds no missing branch observation at entropy.rs:11308 in the selected report. The report has no source/build receipt and test attribution is unknown. The incremental comparison with the saved full baseline is incomparable because exact branch detail is incomplete, so this remains selected coordinate evidence and makes no aggregate coverage claim.

Report:

• target/release-evidence/coverage-avif-tile-cdef-reservation-selected-20261016.json

Indexed AVIF item, color CDEF faults and luma-only H4 — 2026-10-05

The ordinary parity row iloc_idat_indexed_extent adds a four-byte zero extent index to the pinned method-one idat input. Its version-one iloc declares index_size = 4; construction method one leaves that index unused. Base and extent offsets remain eight bytes each, and all 2,795 AV1 bytes, idat payload, ftyp, original mdat and non-iloc metadata children remain unchanged. Bounded box reconstruction adds four bytes to iloc and meta. The complete 5,906-byte input has SHA-256 d90e970b5b9570c5091df64871d58a8f500c72df294c456037fad90cc1d92aac.

Live pinned Pillow 12.2.0 with libavif 1.4.1, dav1d 1.5.3 and libaom 3.13.2 accepts the indexed input with exactly the source image's pixels, metadata and frame observations. The maintained generator now verifies both idat variants before writing either and retains its original returned path. The normal AVIF asset hook and independent reference generator use the same workflow. Both repeated generation runs and generate_decode_refs.py --format avif pass. During input/reference generation, 4,689 of 4,692 preceding fixture files remain byte-identical; only the three aggregate AVIF JSON/index files change, and the new complete input and 49,152-byte raw reference are added. Subsequent current-count and integrity-hash updates affect only accounting metadata. Historical coverage metrics, measured inputs and managed identities remain unchanged.

Two new target-only rows, avif_assembled_cdef_region_map_reservation_failure and avif_assembled_cdef_active_map_reservation_failure, reuse the active multitile_color_split_groups parity input. Ordinary image bytes cannot reliably force either allocation failure. Each coverage-only point requests usize::MAX capacity at one fallible vector reservation, takes the existing structured AVIF still-decode Dimensions error, and then checks a successful uninjected retry against a fresh Rust decode. The existing ordinary source row separately supplies independent Pillow pixel parity. Error messages and production reservation counts remain unchanged; restoring the normal aliases reconstructs frame.rs byte-for-byte to the preceding production source. These rows stay in the shared matrix's separate oracle_status: not_applicable lane and do not increase Pillow parity totals.

The former decode_following_vertical_without_chroma has one caller: the third child of the closed H4 compositor, always 16x4 with no Full-resolution edges. Its locally owned state remains 4:2:0, while this child parses and publishes Monochrome syntax/output because it owns only luma samples. The new private decode_following_horizontal_four_without_chroma keeps sample checks, geometry consumption, quantization/CDEF bookkeeping, error ordering, palette rejection, the active H4 reconstruction and byte-identical output contexts. Four disconnected private helpers and unused edge preparation are removed after independent caller/reference review. All other surviving function bodies are byte-identical apart from the sole compositor call. block.rs shrinks by 422 lines, with final SHA-256 0f18d590882c560b9770503795b3a0c3520dd03c1fbd554bf0ef7930767abb00. The shared reconstruction, complete partition decoder and checked H4 fallback remain intact.

The incremental campaign separately runs all 504 preceding AVIF rows plus 21 preceding fault contracts, then the new parity row and each new fault row. Every selection passes with no failures or ignored tests. All 4,843 recorded local file hashes stay unchanged within the campaign. Coverage MCP's LCOV union estimates 45,192→45,194→45,197→45,200 observed lines out of 131,064: gains of two, three and three lines, respectively, with zero added or removed coordinates. Successful extent-index reads at container.rs:659 and samples.rs:1110 are observed; their error-return outcomes remain missing. The color CDEF allocation error closures at frame.rs:1993 and :2010 are observed in their selected reports. This subset denominator differs from the full report; the union is limited coordinate evidence and does not establish full-suite regressions or verified named-test attribution.

The preliminary verifier catches stale current provenance counts in the roadmap/documentation. They are synchronized to 138 before the successful final verification. The local full receipt explicitly records the later claim-ledger integrity refresh; all Rust and test input/reference hashes remain identical to the incremental campaign. Independent source, input, registry and numerical reviews have no actionable findings. Proofs and receipts are retained under target/release-evidence/avif-h4-no-chroma-specialization-0899215a/, target/release-evidence/avif-idat-indexed-20261005/ and the corresponding avif-indexed-idat-cdef-* campaign paths.

Preceding AVIF idat and following-chroma H4 campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-avif-h4-idat-20261005.json, generated by RUSTC_WRAPPER= CARGO_BUILD_JOBS=2 COVERAGE_REPORT=target/release-evidence/coverage-avif-h4-idat-20261005.json make coverage with nightly-2026-07-16. It records 88,892/135,927 lines (65.396867%), 17,299/31,196 branches (55.452622%), 4,976/8,692 functions (57.248044%), and 136,037/211,020 regions (64.466401%). All alpha floors pass; the strict report verifier still fails all four 100% requirements, so that goal remains open.

Every test binary passed, including all 57 coverage-matrix harness tests, 504 AVIF decode rows, the native repetition bundle's 82 cases, all 21 target-only fault contracts, seven decode-policy tests, all 68 feature-gate tests, determinism, animation, and runtime suites. The ordinary decode/encode inventory now contains 2,016 rows; previous Pillow observations are unchanged. The local source receipt confirms unchanged Rust, Cargo and input hashes throughout this full campaign.

Relative to the preceding full report, covered counts increase by 15 lines, four branch outcomes and 26 regions, with the function numerator unchanged. The same-source incremental comparison below isolates the new idat row's line observations. Source totals decrease by 6,732 lines, 1,038 branches, 388 functions and 9,914 regions after the H4 specialization supported by caller proof and removal of its disconnected code. These source-total changes are kept separate from executed coverage; no source exclusions are used.

Coverage MCP reads the report as source-unverified with test attribution unknown. It retains 74,983 missing regions and 13,897 missing branch outcomes. The largest groups remain repeated AV1 inter-translation instantiations. The retained following-H4 fallback still has uncovered outcomes; its reachability and checked fallback remain intact.

make fmt, make lint, make lint-x86-simd, make verify, and all 33 native, WASI, and WASM feature lanes pass. Lint and feature receipts confirm unchanged source/input hashes. The origin inventory remains 136 exact cfg(coverage) guards across 20 Rust files. No new Rust unit tests, unsafe code, source exclusions, ignored cases or lint exceptions are introduced.

AVIF idat item and following-H4 specialization — 2026-10-05

The ordinary parity row iloc_idat_primary_item relocates the pinned baseline's primary AV1 item into a complete meta/idat box. Its iloc version-one entry uses construction method one, data-reference index zero, and nonzero base and extent offsets of eight bytes each. Both container inspection and sample extraction must resolve the item relative to the idat payload. The sixteen padding bytes precede the unchanged 2,795-byte AV1 payload; the original mdat, ftyp, and non-iloc metadata children remain byte-identical. The 5,902-byte complete fixture has SHA-256 cc020ae1e91a2cad8c4f66b10165702bf11abc39a462a06b9665664f3c63c337.

Live pinned Pillow 12.2.0 with libavif 1.4.1, dav1d 1.5.3, and libaom 3.13.2 accepts the relocated item with the same complete image and frame observations as the source. The maintained reference generator produces exact pixels and operation contracts independently of Rust. Generate or verify the input with target/oracle-staging/pillow122/bin/python scripts/generate_avif_idat_fixture.py; the normal AVIF asset hook invokes it too. Repeated generation preserves the same bytes and refuses to replace a differing fixture. The input/reference generation step leaves all 4,687 preceding nonaggregate fixture files byte-identical, with previous JSON case observations and ordinary matrix rows preserved. Subsequent count and integrity-hash synchronization changes only accounting metadata; historical measured inputs and managed coverage identities remain unchanged. The AVIF decode inventory grows from 503 to 504; all 21 target-only fault rows retain their separate oracle_status: not_applicable lane.

The H4 refactor uses the following caller invariants. Both calls to the former decode_following_vertical belong to one locally owned Lossy420Decoder::with_qindex state, which fixes sampling to 4:2:0. Each receives 16x4 dimensions and no Full-resolution edges. Pending geometry is consumed by each successful syntax attempt, so both following leaves have parent Horizontal16x4 geometry. Encoded TX8x4 or TX4x4 child splits do not change that parent. The callback can access only the range decoder. The private entry is now decode_following_horizontal_four_chroma.

Sample-depth and geometry checks, quantization/CDEF bookkeeping, syntax/error sequencing, palette rejection before reconstruction, the active H4 reconstruction, and visible output/context updates are retained. The complete partition decoder, normalized Full/high-depth path and H4 compositor remain. The source proof disconnects 63 private helpers together with their unused aliases, constants, neighbor type and twelve unread fields. Four already disabled private tests used only removed helpers; they are retired. A mixed edge test retains its live right-edge assertion. No public parity case is removed. block.rs shrinks by 8,365 lines; the final source SHA-256 is c389592f0ba11d479ceb3ff0277b6148d7a3b94093ff7d0449828b0362f586c7. No coverage exclusions, unsafe code, ignored cases or new lint exceptions are introduced.

Structured caller/reference proofs, preserved baseline/candidate source, lint and feature receipts with source hashes, and the live input/reference receipts are retained under target/release-evidence/avif-h4-following-specialization-3e4ab357/, target/release-evidence/avif-idat-primary-20261005/, and the corresponding avif-h4-idat-* campaign paths.

The incremental campaign runs all 503 preceding AVIF rows and the new row separately on identical source; both selections pass. Its local receipt confirms unchanged Rust, Cargo and input hashes. Coverage MCP's LCOV union estimates 43,755→43,770 observed lines out of 131,419, a fifteen-line gain (0.011414 percentage points), with zero added or removed coordinates. The new row observes 14,754 lines; 14,739 overlap the preceding subset. The previously missing Idat selection at container.rs:642 and relative-span calculation at samples.rs:1124 are observed in its selected LLVM report. This subset denominator differs from the full campaign. MCP still reports source/build identity unverified and test attribution unknown; the local command/hash receipt does not create managed evidence or establish full-suite regressions.

Preceding Full-chroma H4 cleanup campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-avif-h16x4-cleanup-20261005.json, generated by RUSTC_WRAPPER= CARGO_BUILD_JOBS=2 COVERAGE_REPORT=target/release-evidence/coverage-avif-h16x4-cleanup-20261005.json make coverage with nightly-2026-07-16. It records 88,877/142,659 lines (62.300311%), 17,295/32,234 branches (53.654526%), 4,976/9,080 functions (54.801762%), and 136,011/220,934 regions (61.561824%). All alpha floors pass; the strict report verifier still fails all four 100% requirements, so that goal remains open.

Every test binary passed, including all 57 coverage-matrix harness tests, 503 AVIF decode rows, the native repetition bundle's 82 cases, all 21 target-only fault contracts, seven decode-policy tests, all 68 feature-gate tests, determinism, animation, and runtime suites. The 2,015 ordinary decode/encode rows and their Pillow references are unchanged.

The covered numerators are identical to the preceding full campaign. The caller-proven dead-code cleanup removes 457 reported lines, 84 branches, 15 functions, and 713 regions from the source totals; no coverage exclusion or synthetic case produces this change. Coverage MCP reads the report as source-unverified with test attribution unknown. Its totals retain 84,923 missing regions and 14,939 missing branch outcomes. Uncovered paths in the retained vertical fallback remain open.

make fmt, make lint, make lint-x86-simd, make verify, and all 33 native, WASI, and WASM feature lanes pass. The origin inventory remains 136 exact cfg(coverage) guards across 20 Rust files. No Rust unit tests, unsafe code, source exclusions, or new lint exceptions are introduced by the cleanup.

Preceding CDEF fault-contract campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-cdef-region-map-20261005.json, generated by RUSTC_WRAPPER= COVERAGE_REPORT=target/release-evidence/coverage-cdef-region-map-20261005.json make coverage with nightly-2026-07-16. It records 88,877/143,116 lines (62.101372%), 17,295/32,318 branches (53.515069%), 4,976/9,095 functions (54.711380%), and 136,011/221,647 regions (61.363790%). All alpha floors pass; the strict report verifier still fails all four 100% requirements, so that goal remains open.

Every test binary passed, including all 57 coverage-matrix harness tests, 503 AVIF decode rows, the native repetition bundle's 82 cases, all 21 target-only fault contracts, seven decode-policy tests, all 68 feature-gate tests, determinism, animation, and runtime suites. The 2,015 ordinary decode/encode rows and their Pillow references are unchanged by this slice. Fault results remain a separate oracle_status: not_applicable lane.

Coverage MCP reads this full report as source-unverified with test attribution unknown. It reports 85,636 missing regions and 15,023 missing branch outcomes. The monochrome CDEF region-map allocation error closure is now covered. The same-source incremental line comparison below isolates the new case's coordinate observations; full-report denominator changes are reported intact.

make fmt, make lint, make lint-x86-simd, make verify, and all 33 native, WASI, and WASM feature lanes pass. The origin inventory records 136 exact cfg(coverage) guards across 20 Rust files. No source exclusions, Rust unit tests, unsafe code, or lint exceptions were added in this slice.

Preceding AVIF edge campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-avif-edges-20261005.json, generated by RUSTC_WRAPPER= COVERAGE_REPORT=target/release-evidence/coverage-avif-edges-20261005.json make coverage with nightly-2026-07-16. It records 88,864/143,107 lines (62.096194%), 17,293/32,316 branches (53.512192%), 4,975/9,095 functions (54.700385%), and 136,002/221,642 regions (61.361114%). All alpha floors pass (59%, 46%, 52%, and 58% respectively). The strict report verifier still fails all four 100% requirements; that goal remains open.

Every test binary passed, including all 57 coverage-matrix harness tests, 503/503 AVIF decode rows, the native repetition bundle's 82 complete cases, all twenty target-only fault contracts, seven decode-policy tests, determinism, all 68 feature-gate tests, animation, and runtime suites. The matrix contains 2,015 decode/encode rows. The unchanged fault contracts remain a separate lane with oracle_status: not_applicable, outside Pillow parity counts. The initial full run caught the native repetition harness's stale 232-artifact inventory; its exact inventory now includes the new sequence and all 235 artifact hashes, and the repeated full campaign passes.

Coverage MCP reads the final report as source-unverified with test attribution unknown. It reports 85,640 missing regions and 15,023 missing branch outcomes. The largest groups remain AV1 inter-translation and vertical decode instantiations in block.rs. Repeated generic instantiations dominate; these coordinates are leads for source review, not direct fixture prescriptions. The final same-source incremental comparison is recorded below. Source and harness edits changed full-report denominators, so differences from the preceding full report are not an isolated execution gain.

make lint, make lint-x86-simd, make fmt, make verify, and all 33 native, WASI, and WASM feature lanes pass. The origin inventory remains 135 exact cfg(coverage) guards across 20 Rust files, with no source exclusions. No new Rust unit tests, unsafe code, or lint exceptions are introduced.

Preceding complete-source campaign — 2026-10-05

The preceding full local report is target/release-evidence/coverage-current-source-accounting-20261005.json, generated by RUSTC_WRAPPER= COVERAGE_REPORT=target/release-evidence/coverage-current-source-accounting-20261005.json make coverage with nightly-2026-07-16. It records 88,864/143,127 lines (62.087517%), 17,279/32,344 branches (53.422582%), 4,974/9,095 functions (54.689390%), and 136,005/221,676 regions (61.353056%). The project alpha floors pass (59% lines, 46% branches, 52% functions, 58% regions), while the separate 100% requirement still fails and remains open.

All test binaries in the campaign passed, including all 57 coverage-matrix harness tests, seven decode-policy tests, determinism, all 68 feature-gate tests, animation, and runtime suites. The shared matrix contains 1,995 decode/encode rows and twenty target-only AVIF/JPEG fault contracts in a separate lane with oracle_status: not_applicable; all twenty contracts passed. The full AVIF decode matrix passed 483/483, including both lossy 4:2:0 four-Square8 parity cases, the skipped color/alpha CDEF case, and the 33×17 I422 super-resolution case's Pillow odd-width right-edge chroma behavior.

Coverage MCP reads the full LLVM report as source-unverified with test attribution unknown because it carries no source/build receipts. Its region and branch totals report 85,671 missing regions and 15,065 missing branch observations. The largest groups are AV1 inter-translation and vertical decode instantiations in block.rs; repeated generic instantiations dominate the result, so the coordinates are leads for source review rather than a direct case prescription. The targeted branch scan still reports missing outcomes in Lossy420Decoder::decode_following_vertical (block.rs:67556); neither lossy Square8 parity row adds observations there. The frame.rs branch scan also reports 35 missing outcomes in assemble_monochrome_tiles, including inconsistent or absent per-tile filter metadata paths. MCP does not attribute observations to tests. The full report includes all twenty fault-contract rows; source/build receipt-bound attribution remains unavailable.

The current coverage-origin inventory records 135 exact cfg(coverage) guards across 20 Rust files. All source coverage(off) attributes have been removed. Rust's strict Clippy policy, coverage-hook Clippy configuration, and x86 SSE2/AVX2 lint targets pass without new lint exceptions. Target fault injection remains compiled only for coverage builds.

AVIF configuration precedence and film-grain edges — 2026-10-05

Twenty new complete-file manifest cases use live pinned Pillow 12.2.0, libavif 1.4.1, dav1d 1.5.3, and libaom 3.13.2. Fourteen succeed completely, five fail during opening or first-frame decoding, and one succeeds on frame zero before rejecting an unlisted grain reference in frame one. The ordinary public runner executes all twenty successfully after the fixes. These are Pillow parity inputs; the twenty target-only fault contracts remain a separate unchanged lane.

The configuration generator preserves BMFF lengths, item extents, and AV1 media bytes while changing redundant declarations or a later duplicate property. Seven cases establish that decoded sequence fields take precedence over differing profile, level, tier, monochrome, subsampling, and chroma position declarations. Two depth disagreements between the selected pixi and av1C properties require opening errors. Two later duplicate pixi properties retain the first property's precedence. Two matching ten/twelve-bit container declarations retain the actual eight-bit sequence pixels, and one accepted twelve-bit declaration has highBitdepth clear. Declared depth metadata remains independently identified; decoded storage and conversion use the validated AV1 sequence depth.

Before fixes, the original nine configuration cases failed, both duplicate property cases failed, both declared-versus-sequence depth cases failed, and the tolerated twelve-bit flag case failed. Rust now validates the selected first pixi against the cached av1C depth and follows libavif's twelve-bit flag precedence. The redundant configuration/sequence equality check is removed. Bounded container framing, actual AV1 syntax, repeated sequence consistency, sample bounds, and checked plane/conversion validation remain. No additional pixel allocation or repeated configuration payload parse is introduced.

The grain generator adds exact I422 pixels, Y-point-count 15 and UV-count 11 rejections, unequal I420 U/V presence, an unlisted reference rejection, and valid reuse of an inactive reference. The last case reproduced a sequence decode failure before the fix. A listed, existing reference with inactive grain now inherits inactivity; empty or unlisted references still fail. Option<FilmGrain>::None retains its documented meaning of apply_grain=false. The independent header inspector follows the same native semantics. The refreshed native repetition bundle contains 82 cases; all 81 preceding case records are unchanged, with one new inactive-reference sequence observation.

Reproduce inputs with target/oracle-staging/pillow122/bin/python scripts/generate_avif_config_disagreement_fixtures.py and target/oracle-staging/pillow122/bin/python scripts/generate_avif_filmgrain_edge_fixtures.py. The existing asset-generation hook invokes both. Exact outputs and operation contracts are generated through scripts/generate_decode_refs.py --format avif; no expected pixels or failures are copied from Rust.

The incremental campaign executes the preceding 483 AVIF rows and the twenty new rows in separate runs on identical final source, features, and LLVM flags. Both subsets pass and their local receipt confirms unchanged Rust inputs and matrix hashes throughout. Coverage MCP's LCOV coordinate union reports 43,734→43,749 observed lines out of 138,301: fifteen additional lines, with no source coordinates added or removed. The twenty-row subset observes 22,283 lines; 22,268 were already observed by the old AVIF subset. The I422 grain helper has seven missing regions in the baseline and none in the new subset. This subset denominator differs from the full all-test campaign.

Coverage MCP labels both raw reports source-unverified and test attribution unknown. The local receipt supports this same-source comparison but does not turn it into managed MCP evidence or a full-suite regression result. JSON branch/region coordinates are useful for review; no numeric incremental branch or region union is claimed. Reports are avif-edges-baseline-20261005.lcov and avif-edges-selected-20261005.lcov, with companion JSON reports, avif-edges-receipt-20261005.json, and coverage-mcp-avif-edges-final-20261005.json, under target/release-evidence/.

Local red/green logs: config-disagreement-red-20261005.log, avif-15-red-20261005.log, duplicate-pixi-red-20261005.log, sequence-depth-red-20261005.log, depth-flags-red-20261005.log, and avif-20-green-20261005.log, all under target/release-evidence/.

Rejected JPEG sparse chroma masks — 2026-10-05

A separate worktree at d5ddebbe83d067be16f49eb13c4f29603faa55d5 implemented fused chroma nonzero masks and a separate sparse Cb/Cr entropy loop for complete I420 MCUs without low-quality trimming. The prototype is rejected and reverted; the main encoder remains unchanged. Its exact source and patch are preserved locally for review of the rejected prototype.

The ARM64 macOS 15.7.7 campaign used rustc 1.96.1, ordinary Cargo release builds, and the pinned TurboJPEG 3.2.0 oracle. No LTO, target-cpu, PGO, or TurboJPEG SIMD disabling was added. Single-threaded complete public calls use the existing twenty configurations, forty encode/decode workloads, and Rust harness's 100-call warmup; per-invocation iteration counts and timings are retained. Five rounds alternate baseline/candidate order, with the unchanged oracle following each variant. All 800 raw records retain commands, timing, output hashes, order, and background-load observations. Source, binary, and oracle hashes remained unchanged. CPU brand/model queries were unavailable; recorded background load was nonzero, so this is a scoped host observation.

All seven admitted encode configurations regress in every paired round. The table gives medians of paired candidate/baseline time ratios; values above one are slower. Oracle normalization retains the same regression decision.

Encode workload	Candidate / baseline	Oracle-normalized ratio
32×32 Q85 I420	1.1585	1.1587
128×128 Q50 I420	1.0494	1.0413
128×128 Q85 I420	1.1222	1.1243
128×128 Q100 I420	1.2138	1.1838
512×512 Q85 I420	1.2125	1.2083
1024×1024 Q85 I420	1.2366	1.2138
128×128 Q85 I420, restart interval 4	1.1085	1.1325

Controls varied: odd 63×65 encoding was 0.9805, I444 encoding 1.0008, 512×512 Q10 encoding 1.0927, and 1024×1024 decoding 0.9928. These controls are retained alongside the regressions. Mask-construction overhead and lost six-chain instruction overlap are plausible causes, without stage-level proof. No encoder, decoder, SSE2, AVX2, or universal speedup is claimed.

Correctness still passed: emitted JPEG bytes matched the baseline for all twenty configurations; the existing public manifest passed 81/81 encode rows (379 calls, zero panics) and 205/205 decode rows; strict all-feature/all-target Clippy passed.

The preserved candidate source SHA-256 is 283be8d25af57b67396f3a08742586532c539593cbb5095cd6b0dcc78e912321; patch SHA-256 is b541f59801c0a84d7ae4510ab292943a28779fc3046661896b9543a247558556. Local evidence is under target/release-evidence/jpeg-sparse-chroma-d5ddebbe/: rejection.json, candidate-source.rs, candidate.patch, build/check logs, and paired-five-rounds/{metadata.json,raw.jsonl,summary.json,summary.csv,exact-encode-equality.json}. These local artifacts are not shipped release benchmark results. The next candidate must preserve instruction overlap or identify a different measured cost, then pass the same correctness and complete-call measurement gates.

Rejected JPEG bounded entropy arithmetic — 2026-10-05

An isolated candidate based on e070f9cef79005c5b832ebb78db0fee3eb192cf6 replaced three saturating operations with locally bounded arithmetic: available reservoir space, the post-capacity-check word count, and the AC zero run. The source-bound ARM64 object showed saturation selects for these expressions, but did not quantify their share of elapsed time. Six-chain scheduling, quantization, storage, and output contracts were unchanged.

Two whole-call campaigns each completed forty workloads and five balanced rounds, with the second reversing the starting order: 1,600 raw records in total. Both retained exact equality for all twenty encoded benchmark JPEGs. Strict Clippy and the public Pillow manifest passed 81/81 encode rows and 205/205 decode rows. The ordinary release builds used Rust 1.96.1 on macOS 15.7.7 ARM64 and the pinned TurboJPEG 3.2.0 timing oracle, with single-threaded operation loops. CPU brand/model and memory queries were unavailable; nonzero background load is recorded in each campaign. Inputs, source, executables, and oracle hashes stayed unchanged during each campaign.

Each table value is the median of five paired round ratios. Candidate/baseline ratios below one mean lower elapsed time. Normalized ratios also divide each target measurement by its following oracle measurement.

RGB I420 encode workload	First ratio	Reversed ratio	Normalized first / reversed
63×65 Q85	1.0092	1.0122	1.0067 / 1.0095
128×128 Q100	1.0214	1.0135	1.0198 / 1.0337
512×512 Q85	1.0169	1.0048	1.0122 / 0.9981
1024×1024 Q85	1.0167	1.0131	0.9955 / 1.0129
512×512 Q10	0.9852	0.9479	0.9839 / 0.9511

Regular RGB inputs repeatedly regressed despite gains on some low-quality and CMYK inputs. Decode controls also varied. The combined candidate is rejected; these results do not isolate an individual expression's cost or establish an SSE2/AVX2 result. The encoder was restored byte for byte, and the clean managed worktree was archived after independent preservation checks. No candidate source reached main.

The retained bundle target/release-evidence/jpeg-bounded-entropy-e070f9ce/ contains both executables, source and patch snapshots, harness files, inputs, both complete campaigns, comparison.json, comparison.csv, rejection.json, and preservation.json. Candidate source SHA-256: 71942749a3545ed9323573abc8a60c9c9a59ca6a9234f8e992798ed3a375c36f; restored encoder SHA-256: 5451cb6570679fe9ea13b385900e5270581220e35cf1993c09eeb0b1a799afab.

SSE2/AVX2 runtime evidence and JPEG profile — 2026-10-05

At pushed revision d5ddebbe83d067be16f49eb13c4f29603faa55d5, CI run 37263569622 completed successfully. Both SSE2 and AVX2 public JPEG/AVIF encode/decode parity lanes passed with branch coverage; aggregate coverage floors, strict lint, feature/target checks, and dependency checks also passed. The x86 coverage artifact retains eight reports. Their numerical totals have not been inspected locally, so this establishes runtime parity and passed floors.

Benchmark run 37263569657 also passed five rounds each of SSE2 and AVX2 on the same Ubuntu host, covering 20 configurations and 40 workloads. All 40 comparisons retained equal output lengths and hashes. Downloading its timing artifact requires authenticated access (HTTP 401), so no relative speed or speedup is claimed from this run.

A source-bound ARM64 profile at that revision sampled the complete 1024×1024 RGB Q85 I420 encode call for 12 seconds. Its receipt records source hashes, binary SHA-256, build flags, and the owned process; the source remained unchanged through sampling. Streaming encoding represented 84.56% of observed top-of-stack samples, RGB conversion 9.11%, and external FDCT 6.20%. Exact binary/object/DWARF matching maps representative streaming addresses to Cb AC coefficient reads, zero-run handling, and the bit reservoir. Collapsed samples prevent assigning a precise entropy fraction. Sampling is not a timing benchmark.

The profile motivated collecting sparse chroma AC masks during quantization and enumerating their zigzag positions. The experiment above rejects that prototype after complete-call measurement. Any future implementation must preserve ZRL/EOB, DC prediction, byte stuffing, and restart semantics, then pass exact public parity and balanced complete-call measurements. Dense-image mask overhead is part of the measured rejection above; no optimization is retained from this profile. Halving the measured conversion bucket would permit approximately 1.048× overall speedup, while the sparse-scan candidate's affected fraction is unknown.

Local receipts: target/release-evidence/jpeg-profile-d5ddebbe/receipt.json, analysis.md, analysis-offset-mapping.json, and analysis-ci-terminal.json; remote benchmark metadata: target/release-evidence/simd-remote-d5ddebbe/.

Unreachable AVIF Full-chroma Horizontal16x4 cleanup — 2026-10-05

Both current callers of Lossy420Decoder::decode_following_vertical belong to the H4 composer. Each receives a local with_qindex state initialized to Subsampled420, dimensions (16, 4), and absent full-edge state. Intervening methods do not change sampling; the callback receives only the range decoder. The sole Full-sampling setter, decode_origin_full, is outside this local path. The Full-chroma Horizontal16x4 predicate therefore cannot succeed for any current caller, independently of coverage observations.

The removed cluster consists of that reconstruction arm, reconstruct_following_lossy_full_vertical_16x4_leaf, reconstruct_lossy_full_16x4_chroma_normalized_target, and their exclusively owned right_edge_4_for_16x4 accessor. It removes 580 source lines and three separator blanks. Exact comparison against f46efa4b3eee82b9c33e5cd3fe1911a7ad2d16f5 confirms only those four ranges were deleted: every retained byte is unchanged. The live 4:2:0 arm, entire vertical decoder, H4 composer, and their safety checks remain. This proof does not justify deleting the complete fallback method.

The source proof is retained in target/release-evidence/avif-vertical-h16x4-cleanup-f46efa4b/proof.json. No cfg guard or source coverage exclusion changed. The full all-feature campaign, strict debug/release/coverage and x86 SIMD Clippy gates, formatting, static verification, and all 33 feature lanes pass. Ordinary Pillow rows and target-only fault rows are unchanged. This source cleanup is not a measured AVIF throughput improvement.

Complete source accounting and unreachable Square8 cleanup — 2026-10-05

The preceding full report still contained 42 source coverage(off) attributes. This cleanup removes all 42, including defensive production checks, and the unused nightly coverage-attribute feature gates. make verify now rejects source coverage exclusions in Rust files under src and tests, preventing those attributes from silently shrinking later denominators.

Source review proves the older lossy four-Square8 fallback is unreachable: public root contexts retain level zero or one; its exact frame class is absent from closed_class admission, and the alternative vertical-pair admission requires context level three. The complete frame decoder already handles the two public Square8 inputs. The obsolete predicate, dispatch branch, and composer are deleted, removing 208 lines and one coverage guard. Shared vertical helpers and the H4 callers remain.

The subsequent full campaign passes all public parity and twenty target-only fault-contract rows. make lint, make lint-x86-simd, and all 33 feature/target lanes also pass. Coverage is rebaselined at the four totals above; source accounting and deletion changed the denominators, so their difference from the previous report is not an incremental execution gain. The 100% target remains open. These edits introduce no codec optimization or new runtime speed claim.

The x86 CI benchmark lane also gains an explicit Linux POSIX feature macro for its strict C11 timing harness. The native strict C build and a timing smoke invocation pass on ARM64 macOS; Linux compilation and SSE2/AVX2 runtime results remain pending the pushed workflow. The fixture encoder patch retains its semantics after whitespace normalization; reverse application checks pass against the pinned patched libavif tree.

Report: target/release-evidence/coverage-current-source-accounting-20261005.json.

AVIF skipped CDEF color/alpha public parity — 2026-10-05

decode:avif:multitile_skipped_cdef_color_alpha is a complete 128×64 RGBA input with two tile columns in each color and monochrome-alpha item. The independent libaom default-CDF writer selects unpartitioned 64×64 DC blocks with skipped transforms. Frame headers retain enabled CDEF syntax with zero strengths, while skipped blocks omit the region index. Pinned Pillow 12.2.0 accepts the file and supplies exact pixels; the public matrix runner passes all declared operations. No target fault injection or Rust implementation change is involved.

The new one-case selection passes against the same 481-case AVIF baseline used for the gradient below. Coverage MCP's incremental LCOV line comparison, including the gradient as a previously accepted batch, observes 20 newly covered coordinates and 11,454 overlapping coordinates. The estimated gain is 0.014490 percentage points over the 138,027-line selected-report denominator. The gains include the inactive-block and absent-region-index skips in both color and monochrome tile assembly (frame.rs:2063,2099,2411,2462). Missing source/build receipts and test attribution limit this to coordinate evidence, without a full-suite regression claim. This ordinary-input case belongs to Pillow parity; the twenty typed target-only fault contracts remain a separate outcome lane.

The subsequent full campaign passes all tests and records 18 additional covered lines, 24 branches, zero functions, and 24 regions with unchanged denominators relative to the preceding full report. MCP's full-report branch comparison remains limited by unverified source/build identity; its frame.rs filter observes seven newly covered outcomes, including all four targeted assembly skips. The current report records both outcomes at each target: color active-map 256/4,352, color region-index 68/4, monochrome active-map 256/1,536, and monochrome region-index 24/4. These are report counts, not receipt-bound per-test attribution. make fmt, make verify, make lint, and make lint-x86-simd also pass. The native fixture writer now compiles with -Wall -Wextra -Werror; both generator profiles reproduce their pinned hashes. The SSE2/AVX2 gates are cross-compilation checks on this ARM64 host, with no new runtime speed measurement. The fixture additions change no codec hot path.

Reports:

• target/release-evidence/coverage-avif-existing-minus-square8-gradient-20261005.info
• target/release-evidence/coverage-avif-square8-gradient-new-20261005.info
• target/release-evidence/coverage-avif-skipped-cdef-color-alpha-new-20261005.info
• target/release-evidence/coverage-current-skipped-cdef-20261005.json

AVIF lossy Square8 gradient public parity — 2026-10-05

decode:avif:portable_lossy_420_square8_gradient adds a 16×16 full-range quality-99 RGB gradient with four terminal Square8 leaves and disabled screen-content tools. The pinned libavif 1.4.1/libaom 3.13.2 generator produces identical repeated encodes; pinned Pillow 12.2.0 supplies the exact RGB reference. The public manifest runner passes all declared operations.

The focused LLVM report records three complete lossy-partition decodes, twelve streamed intra leaf decodes, and nine following-leaf decodes. It records zero hits in decode_four_lossy_420_leaves and Lossy420Decoder::decode_following_vertical. The complete frame decoder handles this input before the legacy fallback. Source review also finds that the fallback's closed_class admission omits the lossy square-split predicate; the public root context has level zero or one, while its vertical-pair alternative requires level three. This case therefore protects the complete frame's public pixels without providing a witness for the older square helper.

Both the 481-case existing AVIF selection and the new one-case selection pass. Coverage MCP cannot union these LLVM JSON details with the full report because the detailed observations do not reconcile with the reported totals. Matching LCOV selections instead provide an unverified incremental line estimate: zero newly covered lines, with all 12,177 new-selection line coordinates already covered by the 138,027-line existing-selection inventory. The case is retained for its distinct public gradient regression contract. Missing source/build receipts and test attribution limit the comparison to coordinate evidence; it makes no full-suite regression claim.

Reports:

• target/release-evidence/coverage-avif-square8-gradient-new-20261005.json
• target/release-evidence/coverage-avif-existing-minus-square8-gradient-20261005.info
• target/release-evidence/coverage-avif-square8-gradient-new-20261005.info

AVIF monochrome CDEF region-map reservation fault contract — 2026-10-05

fault-contract:avif:avif_monochrome_cdef_region_map_reservation_failure reuses the existing decode:avif:multitile_monochrome_split_groups complete 128×64 Pillow-success input, SHA-256 57490ef5f80626a3218b96cae9f3e9601ff9db685fc608cd02ad39213638b24c. The ordinary input requests two CDEF region slots. It cannot deterministically choose allocator failure, and Pillow cannot receive the target's injection.

The coverage-only point makes the existing try_reserve_exact request usize::MAX, causing its real capacity failure before resizing the map. The runner requires the public AVIF StillDecode dimensions error and exact message decode: AVIF AV1 validation failed: unable to allocate assembled monochrome CDEF map, then requires a successful retry equal to a fresh uninjected decode. The row uses the existing decode_error_then_retry_succeeds contract and structured diagnostics requirement, with oracle_status: not_applicable. Production builds keep the original reservation count and error path.

The twenty existing contracts and the new one-case selection each pass. Their local receipt confirms unchanged source and Cargo inputs between runs. Coverage MCP's matching LCOV comparison observes five newly covered lines, 30,769→30,774/138,310, a 0.003615 percentage-point incremental estimate. The selected LLVM region scan finds no remaining gap in the allocation error closure. MCP still labels source/build identity unverified and test attribution unknown; the coordinate union does not establish a full-suite coverage result. The added hook brings the origin inventory to 136 exact cfg(coverage) guards across 20 Rust files, without source exclusions.

Reports:

• target/release-evidence/cdef-region-map-baseline-twenty-20261005.lcov
• target/release-evidence/cdef-region-map-selected-one-20261005.lcov
• target/release-evidence/cdef-region-map-selected-one-20261005.json
• target/release-evidence/cdef-region-map-incremental-receipt-20261005.json
• target/release-evidence/coverage-mcp-cdef-region-map-incremental-20261005.json

AVIF monochrome CDEF active-map reservation fault contract — 2026-10-05

fault-contract:avif:avif_monochrome_cdef_active_map_reservation_failure reuses the active decode:avif:multitile_monochrome_split_groups Pillow stimulus, which enables CDEF for a split monochrome frame. Its coverage-only failpoint targets the later cdef_active.try_reserve_exact allocation, after the CDEF region map and loop-filter metadata reservations. The public AVIF StillDecode dimensions error is checked, then a fresh retry must match an uninjected decode. The row uses oracle_status: not_applicable; the injected failure remains outside Pillow parity counts.

The new fault case and the nineteen-case baseline each passed through test_fault_contract_matrix. Coverage MCP's LCOV incremental line comparison observed five newly covered lines in frame.rs and estimated a 0.003622 percentage-point gain over the 138,027-line selected-report denominator. MCP marks the estimate limited because source/build receipts and test attribution are missing. The branch comparison is incomparable because exact branch detail is unavailable, so this is selected-run coordinate evidence, not a full-suite coverage claim.

Reports:

• target/release-evidence/coverage-fault-contracts-existing-nineteen-minus-cdef-20261005.info
• target/release-evidence/coverage-fault-contract-monochrome-cdef-active-map-new-20261005.info
• target/release-evidence/coverage-current-fault-contracts-20261005-cdef-active-map.json

AVIF monochrome CDEF invalid sample-depth fault contract — 2026-10-31

fault-contract:avif:avif_monochrome_cdef_invalid_sample_depth_rejected reuses the active decode:avif:coverage_monochrome_multitile_loop_cdef_active_8bit_128x64 Pillow parity fixture. Its coverage-only hook changes the CDEF filter parameter depth to 7 immediately before the shared filter, reaching the maximum_sample range rejection. The integration contract checks the public AVIF StillDecode malformed error, then verifies that a clean retry succeeds. The row is target-only with oracle_status: not_applicable; it does not add a Pillow parity observation or a release-build hook.

The exact selected test_fault_contract_matrix case passed. The retained LLVM JSON has no baseline observations for the invalid-depth edge at cdef.rs:317; the selected report records that edge after the injected depth 7. Coverage MCP's incremental comparison was unavailable because its transport closed; this is selected branch-coordinate evidence, not a full-suite coverage claim.

Reports:

• .coverage-mcp/local-evidence/full/20261031-av1-monochrome-multitile-active-loop-cdef-current/coverage.json
• .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-cdef-invalid-sample-depth-final/coverage.json
• .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-cdef-invalid-sample-depth-final/coverage.local-evidence.json

AVIF monochrome CDEF direction-depth fault contract — 2026-10-31

fault-contract:avif:avif_monochrome_cdef_direction_invalid_sample_depth_rejected uses the same active monochrome CDEF Pillow parity fixture. Its coverage-only hook passes bit depth 7 to direction_for_block, which rejects the invalid depth and returns the normal AVIF StillDecode malformed error. The contract checks that error and a successful clean retry. The fault row remains target-only with oracle_status: not_applicable.

The selected integration case passed. The retained LLVM JSON records the invalid-depth branch at cdef.rs:72, which had no observations in the full baseline. Coverage MCP's incremental comparison remains unavailable because its transport closed; this selected report provides local branch-coordinate evidence only.

Reports:

• .coverage-mcp/local-evidence/full/20261031-av1-monochrome-multitile-active-loop-cdef-current/coverage.json
• .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-cdef-direction-invalid-sample-depth-final/coverage.json
• .coverage-mcp/local-evidence/selected/20261031-avif-monochrome-cdef-direction-invalid-sample-depth-final/coverage.local-evidence.json

AVIF monochrome CDEF input-guard sweep fault contract — 2026-10-31

fault-contract:avif:avif_monochrome_cdef_input_guard_sweep_rejected reuses the active monochrome CDEF Pillow parity input. A coverage-only hook checks 19 invalid private calls across block geometry, source and output lengths, sample depth, direction, empty sample dimensions, and deliberately unavailable taps. The public decode reports the malformed-input contract with the exact message decode: AVIF AV1 validation failed: invalid AV1 bitstream: CDEF guard sweep rejected 19 invalid inputs; the row then verifies that an uninjected retry succeeds. Its oracle status is not_applicable, so the injected result remains separate from Pillow parity.

A combined selected run of 12 active AVIF Pillow parity rows and the three CDEF fault contracts passed all 15 rows. The current-source LLVM report records 66/66 CDEF branch outcomes, including the zero-variance and low-nonzero- variance outcomes in adjust_primary_strength. Source and fixture hashes were stable during the run. Coverage MCP returned Transport closed, so these are local selected-report counts rather than an MCP source/build receipt or a full-suite claim.

Reports:

• .coverage-mcp/local-evidence/selected/20261031-avif-cdef-parity-and-guards-current/coverage.json
• .coverage-mcp/local-evidence/selected/20261031-avif-cdef-parity-and-guards-current/coverage.local-evidence.json

AVIF color CDEF active-map extent fault contract — 2026-11-01

fault-contract:avif:avif_color_cdef_active_map_extent_mismatch_rejected reuses the active decode:avif:coverage_i420_intra_cdef_10bit_16x16 Pillow parity input. A coverage-only hook shortens the decoded CDEF active map by one entry immediately before the existing extent guard. The public AVIF StillDecode malformed-input error is checked, followed by a successful clean retry. The injected row has oracle_status: not_applicable and is kept separate from the parity result.

The selected fault-contract run passed 1/1, and a separate selected parity run passed 1/1 with exact 768-byte pixel parity. LLVM coverage shows the active-map extent guard's rejection edge taken once in the injected run and zero times in the parity-only run. Both local receipts report unchanged source and fixtures. Coverage MCP returned Transport closed, so these reports are local evidence, not managed attribution or a full-suite coverage claim. Source and fixture SHA-256 values were 349ae3a00776d6827e1716dbe7f5ed746238e063a961b465d615b7018dfcf139 and 3407c458add1348d2e0f0a73f8aaaa862fd435a18eb7c563b8461d89541656d2.

Reports:

• .coverage-mcp/local-evidence/selected/20261031T230625.055415Z-3a1ada4568c748c4a0bbe6b67a063193/coverage.json
• .coverage-mcp/local-evidence/selected/20261031T230625.055415Z-3a1ada4568c748c4a0bbe6b67a063193/coverage.local-evidence.json
• .coverage-mcp/local-evidence/selected/20261031T230732.716490Z-f3360f66ccd243dfab6b2c073b19f131/coverage.json
• .coverage-mcp/local-evidence/selected/20261031T230732.716490Z-f3360f66ccd243dfab6b2c073b19f131/coverage.local-evidence.json

AVIF color CDEF strength-count guard fault contracts — 2026-11-01

The AV1 parser derives color CDEF strength counts from the parsed strength arrays, whose syntax allows one through four entries. The target-side FrameCanvas::apply_cdef guard also checks those counts against the arrays. Coverage review found that separate count > array.len() comparisons repeated the upper bound for the fixed [u32; 4] arrays; the guard now uses each array's length as the range upper bound, preserving the accepted values without unreachable comparison branches. Two target-only cases exercise the invalid-count path, which ordinary valid bitstreams cannot express: fault-contract:avif:avif_color_cdef_invalid_y_strength_count_rejected sets only the Y count to zero, and fault-contract:avif:avif_color_cdef_invalid_uv_strength_count_rejected sets only the UV count to zero. A third case, fault-contract:avif:avif_color_cdef_active_strength_index_out_of_range_rejected, sets an active region index to the first value beyond the Y and UV strength counts. All three hooks exist only under #[cfg(coverage)] and reuse decode:avif:coverage_i420_intra_cdef_10bit_16x16. The runner checks the public StillDecode errors decode: AVIF AV1 validation failed: invalid AV1 bitstream: CDEF strength counts are invalid for the count cases and decode: AVIF AV1 validation failed: invalid AV1 bitstream: CDEF active region index exceeds strengths for the index case, then confirms each clean retry succeeds. All three rows have oracle_status: not_applicable; the normal input remains a separate Pillow parity row.

The baseline all-active matrix selection passed 3,088/3,088 rows: 2,365 decode, 556 encode, and 167 fault contracts. The target-only fault outcomes remain outside oracle-parity counts. Its selected LLVM report records 96,178/142,952 lines (67.28%), 19,311/31,982 branches (60.38%), 5,228/9,333 functions (56.02%), and 146,535/221,847 regions (66.05%). In raster.rs, it records 1,982/4,674 lines (42.40%) and 308/904 branches (34.07%). These are all-active parity/fault-matrix figures, not full test-suite coverage or a 100% coverage claim. No Coverage MCP tool was exposed in this session, so the report and receipt are local evidence without MCP source/build attribution. The receipt records unchanged source and fixtures during the run, revision 69a79d4c46b3c8598de020e47345ade1b0e1d304, source-manifest SHA-256 cf06eefe697bec96cafe0510654091b7d30cc7742d1c4ae467979369741c64ce, raster SHA-256 9256783ff149ecc1aafc5d52a5aee07f2bce91ef565f226381cedd2f33ca5827, the active parity input SHA-256 3407c458add1348d2e0f0a73f8aaaa862fd435a18eb7c563b8461d89541656d2, and matrix SHA-256 00450f600e2302f654d5452d156134cf3b25b29360545ed4e8e9eed0b0c470f7. That matrix snapshot contains one planned 9x9 CDEF parity case, excluded from the 3,088 executed rows.

Reports:

• .coverage-mcp/local-evidence/selected/20261101T045700.728392Z-707a91ec2a1641dfaf86ccc8a774b6db/coverage.json
• .coverage-mcp/local-evidence/selected/20261101T045700.728392Z-707a91ec2a1641dfaf86ccc8a774b6db/coverage.local-evidence.json

AVIF odd-edge color CDEF parity — 2026-11-01

The pinned 9x9 and 9x16 10-bit I420 fixtures coverage_i420_intra_cdef_10bit_9x9 and coverage_i420_intra_cdef_10bit_9x16 are active pixel-parity regressions with Pillow 12.2.0/libavif 1.4.1 RGB references. Both have active single-entry CDEF. The 9x16 fixture combines a partial horizontal block with an aligned vertical extent, exposing a failure hidden by the 9x9 fixture's repeated edge samples.

The earlier visible-edge extension matched the 9x9 output but differed in 94 of 432 RGB bytes for 9x16. The entropy walker had reconstructed the complete 16x16 coded canvas, then cropped it before CDEF. Retaining that canvas through CDEF and cropping after filtering restores exact parity for both fixtures. Super-resolution retains its filtered padding for its subsequent resize stage. The temporary plane traces and diagnostic example were removed.

The initial two-case reproducer passed 2/2 active rows. After removing the diagnostics, the related CDEF/super-resolution selection passed 35/35 parity rows. A separate selection passed 13/13 CDEF fault contracts with oracle: not_applicable; those results are not counted as Pillow parity. Native strict lint and the SSE2/AVX2 compile checks passed. The static origin inventory now accounts for all 267 coverage guards across 36 files, including the six color-CDEF defensive guards omitted from its previous receipt.

Coverage MCP's branch-gap inspection of frame_coordinate::<true> reports only the unreachable arm of its compile-time generic condition as missing. No coverage exclusions were added. This is selected-case evidence; it does not establish full-suite coverage or decoder performance. The local LLVM reports have unverified source provenance and unknown test attribution in Coverage MCP.

Reports:

• Parity: .coverage-mcp/local-evidence/selected/20261101T053933.226263Z-280a3c48d1c341c88ad8b5535deb42e9/coverage.json
• Parity receipt: .coverage-mcp/local-evidence/selected/20261101T053933.226263Z-280a3c48d1c341c88ad8b5535deb42e9/coverage.local-evidence.json
• Fault contracts: .coverage-mcp/local-evidence/selected/20261101T054059.940791Z-fece9c294b48459c837820cd50c7c44c/coverage.json
• Fault receipt: .coverage-mcp/local-evidence/selected/20261101T054059.940791Z-fece9c294b48459c837820cd50c7c44c/coverage.local-evidence.json

AVIF grid and monochrome assembly fault contracts — 2026-10-05

Two target-only rows use existing active Pillow parity inputs as reproducible stimulus. fault-contract:avif:avif_grid_cell_reservation_failure uses decode:avif:grid, an 80×80 color grid with per-cell alpha. Grid assembly now uses fallible try_reserve instead of Vec::with_capacity, preserving the normal reservation size while returning the public AVIF StillDecode dimensions error on allocation failure. Its coverage-only failpoint forces that error, and the runner confirms a fresh retry matches an uninjected decode.

fault-contract:avif:avif_monochrome_loop_filter_metadata_reservation_failure uses decode:avif:multitile_monochrome_split_groups. It forces the assembled monochrome loop-filter metadata reservation to fail, checks the public StillDecode dimensions error, and verifies retry output against a fresh decode. Both rows use oracle_status: not_applicable; their injected outcomes remain separate from Pillow parity counts.

The 17-case existing-fault baseline and the two-case new selection each passed through test_fault_contract_matrix. Coverage MCP's LCOV incremental line comparison observed 923 new line coordinates, a 0.668744 percentage-point gain over the 138,020-line selected-report denominator; 15,044 coordinates were already covered. MCP marks this estimate limited because the reports have no source/build receipts or test attribution. Its branch comparison was incomparable because exact branch detail was unavailable, so these figures are selected-run coordinate evidence, not full-suite coverage claims.

Reports:

• target/release-evidence/coverage-fault-contracts-seventeen-baseline-20261005.info
• target/release-evidence/coverage-fault-contracts-two-new-20261005.info

AV1 projected temporal-field reservation fault contract — 2026-10-05

The target-only row fault-contract:avif:avif_projected_temporal_field_reservation_failure reuses decode:avif:animated_motion_chroma, whose inter frames enable reference-frame MV projection. Its cfg(coverage) failpoint forces ProjectedTemporalField::new's reservation to fail and asserts the exact AVIF SequenceDecode dimensions diagnostic, then verifies a fresh retry matches an uninjected sequence decode. The new contract passed 1/1; the existing sixteen contracts passed 16/16 in the selected baseline. Its oracle is not_applicable, so it remains outside Pillow parity totals.

Coverage MCP compared the selected LCOV reports in incremental line mode: four newly observed coordinates (0.002898 percentage points), with 19,478 already covered. In the sixteen-case baseline, the allocation-error mapping at motion.rs:2999 was missing; it is observed by the new contract. MCP marks the estimate limited because source/build receipts and test attribution are unavailable.

Reports:

• target/release-evidence/coverage-fault-contracts-existing-sixteen-20261005.info
• target/release-evidence/coverage-fault-contract-projected-field-new-20261005.info
• target/release-evidence/coverage-full-active-goal-20261005-projected-field.json

The public row decode:avif:coverage_lossy_420_square8_four_leaves_01 pins a lossy 4:2:0 16×16 AVIF with a four-Square8 AV1 partition trace and exact Pillow RGB output. It passed 1/1, and its same-target baseline comparison against the other 480 active AVIF decode rows found zero newly covered lines. The frame's allow_screen_content_tools flag fails the specialized closed-frame gate, so this row is retained as a public parity regression only; it is not claimed as coverage for decode_four_lossy_420_leaves or decode_following_vertical. MCP's selected report remains source-unverified and test attribution unknown.

Reports:

• target/release-evidence/coverage-avif-existing-480-20261005.info
• target/release-evidence/coverage-avif-lossy-square8-new-20261005.info

AV1 tile assembly and partition-node reservation fault contracts — 2026-10-05

Two target-only cases exercise deterministic AV1 allocation failures through the shared fault-contract runner. The assembled loop-filter metadata contract reuses decode:avif:multitile_color_split_groups; the partition-node contract reuses decode:avif:baseline. Each case checks the public AVIF StillDecode dimensions error for its named allocation failure, then verifies that a fresh decode retry matches the clean result. Both use oracle_status: not_applicable and remain excluded from Pillow parity counts.

The selected runner passed both new contracts (2/2); a same-source selected baseline run passed the other fourteen contracts (14/14). Coverage MCP compared their LCOV reports in incremental line mode: 7 newly observed line coordinates, 14,410 already covered, and a limited 0.005072 percentage-point estimate. MCP marks the comparison limited because source/build receipts and test attribution are unavailable. Its selected report has no remaining line gaps in PartitionWalker::push, and no region gap at the assembled metadata error mapping or branch gap at its injection check. The rest of assemble_color_tiles retains unrelated uncovered regions.

Reports:

• target/release-evidence/coverage-fault-contracts-existing-fourteen-20261005.info
• target/release-evidence/coverage-fault-contracts-new-two-20261005.info
• target/release-evidence/coverage-fault-contract-assembly-partition-20261005-confirmed.json

AV1 tile block metadata reservation fault contract — 2026-10-05

The target-only row fault-contract:avif:avif_tile_block_metadata_reservation_failure reuses the active decode:avif:baseline input. Its coverage-only failpoint forces the per-tile decoded-block metadata reservation to fail and checks the public AVIF StillDecode dimensions error, then verifies that an uninjected retry matches a clean decode. The selected contract passed 1/1; all twelve earlier fault contracts also passed in their selected batch, and the full run passed all thirteen. Its oracle status is not_applicable, so it remains separate from Pillow parity counts.

Coverage MCP's same-target LCOV incremental comparison starts from the 56-test coverage-matrix baseline without its fault-contract runner, then unions the twelve existing fault contracts and this new row. It reports four newly observed line coordinates (0.002899 percentage points) in tile_state.rs. MCP marks the result limited because the reports have no source/build receipts or test attribution. The full all-feature report has no remaining region gap at the new reservation error path.

AV1 chroma tile-cell reservation fault contract — 2026-10-05

The target-only row fault-contract:avif:avif_chroma_tile_cell_reservation_failure reuses the active decode:avif:baseline input. Its coverage-only failpoint runs after the luma cell allocation succeeds and forces chroma-cell reservation to fail. The contract checks the distinct public AVIF StillDecode dimensions diagnostic, then verifies an uninjected retry matches a clean decode. The selected case passed 1/1; its oracle status is not_applicable and it does not contribute to Pillow parity counts.

The same-target LCOV incremental comparison adds this row after the thirteen existing fault contracts and reports three newly observed line coordinates (0.002174 percentage points) in tile_state.rs. MCP marks the comparison limited because the local reports have no source/build receipts or test attribution. The full report has no missing branch at the injection check and no remaining region at the public error mapping.

AV1 film-grain parity and restoration fault contracts — 2026-10-05

The public parity row decode:avif:animated_filmgrain_reference_reuse_i444_64x64 uses a two-frame full-resolution I444 sequence. The first key frame refreshes film-grain parameters into reference slot 0; the second displayed inter frame sets update=false, reuses slot 0, and supplies a new seed. Pinned Pillow 12.2.0/libavif 1.4.1 decodes both frames. The selected Rust parity run passed 1/1, including exact per-frame pixel references.

The public row decode:avif:portable_lossless_filmgrain_420_chroma_from_luma_64x64 adds a lossless I420 key frame with chroma_scaling_from_luma=true, non-empty Y scaling points, and empty U/V point arrays. The generator preserves the tile payload and item extent, validates the rewritten syntax with the independent OBU inspector, and pins the exact Pillow RGB output. Its selected Rust parity run passed 1/1. Coverage MCP reports no remaining branch gap at the read_film_grain chroma-scaling gate (frame.rs:4277) in the full AVIF matrix.

The public row decode:avif:portable_lossless_filmgrain_420_zero_y_points_64x64 exercises a valid 8-bit I420 key frame whose film-grain syntax has num_y_points == 0 and CFL disabled. AV1 infers empty U/V point tables and omits luma AR coefficients for this 4:2:0 syntax. The deterministic generator preserves the tile payload and item extent, validates the rewritten OBU independently, and pins Pillow's exact 12,288-byte RGB output (5d35ab50438b9f1536ef7de3cbca8ac3d01360efa9d77446dfe0d69786d2fb62). The selected public parity row passed 1/1. The decoder now accepts this legal case, retains a zero luma-grain LUT for active chroma consumers, and skips Y plane writes when no Y points are present. With no active chroma points, it returns after geometry and parameter validation without allocating grain LUTs.

This case exposed an admission gap: lossless non-super-resolution inter reconstruction rejected all film-grain frames before producing a color surface. The decoder now admits only bounded full-resolution I444 grain for that lossless profile. Grain remains display-only and retained reference samples remain ungrained. The bounded geometry and depth checks match the existing display materializer.

The target-only row fault-contract:avif:avif_sgr_intermediate_reservation_failure injects a deterministic reservation failure in SGR intermediate allocation while decoding the active decode:avif:animated_lossy_inter_420_superres_sgr_8bit_160x56 input. It asserts the public allocation error classification and retry behavior; its oracle status is not_applicable. The selected new fault case passed 1/1. The target-only row fault-contract:avif:avif_restoration_stripe_scratch_reservation_failure uses the active decode:avif:high_bitdepth sequence. Independent OBU inspection confirms a 64×64, non-super-resolution, single-tile frame with restoration enabled, which reaches striped restoration. The reservation hook forces the scratch reservation to fail; ordinary allocation failure now reports the typed Dimensions resource error rather than malformed input. The contract asserts the exact SequenceDecode diagnostic and verifies retry against a fresh sequence decode. Its oracle status is not_applicable, and the selected fault case passed 1/1.

The target-only row fault-contract:avif:avif_restoration_stripe_output_reservation_failure uses the active decode:avif:high_bitdepth sequence. A cfg(coverage) failpoint forces the striped-restoration output reservation to fail before stripe scratch is allocated. The public result must be a typed Dimensions error at SequenceDecode, and a fresh retry must decode the same reference sequence. Its oracle status is not_applicable, and the selected fault case passed 1/1. Coverage MCP's selected-test branch comparison against the scratch-reservation control found one newly observed arm at the output-reservation failpoint (restoration.rs:221–223). The scratch-control arm at restoration.rs:254–256 was not observed in the output-failure run because that failure returns before scratch reservation. MCP source/build identity remains unverified, so these are coordinate observations rather than a verified aggregate coverage gain.

The target-only row fault-contract:avif:avif_tile_cell_reservation_failure uses the active decode:avif:baseline input. A cfg(coverage) failpoint forces the AV1 tile cell reserve to fail; the contract checks the exact public Dimensions diagnostic at StillDecode, then confirms a fresh retry matches a clean decode. Its oracle status is not_applicable, and the selected contract passed 1/1. The coverage-origin inventory now records 128 exact guards across 20 Rust files; the new reservation hook is classified as defensive_model.

The focused film-grain parity rows passed 3/3; all twelve target-only fault contracts passed 12/12 in the full all-feature campaign. The complete AVIF decode matrix passed 480/480, and the AVIF edit-list repetition witness passed after its artifact index was updated to include the new verified loop sample. The current full report is target/release-evidence/coverage-zero-y-filmgrain-tile-cell-20261005.json.

Coverage MCP scope: incremental, metric lines, reports five newly observed coordinates for the zero-Y parity row (0.003624 percentage points) and three for the tile-cell fault contract (0.002174 percentage points). The comparisons use the same-source selected reports target/release-evidence/coverage-baseline-zero-y-filmgrain-final-20261005.info, target/release-evidence/coverage-filmgrain-zero-y-i420-final-20261005.info, target/release-evidence/coverage-baseline-fault-contract-tile-cell-20261005.info, and target/release-evidence/coverage-fault-contract-tile-cell-final-20261005.info. MCP marks them source-unverified with unknown test attribution, so both gains are limited coordinate estimates. Branch-detail unions are incomparable. Invalid reference and point syntax remains outside the positive Pillow parity lane; the twelve remaining read_film_grain branch observations need separate input-reachability review. The current full report also leaves normal SGR regions uncovered, including 36 in sgr_intermediates and 23 in restore_sgr_plane; the striped restoration contract covers its allocation failure outcome only. The earlier film-grain, SGR, and stripe reports are preserved as historical measurements. Earlier reports: target/release-evidence/coverage-baseline-filmgrain-existing-20261005.json, target/release-evidence/coverage-filmgrain-reference-reuse-20261005.json, target/release-evidence/coverage-filmgrain-cfl-i420-20261005.json, target/release-evidence/coverage-baseline-faults-existing-20261005.json, and target/release-evidence/coverage-fault-contract-sgr-intermediate-20261005.json.

A prior full all-feature report and its dated observations are retained below for historical context.

A later coverage_matrix_tests integration-target run completed 56/56 tests on the 1,981-row matrix. Its parity-target report is target/release-evidence/coverage-parity-matrix-final-20261004.json: 85,100 / 142,526 lines (59.7084%), 16,699 / 32,240 branches (51.7959%), 4,652 / 8,990 functions (51.7464%), and 130,211 / 220,521 regions (59.0470%). This report is separate from the broader all-feature report above.

AVIF display-plane allocation fault contract — 2026-10-04

fault-contract:avif:avif_display_plane_copy_allocation_failure injects a one-shot allocation failure immediately before AV1 display-plane copy reservation while decoding the existing decode:avif:baseline input. It asserts the public Dimensions / AVIF / still-decode error and a successful retry. The case is indexed in the shared matrix with a not-applicable oracle; it does not add to Pillow parity counts. The selected all-feature coverage run passed 1/1 and wrote target/release-evidence/coverage-fault-contract-avif-20261004.json (1,972 / 32,244 branches for that selected run). Coverage MCP reports no remaining branch gap at src/codecs/avif/av1/surface.rs:174.

For Coverage MCP incremental comparison, a same-source baseline was captured with test_fault_contract_matrix skipped; its remaining 56 integration tests passed. The compare call is incomparable: LLVM detailed observations do not reconcile with report totals, and these reports have no source/build receipts or test attribution. No marginal coverage gain is claimed from that comparison.

AVIF still-brand sequence parity — 2026-11-07

Added input-driven parity row decode:avif:animated_sequence_still_major_brand. Its reproducible fixture changes only the ftyp major brand of the existing four-frame animated_motion_chroma.avif sequence from avis to avif. Pinned Pillow 12.2.0 exposes the result as a single 32×32 RGB still image (3,072 bytes). The sequence API now selects the primary-image path before extracting sequence tracks for avif major-brand files, so it does not reserve or decode the hidden frames.

The parity harness also verifies this image under a one-frame policy with a 3,072-byte sequence-output limit. It passed the Pillow pixel-parity row (1/1) and the retained frame-count and mode fault contracts (2/2); each contract retries the ordinary four-frame avis sequence after checking its injected error. The selected LLVM report records both outcomes of the frame-count comparison (1 true, 5 false) and mode comparison (1 true, 4 false) at src/codecs/avif/decode.rs:242.

Report: .coverage-mcp/local-evidence/selected/20261107T111349.187247Z-87167ab9bddc466388b2e599cb8147f6/coverage.json (SHA-256 1d32cbfaae13e9f4f4f36e4fae6370432e1724b255ddd76b853fe6bb0e28c2a8); receipt: .coverage-mcp/local-evidence/selected/20261107T111349.187247Z-87167ab9bddc466388b2e599cb8147f6/coverage.local-evidence.json (SHA-256 ef710cb7cd212dacecc251d7478e46c4cd9a894683e8b337bd6d3ab0d74fdc65). Coverage MCP was not connected, so this is local selected evidence and does not update full-suite coverage totals.

fault-contract:avif:avif_sequence_frames_reservation_failure drives the public sequence decoder with the active decode:avif:animated_motion_chroma fixture (32×32, four frames). The coverage-only failpoint asks Vec::try_reserve for an impossible capacity, which deterministically reaches the existing reservation-error conversion without allocating; the public call must return Dimensions at SequenceDecode, and retry must return all four frames. The selected all-feature run passed both fault contracts (2/2 cases). Against the same-source 56-test parity baseline at target/release-evidence/coverage-parity-baseline-postfmt-20261004.info, the selected combined fault report target/release-evidence/coverage-fault-contracts-postfmt-20261004.info adds 23 line coordinates (0.016688 percentage points). Coverage MCP reports no remaining branch outcomes at src/codecs/avif/decode.rs:231 or :241, the failpoint and reservation-error conversion, nor at src/codecs/avif/av1/surface.rs:174 for the existing still-image fault. Branch-level incremental union is incomparable because LLVM detail does not reconcile with aggregate totals. The reports have no source/build receipts or test attribution, so the line result is a limited estimate rather than a verified causal claim.

AV1 split monochrome tile reservation fault contract — 2026-10-04

fault-contract:avif:avif_monochrome_tile_reservation_failure uses the active decode:avif:multitile_monochrome_split_groups Pillow parity input. Its first tile group exercises the existing incremental monochrome tile-state reserve. The coverage-only fault requests an impossible vector capacity, which reaches the existing Dimensions error conversion without allocating. The selected target-only contract checks StillDecode error classification and that a fresh retry returns the complete decoded image. The injected result remains oracle_status: not_applicable and outside Pillow parity totals. The focused five-case fault-contract lane passed 5/5 contracts, and its instrumented JSON report is target/release-evidence/coverage-fault-contracts-five-20261004.json. Coverage MCP reports no remaining branch outcomes at the new failpoint on src/codecs/avif/av1/frame.rs:1577. The report has no source/build receipts or test attribution, so this is limited coverage-coordinate evidence.

For the new case alone, a same-source 56-test parity baseline skipped test_fault_contract_matrix; those tests passed 56/56. Coverage MCP's incremental comparison against target/release-evidence/coverage-parity-baseline-monochrome-fault-20261004.info estimates 21 newly observed line coordinates, or 0.015235 percentage points. The selected report is target/release-evidence/coverage-fault-contract-monochrome-tile-20261004.info. It remains a limited estimate because source/build identity and test attribution are unavailable.

AV1 super-resolution and JPEG multi-scan allocation fault contracts — 2026-10-04

fault-contract:avif:avif_superresolution_positions_reservation_failure uses the active decode:avif:animated_lossy_inter_420_superres_sgr_8bit_160x56 sequence. The inter frame reaches AV1 super-resolution after the first frame has been decoded. A coverage-only one-shot fault requests usize::MAX positions from the existing try_reserve_exact call, producing its normal Dimensions / AVIF / SequenceDecode error without attempting a large allocation. Retry must return the matrix canvas and frame count, and its full result must equal a fresh uninjected decode.

fault-contract:jpeg:jpeg_multiscan_coefficient_reservation_failure uses the active decode:jpeg:baseline_444_multiscan_duplicate_component input to enter multi-scan coefficient retention. Its coverage-only fault forces the actual try_reserve_exact capacity-overflow path; the public result must be Dimensions / JPEG / StillDecode, and retry must equal a fresh uninjected decode. Both cases use oracle_status: not_applicable and remain outside Pillow parity totals.

The focused all-feature baseline passed 56/56 integration tests with the fault runner skipped. The selected four-case fault lane then passed 4/4 contracts (the two existing AVIF contracts plus these additions). Its LCOV reports are target/release-evidence/coverage-fault-parity-baseline-20261004.info and target/release-evidence/coverage-fault-contracts-new-cases-20261004.info. Coverage MCP's incremental line comparison is limited because the reports have no source/build receipts or test attribution: it estimates 29 newly observed line coordinates, or 0.021040 percentage points. The path-filtered observations include the JPEG coefficient reservation and AV1 position reservation error paths. Branch comparison is incomparable because the available detail does not reconcile with report totals; no branch gain or regression claim is made.

JPEG default Huffman table slot reservation fault contract — 2026-10-14

fault-contract:jpeg:jpeg_huffman_table_slot_reservation_failure reuses the active decode:jpeg:baseline_444_multiscan_late_dht_after_default_scan input. Its first baseline scan reaches the default Huffman table slot reservation before the later DHT marker. A coverage-only one-shot fault requests usize::MAX slots from the existing try_reserve_exact call, taking the capacity-overflow error path without a large allocation. The public result must be Dimensions / JPEG / StillDecode with message decode: unable to allocate JPEG Huffman table slots; retry must equal a fresh uninjected decode. The fault row uses oracle_status: not_applicable and is excluded from Pillow parity totals; only its ordinary source row carries Pillow parity. The selected fault-matrix run passed 1/1 case; its report is .coverage-mcp/local-evidence/20261014/jpeg-huffman-slot-fault/coverage.json. Coverage MCP found no remaining region or branch location at parser.rs:414 in that selection. The report has no build/source receipt and test attribution is unknown, so these are limited selected-coordinate observations; they do not establish an aggregate coverage gain or full-suite coverage.

JPEG YCCK output reservation fault contract — 2026-10-19

fault-contract:jpeg:jpeg_ycck_output_reservation_failure reuses the active odd-sized subsampled YCCK input decode:jpeg:color_ycck_app14_transform_2. The coverage-only one-shot fault requests usize::MAX output bytes from the fallible YCCK result reservation, exercising the public Dimensions / JPEG / StillDecode failure without attempting a large allocation. Retry must match the clean Pillow-parity decode. This target-only contract is recorded with oracle_status: not_applicable; the source image remains the input-driven Pillow parity case.

JPEG bulk entropy refill experiment rejected — 2026-11-04

Native x86 A-B-B-A run 41812150890 compared baseline 3607da286639c16a0cf76c32f09fffcdf8b675be with the committed candidate from PR head 11a4fdf4c3479416ab2f38c86709d36abc4c0ed9. Six primary cohorts completed on both SSE2 and AVX2, and the benchmark's output-identity checks passed. The candidate failed the performance gate: SSE2 primary paired gain was -2.0854% with a -2.6305% minimum guard gain; AVX2 primary paired gain was -4.9570% with a -4.9859% minimum guard gain. Zero of six primary cohorts were faster on either variant.

The largest cases regressed on both variants. SSE2 grayscale 512x512 4:2:0 moved from 2.560 ms to 2.612 ms and 4:2:2 from 2.560 ms to 2.631 ms. AVX2 moved from 2.209 ms to 2.320 ms and from 2.203 ms to 2.317 ms, respectively. Reject the bulk refill implementation and retain the byte-at-a-time reader. Keep the separately validated marker-prefix EOF fault contract; its cfg(coverage) hook is absent from production builds.

JPEG fast bit-reader marker-prefix EOF fault contract — 2026-11-04

fault-contract:jpeg:jpeg_fast_reader_marker_prefix_eof_fallback reuses the public grayscale 4:2:0 input decode:jpeg:grayscale_sampling_420_512x512. The coverage-only one-shot fault ends the logical entropy range immediately after 0xFF, exercising the fast reader's marker-prefix EOF fallback. The public decode must recover to the same bytes as the clean Pillow-parity decode, and a retry must also succeed. The target-only fault is recorded with oracle_status: not_applicable; the source image remains the input-driven Pillow parity case.

JPEG baseline fast-reader metadata guard fallback — 2026-11-04

Five target-only fault-contract cases reuse the clean 4:4:4 baseline input decode:jpeg:subsampling_444. Each changes one parsed-metadata invariant used by single_baseline_scan_entropy_end, forcing the generic entropy path. The public decode must match the stored Pillow pixels, and a clean retry must succeed. These cases exercise scan-count, entropy-start, entropy-end, EOI marker, and final-marker-position guards; they stay outside Pillow parity counts with oracle_status: not_applicable.

The selected run passed 5/5 fault contracts. Coverage MCP found no remaining JPEG branch observations at decode.rs:2997, :2998, :2999, :3000, or :3084 in .coverage-mcp/local-evidence/selected/20261104T144719.716920Z-8adf50c8aa164d419c0c64ca83155691/coverage.json. That report still has source=unverified and tests=unknown, so the branch result is limited to these selected coordinates; it does not establish an aggregate coverage gain or full-suite coverage.

JPEG h1v2 upsampler edge and allocation contracts — 2026-10-19

The public parity row decode:jpeg:baseline_420_chroma_component_sampling_fallback exercises the 1×2 chroma upsampling ratio and passes exact 16×16 RGB parity. Four target-only fault contracts reuse that input to check zero-height and zero-width geometry, a short source plane, and output-plane reservation failure. Each returns the expected public JPEG decode error, then retry matches a clean decode. These rows use oracle_status: not_applicable and remain outside Pillow parity counts.

The selected run passed all five rows and is recorded at target/release-evidence/selected/20261019-jpeg-h1v2-helper-edges-final/coverage.json. Coverage MCP reports no missing branch groups for h1v2_fancy_upsample; it still reports 18 unobserved regions in that function. The report has no source/build receipt and MCP test attribution is unknown, so it is selected-coordinate evidence only. No aggregate coverage gain or full-suite coverage claim is made, and no full coverage campaign was run.

Six YCCK parity rows also pass in the selected report target/release-evidence/selected/20261019-ycck-selected-final/coverage.json. They cover odd- and even-height 4:4:0 vertical row upsampling, luma and K-plane sampling differences, and single-sample h2v1/h2v2 edges. The 17×10 parity case checks the clamped final source row. Coverage MCP reports 3,975/223,112 regions observed overall and 186 unobserved regions in the separate full-plane h1v2_fancy_upsample helper for this YCCK-only selection. This report also lacks source/build identity and test attribution, so it does not establish an aggregate coverage gain. No full coverage campaign was run.

AV1 super-resolution output-plane reservation fault contract — 2026-10-04

fault-contract:avif:avif_superresolution_plane_reservation_failure reuses the active 160×56 AV1 super-resolution sequence after the positions vector has been built. A coverage-only fault requests usize::MAX output samples from the existing plane try_reserve_exact; the public sequence result must be Dimensions / AVIF / SequenceDecode, and retry must equal a fresh clean decode. The fault is recorded with oracle_status: not_applicable and does not contribute to Pillow parity counts.

The final-source baseline selected 472 existing AVIF decode rows and five prior fault contracts; all 57 coverage-matrix harness tests passed. The selected sixth-contract run also passed all 57 tests. Coverage MCP reports the sample-reservation error region at resize.rs:398 as missing in the baseline and absent from the selected-run gap list. Its incremental comparison is incomparable because LLVM detail does not reconcile with report totals. Reports are target/release-evidence/coverage-avif-superres-faults-postfmt-baseline-20261004.json and target/release-evidence/coverage-fault-avif-superres-plane-postfmt-new-20261004.json. They lack source/build receipts and test attribution, so the coordinate change does not establish a numeric marginal gain or a verified regression result.

AV1 temporal-motion-field reservation fault contract — 2026-10-05

fault-contract:avif:avif_temporal_motion_field_reservation_failure injects a capacity-overflow failure at the existing AV1 temporal-motion-field reservation while decoding the active decode:avif:baseline Pillow input. The selected contract checks the public AVIF Dimensions / StillDecode error and its full diagnostic (decode: AVIF AV1 validation failed: unable to allocate AV1 temporal motion field), then requires a retry to equal a fresh uninjected decode. The injected outcome is indexed as oracle_status: not_applicable and does not contribute to Pillow parity counts.

The six existing fault contracts passed in the selected baseline run, and the new contract passed in its one-row run. Coverage MCP showed the allocation error region as missing in the earlier AVIF report at motion.rs:3113; it is absent from the selected run's gap list at motion.rs:3122. The region-level incremental comparison against the six-case run estimates six newly observed regions (0.002720 percentage points). This evidence is limited: reports have no source/build receipts or test attribution. Line comparison is incomparable, and branch detail does not reconcile with report totals. The selected reports are target/release-evidence/coverage-fault-contracts-six-before-temporal-motion-20261005.json and target/release-evidence/coverage-fault-contract-avif-temporal-motion-field-v2-20261005.json.

AV1 split color-tile reservation fault contract — 2026-10-05

fault-contract:avif:avif_color_tile_reservation_failure uses the active decode:avif:multitile_color_split_groups Pillow parity input. The dedicated scripts/generate_avif_color_tile_split_fixture.py derives it from the pinned multitile.avif, preserving frame-header and tile payload bytes while placing the two color tiles in separate tile-group OBUs. It checks the split ranges (0, 0) and (1, 1), then requires Pillow 12.2.0 to return the same format, mode, size, metadata, and pixels as the source. The generated input hash is 654ef88dd8ebc71a554c03f721ad97581fcf2d2df0d825020d267939eb8f5e34; its 98,304-byte RGB reference hashes to 8fddfd016bbc17e2f00a5154ee6e50c8f1d9d6a8254279ddf57be490ecdf9e44.

The selected Pillow parity row passed. The target-only coverage case injects a one-shot failure at the existing incremental color-tile reservation and checks the public Dimensions / AVIF / StillDecode error, including the diagnostic decode: AVIF AV1 validation failed: unable to reserve reconstructed AV1 tile state; retry must equal a fresh uninjected decode. Its oracle remains not_applicable, outside the Pillow parity result count. The focused fault run passed 1/1 and wrote target/release-evidence/coverage-fault-contract-color-tile-20261005.json.

Coverage MCP reports the reservation-error closure at src/codecs/avif/av1/frame.rs:1574 as missing in the same-source AVIF parity baseline, and absent from the selected fault report. The JSON region comparison is incomparable because its detailed LLVM observations do not reconcile with the reported totals. An LCOV incremental line comparison against target/release-evidence/coverage-avif-color-tile-parity-baseline-20261005.info reports 29 newly observed line coordinates (0.021037 percentage points); the selected report is target/release-evidence/coverage-fault-contract-color-tile-final-20261005.info. The LCOV branch comparison remains incomparable because branch detail does not reconcile with totals. Neither report has source/build receipts or test attribution, so the line result is an unverified coordinate estimate, not a causal coverage claim.

The full scripts/generate_test_assets.py --format avif command currently stops earlier at its ICC fixture hash assertion. The dedicated split fixture generator and Pillow reference generation completed independently.

AV1 SGR restoration allocation classification fault contract — 2026-10-05

fault-contract:avif:avif_sgr_restoration_output_reservation_failure reuses the active decode:avif:animated_lossy_inter_420_superres_sgr_8bit_160x56 sequence input to inject a deterministic failure at SGR output-plane reservation. It protects a distinct public diagnostic: allocation failures must remain Dimensions errors, not be mislabeled as malformed AV1 input. The runner checks the full SequenceDecode diagnostic and that retry matches a fresh uninjected sequence decode. The matching AVIF source row remains the Pillow parity case; the injected result is oracle_status: not_applicable.

The focused target-only run selected, executed, and passed all nine fault contracts declared in the matrix at that point. Its report is target/release-evidence/coverage-fault-contracts-nine-20261005.json and records 4,878/32,254 branches for this selected run. Coverage MCP found no missing branch observation at the SGR allocation error conversion in restoration.rs:688. The report has no source/build receipt or test attribution, so its coverage coordinates are limited evidence; the runner output is the evidence that the nine selected contracts passed.

AV1 equal-width super-resolution parity — 2026-10-04

The active decode:avif:superres_equal_width_16x16 case uses a pinned lossy 16×16 I420 still whose AV1 sequence enables super-resolution and whose frame header signals denominator 9 while coded and upscaled widths both remain 16. The fixture generator checks that syntax, repeats the encode, and verifies the pinned Pillow 12.2.0 RGB pixels (768 bytes; SHA-256 d5b4e270a08e4f03c6de84f4488420658a3ab62b00a954aeca14d50f58bb0eef). The encoded asset SHA-256 is 2de74d720f8863be43049a3df776337c1cde494122a57093ffad532cea19a004.

The selected parity row passed within the 57-test coverage-matrix harness. In the final-source 472-row AVIF baseline, Coverage MCP lists the true arm at resize.rs:208 as missing; in the one-row measurement, that arm is absent from the gap list while the false arm remains missing. The incremental comparison is incomparable because LLVM detail does not reconcile with report totals. Reports are target/release-evidence/coverage-avif-superres-faults-postfmt-baseline-20261004.json and target/release-evidence/coverage-avif-superres-equal-width-postfmt-new-20261004.json. The reports lack source/build receipts and test attribution, so this confirms the selected coordinate change without a numeric marginal percentage claim.

AV1 equal-width I444 super-resolution parity — 2026-10-05

The active decode:avif:superres_equal_width_i444_16x16 row adds the 8-bit 4:4:4 path to the existing 4:2:0 equal-width case. The deterministic Y4M source is pinned at 0ed9bb725d8f4eb3ae33998b97f064ef9486683156befa28e3c572f652d42788; the fixture generator repeats the pinned encode and checks AV1 I444 and equal-coded/upscaled-width syntax. The fixture hash is cd02b86f213b96f9d58bec3781f8855f325aa7b4c867a6fbf76f5802886420a4. Its 768-byte Pillow RGB reference hashes to 9cebc72915c26c647a920455c639b606976a1bbc0221ff9bf10cc0c9441864f9.

The selected public parity run passed 1/1. Coverage MCP branch gaps at resize.rs:210 and :215 now list only the true arms, so this I444 row observes the previously missing false arms. The JSON incremental comparison is incomparable because LLVM detail does not reconcile with the baseline totals. The LCOV line union estimates 113 newly observed coordinates (0.081973 percentage points) against target/release-evidence/coverage-avif-color-tile-parity-baseline-20261005.info. Both reports lack source/build receipts and test attribution, so this is a limited coordinate estimate rather than a verified causal gain. The selected reports are target/release-evidence/coverage-avif-i444-equal-width-selected-20261005.json and target/release-evidence/coverage-avif-i444-equal-width-selected-20261005.info.

JPEG optimized Huffman length-limit parity — 2026-10-05

The active encode:jpeg:enc_optimize_huffman_length_limit row encodes a deterministic 2504×288 L8 PNG at quality 1 with optimized baseline Huffman tables. Its balanced frequencies across seventeen AC symbols and EOB force the JPEG 16-bit code-length limiter to rebalance the generated table. The integer-basis fixture generator pins the source pixels and PNG hashes to 8c5f7f43d4a78548fe6c8054b4c6a74279da5d46afe367adbd95a1ec8da92a9c and 21d7fefde68d0e4c9ee627c2222831fce271230e3365a8a921393bf37b554338. Pillow 12.2.0 with JPEG 6.2 returns the 8,167-byte output pinned at 4f8d2339e8eb0053fc2190cbbdd7e10a99f74e4139edd7be16805a669db7d668; public Rust encode bytes match exactly, and decoded L8 pixels match the Pillow image.

The selected public parity run passed 1/1. Coverage MCP reports no missing regions, branches, or lines in jpeg::encode::huffman::optimal_table for this selected report. Incremental LCOV comparison is incomparable because the measurement includes coordinates outside the older baseline inventory; the JSON detail comparison is also incomparable. Reports lack source/build receipts and test attribution, so no aggregate percentage gain is claimed. The selected reports are target/release-evidence/coverage-jpeg-huffman-length-limiter-selected-20261005.json and target/release-evidence/coverage-jpeg-huffman-length-limiter-selected-20261005.info.

Target-only fault-contract lane — 2026-10-05

At this report snapshot, the shared matrix had nine active AVIF/JPEG fault contracts, kept separate from Pillow parity with oracle_status: not_applicable. An earlier selected lane run, recorded before the SGR restoration contract was added, executed eight contracts and passed all eight public error and retry checks. Coverage MCP reported no remaining branch gaps at the AVIF color-tile reservation fault point in frame.rs:1574 or its reservation error conversion at :1577. That selected report records 4,876/32,252 branches; it is not full-suite coverage. It has no source/build receipts or test attribution, so those totals are limited selected-run evidence. Against target/release-evidence/coverage-avif-color-tile-parity-baseline-20261005.info, the incremental LCOV comparison estimated 1,366 newly observed line coordinates (0.990925 percentage points). This remains an unverified estimate, not a receipt-bound causal claim or full-suite gain. The historical reports are target/release-evidence/coverage-fault-contracts-eight-agent-20261005.json and target/release-evidence/coverage-fault-contracts-eight-agent-20261005.info.

That nine-case lane subsequently passed 9/9, including the SGR restoration allocation-classification contract. Its report is target/release-evidence/coverage-fault-contracts-nine-20261005.json and records 4,878/32,254 branches. Coverage MCP reports no remaining branch gap at the SGR allocation error conversion in restoration.rs:688. This selected report also has no source/build receipts or test attribution; the runner output establishes the nine passing contracts, while its coverage coordinates remain limited evidence.

Progressive CMYK without APP14 parity — 2026-10-04

The active progressive_cmyk_no_app14 row strips the single Adobe APP14 segment from the existing progressive CMYK input. The 11,859-byte fixture has SHA-256 abe44e8567c1cbf463ba0e99cd8d96598fad6de8291e8723f3abd00d82ce769c; Pillow 12.2.0 returns 65,536 CMYK bytes with SHA-256 ff97c9d811b513694fa089a582cdf540e4f17c26bfa087cd9df458dd0f610385. The initial selected parity run found all channels complemented: the progressive path inverted CMYK samples only when APP14 existed, unlike the baseline path and Pillow's four-component output convention. The decoder now applies the same inversion for all four-component progressive JPEGs and no longer stores an unused APP14 transform byte. The targeted parity run passed for the new case and the existing baseline and progressive APP14 CMYK neighbors. Its matrix case is included in the same-source parity baseline; it therefore adds no further marginal line coverage in a separate selected-row comparison.

AV1 duplicate tile-group-start parity — 2026-10-04

The active error_tile_group_start_order AVIF row changes the second split tile-group header from tile 1 to a duplicate tile 0, with zero alignment padding. The 316-byte fixture hashes to 68781acc246e2946c962c33990c53b50ed308a06fcdec6e421a38dbf353de4cf. Pillow reports RuntimeError: Failed to decode frame 0: Decoding of color planes failed; the selected Rust/Pillow parity row passes 1/1 on the local Pillow 11.3.0 host (the repository pins 12.2.0). The isolated report target/release-evidence/coverage-avif-tile-order-final.json and the refreshed parity-target report cover the missing true arm at src/codecs/avif/av1/frame.rs:1482. Coverage MCP's selected-test comparison observes one new coordinate, but remains limited without source/build receipts. The deeper accept_tile_group ordering guard at line 1545 is rejected earlier by read_tile_group, so this row claims only the public path it reaches.

GIF metadata-limited decode parity — 2026-10-04

The active palette_absent case also exercises the public metadata-limited decode path on its three Pillow-valid GIF inputs, with a 13,772-byte cap above their metadata extents. The normal decode assertion remains active, and the policy decode must return exact reference pixels. Its selected matrix row passes 1/1; the isolated report and Coverage MCP comparison observe the false outcome at src/codecs/gif/decode.rs:369. The full comparison also observes the true outcome at line 400 for the local-table variants. Pillow pixel references and GIF assets were unchanged. The host Pillow version is 11.3.0 while the repository pins 12.2.0, so this Rust-only policy-field change did not regenerate oracle outputs.

Progressive JPEG restart-overrun parity — 2026-10-04

The active decode row progressive_restart_overrun mutates the second progressive scan in progressive_restart.jpg by appending sequence-correct RST7/RST0 markers at its entropy boundary, before the following DHT and DRI markers. Its 5,655-byte input hashes to 509d436c87d82c880128aeffe1b41a39819dc7030141964bd302a6e4039f3c86; pinned Pillow 12.2.0 returns the same 128×128 RGB pixels as the unmutated source, with reference SHA-256 e92abdc1f9d14fd2491920de98bdcee028788715bebc6ba5d21b20d89b59fd76. The selected public parity row passes 1/1. Its isolated LLVM report records 4 true and 5,632 false outcomes at src/codecs/jpeg/decode/progressive.rs:832, exercising the extra empty segment past the 256-MCU scan. Coverage MCP has no source/build receipt or test attribution for this selected report; the named-row result and branch counts are local execution evidence.

JPEG low-quality 4:2:0 edge parity — 2026-10-04

Monochrome AV1 film-grain parity — 2026-10-04

The active decode row portable_lossless_filmgrain_monochrome_64x64 is a 6,210-byte 64×64 8-bit all-lossless monochrome AV1 primary still with frame film grain. Its AVIF input SHA-256 is 0bc3fe81f320d7f55853d53ec7b7fa20f099bf8af7e5e7ccbaa69556ccd980d4; Pillow 12.2.0's 12,288-byte RGB reference hashes to 853bfb557b4ab4960d708f4ecfeda145ed9feab8c987214d82ee6a20665e93f4. The selected public parity row passes. The decoder now admits monochrome primary sequences that declare film-grain support because selected-display materialization applies the frame's grain before checking the complete plane. The auxiliary-alpha admission rule remains unchanged.

Coverage MCP compares eight newly observed branch coordinates in film_grain::apply_monochrome with the earlier full report; eight validation arms remain unobserved. Both reports lack source/build receipts and test attribution, so this is limited coordinate evidence, not a verified causal claim.

JPEG low-quality 4:2:0 edge parity — 2026-10-04

The active encode row enc_sub_420_q10_odd_streaming_edge combines quality 10, 4:2:0 sampling, and a 33×33 source, exercising partial right and bottom MCU edges on the low-quality streaming path. Its existing source asset hashes to afdec16d964c39b1d8f8329f72d798669ce507bf0904f96388fd273ddf65cc45; Pillow 12.2.0's 33×33 RGB reference is 3,267 bytes with SHA-256 9ee98db427d2e8ac625f6eb0e09e79f96ae13ff7c975297d537fe0e1725c27e4, and the encoded JPEG reference is 777 bytes with SHA-256 db364d028ea02c8c5e3548e22df6c1d4a74466e9afb06cf952bfe0e47e71419e. The selected public matrix row passes. Its selected LLVM report records the true arm of present[0] at jpeg/encode/mod.rs:3925; the remaining listed arms are structural states, and the full coverage totals remain unchanged. MCP reports no source/build receipt and unknown test attribution, so the branch observation is coordinate evidence rather than a receipt-verified causal claim.

GIF reserved disposal values — 2026-10-04

The active rows enc_animated_disposal_8_reserved_bits and enc_animated_disposal_255_u8_limit exercise GIF sequence encoding with the full public u8 disposal range. Pillow 12.2.0 shifts the supplied value into the graphic-control packed byte: disposal 8 produces 0x20 / 0x21, while 255 produces 0xfc / 0xfd. The exact two-frame Pillow outputs hash to 8a8954d61effd22db2292078adda561beb35102d50c36d2cd438094787afc190 and 727785b857f0bbb52cddea5cbbad4a14b8721f68914eb31cc557b92344a69305. Both selected public parity rows pass. Coverage MCP returns no missing branch group for disposal_code; its report has no source/build receipt and unknown test attribution, so this is coordinate evidence rather than a verified causal claim.

Public parity rows added — 2026-10-04

The active AVIF rows error_sequence_frame_id_width_exceeds_16 and error_sequence_identity_color_matrix_profile2_8bit mutate the pinned error-resilient animation's sequence header. The first changes its three-bit additional frame-ID length from 0 to 2, declaring a 17-bit frame ID. The 1,084-byte input hashes to 6970dc8e41a8861097dff0fbd8577b84dde72ec2018d3f2f75169bf7d78a123e. Pillow 12.2.0 opens and verifies the container, then reports RuntimeError: Failed to decode frame 0: Decoding of color planes failed on load. The selected public decode row passes. The selected LLVM branch report observes the true arm of the 16-bit guard at src/codecs/avif/av1/sequence.rs:266, which the preceding full Coverage MCP report listed as missing. Coverage reports lack source/build receipts and test attribution, and the selected comparison is not aggregate-comparable, so this is coordinate-level evidence. The second changes the same sequence from Main profile to profile 2 while retaining 8-bit depth, then sets the CICP matrix to the identity value. Its input hash is 478d360b9c47d12f32c1a2f6ee9da0a483f7b6ac87b1ea93deda0e786dea07f6; Pillow 12.2.0 opens and verifies it before reporting the same decode error. Its selected branch report enters identity-matrix parsing, but raw counts at sequence.rs:354 show its profile != 1 true arm and both nested profile == 2 && bit_depth == 12 outcomes remain unobserved. This malformed row therefore does not close the profile/depth guard.

The active rows baseline_reserved_ac_zero_size_eob and baseline_multiscan_reserved_ac_zero_size_eob cover Pillow's handling of a reserved zero-size AC symbol (0x10) as end-of-block. Their 137-byte grayscale and 165-byte 4:4:4 multiscan inputs hash to 278b5b7d9a5d56799646149baec5c89be8d1f1bc1d39c74f0ab02b16a53c774d and 8aa96a1a0a6e8edd37fafbe7be424c3b3691deb16923a469c46718730a10e7bc. Pillow 12.2.0 yields 8×8 grayscale and RGB images respectively, all pixels 128; both selected public decode rows pass exact parity. The grayscale row reaches the single-scan fast path, and the three-scan RGB row dispatches through the scalar baseline block decoder. Zero-size EOB leaves the DC-only output optimization available.

The active JPEG rows baseline_420_restart_row_aligned and baseline_420_restart_overrun add an exact DRI=8 4:2:0 control and a Pillow-tolerated surplus-restart mutation. The 5,954-byte control hashes to a0ea540bcedbb4fdb195055eee29aa0e3f5b9a856e6bea195002be0d8f7d5f4c; the 5,958-byte candidate hashes to d52d934b119504b84ee1697bec2ce78077788e3a98ff8073a371a2a42b26715c. Pillow 12.2.0 loads and verifies both as 128×128 RGB with the same pixel SHA-256 e92abdc1f9d14fd2491920de98bdcee028788715bebc6ba5d21b20d89b59fd76. The candidate inserts FF D0 FF D1 before EOI. With 64 MCUs and DRI 8, the decoder expects eight entropy segments; the mutation supplies ten, reaching the direct-path segment-count fallback at src/codecs/jpeg/decode/decode.rs:1180. The focused public row passes 1/1. Coverage MCP's refreshed full report has no missing branch group at that location. MCP still lacks source/build receipts and test attribution, so this is coordinate evidence rather than a receipt-verified causal claim.

The active JPEG row baseline_444_single_component_scan_cb retains only the first Cb scan from baseline_444_three_sequential_scans and appends EOI. The 640-byte input hashes to 6ab4a1f95019f910ed48b81d5889ff9a464904c9ba158232ab290e41dfe16231; Pillow 12.2.0 opens, verifies, and decodes it as 8×8 RGB with pixel SHA-256 3100a6a318864cd8fff4192c9acc15b51f2219a0195043761c7a38caf5b3963a. This single-scan route reaches the scan_components.len() != 3 fallback guard in src/codecs/jpeg/decode/decode.rs:1590, then decodes through the general checked path. The public matrix test and complete make coverage campaign pass. Coverage MCP no longer lists that outcome as missing, but cannot attribute the hit to a test without source/build receipts. No codec or SIMD implementation changed in this fixture batch.

The active JPEG row baseline_cmyk_single_component_scan retains only the first component scan from baseline_cmyk_13x9.jpg. Its 13×9 CMYK input hashes to 81109c230ad68dc6ddfccb25a441f9c0ceb2b5d336a3e948b2496628849c1c7f, and Pillow 12.2.0's decoded CMYK pixels hash to 1ca1b4e0d3309f8b0e4d84ddc4fd20c8fc98827a62e0b4d3713ef3017f52f7b4. The focused public JPEG matrix passes 202/202 rows. This input reaches the single-component fallback in src/codecs/jpeg/decode/decode.rs:963; the coverage campaign below measures it in the current report.

The active AVIF row animated_lossy_inter_420_superres_sgr_8bit_160x56 extends the 10-bit super-resolution/restoration witness to 8-bit I420. Its frame 1 uses largest-transform mode, 16×16 partitions, super-resolution from 128×56 to 160×56, and SGR restoration on all three planes. The 1,612-byte timestamp-normalized input hashes to c294163610d4a45852fe374e0345c878979bb81e5ea94596960ef64411180fd7. Pillow 12.2.0 RGB frame hashes are 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 0bb7e3278f7cad0535a87e433d644434074b207396bf668ab3f5007dfca98061; the selected public sequence decode matches them byte-for-byte. The fixture uses the pinned encoder compatibility patch documented in scripts/avif_fixture_oracle/README.md.

The active AVIF rows error_av1c_invalid_marker and error_av1c_twelve_bit_without_high_bit_depth each mutate one field in the 3,077-byte baseline file. Their input SHA-256 values are 8e183203e849b4a7fd01bf5662b585a42b745b01b18a62a5c11cb64d550dbae9 and 68e3963bfc3437156e871b5b48e279e1450fa8d67f22b03644925190b8b03695. Pillow 12.2.0 reports PIL.UnidentifiedImageError; the Rust parity contract reports malformed. The AVIF decode matrix passes 442/442 cases, and Coverage MCP now returns no missing branch observations at samples.rs:724 and samples.rs:732.

The active AVIF row error_animated_duplicate_sample_size retypes the animated fixture's stss box as a second stsz, places it before stco, and makes the following chunk-offset table incomplete. Its input SHA-256 is 99400ac1612db40de4af63b07e7511483381590689be3cc0ed1607df63e44959. Pillow reports PIL.UnidentifiedImageError, and the Rust parity contract reports malformed. The AVIF decode matrix passes 443/443 cases. Coverage MCP reports no missing branch observation at samples.rs:2189; the report still lacks a source/build receipt, so this remains coordinate-level evidence.

The active AVIF row animated_lossy_inter_420_superres_sgr_10bit_160x56 adds a full-range two-frame 10-bit I420 sequence. Its inter frame is coded at 128×56, super-resolves to 160×56, and uses SGR restoration on all three planes; the bitstream uses the supported largest-transform mode. The 1,366-byte timestamp-normalized input hashes to 016e4a8433002b60899744fba6f26a7c10af82c192f65b4c5c19233b15c3cb11. Both public Rust decode APIs match Pillow 12.2.0 byte-for-byte: frame hashes are 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 199a031bed1879efe5b17d90bacd44226ec2c05da120f4e981326695e6d493d0, each with a 33 ms duration. The selected manifest parity row passes 1/1. Coverage MCP's full-report coordinate comparison shows this case alongside other all-feature work exercising 61 additional outcomes in the high-depth super-resolution/restoration admission function; the function now has 65 unobserved branch outcomes. MCP reports no source/build receipt or test attribution, so the comparison is not a verified causal claim.

The active AVIF row animated_lossy_inter_420_superres_select_10bit_160x56 adds a companion full-range 10-bit I420 sequence. Its inter frame uses TX_MODE_SELECT with the same 128×56 to 160×56 super-resolution geometry and no active restoration. The 1,311-byte timestamp-normalized input hashes to 04e31a3ac36c25ef77061a2ed09b79fd8fb885a5ff14d6ab3a82e2d32ad3b02e. Public Rust decode and sequence decode match Pillow 12.2.0 byte-for-byte; the RGB frame hashes are 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 7aa2455358aa4a1d51b3a4a263a425229b1be524efd68979a26dad18c8250fef, both with a 33 ms duration. The focused row passes 1/1, and native repetition is confirmed as infinite. Coverage MCP's selected comparison against the SGR row shows seven newly observed coordinates in complete_high_depth_inter_reconstruction_context; the all-feature report also adds one covered branch relative to the prior full report. Those reports lack source/build receipts and test attribution, so these remain coordinate signals rather than verified attribution.

The active ICO row error_short_header_metadata_preflight uses a four-byte recognized signature without the remaining directory header. Its input SHA-256 is 6b1e73a0094b7b812d3b9e22cffb4f8239319847522c4fa103753b6950020f93; the manifest also compares decode_with_policy with a zero metadata-byte limit. Pillow reports PIL.UnidentifiedImageError, and the Rust parity contract reports malformed. The ICO decode matrix passes 57/57 cases, and Coverage MCP returns no missing branch observation at ico/decode.rs:123.

The active WebP encode row enc_lossless_sampling_row_compaction_checkpoint uses a deterministic 512×1,024 RGB input whose two VP8L histogram bands compact to multiple rows. The token-aware encode shard passes 47/47 cases, including byte-for-byte Pillow parity for the new row. The input SHA-256 is 36d8d0a1048480054a0d99cb503cab17e299d0f6fa1f9afdbee81e1568e43478; its 395,738-byte Pillow WebP output has SHA-256 5d216ba74978fb381c518359f11db60861b8ce6a25ab2c30edd4bdcd8e1ed012. The selected Coverage MCP report has no missing branch at webp/native/encoder.rs:1454, the nonzero-row token checkpoint. Its report still lacks a source/build receipt, so this is coordinate-level coverage evidence.

Token-aware VP8L sampling checkpoint parity — 2026-10-04

The active WebP encode row enc_lossless_sampling_equal_rows_checkpoint uses an 8,192×16 RGB fixture with 511 unique colors. Repeated histogram distributions across tile rows reach the token-aware row and column sampling checkpoints without selecting the palette transform. The selected public row passes Pillow byte parity, including the token-aware Rust output. The input SHA-256 is cda7a74a4e7b6e8414374a82307919b65426a6c24b252055e6f89c0cc230650a; its 134,180-byte Pillow WebP output has SHA-256 3da23b0660aba09c176a17b552913c14e33f2ac943a265582bdbfb5a0529b92f. Coverage MCP reports no missing branch outcomes at webp/native/encoder.rs:1378 and :1418, the 1,024-comparison row and column checkpoints. The incremental LCOV estimate reports four newly covered lines and a 0.002902 percentage-point gain against the pre-row baseline. That increment is coordinate evidence only because source/build and test receipts are unavailable; branch-level incremental unions remain incomparable.

The current matrix contains 2,233 total rows: 1,753 decode / inspect / verify rows and 480 encode rows. Of those, 1,753 decode rows and 448 encode rows are active; 0 decode rows and 32 encode rows are planned. TIFF has 288 decode rows. The 31 fault contracts are tracked separately from the Pillow parity totals. Full and selected MCP reports lack source/build receipts and test attribution, so MCP locations are coordinate evidence rather than verified named-test attribution.

PNG Paeth tie parity — 2026-10-15

Two active public encode rows now target Paeth predictor tie behavior. enc_paeth_tie_precedence uses a 2x7 grayscale raster to exercise the predictor return arms and equal adaptive filter scores. enc_paeth_emitted_above_upper_left_tie uses a 3x2 grayscale raster where Paeth wins adaptive selection and distinct, equally close above and upper-left samples make its tie choice visible in exact encoded bytes. The pinned Pillow 12.2.0 references and round-trip pixels are generated from the public encoder. The second reference decompresses to filter bytes [0, 4] with Paeth residuals [1, 1, 0]. The selected public matrix run passed both rows (2/2), made eight public encode calls, and had no panics.

Coverage MCP returned no missing branch groups for src/codecs/png/encode.rs:275 or :339 in the selected report target/release-evidence/coverage-png-paeth-tie-final.json. That report observed 269/31,320 branch outcomes. It has no source/build receipt and test attribution is unknown. Incremental comparison with coverage-png-matrix-current.json is incomparable because the branch detail differs (31,320 versus 31,314 outcomes); no marginal gain or full-suite coverage claim is made. The saved full baseline remains unchanged.

JPEG Huffman edge rows — 2026-10-14

Two generated JPEG parity rows extend the active matrix. long_huffman_code_slow_path is an 8x8 grayscale SOF0 image whose one-symbol DC and AC tables use valid 11-bit codes; pinned Pillow 12.2.0 decodes all 64 samples as 128. The row exercises the >10-bit lookup fallback through public decode operations. baseline_444_unused_custom_dc_chroma_table adds unused DHT selector 2 with standard chroma DC code counts and swapped symbol values. Pillow 12.2.0 returns the same 128x128 RGB pixels as the baseline image, while Rust takes the generic custom-table path.

The saved full branch report .coverage-mcp/local-evidence/20261013/main-full-baseline/coverage.json lists the false arm of standard_huff_table at huffman.rs:89 as missing. The selected public row passed 1/1. Its focused report is .coverage-mcp/local-evidence/20261014/jpeg-unused-custom-dc-chroma/coverage.json; Coverage MCP no longer lists the values-comparison false arm at line 89, and a selected-row comparison against jpeg-empty-dc-huffman/coverage.json reports three newly observed branch coordinates, including that arm. The comparison is limited: source/build identities are unverified and test attribution is unknown. This is targeted coordinate evidence, not a verified aggregate gain. No full coverage run was made.

Current AVIF location generator observations — 2026-10-05

The current AVIF location inputs come from scripts/generate_avif_idat_fixture.py through the normal asset hook. They exercise a truncated extent index, an unsupported three-byte index width, assembly from two indexed idat extents, and an extent ending one byte beyond idat. Pinned Pillow 12.2.0 rejects the first two at open, preserves the split item's complete image result, and accepts inspection and verification of the overrun before frame decoding rejects it as malformed. The canonical reference generator reads configuration depth through the bounded configuration-only reader in scripts/inspect_avif_bitstreams.py; its full sample inspector keeps extent validation. Independent enrichment failures abort generation. These ordinary cases remain separate from the 24 target-only fault contracts.

Token-aware PNG reserved-distance parity — 2026-10-04

The active row error_token_aware_reserved_deflate_distance reuses the pinned zlib_reserved_distance_symbol.png input through the public decode_with_token API and checks the same Pillow 12.2.0 malformed-decode contract as ordinary decode. Its 67-byte fixture has SHA-256 222fcf6a5fc0b121582aa779cd86a7e77e35948b779e71151313d9ced571b7b1; the selected public parity row passes 1/1.

The selected LLVM report records one hit on the reserved-distance true arm at src/codecs/compression/deflate.rs:539, which the earlier full report lists as uncovered. The other outcome remains uncovered in this one-row selection. The full-versus-selected MCP comparison is incomparable because baseline branch detail is incomplete; both reports lack source/build receipts and test attribution, so this is coordinate-level evidence only. No codec or SIMD implementation changed.

AVIF profile-2 12-bit identity-CICP parity — 2026-10-04

The active row profile2_identity_12bit_444 uses a reproducible 16×16 full-range 4:4:4 AVIF with profile 2, 12-bit samples, and CICP 1/13/0. Its 1,188-byte fixture SHA-256 is 1ce2aae5539074e3a65092f185c4db34537462d637859d4fd85449bb15557931; the 768-byte Pillow RGB8 reference SHA-256 is 45114693c3cde135ae810d49fbfb8bcf54204da4b9bf11fa3094b5e177686343. The selected public parity row passes 1/1. The decoder maps AV1's Y/Cb/Cr identity planes to G/B/R and truncates validated 12-bit samples to RGB8; existing YUV conversion kernels are unchanged.

The fresh selected LLVM report records the true outcomes of all three guards at src/codecs/avif/av1/sequence.rs:354 (three hits each). The separately selected 8-bit malformed identity-CICP row records the false depth outcome (three hits), so the two public rows exercise both depth outcomes. Coverage MCP reports the opposite outcomes missing in their respective single-row selections. The profile != 1 false arm and profile == 2 false arm remain unobserved. MCP reports lack source/build receipts and test attribution; its selected-test comparison is limited coordinate evidence, not a verified full-suite gain.

VP8 loop-filter mode-delta parity — 2026-10-04

The active WebP row lossy_vp8_mode_filter_delta uses a deterministic 128×128 RGB keyframe with a +5 VP8 loop-filter mode delta. The 3,312-byte fixture SHA-256 is 86b97b8489b9ec2318858bef5d91be138e1222398dd2b8ffbde6dded0e598b55; its Pillow RGB pixel SHA-256 is ce195285d0ae374bc2ae5538da590658fbe26846b27cf2b0d2300979319f4c99. The selected public decode parity row passes 1/1. Its fixture generator applies the encoder-only patch to a temporary copy of pinned libwebp 1.6.0 and checks the Pillow output hashes.

The selected LLVM report records true hits at src/codecs/webp/native/vp8.rs:1158 (3), :1283 (3), and :1913 (192); the mode check at :1915 observes both outcomes (177 true, 15 false). Coverage MCP confirms the opposite outcomes at 1158, 1283, and 1913 remain unobserved in this selected-only report. The earlier full report listed these true outcomes as missing, but neither report has source/build receipts or test attribution, so the comparison remains coordinate-level evidence.

WebP malformed chunk extents and GIF89a exact metadata budget — 2026-10-04

The active WebP row error_truncated_chunk_header_metadata_preflight retains the valid VP8X and EXIF chunks from exif.webp, removes its VP8L image chunk, and adds one byte inside the corrected RIFF extent. Pillow rejects the resulting malformed file; the Rust row exercises the metadata preflight path with a zero-byte metadata limit. The full parity matrix passes, and Coverage MCP no longer lists the short-chunk-header branch at src/codecs/webp/decode.rs:203. The report is source-unverified and its test attribution is unknown, so this is coordinate evidence.

The active WebP row error_chunk_exceeds_riff_metadata_preflight uses the same extended metadata container with the EXIF chunk length raised past the RIFF extent. Pillow and the Rust public operations reject it, and the zero-byte metadata-limit call reaches the chunk-extent error at src/codecs/webp/decode.rs:223. Coverage MCP no longer lists either line 203 or line 223. Its two remaining WebP metadata branches, at lines 185 and 186, reject bad RIFF/WEBP signatures before public metadata scanning can be entered.

The active GIF row gif89a_exact_metadata_limit checks that the existing GIF89a lzw_kwkwk.gif fixture decodes at its exact 39-byte metadata limit. Its Pillow pixel parity passes. This case adds a metadata-policy regression check but does not change aggregate coverage; the remaining reported GIF signature arm corresponds to invalid signatures, which public format detection rejects before metadata scanning.

An earlier local full report recorded 86,813/142,471 lines (60.9338%), 16,768/32,250 branches (51.9938%), 4,849/8,990 functions (53.9377%), and 132,773/220,396 regions (60.2429%). The GIF exact-budget case adds a parity regression check without changing that report's aggregate coverage. The report and MCP view lack source/build receipts and test attribution, so their source locations are coordinate evidence rather than verified causal attribution.

The active AVIF row iref_future_version adds an empty version-2 iref FullBox and preserves exact Pillow 12.2.0 metadata and pixels. Its selected public Rust parity row passes.

The active JPEG row baseline_444_multiscan_final_empty_entropy derives an 8×8 baseline 4:4:4 image with an empty final component scan immediately before EOI. Pinned Pillow 12.2.0 decodes the fixture and the selected Rust parity row passes. The refreshed local LLVM report with both rows records 86,819/142,504 lines (60.9239%), 16,751/32,252 branches (51.9379%), 4,847/8,990 functions (53.9155%), and 132,753/220,401 regions (60.2325%). Coverage MCP no longer reports missing branch observations at avif/samples.rs:982 or jpeg/decode/decode.rs:2473. The local report has no source/build receipt or test attribution, so these locations are coordinate evidence rather than verified causal claims.

MCP still reports the true outcome for the right-hand comparison at tiff/decode.rs:1872 and :1965. The active invalid-first-code TIFF row makes the left side of code >= CLEAR || output.len() >= expected true, so the right side is short-circuited. Public TIFF inputs keep expected positive and the decoder stops when it reaches that size; no public Pillow-parity input can take the right-hand true outcome. This is not a missing public fixture.

The active WebP row enc_lossy_method_6_token_checkpoint exercises the token-aware lossy VP8 method-6 trellis path on lossless.webp. Its 128×128 RGB input SHA-256 is 20eb48b4ef2a42d4842684930c2023f7d14ac343b825d19a185e8dda5b25f8b2; its 49,152-byte Pillow RGB reference hashes to 2c759de6a1ae9096f129744a6c04d24f1a611bcd8841b26810cc1c583b6a1525, and its 3,570-byte Pillow WebP output hashes to ba524d40418e1bd254e437cb4cf51d98e10d31df9fb5a163938840b9e3fddf4f. The token-aware WebP encode shard passes 47/47 cases, including byte-for-byte parity for this row. Coverage MCP's focused report no longer lists a missing group at webp/encode/vp8/quant.rs:238, and the raw LLVM export records 10,240 executions of the token-specific quantizer specialization. The aggregate branch percentage did not change; the report has no source/build receipt or test attribution, so these are coordinate and specialization observations, not receipt-verified causal attribution.

A parity-only coverage-matrix run passed 38 public parity-target tests with 18 internal/admin tests filtered out. Its selected report, target/release-evidence/coverage-public-parity-20261004-final6.json, records 83,386/142,489 lines (58.5210%), 16,208/32,252 branches (50.2542%), 4,554/8,987 functions (50.6732%), and 127,597/220,381 regions (57.8984%). Compared with final5, raw covered totals rise by 50 lines, 12 branches, six functions, and 81 regions. Coverage MCP's selected comparison observes six new parse_pasp branch coordinates: the valid false outcomes in both parser implementations. Across the three TIFF increments, Coverage MCP observes the zero next-IFD arm at decode.rs:46, three metadata_bytes outcomes, and the inspect_basic arm at inspect.rs:47. Current filtered gap queries list no missing TIFF outcomes in metadata_bytes, decode_page, or inspect_inner. MCP marks the comparisons limited because source/build receipts are unavailable; they are coordinate evidence rather than verified causal or regression claims. The incremental comparison to final5 is limited because source/build identity is unverified. These selected-target totals describe the public parity test target and do not replace the full release coverage campaign.

The active AVIF row primary_item_pasp_4x3 adds the exact 342-byte input primary_item_irot_pasp_4x3.avif (SHA-256 2acc2e59572718a5fd1247aef7d18ab7666943533f068c221117df05378c4564). It associates a valid 4:3 pasp property with the existing 270-degree primary-item rotation fixture; the property and association add 17 metadata bytes, and the iloc extent is relocated from byte 285 to 302. Pillow 12.2.0 verifies and loads it as 2×3 RGB with the same info and all 18 pixel bytes as the source. The focused public AVIF parity target passes 1/1. Coverage MCP reports target/release-evidence/coverage-avif-pasp-20261004.json and target/release-evidence/coverage-public-parity-20261004-final6.json leave only the three invalid-value arms in each container::parse_pasp and samples::parse_pasp unobserved; the valid false/success outcomes are present. Both reports lack source/build receipts and test attribution, so this is coordinate evidence, not a verified suite-wide coverage gain.

The active AVIF row clap_zero_width_ignored adds an essential clean-aperture property with a zero width numerator to the 3,077-byte baseline AVIF. The 3,118-byte input hashes to ce95ee92b5498964ff6e3e0bd383608c559fafcafe7bd110e5f2101d10734572; Pillow 12.2.0/libavif 1.4.1 verifies and decodes it as 128×128 RGB with the unchanged pixel SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf. Rust's inspector and decoder now preserve this property as opaque metadata and do not apply a crop, matching Pillow.

The active AVIF row clap_zero_width_denominator_ignored adds an essential clean-aperture property with a nonzero width numerator and a zero width denominator to the same 3,077-byte baseline. The 3,118-byte input hashes to 8641c0eff26bfdf83f998e2a13737eeea8dbff30d04c818109a358d3a267b4e1. Pinned Pillow 12.2.0/libavif 1.4.1 verifies and decodes it as 128×128 RGB with the unchanged pixel SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf.

Six further active rows exercise the other ignored clean-aperture cases. The 3,118-byte zero-height-numerator, zero-height-denominator, zero-horizontal- offset-denominator, and zero-vertical-offset-denominator inputs hash to ec0031d6d620d303a05937051504d621498dfe73920c51fb072e03c7746fbe2c, 1004a811270a222f0072637fafc2b1004f25084a6f8f1b34976696595fefefab, 9d67878e798b93a6fe551fdd492701a501d4744d847f26c670e5c793c9a367c3, and 662fca402bf3a78537aaaadbe101c5ceaee736a064ddcaa46ff5931ec17971c2. The trailing-payload rows contain one and 16 bytes and hash to ece2fc8f98cc42f31a8806690ac415460d5eadf96c93492ba2d710c0b2e22bde and 93038a983d242ee2204d866b63a1811573acc7f8e38699595d328ccdf49cf2d7. Pinned Pillow 12.2.0/libavif 1.4.1 verifies and decodes all six rows as 128×128 RGB with the unchanged pixel SHA-256 above. Both AVIF parsers now preserve these unusable clean-aperture declarations as opaque metadata. The full AVIF matrix passes 467/467, and Coverage MCP reports no missing branch group in either parse_clap; its source identity and test attribution remain unverified.

The active GIF row lzw_long_expansion_token_checkpoint is a 1,024×515 Pillow 12.2.0 palette image. Its 1,909-byte input hashes to 60bfab0d96d4fcc742246b440f337bc183e1e1ead86dfa02a8fb4013f07e571a; its 527,360-byte decoded reference has SHA-256 8245292ed38da63c136ed67020067c8dad124da8cadacdb8cad7489f914fa01b. Its valid LZW phrase reaches the cancellable expansion checkpoint, and the new GIF fixture passes exact public pixel parity. A separate error_lzw_end_only_token_checkpoint row checks the immediate-end-code error through the token-aware public decoder; it was split out of the aggregate malformed group so the token-aware assertion applies only to the relevant input. Two more dedicated error rows cover an invalid first LZW code and a future dictionary reference. The selected four-row GIF shard passes 4/4. The full selected Coverage MCP report returns no missing branch groups for decode_lzw_with_token or append_code_with_token in src/codecs/gif/decode.rs; this remains coordinate evidence.

Four existing Pillow rows now also exercise public decode_with_policy at the measured metadata boundary: BMP depth_24 at 54 bytes, ICO single_icon at 22, WebP icc_profile at 69, and TIFF tiled_missing_byte_counts at 146. The focused BMP/ICO/WebP selector passes 3/3 and the TIFF selector passes 1/1; all four retain exact Pillow pixel references. Against the prior selected report, MCP's filtered gap listings now show one missing BMP metadata_bytes outcome instead of two, no ICO metadata_bytes group instead of one, six WebP metadata_bytes outcomes instead of 19, and three TIFF outcomes instead of 10. The TIFF check exercises the unequal offset/count length path at tiff/decode.rs:150. The cycle and empty-directory policy rows exercise the remaining TIFF metadata_bytes exits; the final selected report has no missing branch groups for that function. MCP's aggregate incremental comparison remains incomparable and its reports lack source/build receipts and test attribution, so these are coordinate-level observations rather than verified test attribution.

The TIFF cyclic_ifd_leniency row exercises metadata policy on the self-referential cyclic_ifd.tiff with its measured inclusive limit of 140 bytes. A dedicated error_empty_ifd_chain_metadata_policy row exercises empty_ifd_chain.tiff with a zero limit and retains Pillow's malformed error. Together they cover the cycle stop, matching strip offset/count arrays, and no-directory error path. The final selected report has no remaining TIFF metadata_bytes branch gaps; source/build identity is unverified.

The TIFF single_page row requests page index 1 from single.tiff. Pinned Pillow 12.2.0 reports builtins.EOFError, and the public owned and borrowed decode_frame calls are pinned to Rust's parameter error. This reaches the zero next-IFD termination arm in tiff/decode.rs:46; the preceding selected report listed that arm as missing. The final parity-only run passed with the frame request included, and Coverage MCP no longer lists that arm. The report has no source/build receipt or test attribution. The row also exercises public inspect_basic; the parity harness checks that its complete page count matches the full inspection and Pillow reference, covering the basic path in tiff/inspect.rs:47.

The active TIFF row error_lzw_invalid_first_token_checkpoint checks the invalid-first-code error through the token-aware public decoder as well as the ordinary decode path. It is retained for that API parity contract, not claimed as a new branch gain. A fresh one-row LLVM report, target/release-evidence/coverage-tiff-invalid-first-token-selected.json, records the invalid code >= CLEAR arm four times in ordinary decode and twice in token-aware decode at tiff/decode.rs:1872 and :1965. The RHS output.len() >= expected is short-circuited and has no counter in this selection. Coverage MCP reports the missing RHS outcomes in the one-row view; this does not identify a missing public input, because the first code is already invalid and a valid first code starts with zero output against a positive expected length. The same fresh report lacks source/build receipts and test attribution.

The final5 TIFF branch query has four remaining outcomes: the invalid-signature arm in parse_header at decode.rs:1005, the output-full RHS in ordinary and token-aware LZW at decode.rs:1872 and :1965, and the empty-input arm in encode_lzw at encode.rs:723. Public format dispatch rejects signatures before parse_header; TIFF validation requires positive decoded dimensions and skips zero-row compressed strips before LZW; and public encoder validation passes nonempty pixel data to encode_lzw. These defensive arms have no known public Pillow-compatible parity witness under the current APIs. This is a source-level reachability assessment; the MCP report lacks source/build receipts and test attribution.

Public parity rows added — 2026-10-03

The active JPEG row baseline_444_restart_marker_fill adds three legal 0xFF fill bytes before the restart markers of a Pillow 12.2.0 baseline 4:4:4 JPEG. Its input is 2,593 bytes (SHA-256 c5369d29b879ca0d40ac01c927c4a5d845d3fc9f59ae07ccb7cb5947b0e5fee2); its 2,835-byte Pillow RGB reference has SHA-256 0276fe6a4734a34cee3009e2c6aca9c36323785712622759f3a8b9e835453895. The selected public parity run passes. The pre-row full report listed the true arm of the repeated-fill loop at jpeg/decode/decode.rs:2484; the selected report observes it, and the refreshed full report has no gap at that location.

The active AVIF row no_intrabc_repeated_patch_monochrome_256 pairs the existing monochrome IntraBC witness with an all-lossless frame that disables IntraBC. Its input SHA-256 is 34321df1afb253b459f20169ddc4d3b588e517b4832c2c2460d6900ca647c7a3; its 196,608-byte Pillow RGB reference has SHA-256 ed729898cd63496b4a1aa628686ebff2dd7a0f383dfdae854f7cd77dae54ce22, and the selected public parity row passes. Coverage MCP still reports the false arm of !header.superres_enabled at av1/frame.rs:3346; this row tests the valid IntraBC-disabled bitstream state and is not credited with closing that superres branch. Selected and full reports have no source/build receipts and unknown test attribution, so the branch observations are coordinate evidence.

The selected and refreshed full reports show no remaining branch gap at jpeg/decode/decode.rs:2484, av1/frame.rs:3647, or webp/native/decoder.rs:226. MCP incremental comparison is unavailable because the full report's detailed baseline branch inventory is incomplete; no four-metric union or receipt-verified causal attribution is claimed. The full report still has 15,726 unobserved branch outcomes, so the 100% goal remains open.

The existing WebP rows enc_lossless_indexed and enc_lossless_indexed_alpha now also request public encode_with_token parity. The 9,190-byte opaque Pillow reference has SHA-256 fc35d688c00c25e149daee2fc8716ca3e6fcd671a67430db0169671c0dc39b34; the 2,022-byte alpha reference has SHA-256 5e8dfcc6d3fab8655405b166a951cbb1885400c7b6966945e112cc0473d0c339. Both token-aware calls match those exact bytes, and the indexed-alpha call also retains its 65,536-byte RGBA reference (SHA-256 f622a7e1dbe429f8414c6081c3d79c93573e37b18538dc828c497f13fa8b3659). The selected MCP report and refreshed full report no longer list either outcome of has_alpha in the token-aware expand_indexed path at webp/encode/mod.rs:663. MCP source/build receipts and test attribution are unavailable, so this is coordinate evidence.

The active WebP error row error_truncated_riff_extent_metadata_preflight adds a reproducible 16-byte RIFF prefix declaring 32 container bytes while providing only the 16-byte header. Pillow 12.2.0 detects WebP and rejects the input with OSError: could not create decoder object; the selected public parity row passes. The matrix also repeats public still decode with a zero-byte metadata limit and checks the resulting error kind and format against the same Pillow error contract. The full Coverage MCP report no longer lists a missing branch at webp/decode.rs:193, the declared-extent guard. MCP source/build receipts and test attribution remain unavailable, so the coordinate mapping is not receipt-verified.

The WebP decode row lossy_vp8_segmentation_feature_data_disabled_16x16 (input SHA-256 b1fce88cb549bb4429cada0271752681530e8a86bc1c76256c57e581cf7c93ad) matches its pinned Pillow RGB reference and passes selected public parity. A Coverage MCP comparison with the saved pre-row report observes the false arm at src/codecs/webp/native/vp8.rs:1177; the refreshed filtered query has no missing branch there. The reports lack source/build receipts and test attribution, so this is coordinate evidence, not receipt-verified causal attribution.

The GIF encode row enc_rgb_balanced_checkerboard_token_split uses source SHA-256 d5045ccb8a0f05d35a07e300642c7501d4349af24aee2157b0b6886a0e3a32d4 and matches the 78-byte Pillow GIF reference with SHA-256 edcba5284f8c6f34ffb4de0f7c6012a90b7a650c3c693ac97efe6ad176c74f6d. Its selected public parity passes. The full comparison shows no new branch coordinate: the false arm for split > 0 at src/codecs/gif/encode.rs:1832 remains missing, while this input exercises the false outcome of the later equality operand. The normal 22-row color quantization partition also leaves that arm unobserved. Retain this row for public token-encoding parity, not as a coverage gain; MCP source/build identity is unverified.

The additional GIF row enc_rgb_257_color_low_green_dominant exercises a skewed 257-color RGB distribution (source SHA-256 221a0b156a315d1113a1d491c7fe497b21253a21ff17ad28c9ac7dd6f3c7c0e7) and matches the 1,124-byte Pillow GIF reference with SHA-256 f63195630ba5ccc8c680101828adceb54944bfa35dd235d48ae7a7921cf070cd. Its selected public token-encode row passes. The full branch comparison shows zero new coordinates, and the refreshed query still reports the false arm of the split < sorted.len() condition at src/codecs/gif/encode.rs:1814. The selected input reaches the final axis entry but exits through the median-threshold break; treating the condition's false arm as unreachable for valid public inputs is a source inference, not receipt-verified Coverage MCP evidence. Keep the row for its exact palette-encoding parity value, not as a coverage gain.

The AVIF decode row animated_lossless_inter_420_clipped_b32x32_10bit_28x28 uses input SHA-256 f9d829f20968483dbd078a47f136b9c413205ce78d423fb0b5f1bdb2d2c0cce4. Pinned Pillow 12.2.0 returns two 28×28 RGB frames at 100 ms each, with hashes 925479a7e1eb832f5ce02848b2fb4df84769979f770e056ac398bf856cdcca1f and e8e893f5c8a17b1d22653f7d92adfed2021901ab37d9bcbc72debccfba3645bd; the selected public parity row passes. The selected report still shows missing outcomes in decode_inter_transform_size at av1/entropy.rs:6927 and :6938, so this row is retained for high-bit-depth clipped-frame parity rather than as a coverage gain. The report has no source/build receipt or test attribution.

Three WebP encode rows cover compressed, raw, and equal-sized alpha candidates. enc_lossy_rgba_alpha_compressed (source SHA-256 bdf14b68c3d95d39080728931fee6002ddb27624e816df41a1120ba497ee2a81) matches the 140-byte Pillow output SHA-256 9528b8edc7bbf5d2010bcaa1492f07feeef7d9004073c4ef3fdf8127f5a5a307. enc_lossy_rgba_alpha_raw (source SHA-256 e1105dfac182e64e01ef20cd87bbe44ffa4a187666161e1d54858afaf947ed36) matches the 4,210-byte output SHA-256 c3fed186ee97cc2418fd1815880646118e73fdaa3fed896bf977118972b13e4d. enc_lossy_rgba_alpha_size_tie uses a 9×1 constant-alpha RGBA source (source SHA-256 6e7e517108ef0e25c4f6c4257318ebf06f0abb2bea133804ea2417883e586d14) and matches Pillow's 100-byte output SHA-256 f99e6b76bea04b1263728c6f4c6d275db57a7e9e1636887f6da8df0f1d84b594 through both ordinary and token-aware public encode calls. The exact tie exposed a parity bug: Pillow keeps the compressed candidate on equal lengths. Both Rust paths now choose raw only when it is strictly shorter, retaining the existing compressed buffer on a tie. The selected row passes with five public encode calls and no panics. Coverage MCP reports both outcomes of the ordinary Noop-writer size decision covered at webp/native/encoder.rs:2750; its token-specialized sibling arms remain unobserved in that block because the specialization receives Some(token). MCP source/build receipts and test attribution are unavailable, so the coverage mapping remains coordinate evidence.

The AVIF matrix now includes two size-zero box cases. size_zero_top_level_free appends a size-zero top-level free box and payload to the baseline (input SHA-256 0390a339020a54aa4ddb7600b988407c10efdc21ec0bdff762a793b7a1217e6c). Pinned Pillow 12.2.0 returns the same 128×128 RGB pixels as the baseline: 49,152 bytes with SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf. The error_meta_nested_zero_size_ipma case sets the final nested ipma box size to zero (input SHA-256 01ef1212f06626031f796c5268e49065a340ab0308a0cc7db4a0fdbafcfdbc65); Pillow rejects it as malformed, and its active public row passes. A Coverage MCP coordinate comparison with the pre-case full report shows one additional observation at samples::next_box (samples.rs:264), and the refreshed filtered query reports no remaining branch gap there. The comparison has no source/build receipt or test attribution, so it cannot bind that observation to these rows. avif/container.rs:449 still has an unobserved nested-size rejection arm: public validation rejects the nested box in samples::validated before reaching the duplicate container parser. The error_meta_duplicate_primary_item AVIF row changes the baseline's nested iloc FourCC to a second pitm without moving box data (input SHA-256 3badc9ce02273d7ac0210aa6bcc3634e75cfed2531b30427bf721620452ab2c3). Pillow rejects the malformed meta box and the selected public row passes. Compared with the full report captured before this row, Coverage MCP reports one new observation at samples::parse_meta (samples.rs:471); the refreshed filtered query has no gap there. The report comparison is coordinate-only because it has no source/build receipt or test attribution. The error_meta_nonzero_version AVIF row changes the top-level meta FullBox version from zero to one (input SHA-256 81cbc07cf4cad9653c58c47c7b88fcd3c323d7f749e2c47cbb39995a3a411b9b). Pinned Pillow rejects it as malformed, and the selected public AVIF row passes. The current filtered Coverage MCP query reports no remaining branch gap at samples.rs:449; source/build receipts and test attribution are unavailable. Two more AVIF error rows relabel a later meta child to exercise duplicate tables. error_meta_duplicate_item_info changes iprp to a second iinf (input SHA-256 51045cb251dc8cbbdfa245be7893f8fa54735e16414a71cb77abd0708e4f7aec), and error_meta_duplicate_item_location changes iinf to a second iloc (input SHA-256 8139b4019d1bdaad53622eaa137d0b8987b29b06a1d360df2c1dc0218d546f76). Pinned Pillow rejects both, and both selected public AVIF rows pass. Compared with the saved report before these rows, Coverage MCP shows two new coordinates at samples::parse_meta (samples.rs:478 and :499); the filtered queries have no remaining gaps there. The comparison has no source/build receipts or test attribution. The JPEG row baseline_444_multiscan_duplicate_dqt_after_snapshot duplicates the 69-byte DQT marker between the first two component scans (input SHA-256 a73504634df562811870132182af22730318fa2f4416347770499aa412c71e56). Pillow 12.2.0 returns the 8×8 RGB reference (192 bytes, SHA-256 983025493b251f11b379bbbf15a92cde4e5b9177e63626ff035e0049cc6779b4), and the selected public JPEG row passes. Coverage MCP reports one new coordinate at jpeg/decode/parser.rs:431, with no remaining filtered gap. This comparison also lacks source/build receipts and test attribution. The JPEG row baseline_444_multiscan_duplicate_dht_after_snapshot repeats the first DHT marker twice between the first two component scans (input SHA-256 60ce19025b6c5e78ff18659ffea26dc97a0c628bb29dbc9c78c4d653c8c708f6). Pillow 12.2.0 returns the same 8×8 RGB pixels as the three-scan source (192 bytes, SHA-256 0d4dccc69dc0ee4ae956be8c624186ddb2b5f3d411671361056c51a7ea7f9e66), and the selected public JPEG row passes. Comparison with the saved report before this row shows three new branch coordinates at jpeg/decode/parser.rs:442; the current filtered query has no gap there. This remains coordinate-only evidence without source/build receipts or test attribution. The TIFF parity matrix adds tiled_gray2_deflate_short_tile (input SHA-256 1fb7f7d7d6a281cb667c365fe097bc868d841ec246783bd0b5014f4417127d8) and tiled_palette4_oob_tile (input SHA-256 175f8b4e1c2df6e59d8a758892b8430ddc03cf23c24e26db752faff754435cb6). The first has a valid Deflate stream that expands to a truncated packed tile; the second has a tile offset outside the file. Pinned Pillow opens both headers and rejects pixel loading with decoder/truncation errors, and both active public Rust decode rows pass the expected malformed-input parity. The full all-feature coverage campaign passes with these rows in the matrix.

The tiled_deflate_no_predictor row adds a 128×128 RGB TIFF using Deflate tiles without a Predictor tag (input SHA-256 fddee4f848bfcde2bf9f8064016278ba0d8a755d7f0fc3598c756755e2399f73). Pinned Pillow 12.2.0 produces the exact 49,152-byte RGB reference with SHA-256 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131; its active public matrix row passes. The full local LLVM report records 64 false-arm hits at decode_ifd:454, and the filtered Coverage MCP query no longer lists that predictor branch.

The packed-tile helpers no longer repeat bounds and sample-width checks already guaranteed by their callers; checked bit-offset arithmetic remains. Strict Clippy and the full all-feature suite pass. Removing the two duplicated layout guards reduced the local branch inventory from 32,264 to 32,254 arcs. Filtered MCP queries no longer report gaps at decode.rs:290, :454, or :1141; they still show one header-magic error arm and two LZW output-length guard outcomes. The active error_bad_ifd_lzw_invalid_first row emits code 258 and exercises the separate code >= CLEAR arm in both ordinary and token-aware public decode paths. The remaining output.len() >= expected operands protect an internal state which public TIFF dimensions and capped output writes do not allow. The header magic arm is also unreachable through normal public dispatch: detect_format recognizes only signatures whose magic parse_header considers registered. These MCP locations remain coordinate evidence because source/build receipts and test attribution are unavailable.

On this report, the filtered branch query shows no missing branch groups in src/codecs/jpeg/encode/encode_baseline_422_block_row_streaming. The selected enc_sub_422_streaming_exif_restart_rows public parity row passes and its selected report observes the true EXIF arm at jpeg/encode/mod.rs:1958; the opposite arm remains unobserved in that selection. The report lacks source/build receipts, so it does not bind the observed arm to a source revision or prove test attribution.

The JPEG decode matrix now has 161 active rows. The new baseline_cmyk_aligned_entropy_truncated_tail_64 case uses a 32×8 MCU-aligned CMYK image with 64 entropy bytes removed before EOI (input SHA-256 51f4f76d8a6144572eb0880c5722f290840db23c6fa5a83148ac1a1947d7445c). Its exact 1,024-byte Pillow output has SHA-256 89b4bd202579d6c4c3497dc124d1d45795ffb3dd74bb25a024a40d66f094c718. Public parity passes, and the selected report observes the incomplete-data arm at jpeg/decode/decode.rs:916; the full Coverage MCP query lists no remaining gap there. MCP source/build receipts are absent and test attribution is unknown, so those findings remain coordinate evidence.

The progressive_dqt_redefined_between_scans JPEG row inserts an identical DQT segment after the first DC scan of the 128×128 progressive fixture. The 5,579-byte input has SHA-256 353d4f1b20a5b73e473deef0d401dd91a9d2973c6065b0dfddd005edf21785da; its exact 49,152-byte Pillow output has SHA-256 e92abdc1f9d14fd2491920de98bdcee028788715bebc6ba5d21b20d89b59fd76. The public JPEG decode row passes. Local full LLVM coverage now records three hits for the previously unseen !progressive false outcome at jpeg/decode/parser.rs:431; the filtered MCP query no longer lists that span, though a later conjunction outcome on the same line remains uncovered. MCP source/build receipts are absent and test attribution is unknown.

The animated_lossless_inter_420_b8x16 AVIF row adds a two-frame 8×16 I420 sequence whose public decode selects a lossless B8×16 inter transform. Its 1,152-byte input SHA-256 is 9e3fbac5e42c61413ec8c1f7f4f72bc1338fb7cfd21587e30826855732e369c0; exact 384-byte frame references have SHA-256 201fc960015c0e0974cb9b6aab74c9147694ddfd7876da531b696fc3639257e6 and aebfeaa0e20ab2e7aad44ca321ed0bdebaea085045a02954e55eb63505342659. Both frames have 100 ms durations, and the pinned native loop oracle records infinite repetition. The selected public parity run and refreshed full local report hit the lossless_rect and exact B8×16 outcomes at av1/block.rs:56172. Coverage MCP still lists sibling outcomes and other decoder instantiations at that line; source/build receipt and named test attribution are unavailable.

The active enc_animated_rgba_transparency_composite row decodes a two-page RGBA TIFF (input SHA-256 445c160373a2391d3e090179cf9e5b3959382c1753b9ed762b0a653ec81bf5e6) and encodes both frames through the public GIF sequence API. Its 90-byte Pillow reference has SHA-256 e6fbf77ce827bd01c711a70ea9b48468b3ddf10dcca7bc9635e96eceeee63a7f. The focused GIF matrix test passes, and the fresh filtered Coverage MCP result no longer lists the false arc in composite_image at encode.rs:710. Coverage MCP's report remains coordinate-only because source/build receipts are absent and test attribution is unknown.

The active enc_error_oversized_dimensions BMP row supplies a valid packed L1 image of width 2,147,483,648 (268,435,456 bytes) through the public encoder matrix. Pillow 12.2.0 raises OverflowError: signed integer is greater than maximum; the focused BMP matrix and full coverage campaign pass. The fresh filtered Coverage MCP query no longer lists the width-failure arm in bmp_file_fits. The height-failure arm remains unobserved: a valid 1×2,147,483,648 packed L1 image requires a 2 GiB pixel buffer, so the matrix retains the existing Pillow error row without constructing that buffer. Coverage MCP has no source/build receipt and unknown test attribution, so these locations are coordinate evidence.

The active enc_sub_420_q10_small_image_threshold JPEG row encodes the existing 17×17 RGB input (source SHA-256 cb1632ddf154ea044863205d6b6f6e8249c70791a044debdc2b80b8fae92622e) with quality 10, baseline 4:2:0 subsampling, and optimization disabled. Pillow 12.2.0 produces a 690-byte reference (SHA-256 ff93ff388fa786b630cff562f4052d31de74e9f4d2cdd076b1377f4cf83a8cba). The focused public matrix case passes exact byte parity. Its selected report is target/release-evidence/coverage-jpeg-q10-sub420-small-20261003.json; the full-report query at jpeg/encode/mod.rs:713 now has no missing branch group. The selected report observes the small-image false arm, but the MCP source and test receipts remain unverified/unknown.

The packed FDCT encoder now multiplies all four rounded coefficient numerators by their shared reciprocal with safe u32x4::widening_mul. Both the packed and scalar paths apply the exact possible one-step correction by subtracting the boolean as 0 or 1. The full public JPEG encode matrix passes exact Pillow byte parity. Coverage MCP's filtered full-report queries list no missing branch groups at jpeg/encode/mod.rs:3042 or :3212; the report still has no source/build receipt and unknown test attribution. Three five-round public benchmark runs measured the 512×512 RGB quality-10 4:2:0 case 7.6–8.1% faster than the scalar baseline, with identical encoded bytes and hashes. The full-matrix geometric mean stayed within 1% of baseline, so this is a targeted low-quality workload gain rather than a general JPEG speedup. Artifacts are in target/benchmarks/jpeg/arm64-goal-quantize-simd-{baseline-20261003-b,candidate-20261003-a,candidate-20261003-b,branchless-20261003-c}/.

Coverage MCP still lists the true checkpoint arms at src/codecs/webp/native/encoder.rs:1378 and :1418 as missing in this full report. The experimental large lossless input did not observe either arm and failed exact Pillow parity, so it is not a retained matrix case. The preceding full report's filtered queries found no remaining branch gaps at container.rs:608 or :622, or at jpeg/encode/mod.rs:2201, :2241, and :2283. An earlier filtered query on coverage-after-gif-parity-20261003.json reported no remaining branch gaps in the WebP grayscale/alpha scan. The grayscale RGBA input has 1,024 opaque pixels before varying alpha, so its token-aware scan crosses one checkpoint before selecting the per-tile predictor; alpha classification now shares that grayscale traversal. Two 32×32 partial-alpha RGBA rows exercise the red/green and green/blue early exits. Both match Pillow byte-for-byte at 942 and 954 bytes, respectively, with ordinary and token-aware public encoding. The opaque grayscale shortcut remains available for fully opaque input.

The active decode:gif:valid_frame_missing_trailer row exercises Pillow's acceptance of a complete one-frame GIF that ends at a top-level block boundary without a trailer. Its ordinary and metadata-limited public decode paths match Pillow's 1×1 palette image. The focused GIF matrix passes 80/80, strict lint passes, and the full coverage run above passes. Coverage MCP's filtered branch query reports no missing branch groups in src/codecs/gif/inspect.rs; the report lacks source/build receipts, so this is coordinate evidence only.

Coverage MCP also lists AV1 decode_following_vertical at block.rs:67554, but the full_strict outcome is unreachable through today's public decoder: all four callers use Lossy420Decoder constructors fixed to 4:2:0. The true arm at block.rs:21111 is ordinary nonzero-plane decoding, already represented by active I444 residual rows. Neither coordinate provides a distinct public parity case; the report remains unverified coordinate evidence.

Selected parity and coverage — 2026-10-03

The JPEG public decode matrix passes 174/174 active rows, including valid cases where Cb and Cr use different sampling factors. Those cases exposed a panic in the generic reconstruction path: it cropped Cr using Cb's plane dimensions. Reconstruction now crops and upsamples each chroma plane from its own sampling factors. The existing baseline 4:2:0, 4:2:2, 4:4:4, grayscale, and CMYK direct decoders still return before this generic path.

The four selected baseline_420_chroma_component_sampling_fallback rows pass 4/4. Their LLVM report is target/release-evidence/coverage-jpeg-chroma-component-sampling-all-variants-20261003.json. Coverage MCP's older full report showed missing true arms for the Cb/Cr horizontal and vertical sampling guards at decode.rs:1170-1173; the selected report now observes those true arms. The false arm at line 1173 remains uncovered in that selected run. This is coordinate evidence from reports with no source/build receipts; MCP lists test attribution as unknown.

The selected 4:2:2 sampling, CMYK sampling, and restart rows pass 7/7. Their LLVM report is target/release-evidence/coverage-jpeg-sampling-fallback-guards-20261003.json. Coverage MCP shows the selected 4:2:2 cases reach the component sampling fallback guards at decode.rs:1430-1433 and the CMYK cases reach the non-1x1 sampling guard at lines 962-965. The report does not observe every opposite arm in this selection; source/build receipts are absent and MCP lists test attribution as unknown.

The AVIF ipma_wide_property_associations row passes its selected public parity case (1/1). The selected LLVM report is target/release-evidence/coverage-avif-wide-associations-20261003.json. Coverage MCP reports 2,142/32,164 branches observed in that selected test and leaves the false arm of parse_ipma at container.rs:1077 uncovered. The earlier full report listed the true arm at that coordinate as missing. This is consistent with the selected row exercising the wide-association arm. Both reports lack source/build receipts and MCP lists test attribution as unknown; the incremental comparison is incomparable, so no combined coverage gain is claimed.

The active compression_lzw_lzw_long_phrase_checkpoint_1024 TIFF row adds a Pillow-exact 525,825-pixel grayscale stream whose growing LZW phrase reaches 1,025 bytes and crosses the token-aware output checkpoint. Its input SHA-256 is 0e85b9b6a8f064755ce9f1934d838c5d64c2e8fb5b453a2fe072ba347f2f0; the Pillow pixel reference SHA-256 is e32ad4269a71ed42a3d18578f1e3cbd8ec3a0b026b8215287483b0d47fa9e7bd. The selected TIFF matrix suite and full coverage run pass. Coverage MCP's filtered query reports no remaining branch group in append_lzw_with_token; its coordinate comparison observes the checkpoint's true arm once. The report has no source/build receipt and test attribution is unknown, so this remains local coordinate evidence rather than a managed Coverage MCP claim.

Coverage MCP still reports eight uncovered branch observations in WebP's main optimize_sampling and one in its cross-color sampler, plus two observations each in GIF's split_median_box and token-aware variant. A 16,320×576 token-aware WebP candidate reached 641 row comparisons but still missed the main sampler's row-checkpoint true arm and column pass; it encoded to 222,328 Rust bytes versus 222,334 Pillow bytes, so it remains outside the parity manifest. This report has no source or build receipt and test attribution is unknown, so Coverage MCP comparisons are source-coordinate diagnostics rather than verified coverage gains. For the GIF misses, a 2×1 two-color Pillow control reaches the equal-value fallback, but public-path branch counters confirm that the initial split loop's exhausted condition and the fallback's split > 0 false arm remain unobserved. With positive, nonsaturated per-color counts, the midpoint loop breaks on the last color and the fallback stops at a prior distinct color; no public fixture witness for either false arm was found.

The same full report has a PNG chunk-iterator stop observation. Its raw LLVM branch table identifies the missing arm as Chunks::failed; the position-at-EOF arm is already exercised by the active missing-IEND input. Every public chunk consumer propagates a chunk error immediately, so none requests another item after failed becomes true. TIFF's packed-tile extent checks follow validated tile geometry and bounded source rows. BMP signature guards and ICO size guards are preempted by public dispatch/source validation; reaching the BMP file-size limit with a valid image would require impractically large pixel storage. These remain defensive branches without valid public Pillow parity witnesses, rather than reasons to add private coverage-only tests.

Coverage MCP's TIFF LZW gap at decode_lzw:1888 is the right side of the || check (output.len() >= expected). The active error_bad_ifd_lzw_invalid_first row passes public parity but returns on the left side (code >= CLEAR) before evaluating it. Successful output writes return as soon as they reach expected, so the right-side true outcome remains a defensive state without a valid public input witness.

The new tiled_rgb1_packed_multisample_rejected row preserves Pillow's malformed-error parity for packed 1-bit RGB tiles. It does not reach the decode_ifd tile-sample guard at decode.rs:289-291: layout_and_palette rejects RGB below 8 bits earlier, and every currently supported packed layout uses one stored sample. Its selected LLVM report records no branches at that guard, so the row is an error-parity edge rather than a coverage gain there. A fresh selected run passes 1/1 and is recorded at target/release-evidence/coverage-tiff-packed-tile-control-20261003.json; Coverage MCP likewise reports no observations at that guard or in copy_packed_tile_into/copy_packed_tile_row. The report is selected-test evidence with no source/build receipt and unknown test attribution.

Coverage MCP's remaining JPEG encoder groups include zero-dimension and unsupported-sampling guards in downsample_without_checkpoint, downsample_two_to_one, and downsample_with_checkpoint. Public image validation rejects zero dimensions, and JpegSubsampling exposes only 4:4:4, 4:2:2, and 4:2:0; no-token 4:2:0 uses a separate pre-downsampled path. The encode_six_coefficient_major_edge_raw_blocks helper also receives chroma presence flags set to true at both public call sites, while its absent-luma edge makes the uncovered present[3] outcome unreachable. Existing exact parity rows cover the supported sampling and clipped-edge paths.

The JPEG direct-decoder bailout audit found a valid baseline multi-scan edge: Pillow accepts a 4:4:4 image that encodes Cb, Y, and Cr in separate non-interleaved sequential scans. The active baseline_444_three_sequential_scans fixture is generated by splitting a single 8×8 interleaved Pillow JPEG. The resulting file has SHA-256 b9e3e277c0d05b2df169804236d5f9b72d3a1c8beda33e845f9c6ffd436f424b, and its decoded pixels match the original Pillow JPEG exactly (pixel SHA-256 0d4dccc69dc0ee4ae956be8c624186ddb2b5f3d411671361056c51a7ea7f9e66). The active baseline_444_three_scans_dqt_redefined variant inserts a new 8-bit Cb quantization table between the first and second scans. Pillow's decoded pixels differ from the original when the final table changes (input SHA-256 74d02103e151831846019cbcf009f2d17912988045e8d82e850828e18d1724f7, pixel SHA-256 983025493b251f11b379bbbf15a92cde4e5b9177e63626ff035e0049cc6779b4), so each component latches its quantization table at its first scan; scans retain their SOS Huffman and restart settings. The decoder handles non-interleaved block geometry and resets DC predictors at scan and restart boundaries. Single-scan baseline decoding keeps its existing dispatch and fast paths, and the parser defers per-scan table copies until a later scan or table update requires them.

Coverage MCP surfaced three additional Pillow-tolerated SOF0 cases. The baseline_444_multiscan_ss_nonzero row sets Ss to 1 in the first sequential scan; Pillow returns the same pixels as the ordinary three-scan input (input SHA-256 7a36ce48ba3d15bcefb15ad70b1a5e3f0c70523c84d2cdadade2ed6531e0094d, pixel SHA-256 0d4dccc69dc0ee4ae956be8c624186ddb2b5f3d411671361056c51a7ea7f9e66). baseline_444_multiscan_duplicate_component changes the final scan's component ID from Cr to the already-seen Cb (input SHA-256 76b4d1d36238ff9f92d63a44bb6dc1bcde040e99e0217f15b1c96f4a624668cc, pixel SHA-256 2b73ccd3b62ddd2c645e63cd0d65ed016fc25a461d82e161514ac0d48fb2fb52). Pillow maps that scan back to Cb and leaves the omitted Cr plane neutral. Its coefficient buffer retains earlier AC values where a repeated sequential scan encodes zeros, so the Rust path stores coefficient history only for components that repeat and merges the later block coefficients. This follows libjpeg-turbo's multiscan coefficient buffers and Huffman decoder (jdcoefct.c, jdhuff.c). The baseline_444_multiscan_missing_component row omits the final Cr scan and leaves its neutral plane initialized (input SHA-256 d91a46924a2310aae6a9b7c16fd7f091eaf21bff8a8b74dc99c388d1983e6a8a, pixel SHA-256 669b0f32cd296cd0742d7e9b8e9c25cf7a4f114b6a5788f83af5ed0e89f409b7). The baseline_444_multiscan_empty_entropy row removes the first component scan's entropy while retaining its SOS; Pillow accepts the file and leaves that component neutral (input SHA-256 f8bba1d8f8e8f631f5487349550f64a3bd3438a9789ed293619d7e2553be6192, pixel SHA-256 1b343e02a958d0137fd239618dd0332265457fc011296714fe1a42cf0e35d49d). baseline_444_multiscan_interleaved_restart combines Y and Cb in one scan, leaves Cr in a singleton scan, and places a restart marker between its two MCUs (input SHA-256 ddbcf29eb1549aae0356661ff2b879b7b2b23b7aae924adbb424af22246e20d7, pixel SHA-256 f83545d43c6939ec393b6b8310959b6174fd764b08a12fc22d908408a7e6a43e). The baseline_444_multiscan_restart_overrun variant adds two trailing restart markers; the first creates an empty segment after the final MCU. Pillow accepts it and returns the same pixels (input SHA-256 1aac34523a7e6491744764d84c9c0de21ef9a308d532924e121c7c36229defe6, pixel SHA-256 f83545d43c6939ec393b6b8310959b6174fd764b08a12fc22d908408a7e6a43e). baseline_444_multiscan_duplicate_component_dc_only repeats Cb with blocks containing only DC coefficients, reaching the repeated-component DC-only path (input SHA-256 3a316bfffa1834975e775d7a4dd62f0766919eef85bdd5a44f0401f12f17f429, pixel SHA-256 fa7b78cc215df21d7ce54d8c3c6637c326dab95c10fbc12263101365973f4268). All seven tolerance cases match Pillow. The JPEG decode matrix passes 188/188. The active entropy_all_ones_huffman row is a grayscale baseline JPEG whose SOS prefix is followed by two stuffed all-ones entropy bytes and EOI. Pillow 12.2.0 decodes it; the input SHA-256 is bef219c962289debcec499023a86acf162a5e51c0ccd78309162f845a2544456, and the exact 128×128 L8 reference SHA-256 is f9db8abaac585e058a892932da246a2cd05aec42b862dd931ffee9891577c4de. The fixture reaches the fast decoder's overlong-code sentinel with length 17. Coverage MCP no longer lists the overlong-length guards in either the scalar or fast decoder in the current full report. The active empty_dc_huffman_table row starts from sampling_3x1.jpg and replaces DC0's DHT entry with a zero-symbol table. Pillow 12.2.0 decodes the resulting 617-byte input (SHA-256 c28fa453e06196681ad2815bfe6dd320ee2239e19d9efba3999d0bdc9c5c8d14) to a 24×8 RGB image (pixel SHA-256 65f0bcf872b036301186859680a42be71467f6fd402c47ab2cc20c68e10dee44). Rust now follows IJG's fake-zero recovery for scalar and fast overlong codes while preserving the error for its internal invalid-table sentinel. The empty-table fixture reaches scalar decode_slow at length 17. Remaining filtered gaps are fast ensure true at huffman.rs:373, fast values.is_empty() true at line 390, scalar ensure true at line 329, the invalid synthetic sentinel at line 349, and the missing-symbol arm at line 360. MCP reports source/build identity as unverified and test attribution as unknown. Coverage MCP reported remaining unobserved branches in reconstruct_baseline_multi_scan; its local report has no source/build receipt and unknown test attribution, so it is coordinate-level guidance rather than a managed coverage claim. A header-only SOS component-ID swap remains rejected by Pillow as a broken data stream; no parity case is claimed for that mutation. The final full make coverage run passes all tests and repository floors: 86,169/142,520 lines (60.4610%), 16,492/32,268 branches (51.1095%), 4,810/8,989 functions (53.5098%), and 131,806/220,404 regions (59.8020%). Coverage MCP now reports one branch at decode.rs:2268: an empty extracted segment set with nonempty scan bounds. The JPEG parser ends each entropy range at the first non-stuffed, non-restart marker, so this error arm appears unreachable through manifest-visible inputs. The LLVM report has no source or test receipt; MCP marks both as unverified/unknown.

Coverage MCP also pointed to a valid baseline JPEG with a DQT marker after its only SOS entropy scan and before EOI. Pillow 12.2.0 accepts the full 8×8 4:4:4 input and decodes it identically to the source without the trailing marker (input SHA-256 1b4519e48e1ce711cd1cbb44c3173ef3c97f222b8aa1686f9437df5e5f906372, pixel SHA-256 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f). The public baseline_444_single_scan_trailing_dqt row exercises this case. Single-scan reconstruction now stops entropy extraction at the scan boundary and uses the quantization-table snapshot captured before the marker. Pillow also accepts an empty trailing DQT (input SHA-256 bedd3492ec593158787385c58ec04055ecedd0beb334d1dbcae55716cb3ed9a3) and marker fill before a nonempty trailing DQT (input SHA-256 6f4e22755f714d4fe3dab67e8d9e0154abc33cd80714ba4cd7ba4792abfa18e4); both produce the same pixel hash above. The public baseline_444_single_scan_empty_trailing_dqt and baseline_444_single_scan_dqt_marker_fill rows cover those forms. The code keeps the existing single-scan dispatch and fast paths. The focused public rows and full JPEG decode matrix pass; these are previously unsupported valid inputs.

Coverage MCP identified the false arm of the second comparison at src/codecs/jpeg/decode/huffman.rs:410: a valid AC DHT has the standard luma code counts but a different symbol order. The public baseline_444_unused_custom_ac_table fixture inserts an unused AC table 2 into the complete baseline_444.jpg input, swapping the first two symbols assigned to one code length. Its generator pins the source and generated-input SHA-256 values and verifies Pillow 12.2.0's decoded RGB SHA-256. Pillow accepts the 9,329-byte input as 128×128 RGB and preserves the baseline pixels exactly; Rust matches all 49,152 Pillow bytes. The selected public matrix row passes 1/1. Its LLVM branch report changes the targeted arm from zero observations for decode:jpeg:subsampling_444 to four observations for the new row. The Coverage MCP selected-test comparison reports the line-410 arm as newly observed, but remains limited because source/build receipts are absent. The selected report is target/jpeg-coverage-probe/coverage-public-row.json; this is coordinate-level evidence, not a full-suite coverage claim.

JPEG direct-safe SOF component-count invariant — 2026-10-04

Coverage MCP also showed missing true arms for components.len() != N in the grayscale, CMYK, 4:2:0, 4:2:2, and 4:4:4 baseline direct-safe paths. Those arms are unreachable from public JPEG inputs: parse_sof0 builds the component vector from the SOF count, the parser derives num_components from that vector, and its sole JpegInfo construction stores both values together. The five redundant hot-path checks were removed and the invariant is documented on JpegInfo; no private unit tests or coverage exclusions were added. The public JPEG decode matrix passes 203/203 rows. The selected LLVM report is target/release-evidence/coverage-jpeg-direct-safe-guards-20261004.json; MCP has no source/build receipts, so it is row-local evidence and does not support a verified aggregate coverage-gain claim.

Coverage MCP also lists repeated AV1 specialization observations in decode_inter_translation_impl and decode_following_vertical; specialization counts are not distinct source branches. A selected run of the clipped animated_lossless_inter_420_clipped_b32x32_64x60 row passes public parity and reaches the true outcome at lines 54836–54838 in one of eight compiled decode_inter_translation_impl specializations. Its report has no source/build receipts, so retain this as coordinate evidence.

The 32×32 animated_lossless_inter_420_b32x32_10bit row records no branch counts at lines 54836–54845 across eight compiled specializations. A separate selected run of animated_lossless_inter_420_b32x32_10bit_64x64 passes public parity and records six false outcomes at block.rs:54838 (tools.sample_depth == SampleDepth::EIGHT) in one specialization, with the preceding 32×32 LosslessGrid match reached. This existing full-size case already witnesses the sample-depth false arm. The 28×28 10-bit clipped fixture uses B8×8 leaves; high-depth clipped B32 geometry is rejected by the current planner before this block evaluator, so it does not need a new fixture to cover the false arm. The selected 64×64 coverage report is target/release-evidence/coverage-avif-10bit-64x64-target-20261004.json. Coverage MCP still lists other missing specialization observations, and its incremental comparison with the full baseline is incomparable because exact baseline branch detail is incomplete; this does not claim a marginal full-suite coverage increase.

decode_following_vertical has no observed calls in this report; its production caller requires a lossy 4:2:0 16×16 split in a closed frame context. A 16×16 q76 noisy-quadrant AVIF probe decoded in Pillow but returned NotImplemented from the Rust public decoder, so it was not added. No valid Pillow-parity witness for this remaining gap was established. The reports have no source/build receipts; Coverage MCP marks source unverified and test attribution unknown, so these are source-coordinate diagnostics only.

Coverage MCP reports no remaining branch gap in decode_portable at lines 492, 496, 535, 555, 588, and 606 after adding 10-bit alpha 4:2:0, 4:2:2, and 4:4:4 public parity rows. It reports no remaining gap at webp::inspect::validate_animation_frame line 311 or in the token-aware GIF coalescing group. These are source-coordinate diagnostics; the report has no source/build receipt and marks test status unknown.

Seven public limited-range monochrome parity rows now cover RGB and auxiliary alpha output at 8, 10, and 12 bits, plus BT.2020/PQ CICP. Their selected rows match exact Pillow output and the full AVIF decode matrix passes. The CICP row shows monochrome admission no longer needs a 1/13/6 color declaration. Coverage MCP reports no branch gaps in limited_luma_to_u8; remaining AVIF groups are plane-shape guards at decode_portable lines 457–463 and decode_monochrome_portable lines 676–684, plus the false subsampling_x/subsampling_y check at line 410 of monochrome_primary_sequence_supported. The shape guards follow validated plane assembly, and AV1 monochrome sequences have fixed 4:0:0 subsampling, so these arms have no known public encoded-input witness. The report is unverified for source/build identity and test attribution.

The active enc_rgba_octree and enc_rgba_octree_sorted GIF rows now also call the public encode_with_token API on their existing RGBA inputs. Each token-aware result is compared byte-for-byte with both the exact Pillow reference and ordinary Rust encoding. Both selected parity rows passed, and Coverage MCP reports no remaining branch gaps in gif::encode::apple_qsort_buckets_with_token in the refreshed full report.

The active animated_lossless_inter_420_clipped_b32x32_185x64 AVIF case adds a 185×64 two-frame, lossless 4:2:0 B32 edge input. Its final block has 25 visible columns; the input is pinned by SHA-256 701d247ebbe2666b1f28f447fa1a086573e7dc6d88b0b29405f9f7a6f9460b59, and its two Pillow RGB frames are pinned by SHA-256 ac76c404cf3001f4e087307516e596223e3e5f1c26d7eaf8860bc710b88761a1 and 336f948700529f81199b9d8fb0adcc8da79dcc00b06ffffa5b66d5dee255199e. The selected parity row and full AVIF matrix pass. This edge does not make the AV1 partial-grid false arm observable: the relevant decoded extent is MI padded to a multiple of four.

The active animated_lossless_inter_420_clipped_b32x32_64x60 AVIF row adds a two-frame bottom-edge crop case with exact Pillow frame parity. Its selected LLVM run reports selected=1 active=1 and passes the row. The report records 11 calls to inter_lossless_grid_clipped_b32_geometry_supported; one B32x32 call passes the 32-pixel width check and takes the 28-pixel visible-height arm. decode_inter_transform_size runs 11 times, but the later clipped-plan arm at line 6927 remains unobserved in this selected run. Coverage MCP marks the report's source unverified and test attribution unknown, so these local counters are scoped diagnostics, not managed coverage attribution.

Two active TIFF parity inputs set the separate-planar RGB tile width or height to zero. Pillow opens and verifies both headers, then raises ValueError: tile cannot extend outside image while decoding pixels. Their input SHA-256 values are f8265499d2ee3d4e63e9525a76e70aa88cd9840891267c47aaa840928056617a and 1dc16a0bd0c6b6574ae38c9ed163bf931e343736e41a41f2d81a24331bd08cc0. The public parity run matches all four lifecycle results. These inputs cover both zero-dimension exits in verify_separate_planar_offset_count; the remaining mismatched-tag operand was removed because the preceding directory check rejects that state before this helper runs. Coverage MCP's filtered query now returns no branch gaps for the helper, with the same source/build and test attribution caveat noted above.

The JPEG encode matrix now has 74 passing active rows. The new enc_sub_444_unaligned_subthreshold and enc_sub_444_aligned_subthreshold rows pin exact Pillow bytes for 4:4:4 inputs below the row-streaming size threshold; together they exercise the three-component independent-entropy predicate and the dimension-alignment alternative. The token-aware GIF LZW and BMP raw-pixel paths also run through public parity: GIF passes 79/79 decode rows and BMP passes 106/106. The selected report target/release-evidence/coverage-public-parity-edges-20261003.json records the JPEG three-component arm and both token-aware BMP read paths. Its aggregate covers only the four selected rows, and Coverage MCP reports no source/build receipt and unknown test attribution. A seven-row token-aware GIF selection passes 7/7, covering the existing patterned frame, four LZW boundary cases, and invalid minimum code sizes on both sides of the accepted range. Its report is target/release-evidence/coverage-public-gif-token-lzw-edges-20261003.json; Coverage MCP reports no remaining branch observations at the invalid-size guard in gif/decode.rs:556 or the phrase traversal in append_code_with_token at line 695 for this selection. The full GIF decode matrix passes 79/79. This report also has unverified source/build identity and unknown test attribution, so it supports a selected-path observation rather than a full-suite coverage claim.

The VP8L structural inspector now follows nested VP8L chunks in ANMF frames when no top-level bitstream exists. The property map records the nested 16×16 frame header and color-indexing transform for pillow_tolerated_malformed_animated_vp8l_anmf_width_mismatch; the malformed outer width remains covered by Pillow parity, not by the VP8L parser.

Public parity coverage edges — 2026-10-02

Active Pillow parity cases target codec edges surfaced by Coverage MCP. The WebP row error_malformed_container_animated_frame_bottom_outside complements the existing horizontal frame-overflow case by moving the ANMF top offset down two pixels. Pillow 12.2.0 reports OSError: could not create decoder object, and the selected public parity row passes. The isolated LLVM report target/release-evidence/webp-frame-bottom-outside-isolated.json records four false outcomes for the horizontal operand and four true outcomes for the vertical operand at webp/inspect.rs:311. This is selected local evidence only; it has no managed Coverage MCP source/build receipt or test attribution, so it does not establish full-suite coverage.

The fdat_without_actl_before_idat PNG case uses a valid-CRC fdAT chunk before IDAT with no acTL; Pillow rejects it during inspection, and Rust now rejects it in the independent PNG inspector as well as the decoder. Its input is pinned by SHA-256 6d1a1d4a5fb1e4185b39fe44bd13e489d9a58680b3a5f7490ffcad4854148c4d. The apng_truncated_fdat_before_idat case puts a three-byte fdAT after valid acTL and fcTL chunks but before IDAT; Pillow raises ValueError: APNG contains truncated fDAT chunk. Its CRC-correct fixture is pinned by SHA-256 4f34e6caa28789baa349f5b3ada75f0ad7aae29f617717da9dffd6f906d2312b. The PNG parity matrix passes all 175 active rows, including both malformed cases and the existing valid sequence-only APNG case.

An earlier all-feature make coverage run passed every suite and repository floor with target/release-evidence/coverage-full-webp-tiff-jpeg-20261002.json: 85,519/142,085 lines (60.1886%), 16,254/32,178 branches (50.5128%), 4,788/8,972 functions (53.3660%), and 130,592/219,584 regions (59.4725%). The PNG parity harness decodes each successful row through decode_with_token and compares its exact pixels with Pillow. The existing WebP enc_exif, enc_xmp, enc_icc, and enc_lossy_alpha_exif cases now also run through encode_with_token; the harness checks exact bytes against Pillow and the ordinary Rust encoder. The WebP decode parity lane passes all 230 active rows. Four complete VP8X mismatch files exercise width and height rejection for both VP8 and VP8L, including inspect_basic. The three new files derive from valid generated WebP inputs by changing only one 24-bit VP8X canvas dimension; Pillow reports OSError: could not create decoder object, and Rust reports a structured malformed-image error. The VP8L decoder now checks its signature, dimensions, and version in the frame header and returns typed errors rather than panicking on malformed input. These checks run once before pixel reconstruction; the pixel loops and SIMD kernels are unchanged. Coverage MCP's filtered branch queries no longer list missing branches in inspect_extended_basic or LosslessDecoder::read_frame_header. Other groups remain in WebP inspection and lossless decoding. It still reports the false arm of encoded.len() >= 30 at src/codecs/webp/encode/mod.rs:912; valid public output already contains the 12-byte RIFF header and 18-byte VP8X chunk, so that shorter-buffer arm is unreachable there. The AVIF query still reports missing branch observations at src/codecs/avif/av1/block.rs:54833; the 10-bit fixture validates its sample but does not complete sequence surface reconstruction. These Coverage MCP queries are diagnostic: the full report has no source/build receipt and MCP reports test attribution as unknown. The 100% coverage goal remains open.

The new lossless_copy_out_of_bounds WebP decode row reaches the lossless copy-length bounds rejection: a singleton VP8L copy asks for 25 pixels when only 16 remain. Pillow reports OSError: failed to read next frame; the Rust decoder matches the malformed-input outcome. Its 8×4 fixture is pinned by SHA-256 abb0a3d2b630b23fc5bdd476bb59e9b7790a461ae60522ddc282fd53b27ef075. enc_wide_scanline_checkpoint uses a 1,025×1 RGB BMP row to reach the post-pixel checkpoint at index 1,024 in bmp::encode::write_rows; its exact 3,130-byte BMP output is pinned in tests/fixtures/outputs/jsons/Encode.bmp.json. enc_lossless_palette4_box_chain uses a 4×4,100 four-color WebP source whose packed palette stream reaches the 4,095-sample box-chain match boundary; its exact 62-byte output is pinned in tests/fixtures/outputs/jsons/Encode.webp.json. enc_sequence_raw_final_aligned uses two 4×3 RGB TIFF pages and produces an exact 352-byte encoded sequence ending on a 16-byte boundary. enc_animated_reserved_disposal re-encodes a two-frame GIF with disposal values 4 and 2; its exact 13,328-byte Pillow output exercises the GIF writer's valid FrameDisposal::Reserved(4) conversion. enc_sub_420_aligned_full_mcu_rows encodes a 32×32 RGB source through the complete 4:2:0 MCU-row converter; its exact 1,264-byte Pillow output is pinned with SHA-256 644ec00d071d47f21042a0548a7c2d89387c43039be6af375f7b087ef7c0f3a0. lossy_vp8_delta_segment_values decodes a four-segment VP8 frame whose quantizer and filter strengths use delta syntax. Stock libwebp always emits absolute segment values, so scripts/build_webp_delta_cwebp.py patches a temporary copy of pinned libwebp 1.6.0 and scripts/generate_test_assets.py verifies the resulting stream against its byte and decoded-pixel hashes. Pillow 12.2 decodes the delta and stock absolute-mode streams to the same 49,152 RGB bytes. The input PPM is pinned by SHA-256 9efd98332fada058f0ec106ac5c714b7898d640379b3739a22a1185397604421, the WebP asset by 9f6a1b274d9faf180fd024b962b068d6c4db5fe29e619868e7e4f9e91f12adbb, and decoded RGB by 6b2c202c55d0bf70d9f32b74c1b8705232ae41e0ed24203ea2b1b138dfd914fe. The portable_lossless_monochrome_alpha_17x17 AVIF row adds a 17×17 lossless monochrome color item with an auxiliary alpha plane. Its 900-byte input is pinned by SHA-256 573db25044c9dcbb03f00d623d20a30639d3334ba35feae6d57f115e208741bd; Pillow returns exact RGBA pixels in 1,156 bytes with SHA-256 d0201688c025cda34f274e3187240f35090e3366cb8883d3a3f04c45d03e0319. The case targets the has_alpha path in decode_monochrome_portable; its primary and auxiliary AV1 items are both monochrome. The AVIF decode parity matrix passes all 402 active rows. Coverage MCP no longer lists the true arm at src/codecs/avif/decode.rs:699 in the refreshed full run; source identity is unverified and test attribution is unknown, so this is diagnostic coverage evidence alongside the local parity result.

The bmp_8bit_default_palette ICO row sets the embedded 8-bit DIB's colors_used field to zero while retaining its full palette. Its 1,374-byte input is pinned by SHA-256 4915bb486fdd9b56d0bb200d43dfeb80efe82762a6e02485390b22cabc7f22ad; Pillow returns 16×16 RGBA pixels in 1,024 bytes with SHA-256 d3b82ecad923e39c5007fdae2b42acb59a6dd9d36419a4e1329d53859b824ff5. The ICO decode parity matrix passes all 55 active rows. Coverage MCP's refreshed full report no longer lists the true arm at src/codecs/ico/decode.rs:465; source identity is unverified and test attribution is unknown, so this is diagnostic coverage evidence alongside the local parity result.

The enc_cmyk_small_unaligned_fallback JPEG encode row uses the existing 13×9 CMYK source, below the streaming threshold and outside its alignment constraints. It exercises the baseline generic encode path and matches Pillow 12.2.0 byte-for-byte: 634 bytes, SHA-256 0d8885a6009b46e1f8f066fe90abadf5dac3153dcd11c5c63a8f62c15bf9b03a.

The enc_cmyk_aligned_subthreshold 32×8 row takes the aligned baseline streaming path with only 256 pixels, below the 1,024-pixel threshold; its exact 759-byte Pillow output is pinned by SHA-256 226d495545b556a72558ba6f9b768ef382372b2729eaa6481410313426c18fba. The enc_cmyk_aligned_width_partial_height 32×9 row reaches the aligned-width, partial-height fallback; its exact 809-byte output is pinned by SHA-256 aa5e354fe0ae1c8d072642ea27501f72252648fc1bb52a03bf3ff61d1730709c. Together with the 13×9 unaligned row, these three cases cover both alignment outcomes inside the baseline CMYK dispatch expression.

The enc_cmyk_optimized and enc_grayscale_optimized rows take the generic optimized entropy paths; Pillow's exact outputs are 10,325 bytes (SHA-256 7bb93dc5c122a85aa555e03c9912da5f22d8f5377226d7cb16ceb9af84070d4e) and 3,185 bytes (SHA-256 5612f6c2f016150cde09d9d35f336c8cf9115178772bff3d143a64804908b9ff), respectively. The JPEG encode parity matrix passes with all five rows active. Coverage MCP no longer lists branch gaps at src/codecs/jpeg/encode/mod.rs lines 607, 608, or 631 in target/release-evidence/coverage-full-jpeg-optimized-paths-20261002.json. That full report passes every suite and repository floor: 85,184/142,042 lines (59.97%), 16,037/32,156 branches (49.87%), 4,780/8,972 functions (53.28%), and 130,166/219,556 regions (59.29%). Its source/build identity is unverified and test attribution unknown, so the branch results are diagnostic evidence beside the local parity results.

The error_malformed_structure_apng_fdat_payload_before_idat PNG row places frame-data payload after an fdAT sequence number before the default image's IDAT. Pillow raises OSError: broken data stream when reading image file when decoding and SyntaxError: broken PNG file (chunk b'\x00\x00\x00\x01') when verifying. Its input is pinned by SHA-256 07d84a0ef147069484e49bdb3a63aca3a28d5e863d6af033708c3b186434d783. Parity exposed a static PNG decoder path that previously ignored this invalid APNG state; the decoder now validates the sequence-only exception and rejects early frame payload before IDAT.

The compression_deflate_deflate_predictor_checkpoint_343x2 TIFF row uses 343×2 RGB pixels with Deflate and horizontal Predictor 2. A 1,029-byte scanline reaches the predictor's 1,024-byte cancellation checkpoint. The 194-byte input is pinned by SHA-256 1a0c5c7ce1a80fa071619c138e8702854ece6d7101fcd16cb93db4b8de899cdf; Pillow's 2,058-byte RGB reference has SHA-256 ab69d4afd329ce8d28339663557fdc4a3c66844a0ddde05f87bdf61f1b75574f.

Two AVIF malformed rows cover required meta child validation: error_meta_first_child_not_hdlr changes the first child box away from hdlr, and error_meta_hdlr_non_pict declares a non-picture handler. Pillow raises UnidentifiedImageError for both. Their input SHA-256 values are 21062fa34dab7a259cc7aa47f7960a5c2a0b1b39d28396f361c46c5e4a754a9c and 39d963ae504465535d09d7341de78c1788a752cc528ff5d888a873a5478e85e4.

error_meta_missing_primary_item and error_meta_missing_item_info retag the respective required pitm and iinf children as free. Pillow raises RuntimeError: Failed to decode image: Missing or empty image item for both; their input SHA-256 values are e7eb26add7703e8973c243e22f7b9225ead5292e8e1f051a09ada938824c0ffa and 8551acfec0234028ec989a52f1ceea4ff5666a3bc929e00a5a4946f902ae6dc6. error_meta_missing_item_properties retags the required iprp child as free; Pillow raises UnidentifiedImageError, and the input SHA-256 is 5339cf9635130eee4dcfd7801dd25563b591332b243b137b077a67576ee69436. unknown_extended_size_uuid_box appends a valid top-level extended-size UUID box to the 64×64 I444 fixture. Pillow returns the same 12,288 RGB bytes as the base image; its input SHA-256 is 270ba9556bd21bd85c56b5f7609a5d48e9a255ffc3ec4d1b1fa4c1885a70847d and its pixel SHA-256 is 5e74b862ca69314d8ae9a3aa4b8f3af5651dfbd238ce922a7973c193e338f64a.

error_bad_ifd_zero_tile_height sets TIFF TileLength to zero while retaining a nonzero width. Pillow opens and verifies the header, then raises ValueError: tile cannot extend outside image on decode; the input SHA-256 is 6c83b3e663f810d18db3d9a6a623eeac6ee7f21407d9dd22ad7084f0f626e208. enc_grayscale_small_fallback encodes a 13×9 grayscale JPEG source below the streaming threshold and outside its alignment constraints. Its exact 422-byte Pillow output is pinned by SHA-256 05fae511efea0f239c6d7c59ee24d0e52f993f6d6581ee842b2397ec06cb3442. enc_grayscale_aligned_width_partial_height and enc_grayscale_aligned_subthreshold encode 32×1 and 32×8 grayscale sources. Both stay below the 1,024-pixel threshold with aligned width; their heights take the false and true outcomes of the 8-pixel alignment check. Pillow's exact outputs are 349 bytes (SHA-256 1467cdfb18e2f59ce73814ebfeb2882f6bef77c97990b4b16c3f4182e217b241) and 465 bytes (SHA-256 29c71e3206d0eeebe5428504e2432d5810631508a82d761f7fd3db9fbab3ffec). enc_sub_422_aligned_width_partial_height and enc_sub_422_aligned_subthreshold encode 64×1 and 64×8 RGB sources with 4:2:2 subsampling. They stay below the 1,024-pixel threshold with aligned width; their heights take the false and true outcomes of the 8-pixel alignment check. Pillow's exact outputs are 691 bytes (SHA-256 4afe5fc617557765f13a6806683d757d6bdab6815240556c4192f4f357dc7ea5) and 1,026 bytes (SHA-256 3c6dcb8056b151eb832db29ec8a337e4edaf76a423ba0aefdf4573466d557a01). The JPEG encode parity lane passes all 72 active rows.

The palette_absent_animated_no_palette_second_frame_no_local_table GIF row removes the second frame's local color table while retaining its two-frame palette-less structure. Pillow returns an 8×8 luminance image (64 bytes) with SHA-256 c2a74daea21f6caad6b7794dcfd121cbaa0bddc3407ce5f5fdc1914bd5e7ff90; the input SHA-256 is 440eb36917bab98cd88a53534d87aadb611865999898bc9bbc3503a62a2c9654.

The error_malformed_short_dib_payload_below_eight ICO row contains a seven-byte embedded DIB payload, exercising the short-payload rejection before the DIB header can be read. Pillow raises OSError: Truncated File Read; the input SHA-256 is 585f1feefb2f364c4ecb0b50ac8e3ff414771fde088ec23fe39b44e652caa981.

The incomplete_image_data_no_iend PNG row contains a valid IHDR and IDAT chunk, but its truncated zlib stream does not provide the complete image and the file ends without IEND. Pillow raises OSError: image file is truncated when loading it (and OSError: truncated PNG file during verify). Its 1×2 fixture is pinned by SHA-256 b4c5b83118403fbff8bfa3fe0d4d85f094a79e21a8421de87bd7695c9b2e56e7. The PNG decode parity matrix passes with the row active, and Coverage MCP no longer lists the no-IEND NeedMore mapping at src/codecs/png/decode.rs:678 in the refreshed full report. Source identity and test attribution remain unverified.

The public parity matrix compares every eligible successful non-direct-still row through its shape-matched sink API: stills through encode_to_sink, and animations plus all TIFF cases through encode_sequence_to_sink. Each sink result must match the same pinned Pillow bytes and the regular encoder result. At the time of the selected LLVM report below, the public matrix had 1,334 active decode rows across eight format tests and 386 active encode rows across 19 coverage_matrix_tests functions. All 27 public decode/encode matrix tests passed. The selected LLVM report, target/release-evidence/coverage-public-parity-matrix-vp8-delta-20261002.json, records 14,277/32,072 branches (44.52%) for that earlier matrix. It predates the TIFF rows recorded below, is not a full-suite measurement, and Coverage MCP marks source identity unverified and test attribution unknown. Coverage MCP could not calculate an incremental union with the earlier report because exact baseline branch detail is incomplete, so no marginal percentage gain is claimed.

Coverage MCP lists no remaining branch gaps at WebP Vp8Decoder::read_quantization_indices line 1119 after the delta-mode row was added; the row-only report covers the true outcome, while the full matrix report covers both outcomes. It also lists no remaining gaps for PNG validate_color_chunk_structure, TIFF decode_packbits, or JPEG convert_rgb_420_mcu_row, including its aligned fast path. The earlier edge-case report still predates the delta-mode row. The targeted report target/release-evidence/coverage-webp-copy-overrun-row-20261002.json records the <4> lossless decoder taking the true bounds-rejection outcome at lossless.rs:766; its filtered MCP query no longer lists that arm as a gap. Coverage MCP marks these reports' source/build identity unverified and test attribution unknown, so only the observed locations and aggregates are reported. The latest full local make coverage campaign passes all 56 coverage_matrix_tests, including all eight decode lanes and the 402/402 AVIF parity rows. Its report, target/release-evidence/coverage-full-avif-jpeg-alignment-edges-20261002.json, records 85,328/142,054 lines (60.0673%), 16,076/32,164 branches (49.9813%), 4,785/8,972 functions (53.3326%), and 130,382/219,569 regions (59.3809%). Coverage MCP reports no remaining branch group at src/codecs/avif/container.rs:441 or :444, src/codecs/avif/samples.rs:513, src/codecs/jpeg/encode/mod.rs:632 or :654, or src/codecs/tiff/decode.rs:265. The report has no source/build receipt and test status is unknown, so those coordinates are diagnostic evidence alongside the passing public parity lanes. The 100% coverage goal remains open.

Packed low-bit TIFF tiles — 2026-10-02

Three active Pillow parity rows now cover 1-bit black-is-zero grayscale, Deflate-compressed 2-bit grayscale, and 4-bit palette tiles. Each uses a spec-compliant 16×16 tile over a 17×13 image, so the decoder reconstructs both partial right and bottom edges. Pillow 12.2.0 supplies the exact references. Three more rows use a Pillow-accepted 9-pixel tile width over a 17×1 image, covering unaligned second-tile offsets for 1-bit, 2-bit, and 4-bit samples. Those nonstandard widths record Pillow compatibility, not TIFF-spec conformance. Byte-aligned sample placement stays on a bulk byte-copy path; packed samples with unusual bit offsets use a checked merge path that preserves neighboring samples in the destination byte. No private unit tests were added.

The complete TIFF decode matrix now has 167 active rows. The broader 100% coverage goal remains open. The refreshed local full LLVM run at target/release-evidence/coverage-full-png-incomplete-no-iend-20261002.json passes repository floors: 85,181/142,042 lines (59.97%), 16,027/32,156 branches (49.84%), 4,780/8,972 functions (53.28%), and 130,159/219,556 regions (59.28%). Coverage MCP no longer lists the unaligned-copy arm at src/codecs/tiff/decode.rs:1199 as a gap; it still lists packed-row bounds checks at line 1193 and the defensive sample-width guard at line 1122. MCP marks report source identity unverified and test attribution unknown, so these branch locations remain diagnostic observations rather than source-bound coverage claims. The older full report below predates these rows and the packed-tile decoder.

Separate-planar TIFF parity — 2026-10-02

Manifest parity now covers PlanarConfiguration 2 RGB strips and tiles, including raw data, Deflate with and without horizontal prediction, partial right/bottom tiles, missing final strips and tiles that Pillow zero-fills, one-sample grayscale, and 1:1 YCbCr strips and tiles. The YCbCr cases preserve Pillow's raw component triplets in RGB mode. Malformed rows cover excess strip/tile offsets, out-of-bounds strip/tile payloads, zero rows per strip, invalid planar value 3, and missing, empty, zero, or mismatched compressed byte counts. Pillow accepts inspection for invalid planar value 3 but fails at pixel load; Rust matches that lazy failure. Pillow also rejects extra separate-planar tile offsets during open, while a short final raw tile remains a successful zero-filled decode.

At that measurement, the TIFF decode matrix passed all 161 active rows. The full make coverage campaign passes all suites and repository floors with target/release-evidence/coverage-full-planar-tiles-20261002.json: 84,990/141,861 lines (59.91%), 15,994/32,130 branches (49.78%), 4,768/8,959 functions (53.22%), and 129,857/219,262 regions (59.22%). Coverage MCP returns no remaining branch gaps for decode_separate_planar_tiles; report source identity is unverified and test attribution unknown, so its location results are diagnostic rather than source-bound claims. The current matrix has 1,367 active decode rows and 392 active encode rows at that point. Strict debug, release, coverage-configured, x86-64 SSE2-baseline, and AVX2 Clippy checks pass. The x86 SIMD commands are compile checks and do not measure runtime performance.

pillow_tolerated_post_idat_color_chunks appends PLTE and tRNS chunks after the 1×1 RGB PNG's IDAT data; Pillow and the Rust decoder retain the same exact three pixel bytes. The existing size_1x1 row also exercises decode_with_policy at its exact 57-byte non-pixel metadata budget. The public apng_animated row decodes with a 169-byte metadata budget and compares every frame with its pinned Pillow reference; a 168-byte budget returns LimitExceeded(MetadataBytes) with an observed extent of 169 bytes. The final matrix report above includes these rows. Its Coverage MCP source and test attribution remain unverified.

apng_orphan_fdat_missing_control keeps the orphaned fdAT sequence number valid, so decode_sequence reaches the missing-fcTL outcome at src/codecs/png/decode.rs:1007. Pillow 12.2 decodes the default image to the exact pinned 49,152 RGB bytes, then reports OSError: Truncated File Read when animation playback seeks the orphaned frame data. The paired apng_orphan_fdat_invalid_sequence case retains the original bad sequence number and checks Pillow's SyntaxError: APNG contains frame sequence errors in ordinary decode; it covers the sequence-consumption error at src/codecs/png/decode.rs:568. The short-fdAT row continues to verify truncated-chunk handling before either sequence outcome.

apng_empty_fdat_before_idat adds a sequence-only fdAT before IDAT while preserving Pillow's exact default-frame pixels and both decoded frames. Rust verification rejects the misplaced chunk; ordinary decode retains the default image, and sequence decode consumes the sequence number while ignoring the empty frame-data payload. The follow-up PNG-only public parity run is target/release-evidence/coverage-png-apng-orphan-sequence-parity-20261002.json; its test_decode_matrix_png integration test passes. Coverage MCP reports no remaining branch observations at decode.rs:562 or decode.rs:568. The parse_apng length check at decode.rs:1003 still lacks its non-empty pre-IDAT fdAT outcome; moving compressed frame data before IDAT caused 46,906 of 49,152 decoded bytes to differ, so that case cannot be added as a pixel-parity witness. This selected-test report has an unverified source/build identity and unknown test attribution; its global branch denominator is not a whole-suite measurement.

Coverage MCP also found the unobserved COREHEADER depth-selection arm at src/codecs/bmp/inspect.rs:66. The new error_unsupported_core_depth row uses a complete 1×1 OS/2 COREHEADER with unsupported 2-bit samples, a four-entry palette, and a padded row; Pillow reports Unsupported BMP pixel depth (2). The selected public parity run now observes both outcomes at that branch.

The TIFF decode matrix now invokes both public decode_with_token and decode_prefix for each active TIFF input. Successful token results are checked against the Pillow pixel reference; terminal errors retain the Pillow contract, and resumable results must match the prefix API's exact retry minimum. This keeps the ordinary decode route as the terminal Pillow error-parity assertion. It also exposed two Deflate NeedMore results inside strips whose byte counts already bound the compressed input. Those errors are now terminalized in the TIFF Deflate path, while genuinely truncated TIFF structures and strip spans retain resumable status.

Public boundary-sized TIFF cases cover token-aware sample-conversion checkpoints: the existing 128×64 WhiteIsZero bilevel image contains exactly 1,024 packed bytes; new 32×32 WhiteIsZero Gray8 and Gray2 images reach their 1,024-sample checkpoints; and a new 32×32 YCbCr image reaches its 1,024-byte checkpoint. Coverage MCP reports no remaining branch outcomes in convert_pixels_with_token. The new lzw_extra_zero_output_strip fixture contains one LZW strip that decodes to A plus an extra strip whose geometry requires zero output; pinned Pillow returns the exact one-byte image. The decoder now skips unused compressed strips after checking their declared byte range, while retaining the Pillow error for uncompressed extra strips. The LZW first-code output-length guard at decode.rs:1377 remains unobserved by public inputs because zero-row compressed strips are now skipped before inflation.

TIFF YCbCr LZW parity — 2026-10-17

The public TIFF matrix adds three Pillow 12.2.0 inputs for contiguous 8-bit YCbCr with default 2-by-2 subsampling: the 4×4 Kata candidate, a 3×3 image that clips the right and bottom clump edges while omitting default tags 530 and 531, and a 4×4 image split across two aligned LZW strips with centered positioning. Their input SHA-256 values are respectively d9c3e4b7111658f3b86fdb1f94bf04e03aebe7cb4fbd01a98708ebfd27e65a6c, 67df0dce7b4cab6af8d43f258f7eb1b77ba119e096ad242083baec83ebd585e9, and 1dd542a0a6e22d922f66e0f19e92421dd15fd1108f726af38810a11a6bf13487. An additional full-resolution 1-by-1 LZW row guards the compressed path while the existing uncompressed 1-by-1 rows retain Pillow's RGBX raw behavior; its input SHA-256 is c3ebf5fdd35da227f9ef92cf45b81d726c908a0be1fe3e52c1bd3abfe699f9b6. The 32×32 subsampled control reaches the conversion loop's 1,024-pixel cancellation checkpoint; its input and RGB reference hashes are 655b9b0172e44433b222cc93acdd2e14ca296e22f373e5f073e2e24d33b5111f and c5fc0bdafed814b597605fb7d00ce7510c60e1b45e774d0c71c4850ec39b4ded.

The Kata candidate is 186 bytes and decodes to the exact Pillow RGB byte sequence recorded in scripts/generate_tiff_ycbcr_subsampled_fixtures.py (SHA-256 af15457a9372a158dd276ced4109b650b99def573093a49f70dbb469c2262668). For compressed full-resolution data, the decoder converts each YCbCr triple; the four 2-by-2 cases read six-byte clumps (Y00,Y01,Y10,Y11,Cb,Cr), check clump and output geometry with checked arithmetic, clip odd image edges, and apply libtiff's fixed-point default conversion. Libtiff's RGBA path applies a clump's chroma to all four luma samples for either legal positioning value. The subsampled layout supports contiguous strips with predictor 1 and aligned two-row strip boundaries. Uncompressed files retain Pillow's RGBX raw path, including the existing 1-by-1 rows. The fixture generator pins input hashes, tag claims, and oracle output hashes, and is part of make verify.

The active ycbcr_subsampled_lzw_1x2 row adds Pillow-compatible horizontal full-resolution and vertical 2:1 subsampling. Its 203-byte complete TIFF has input SHA-256 d659443b0f3eb3c6de349a45d3e007e482b6727c4682f82545df0ac5b49971c9; pinned Pillow 12.2.0 decodes it to 4×4 RGB with reference SHA-256 1ddadfe41e070962f7991dda8e8d26efc8c43a7352227b45154387a9991c5fb6. Rust accepts [1, 2] subsampling and keeps the established [2, 2] converter on its existing specialized path. The selected public parity row passes. Two separate target-only fault-contract rows exercise clump-length rejection and RGB output reservation failure on the 1-by-2 path; both declare Pillow not_applicable and are reported outside the parity totals.

The active ycbcr_subsampled_lzw_1x2_odd_height row is a 4×3, 203-byte TIFF with the same 1-by-2 LZW layout. Its input SHA-256 is 00013d30c2155603f592722acf82b52154eb031774453023612d93a8983e2185; pinned Pillow produces 36 RGB bytes with SHA-256 c71479e1cfff0dd7c76fbe5df2c61e80c75405df52c1aa2413e2f4d08a99f1fb. It reaches and passes the new converter's bottom-edge clipping condition. The selected public parity row passes. The focused report target/release-evidence/coverage-tiff-ycbcr-1x2-odd-final.json records both outcomes at decode.rs:2124 (20 clipped and 60 in-bounds observations in the exercised specialization). Coverage MCP calls hung in this run, so the selected report is not unioned with a baseline and establishes no aggregate coverage change.

The full all-format public decode matrix passes all eight integration tests. Its report, target/release-evidence/coverage-public-decode-matrix-parity-final-20261002.json, records 11,386/32,252 branches (35.30%) for this selected decode run. Coverage MCP reports both outcomes covered at BMP inspect.rs:66 and no remaining outcomes at TIFF decode.rs:490 for the zero-row compressed-strip path, decode.rs:599 for bounded Deflate handling, or in convert_pixels_with_token. The report has no source/build receipt and unknown test attribution; its incremental comparison with the earlier selected report is unavailable because that baseline lacks complete branch detail. These measurements do not replace the separate full-suite coverage snapshot or claim 100% coverage.

The AV1 encoder entropy corpus retains eleven complete files from standalone pinned libavif/libaom builds, with Pillow/dav1d decoded pixels. It contains thirteen independently inspected tile payloads: monochrome, 4:2:0/4:2:2/4:4:4, alpha, two-column tiling, lossless, and 8/10/12-bit samples. Original and instrumented builds each encode every file twice with identical results. All thirteen tile payloads bind uniquely to finished native writers; unmodified libaom replay matches every logical state, CDF update and final byte. This is native encoder evidence, not Pillow save() parity or a Rust execution result.

The 83 hashed artifacts total 1,618,610 bytes. Gzip traces retain expanded lengths and hashes; prepared planes, replay inputs, syntax reports, complete files, pixels, instrumentation patch and build identities remain separate. Committed tiles exhibit 292 normalization flushes and 103 carry changes, including a two-byte carry. Separately labelled native models cover alphabets 2–16, probability endpoints, CDF plateaus, frozen adaptation, counter thresholds and empty/short termination. They are not full-file syntax claims. The generator is scripts/generate_av1_encoder_refs.py; its C observers under scripts/av1_encoder_oracle/ are development tools, excluded from the crate. The Rust entropy/tile writer, image analysis and full AV1 compressor remain unimplemented. The 16x16 10-bit I420 case also supplies the active public AVIF decoder parity row high_bitdepth_still_10bit_420_lossy_16x16 in the coverage matrix, with generator and fixture provenance in the AVIF fixture README. Its selected Pillow 12.2.0 check passed for 16x16 RGB8 output (reference bytes, 768 bytes, 55820e29e26b25634c402e57e8b743bb9560666861f5ea07c14a607f31eea38f). A same-source AVIF selected-test Coverage MCP comparison reports 73 newly observed branch coordinates, including seven outcomes in complete_high_depth_420_reconstruction_context. Its source/build receipts are unverified, so this is limited selected-test coordinate evidence and does not claim a full-suite coverage-percentage change. The active matrix row is decoder evidence; it does not promote a Rust AV1 encoder roadmap item.

The 2026-09-17 private still-container candidate has a 28-file native mux corpus. Pinned Pillow/libavif/libaom observations repeat exactly, including complete encoded bytes and decoded pixels. Sixteen files correspond to registered planned still rows; twelve supplemental files cover orientation, combined alpha/metadata and actual media reuse within and across item boundaries. The corpus has 105 hashed artifacts totaling 314,731 bytes and retains clean libavif source, native binary, generator, source image and manifest identities.

The Rust writer consumes semantic descriptors and encoded/metadata payloads; expected serialized boxes and output offsets are excluded from its inputs. Deferred tests compare complete containers, output limits and separate model error/interruption states. The source-derived 10/12-bit descriptor handling has no native encode witness yet; all 28 files are 8-bit. AV1 compression and metadata preparation remain unimplemented, so public encoding is still unavailable and no matrix row is promoted. Rust behavioral execution and managed coverage remain deferred; historical measurements below are unchanged. All 16 strict compile configurations pass across native and both WASM targets, with AVIF-only/all features and ordinary/coverage modes, plus native default and no-codec lanes. Warnings-as-errors rustdoc, formatting and static checks pass. The coverage-origin manifest now classifies 111 exact guards across 16 files; these are provenance records, not coverage exclusions or a new measurement.

Historical release 0.1.2

Version 0.1.2 passed main CI and release CI at 70190214a0711223302c76ab58e76c097288d80b. The published crate matches the GitHub checksum manifest, with SHA-256 e53037e57d0c5cae052ba94851c8cf72a80b9dfe195cd21b166506ab7bdbeb3b.

The 2026-09-15 all-feature release coverage run recorded 95,473/161,451 lines, 14,912/32,258 branches, 4,859/9,244 functions, and 140,609/241,503 regions. The release floors are respectively 59%, 46%, 52%, and 58%. The complete target retains 100%; a floor pass is not complete coverage. All executed comparisons remain mandatory.

Maintained fixture matrix

The retained matrix contains 1,798 total rows: 1,370 decode / inspect / verify rows and 428 encode rows. Of those, 1,370 decode rows and 396 encode rows are active; 32 encode rows remain planned. Planned rows stay outside executed parity numerators. Active rows have operation-specific outcomes, including not-applicable results.

Generated capabilities distinguish declarations and actual native/all-feature fixture observations. A WASM cross-compile does not extend that pixel-evidence scope.

Decoder validation — 2026-09-20

The full public matrix passes all 46 tests, including 343 AVIF rows and exact native comparisons of complete animations. All native, WASI and browser-WASM feature lanes pass. High-depth, HDR and animation additions are on main, awaiting the next release; the 32 AVIF encoder rows remain planned.

A fresh local make coverage run passes every executed test and the unchanged release floors: 99,349/163,373 lines (60.8112%), 15,524/32,418 branches (47.8870%), 5,052/9,372 functions (53.9053%), and 145,689/243,793 regions (59.7593%). This is LLVM evidence, not a new managed Coverage MCP snapshot. The changed-line review observes 274/294 executable lines in the seven changed AV1 modules. Unobserved lines include defensive failures and the Wiener stripe branch; this is not complete line or branch coverage.

The local reports live under target/release-evidence/: coverage.json, coverage.lcov, and avif-fix-coverage.json. The last receipt retains source and input hashes and the exact uncovered line list. CI produces a fresh report for each pushed commit and retains it as the llvm-coverage artifact.

Codec parity and coverage — 2026-10-03

At that point, the matrix contained 1,927 total rows: 1,474 decode / inspect / verify rows and 453 encode rows. Of those, 1,474 decode rows are active; 421 encode rows are active and 32 are explicitly planned. It includes 440 active AVIF decode rows. Twelve new error rows pass the selected public matrix runs: short_marker_missing_eoi (JPEG, input SHA-256 869e30d73346ca502d81c1a04881b3ca8cbb64d980cb73b73cf856d54a8bdcbc), error_ispe_nonzero_version (AVIF, 9caaefec8072bd826607867f9d80c8ce2a10d67f1638bf8c1ac382055d75a791), error_ispe_zero_width (AVIF, 3524b652351b5a668a7a91a7dcd10a376205d5771858d11e073f61bdf96de3da), error_iloc_version_3 (AVIF, 9ce231f76eac5fb15f9da9d12cc34b6e6a59d7eeee8bcad4101a451ee9648dd2), error_sequence_zero_timing_rate (AVIF, 055dea40a69ca9eb7a60a499524a7e563990bccb708f6a9992c1691f304f15e2), error_inconsistent_operating_point_idc (AVIF, 3c81896058305429697219be55ddcaf4fcf5293aca48570c1e7e22f6ebcd0a07), error_sequence_zero_time_scale (AVIF, 92d7882e439adf1430d60460d488d0df2b7feb9f6ba3bb7931898c4f70f25ac0), error_inconsistent_operating_point_idc_low_byte (AVIF, d49e5403f421c1f71140c7442ba4493e51317bd1c9776d0aaf19069e9002fd71), error_ispe_zero_height (AVIF, e93421df7d5d3564f7d297c4deb09a765be702e16aa86de41c3705974d059024), error_vp8_color_space_invalid (WebP, ce6b3a9b8e69194d02cdc0739b9db9cdc668554abc0fe29e28fa902e49eb6e45), error_malformed_container_animated_all_frame_chunks_unrecognized (WebP, cde9d77559e01ef3324fb73f6541c4cd6257b8563595a4ca397fc0ab52f69886), and error_truncated_riff_extent_metadata_preflight (WebP, e84c137505358f37c528aa349b7541971603dae587e5dbfd15e67792ce72da09). The pinned Pillow 12.2.0 oracle rejects each case under the matrix's malformed decode contract. The selected rows and full coverage campaign pass. Coverage MCP reports nine newly observed branch coordinates at AVIF samples.rs:656, :661, :1030, sequence.rs:179, and :223, JPEG parser.rs:609, and WebP vp8.rs:1268; a filtered follow-up reports no missing branch groups at the targeted AVIF height, timing, and IDC operands. The comparison has no source/build receipts and test attribution is unknown, so these are coordinate differences rather than verified causal gains or regressions. The active uniform_tile_rows_monochrome_256 AVIF row uses a 344-byte constant grayscale still with one tile column and four uniform tile rows (input SHA-256 782568b37a63b44e632aee68896bcee3c59c5492081c7ac2ac6a31fc0ca1df37). Its Pillow reference is 196,608 RGB bytes with SHA-256 d5039cbfb3fb9a915614802a721cba155442563d36a6bbf73e582e65f5290890; the selected public parity row passes. The pre-row full report showed the true arm of read_tiling at av1/frame.rs:3647 missing, and the selected report leaves only the false outcome of the tile-row bit read. The active WebP row error_malformed_container_animated_all_frame_chunks_unrecognized changes both nested VP8L frame FourCCs in a valid two-frame lossless animation to JUNK while preserving RIFF lengths (input SHA-256 cde9d77559e01ef3324fb73f6541c4cd6257b8563595a4ca397fc0ab52f69886). Pillow reports could not create decoder object; its selected public matrix row passes the malformed WebP contract. The selected report covers the previously missing true arm of WebPDecoder::new at webp/native/decoder.rs:226. Coverage MCP reports missing source/build receipts and unknown test attribution for these selected runs, so the arm mappings remain coordinate evidence. The new animated_lossless_inter_420_b32x32_10bit_64x64 AVIF sequence adds a animated_lossless_inter_420_b32x32_10bit_64x64 AVIF sequence adds a deterministic 64×64 10-bit 4:2:0 inter-frame case while preserving the prior 32×32 fixture. Its pinned dav1d trace confirms four 32×32 leaves in the second frame; the selected public parity run passed and checked exact Pillow frame bytes. The selected LLVM report records three hits on the previously missing false arm in one decode_inter_translation_impl specialization at src/codecs/avif/av1/block.rs:54836. The fresh full report adds one aggregate branch observation. Coverage MCP comparison remains limited because these reports have no source/build receipts and MCP cannot attribute tests. The active enc_lossless_sampling_multi_group_checkpoint WebP row encodes an 8192×16 RGB PNG with lossless quality 80, method 4, and a cancellation token. Its deterministic 32×1 metadata map alternates two retained Huffman histogram groups. Pinned Pillow 12.2.0 produces the committed 98,388-byte reference (SHA-256 cc92a5c28e780be64ef34a104ddeeb92e76c967f8e3f8f1a16fb42a01ca907a4), and the focused selected row and full encode matrix pass. The current full local report still lists the true checkpoint arms at encoder.rs:1378 and :1418; the filtered query at :1421 has no missing branch group. Because the report lacks source/build receipts and test attribution, this is a fixture-parity result plus coordinate coverage evidence, not source-bound proof that those checkpoint arms were executed. The active enc_animated_non_centisecond_delays GIF row uses two WebP frames with 17 ms and 33 ms source durations. Rust now stores their GIF delays as 1 and 3 centiseconds, matching Pillow's 10 ms and 30 ms output; the 129-byte encoded reference SHA-256 is 52f23eb3646581d4982bed87c11bf63315ddf2e3a4cdf5d73a5b0b80c44e8509. The enc_animated_large_fraction_delay row sets the first duration to the unreduced u64::MAX / u64::MAX rational (one second), exercises GIF's wide scaling path, and matches Pillow's [100, 3] centisecond delays. Its 129-byte reference SHA-256 is df760f2efb3378fd2eb3c46660ebaf5399b11086838ec28f99b5faf5e9a15792. The focused GIF encode parity suite and full coverage run pass. Coverage MCP's filtered gif_delay query now leaves only the zero-denominator arm at line 869; the wide-scaling arm is no longer missing. The local report has no source/build receipt and test attribution is unknown, so this is coordinate evidence. A zero-denominator value is not a valid Pillow frame duration and has no public Pillow-backed fixture witness. The new primary_item_irot row decodes the independently generated 325-byte mux fixture with an associated 270-degree primary-item rotation. Its Pillow 12.2.0 output is 2×3 RGB (18 bytes, efbe5247163f007591d148c7975ad74429fd2282feb0bdec402838155763da38), and the Rust decoder reports the matching counterclockwise 270-degree transform. The Seven portable_lossless_monochrome_limited_* rows cover limited-range monochrome RGB and RGBA at 8, 10, and 12 bits, plus a BT.2020/PQ CICP case. Their selected public parity rows pass against exact Pillow bytes; the preceding all-feature AVIF decode lane included all 415 active rows. Coverage MCP reports no remaining branch gap at container.rs:1367 in coverage-avif-primary-irot-current.json; that selected report has no source/build receipt and labels test status unknown, so this is bounded path evidence only.

The new active ipma_version_1_wide_item_ids still row widens the primary item ID in AVIF's ipma FullBox from 16 to 32 bits and adjusts the following absolute iloc extent. The 3,079-byte fixture is generated from Pillow's baseline still and hashes to 90ac8f0230ddede24a72b73fb120bd46680962d4c0a7facab31e77b088cd82c5. Pillow 12.2.0 verifies and decodes it to the same 128×128 RGB pixels, metadata, and info as the baseline. The focused public AVIF decode matrix passes 416/416 rows. The full local make coverage campaign passes every executed test and reports 85,737/142,131 lines (60.3225%), 16,350/32,170 branches (50.8237%), 4,797/8,975 functions (53.4485%), and 131,045/219,720 regions (59.6418%); all four release floors pass and the 100% target remains open. Its LLVM report is target/release-evidence/coverage-full-ipma-v1-20261003.json. Coverage MCP's coordinate comparison lists two newly observed branch arms in parse_ipma, the version-zero arms in container.rs and samples.rs. That report has no source/build receipt and MCP reports test attribution as unknown, so the comparison is coordinate evidence; the local matrix and full coverage commands themselves passed.

The active iloc_version_2_wide_item_ids AVIF row derives from baseline.avif, widening the iloc item count and ID to 32 bits, adding construction method zero, and relocating the absolute extent after the six-byte box growth. The generated input SHA-256 is 39a494da43edb3e25dcc60c1c51c987452c66a2590e5ac9563d416d922199d87. Pinned Pillow 12.2.0 accepts it and produces the same 128×128 RGB pixels and info as the baseline (49,152 bytes; output SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf). The selected public row passes, and the full AVIF matrix passes 418/418 rows. Its selected LLVM report records four visits to the version-2 path at container.rs:608; the full report has no remaining branches at lines 608 or 622. Coverage MCP reports no gaps at those coordinates, but has no source/build receipt and test attribution is unknown, so that result is coordinate evidence.

The active size_1x1_local_palette_only GIF row moves the exact six-byte palette from the Logical Screen Descriptor's global table into the image's local table, leaving no global table. Its 37-byte input SHA-256 is 2d029f561c59b4bf8c23b46e1acf61a144e16d7ec46901e0c428914801363146. Pillow 12.2.0 returns the one-byte P image 00 and the six-byte RGB palette with SHA-256 b0f66adc83641586656866813fd9dd0b8ebb63796075661ba45d1aa8089e1d44; the focused public parity row passes detect, inspect, verify, decode, and sequence comparisons. Pillow omits info["background"] for this input, so the matrix records the Logical Screen Descriptor's palette index with specification_reference provenance. Metadata-byte scanning runs only when a caller sets a DecodePolicy metadata limit, so the parity-only row does not claim coverage for that policy path.

The ordinary and token-aware GIF LZW paths reject zero-sized frames before decoding and return as soon as the output reaches its expected length. This makes the first-code output-full guards and end-code exact-length success arm unreachable; those redundant conditions are removed. All 79 active GIF parity rows pass. The refreshed Coverage MCP GIF query no longer lists decode_lzw; it still lists the metadata scanner's global-table false arm at line 366 and local-table true arm at line 393. That scanner only runs when a caller sets a metadata-byte policy limit. The new full report has no source/build receipt, so these filtered results are source-coordinate leads.

The active high_bitdepth_still_10bit_420_alpha_lossless_16x16 AVIF row exercises the public 10-bit 4:2:0 color path with an auxiliary 10-bit alpha plane. Its 1,653-byte input SHA-256 is 8c3cb86055e1003d91897d986995dd2ee030d0278b82d3d7c9ddc783189eb76f; pinned Pillow returns 16×16 RGBA8 (1,024 bytes) with SHA-256 a3eec8f3c1e9539ccee71ec2e9d514a46d20d0b93a7b8e5d562379ef4a794dd9. The selected public parity row passes. Its isolated branch report records the 10-bit alpha path at decode_portable lines 492, 535, and 555. The refreshed full report shows no remaining branch gap at those locations.

Two more active 10-bit alpha stills exercise the AV1 4:2:2 and 4:4:4 decode paths. The all-lossless 16x16 4:2:2 input hash is eef1ffae7961354032dad642c1ebfc146cbcb28f7147c4dce6d9b8a4de17d392; Pillow RGBA8 output hash is b7731cca14b3da564883533a5cfd6ddc75aba189b60dbe7795de93711237a457. The 16x16 lossy 4:4:4 input hash is 468bd5af2f96693582d6618572dc353cac4ee16719cebebb8e20ff7e81049548; Pillow RGBA8 output hash is 02e871ddbaa576836e9d486cf36be09efce4f2fef164c7f66af2a579dfb1e67a. Both selected public parity rows pass. Coverage MCP's selected report reaches the 10-bit 4:2:2 sampler path at lines 588 and 606 and the full-resolution alpha conversion at line 496. That report has no source/build receipt and marks test status unknown; the local selected matrix command supplies the pass result.

The active portable_lossless_monochrome_1x1 row exercises a 1×1 8-bit lossless monochrome still. Pillow returns RGB 7f7f7f; the selected public parity test passes, and the Rust reconstruction crops its coded block to the visible canvas. The row's pinned input SHA-256 is 6c4212de07ead445c0b468c39b77f099cc8555e99edd6460806407d7536be305. The WebP decode lane passes all 230 active rows. Two generated 1×1 VP8L cases exercise transformed opaque RGB reconstruction and singleton RGBA color-cache insertion. Their Pillow outputs are RGB 0a141e and RGBA 0a141e80. Coverage MCP reports no remaining branch group at webp/native/lossless.rs:763; it still reports the alpha-used false arm at line 155.

Two JPEG fixtures truncate 64 entropy bytes before EOI in baseline 4:2:2 and 4:4:4 inputs; both selected public parity rows pass. Coverage MCP reports no remaining branch group at the direct-row fallback locations jpeg/decode/decode.rs:1504 and :1697 in the latest full report.

The metadata-policy manifest adds public TIFF cases for a cyclic IFD, empty tile byte counts, and an empty IFD chain. The policy test checks successful metadata accounting and malformed-scan propagation through inspect, still decode, and sequence decode. Coverage MCP reports no remaining branch groups at tiff/decode.rs:133, :150, or :160.

These filtered MCP observations have no source/build receipt or per-test attribution; they are bounded path evidence. The full-report comparison lists seven newly observed branch coordinates at these TIFF, JPEG, and WebP paths, but MCP marks the result limited because source/build identity is unverified. The full local report still passes every repository coverage floor.

The active GIF row enc_rgb_high_color_token_checkpoint adds a 33×33 RGB PNG with 1,089 distinct colors, forcing the token-aware median-cut quantizer across its 1,024-pixel checkpoints in all three mapping passes. The source PNG SHA-256 is a4c488ae9683a7ae782017bf8fc334d67ec43e0f0430a0c2442cfa426dcc82e6; its Pillow GIF reference is 1,862 bytes with SHA-256 7bbedc5d1161b6b8b00a41b9b5f4dc52e7cc2d33a4cc63b30320876a4165e43f. The selected public parity row passed byte-for-byte comparison against Pillow and ordinary Rust encoding. Its isolated LLVM run records one checkpoint hit and 1,087 non-hits at each pass; the fresh full report records no remaining branch gap for quantize_rgb_nearest in Coverage MCP. Both reports lack source/build receipts and test attribution, so local test results and counters are scoped evidence rather than managed coverage attribution.

The active GIF row enc_rgba_high_color_token_checkpoint exercises transparent pixel normalization in token-aware RGBA quantization with 1,088 opaque pixels and one fully transparent pixel. Its 33×33 PNG SHA-256 is 1939c2816f1f56c21c3e672d03df8341a6dcf16181cbaa8035b93ad0e3ae9896; the 1,936-byte Pillow GIF reference has SHA-256 ee584ccbbe4b55eb06a9e2d3ad52ae037d74f2d3ad545cf0e954ef555e8c4e34. The selected public parity test passes exact Pillow byte parity. Its isolated LLVM run records the normalization checkpoint and both alpha outcomes; the full report has no remaining branch group for quantize_rgba in Coverage MCP. Those reports also lack source/build receipts and test attribution.

The active GIF row enc_animated_rgb_full_palette_token uses a lossless, opaque two-frame WebP animation with all 256 grayscale values in each 16×16 frame; the second frame swaps the first and last pixels. The WebP SHA-256 is eda7f7272532e97d362a46a905d3f80dc857c5a5602232dde366f885d9838946. The row requests GIF local color tables and the public token-aware sequence encoder; its Pillow GIF reference is 2,963 bytes with SHA-256 881dfb2f5a8b81575a20ac40350ccb6124bf3ef95df6b9b15c9a9cc5cb98c6f4. The selected parity row passes for both ordinary and token-aware sequence encoding. Its isolated LLVM run records three visits to the false arm at gif/encode.rs:472, where the full 256-entry palette prevents adding a transparency slot. The report has no source/build receipt or test attribution.

The WebP lane's public basic-inspection parity assertion now covers VP8 canvas width and height mismatches and VP8L canvas width and height mismatches. The generated VP8L files are complete VP8X, VP8L, EXIF RIFF images derived from exif.webp; their Pillow outcome is OSError: could not create decoder object. The VP8 width fixture is pinned by SHA-256 9213d677987c5dd684e0d07d09efcb3922a624b8188706f2879b3dbfe385d7ea, the VP8 height fixture by 8d9ebf1b4656176dae2627363d7f73cc99a27b4fdcfc74f14db917def973bf14, the VP8L width fixture by 51127d31ba0f68d73000ffea0a8d962cc5408db4dea2df6188a70302e7b10fa4, and the VP8L height fixture by 79a1c86ebd90824274d792f602d980e6dc1c01bb83a969ceb4e1ffb2b057c3a5. Two more full-file mutations start from the valid two-frame animated_sequence_rgba_keyframes.webp: one clears the first nested VP8L signature byte, and one sets its unsupported version bit while preserving dimensions. Pillow returns the same decoder-object error for both. The public decode matrix passes both rows across detection, inspection, verification, still decode, and sequence decode; their input SHA-256 digests are a40cd40a7f492abe7c086323aefd25edd04e73291618154285e83b85d3ca4a4c and 6e51fc2edee8208762d8faa8e292993f165d715a3ba2e7a5cdaf9e629c2f75c8. Coverage MCP's full report filtered to WebP inspection and VP8L lossless decoding contains no missing group in inspect_extended_basic or LosslessDecoder::read_frame_header, though other WebP groups remain. Source/build identity and test attribution are unverified in that report, so the query is diagnostic evidence alongside the local parity pass. The new portable_i444_quality100_64x64 case checks a 64×64 8-bit 4:4:4 quality-100 frame with fixed 64-pixel partitions. The selected public matrix row passes exact Pillow parity for all 12,288 RGB bytes; its input SHA-256 is 5ceb66b47bda43bec5c421222eeb3ef858c62702bc41833986fdf678f6867737 and its output SHA-256 is 5e74b862ca69314d8ae9a3aa4b8f3af5651dfbd238ce922a7973c193e338f64a. The new animated_lossy_global_halfblend_spatial_i444_b256x256 row pairs identity and RotZoom global references in compound spatial neighbors. Its four complete RGB frames and 100ms timing match Pillow, and the independent loop bundle records an infinite-play sequence. Selected LLVM coverage records five visits to each outcome at motion.rs:1707; the full report records 30/10. Coverage MCP returns no missing branch group at that coordinate. These local reports have no source/build receipt and list test status as unknown; the public matrix row and full campaign pass. The new coverage_h16x4_third_leaf_no_chroma_tx8x4_01 row pins a 16×16 4:2:0 H4 with two TX8×4 luma residuals in its third no-chroma leaf against Pillow output and passes the matrix. Coverage MCP still shows 26 missing branch observations in decode_following_vertical_without_chroma: production decodes this input with the complete partition walker, so the row guards that public reconstruction path without covering the narrower first-partition fallback. Its report has no source/build or test receipt, so those locations remain unverified. Three further AVIF parity rows add a 64x64 TX64-root split and two opposite 512x128 projected-motion window misses. All eleven decoded frames and native loop observations match their pinned references. Coverage MCP reports no missing branch group at entropy.rs:8000 for the TX64 child offsets or at motion.rs:3351 for the temporal x-window checks. These reports have no source/build receipt and label test status unknown; the successful full local coverage run supplies execution evidence. One more public sequence adds a textured 184×64 all-lossless 4:2:0 input with fixed 32×32 AV1 partitions. Its final-frame edge block at pixel (160,0) has a 24×32 visible extent and selects the clipped-lossless plan. The input hash is 0a8c935fe67694fe576e7f21064eec4c428cffc2a05a3ff2d0be33e401a20c1d; both Pillow RGB frame hashes are retained in the AVIF loop oracle and exact public sequence parity passes. The selected LLVM report observes the true outcome at entropy.rs:6925; Coverage MCP reports the false outcome missing in that single-row report. Its source/build receipt is unverified and test status is unknown. The complete coverage run passes, with branch totals unchanged. Two public parity rows exercise the AVIF ICC prof and rICC properties; Pillow 12.2.0 accepts both fixtures with matching RGB pixels and preserved profile bytes. Two further rows assert associated BT.2020/D65 mdcv fields against the property definition while Pillow verifies identical pixels and profile preservation, including when one bounded trailing metadata byte is present. A new two-frame 60×64 lossless I420 sequence pins a B32×32 leaf at pixel (32,32) with 28×32 visible pixels at the right edge; both complete frames match Pillow exactly. New JPEG parity cases cover progressive AC-first run overshoot, AC-refinement EOB runs and scan tails, repeated sparse refinement, a malformed DC Huffman category-16 symbol, and out-of-range spectral starts and ends rejected by Pillow during pixel loading, an oracle-accepted out-of-range DC coefficient case matching signed JCOEF narrowing, plus two DC-only progressive cases that exercise smoothing with ordinary and Pillow-tolerated zero quantization tables. The matrix also includes a 33×33 baseline 4:2:0 encode with partial MCU edges. Five additional encoder rows exercise the fused 4:2:0 batch path at 16×2, 16×1, 17×17, and 17×2 sizes, plus the generic 4:2:2 RGB batch tail at 17×17. Four more JPEG fixtures cover partial baseline grayscale and CMYK blocks, plus progressive 4:2:2 scans at 17×13 and 1×8. The odd 4:2:2 case exposed scan iteration over padded storage blocks; progressive scans now use the logical component block extent while retaining the padded buffer stride. Successful cases compare exact pixels or bytes against Pillow. At that time, the all-feature JPEG decode lane passed all 154 active rows. The new baseline_ac_pair_tail fixture exercises a baseline AC run whose first coefficient position exceeds 63; its exact Pillow pixels pass the public matrix. The bounded overrun path consumes the symbol amplitude and writes to coefficient 63, matching libjpeg-turbo's padded zigzag behavior for corrupted streams. Coverage MCP's query for decode.rs:145 has no remaining missing branch group in the full JPEG lane report. A selected incremental branch union was incomparable because its exports lacked complete branch detail; the parallel region comparison found 10 newly observed regions in decode_block_fast against the other 153 JPEG decode rows. The reports are target/release-evidence/coverage-jpeg-baseline-excluding-ac-pair-tail.json and target/release-evidence/coverage-jpeg-ac-pair-tail-selected.json; the full-lane report is target/release-evidence/coverage-jpeg-ac-pair-tail-final.json. These reports have no source/build receipts, so MCP marks their test status unknown; local selected and full JPEG decode runs passed.

Three more Pillow-generated baseline JPEG rows exercise public restart-marker fallbacks: 4:2:0 with DRI 3, which is not aligned to its eight-MCU row, and 4:2:2 and 4:4:4 with DRI 1. The fixture generator uses Pillow's restart_marker_blocks option; the full 128×128 sampling grids avoid partial MCU edges. All 157 active JPEG decode rows pass exact pixel parity. Coverage MCP reports no remaining branch gaps at decode.rs:1083, 1330, or 1494 in coverage-jpeg-restart-fallbacks-current.json. That selected report has no source/build receipt and marks test status unknown, so the result is bounded path evidence; the local test output confirms 157/157.

A fresh selected all-feature run passes all 60 active JPEG encode rows, including progressive CMYK and the CMYK EXIF cases below.

The public enc_cmyk_progressive row closes a Pillow-supported combination that previously returned an unsupported error. The general progressive scan script now covers each component of non-YCbCr images, and the optimized CMYK row-streaming path remains restricted to baseline output. The exact Pillow reference is 10,364 bytes with SHA-256 53d7b0a56e5156b5b9a7ea14ef13fe5fc0fe88274b1d86efa5e6668fa1592814; all 60 active JPEG encode rows pass. Coverage MCP reports no remaining branch-gap group in default_progression_script for coverage-jpeg-progressive-cmyk-current.json. Its source/build receipt is unverified and test status unknown, so this does not claim a managed coverage delta. The baseline CMYK streaming path remains available unchanged for non-progressive output.

JPEG parity now also covers baseline CMYK streaming with valid and oversized EXIF, restart-marker emission, the 65,536-MCU restart-interval clamp, and restart rows above Pillow's signed limit, alongside the existing row without EXIF. The full all-feature JPEG encode lane passes all 60 active rows. Coverage MCP reports no missing branch at restart_interval_from_rows, and no missing region at the APP1 error-propagation site on line 4813, the restart-marker emission site on line 4866, or in the CMYK streaming function. A 4,096-row setting clamps to DRI 65,535; a setting of 2,147,483,648 omits DRI, matching Pillow. Pillow rejects the 65,534-byte EXIF payload with ValueError: EXIF data is too long, matching the Rust parameter error. The current report has no source/build receipt and MCP marks test status unknown; the local test output confirms 60/60. MCP findings are limited to this JPEG lane and do not establish a full-repository coverage change. At that point, the active JPEG decode inventory had grown to 158 rows. Its new baseline_cmyk_entropy_truncated_tail_64 case truncates 64 bytes of baseline CMYK entropy while retaining EOI. Pillow returns the exact 13×9 CMYK output (468 bytes); the direct-decoder fallback at decode.rs:1065 is covered by the public row. Coverage MCP returns no missing branch group at that coordinate in the current full report, which has no source/build receipt and reports test status unknown.

The JPEG decode inventory now has 159 active rows. The new baseline_cmyk_height_partial_aligned_width fixture is 8×9 CMYK: its width is MCU-aligned while its final MCU row is partial. Pillow's exact 288-byte output has SHA-256 ac10bdd2898d8df3462b1594b15ade2e2a429a61ca2908a31102c64f27b579b9. Exact parity passes, and both outcomes of the AArch64 height-alignment check at decode.rs:1023 appear in the full local report. Coverage MCP returns no remaining gap at that line; the LLVM report has no source/build receipt and MCP labels test status unknown.

The idct_high_horizontal_frequencies row uses a restart-separated, fully valid baseline grayscale JPEG. Six blocks place AC coefficients at horizontal frequencies 3 through 7 and at vertical frequency 1. Its exact Pillow pixel reference passes the public decode matrix. The selected LLVM report observes both outcomes at each scalar IDCT row-shortcut predicate on lines 191–195; Coverage MCP returns no remaining gap for those selected coordinates. The local report has no source/build receipt, so this is selected-path evidence and does not establish a complete-suite coverage delta by itself.

The 2026-10-01 all-feature make coverage run passes every executed test and the release floors: 106,527/162,369 lines (65.607967%), 17,345/32,236 branches (53.806304%), 5,341/9,371 functions (56.994985%), and 156,010/242,524 regions (64.327654%). Its LLVM report is target/release-evidence/coverage.json, measured on macOS ARM64 with nightly-2026-07-16 against the current working tree. It has no source/build receipt: Coverage MCP reports source identity unverified and test status unknown, so its totals cannot establish a source-bound delta or per-row coverage gain. Coverage MCP groups the remaining branch observations in the AV1 lossless partial-grid predicate at block.rs:54830-54831; the targeted decode_following_vertical_without_chroma query still returns 26 observations. A selected 2026-10-04 run of the public 64×64 10-bit fixed-32-partition row records six false outcomes at the current block.rs:54838 sample-depth check, so that outcome is reachable through a valid full-size LosslessGrid. This selected witness does not identify the older report's remaining observations at lines 54830–54831; both reports lack source/build receipts, so their line coordinates cannot be treated as source-bound branch identities. The 100% goal remains open, with 55,842 lines, 14,892 branches, 4,030 functions, and 86,514 regions uncovered.

While validating the three-frame I444 parity row, a DAV1D trace exposed a transposed compound-reference CDF lookup. Rust indexed the AV1 [group][context] tables as [context][group], selecting Last3 where the stream selected Last. The decoder now indexes group then context; the selected animated I444 parity row and the full test campaign pass. Coverage MCP reports 207 newly observed branch coordinates against the prior report, but source/build receipts are missing, so MCP marks that comparison limited rather than a verified gain. Its highest missing group remains Lossy420Decoder::decode_inter_translation_impl, with 1,842 repeated coordinates across monomorphizations, not 1,842 distinct source branches. The 100% goal remains open.

Two odd-sized baseline color JPEG rows now cover right and bottom edges in separate sampling modes: 13×9 4:4:4 and 17×9 4:2:2. Both compare exact decoded pixels with the pinned Pillow oracle. The 4:4:4 row also drives a short RGB conversion tail through the direct row kernel, extending coverage beyond the existing odd-sized progressive 4:2:2 case. The AVIF additions include four-frame 4:2:2 and 4:4:4 sequences. The 4:2:2 case moves a small block across horizontal chroma boundaries; the 4:4:4 case translates a periodic full-frame chroma pattern. A three-frame 4:2:0 sequence with forced 4x4 inter partitions and a small luma/chroma change exercises the subsampled block-width ownership edge. Exact Pillow frame references and pinned libavif loop witnesses pass the public sequence checks.

A 96×96 untransformed VP8L lossless case repeats a four-pixel RGB phrase at short distances. Its exact Pillow reference passes public decode parity. The isolated and full local branch reports observe the short non-overlapping copy arm; Coverage MCP reports new branch coordinates for this input, with source and build identity unverified.

A deterministic 128×64 VP8L stream exercises color-cache lookahead after a cached color, a new literal, and a repeated cached color. The exact RGB output matches Pillow, and the isolated public report observes both outcomes at the three lookahead branches in lossless.rs:828-830; Coverage MCP reports no remaining gap for those selected coordinates, but source/build receipts are unverified. The new active row is lossless_color_cache_lookahead.

The public GIF encode matrix now includes a one-frame sequence with exactly one total play. Its Pillow byte reference is unchanged because no GIF loop extension is required. The selected parity row reaches the Finite { total_plays: 1 } mapping in encode.rs:1734; the selected report has no remaining gap at that coordinate, with source/build identity unverified.

Three complete 3×1, 4-bpp ICO fixtures pin Pillow's grayscale-palette rules: identity grayscale becomes raw luminance bytes, non-identity grayscale remains indexed, and a black/white two-entry palette uses the one-bit interpretation. All three decode, inspect, and verify through the public manifest parity path. The identity fixture's input SHA-256 is de23f5d6d7ec9047cc6103e2991db5b62fde8cbd9b3d95e078ccf3960d1f5b29, and its Pillow RGBA reference SHA-256 is 45add7ffebacd45767e5608c10f43c1aab79268a2645bfe9f5ab759656af4c22. The selected LLVM report observes both outcomes at the odd-nibble guard; Coverage MCP reports no remaining gap there, with source/build identity unverified.

A new two-frame 16×16 4:2:0 AVIF sequence moves a 4×4 patch by one pixel. Both frames match Pillow exactly. Its inter frame is all-lossless and selects the specialized LosslessB16I420 reconstruction path; a branch-instrumented public decode observed the previously missing false arm at decode_inter_transform_size's small-block eligibility check.

A four-frame 256×256 4:2:0 AVIF sequence with moving inter-frame content covers the large-block side of that eligibility check. Its frames match Pillow and pinned native loop witnesses. The row also exposed a decoder-state bug: a skipped transform block inside a non-skipped coding block must propagate its own txb_skipped state to the wide-luma terminal decoder. Passing the enclosing block state could consume coefficient symbols for an empty transform and overread the tile; the corrected path passes the per-transform state.

A new 16×16 lossy WebP fixture uses luma-balanced red and green 4×4 tiles. It reaches the VP8 Y2 residual path with no coefficients, so both neighboring macroblocks receive a zero Y2 complexity context. The exact Pillow RGB output matches the public Rust decoder, and targeted LLVM evidence observes the previously missing false arm at read_residual_data.

A 32×32 four-quadrant lossy WebP row extends the public VP8 chroma decode corpus with a 2×2 macroblock layout and passes exact Pillow output parity. Its selected run reaches the production chroma DC prediction path. The saved full LLVM report coverage-after-adam7-gray16.json already records hits for that arm, and the MCP incremental comparison is incomparable, so no coverage gain is claimed; the row is retained as a decode regression case.

Three further 32×32 lossy WebP rows target VP8 chroma prediction with mixed neighboring blocks, a horizontal color gradient, and a vertical color gradient. All three pass exact Pillow RGB parity. Their isolated reports reach the production Vp8Decoder<Take<&mut Cursor<&[u8]>>> specialization's TrueMotion, Vertical, and Horizontal predictor arms. The aggregate coverage counts did not increase because the existing full matrix already covered those arms; the cases add focused regression inputs, not a claimed coverage gain. Coverage MCP has no source/build receipt for these local reports, so its source identity is unverified and selected-test status is unknown.

The malformed WebP row error_malformed_container_alpha_uncompressed_truncated_payload starts from alpha_uncompressed.webp, shortens the raw ALPH plane from 4,096 samples to one, and updates both chunk and RIFF lengths so the container stays complete. Pinned Pillow 12.2.0 opens and structurally verifies it, then reports OSError: failed to read next frame during load. The public Rust parity row passes with the matching malformed error category. It exercises the Take<&mut Cursor<&[u8]>> production specialization at read_alpha_chunk's read_exact in extended.rs:442; the prior full report listed that exact region as missing. The current full report and selected report show it executed. The row-only LLVM report is target/release-evidence/coverage-webp-alpha-truncated.json. MCP comparison remains coordinate evidence only because its source/build identity is unverified and test status is unknown.

The companion malformed row error_malformed_container_alpha_lossy_gradient_empty_compressed_payload keeps the compressed ALPH header and intact lossy VP8 image while removing the compressed alpha bitstream, then repairs the chunk padding and RIFF length. Its input SHA-256 is dbacedb09b0aec8375255d8d5b509fde9063b018b3497764769e8ea5aa93ba52. Pinned Pillow 12.2.0 opens it as 64×64 RGBA and raises OSError: failed to read next frame on load. Its public parity row passes with the malformed category, and a selected LLVM report records the production Take<&mut Cursor<&[u8]>> specialization without a remaining gap. Comparing the old and refreshed full reports observes one new region at read_alpha_chunk's lossless decoder call in extended.rs:433; that MCP result is limited coordinate evidence because source/build receipts are absent. The selected report is target/release-evidence/coverage-webp-alpha-lossy-truncated.json.

A further malformed WebP row, error_lossless_vp8l_short_backreference_truncated_tail, starts from the active 96×96 RGB lossless_short_backreference.webp stream and removes its final two VP8L payload bytes while repairing both the chunk and RIFF sizes. The complete 13,924-byte container has SHA-256 6c5dac54aae71b6c8e086096acfd00e4370689f955aa66bbe0227eb06198dd83. Pinned Pillow 12.2.0 opens it as RGB and raises OSError: failed to read next frame on pixel load; the public Rust parity row passes. The full coverage totals did not change. MCP's full-report comparison identifies one newly observed region in the direct RGB VP8L pixel path at lossless.rs:754:72, but the report has no source/build receipt and the result remains coordinate-only. The row is retained as a malformed-input regression for a valid header and short-copy stream that fails during pixel reconstruction, not as an aggregate coverage increase. Its full report is target/release-evidence/coverage-after-webp-avif-shortbackref.json.

The AVIF compound-reference investigation found a CDF table-axis error that could panic on a valid context-2 stream. The correction indexes each CDF by branch group then context. A deterministic full-file AVIF mutation preserves the compound-reference prefix and damages only a later coded sample; Pillow and Rust both reject sequence decoding as malformed, while the first image still matches Pillow exactly. An isolated public decode_sequence trace stops at the corrected backward-reference CDF lookup with group 0/context 2; the old transposed access would index beyond that table's two group rows. The selected parity row then returns its structured malformed result. This access occurs in an earlier AV1 sample than the mutation at byte 16098, so it proves the public prefix exercises the fix but does not attribute the eventual sequence error to the changed byte or frame. The valid DIFFWTD stream still reaches other AV1 decoder limitations, so it is not counted as a successful parity case.

An odd-sized 9×9 4-bit grayscale PNG uses Adam7 with all seven passes carrying samples. Exact Pillow L8 parity exercises packed-sample reconstruction in the interlaced pass callback, complementing the existing non-interlaced low-depth fixtures.

A three-page RGB TIFF sequence now uses 9×7, 9×7, and 5×11 pages. The public sequence decoder matches Pillow for all three frames, and the encoder matches Pillow's complete byte stream. This extends IFD traversal and inter-page alignment coverage through a third page with a different extent. The two new rows add regression coverage but leave the full LLVM totals unchanged; the Coverage MCP incremental comparison is incomparable because the prior report does not retain compatible branch detail.

A deterministic 128×64 monochrome AVIF with two tiles now passes exact Pillow RGB pixel parity in both one-group and split-group forms. The split case sends tile 0 and tile 1 in separate tile-group OBUs and exercises the accumulated pending-plus-trailing tile path. A new two-tile AVIF with a monochrome alpha item and CDEF disabled reaches the CDEF-off reconstruction branch; the complete RGBA output matches Pillow byte-for-byte. The new row multitile_monochrome_alpha_zero_loop_filter keeps that two-tile monochrome alpha layout but makes its alpha frame all-lossless, with zero Y/U/V loop-filter levels. Its generator checks both tile indices, CDEF, lossless state, and filter levels before accepting the fixture. Exact Pillow RGBA parity passes; the selected LLVM report observes the missing false arm at assemble_monochrome_tiles in frame.rs:2246. That report has no source/build receipt, so the location remains coordinate evidence. The selected report is target/release-evidence/coverage-avif-monochrome-alpha-zero-loop-filter.json.

A sparse grayscale progressive JPEG pins a 64-ZRL AC-refinement scan with coefficient correction bits and passes exact Pillow L8 pixel parity. A second 8×8 grayscale row, progressive_ac_refinement_refine_zrl, includes refinement symbols with r=15, size=0 and also matches Pillow exactly. Its selected nightly LLVM report records 8 true and 16 false executions at ac_refine_block's r != 15 branch; Coverage MCP lists no remaining gap for the production FastBitReader specialization. The full ARM64 report still lists the generic BitReader monomorphization, which this target does not use for production JPEG decode. The isolated report has no source/build receipt, so its branch location is coordinate evidence; the local public parity run passed. This edge case adds regression value without increasing the aggregate branch count.

An earlier full all-feature make coverage run passes every executed test and remains above all project floors: 100,225/163,401 lines (61.3368%), 15,892/32,398 branches (49.0524%), 5,085/9,372 functions (54.2574%), and 146,750/243,772 regions (60.1997%). The local LLVM report is target/release-evidence/coverage-goal-lossless-inter-420-final.json; it is not a managed Coverage MCP snapshot. It was measured on the macOS ARM64 working tree on 2026-09-30 with nightly-2026-07-16, all Cargo features, and the complete make coverage test campaign; it is not bound to a clean commit or a source/build receipt. Compared with the prior full local report target/release-evidence/coverage-goal-cdef-disabled.json, the measured totals show +171 covered lines, +70 branches, +11 functions, and +203 regions. The new lossless inter-frame AVIF parity row passes the full Pillow pixel check and observes the eligible lossless transform-size branch in the public decoder. Coverage MCP's report-coordinate comparison lists 173 newly observed branch locations across monomorphizations; its reports lack source/build receipts and test status, so the comparison is limited and does not establish verified attribution or regressions. The local full campaign itself reports all tests passing. The 100% target remains open.

The preceding all-feature make coverage run passed 118 library unit tests, 3 binary tests, 4 animation-loop tests, 1 capability test, 59 coverage-matrix tests, 7 decode-policy tests, 1 determinism test, and 68 feature-gate tests. It reports 106,798/165,795 lines (64.4157%), 16,435/32,508 branches (50.5568%), 5,578/9,617 functions (58.0015%), and 156,910/247,495 regions (63.3993%). The local LLVM report is target/release-evidence/coverage-goal-jpeg-jcoef-dc-shortcut-final.json, measured on macOS ARM64 with nightly-2026-07-16 and all features. Unit tests were included after enabling the existing library test target. Coverage MCP queries on this report no longer list branch gaps for JPEG range_limit, ycc_to_rgb_batch, reconstruct_baseline_444_direct_safe, or jpeg_idct_islow. The largest remaining group is AV1 decode_inter_translation_impl: MCP repeats 4,063 observations at the same source spans across specialized monomorphizations, not 4,063 distinct source statements. MCP marks source as unverified and test status unknown, so these are report-coordinate findings; the local Cargo campaign itself passed. All four floors pass, while 100% remains open.

An earlier all-feature make coverage run passes 119 library unit tests, 3 binary tests, 4 animation-loop tests, 1 capability test, 59 coverage-matrix tests, 7 decode-policy tests, 1 determinism test, and 68 feature-gate tests. It reports 106,929/165,923 lines (64.4450%), 16,441/32,508 branches (50.5752%), 5,580/9,619 functions (58.0102%), and 156,956/247,537 regions (63.4071%). The local LLVM report is target/release-evidence/coverage-goal-av1-has-chroma-final.json, measured on macOS ARM64 with nightly-2026-07-16 and all features. The new table-driven AV1 test covers monochrome, 4:4:4, 4:2:2, and 4:2:0 ownership at odd/even origins and one-MI versus larger block axes. Coverage MCP has no remaining branch gaps for inter_block_has_chroma; the rule is #[inline] in release builds. Its next AV1 branch group is lossy_i422_narrow_mode0, the 4:2:2-only 4×8/4×16 mode-0 specialization. That group has 1,916 repeated observations across specialized monomorphizations; they are not distinct source statements. The full report improves by 131 covered lines, 6 branches, 2 functions, and 46 regions over the preceding full report. MCP reports source as unverified and test status as unknown, so its gap listings are report-coordinate findings; the local Cargo campaign itself passed. All four floors pass, while 100% remains open.

An earlier selected LLVM run of the 59-test coverage_matrix_tests integration target records 97,978/163,390 lines (59.9657%), 15,457/32,404 branches (47.7009%), 4,867/9,369 functions (51.9479%), and 143,525/243,760 regions (58.8796%). It clears the line, branch, and region floors and is five functions short of the 52% function floor. Every successful JPEG decode input row also passes through the public token-aware decoder and matches its Pillow pixel reference. Every successful JPEG encode row passes through both ordinary and token-aware encoding, and both byte streams match the committed Pillow output exactly. Every successful JPEG encode roundtrip also passes its encoded output through the token-aware decoder and compares its pixels with the Pillow reference, including the 1,024-MCU checkpoint in the 2048×1024 grayscale case. Coverage MCP reports that checkpoint branch observed. Its selected report also listed the false arm of the AArch64 dequantization-overflow fallback. Source review shows full-file parsing bounds progressive coefficients to i16 and DQT entries to u16; the maximum product, 2,147,450,880, fits in i32. That fallback protects internal states outside the parser path and has no valid full-file JPEG parity witness. The selected report has no branch-gap groups for baseline_frequencies_with_checkpoint, append_ac_refine_events, or encode_baseline_420_mcu_pair. The MCP report has no source/build receipt and marks test status unknown, so these are report-coordinate observations; the local Cargo command itself reported 59/59 passing. A Coverage MCP selected comparison against the previous selected report shows seven newly observed branch observations, including both find_entropy_end arms, the generic CMYK branch in reconstruct_image, and PNG opaque-chunk/reserved-bit paths. The source/build receipts are unavailable, so these are coordinate-only comparisons. The selected target does not describe whole-workspace coverage. The 100% target remains open.

The selected JPEG additions cover baseline CMYK reconstruction with restart markers and two missing-EOI tails: a dangling 0xFF and a stuffed 0xFF00 at EOF. Pillow error contracts remain exact, and the selected comparison observes both find_entropy_end arms plus the generic four-component branch.

The same selected run adds Pillow-parity PNG cases for duplicate gAMA, sRGB, cHRM, and iCCP chunks; invalid and short sRGB payloads; malformed short cHRM; an empty-key iCCP chunk; and valid, invalid, and edge compressed text metadata. It also covers a Pillow-tolerated unknown ancillary chunk with a lowercase reserved bit in static PNG and APNG inputs, preserving exact pixels and frames. text_chunks.png now contains tEXt, zTXt, and iTXt. All active PNG decode rows pass exact pixel comparison. Typed source-color assertions cover valid values and duplicate chunks where Pillow and Rust expose the same declared color. Malformed short sRGB and empty-key iCCP rows assert pixels only because their Pillow metadata differs from the decoder's spec-aware typed SourceColor. Coverage MCP's selected comparison reports 10 newly observed branch observations in retain_color_chunk, with three false arms still uncovered; its gap query lists no remaining branch group for invalid_compressed_metadata_identity. The remaining color-chunk arms require short gAMA data, an iCCP keyword without a NUL terminator, or an iCCP method without profile bytes. Pinned Pillow rejects those images, so they cannot be added as parity fixtures. The coverage report lacks source/build receipts and MCP reports test status unknown; the local run passed 59/59. This remains selected-target evidence, not whole-workspace coverage.

Coverage MCP reports no remaining branch-gap groups in encode_baseline_420_mcu_pair after the edge row and removal of redundant first-column checks implied by the MCU loops. The all-feature run's gap query listed 12 remaining AC-refinement branch observations for BitReader; the FastBitReader group had disappeared after the repeated sparse-refinement row and once-per-scan bound check. AV1 decode_inter_translation_impl groups remained the largest branch gap in that run. After adding the AC-first narrow-tail fixture and matching libjpeg-turbo's padded-table write behavior, Coverage MCP no longer lists the FastBitReader AC-first or AC-refinement gap groups. The malformed category-16 fixture also closes the fast-reader dc_first_block error group. The selected ARM report still shows generic BitReader groups for those functions; the public JPEG path selects FastBitReader. This is selected-run evidence, not a full-suite result. The new Ss=64 and Se=64 JPEG rows reach both scan-range error paths. The larger 128×128 JPEG scan-tail row adds multi-block parity coverage. MCP reports have no source/build receipts, so their comparisons and gap listings are report-scoped evidence, not standalone source-provenance claims.

The selected AVIF report passed all active AVIF matrix rows. Coverage MCP's query at block.rs:55046 dropped from ten to nine missing specialization groups, and the previously unobserved block-width branch recorded both sides in the selected AVIF lane. The local report is target/release-evidence/coverage-parity-avif-current.json; MCP reports lack source/build receipts and report test status as unknown, so this remains scoped coverage evidence rather than a full-suite claim.

The row-selected JPEG encoder report exercised the new micro-image cases. Coverage MCP compares the five-case report with the earlier two-case batch report and reports five newly observed branch arms: the aligned/even-height decision, the 4:2:0 row remainder and even-height fallback, and both arms of the generic RGB conversion loop. Gap queries show no remaining observations at those locations; the fused helper's two zero-dimension guard arms remain. Public zero-sized JPEG inputs fail validation before this helper. These local LLVM reports have no source/build receipts and MCP test status is unknown, so their branch comparison is limited selected-run evidence, not an aggregate coverage or regression claim. Direct all-feature parity runs passed both JPEG decode and encode matrix tests. Reports are under target/release-evidence/coverage-parity-jpeg-kernel-edges-final.json and target/release-evidence/coverage-parity-jpeg-420-batch-cases.json.

The selected decode report's largest group is AV1 decode_inter_translation_impl. Raw LLVM data shows ten monomorphized closure instantiations at the reported location, with execution recorded in two for this run. Coverage MCP's 1,928 observations therefore span unvisited specialized paths; they are not 1,928 distinct source statements. A useful next parity pass needs to identify the missing supported AV1 syntax paths before selecting or generating fixtures.

Two local release A/B runs per source version exercised the public JPEG benchmark matrix on an Apple M3 Pro, with three alternating rounds per run. Across 63×65, 127×129, 128², 512², and 1024² RGB 4:2:0 encodes, the median of the run medians was 5.3–7.8% lower after the MCU-check cleanup; Rust output lengths and hashes matched before and after in all five cases. One baseline run started with a 1-minute load average of 10.7, so these are directional local measurements rather than a cross-machine or release speed claim.

A separate release profile used the public Rust runner for a 1024×1024 RGB 4:2:0 encode (2,000 measured iterations after 100 warmups) on the same M3 Pro. The median was 6.806 ms and P95 was 7.200 ms. A five-second sample capture recorded 3,866 stacks; rgb_to_ycbcr_420_packet appeared in 340 stacks (8.8%) and the four-block FDCT in 221 (5.7%). This is a single-workload diagnostic that points to color conversion for follow-up profiling. It is not a paired speedup measurement, and it provides no SSE2 or AVX2 runtime evidence.

A same-checkout A/B isolated #[inline(always)] on rgb_to_ycbcr_420_packet. Seven alternating release-runner pairs on the M3 Pro measured 128², 512², and 1024² RGB 4:2:0 encodes. The candidate medians were 2.61%, 0.34%, and 3.18% lower, respectively; every encoded length and hash matched. These small local gains support retaining the hint. The run does not measure SSE2 or AVX2 execution. Raw paired results are in the ignored local artifact target/benchmarks/jpeg/goal-continuation-2026-09-29/packet-inline-controlled-ab.json.

A follow-up experiment replaced four overlapping 8-pixel conversions in each 16-pixel RGB row with three 16-byte loads and mask-based channel deinterleaving. The public JPEG encode parity lane passed and all 20 encoded outputs matched the stored baseline hashes and lengths. However, a five-round full JPEG matrix on the M3 Pro measured an encode median ratio of 1.0031 and a geometric-mean ratio of 1.0067 versus baseline; RGB 512² and 1024² 4:2:0 encodes regressed 5.15% and 3.69%. The packet-body change was reverted. This result is directional ARM64 evidence only, not an SSE2 or AVX2 runtime measurement. The local candidate report is target/benchmarks/jpeg/goal-20261001-arm64-3load-candidate.

A bounded public-path CMYK experiment streams each decoded component block into its final channel for aligned baseline 4:4:4 images on AArch64. Five alternating release rounds reduced median latency by 21.13% at 512×512 (6.187 ms to 4.880 ms) and 18.24% at 128×128 (0.254292 ms to 0.207917 ms); output hashes matched in every round. The helper keeps the existing packet path for partial edges and restart scans, and is not compiled for x86, where the existing SIMD path is unchanged. The selected Pillow decode matrix passed all three active CMYK cases, including the aligned fast-path case, odd partial blocks, and restart rows. cargo fmt --check, strict release library Clippy, and git diff --check passed. Round data and the exact candidate patch are in target/jpeg-cmyk-fusion-experiment/; these are local Apple M3 Pro measurements, not SSE2/AVX2 runtime evidence.

The preceding full local make coverage campaign on 2026-09-30 passed every executed test and the unchanged release floors: 100,431/163,617 lines (61.3818%), 15,947/32,444 branches (49.1524%), 5,097/9,395 functions (54.2523%), and 147,132/244,178 regions (60.2560%). Its LLVM report is target/release-evidence/coverage.json; it was measured on macOS ARM64 with nightly-2026-07-16 and is not bound to a clean commit. The fresh Coverage MCP gap query still lists AV1 decode_inter_translation_impl as the largest branch group. MCP source/build receipts are unavailable and test status is unknown, so these locations are report-scoped observations rather than verified test attribution or a managed snapshot.

The AV1 gap query at block.rs:55105 returns repeated decode_inter_translation_impl observations across specializations. The apparent lossy I422 narrow path requires transform mode 0 and a non-lossless segment. Valid frame parsing sets mode 0 only when all_lossless, and derives that flag as the conjunction of every segment's lossless state, so no valid frame can satisfy the helper's !segment_lossless && transform_mode == 0 predicate. This is an unreachable implementation branch, not a missing public fixture; no parity row should be invented to exercise it. A separate reachable candidate is diff-weighted compound prediction at block.rs:57292 and :57310. No candidate is accepted without independent syntax inspection and exact Pillow/native frame parity.

An earlier full make coverage run passes all executed tests and project floors: 101,330/163,618 lines (61.9308%), 16,104/32,444 branches (49.6363%), 5,124/9,395 functions (54.5396%), and 148,460/244,179 regions (60.7997%). This run includes the Adam7 4-bit grayscale PNG and large-motion 4:2:0 AVIF parity rows. The AVIF sequence row exposed and now covers propagation of the per-transform skip flag to the wide-luma terminal decoder; all active AVIF decode rows pass. The 59-test integration target, 68 feature-gate tests, 7 decode-policy tests, 4 animation-loop tests, 3 binary tests, and the determinism test pass. The local report is target/release-evidence/coverage.json, from macOS ARM64 with nightly-2026-07-16; it is not bound to a clean commit. Coverage MCP reports 16,340 uncovered branch observations and keeps AV1 decode_inter_translation_impl as the largest group, with repeated hits across monomorphizations. It reports no remaining gap at the large-block eligibility check in motion.rs:2278. MCP source/build receipts are absent and test status is unknown, so these are report-coordinate findings; the local full campaign supplies the passing test evidence. The 100% target remains open.

The preceding full make coverage campaign on 2026-09-30 passes all executed tests and the release floors: 104,438/163,657 lines (63.8152%), 16,770/32,444 branches (51.6891%), 5,251/9,398 functions (55.8736%), and 152,993/244,210 regions (62.6481%). The local report is target/release-evidence/coverage.json, measured on macOS ARM64 with nightly-2026-07-16; it is not bound to a clean commit. Coverage MCP reports 15,674 missing branch observations, with the largest group at AV1 decode_inter_translation_impl (block.rs:55105); repeated specialization records are observations, not distinct source branches. At the WebP Y2 read_residual_data false edge, LLVM records 57 executions in a covered specialization and a duplicate zero-count generic record, while Coverage MCP still lists missing branch records at that coordinate. Keep that edge marked ambiguous in MCP rather than calling its gap closed. MCP reports source/build identity as unverified and test status as unknown, so its results are report-coordinate findings; the local full campaign supplies the passing test evidence. make lint, make lint-x86-simd, make test-feature-matrix, and make verify also pass. SSE2/AVX2 checks validate formatting and compilation; they do not establish runtime speedups. The 100% coverage and fastest-decoder goals remain open.

A Coverage MCP query against that earlier report found no supportable new non-AV1 parity fixture. Its JPEG ac_refine_block<BitReader> gaps are for the x86 decoder specialization; this ARM64 run uses FastBitReader, whose public progressive ZRL cases are already in the parity corpus. The reported progressive_dequantize_block fallback only follows a DC-times-quantizer overflow, which valid parser bounds prevent. These are target-specific or unreachable observations, not reasons to add duplicate or invalid fixtures.

The AV1 decode_following_vertical gap was checked with selected public parity rows on 2026-09-30. coverage_h4_horizontal_bands and coverage_h16x4_predictor_adst_dct_01 both pass the matrix parity test, but a fresh branch-instrumented run of the latter records zero calls to Lossy420Decoder::decode_following_vertical. The public decoder therefore does not exercise this bounded first-leaf helper for those H4 streams, despite their encoded topology. Source inspection shows its only callers are the bounded 4:2:0 split helpers. Those callers fix chroma sampling to 4:2:0 and pass no full-resolution edges, so the method's Full-only entry checks cannot be covered by a valid public fixture on the current dispatch path. Coverage MCP also reports both outcomes missing for the full_strict condition at block.rs:67502: the 4:2:0 leaf helpers hardcode Subsampled420, and their closed-frame callers require 8-bit input. The generic decoder's Full/high-depth following path uses decode_following_from_edges instead. Keep this gap open until a supported public path can exercise it or the obsolete path is removed with a behavior-preserving refactor; do not add a parity fixture that merely matches the topology label. Selected reports are target/release-evidence/coverage-h4-horizontal-bands.json and target/release-evidence/coverage-h16x4-predictor.json; Coverage MCP marks their source identity unverified and test status unknown.

A fresh 2026-10-01 Coverage MCP read of target/release-evidence/coverage.json reports 1,512 missing-branch groups and 14,972 missing branch observations. The decode_following_vertical group has 342 repeated observations across monomorphizations; filtering to block.rs:67501 isolates the two missing outcomes of its full_strict condition. Fresh selected parity profiles for the H4/H16 fixtures and the 16x16 4:2:0 SPLIT fixtures all passed, yet recorded zero executions across the method and its 102 closure records. This confirms that their encoded partition labels do not reach this helper on the public dispatch path. Coverage MCP still marks report source identity unverified and test status unknown, so these are coordinate-only observations, not a verified coverage gain. No duplicate fixture was added.

On 2026-09-30, a portable u32x4::widening_mul experiment for four-lane JPEG reciprocal quantization preserved Rust output lengths and hashes across all 40 rows of the public JPEG benchmark matrix. Two five-round full-matrix repeats per implementation, run in opposite order on the aarch64-apple-darwin host, showed the candidate's 1024×1024 RGB 4:2:0 encode median 9.63% and 14.02% slower than baseline; the median slowdown across the 20 encode workloads was 10.69% and 15.37%. The candidate was removed. Results are local directional evidence only and do not measure SSE2 or AVX2 runtime performance. Raw reports are under the ignored local artifacts target/benchmarks/jpeg/goal-quantizer-{baseline,candidate,candidate2,baseline2}-2026-09-30/.

A subsequent all-feature make coverage campaign on 2026-09-30 passes every executed test and the release floors: 104,471/163,650 lines (63.8381%), 16,807/32,432 branches (51.8223%), 5,251/9,398 functions (55.8736%), and 153,027/244,201 regions (62.6644%). The local report is target/release-evidence/coverage.json, measured on macOS ARM64 with nightly-2026-07-16; it is not bound to a clean commit or a managed Coverage MCP receipt. The 100% target remains open.

The WebP matrix adds a 32×16 public parity row with a flat macroblock beside a deterministic high-frequency macroblock. Its exact Pillow output passes the selected decoder matrix test. The selected LLVM report target/release-evidence/coverage-webp-macroblock-candidate.json invokes the Cursor<&[u8]> specialization of Vp8Decoder::read_residual_data and records both outcomes at the plane-selection and luma complexity-update branches. Separate selected runs of the existing public rows lossy_vp8_lossy_macroblock_residual_context_edges_32x16_q75_m4 (input SHA-256 9bbe53e9597854a1f5412ab40b1ee9f54bcf56f6c8513d254d69dee85fa74abb) and lossy_vp8_lossy_y2_empty_ac_16x16_q90_m4 (input SHA-256 e5e6cc56cf73aded4521a16de4ef0d08ff4066db75cdcd5527b15e6210d4ea98) both pass exact Pillow pixel parity. Their row-only LLVM reports record n=true and n=false, respectively, at src/codecs/webp/native/vp8.rs:1583-1584 in the production Vp8Decoder<Take<&mut Cursor>> specialization. The reports have SHA-256 4723f808dd1331cf4b0cd92639aaab47958c5f0dee08a0ef356da1dacd146109 and 7c0769e6f8fa66ab048c442e6552b865f128bfabd60d670e2590d4430064f1b9. The aggregate MCP miss is in the separate Vp8Decoder<Cursor<&[u8]>> specialization; MCP source/build identity is unverified and selected-test status is unknown, so this is coordinate guidance rather than a source-bound coverage claim. No private-only coverage test was added.

A 128×64 lossless RGB WebP row, lossless_color_cache_lookahead, covers the VP8L color-cache lookahead branches through the public decoder. Its deterministic 512-color input has SHA-256 920481d0986bf9034730ebdd4678c65540c985dc00c25c0cc293d45167b3e541; the Pillow 12.2.0 RGB8 reference has SHA-256 d35118946b17473c290fc38351acb637a8887d4248de5052a3e6e2f305ddd35c. The independent VP8L inspector finds one untransformed stream, cache width 10, and 6,252 cache lookups. The selected all-feature matrix row passes exact Pillow parity. Its isolated local LLVM report records both outcomes at lossless.rs:828 (10,572/93), :829 (10,113/459), and :830 (8,091/2,022), true/false respectively. This is selected-row evidence, not a refreshed Coverage MCP measurement or complete coverage claim.

The public VP8L cache-boundary corpus also includes a 2×1 RGBA input with color_cache_bits = 11. Its dynamic green tree emits a literal whose cache hash is 2047, then performs a real lookup of that highest entry. The independent structural inspector records both the width and referenced cache index; Pillow 12.2 decodes the exact pixels. The focused matrix test passes. Coverage MCP reports the focused branch profile as 135/31,268 observations, with source identity unverified and test status unknown. Incremental comparison with the saved full baseline is incomparable because its exact branch detail does not match the summary totals, so this case is recorded as a maximum-boundary parity witness rather than a claimed marginal branch-coverage gain.

The same change simplifies AV1 lossless inter-transform selection to use its prevalidated geometry predicate directly, removing a repeated exact-geometry check and duplicate block/layout guards. The matrix adds a two-frame 8-bit monochrome lossless inter sequence with a translated patch. Its generator disables warped motion to stay within the decoder's admitted reconstruction profile; exact Pillow frame/timing parity and pinned native loop evidence pass. Coverage MCP reports no missing branch observation at decode_inter_transform_size line 6950; the true arm at line 6951 remains missing at that checkpoint. The report's source/build identity is unverified and test status is unknown, so this is coordinate evidence rather than an attributed MCP gain. Strict Clippy now denies missing_errors_doc; the eight previously undocumented public Result APIs have # Errors sections, and make lint passes. This lint and documentation add no runtime work. No SSE2 or AVX2 runtime benchmark was available on this ARM64 host, so no x86 speedup is claimed.

The 8-bit color lossless inter-transform gap has public parity fixtures: animated_lossless_inter_420_b32x32.avif uses a translated 4x4 patch inside an exact-visible 32x32 block and is pinned to input SHA-256 65e8617044f7f12db081f65276235296f8dc208a006451210ebb9603f27f20a7; the new animated_lossy_split_inter_420_b16x16.avif exercises a lossy B16x16 transform split and is pinned to input SHA-256 9eb50f5a45dc2eb549c62ac9bcb67abd931a977076685bcf3c0f69e6827ce323. animated_lossy_wide_monochrome_b128x128.avif is a four-frame 8-bit monochrome sequence with three lossy B128x128 inter blocks using switchable transform splits; it is pinned to input SHA-256 eb8dda5000882ffd03c182a817e08fc944ef110afa1e78aaf1678bef5efc65bf. All three fixtures match Pillow frame pixels exactly, and native sequence evidence records each displayed frame.

The three-frame animated_lossy_b16_mixed_topology_inter_420_b16x16 sequence adds an inter B16x16 whose top-right TX8 child splits while the other three children stay unsplit. The deterministic Pillow 12.2.0/libavif 1.4.1 generator is scripts/generate_avif_b16_mixed_topology_fixture.py; its 1,186-byte input has SHA-256 3264482e2a50d80bd39be178b843fdfe9997e947d54b4466c745751837821d74. The exact Pillow/Rust frame hashes are 7f3e5e4e65eca4390e9242558012bc9bdad133d7ac9f6aed53fa156a2288f73b (frames 0 and 1) and e195092d99a776d7638ff75a30825447f6dffd85a04fa845750617ce04a98a79 (frame 2). The selected public row passed 1/1 under branch-enabled isolated coverage in target/release-evidence/coverage-avif-b16-mixed-topology-row-20261004.json. Its entropy.rs:7778 branch counts are true=1, false=0, proving the any(child_split) true arm; at line 7775 they are true=0, false=1, leaving the all-children-split true arm unobserved. The line 7778 false arm is also still unobserved. Coverage MCP comparison to the older full AVIF report is limited and shows zero aligned coordinate gains because the receipts and inventories differ, so this selected-row observation is not an aggregate coverage gain.

The 10-bit public row animated_lossless_inter_420_b32x32_10bit now materializes its sequence instead of returning the former Rust-only Unsupported result. Its header permits warped motion, but the checked-in 32×32 stream has one top-left B32×32 leaf and no overlappable neighbor; the frame flag therefore adds no local-warp mode syntax for this input. The high-depth admission predicate no longer rejects that capability flag, while per-block mode and geometry checks remain in decode_inter_leaf. The existing row passes exact Pillow parity for both RGB frames and sequence timing/loop metadata; no new fixture or unit test was added.

The 2026-10-02 macOS ARM64 all-feature, branch-enabled make coverage run passes all executed tests and the repository floors: 85,551/142,082 lines (60.2124%), 16,248/32,170 branches (50.5067%), 4,791/8,972 functions (53.3995%), and 130,676/219,579 regions (59.5121%). Its report is target/release-evidence/coverage-full-avif-high-depth-parity-20261002.json. Coverage MCP still reports unvisited branches in decode_inter_transform_size; its source/build receipt is absent, so its comparison is coordinate guidance and does not establish a verified coverage delta. The 100% target remains open.

The public row animated_opidc_0x101 transforms the pinned animated AVIF fixture (input SHA-256 25b79a856ea2767e02e5a509f72e7af3f9563202301779be65b0745724ab23be) to use operating-point IDC 0x101 and explicit temporal-0/spatial-0 extension headers for its seven layer-specific OBUs. Its five 150×150 RGB frames match Pillow byte for byte, and the native loop witness confirms all five displays. The selected public parity command reports 1/1 active rows passed; the native repetition witness test also passes. Before this row, Coverage MCP listed the false arm at src/codecs/avif/av1/frame.rs:952 as missing. After the full coverage run, its line-filtered branch query returns no missing group at 952; the function still has gaps at lines 947 and 964. MCP marks source/build identity unverified and test status unknown, so this is coordinate guidance; the local instrumented campaign is the executed test evidence.

A fresh all-feature make coverage run passes every executed test and the release floors: 104,619/163,698 lines (63.9098%), 16,854/32,444 branches (51.9480%), 5,262/9,405 functions (55.9490%), and 153,241/244,291 regions (62.7289%). Compared with the preceding full report, it observes four additional lines, four branches, and four regions; function coverage is unchanged. The new 32×32 lossy I444 AVIF parity row exercises mode-2 and positive qindex outcomes before its geometry excludes the separate 64-axis split path. The full report still has 247 uncovered branch observations in decode_inter_transform_size. Coverage MCP marks source/build identity unverified and test status unknown, so its gap coordinates are guidance. The report SHA-256 is 79cc1056db899cd493dea18492556626d95c8e91bab4da1250ddf96d77d58149. Raw LLVM counters observe six true and 24 false executions at src/codecs/avif/av1/block.rs:65010 in a wide-chunk decoder specialization, and the true arm at block.rs:55789 was reached three times in the lossy decoder specialization. Coverage MCP still lists misses in other monomorphizations. The largest general AV1 gap remains at block.rs:55105, which prior parsed-state analysis found unreachable for legal lossy input. JPEG progressive gaps belong to the non-active BitReader monomorphization on this ARM64 host; the active public FastBitReader path is covered, and parsed JPEG state cannot reach the reported dequantization overflow fallback. MCP reports no remaining ICO decode branch group. The WebP cost/quant interpretation in that report depended on private coverage-hook monomorphizations that have since been removed; those old coordinates are not current evidence. The current public parity report above still lists WebP VP8 segment-delta and VP8L bounds outcomes. Coverage MCP marks source/build identity unverified and test status unknown, so the results are coordinate guidance only. The 100% target remains open.

ICO adds four 3×1 public 4-bpp parity rows for the black-and-white white-bit arm, two distinct two-entry palette predicate failures, and an out-of-range palette reference. Pillow decodes the missing palette index as black; the Rust decoder now uses a fixed 16-entry table with black-filled unused entries. That removes the separate palette-reference scan while preserving the existing short grayscale-palette errors. The selected rows pass 4/4, and Coverage MCP reports no missing decode branch in src/codecs/ico/decode.rs for the full report.

JPEG adds a minimal public parity fixture, progressive_ac_refinement_eobrun_correction_bit, for a 16×8 two-block grayscale progressive stream. Its repeated 8×8 source pattern is pinned to input SHA-256 d1823abbbd3f9b78b440eb25abbb38b73db7dc30be1457d013131d481038c3eb; the selected public decode row matches Pillow pixels exactly. The isolated instrumented run reaches the AC-refinement EOBRUN correction arm through FastBitReader. The full local report remains unchanged because the remaining true arm is the separate BitReader instantiation used on x86, which this ARM64 host does not execute. The existing x86 CI lane runs the public JPEG matrix and retains branch reports; no x86 runtime result is claimed here.

A fresh all-feature make coverage campaign on 2026-09-30 passes every executed tests and the release floors: 104,452/163,691 lines (63.8105%), 16,752/32,454 branches (51.6177%), 5,254/9,404 functions (55.8698%), and 153,135/244,275 regions (62.6896%). It used nightly-2026-07-16 on macOS ARM64. The report is local to the dirty worktree and contains no revision or build receipt. Coverage MCP therefore labels its source identity unverified and test identity unknown; the successful make coverage exit is the local test-run evidence. These floor passes do not meet the separate 100% target. The current report leaves 59,239 lines, 15,702 branch observations, 4,150 functions, and 91,140 regions uncovered. make fmt, make lint, make lint-x86-simd, and make test-feature-matrix also pass. The matrix passes native and WASI runtime lanes plus browser-WASM compile/documentation lanes; its capability tables agree. SSE2-baseline and AVX2 x86 builds pass strict Clippy, which validates compilation but is not an x86 runtime benchmark or speed claim.

Two new public parity rows extend the corpus. JPEG progressive_ac_refinement_zrl_symbol exercises a ZRL across coefficients 1–16 before introducing coefficient 17; its selected row matches Pillow and the instrumented ARM64 run covers both outcomes in the FastBitReader specialization. Coverage MCP still reports the portable BitReader false arm at progressive.rs:209, which the ARM64 public matrix does not exercise. AVIF animated_lossy_wide_i444_b128x128 adds exact two-frame parity for a lossy 4:4:4 sequence with 128×128 superblocks. Its selected run does not satisfy the size predicate at block.rs:65010, so it does not cover the specialized wide chunk branch. The remaining decode_following_vertical observations are in a diagnostic fallback that the current public 4:2:0 decode path cannot reach; no synthetic coverage-only input was added.

On 2026-10-01, the active public row progressive_ac_refinement_zrl_duplicate_tail passed exact Pillow pixel parity (1/1). Its repeated AC-refinement scan is the targeted edge case for the correction-bit no-op at progressive.rs:226. Coverage MCP reports no remaining branch group there for the ARM64 FastBitReader specialization; the listed missing outcomes belong to the portable BitReader monomorphization, which this target's public matrix does not exercise. The selected-format report has no source/build receipt, so the mapping is local coordinate evidence rather than a verified full-suite comparison. This active row already covers the reachable path, so no additional fixture was justified. x86 runtime parity and performance still require matching hardware.

Coverage MCP reports no missing branch observations in JPEG ycc_to_rgb_batch or AV1 inter_intra_context in this report. The public baseline_444_partial_blocks JPEG row exercises the scalar RGB tail. The new deterministic 17×17 two-frame 4:2:0 sequence has exact Pillow references for both frames. Differential decoding exposed and fixed two sequence-path defects: one-intra/two-neighbor inter-intra context selection, which previously overread tile padding, and final-column odd-width chroma upsampling, which blended an out-of-edge sample. Both frame hashes match Pillow after the fixes.

Coverage MCP on the current local report lists 191 missing branch observations in decode_inter_transform_size. Its current full report observes the transform_mode == 0 arm and the TX64 offset_x == 0 decision; clipped-geometry and high-depth guards remain open. Pinned AOM searches still find input geometries that the safe Rust sequence decoder rejects, so those candidates remain outside the Pillow parity corpus. The largest AV1 groups remain the I444 split predicate at block.rs:54939 and the vertical I422 TX4 chroma grid at block.rs:54973; observations repeat across decoder monomorphizations. The new I444 parity row covers the predicate true arm for some instantiations, while the separate terminal body and other monomorphizations remain open. The existing active public row animated_motion_chroma_422 reaches the vertical TX4 predicate's true arm in one decode_inter_translation specialization; its row-filtered LLVM report records 3 true and 0 false evaluations with exact four-frame Pillow parity. Other decoder monomorphizations remain uncovered, so no duplicate I422 fixture was added.

Coverage MCP also reports 114 missing branch observations in high_depth_lossy_i444_superres_restoration_supported, beginning at entropy.rs:13514. The existing 8-bit I444 animated parity fixtures exercise the generic I444 operand, but not the high-depth operand. The pinned Pillow/libavif AOM encoder rejects a 10-bit animated probe, and Pillow's AVIF save interface does not expose a bit-depth option, so there is no reproducible oracle-backed public candidate to add yet. At the time of this historical report, an 8-bit I420 super-resolution/ restoration fixture was blocked because stock pinned libavif rejected the required encoder controls. On 2026-10-04, a reproducible fixture-only patch under scripts/avif_fixture_oracle/ exposed those controls and enabled a public parity case. The active case uses largest-transform mode and 16x16 partitions; its two exact Pillow frame hashes are recorded in tests/fixtures/input/images/avif/README.md. This does not close the separate high-depth I444 restoration gap. Coverage MCP reports four missing branch observations in the defensive empty/zero-size guard at decode.rs:1049 inside the 4:2:0 sampler. No public AVIF fixture has been identified that reaches this helper with an empty plane or zero geometry; the gap remains open instead of adding a private-only test. It also reports repeated observations around decode_following_vertical at block.rs:67502. Source review found its four direct callers inside two bounded 4:2:0 helpers. Both constructors hardcode 4:2:0, and their closed-frame callers require 8-bit input; generic Full/high-depth following blocks use a separate decoder path. The full_strict branch is therefore not reachable through today's public decoder call graph. These MCP coordinates are unverified because the local report has no source/build receipt. The 100% target remains open.

Previous full-suite snapshot before parity-only cleanup — 2026-10-02

The last recorded all-feature make coverage run before removing private coverage sweeps passed its then-current tests and release floors: 108,537/162,403 lines (66.8319%), 17,646/32,238 branches (54.7366%), 5,456/9,374 functions (58.2035%), and 159,061/242,607 regions (65.5632%). It ran with nightly-2026-07-16 on macOS ARM64 and wrote target/release-evidence/coverage.json. This report predates the current source and fixture set and is historical, not a measurement of the current tree. Coverage MCP reports its source identity as unverified and test status as unknown because the report has no source/build receipt. Its branch observations cannot be attributed to current public parity rows. The selected public matrix measurement above is current but does not establish full-suite floors or 100% coverage.

That earlier MCP report listed a missing outcome in an AV1 decoder specialization. Its coordinate (block.rs:21108) predates source cleanup. The format rule still requires delta_q_present = 0 when CodedLossless = 1, so a conforming parity input cannot exercise the opposite state (AV1 bitstream semantics). No synthetic case was added to claim that unreachable state.

The active portable_lossless_filmgrain_i444_64x64 row exercises a 64×64 8-bit all-lossless I444 AV1 still with film grain. The full-resolution I444 admission uses the existing bounded grain-dimension check, then the public decode path applies the grain kernel. The row is one of 393 active AVIF decode cases and passes the current public matrix with exact Pillow parity. Its RGB reference is 12,288 bytes with SHA-256 44f85ee642e036ae8646b40b2a71643f1e74a27d2a5a6af719c938d8aba2dceb, and its AVIF source SHA-256 is 5e40ca71068fdd232d11f356103f53c1fdd7b94356fa91b0004d7307de4cbd25. The historical full coverage run recorded 859 more covered lines, 110 more branches, 64 more functions, and 1,335 more regions than its predecessor. The report has no source/build receipt, so that coordinate change is not a test-attributed gain.

Progressive JPEG reconstruction now selects the existing safe fixed-point wide IDCT on x86_64 as well as AArch64. The x86_64 baseline uses SSE2; the AVX2 configuration is a separate compile-time target-feature build. The all-feature JPEG decode matrix passed all 163 active rows on this ARM64 host, which exercises the AArch64 path only. make lint-x86-simd passed strict Clippy for x86_64 SSE2 and AVX2 builds. CI runs the public JPEG decode and encode parity matrices with branch reports on both x86 configurations, and the benchmark workflow measures both variants on the same AVX2-capable host. No x86 runtime parity or speedup result is claimed until those artifacts are available.

A separate three-round, 40-workload pre-candidate ARM64 JPEG diagnostic compared the then-current build with TurboJPEG. RGB 4:2:0 encode medians were 1.82× slower at 512×512 quality 85 and 1.89× slower at 1024×1024 quality 85; their output lengths and hashes matched. The run is a baseline, not an A/B candidate comparison or an x86 measurement. Its artifacts are local under target/benchmarks/jpeg/goal-baseline-20261002/; the results identified the RGB 4:2:0 encode path for further full-workload profiling.

A 3-second macOS sample capture during 2,000 public 1024×1024 quality-85 RGB 4:2:0 encodes observed 2,320 stack samples: 1,953 ended in encode_baseline_420_mcu_row_streaming, 215 in aligned RGB conversion, and 148 in packed FDCT. The optimized runner reported a 6.569 ms median and 7.004 ms p95, with the same 793,139-byte output and hash d748543a168ce6aa. The row pipeline inlines its transform, quantization, and entropy work, so this sample does not separate those costs enough to justify a stage-specific SIMD change. The run and sample are under target/benchmarks/jpeg/goal-encode-rgb1024-q85-arm64-debuginfo-20261002.*; they are profiling evidence, not a controlled performance comparison.

The aligned RGB 4:2:0 MCU-row fast path reuses the existing packet conversion kernel and keeps the generic edge-replication path for partial dimensions. Its public JPEG encode parity matrix passes all 61 active rows. A 32×33 RGB case reaches the streaming converter with aligned width and odd height; Coverage MCP no longer reports missing branches in this converter. The unreachable padded width comparison was removed because ceil(width / 16) * 16 equals width whenever the preceding width-alignment condition is true. A balanced local baseline/candidate/candidate/baseline comparison, with five rounds per build and the full 40-workload matrix on the same ARM64 Mac15,7, measured a 2.13% lower geometric-mean latency across encode workloads and a 1.65% lower mean across the 512×512 quality-10/85 and 1024×1024 quality-85 RGB 4:2:0 cases. Decoder latency changed by -0.10%; input and Rust output length/hash matched for all 40 workloads. The measurements are directional ARM64 evidence, not an x86 SIMD result or a cross-machine performance claim. Raw runs are under target/benchmarks/jpeg/goal-aligned-ab-{b1,c1,c2,b2}-20261002/.

The JPEG quantizer now omits its upward quotient correction: prepared JPEG divisors are 8–2040 and use ceil(2^32 / divisor), so multiply-high cannot underestimate the quotient. The single downward correction remains, and the public JPEG encode parity matrix passes all 61 active rows. Ten alternating 500-encode captures of the public 1024×1024 RGB quality-85 4:2:0 workload on an Apple M3 Pro measured a 1.14% lower median of run medians (6.271 ms candidate, 6.343 ms baseline); six of ten paired runs were faster. Output size and FNV-1a hash were identical at 793,139 bytes and d748543a168ce6aa. This is a small, directional ARM64 result; raw records are in target/benchmarks/jpeg/goal-quantizer-20261002/, and no x86 runtime speedup is claimed.

Four exact public AVIF sequences now select non-wedge inter-intra mask modes 0, 1, 2, and 3. The mode-3 case has a pinned dav1d syntax trace for the final-frame B16x16 at (16,16), matches all three Pillow RGB frames and 100 ms durations, and is retained in the 60-case, 167-artifact AVIF loop bundle. The current full LLVM report observes both outcomes of mode == 2 at mc.rs:778 768 times each, and Coverage MCP reports no missing branch at that line. Six missing observations remain in fill_inter_intra_mask's invalid-mode and invalid-geometry guards; valid AV1 syntax cannot produce those states, so they remain uncovered without private-only tests.

The new active animated_lossy_wide_i444_mode2_unsplit_b128x128 case is a two-frame 256×256 I444 sequence encoded with fixed 128×128 partitions. Its mode-2 unsplit inter leaf is the public input needed to take the previously unobserved topology.is_none() arm at block.rs:63734. The selected public row passes exact Pillow RGB parity; frame hashes are e9a4e243aaa2832b61a0f8d362ee44e06d67acf653cf0e687c0d3e33099d8e and cd57a87fb5d4d0d896d8dd50b80583ca80780eee160f5d59cd4699283937c4dc, each with a 100 ms duration. Its complete-file loop observation is infinite. The selected LLVM report records one true and three false evaluations at that branch. The full report now records two true and 60 false evaluations in the public decode_inter_leaf specialization (the preceding full report had zero true and 54 false); other monomorphizations still have uncovered observations there. Coverage MCP marks the report source unverified and test status unknown because no source/build receipt accompanies the local report.

The companion animated_lossy_wide_i444_mode2_split32_b128x128 fixture uses a flat gray key frame followed by a row-alternating 32-pixel sinusoid. Its 1,739-byte input hashes to f48a6d235c7ab245e8d57aedcc6135b897cea1bcbc579c3d630aa7c20e1a61aa, and both Rust-decoded frames match the pinned Pillow bytes. The selected public row passes 1/1; its branch report reaches the true all_roots_split && all_children_unsplit LossyWideMode2Split32 arm at entropy.rs:7109 and the true all_roots_split && all_children_split LossyWideMode2Deep16 arm at entropy.rs:7115. Coverage MCP's selected-test comparison reports six newly observed branch coordinates in entropy.rs, including both arms, but marks the comparison limited because source/build identity and test receipts are unavailable. The fresh full AVIF decode-matrix report passes 466/466 and records 9,528/32,200 branch observations; this selected AVIF report does not represent full-project coverage. Reports are target/release-evidence/coverage-avif-mode2-split32-row-20261004.json and target/release-evidence/coverage-avif-goal-full-20261004-rev2.json.

The mode-zero condition in decode_inter_transform_size is covered, but its nested clipped_lossless_grid false arm at entropy.rs:6927 remains missing: the fresh full report records six true and zero false outcomes. The public 17×17 clipped-grid row now changes its bottom-right pixel in frame two and passes exact Pillow parity. Its selected LLVM report exits through the earlier complete-grid guard at line 6881 and records neither outcome at line 6927, so it is retained as an edge-pixel parity regression case rather than coverage evidence for that arm. The selected batch of ten lossless inter rows records two true and zero false outcomes there. Full aggregate coverage remains unchanged at lines 85,551/142,082, branches 16,248/32,170, functions 4,791/8,972 and regions 130,676/219,579. Coverage MCP reports the full-report comparison as limited because source/build receipts are absent. The reports are target/release-evidence/coverage-avif-clipped17-edge-20261002.json, target/release-evidence/coverage-avif-lossless-inter-batch-20261002.json and target/release-evidence/coverage-full-bottom-b32-speed8-edge-20261002.json. Pinned AOM searches found inputs for some clipped B32x16/B64x128 geometries that Rust rejects; no rejected or mismatching file was promoted to the public parity corpus.

The public interlace_adam7_gray_16bit PNG row adds a 9×9 grayscale fixture with 16-bit samples across all seven Adam7 passes. The selected PNG coverage report has no remaining region observations at decode.rs:1654–1655. A full comparison against the preserved pre-row report lists seven newly observed coordinates in that span, with limited status because source/build identity is unverified. Full-suite totals are unchanged, and the incremental comparison could not combine the selected PNG and full-suite report inventories. No aggregate coverage increase is claimed from these reports.

In this snapshot, decode_inter_translation_impl still has its largest grouped branch observations at block.rs:54939 and block.rs:54973, corresponding to the small I444 chroma-split predicate and vertical I422 TX4 chroma-grid path. Coverage MCP repeats observations across decoder monomorphizations, so group counts are not unique source branches. The deterministic public AVIF input animated_lossy_inter_i444_split_b16x32_mode2 now passes exact two-frame Pillow pixel parity. Its SHA-256 is ad7ce564a11440b91237e0dfffedbde1053bc663ae0e9bf0894f87e05e669bd0. The public decoder trace selects SplitB16x32Deep with transform mode 2 and the LLVM report records the true arm of the small I444 predicate at block.rs:54939. This input does not reach the later small-chroma terminal body; other decoder monomorphizations remain uncovered. A Coverage MCP coordinate comparison against the saved pre-rerun report observes 45 additional AV1 block branch observations, including 27 in decode_inter_translation_impl; source/build receipts are absent, so MCP does not verify attribution. A row-filtered run of the existing public animated_motion_chroma_422 case records 3 true and 0 false evaluations at block.rs:54973 in one decoder specialization. Its active input SHA-256 is 5a83530dcc60f75f0bec7d36cb4db67ae7258b2acc481cbb08cc0987247ea66a; the focused report SHA-256 is efe7104321bb07819efe9a9d17194236102e0122594e145aee3056adf76e89e7. This confirms the geometry is publicly reachable, while the remaining repeated MCP observations belong to other monomorphizations. The lossy mode-zero plan families formerly reported as narrow I422 mode-zero cases were removed after source and AV1 syntax analysis showed that they required both a lossy segment and frame transform mode 0. AV1 uses ONLY_4X4 only for coded-lossless frames (AV1 specification), while the parser sets mode 0 only when every segment is lossless. The legitimate lossless plans and mode-zero parsing remain.

A temporary public parity profile of staged 16×16 and 32×16 I444 candidates matched their Pillow frame pixels and durations, but neither reached the plane-nonzero terminal fallback at block.rs:58149; the LLVM report records zero executions for both arms across the eight emitted decoder specializations. A staged 16×32 candidate failed frame-1 pixel parity and was excluded. The candidates did not justify another matrix row; the 100% target and the terminal-body gap remain open.

The thin-64 lossy qindex guard at block.rs:55045 remains without a public parity row. A 128-case staging sweep used the pinned Pillow 12.2.0, libavif 1.4.1, dav1d 1.5.3, and AOM 3.13.2 stack across exact 16×64 and 64×16 canvases, monochrome and 4:2:0, four content patterns, quality 75 and 50, and partition settings from 8/16 minimum to 64/128 maximum. The sweep index is target/oracle-staging/thin64-lossy-search/quality-partition-sweep-index.json; none of its candidates selected a thin-64 inter block. The closest mode-2/non-lossless candidates with positive qindex matched all Pillow frames exactly but selected 16×16, 16×32, or 32×16 inter leaves. This search does not prove the decoder path unreachable for every valid AV1 bitstream, so no coverage-only or synthetic test was added and the gap remains open.

A separate 36-case qindex-zero sweep over 16×64 and 64×16 4:2:0/monochrome sequences also produced no thin-64 inter leaf: every quality-100 segment was lossless with only_4x4, while a quality-99 control used inter qindexes 2 and 4. The pinned three-frame qmatrix-at-qindex-zero input is target/oracle-staging/thin64-zero-qindex/candidates/16x64_420_bands_q100_min64_max64.avif (SHA-256 da19be87bf0952334f6d613e5ad1b15381ecc04f41c3e952dacde25f9cd288ac). A two-frame derivative at target/oracle-staging/thin64-zero-qindex/two-frame-qmatrix/16x64_420_bands_2frame_q100_qm15.avif (SHA-256 80b7e4469118c276fb0478e4f97ea0b319d1b3feb88c9f70d9eb22f3b5cc2f53) uses the same first two AV1 sample payloads and isolates the qmatrix inter frame. Both kept segment_lossless=true and passed independent Pillow/dav1d decoding; the three-frame input also passed Rust still decode. Its first shown key frame reconstructed, but the second shown all-lossless I420 inter frame was rejected by the initial reconstruction admission gate because complete_lossless_inter_color_reconstruction_context requires !quantization.using_matrix. The qmatrix-off control reconstructed that frame, then its third frame was rejected because the same profile excludes skip_mode_references. The AV1 specification assigns lossless segments SegQMLevel=15 and applies matrix scaling only below level 15 (AV1 specification, §§5.9 and 7.12.3); this looks like a future profile-expansion candidate. However, the repo's capability contract declares AVIF sequence_decode not implemented, so the probe does not justify a public parity row or changing that decoder gate under the current scope. deltaq-mode=1 is suppressed at qindex zero by the encoder and its three-frame parity control still selected 16×16/16×32 inter leaves. No bitstream surgery or coverage-only fixture was added.

Earlier coverage measurements reported the true arm of the mode-zero fallback in decode_inter_transform_size at entropy.rs:6888. It can be reached only when lossless_grid_geometry is false, because the preceding geometry path returns a lossless plan or an unsupported result. The public 16×16 lossless inter row and staging-only 17×17, 23×21, and 33×33 lossless edge probes took the geometry path; the odd-size probes passed exact public parity in shadow harnesses but did not cover the fallback. They do not prove that every valid lossless syntax/geometry is covered, so this guard remains open. Three additional monochrome lossless sequences—7×9, 65×67 translated noise, and a 65×67 edge-residual variant—also passed exact public pixel, timing, and loop parity in staging. Their isolated reports still record 0/0 at line 6888; the lossless-grid guard at line 6799 was true for every inter-transform call (true/false counts 1/0, 72/0, and 16/0). These candidates therefore took the complete lossless-grid plan before the fallback. Candidate files and reports remain under ignored target/oracle-staging/mode0-public-{7x9,65x67,edge-65x67}/; they do not prove every valid lossless geometry is covered, and no new row was added. The compound-reference CDF lookup now follows the declared [group][context] table order, including the backward table's two group rows; its parity correction passes the complete matrix and coverage campaign.

The existing public row animated_odd_dimensions_inter_intra_boundary_420 also passes an isolated all-feature parity run on the ARM64 host. Its selected LLVM report leaves both outcomes of transform_mode == 0 at entropy.rs:6888 unobserved, while the current full report still lists the true arm as missing. The row therefore does not reach this fallback, and no duplicate fixture was added. The selected report target/release-evidence/av1-odd-interintra-mode0-arm64.json has no source/build receipt; Coverage MCP marks its source unverified and test status unknown.

Two additional active AVIF parity cases close decoder divergences found while examining public edge inputs. The 20x20 all-lossless I444 sequence exposed an incorrect B8x8 inter-intra size group; it now matches dav1d's group 1 and passes exact two-frame Pillow parity at clipped edges. The three-frame lossy I444 sequence exposed single-reference motion-vector collection from the matching lane of a compound neighbor, plus a mixed B16x32 split that was incorrectly rejected whenever OBMC was present. The decoder now selects the first matching neighbor lane without allocation, accepts the existing OBMC-capable topology reconstruction path, and uses AV1's 8x8 paired-MI metadata rule in the OBMC syntax precheck. The normative check examines the right/lower metadata owner in each 4x4 pair (AV1 specification, §7.10.3). Its three frames match Pillow exactly. The loop bundle now contains 49 complete observations: 41 accepted inputs and eight malformed inputs, with native repetition and complete frame hashes retained. Coverage MCP's remaining true arm in has_overlappable_neighbor at entropy.rs:5608 is defensive: its public caller invokes the helper only when both block axes are at least two MIs. No private-only test was added for this unreachable guard.

A four-frame 256×256 4:4:4 affine-motion AVIF row exercises RotZoom global models on a compound-reference path. Its frame-3 mismatch traced to a second application of compound_mode_context: find_reference_mvs had already reduced the reference stack to the final 0–7 CDF context. The decoder now uses that context directly. All four Rust frames match the pinned Pillow RGB references byte for byte at 90, 110, 130, and 150 ms, and the native libavif loop witness confirms infinite repetition and repeat equality. This fixture also exercises compound spatial-neighbor and affine-motion state through the public decode path.

An earlier local Coverage MCP query on target/release-evidence/coverage.json, before the all-feature snapshot above, reported 17,239/32,240 branch observations covered, with 15,001 missing across 1,513 groups. Its largest decode_inter_translation_impl groups reported 1,870 repeated misses at block.rs:54830–54832; those counts span decoder monomorphizations and are not unique source branches. Coverage MCP marked that report's source unverified and test identity unknown because it had no source/build receipt, so the counters were coordinate diagnostics rather than attributed test coverage. An earlier coordinate comparison reported 84 newly observed coordinates against target/release-evidence/coverage-after-compound-reference-cdf.json, but that baseline file is no longer present in the workspace and the reports lacked receipts. The earlier local test run passed all 59 coverage-matrix tests.

The active intrabc_spatial_neighbor_monochrome_256 fixture now witnesses the IntraBC spatial-neighbor path. Its pinned Pillow 12.2.0/libavif 1.4.1/AOM 3.13.2 input is a deterministic 256×256 monochrome lossless AVIF with neighboring 8×8 IntraBC leaves (input SHA-256 c77c448e3668e90a4de1228c8b44a54fd47caae8e7538e314a1597dcc961795f). Public decode and decode_sequence both match all 196,608 Pillow RGB bytes (SHA-256 ed729898cd63496b4a1aa628686ebff2dd7a0f383dfdae854f7cd77dae54ce22). The fixture exposed that AV1 infers both subsampling flags as true for monochrome; the bounded profile gate now checks those inferred values, and the fallback motion-vector row test is tile-relative. A DAV1D trace confirms the second leaf uses its IntraBC spatial neighbor. The full-report Coverage MCP query still lists three missing observations in add_spatial_candidate at motion.rs:1675, 1678, and 1707; this fixture does not claim to cover every outcome there. That report has no source/build receipt and labels test status unknown, so the remaining locations are diagnostic rather than verified per-row attribution. No coverage-only test was added.

A fresh selected LLVM profile of this parity row passed 1/1 on 2026-10-29 and records six calls to relocate_intrabc_source. The calls follow the in-bounds monochrome path and do not exercise source relocation. The bounded public profile admits monochrome only and supplies has_chroma: false, leaving the chroma-border arms unreachable through public decode. A valid parity fixture for the relocation arms has not been established. The report is .coverage-mcp/local-evidence/selected/av1-intrabc-spatial-current/coverage.json (SHA-256 4618cf1ac9f3143a85c010e155917088ca57b7291f78ad27b556ad49b7f5737b). Its local receipt records no source changes during collection, but Coverage MCP still marks source/build identity unverified and test attribution unknown; this is a reachability note, not a coverage-gain claim.

The targeted temporal-projection candidate is already exercised by the active animated.avif parity row (SHA-256 2f8683d21725261f37f86e115f0c212cc52d0fefd3a2ddfcc4fa648c1859906d). Independent OBU inspection confirms order hints and reference-frame MVs are enabled, including an inter frame whose future ALT slot differs from GOLDEN. The selected public-row LLVM profile invokes load_projected_temporal_field five times and records both outcomes for the ALT/GOLDEN hint comparison (2/3) and positive temporal-distance selector (4/11); the existing row already pins five complete Pillow RGB displays and sequence metadata. The selected report has no source/build receipt, so these are diagnostic counters rather than Coverage MCP attribution. No duplicate parity row was added.

Boundary-focused monochrome probes also passed public pixel and duration parity at 69×73 with 128×128 superblocks, 4×4, 5×8, 8×5, and 5×5. Their isolated profiles took the complete lossless-grid path for every inter transform call and recorded no execution at entropy.rs:6842. The candidates remain under ignored target/oracle-staging/mode0-edge-non4/; no parity row was added because none reached the fallback.

Two additional staging-only 64×64 monochrome lossless inter-sequences matched Pillow's decoded RGB frames and frame durations; the second frame in each sequence was inter-coded. Their isolated LLVM profiles recorded no executions of the large-transform helper or either outcome at block.rs:21105. Pillow's AVIF info does not expose the loop field, so the Rust loop=0 result has no independent Pillow assertion. These candidates do not justify a public parity row, and no row was added.

A later bounded probe exercised four deterministic 64×64 monochrome lossless images and four RGBA images with monochrome lossless alpha items. All eight public decodes matched Pillow exactly, while isolated LLVM profiles still recorded 0/0 at line 21105 and did hit a separate monochrome plane-geometry branch. The target function's production caller is a fallback reached only when the complete streamed monochrome validator declines; these probes followed that complete validator instead. Encoder-option attempts did not find a valid candidate that passes the fallback's narrower admission checks. The route remains open for a bitstream where the first validator declines and the fallback accepts; no coverage-only input or parity row was added.

The selected public rows animated_lossless_inter_420_b16x16 and animated_lossy_split_inter_420_b16x16 passed their Pillow parity checks but did not exercise the luma-extension condition at block.rs:48287. Coverage MCP reports both branch outcomes missing in the selected report target/release-evidence/coverage-goal-vertical420-probe.json; the full and other selected AVIF profiles also show no observations for the helper's extension/fallback arms. No new row was added from these cases.

Coverage MCP also identifies a WebP Vp8Decoder<Cursor<&[u8]>> specialization gap at vp8.rs:1566. Production decode call sites pass bounded readers (Take); the direct Cursor specialization is instantiated only by private decoder tests. The selected public lossy_vp8_lossy_macroblock_residual_context_edges_32x16_q75_m4 parity row exercised the Take specialization six times and did not call the direct specialization. Since a new public row follows the same production reader path, it cannot cover this gap; no parity row was added for it.

The new public encode row enc_lossy_noise re-encodes the 64×64 high-entropy lossless_noise.webp source as lossy WebP through both ordinary encoding and encode_with_token. The 2,888-byte Pillow 12.2.0 output matches exactly (SHA-256 4989ffb95ab4b7bd4f1d5feb61d80d9fe256278a1e8d90070835db628dbb3912). Its pre-cleanup selected LLVM report, coverage-webp-token-noise-selected.json, shows the TokenPartitionCheckpoint::flush_with_checkpoint output.last_mut() Some(previous) arm 15 times in encode_bool and once in the final flush at bool_enc.rs:169. A selected comparison against the q50 token-aware row reports three newly observed branch outcomes at lines 168, 169, and 173. The quality, alpha, palette, grayscale, CMYK, and predictor probes did not hit this carry path. The earlier full profile's eight None outcomes came from the coverage-only hook's empty output vectors, which have since been removed. This public parity row supplies the complementary prior-byte carry case. Its old branch coordinates and the 17,536/32,238 aggregate belong to a pre-cleanup report; they are not current full-suite coverage. Coverage MCP reports no source/build receipt and unknown test status, so the selected comparison is limited coordinate evidence rather than a managed coverage delta.

Public parity rows added — 2026-10-01

Three active decode rows add exact edge-case parity from Coverage MCP findings. unknown_ancillary_after_idat inserts a valid abCd ancillary chunk after PNG image data; Pillow 12.2.0 and Rust return identical 128×128 RGB pixels (49,152 bytes, SHA-256 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131). bmp_1bit_default_palette sets ICO's embedded 1-bit DIB colors_used field to zero and matches Pillow's 16×16 RGBA output (1,024 bytes, SHA-256 1a9eee34c466acd78abb5ad2db2467d3fae0931df64b402f1eaf35a65463b842).

compression_packbits_packbits_zero_strip_byte_count sets TIFF tag 279 (StripByteCounts) to zero. Pillow still returns the exact 128×128 RGB pixels above. The public parity test exposed Rust rejecting this input as a truncated PackBits stream; compressed strips with a zero byte count now derive their bounded payload span from the next strip or file boundary, while positive declared counts keep their existing path. The all-feature TIFF decode matrix passes 129/129 rows.

The PNG, TIFF, and ICO focused decode matrices pass 163/163, 129/129, and 54/54 rows respectively. Coverage MCP reports no remaining branch gaps at png/decode.rs:347, tiff/decode.rs:1180, or ico/decode.rs:699 in their selected reports. Those reports have no source/build receipts and test status is unknown, so these are bounded path observations and do not update the source-bound full-repository coverage totals.

Selected parity coverage probes — 2026-10-03

The existing public GIF row enc_rgba_mixed now also invokes encode_with_token and compares exact Pillow bytes and ordinary/token-aware output. Its selected Coverage MCP report no longer lists the token-present arm in compact_rgba_palette. That 4×2 input is too short to reach the remap checkpoint at 1,024 pixels, so a separate public row enc_rgba_mixed_token_compact_checkpoint uses a 33×33 PNG cycling the same eight-value mixed-alpha pattern. The selected matrix run reports exactly one active row passed, and Coverage MCP's selected comparison observes the true checkpoint arm at encode.rs:2027. The two reports have no source/build receipts and unknown test attribution; this is local coordinate evidence, not a full-suite coverage claim. The remaining has_holes true arm has no public witness under the current FASTOCTREE palette ordering: used indices form a dense prefix, with unused padding at the end.

The public row pillow_tolerated_malformed_missing_iend verifies that PNG decode succeeds while Pillow-style verification reports a truncated-file error. Its selected run exposed a coverage-matrix lifecycle assertion that always required EncodedImage::verify() to succeed for the first selected row of a format. The parity harness now checks the source verification result against that row's recorded Pillow status and error contract. The selected PNG row passes 1/1. Its LLVM report records Chunks::next's clean-EOF condition true 7 times and false 12 times; the other true arm on the same source line, self.failed, remains unobserved. Coverage MCP groups those two short-circuit branches at one line and still lists a true-arm gap. Chunk errors propagate to the current iterator consumers, so a later next() call after self.failed has no known public parity input. The selected report has no source/build receipt and unknown test attribution; these are local path observations, not a full-suite coverage claim.

The selected BMP rows error_not_bmp and error_related_os2_signatures both pass public error parity, but their selected reports do not enter bmp::decode()'s signature branch at decode.rs:363: format detection rejects those signatures before dispatch. Adding another row with the same dispatch path would not cover that decoder guard. Their reports likewise have no source/build receipts or test attribution.

The active WebP row pillow_tolerated_malformed_animated_alpha_anmf_width_mismatch keeps the nested VP8 and alpha streams at 64×64 while declaring the ANMF frame width as 16,385. Pillow 12.2.0 decodes two 64×64 frames; the previous ALPH path trusted the declared width and returned ImageTooLarge. The decoder now reads the bounded VP8 bitstream first and uses its validated dimensions for alpha expansion and compositing, retaining the 16,384 limit on the decoded frame. The selected public parity row passes 1/1. Its report target/release-evidence/coverage-webp-alpha-frame-too-large-20261003-after.json still lists the guard's false arm as unobserved at decoder.rs:705; Coverage MCP has no source/build receipt and unknown test attribution, so this is not a verified full-suite coverage gain. Incremental comparison with coverage-full-gif-lzw-invariants-20261003.json is incomparable because its baseline branch detail is incomplete; no marginal-coverage union is claimed.

The active JPEG row baseline_420_singleton_chroma_width_fallback uses a 1×1 baseline JPEG whose Cb and Cr sampling factors differ. Pinned Pillow 12.2 decodes the pixel as RGB (128, 128, 128), and the selected public parity row passes 1/1 without a decoder change. Its LLVM report target/release-evidence/coverage-jpeg-singleton-h2v2-20261003.json shows the previously missing false arms at upsample.rs:85 and :105 hit; the opposite true arms remain missing. Coverage MCP reports no source/build receipt and unknown test attribution, so this records the selected input's paths rather than a suite-wide gain.

The active WebP row pillow_tolerated_malformed_animated_vp8l_anmf_width_mismatch declares an ANMF width of 16,385 around a 16×16 VP8L stream. Pillow 12.2 decodes two 64×64 RGBA frames. The decoder now reads the bounded VP8L header and uses its intrinsic dimensions before allocating and compositing the frame. The selected row passes 1/1. The active rows error_animated_vp8l_short_header and error_animated_vp8l_short_header_oversized_width cover four-byte nested VP8L payloads with normal and oversized ANMF declarations. Pillow 12.2 rejects both with OSError: could not create decoder object; both selected public parity rows pass 1/1, including the oversized-frame guard's ImageTooLarge path. The WebP decode matrix passes 237/237. Rows error_animated_vp8l_frame_outside_right and error_animated_vp8l_frame_outside_bottom shift a valid 64×64 nested frame two pixels beyond each canvas edge. Pillow 12.2 rejects both; the selected public parity rows pass 2/2 and exercise both short-circuit arms of the frame-bounds guard. The complete decoder matrix ran eight public format tests and passed 1,419/1,419 active decode rows. Coverage MCP report target/release-evidence/coverage-public-decode-matrix-20261003-verified.json records 11,766/32,174 crate-wide branch counters for that decode-only run. The report has no source/build receipt and unknown test attribution, so use it as a path inventory rather than a full-suite coverage measure. Coverage MCP no longer lists gaps in the new WebP VP8L header-size or canvas-bounds paths, or in the JPEG singleton-width upsampler. Its remaining WebP read_frame gap at decoder.rs:734 is the VP8 dimension guard; valid VP8 widths and heights are 14-bit values and cannot exceed its 16,384 limit.

The latest public parity batch adds three malformed AVIF meta cases: duplicate iprp (9a245809b8f3a78aec952c15ee9703973a5d407bbaffe17580c4b6b3aca26ee8), duplicate iref (ec6f361b37447d4abeb047508863c59e60d3aa73721adb4b5a76e7e159295f3e), and empty idat (281c5cf87f6d34f77635924a13384d107111870db7600e10636e4a2735d2c1c7). It also adds JPEG progressive_com_tail_junk (70dd4ed893d23e30d3e5c27ef1ac3f55e6a1a98e3aad166610db48754ee43ed2), which opens and verifies in Pillow but fails during load as a truncated progressive stream. All four selected public parity rows pass. The full make coverage run passes every executed test and the local floors. Coverage MCP reports seven new branch coordinates compared with the saved pre-batch report: five under samples::parse_meta and two in JPEG find_next_marker. The comparison remains limited because source/build identity and test attribution are unverified; these are coordinate changes, not source-bound coverage claims. The 100% goal remains open.

Clipped AV1 lossless inter-grid parity — 2026-10-04

The public AVIF matrix now includes clipped B32 lossless inter-grid witnesses for I444 right and bottom edges, I422 right-edge cases, and I422/I444 dual-edge cases. The new animated_lossless_inter_i444_clipped_b32x32_64x56.avif has SHA-256 9004ec840b2a413c0e15294f52c723ebe5c3689cbe3decbd4afd5575cad78e23; its bottom B32 block exposes 32x24 pixels, and its two decoded RGB frames match Pillow exactly. The selected public row and the complete AVIF native-loop parity test pass. The 52x64 I422 case also passes exact sequence parity with a 20x32 clipped right block. The two 52x60 dual-edge cases pass exact sequence parity with 20x28 luma visibility; I422 chroma visibility is 10x28. For odd-width I422 at 49x64, key-frame pixels match Pillow and sequence decoding keeps an explicit Unsupported expectation because the final chroma sample geometry is not parity-safe. The AVIF matrix now has 454 active decode rows; the full fixture matrix has 1,950 rows.

make coverage passed all executed tests and the local floors. Its LLVM report records 86,804/142,471 lines (60.9275%), 16,766/32,250 branches (51.9876%), 4,849/8,990 functions (53.9377%), and 132,767/220,396 regions (60.2402%). Coverage MCP identified six missing branch outcomes in inter_lossless_grid_clipped_b32_geometry_supported near src/codecs/avif/av1/entropy.rs:5395-5397. The report has no source/build receipt and MCP reports source=unverified, tests=unknown, and no build or revision ID, so these coordinates do not establish named-test attribution or a verified coverage delta. Those false arms are unreachable for valid B32 leaves: tree traversal skips zero-area blocks, and a visible extent over 32 contradicts the coded block size. Malformed inputs may exercise upstream rejection, but defensive-only states do not become Pillow parity fixtures. Strict SSE2-baseline and AVX2 Clippy builds pass, but they are compile checks, not runtime speed measurements. The 100% goal remains open.

The refreshed MCP branch report's largest group is the lossless_partial_grid predicate at block.rs:54838-54847. Source review found seven zero-hit callback-specialization clones; the remaining live clone already observes both outcomes of the clipped-versus-full extent predicate. Existing active parity rows cover admitted clipped B32 grids across I420, I422, and I444. The rejected zero-hit clones and the depth/alignment rejection arms do not provide a new valid Pillow-parity input, so no redundant AVIF row was added. A bounded probe for the 64-axis lossy transform mapping at block.rs:57818 and its topology variant at block.rs:57852 also produced no bitstream that both selected the missing plan and passed public parity. MCP still has no source/build receipts; these are coordinates, not verified test attribution.

PNG post-IDAT ancillary CRC parity — 2026-10-04

The public PNG matrix adds pillow_tolerated_post_idat_ancillary_bad_crc, an unknown ancillary chunk after IDAT with one corrupted CRC byte. Pillow 12.2.0 still decodes the original RGB pixels (SHA-256 8a1d6fcc36f5b5e70fbf949d4e612630a1931279383e7c21db27cd3cbad98131), while verify() reports SyntaxError: broken PNG file (bad header checksum in b'abCd'). The selected public decode-matrix test passes. Coverage MCP could not union its selected report with the saved full baseline: branch totals differ (32,250 versus 32,324), and both reports lack source and build receipts, so no verified coverage gain is claimed.

GIF89a metadata-limit parity — 2026-10-04

The active palette_index_leniency row also decodes its 35-byte GIF89a input with a public metadata limit of exactly 33 bytes; its two compressed image-data bytes are excluded from the metadata extent. The targeted matrix row and full coverage campaign pass, with exact Pillow pixel parity. Coverage MCP now leaves only the malformed-signature outcome at src/codecs/gif/decode.rs:361; public format detection rejects that signature before metadata preflight, so it does not justify another parity fixture. The report remains unbound to source/build receipts and has unknown test attribution.

JPEG 4:2:0 generic small-image encoder parity — 2026-10-17

The active enc_sub_420_generic_mcu_aligned_16x16 row encodes a deterministic 16×16 RGB PNG at quality 85 with baseline 4:2:0 subsampling and Huffman optimization disabled. Its PNG input is 852 bytes with SHA-256 427e0a7d6532ab94abf4ecf3d96d891719c060780eaa9243d161f278d97e9eef; the Pillow JPEG reference is 818 bytes with SHA-256 f8f11806f51915cf5673c8f5732280b24fe53ee7b3c5ef6669ac17ace9e97031, and the roundtrip RGB reference hash is 6fb0c4384dd488fb72663f0799d7591a1fe701165b1ac614a289974139f9696a. The source forms a complete 2×2 luma-block grid below the 1024-pixel streaming threshold. The selected public encode row passes. The focused report target/release-evidence/coverage-jpeg-420-generic-16x16-final.json records the selected row's aligned-grid outcomes at src/codecs/jpeg/encode/mod.rs:4611–4614 (three taken observations per guard). Coverage MCP calls hung in this run, so the selected report is not unioned with a baseline and establishes no aggregate coverage change.

Small JPEG chroma and WebP palette encode parity — 2026-10-04

Two active public encode rows add exact Pillow references using existing source assets: enc_subsample_422_tiny_edge encodes the 1x8 RGB JPEG as baseline 4:2:2 at quality 85, and enc_lossless_palette16 losslessly re-encodes the 64x64 RGB WebP fixture with exactly 16 colors. They cover small-image chroma edge replication and the WebP 5–16-color packed-palette case. The selected public matrix passes 2/2; the full all-feature coverage campaign also passes all 56 matrix tests, 7 decode-policy tests, and 68 feature-gate tests.

Coverage MCP still reports the defensive invalid-geometry arm at src/codecs/jpeg/encode/mod.rs:1507; validated public dimensions cannot reach that arm. The earlier full report for this review recorded 86,804/142,471 lines, 16,766/32,250 branches, 4,849/8,990 functions, and 132,767/220,396 regions; it predates the latest full report at the top of this file. Neither report carries source/build receipts for MCP attribution. The 100% coverage goal remains open.

Historical claim ledger

The following source-bound baseline was measured on 2026-08-27. Its historical percentages must not be relabeled as current-release coverage. The validator checks the historical manifest/matrix bytes at the measured Git revision, Coverage MCP identities, and separately checks current fixture integrity. The public rendering is centralized here so copied prose cannot drift across guides.

After regenerating the manifest, coverage matrix, coverage origin manifest, unreachable contract manifest, or roadmap, run make refresh-fixture-integrity locally. It updates current receipt hashes and the current-integrity line below, then runs make verify-fixture-integrity. It preserves the measured revision, original manifest and matrix hashes, and coverage MCP identity. GitHub CI runs the read-only verifier and never refreshes receipts automatically.

AV1 show-existing unshowable-reference parity — 2026-10-31

The retained local full LLVM report at target/release-evidence/coverage.json (SHA-256 5209ff334213f218cd54ceaacdd0704099532ed63f38aaabc788ac130f2c7281) showed no hits for the non-showable reference arm in parse_reader at src/codecs/avif/av1/frame.rs:3241, while the showable arm was observed 77 times. Coverage MCP returned Transport closed for both the full report and the focused report; these coordinates are local evidence only.

Added active parity row decode:avif:error_animated_show_existing_unshowable_reference. The generator changes the show-existing slot in sample 2 of animated.avif from slot 2 to slot 0, which contains the initial non-showable key frame. It changes one AV1 syntax byte; fixture SHA-256 is bf8daa2a92e16a7c9b12cd5ef6d724b36c30e724d5f8a2952480387ff20ecf9d. Pillow 12.2.0 opens the file and loads frames 0–2, then reports Failed to decode frame 3: Decoding of color planes failed. First-frame RGB parity remains exact at 67,500 bytes, and sequence decoding returns the same malformed-input error.

make coverage-selected COVERAGE_CASES='decode:avif:error_animated_show_existing_unshowable_reference' passed 1/1. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T044137.197296Z-1a9966d9bc4a40d99eb43307d1b87fc0/coverage.json (SHA-256 c240d1c355dd2815cf7b652e1c7b89b72d0bf3b0cd59dd7f500319dce2a3d335); the local receipt SHA-256 is 96b2e7732ec71e0c72d2de96097ebf5807abeadd57e4d041e9c639175f0c76f2. Its executed parse_reader specialization records the previously missing non-showable arm once. Coverage MCP again returned Transport closed, so this is not MCP-confirmed evidence and makes no aggregate coverage claim. No Rust unit tests or target-only fault-contract cases were added.

The malformed-case ledger now includes sequence-only Pillow and Rust error rows, with their sequence status and error details kept separate from first-frame decode status. scripts/generate_malformed_ledger.py --check and scripts/verify_claim_ledger.py pass.

AV1 show-existing empty-reference parity — 2026-10-31

The retained full LLVM report at target/release-evidence/coverage.json (SHA-256 5209ff334213f218cd54ceaacdd0704099532ed63f38aaabc788ac130f2c7281) showed the empty-reference branch in parse_reader at src/codecs/avif/av1/frame.rs:3238 had zero hits; the populated-reference arm was observed 77 times. The prior slot-7 mutation still selected a populated key-frame slot, so it was discarded as evidence.

Added active parity row decode:avif:error_animated_show_existing_empty_reference. Its generator replaces the first color-track sample's key-frame OBU with the same sequence header and a show-existing frame header for slot 7, before any reference slot has been populated. The file opens as a five-frame AVIF; Pillow 12.2.0 reports a malformed decode at frame 0 and a malformed sequence decode at frame 3. The fixture SHA-256 is 4edf1ad3aca5683da9b01569d76381185f6dc057e089337466085f044e786f7c.

make coverage-selected COVERAGE_CASES='decode:avif:error_animated_show_existing_empty_reference' passed 1/1. Its selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T045526.866827Z-33ae152126e94c2aaebd2d59b4b50659/coverage.json (SHA-256 5d62d5d34d26c60eeb9fa3d6ebddf11fea4fb40a491836507a7e55084d599de9); the local receipt SHA-256 is 499c1ce36e92ddc8acfd69942082d6ceb63128c59e120a66457ea55ee058bc50. Its frame.rs:3238 branch record has counts [0, 3], confirming the previously unvisited empty-reference arm ran. The source and fixtures did not change during this selection. Coverage MCP returned Transport closed; this is local selected evidence only and makes no aggregate coverage claim. No Rust unit tests were added.

WebP truncated VP8X metadata fault contract — 2026-11-10

Added target-only fault contract fault-contract:webp:webp_metadata_truncated_vp8x_rejected. Its coverage-only hook truncates an encoded VP8X container to 29 bytes before metadata insertion; the public encoder must return a structured Malformed error without changing the caller's sink. A clean retry is checked against the pinned Pillow encoded bytes and decoded pixels. Source PNG pixels are independently checked against the matching PNG decode parity fixture, so the lossy WebP output reference is not mistaken for the original input pixels.

The focused coverage run passed the fault contract and two existing parity rows, enc_lossy_alpha_exif and enc_lossless_exif_metadata_reuse (3/3 rows). Coverage MCP observed both outcomes of the VP8X identification predicate (6/3), both outcomes of the 30-byte header-size predicate (5/1), and both outcomes of the follow-up extended-container predicate (1/3). The selected report still lists uncovered ICC and XMP insertion arms and the EXIF-absent arm in this helper; this cohort does not exercise those metadata combinations.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261110T133841.363917Z-dcfdb117c150415fa43e685a91a68905/coverage.json (SHA-256 9ed6b9f1fd279e97fc8cc282f9915d3d37e783807be37dd6ea22e4285d609a8f). Its local receipt SHA-256 is a4068ade41a47d5a7c4ec97219b1559cfb87b3cdf26f56c80ec290a8fb3319ec. Coverage MCP marks source identity unverified and test attribution unknown; these are focused local observations, not an aggregate coverage claim.

Current claim-ledger baseline (not current HEAD): - Measured revision: 93ec80ec99c42671dce6cf70694bce27ad8a2ef4. - Coverage MCP run: ec4c4bbd-dbda-4e49-8109-d7da07722dc0; snapshot: 7665cda3-f4a7-4568-b871-a9d34afaa92c. - Coverage: 100,389/110,015 lines (91.2503%), 12,861/14,246 branches (90.2780%), 5,125/5,794 functions (88.4536%), and 150,221/166,375 regions (90.2906%). - Measured manifest SHA-256: c1a1cccd485d066ffbe206a6e1577a1788aff8d4f288e4e8f8a933fa3c62ae7b; measured matrix SHA-256: f26151b3811aaab58556da422f476b714b5fac5925ff5b97807904096b4d2d58. - Current fixture integrity only: manifest 27bdf88806b544a277f6f1388270d8637aba0c943dc7867da0013af4e236f079; matrix eedaf41429ecae773b1527110423c1c70464d84275835f72dc9efb1409ad2d86.

The larger current source denominator and the historical source denominator are not interchangeable. Selected incremental runs cannot substitute for a full fresh report. Keep the original raw reports and context rather than attaching old identities to new measurements.

The ledger's fixture-manifest hashes track current-file integrity. Updating those hashes does not extend the historical coverage run to new code, guards, or unexecuted regressions. The 2026-09-17 AVIF temporal-candidate repair remains unverified by Rust execution, as recorded in the roadmap.

The 2026-09-17 coverage-fixture maintenance passes strict all-feature Clippy with --cfg coverage on native and wasm32-unknown-unknown targets. Native coverage builds also pass with no codecs, default codecs, and each codec individually. Ordinary native Clippy, both WASM library feature matrices, and all-feature rustdoc pass. Fixture setup retains explicit failure assertions, checked bounds, and the original malformed inputs; feature-specific exercises follow the same feature gates as their implementation. The Rust behavioral test suite and coverage measurements remain deferred. The documentation checker inadvertently executed the README quickstart during this maintenance; that example passed, but is not evidence of roadmap or parity completion. The historical coverage totals and open capability statuses remain unchanged.

The 2026-09-17 HDR color candidate has independent full-file native evidence: dav1d and libavif agree on 240,000 YUV bytes, while pinned scalar libyuv, libavif and Pillow agree on 120,000 RGB bytes. The deterministic observation is recorded in the HDR oracle index. This witnesses the native conversion of 10-bit full-range I444 CICP 9/16/9 without alpha. The safe-Rust converter and its full-plane/tail regressions are implemented; their behavioral execution and managed coverage are deferred. Strict Clippy passes for native, wasm32-unknown-unknown and wasm32-wasip1 with AVIF-only and all features, both ordinary and coverage configurations. Native and coverage-enabled unknown-WASM checks include all targets; WASI checks compile the library. Warnings-as-errors rustdoc, formatting and static provenance/roadmap checks also pass. The HDR public row remains planned and historical coverage is unchanged.

The 2026-09-17 high-depth color candidate adds the exact 12-bit limited-range I422 CICP 2/2/2 declaration with auxiliary alpha from 10bit.avif. Independent scalar dav1d and libavif agree on 81,920 color-plane bytes and 40,960 alpha-plane bytes across all five frames. Pinned scalar libyuv, libavif and Pillow agree on 81,920 RGBA bytes, with repeatable native planes, pixels and timing. Source, compiler, default I601 build flags and artifact hashes are retained in the native index. Partial-alpha pixels witness straight output; zero-alpha pixels are absent.

The shared declaration selector and Rust color conversion are implemented, with deferred regressions for every native frame, 25 full-row slices and separate internal admission/sample-buffer checks. Strict Clippy passes all 12 native/WASM, AVIF-only/all-feature, ordinary/coverage lanes used for the HDR candidate, and warnings-as-errors rustdoc, formatting and static checks pass. This is compile-only Rust verification. Public reconstruction, sequence presentation, Rust pixel execution and managed coverage remain unverified; the existing sequence gates, planned matrix rows and historical coverage totals are retained.

The 2026-09-17 sequence presentation candidate processes matching color and alpha samples with persistent reference state, converts each complete display before advancing, and publishes frames only after all samples succeed. It reserves later output transfer bytes before reconstruction and requires the inspected frame count, output mode and actual frame geometry to agree. Missing reconstruction surfaces remain capability gaps; malformed tile envelopes and empty reference slots retain precedence. That revision retained the frame-ID sequence presentation gate; the later candidate below removes it.

The sequence native index retains five complete RGB displays, six decoded frames, two hidden frames and one show-existing display from the unchanged animated.avif. Unmodified and instrumented pinned scalar dav1d agree on 168,750 YUV bytes; repeated native libavif/Pillow observations agree on 337,500 RGB bytes. Native durations are exactly 1/30 second; Pillow reports rounded 33 ms durations. Independent libavif repetition observations distinguish this one-play animation from the infinitely repeating high-depth fixture. Pillow omits its loop field for both. The bundle notes retain the native metadata origin and required matrix reconciliation.

Deferred regressions compare every public display, first-image pixels, timing, native repetition and output-budget boundaries for both fixtures. Internal defensive cases remain Rust model assertions. All 12 strict Clippy lanes described above, warnings-as-errors rustdoc, formatting and static provenance/roadmap checks pass. Rust behavioral execution and managed coverage remain deferred; no row or finding is promoted. Output transfer limits do not bound retained AV1 references or scratch memory, and variable frame geometry and primary-item/track declaration disagreements remain unsupported.

The later 2026-09-17 frame-ID candidate corrects interleaved reference index and delta parsing in Rust and the syntax inspector. Seven pinned native reads establish the ordering and values independently of either implementation. The frame-ID oracle retains both native RGB displays, native YUV noninterference, exact timing and repetition, a full-file 32767-to-0 wraparound success and a full-file reference delta rejection. The latter preserves the first image in both native/Pillow observations and Rust's deferred regression. Native CLI diagnostics and actual frame outputs establish rejection even though that CLI returns exit code 0. Strict Clippy passes in all 12 native/WASM, AVIF-only/all-feature, ordinary/coverage lanes. Warnings-as-errors rustdoc, formatting, artifact hashes and static provenance/roadmap checks also pass. These are compile-only and static Rust checks; the native observer runs execute only pinned oracles.

The frame-ID-only presentation gate is removed, while repeated-current-ID validation retains precedence over reference-delta failures. Behavioral Rust execution and managed coverage remain deferred. Short-signaling fallback, stale-reference behavior, broader reconstruction and native-versus-Pillow loop reference reconciliation remain unfinished. The bundle's README separates these limitations from the bounded evidence; no matrix row or finding closes.

The 2026-09-17 short-reference candidate removes the no-future rejection and corrects the Python inspector's maximum-distance tie handling. The shared production helper preserves native fallback order, duplicate anchors and repeated earliest-slot reuse. Its normal parser wrapper still requires all eight reference headers.

The short-reference oracle contains six complete AVIF mutations with independently repeated native traces, 4,608 YUV bytes and 9,216 RGB bytes. Unmodified and instrumented dav1d agree byte for byte. Pillow/libavif observations repeat with exact native timing, and the corrected inspector agrees on all selected indices. Equal reference pixels make index comparisons necessary; the deferred coverage test invokes the same production selection helper. Invalid adapter arguments are separately identified as internal model assertions. No coverage exclusions were added.

All 12 strict native/WASM, AVIF-only/all-feature, ordinary/coverage compile lanes pass. Rust behavior and managed coverage remain deferred. This corpus does not establish every mixed-distance history or complete sequence/resource parity; planned rows, finding counts and historical coverage remain unchanged.

The 2026-09-17 repetition candidate aligns the container parser with native edit-list handling and replaces the matrix's absent-Pillow-loop inference with explicit native provenance. The loop index retains 28 complete inputs, 41 hashed artifacts and 420,956 RGB/RGBA bytes. Twenty accepted observations preserve all frames; eight malformed files fail native parsing and Pillow opening. All observations repeat identically.

The native signed-count boundary preserves 2,147,483,648 total plays as finite, then normalizes larger values to infinite. Absent edit lists stay unspecified; nonrepeating lists stop after flags. Repeating lists validate count, version and nonzero segment duration but ignore media fields. Color repetition wins over a different alpha value, while malformed alpha metadata still rejects.

The generator and Rust matrix harness bind loop evidence to the complete input, case, native source, index hash and normalized value. The Python static validator rejects a valid witness substituted from a different file. Existing row statuses and deferred Rust capability contracts remain unchanged pending the final behavioral campaign. All 16 strict native/WASM compile configurations, warnings-as-errors rustdoc and static provenance checks pass. The guard inventory remains 540 across 89 files. No current-source coverage claim is made.

The later 2026-09-17 display-retention candidate replaces the per-sample vector of shown completions with one selected completion. Online maximum selection preserves temporal-unit/spatial/temporal precedence and latest-tie behavior. Losing candidates still commit their reference/CDF/current-ID state. A hidden sample cannot reuse an earlier display as its current presentation. Failed flushes preserve the last completed-frame commit, not a whole-sample rollback.

Two deferred internal ownership regressions use Weak references to check immediate release of losing/superseded surfaces and survival of independently referenced surfaces. They also cover selection axes, exact ties, a winning missing-surface gap, hidden-unit filtering, pending frames and counter overflow. Existing complete native animation/high-depth/frame-ID witnesses retain pixel authority. No input acceptance boundary or oracle output is changed. Rust behavior and managed coverage remain deferred; aggregate memory limits and peak-allocation measurements remain unfinished. All 12 strict native/WASM, AVIF-only/all-feature, ordinary/coverage compile configurations pass, along with rustdoc, formatting and static provenance gates. The coverage-origin inventory records 147 exact guards across 24 Rust files.

TIFF FillOrder rational field parity — 2026-10-13

The TIFF decode matrix now includes complete-file Pillow cases for SHORT, LONG, BYTE and RATIONAL tag 266 values. The RATIONAL cases cover valid 1/1 and 2/1 values, first-value behavior with a later 0/0 value, zero-count defaulting, zero denominators, fractional values, and unsupported 3/1. BYTE(2) and invalid rational values match Pillow's open-time rejection. These are public input parity cases; no target-only fault contract was added, and the 27 typed fault contracts remain separately reported.

The focused TIFF run selected 14 matrix rows, including the default FillOrder-absent miniswhite row, all seven new FillOrder rows, and the existing strip and tiled cases. It passed (1 passed; 0 failed; 56 filtered out). Formatting and strict all-target/all-feature Clippy also pass. The focused Coverage MCP report is .coverage-mcp/local-evidence/20261013/tiff-fillorder2/focused.json; coverage_gaps reports no missing branch outcomes in validate_fill_order and summarizes the selected report as 201/31,308 branch observations. Coverage MCP marks source identity unverified and test attribution unknown. Its incremental comparison with .coverage-mcp/local-evidence/20261013/main-full-baseline/coverage.json is incomparable because the reports' branch details do not match their totals, so this focused run does not establish a suite-wide gain or regression. The last full baseline remains 89,277/135,839 lines, 17,418/31,268 branches, 4,992/8,690 functions and 136,575/210,976 regions; no full coverage campaign was run for this change.

AV1 film-grain output allocation fault contract — 2026-10-13

The target-only row fault-contract:avif:avif_film_grain_output_reservation_failure uses the active Pillow parity input decode:avif:portable_lossless_filmgrain_i444_64x64 as deterministic stimulus. A coverage-only reservation-size override reaches the real Vec::try_reserve_exact error path; the public result is ImageError::Dimensions for AVIF at StillDecode, and a clean retry must match a fresh uninjected decode. The row is recorded with oracle_status: not_applicable, separate from Pillow parity. In normal builds the fault hook is absent and the reserve path has no additional branch; the behavior change classifies allocation failure as a dimensions/resource error instead of malformed input.

The focused target-only run selected and passed this one contract. Coverage MCP reports no remaining region at apply_plane line 1059; the historical full report showed two unobserved regions in the prior allocation-error mapping at line 1048. Its incremental comparison is incomparable because the historical baseline detail differs from its totals. Both reports are source-unverified with test attribution unknown, so this is focused coverage evidence rather than a quantified suite-wide gain. No full coverage campaign was run.

The adjacent target-only row fault-contract:avif:avif_film_grain_points_reservation_failure injects a failure into AV1 film-grain point-array reservation while parsing the same active Pillow parity fixture. It expects the decoder's existing structured ImageError::Malformed result at StillDecode, then verifies that an uninjected retry matches a fresh decode. The fault row is marked oracle_status: not_applicable; it is not Pillow parity. Coverage MCP's saved full report marks the error arm of the increasing-point validation in read_points as unobserved. The reservation fault returns before that check, and the focused selected report still shows that arm as unobserved, so this row does not claim to close that branch gap. The incremental comparison with the full report is incomparable because baseline branch details differ from its totals. Both reports lack source receipts and have unknown test attribution; the focused run verifies this fault contract only. No full coverage campaign was run for this row.

AVIF stts timing fallbacks — 2026-10-13

Six active parity rows mutate the pinned animated.avif source: the original zero-sample_delta case plus empty, zero-count, under-filled, over-filled, and wrapped-count timing tables. The deterministic writer pins each output hash and preserves all media payload bytes. The four incomplete-table mutations keep the complete file length; the empty table is a size-16 stts box followed by an 8-byte free sibling. The wrapped-count case inserts an additional run, updates enclosing sizes and stco/iloc offsets, and grows the input from 1,235 to 1,243 bytes. Pillow 12.2.0 returns five 150×150 RGB frames with unchanged pixels for every mutation. The zero-delta case has five zero-ms durations, the four incomplete-table cases have five 33-ms durations, and the wrapped-count case has durations 33, 67, 67, 67, and 67 ms. Pinned libavif 1.4.1 parses each file and decodes all five frames.

The Rust sequence decoder now mirrors libavif's uint32_t timing-run accumulation, final-run fallback, and one-tick empty-table default while preserving zero deltas. The wrapped-count row reaches the defined u32 sum wrap on all Rust targets. The decoder still checks conversion of Rust sample indices and downstream timing arithmetic. These are public Pillow parity cases, not target-only fault contracts.

The five new incomplete- and wrapped-table rows passed one focused public decode-matrix run (5/5 selected rows; one integration test, 56 filtered). Its Coverage MCP report is .coverage-mcp/local-evidence/20261013/avif-stts-incomplete/current-selected.json, SHA-256 9b27edbd93dacf007c9d6cb7492d56078c558b9bf40382f02feeca38cb9bc50c. The selected report records 3,297/31,302 branches and 20,014/135,914 lines; Coverage MCP found no missing branch observations at samples.rs:2503 for this selection. MCP marks the report source unverified and test attribution unknown. The earlier split-run reports remain in the same local directory; their comparison with the saved full baseline is incomparable because baseline branch detail differs from its reported totals. No suite-wide coverage gain or regression is claimed. No full coverage campaign was run. Exact commands, local test output, report digests, and oracle identities are in .coverage-mcp/local-evidence/20261013/avif-stts-incomplete/receipt.md.

AVIF metadata reservation faults and iinf entry-count parity — 2026-10-13

Two target-only contracts now exercise AVIF metadata-table reservations for iinf items and iloc locations. The coverage-only fault hooks force the real Vec::try_reserve capacity-error path; normal builds contain no injection branch. Each selected fault row returns a structured AVIF ImageError::Dimensions at StillDecode, and a clean retry matches a fresh decode. These rows use oracle_status: not_applicable and stay outside Pillow parity.

The public parity row error_iinf_entry_count_exceeds_children changes only the v0 iinf.entry_count in baseline.avif from one to two while retaining the single valid infe child. Its fixture SHA-256 is 651cb3bd4e3d0f6202d1b9caddd11470f518d05c978e5d38cc5d66423a60dde8. Pillow 12.2.0 detects the AVIF signature, then reports PIL.UnidentifiedImageError: cannot identify image file <bytes> for inspection, verification, decode, and sequence decode. It reaches the normal missing-child parse error and is not a target-only fault case.

The complementary public row error_iinf_entry_count_zero_with_child changes that count from one to zero while retaining the same child. Its full-file fixture SHA-256 is 951efe4031639fc3cda52ba994de66b93b028892cae96e4e0efb2f83d79677ef. The pinned Pillow 12.2.0 reference generator classifies inspection, verification, decode, and sequence decode as malformed builtins.RuntimeError: Failed to decode image: Missing or empty image item. The single-row coverage run passed 1/1. Coverage MCP's selected report .coverage-mcp/local-evidence/20261013/avif-iinf-zero-count/coverage.json (SHA-256 45c831e568a85c30b2895f0ad7343d523bafe0b7138f7ac78b73f59f876c0bf8) lists the false arm as missing at src/codecs/avif/samples.rs:599; the trailing-child true arm is observed in this selection. The test command ran from source revision 43a94a55ea39cb53115749a60ebef757ea6e3b48 with the generated manifest and references. The report has no build ID or recorded revision, and MCP labels source identity unverified and test attribution unknown. Incremental comparisons with the selected iinf report and saved full baseline are incomparable because their exact branch detail is incomplete; no aggregate coverage gain is claimed.

For the count-exceeds selection, the focused public run passed 1/1 row and Coverage MCP returned no missing branch location at src/codecs/avif/samples.rs:589; that path is distinct from the trailing-child branch measured by the zero-count selection above. The selected fault run passed the baseline plus both contracts (3/3 rows), with no missing branch observations at the iinf reservation hook (samples.rs:576) or the exercised parse_iloc::<true> hook (samples.rs:1095). Both reports are selected-only; MCP labels source identity unverified and test attribution unknown. The full baseline comparison is incomparable because its exact branch detail is incomplete, so no aggregate gain or regression is claimed. No full coverage campaign ran. Reports and receipts are in .coverage-mcp/local-evidence/20261013/avif-iinf-parity/ and .coverage-mcp/local-evidence/20261013/avif-metadata-fault-contracts-selected/.

make fmt and make verify pass; strict all-feature Clippy passed with RUSTC_WRAPPER= after the default sccache wrapper was denied by the local sandbox. The broad asset command .oracle-venv/bin/python scripts/generate_test_assets.py --format avif still stops at its existing pinned ICC fixture-hash check before reaching the new generator block. The new fixture bytes were produced from the pinned baseline with the single-field mutation and verified against the recorded digest.

Diagnostic provenance

The separate defensive-model contract has 61 diagnostic cases: 38 use committed bytes that also have a Pillow parity row; 23 cases construct runtime mutations. Diagnostic identities and messages remain Rust model observations, not Pillow parity fields. The provenance verifier checks the original input hashes and supporting baseline route for every case.

Contract catalog: behavior Pillow cannot prove

This is the separate Rust-only list. “Cannot prove” means Pillow may have a similar idea internally, but it cannot return this crate's exact field, token, target, sink, or typed result for comparison.

The bounded v1 map is machine-checked by make verify against tests/fixtures/unreachable_contract_manifest.json. covered means that the manifest names an existing fixture-backed integration contract or fixture verifier; planned means that no such contract is claimed yet. The map is an evidence index, not a claim that every legal format state is implemented.

The verifier also parses this ten-row table. It requires each row's status and Pillow-parity column to match the manifest, every covered row to name the exact manifest evidence paths, the release-package row to name its exact fixture verifier, and the planned allocation/stack/coverage row to say that no category-specific evidence is claimed while naming its bounded context paths. This is documentation-integrity evidence only: it does not promote the planned category to covered and does not add any Rust-only result to Pillow parity.

The separate fault_contract_cases index maps target-only injected failures and defensive parser branches to their structured-diagnostics requirement and shared matrix selector. The AVIF, BMP, JPEG, and TIFF fault cases reuse active Pillow parity inputs as reproducible stimulus, while each injected result is recorded with verification: fault-contract and oracle_status: not_applicable. The new AVIF monochrome alpha case shortens one sample only under cfg(coverage), expects NotImplemented at StillDecode, and compares a clean retry with a fresh decode. It is target-only diagnostic evidence, not Pillow parity. The runner reports this lane separately from Pillow decode/encode counts. The TIFF ignored-sample contracts exercise zero row bytes and a short assembled buffer. The TIFF YCbCr contracts also exercise zero horizontal and vertical subsampling after valid-layout selection, then verify a clean Pillow-parity retry. The YCbCr cases force clump-length failures in the 1-by-2, 2-by-2, and general converters, full-resolution sample-length failures, and RGB-output reservation failures in the 1-by-2, 2-by-2, and general converters. They assert the expected typed decode error followed by a successful retry against the same Pillow-backed input.

Map ID	Rust-only contract	Why Pillow cannot prove it	v1 status	Separate evidence	Pillow parity
decode-encode-policy-limits	DecodePolicy and EncodePolicy limits	Pillow does not expose this crate's pre-detection, canvas, metadata, decoded-byte, encoded-output, or work-budget result with the same boundary/error fields	covered	Manifest evidence: tests/decode_policy_tests.rs, tests/feature_gate_tests.rs	excluded
cancellation-work-budgets	Cancellation and work budgets	Pillow has no caller-owned CancellationToken, checkpoint budget, or EncodeWorkUnits result	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
output-sink-delivery	OutputSink delivery	Pillow does not accept this crate's dependency-free sink, expose delivered prefixes, flush failures, or rollback semantics	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
caller-owned-destination-buffers	Caller-owned destination buffers	Pillow does not expose decode_into capacity, short-destination rejection, or no-partial-write guarantees	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
source-provenance	Source provenance	SourceDescriptor, FileTypeBox facts, AVIF item/property identity, raw source relationships, and declared-versus-confirmed fields are not Pillow result fields	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
structured-diagnostics	Structured diagnostics	Rust diagnostic kind, offset, consumed extent, recovery status, and provenance are not Pillow's ordinary return shape	covered	Manifest evidence: tests/feature_gate_tests.rs, scripts/verify_diagnostic_provenance.py; target-only fault cases: fault-contract:avif:avif_segment_map_reservation_failure, fault-contract:avif:avif_10bit_i444_alpha_plane_length_mismatch, fault-contract:avif:avif_12bit_i444_generic_alpha_plane_length_mismatch, fault-contract:avif:avif_10bit_i444_alpha_invalid_sample, fault-contract:avif:avif_10bit_i444_alpha_output_reservation_failure, fault-contract:avif:avif_12bit_i444_generic_rgb_output_reservation_failure, fault-contract:avif:avif_subsampled_rgb_output_reservation_failure, fault-contract:avif:avif_12bit_i420_alpha_sample_count_mismatch, fault-contract:avif:avif_12bit_i420_alpha_zero_width, fault-contract:avif:avif_12bit_i420_alpha_nondivisible_luma_length, fault-contract:avif:avif_12bit_i420_alpha_zero_height, fault-contract:avif:avif_12bit_i420_alpha_u_plane_length_mismatch, fault-contract:avif:avif_12bit_i420_alpha_v_plane_length_mismatch, fault-contract:avif:avif_portable_y_plane_length_mismatch, fault-contract:avif:avif_portable_u_plane_length_mismatch, fault-contract:avif:avif_portable_v_plane_length_mismatch, fault-contract:avif:avif_portable_alpha_plane_length_mismatch, fault-contract:avif:avif_subsampled_identity_conversion_rejected, fault-contract:avif:av1_inter_translation_sample_depth_mismatch, fault-contract:avif:av1_motion_predictor_zero_width_rejected, fault-contract:avif:av1_motion_reference_mv_geometry_guard_sweep_rejected, fault-contract:avif:av1_difference_mask_first_plane_length_mismatch, fault-contract:avif:av1_difference_mask_second_plane_length_mismatch, fault-contract:avif:av1_difference_mask_output_plane_length_mismatch, fault-contract:avif:av1_difference_mask_scratch_length_mismatch, fault-contract:avif:av1_wedge_mask_fill_empty_width, fault-contract:avif:av1_wedge_mask_fill_empty_height, fault-contract:avif:av1_wedge_mask_fill_scratch_length_mismatch, fault-contract:avif:av1_inter_intra_mask_invalid_mode, fault-contract:avif:av1_inter_intra_mask_empty_width, fault-contract:avif:av1_inter_intra_mask_empty_height, fault-contract:avif:av1_inter_intra_mask_scratch_length_mismatch, fault-contract:avif:av1_inter_intra_mask_non_normative_width, fault-contract:avif:av1_inter_intra_mask_non_normative_height, fault-contract:avif:av1_wedge_mask_reduce_empty_width, fault-contract:avif:av1_wedge_mask_reduce_empty_height, fault-contract:avif:av1_wedge_mask_reduce_scratch_length_mismatch, fault-contract:avif:avif_12bit_i444_generic_u_plane_length_mismatch, fault-contract:avif:avif_12bit_i444_generic_v_plane_length_mismatch, fault-contract:avif:avif_12bit_i444_generic_invalid_sample, fault-contract:avif:avif_10bit_i444_u_plane_length_mismatch, fault-contract:avif:avif_10bit_i444_v_plane_length_mismatch, fault-contract:avif:avif_display_plane_copy_allocation_failure, fault-contract:avif:avif_display_plane_copy_sequence_allocation_failure, fault-contract:avif:avif_film_grain_output_reservation_failure, fault-contract:avif:avif_film_grain_points_reservation_failure, fault-contract:avif:avif_temporal_motion_field_reservation_failure, fault-contract:avif:avif_sequence_frames_reservation_failure, fault-contract:avif:avif_sequence_frame_count_declaration_mismatch, fault-contract:avif:avif_sequence_mode_declaration_mismatch, fault-contract:avif:avif_superresolution_positions_reservation_failure, fault-contract:avif:avif_superresolution_plane_reservation_failure, fault-contract:avif:avif_superresolution_header_geometry_mismatch, fault-contract:avif:avif_superresolution_chroma_u_plane_reservation_failure, fault-contract:avif:avif_superresolution_chroma_v_plane_reservation_failure, fault-contract:avif:avif_sgr_restoration_output_reservation_failure, fault-contract:avif:avif_sgr_intermediate_reservation_failure, fault-contract:avif:avif_restoration_stripe_scratch_reservation_failure, fault-contract:avif:avif_restoration_stripe_output_reservation_failure, fault-contract:jpeg:jpeg_multiscan_coefficient_reservation_failure, fault-contract:jpeg:jpeg_huffman_table_slot_reservation_failure, fault-contract:jpeg:jpeg_ycck_output_reservation_failure, fault-contract:jpeg:jpeg_ycck_component_plane_count_mismatch, fault-contract:jpeg:jpeg_ycck_component_height_missing, fault-contract:jpeg:jpeg_fast_reader_marker_prefix_eof_fallback, fault-contract:jpeg:jpeg_fast_reader_scan_count_mismatch_fallback, fault-contract:jpeg:jpeg_fast_reader_entropy_start_mismatch_fallback, fault-contract:jpeg:jpeg_fast_reader_entropy_end_after_eoi_fallback, fault-contract:jpeg:jpeg_fast_reader_eoi_marker_mismatch_fallback, fault-contract:jpeg:jpeg_fast_reader_trailing_marker_position_mismatch_fallback, fault-contract:jpeg:jpeg_h1v2_upsample_plane_reservation_failure, fault-contract:jpeg:jpeg_h1v2_upsample_empty_geometry_rejection, fault-contract:jpeg:jpeg_h1v2_upsample_source_length_mismatch, fault-contract:jpeg:jpeg_h1v2_upsample_zero_width_rejection, fault-contract:jpeg:jpeg_fancy_upsample_row_invalid_geometry, fault-contract:jpeg:jpeg_fancy_upsample_row_zero_height_rejection, fault-contract:jpeg:jpeg_fancy_upsample_row_zero_horizontal_ratio_rejection, fault-contract:jpeg:jpeg_fancy_upsample_row_zero_vertical_ratio_rejection, fault-contract:jpeg:jpeg_fancy_upsample_row_short_stride, fault-contract:jpeg:jpeg_row_upsample_source_length_mismatch, fault-contract:jpeg:jpeg_fancy_upsample_row_destination_y_out_of_bounds, fault-contract:jpeg:jpeg_fancy_upsample_row_last_row_start_overflow, fault-contract:jpeg:jpeg_fancy_upsample_row_required_source_length_overflow, fault-contract:jpeg:jpeg_fancy_upsample_row_destination_height_overflow, fault-contract:avif:avif_monochrome_tile_reservation_failure, fault-contract:avif:avif_monochrome_group_buffer_reservation_failure, fault-contract:avif:avif_color_tile_reservation_failure, fault-contract:avif:avif_tile_cell_reservation_failure, fault-contract:avif:avif_tile_block_metadata_reservation_failure, fault-contract:avif:avif_partition_node_reservation_failure, fault-contract:avif:avif_partition_context_above_reservation_failure, fault-contract:avif:avif_chroma_tile_cell_reservation_failure, fault-contract:avif:avif_assembled_loop_filter_metadata_reservation_failure, fault-contract:avif:avif_projected_temporal_field_reservation_failure, fault-contract:avif:avif_grid_cell_reservation_failure, fault-contract:avif:avif_monochrome_grid_cell_reservation_failure, fault-contract:avif:avif_monochrome_loop_filter_metadata_reservation_failure, fault-contract:avif:avif_monochrome_cdef_region_map_reservation_failure, fault-contract:avif:avif_monochrome_cdef_active_map_reservation_failure, fault-contract:avif:avif_monochrome_cdef_invalid_sample_depth_rejected, fault-contract:avif:avif_monochrome_cdef_direction_invalid_sample_depth_rejected, fault-contract:avif:avif_monochrome_cdef_input_guard_sweep_rejected, fault-contract:avif:avif_color_cdef_active_map_extent_mismatch_rejected, fault-contract:avif:avif_color_cdef_active_strength_index_out_of_range_rejected, fault-contract:avif:avif_color_cdef_invalid_y_strength_count_rejected, fault-contract:avif:avif_color_cdef_invalid_uv_strength_count_rejected, fault-contract:avif:avif_retained_temporal_sample_reservation_failure, fault-contract:avif:avif_tile_group_temporal_sample_reservation_failure, fault-contract:avif:avif_assembled_cdef_region_map_reservation_failure, fault-contract:avif:avif_tile_cdef_region_map_reservation_failure, fault-contract:avif:avif_tile_cdef_active_map_reservation_failure, fault-contract:avif:avif_assembled_cdef_active_map_reservation_failure, fault-contract:avif:avif_item_table_reservation_failure, fault-contract:avif:avif_item_table_inspection_reservation_failure, fault-contract:avif:avif_item_location_table_reservation_failure, fault-contract:avif:avif_item_location_table_inspection_reservation_failure, fault-contract:avif:avif_item_extent_span_reservation_failure, fault-contract:avif:avif_item_extent_span_inspection_reservation_failure, fault-contract:avif:avif_container_inspection_invariant_guards, fault-contract:avif:avif_duplicate_minf_inspection_contract, fault-contract:avif:avif_duplicate_stbl_inspection_contract, fault-contract:avif:avif_missing_minf_inspection_contract, fault-contract:avif:avif_missing_stbl_inspection_contract, fault-contract:avif:avif_missing_stsz_inspection_contract, fault-contract:avif:avif_missing_stsd_inspection_contract, fault-contract:avif:avif_container_meta_full_box_version_rejected, fault-contract:avif:avif_sgr_source_reservation_failure, fault-contract:avif:avif_monochrome_alpha_plane_length_mismatch, fault-contract:bmp:bmp_palette_reservation_failure, fault-contract:bmp:bmp_decoded_pixels_reservation_failure, fault-contract:bmp:bmp_rle_entry_work_budget_exceeded, fault-contract:bmp:bmp_rle_command_work_budget_exceeded, fault-contract:png:png_decoded_sample_buffer_reservation_failure, fault-contract:png:png_chunk_iterator_failure_stops_iteration, fault-contract:png:png_apng_sequence_counter_exhaustion, fault-contract:png:png_apng_inspection_sequence_counter_exhaustion, fault-contract:png:png_inspect_invalid_signature_rejected, fault-contract:tiff:tiff_lzw_zero_expected_output_rejection, fault-contract:tiff:tiff_lzw_zero_expected_output_token_rejection, fault-contract:tiff:tiff_header_registered_magic_rejection, fault-contract:tiff:tiff_strip_assembly_reservation_failure, fault-contract:tiff:tiff_unaligned_strip_assembly_reservation_failure, fault-contract:tiff:tiff_rgb16_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_general_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_general_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_full_resolution_length_mismatch, fault-contract:tiff:tiff_ycbcr_full_resolution_length_mismatch_custom_tags, fault-contract:tiff:tiff_ycbcr_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_custom_table_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_custom_table_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_rational_index_out_of_range, fault-contract:tiff:tiff_ycbcr_floating_index_out_of_range, fault-contract:tiff:tiff_directory_numeric_value_width_invalid, fault-contract:tiff:tiff_directory_numeric_value_width_remainder, fault-contract:tiff:tiff_directory_numeric_value_remainder_nonempty, fault-contract:tiff:tiff_ycbcr_custom_general_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_custom_general_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_custom_1x2_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_custom_1x2_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_1x2_clump_length_mismatch, fault-contract:tiff:tiff_ycbcr_1x2_rgb_output_reservation_failure, fault-contract:tiff:tiff_ycbcr_tile_assembly_reservation_failure, fault-contract:tiff:tiff_ycbcr_tile_prefix_limit_failure, fault-contract:tiff:tiff_ignored_sample_row_bytes_zero, fault-contract:tiff:tiff_ignored_sample_assembly_length_mismatch, fault-contract:tiff:tiff_ycbcr_horizontal_subsampling_zero, fault-contract:tiff:tiff_ycbcr_vertical_subsampling_zero, fault-contract:tiff:tiff_ycbcr_custom_horizontal_subsampling_zero, fault-contract:tiff:tiff_ycbcr_custom_vertical_subsampling_zero, fault-contract:avif:avif_monochrome_portable_subsampling_x_rejected, fault-contract:avif:avif_monochrome_portable_subsampling_y_rejected, fault-contract:avif:avif_monochrome_portable_u_plane_nonempty_rejected, fault-contract:avif:avif_monochrome_portable_v_plane_nonempty_rejected, fault-contract:avif:avif_monochrome_portable_y_plane_length_mismatch, fault-contract:avif:avif_monochrome_portable_alpha_plane_length_mismatch, fault-contract:avif:avif_monochrome_portable_y_sample_out_of_depth, fault-contract:avif:avif_monochrome_portable_alpha_sample_out_of_depth, fault-contract:avif:avif_monochrome_portable_output_length_mismatch, fault-contract:webp:webp_hash_chain_index_overflow_rejected, fault-contract:webp:webp_riff_header_too_short_rejected, fault-contract:webp:webp_riff_signature_mismatch_rejected, fault-contract:webp:webp_form_type_mismatch_rejected, fault-contract:webp:webp_riff_declared_size_mismatch_rejected, fault-contract:avif:av1_unfiltered_copy_source_x_end_overflow_falls_back, fault-contract:avif:av1_lossless_i444_first_partition_fallback_matches_parity, fault-contract:bmp:bmp_encode_height_over_signed_limit_rejected, fault-contract:bmp:bmp_direct_decoder_invalid_signature_contract, fault-contract:bmp:bmp_metadata_extent_invalid_signature_contract, fault-contract:gif:gif_sequence_decoder_invalid_signature_contract, fault-contract:gif:gif_metadata_extent_invalid_signature_contract, fault-contract:webp:webp_metadata_riff_signature_contract, fault-contract:webp:webp_metadata_webp_signature_contract, fault-contract:webp:webp_metadata_truncated_vp8x_rejected, fault-contract:webp:webp_inspect_riff_signature_contract, fault-contract:webp:webp_inspect_webp_signature_contract, fault-contract:bmp:bmp_inspect_invalid_signature_rejected, fault-contract:ico:ico_reserved_header_nonzero_rejected, fault-contract:ico:ico_unsupported_header_type_rejected, fault-contract:ico:ico_inspect_reserved_header_nonzero_rejected, fault-contract:ico:ico_inspect_unsupported_header_type_rejected, fault-contract:jpeg:jpeg_inspect_invalid_signature_rejected, fault-contract:jpeg:jpeg_ycck_component_stride_too_short, fault-contract:jpeg:jpeg_ycck_component_height_too_short, fault-contract:jpeg:jpeg_ycck_component_plane_samples_too_short, fault-contract:jpeg:jpeg_ycck_component_stride_overflow, fault-contract:avif:avif_sequence_mode_declaration_mismatch_alpha	excluded
feature-target-capability	Feature and target capability	Pillow does not model this crate's Cargo feature-disabled errors or native versus wasm32-wasip1 capability table	covered	Manifest evidence: tests/feature_gate_tests.rs, tests/capability_table.rs	excluded
cache-concurrency-api-lifecycle	Cache/concurrency/API lifecycle	Pillow does not expose EncodedImage lazy-cache states, Rust clone sharing, bounded native concurrent verification, or this crate's frame/page lifecycle	covered	Manifest evidence: tests/feature_gate_tests.rs	excluded
release-package-surface	Release package surface	Pillow cannot inspect this crate's Cargo archive, included source/legal files, or deliberate exclusion of parity fixtures and repository-only integration targets	covered	Manifest evidence: tests/fixtures/package_surface_manifest.json, scripts/verify_package_surface.py	excluded
allocation-stack-coverage-models	Allocation/stack/coverage models	Pillow cannot witness Rust allocator checkpoints, stack measurements, or private defensive branches	planned	No category-specific evidence is claimed. Planned context: scripts/benchmark_fixture_workloads.py, scripts/verify_coverage_origins.py, tests/fixtures/coverage_origin_manifest.json	excluded

Rust-only results do not belong in Pillow parity rows. The shared matrix has a separate fault_contracts lane for deterministic target-internal failures and defensive parser branches that public API routing cannot exercise. Each such row is typed as fault-contract, uses oracle_status: not_applicable, and shares the matrix selector and case-index machinery without contributing to parity counts. Its input may be an existing Pillow parity fixture; that keeps the stimulus reproducible but does not turn the target-only result into Pillow parity. The PNG signature inspection contract decodes the 1×1 Pillow fixture, flips one signature bit on a copy under cfg(coverage), then calls the codec inspector directly and checks its structured malformed result. Public format detection rejects that copied input before dispatch, so the defensive check cannot be exercised by the public parity row.

AVIF monochrome group-buffer allocation fault contract — 2026-10-15

fault-contract:avif:avif_monochrome_group_buffer_reservation_failure reuses the active decode:avif:multitile_monochrome Pillow parity input. The fixture reaches the per-tile-group complete-monochrome buffer reservation, while the coverage-only fault point forces its fallible reserve to report a structured Dimensions error. The public fault-contract runner checks the AVIF format, still-decode stage, exact diagnostic, and a successful retry matching a fresh decode. The injected fault remains separate from Pillow parity and compiles out of normal library builds.

The targeted parity and fault-contract runs passed 1/1 each. Coverage MCP's LCOV incremental comparison found 52 newly observed lines overall, including five in src/codecs/avif/av1/frame.rs at lines 3076 and 3085–3088 (0.0396 percentage points against the selected baseline). This is a limited coordinate estimate: the local reports have no source/build receipts or test receipts. Coverage MCP could not provide the branch-level delta because these reports do not contain exact branch observations. No full coverage campaign was run. Reports: target/release-evidence/coverage-avif-monochrome-group-baseline-current.info, target/release-evidence/coverage-avif-monochrome-group-fault-current.info. The coverage-origin inventory now records 149 exact guards across 25 Rust files; this is a static provenance count, not a new full-coverage measurement.

BMP RLE4 edge parity and palette-reservation fault contract — 2026-10-15

Two active Pillow parity rows cover BI_RLE4 odd-length absolute runs: one ends at end-of-line with the omitted low nibble, and the other places the pixel stream at an odd file offset to exercise word padding. Their input SHA-256 values are e126b4422eb23399b411090b0a9928b7f4f46467ea6847fbd9c0da522b6a33fb and 39a7b1fbc8d09716958cd9ad55f72fb477e69c40d20afceabb357807d39fff03. Both selected public rows pass the pinned Pillow pixel parity. The BMP fixture generator reproduces their inputs and reference provenance.

The target-only row fault-contract:bmp:bmp_palette_reservation_failure reuses the first fixture. Its coverage-only failpoint forces the palette's fallible reservation to fail before palette entries are read. The public contract checks the BMP StillDecode error decode: unable to allocate BMP palette and confirms that a clean retry equals a fresh decode. The selected fault row passed 1/1; the normal allocation path compiles without the fault hook. Coverage MCP found no missing branch observation at src/codecs/bmp/decode.rs:173, but its selected reports have no source/build receipts or test attribution, and branch-level incremental comparison is incomparable because exact detail is incomplete. No aggregate coverage gain or full-coverage result is claimed. Selected reports: target/release-evidence/coverage-bmp-rle4-odd-eol-current.json, target/release-evidence/coverage-bmp-rle4-odd-offset-current.json, and target/release-evidence/coverage-bmp-palette-fault-current.json.

JPEG SOS frame-order parity and fast-path predicates — 2026-10-15

The public parity row decode:jpeg:baseline_420_reversed_chroma_sos_order uses a pinned baseline 4:2:0 input (baseline_420.jpg, SHA-256 c669c42fcf388430afd4400bbdcbc66f30165d50e4b162ed77e1f67392cce4ef) with only the SOS component records changed. The candidate hash is d2c2d756ed55c4cf7b6af6ee4a614edd53b261d72d3b1c4beadcf784c20bd26d. Pillow 12.2.0 opens and structurally verifies the input, then reports a broken data stream when pixels are loaded. Rust now preserves marker-only inspection and verification while returning a malformed decode error for the invalid frame-order scan.

The current fixture matrix contains 2,243 total rows: 1,762 decode / inspect / verify rows and 481 encode rows. Of those, 1,762 decode rows and 449 encode rows are active.

The selected control, malformed case, and multi-scan control passed 3/3; the complete JPEG decode matrix passed 252/252. After the final CMYK direct-index simplification, the CMYK control and partial-block cases passed 2/2. Coverage MCP reports no missing branch observations in validate_scan_component_order or the 4:2:0 direct reconstruction helper for the complete JPEG workload. Its local report has no source/build or test receipts, and comparison with the historical full-suite baseline is incomparable because exact detail does not match. This evidence does not claim an aggregate coverage gain or a full-suite coverage result.

Pillow-tolerated iTXt without a keyword separator — 2026-10-16

The input-only row decode:png:pillow_tolerated_malformed_itxt_missing_keyword_separator uses a complete 1×1 RGB PNG with a valid-CRC iTXt chunk whose payload contains no NUL byte. Its reproducible generator pins the fixture SHA-256 to ef5663b10dd1bef8481a1f73bee3283038fc41a3bd928cd0ba7945654efb98cd. Pillow 12.2.0 opens and verifies the file, loads the same three RGB bytes as the base image, and omits the malformed metadata. The selected public parity row passed 1/1 across detection, inspection, verification, decode, and sequence decode. The fixture is an ordinary malformed-input case, not a target-only fault contract; runtime code is unchanged.

Coverage MCP's focused report records 2,315/211,155 observed regions for the selected test process and still reports a missing observation at src/codecs/png/decode.rs:119 in invalid_compressed_metadata_identity. The incremental comparison with the earlier PNG matrix report is incomparable because the selected report contains observations outside the baseline inventory. Both local reports lack source/build receipts and test attribution. No aggregate coverage gain or full-suite result is claimed, and no full coverage campaign was run. The selected report is target/release-evidence/coverage-png-itxt-missing-keyword-separator-selected.json.

The same gap review identified redundant fast-path predicates. Component order is checked once at decode materialization; per-component sampling records determine their maxima, and the reconstruction table vector is built once per frame component. The 4:2:0, 4:2:2, 4:4:4, grayscale, and CMYK direct paths now avoid rechecking those derived facts. CMYK also uses the validated frame order directly instead of rebuilding a scan-order map. The new JPEG input remains ordinary Pillow parity evidence; it is not a target-only fault contract. Reports: target/release-evidence/coverage-jpeg-direct-safe-cleanup-current.json and target/release-evidence/coverage-jpeg-cmyk-order-regression-current.json.

JPEG active chroma AC Huffman table parity — 2026-10-16

The public row decode:jpeg:baseline_444_custom_ac_chroma_values changes two unused codeword symbols in AC DHT table 1, which the first scan selects for both chroma components. The generated input is pinned to SHA-256 157f83e6e9a3f0d41dde66adf35dc156d1efaa1acfd77c64a83c782214059799; Pillow 12.2.0 returns the baseline 128x128 RGB pixels with SHA-256 2288f8f3cb6dafaa523538760165f2a4634b9a269e03175b8fbc284158dbb94a. This is valid-input public parity, not a target-only fault contract. The selected matrix test passed 1/1.

Coverage MCP's selected-row comparison with the subsampling_444 control observed two additional false-arm coordinates in standard_huff_table (huffman.rs:95) and standard_ac_general_pair_table (huffman.rs:428). The focused report is target/release-evidence/coverage-jpeg-active-ac-chroma.json; the control is target/release-evidence/coverage-jpeg-baseline444-control.json. The reports lack source/build receipts and test attribution, so this is limited coordinate evidence. Comparison with the saved full baseline is incomparable because its branch inventory differs (31,268 versus 31,276 outcomes). No aggregate coverage gain or full-suite result is claimed, and no full coverage campaign was run.

Pillow-tolerated zTXt without a keyword separator — 2026-10-16

The input-only row decode:png:pillow_tolerated_malformed_ztxt_missing_keyword_separator uses a complete 1×1 RGB PNG with a valid-CRC zTXt chunk whose payload contains no NUL byte. The compressed text is valid, but the PNG text keyword separator is absent. Pinned Pillow 12.2.0 opens and verifies the file, then loads the same three RGB bytes as the unmodified input. The selected public parity row passes 1/1 across detection, inspection, verification, decode, and sequence decode. The decoder already preserves this tolerated input; this change adds an independent malformed-metadata parity witness without altering runtime code.

Coverage MCP's branch comparison with the earlier PNG matrix report is incomparable because the exact branch detail differs. A focused incremental comparison against the earlier full PNG matrix report is incomparable because the selected report contains observations outside that baseline inventory. Comparing the selected row with the invalid-compression control reports no new region observations and 17 control observations absent from the selected report; source/build identity is unverified, so those differences cannot establish a coverage gain or regression. The selected report still shows unobserved PNG regions, including in invalid_compressed_metadata_identity; no full-suite coverage campaign was run. Reports: target/release-evidence/coverage-png-ztxt-invalid-compression-control-final.json and target/release-evidence/coverage-png-ztxt-missing-separator-final.json.

Odd-width 1-bit PNG encode parity — 2026-10-16

The public row encode:png:enc_1bit_odd_width uses a complete 9×3 mode-1 PNG saved by pinned Pillow 12.2.0. Its source SHA-256 is ab470446e941a51011e157e861e3f920b911686d3e592e1b7cb1d6a683bdd675; Pillow decodes pixels 5980a6000080 with SHA-256 36e3c5d288415910fd696272299e53b64a80b66782e965c506b57e7dd2d8d203. The rows exercise unused packed tail bits while setting the ninth pixel to both zero and one. The exact 74-byte encoded reference is byte-identical to Pillow's output. The selected manifest parity test passed 1/1. Its fixture generator checks the pinned PNG without importing Pillow; the optional --verify-pillow path checks the pinned save and pixel roundtrip.

The selected branch report records 230/31,276 observations and reaches the 1-bit row packing plus non-palette encoder paths at encode.rs:70 and :107/:429. Coverage MCP's selected-test comparison reports 28 newly observed branch coordinates, including the false arms at lines 107 and 429. This is limited coordinate evidence: source/build receipts and test attribution are unavailable. The saved PNG baseline is 559/31,314 branches; its exact detail differs from the selected report, so the incremental union is incomparable. No aggregate coverage gain, full-suite result, or full coverage campaign is claimed. The selected report is target/release-evidence/coverage-png-1bit-odd-width-final.json.

PNG decoded-sample reservation fault contract — 2026-10-16

fault-contract:png:png_decoded_sample_buffer_reservation_failure reuses the active decode:png:size_1x1 Pillow input. decode_scanlines now reserves the checked sample count fallibly, then initializes the buffer; a reservation failure returns a structured PNG Dimensions error at StillDecode. The one-shot png.scanline.sample_buffer_reservation injection exists only in coverage builds. The shared runner verifies the error and confirms that retry produces the same decoded image as a fresh decode. The ordinary parity row and the selected fault row each passed 1/1; the injected result remains in the oracle_status: not_applicable lane.

The ordinary-row baseline and fault-row reports were collected separately from the same checkout. Coverage MCP reports 163/31,278 observed branch outcomes for the selected ordinary row and 91/31,278 for the selected fault row. Its incremental comparison is incomparable because exact baseline detail is incomplete; both reports also lack source/build receipts and test attribution. A focused gap query still identifies unobserved decode_scanlines branches at decode.rs:1583 and decode.rs:1605; the selected 1×1 case does not cover the Adam7 path. No aggregate coverage gain or full-suite coverage result is claimed, and no full coverage campaign was run. Reports: target/release-evidence/coverage-png-sample-buffer-baseline.json and target/release-evidence/coverage-png-sample-buffer-reservation.json.

BMP RLE8 delta crossing the row boundary — 2026-10-16

compression_rle8_rle8_delta_row_boundary adds an input-only Pillow parity case based on the existing 4×2 RLE8 fixture. Its compressed payload contains a delta (dx=5, dy=0), end-of-line, a four-pixel run, and end-of-bitmap; the complete file declares its 1,088-byte size and 10-byte compressed payload. The pinned Pillow 12.2.0 oracle opens and verifies it as a 4×2 palette image and decodes eight zero indices. The selected matrix test passed 1/1. The active matrix now contains 2,243 rows: 1,762 decode and 481 encode rows.

The selected branch report is target/release-evidence/coverage-bmp-rle8-delta-boundary.json. Coverage MCP reports 115/31,278 branch outcomes observed and groups 16 missing branches in decode_rle. Its incremental comparison against .coverage-mcp/local-evidence/20261014/github-ci-613ac4e0/coverage.json is incomparable: both reports are source-unverified, test attribution is unknown, and the baseline branch detail is incomplete. No aggregate coverage gain is claimed; no full coverage campaign was run.

TIFF normal-order byte-aligned 2-bit tile parity — 2026-10-16

The active row decode:tiff:tiled_gray2_byte_aligned_edge adds a normal-order companion to the existing FillOrder=2 tiled 2-bit grayscale case. The pinned input tiled_gray2_byte_aligned_edge.tiff has SHA-256 f3fcb7652e0eda354ec21bee46fbfedbc4c0a47476d5ae9d5147ca382c3cbce7. Pinned Pillow 12.2.0 decodes it as a 16×1 L8 image; its 16-byte pixel reference has SHA-256 d6591e2f9c5c4f4156323d28bb19ac453d1ac5f4d0ede89805b7ce5316e6fc2e. The existing scripts/generate_test_assets.py generator builds it with write_low_depth_tiled_tiff as two 8×1 tiles and checks equal Pillow pixels against the FillOrder=2 counterpart. The input-only parity row passed 1/1 across its selected matrix operations; Rust implementation code is unchanged.

The current fixture matrix contains 2,244 total rows: 1,763 decode / inspect / verify rows and 481 encode rows. Of those, 1,763 decode rows and 449 encode rows are active.

The selected branch report is target/release-evidence/coverage-tiff-gray2-byte-aligned.json and records 156/31,278 observed branch outcomes. At decode.rs:1339, Coverage MCP reports the tail_bits != 0 arm as unobserved for copy_packed_tile_row::<false>, so the byte-aligned false arm is present in this selected report. Both arms of the <true> specialization remain unobserved under this selection. Comparison with the saved local baseline is incomparable because branch detail is incomplete; the reports also lack source/build receipts and test attribution. No aggregate coverage gain or full-suite coverage result is claimed, and no full coverage campaign was run.

AVIF iinf wrong-child-kind parity — 2026-10-16

The active row decode:avif:error_iinf_child_not_infe adds a complete-file malformed-input case for the parse_iinf child-kind rejection. The deterministic generator scripts/generate_avif_iinf_child_kind_fixture.py checks the pinned 3,077-byte baseline.avif source (d4327b7ab11ed8f11d86978258fc04e5505bcfe511ca2c4efa4838c85d226fd2), verifies the sole version-zero iinf entry is an infe box, and changes only its type to free. The output hash is ee95c49866ddcf2bf1fd4f2f3a0e4c1d2c768bb5ccbf8f675555691298225d76. Pinned Pillow 12.2.0/libavif 1.4.1 rejects the complete input as PIL.UnidentifiedImageError: cannot identify image file <bytes>; the public matrix records successful format detection and that normalized error for inspection, verification, decode, and sequence decode.

The current fixture matrix contains 2,245 total rows: 1,764 decode / inspect / verify rows and 481 encode rows. Of those, 1,764 decode rows and 449 encode rows are active.

The selected parity test passed 1/1. Coverage MCP's focused branch query at src/codecs/avif/samples.rs:590 lists only the false arm of child.kind != infe as unobserved, so the selected report records the wrong-child rejection arm. The report target/release-evidence/coverage-avif-iinf-child-wrong-kind.json has SHA-256 1c852014db08a06b706a2bffed3ec63230c032c6070a0fb86616dc6e26412edb and records 77/31,278 observed branch outcomes. Coverage MCP's incremental comparison with .coverage-mcp/local-evidence/20261013/avif-iinf-zero-count/coverage.json is incomparable because branch detail is incomplete and the inventories differ (31,278 versus 31,306). Both reports lack source/build receipts and test attribution. No aggregate coverage gain or full-suite result is claimed; no full coverage campaign was run.

make verify now includes the generator's hash-only --check and passes; the refreshed malformed-input ledger contains 609 classes across eight formats.

JPEG multiscan positive-size AC tail overrun parity — 2026-10-16

The active input-only row baseline_multiscan_ac_pair_tail adds a 172-byte SOF0 4:4:4 JPEG with three single-component scans. Its Y scan places a positive size-eight AC symbol after a run that advances past coefficient 63; the scalar multiscan decoder consumes its amplitude and stores the value at the final coefficient. The pinned Pillow 12.2.0 oracle verifies the input as 8×8 RGB. The input SHA-256 is ab2f907a724ae03917b169c72868ae43dfc9e6d38dece1c5521039bebc5f26f6; the exact 192-byte RGB reference SHA-256 is ef3e84f55ebfea3a4470bedbe9341f5145b718d560f870428ab76bb6dc9f43dc.

The focused public matrix test passed 1/1. It exercises detection, inspection, verification, still decode and sequence decode against Pillow references. The fresh GitHub x86 CI artifact for source commit 7c32909e recorded zero hits for the k >= 64 true arm at src/codecs/jpeg/decode/decode.rs:89; Coverage MCP groups that arm as missing. The extracted CI report is target/release-evidence/coverage-jpeg-x86_64-ci.json (SHA-256 f8423fa474f19658377965edcb1ca63e3b69bf973389e06e34399f11105b6208). The selected local LLVM report records four true-arm and four false-arm hits, and Coverage MCP finds no remaining gap at that location. Its report is target/release-evidence/coverage-jpeg-multiscan-ac-pair-tail.json (SHA-256 0cd67a75fadaa4237422b8a448b72274fcc781fd10b6f690507d2041ce86be07). The baseline and selected reports have different branch inventories (302 and 308), and both lack source/build receipts and test attribution, so their incremental comparison is incomparable. This is bounded selected-path evidence, not an aggregate coverage gain or a full coverage result. No Rust decoder or SIMD code changed.

The current fixture matrix contains 2,246 total rows: 1,765 decode / inspect / verify rows and 481 encode rows. Of those, 1,765 decode rows and 449 encode rows are active. No full coverage campaign was run.

JPEG multiscan invalid DC category parity — 2026-10-16

The active public error row error_baseline_multiscan_dc_category_16 adds a complete 165-byte SOF0 4:4:4 JPEG with three single-component scans. Its first scan contains DC category 16, which is invalid for baseline JPEG. The input baseline_multiscan_dc_category_16.jpg has SHA-256 807a3da9cac05080e6182c047e551652eeee8e94653ef030a4c60775e4c4c4ea. The generator mutates the existing deterministic three-scan fixture; pinned Pillow 12.2.0 verifies the file structure and rejects pixel loading with OSError: broken data stream when reading image file.

The focused public matrix test passed 1/1 for this row. Coverage MCP's selected branch report is target/release-evidence/coverage-jpeg-multiscan-dc-category-16-local.json (SHA-256 b3048e2376faa1a96b4c130653b6d6177540a1c502187c82d51064263ebcdcac). It records 160/31,278 observed branch outcomes. At src/codecs/jpeg/decode/decode.rs:57, Coverage MCP lists only the false arm of dc_cat > 15 as unobserved, so this selected report observes the invalid category arm in scalar decode_block. The previous selected multi-scan AC report shows the complementary arm. The incremental comparison is incomparable because exact branch detail is incomplete; both reports lack source/build receipts and Coverage MCP test attribution. These are selected path observations only, not an aggregate coverage gain or full-suite result.

The current fixture matrix contains 2,255 total rows: 1,774 decode / inspect / verify rows and 481 encode rows. Of those, 1,774 decode rows and 449 encode rows are active. The regenerated malformed-input ledger contains 611 classes across eight formats. The Rust AV1 decoder gained the 12-bit clipped B32 lossless inter path; no SIMD code changed, and no full coverage campaign was run.

APNG sequence-counter exhaustion fault contract — 2026-10-16

fault-contract:png:png_apng_sequence_counter_exhaustion reuses the active decode:png:apng_sequence_controls Pillow fixture, which has five sequence-bearing chunks. Its coverage-only virtual-prefix fault makes the first control consume u32::MAX, then verifies that the following sequence chunk returns ImageError::Malformed for PNG at SequenceDecode with decode sequence: APNG sequence number overflows. The sequence counter now uses an exhausted Option<u32> state, so accepting MAX cannot wrap to zero. The shared runner also retries without injection and compares the result with a fresh sequence decode. The injected outcome remains oracle_status: not_applicable, separate from Pillow parity.

The selected public fault row and the unchanged APNG parity row each passed 1/1. Coverage MCP measured 154/31,280 branch outcomes in the selected report and found no missing branch observation at the exhaustion guard in src/codecs/png/decode.rs:1233; it still reports the independent sequence mismatch arm at line 1238 as uncovered by this selected fault run. The incremental comparison with the saved October 13 baseline is incomparable because exact branch details differ; neither report has source/build receipts or test attribution. No aggregate coverage gain or full-suite result is claimed, and no full coverage campaign was run. Report: target/release-evidence/coverage-apng-sequence-counter-exhaustion.json. The static coverage-origin inventory now records 151 exact cfg(coverage) guards across 26 Rust files; this does not change the historical full-coverage baseline.

APNG inspector sequence-counter exhaustion fault contract — 2026-10-17

fault-contract:png:png_apng_inspection_sequence_counter_exhaustion reuses the active decode:png:apng_sequence_controls Pillow fixture. The coverage-only fault models a valid prefix through u32::MAX before the inspector's next frame-control chunk. It verifies a public ImageError::Malformed for PNG at Inspection with inspect: PNG animation sequence number overflows, then retries img::inspect without injection and compares its metadata with a fresh inspection. The row uses oracle_status: not_applicable; the separate decoder sequence-exhaustion contract remains unchanged.

The selected run included decode:png:apng_sequence_controls, fault-contract:png:png_apng_sequence_counter_exhaustion, and this inspection fault row. The matrix test binary passed. A fault-only selected rerun reported two selected and executed fault contracts, both passing (2/2), with zero failures and oracle=not_applicable. The selected branch report is .coverage-mcp/local-evidence/20261017/png-apng-inspect-selected/coverage.json, SHA-256 c82b8cc6f2b90b1a75f5af5ca9bac0f281a8423c50602ecf875b5dae80c518c2. Coverage MCP found no missing branch observation at the exhaustion guard in src/codecs/png/inspect.rs:195; the independent sequence-mismatch arm at line 200 remains unobserved. The report is source-unverified, has no build ID or recorded revision, and reports test attribution as unknown. These selected results do not establish aggregate coverage or a full-suite result. No full coverage campaign was run.

AV1 partition-context above reservation fault contract — 2026-10-16

fault-contract:avif:avif_partition_context_above_reservation_failure reuses the active decode:avif:baseline Pillow input. A coverage-only one-shot fault requests an impossible capacity for PartitionContexts::new's above buffer. The public decode returns ImageError::Dimensions for AVIF at StillDecode with decode: AVIF AV1 validation failed: unable to allocate AV1 partition context. The shared runner then verifies that an uninjected retry equals a fresh decode. The injected result is oracle_status: not_applicable and stays outside Pillow parity counts.

The selected fault-contract row passed 1/1. Its JSON report is target/release-evidence/coverage-avif-partition-context-above.json, retained for Coverage MCP inspection. No aggregate coverage gain is attributed to this individual case. A later full all-feature local run and its attribution limits are recorded above. The exact coverage-origin inventory now records 152 cfg(coverage) guards across 26 Rust files.

BMP palette-less indexed encoding parity — 2026-10-16

encode:bmp:enc_indexed_missing_palette reuses the 67-byte PNG asset palette_missing_plte.png (SHA-256 6e78b381ae98aa9a5bdb1e50179a74073cdb0d567b2d55c6e48e4b6c8faeb7c3). Pinned Pillow 12.2.0 loads it with PIL.ImageFile.LOAD_TRUNCATED_IMAGES enabled as a 1×1 P image without a palette and preserves sample 00. It saves a 58-byte 8-bit BI_RGB BMP with offset 54, both palette counts zero, and four zero raster/padding bytes; the encoded SHA-256 is 64850622123ceb124c80eca8ee8c8f4a3ec3026580501d9ba44a7c256e5ba747. Pillow reopens the file under the same load setting and preserves the P-mode sample.

The new public row first reproduced a Rust/Pillow mismatch (1,082 bytes versus 58). The BMP encoder now omits the absent palette table and copies indexes unchanged. The decoder admits the corresponding 8-bit BI_RGB layout only for INFO-or-later headers whose pixel offset equals the end of the DIB header; other indexed BMP files retain their existing palette requirements. The reference generator records and restores the row-scoped Pillow load setting for both source and roundtrip images.

The selected all-feature matrix run passed seven rows: BMP decode depth_8, os2_v1, and error_malformed, plus encode enc_indexed_missing_palette, enc_8bit, enc_grayscale, and enc_24bit. Formatting and strict workspace Clippy passed. Coverage MCP's selected report is target/release-evidence/coverage-bmp-no-palette-controls-20261016.json; its queries report no unobserved branch outcomes at the new palette omission predicate and the encoder's optional-palette branch. The report has no source or test receipt, and its incremental comparison with the saved historical full report is incomparable because that report's branch detail is incomplete. No aggregate coverage gain or full-suite claim is made; no full coverage campaign or SIMD change was made.

AVIF wide-I444 mode-2 mixed topology parity — 2026-10-16

The active animated_lossy_wide_i444_mode2_mixed_b128x128 row adds a two-frame 256x256 lossy I444 input with fixed 128-pixel partitions. Only the top-left 128x128 mode-2 inter leaf has one TX64 root split once to TX32; its other three roots and the remaining leaves stay unsplit. No TX32 child splits. The pinned generator double-encodes the input and checks its SHA-256 0e72f7d47e8e83e0a6e13a76a816cb98974cdb2976fff72857901712e2633d61 and both Pillow RGB frame hashes. The complete-file loop observer reports infinite repetition. The selected public row passes exact Pillow parity 1/1.

The selected branch report records the mixed-plan fallback at entropy.rs:7152. In block.rs:57706, one decoder monomorphization observes both topology.is_some() outcomes (8 true and 24 false); the remaining six monomorphizations have no hits in this selected-only run. Coverage MCP reports 3,308/31,296 branch observations for the selected measurement, with source identity unverified and test attribution unknown because no source/build or test receipt accompanies the LLVM report. This is selected-path evidence, not an aggregate coverage gain or full-suite result. Report: target/release-evidence/coverage-avif-mode2-mixed-selected-20261016.json. No full coverage campaign or SIMD change was made.

At this 2026-10-16 checkpoint, the fixture matrix contains 2,262 total rows: 1,779 decode / inspect / verify rows and 483 encode rows. Of those, 1,779 decode rows and 451 encode rows are active; 32 planned encode rows remain.

AV1 segment-map reservation fault contract — 2026-10-17

The active decode:avif:mixed_lossless_clipped_b32_i420_60x60 fixture is a 321-byte still AVIF whose key frame enables segmentation without temporal segmentation. Pinned Pillow 12.2.0 decodes it to 60×60 RGB8 pixels (10,800 bytes). Its source SHA-256 is ea8d484e1cde6819d1c98a64ff58db1bec7937fd929a835cf9c13c2da8430d1b; the Pillow pixel reference SHA-256 is a3b4b27575bef66a5eb058529aee5cac545d4d43a9bace07421cea066b4d59b8.

fault-contract:avif:avif_segment_map_reservation_failure reuses that public parity input to reach SegmentMap::new. Its coverage-only hook forces try_reserve_exact to reject an impossible capacity before the map is initialized. The public result is ImageError::Dimensions with format: Some(Avif), message decode: AVIF AV1 validation failed: unable to allocate AV1 segment map, stage: Some(StillDecode), offset: None, and identity: None. The shared fault runner checks the structured result, then confirms retry succeeds and matches a fresh decode. oracle_status: not_applicable keeps the injected failure separate from Pillow parity.

The selected parity row and selected fault-contract row each passed 1/1. Coverage MCP's branch-gap query for src/codecs/avif/av1/entropy.rs:855 returned zero missing groups for this selected report. The incremental comparison with coverage-main-full-20261016.json was incomparable because its baseline detail does not match the reported totals; neither report has source/build receipts or test attribution. No aggregate coverage gain is claimed and no broad codec or full-coverage campaign was run. Report: target/release-evidence/coverage-avif-segment-map-fault-current.json. The static coverage-origin inventory now records 161 exact cfg(coverage) guards across 26 Rust files. The current fixture matrix contains 2,269 total rows: 1,786 decode / inspect / verify rows and 483 encode rows. Of those, 1,786 decode rows and 451 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 45 rows.

AVIF 10-bit I444 alpha plane-length fault contract — 2026-10-17

fault-contract:avif:avif_10bit_i444_alpha_plane_length_mismatch reuses the active decode:avif:high_bitdepth_still_10bit_444_alpha_lossy_16x16 Pillow input. Its cfg(coverage) hook shortens only the full-resolution alpha plane before the converter's plane-length guard. The existing Option failure path returns ImageError::Unsupported with AVIF, NotImplemented, and StillDecode, with diagnostic decode: AVIF input is outside the supported pure-Rust decode subset. The contract checks that exact structured result, then confirms an uninjected retry equals a fresh decode. The injected outcome uses oracle_status: not_applicable and remains separate from Pillow parity.

The selected fault-contract case passed 1/1. Coverage MCP's selected branch report, target/release-evidence/coverage-avif-10bit-i444-alpha-mismatch-20261017-final.json, shows the alpha-plane mismatch outcome at decode.rs:948 was observed. Its function query still lists four missing branch outcomes: the split_last empty-plane path, true outcomes for the preceding U/V length checks, and invalid sample-depth rejection. The incremental comparison with target/release-evidence/coverage-avif-10bit-444-alpha-16x16.json is incomparable because baseline branch detail does not reconcile with totals; both reports lack source/build receipts and test attribution. No aggregate coverage gain or full-coverage claim is made, and no full coverage campaign or SIMD change was run.

AVIF 10-bit I444 U/V length and sample-domain fault contracts — 2026-10-17

The target-only selectors fault-contract:avif:avif_10bit_i444_u_plane_length_mismatch, fault-contract:avif:avif_10bit_i444_v_plane_length_mismatch, and fault-contract:avif:avif_10bit_i444_alpha_invalid_sample reuse the active decode:avif:high_bitdepth_still_10bit_444_alpha_lossy_16x16 Pillow input. Coverage-only hooks independently shorten the U or V plane, or inject an out-of-range sample into the helper's existing sample validation. Each case asserts the established ImageError::Unsupported / NotImplemented / StillDecode result and exact diagnostic, then confirms that a clean retry matches a fresh decode. Their oracle status is not_applicable; none is reported as Pillow parity.

The selected three-case fault runner passed. Coverage MCP's branch query on target/release-evidence/coverage-avif-10bit-i444-three-faults-20261017.json no longer lists the U-plane, V-plane, or invalid-sample true outcomes as gaps. It lists three remaining outcomes in this helper: the alpha-fault hook, the alpha-plane length guard, and the output-length guard. A same-source selected alpha control passed in target/release-evidence/coverage-avif-10bit-i444-alpha-control-20261017.json. The incremental comparison between those selected reports was incomparable because branch detail was incomplete or differed; source/build receipts and test attribution are absent, so no additive coverage gain is claimed.

The output-length guard at decode.rs:1004 remains a coverage limitation: the helper reserves exactly four bytes per sample and emits one RGB triplet plus one alpha byte for each sample. Injecting a shortened local output would test an artificial private state rather than a reachable decode contract.

JPEG baseline post-scan COM parity — 2026-10-17

Added decode:jpeg:baseline_444_single_scan_trailing_com, a Pillow 12.2.0 parity row using the deterministic 8×8 baseline 4:4:4 input with a valid COM segment inserted between the entropy scan and EOI. The fixture SHA-256 is cf8e4443dcff4df7858b6573664aa3fe73dd401827aa293d0eca84eb0667f666; its 192-byte RGB reference SHA-256 is 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f.

The first focused run exposed a public decode failure: the single-scan fast boundary check rejected COM as a non-DQT marker, then generic entropy extraction treated COM as entropy and returned no segment. The parser had already recorded the end of scan entropy. The decoder now reuses that boundary for a single baseline scan when parsed COM or DQT segments precede EOI. This keeps entropy extraction bounded at the scan and avoids additional pixel processing. The selected matrix row passes.

The selected LLVM report is target/release-evidence/coverage-jpeg-postscan-com-selected.json. Coverage MCP reports 271/31,378 selected branch outcomes; its function query shows only the input-rejection arms of the helper remain unobserved for this selection. The incremental comparison with target/release-evidence/coverage-main-full-20261016.json is incomparable because the baseline branch detail does not reconcile with its totals. Both reports lack source/build receipts and test attribution, so no aggregate coverage gain is claimed.

The current fixture matrix contains 2,273 total rows: 1,790 decode / inspect / verify rows and 483 encode rows. Of those, 1,790 decode rows and 451 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 47 rows.

JPEG entropy-boundary regression guard — 2026-10-17

GitHub CI #658 exposed two regressions in the initial COM fix on x86-64 and Windows: a fill byte before an RST marker shortened entropy extraction, and an unexpected FF02 marker after entropy was accepted by the fast path. The boundary helper now walks the post-scan tail and only accepts well-formed COM and DQT segments. Restart markers and other marker codes fall back to generic entropy extraction, which preserves RST splitting and malformed-marker rejection.

The selected matrix run passed the COM parity case, the restart-marker-fill case, and the malformed unexpected-marker case. Its LLVM report is target/release-evidence/coverage-jpeg-tail-regressions.json; Coverage MCP reports 367/31,392 branch outcomes for this selection. Its source receipt and test attribution are absent, and comparison with the historical full report is incomparable because the baseline detail does not reconcile with its totals. This is selected-run evidence only; it does not establish aggregate coverage change.

BMP DIB header parity — 2026-10-17

Added three full-file BMP parity cases: reject unknown DIB size 41 and retain Pillow-supported INFO-family sizes 52 and 56. The fixtures derive from a 1×1, 24-bit BMP and adjust the DIB size, pixel offset, and file size together. Pillow 12.2.0 reports Unsupported BMP header type (41) for the 41-byte fixture; the successful 52- and 56-byte references decode to the same 1×1 RGB pixel with SHA-256 25ff297dd78c82468376d6e2c93b672b49c01fb125a2812b94f8f9693a51b67e. The 41-byte input SHA-256 is 331c249550844cee20e0230baaceecbe2f8b58f2ddacbfefe5c8bf9b0f680295.

Decoder and inspector now share an explicit check for Pillow's supported Windows INFO-family DIB sizes (40, 52, 56, 64, 108, and 124). This check runs once while reading the header; pixel loops are unchanged. The selected matrix run passed all three rows. Coverage MCP reports 95/31,392 observed branch outcomes in target/release-evidence/coverage-bmp-dib-variants-selected.json. Source and test receipts are absent, and the comparison with the historical full report is incomparable because its branch detail does not reconcile with totals. No aggregate coverage gain is claimed.

PNG zero-width encoder parity — 2026-10-17

Added the active public row encode:png:enc_error_zero_width, using the existing rgb.png source transformed to dimensions [0, 1]. The pinned Pillow 12.2.0 oracle reports ValueError: cannot write empty image; the Rust encoder reports the structured Dimensions error. The PNG reference generator added the case to the input index and coverage matrix without adding a binary asset. The focused selected row passed 1/1. The existing zero-height control also passed 1/1.

Coverage MCP reports 120/31,392 branch observations for target/release-evidence/coverage-png-zero-width-20261017.json. Its query for src/types/mod.rs:2727 identifies the missing outcomes in DecodedImage::validate; the width predicate's true outcome is absent from the missing branch list, so the zero-width input reaches that path. Comparison against both the historical full report and the selected zero-height control is incomparable because report identities and branch detail do not reconcile. The reports have no source/build receipts or test attribution, so no aggregate coverage gain is claimed. No full coverage campaign or Rust source change was made.

The current fixture matrix contains 2,274 total rows: 1,790 decode / inspect / verify rows and 484 encode rows. Of those, 1,790 decode rows and 452 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 47 rows.

TIFF big-endian Gray16 Predictor=2 parity — 2026-10-17

Added the active public row decode:tiff:compression_deflate_be_unsigned16_wraparound_predictor. The 4×2 Deflate TIFF is unsigned 16-bit grayscale, big-endian, and uses horizontal Predictor=2. Its rows include modulo-65,536 underflow and overflow deltas. The input SHA-256 is 465f00da37c237c0b94fd6537a6cd2888c1bb1aa88c95821dcda4f0c98bd36a8. Pinned Pillow 12.2.0 returns mode I;16B and 16 reference bytes with SHA-256 b6e268aab4491c42fd095133f3ea44c6dd1c4c455c027a7571943f6e1c93259a.

The public ImageMode::L16 transfer contract stores samples little-endian and the decoded source descriptor retains the TIFF's big-endian provenance. The sample values have equal high and low bytes, so Pillow's raw I;16B reference also matches the public little-endian L16 bytes exactly. Their predictor deltas still include non-symmetric 0xfeff and 0x0102 values, so correct big-endian delta reconstruction is required for the sample comparison to pass. The selected public LLVM coverage run passed 1/1. Its report records one execution of reverse_horizontal_predictor_with_token and observes the 16-bit predictor path. The 1,024-byte checkpoint outcome is not exercised by this small fixture. Coverage MCP's incremental comparison could not complete because its local daemon was unhealthy. The saved full baseline also lacks source/build receipts and test attribution, so no aggregate coverage claim is made.

The current fixture matrix contains 2,275 total rows: 1,791 decode / inspect / verify rows and 484 encode rows. Of those, 1,791 decode rows and 452 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 47 rows.

TIFF big-endian Gray16 LZW Predictor=2 parity — 2026-10-17

Added active public row decode:tiff:compression_lzw_be_unsigned16_predictor. The fixture is a 4×2 big-endian unsigned Gray16 TIFF using LZW compression and horizontal Predictor=2. The generated LZW stream contains the predictor bytes as literal codes; exact Pillow decoding validates the TIFF LZW stream and predictor reconstruction together. The input SHA-256 is 3599d2593242e2176e074e192728c47b4c0fe22ca57ed1bf58533affcb93cee8. Pinned Pillow 12.2.0 reports mode I;16B and 16 output bytes with SHA-256 b6e268aab4491c42fd095133f3ea44c6dd1c4c455c027a7571943f6e1c93259a.

The palindromic samples preserve exact raw-byte parity between Pillow's big-endian mode and the public little-endian L16 transfer representation; the Predictor=2 deltas still exercise byte-asymmetric wraparound values 0xfeff and 0x0102. The selected public parity row passed 1/1. Coverage MCP's incremental comparison against the saved full report is incomparable: branch inventories differ (31,282 versus 31,392) and source/build receipts are absent. A selected-tests comparison against the matching big-endian Deflate case is limited and observes 32 additional branch locations, including TIFF LZW decode paths, but both reports have unverified source identity and unknown test attribution. These coordinates do not establish an aggregate coverage gain.

The current fixture matrix contains 2,277 total rows: 1,793 decode / inspect / verify rows and 484 encode rows. Of those, 1,793 decode rows and 452 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 49 rows.

WebP lossless options — 2026-10-17

Added ten active Pillow-backed WebP encode rows for quality 0/100, method 0, partial and transparent alpha, method 5 quality boundaries, and method 6. The lossless path now forwards its quality and method options into the VP8L encoder. A histogram clamp correction matches libwebp's single-tile rule for small power-of-two frames. The exact selected option rows passed after reference generation.

Coverage MCP identified the large-image histogram-growth path as an open gap. The attempted method-5 wide high-entropy row differed from Pillow by eight encoded bytes and was removed. A passing method-4 sampling fixture did not exercise the growth body. Focused LLVM reports have unverified source identity and unknown test attribution; they are useful for locating code only and do not establish aggregate coverage gains.

The current fixture matrix contains 2,287 total rows: 1,793 decode / inspect / verify rows and 494 encode rows. Of those, 1,793 decode rows and 462 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 49 rows.

AVIF generic 12-bit I444 alpha length guard — 2026-10-17

Added the target-only fault-contract row fault-contract:avif:avif_12bit_i444_generic_alpha_plane_length_mismatch. It reuses the active Pillow-backed input decode:avif:high_bitdepth_still_12bit_444_alpha_9x9. A coverage-only hook shortens a present full-resolution alpha plane by one sample immediately before the generic plane-length guard. The shared runner checks the structured Unsupported / NotImplemented result at StillDecode and then confirms that a retry equals a fresh decode. The injected state is target-only (oracle_status: not_applicable) and is not counted as Pillow parity.

The selected fault-contract test passed 1/1, and the selected Pillow-backed source parity control passed 1/1. Their branch reports are target/release-evidence/coverage-avif-i444-generic-alpha-mismatch-verified-20261017.json and target/release-evidence/coverage-avif-i444-generic-alpha-control-20261017.json. The selected fault report records the generic alpha-length predicate as one true and two false branch outcomes across the injected decode, retry, and fresh decode. Coverage MCP could not load because its local daemon did not become healthy; there is no MCP gap or incremental comparison result for this run, and no aggregate coverage gain is claimed.

The static coverage-origin inventory now records 165 exact cfg(coverage) guards across 26 Rust files. The parity fixture matrix remains at 2,277 rows (1,793 decode / inspect / verify and 484 encode); the separate target-only fault lane now contains 49 rows.

AVIF 10-bit I444 alpha output reservation fault — 2026-10-17

Added the target-only fault-contract row fault-contract:avif:avif_10bit_i444_alpha_output_reservation_failure. It uses the active Pillow-backed input decode:avif:high_bitdepth_still_10bit_444_alpha_lossy_16x16 and injects a failure at the AVIF 10-bit I444 alpha RGBA output reservation. The public contract is a structured Dimensions error at StillDecode; a subsequent decode must succeed and equal a fresh decode. This deterministic allocation failure is target-only (oracle_status: not_applicable) and is not counted as Pillow parity. A real try_reserve_exact failure now preserves the same structured allocation error.

The selected target-only fault-contract test passed 1/1, and the selected Pillow-backed AVIF parity row passed 1/1. A grouped fault-control run also passed for the new reservation case and the four existing I444-alpha unsupported cases; its report is target/release-evidence/coverage-avif-10bit-i444-alpha-fault-controls-20261017.json. The first two reports are target/release-evidence/coverage-avif-10bit-i444-alpha-output-reservation-20261017.json and target/release-evidence/coverage-avif-10bit-i444-alpha-parity-20261017.json. Coverage MCP's focused branch query finds the new reservation and error outcomes observed at the updated conversion lines. The selected report still lists other fault-injection branches in the conversion helper as missing. Source/build identity is unverified and test attribution is unknown, so these reports are coordinate evidence only; no aggregate coverage gain is claimed.

The current fixture matrix contains 2,277 total rows: 1,793 decode / inspect / verify rows and 484 encode rows. Of those, 1,793 decode rows and 452 encode rows are active; 32 planned encode rows remain. The separate target-only fault lane contains 48 rows.

AVIF generic 12-bit I444 RGB output reservation fault — 2026-10-17

Added fault-contract:avif:avif_12bit_i444_generic_rgb_output_reservation_failure using the active Pillow-backed source row decode:avif:high_bitdepth_still_12bit_444_alpha_9x9. In coverage builds, the one-shot fault point supplies usize::MAX as the reservation length so try_reserve_exact itself reaches the same typed Dimensions error mapping used for a real reservation failure. The retry contract then verifies that an uninjected decode equals a fresh decode. Normal builds reserve the exact output length, and allocation failure remains reported at StillDecode. The injected fault is target-only with oracle_status: not_applicable; the source parity row remains independently Pillow-backed.

The selected fault-contract row passed 1/1 under coverage instrumentation. The selected Pillow parity row passed 1/1 both under coverage instrumentation and in a normal all-feature build. Reports:

• target/release-evidence/coverage-avif-12bit-i444-generic-rgb-output-reservation-20261017.json (SHA-256 0fdb2f13f84756b5cee435730e2b0555daf6a90c360021c072d92a4a22480d15)
• target/release-evidence/coverage-avif-12bit-i444-generic-rgb-parity-20261017.json (SHA-256 17d701a1015f4cb74011a93f0643f48f6a724b7ce8cad9a645c769a6f8415d40)

Selected report	Lines	Branches	Functions	Regions
Fault contract	10,302 / 136,668	1,629 / 31,444	667 / 8,735	13,045 / 211,995
Pillow parity	11,526 / 136,668	1,832 / 31,444	792 / 8,735	14,851 / 211,995

Coverage MCP's selected-tests branch comparison reports two newly observed coordinates in convert_full_resolution_rgb: the injected reservation arm and the try_reserve_exact(...).is_err() arm at lines 927 and 936. Its focused query found no missing branch outcomes at line 936. Both reports have unverified source/build identity and unknown test attribution, so this is selected coordinate evidence only. The incremental comparison with the saved 2026-10-16 full report is incomparable because its detailed branch inventory does not reconcile with its totals. No aggregate coverage gain or full-suite coverage claim is made.

The coverage-origin inventory now records 166 exact cfg(coverage) guards across 26 Rust files. The parity matrix remains at 2,287 rows (1,793 decode / inspect / verify and 494 encode); its separate target-only fault lane contains 50 rows.

AVIF generic 12-bit I444 U/V and invalid-sample fault contracts — 2026-10-17

Added target-only rows for generic I444 U-plane length mismatch, V-plane length mismatch, and an out-of-range sample. They reuse the active Pillow-backed source row decode:avif:high_bitdepth_still_12bit_444_alpha_9x9. The U/V faults shorten their respective slices inside convert_full_resolution_rgb, after container validation, so each short-circuit predicate is reached independently. The invalid-sample hook appends u16::MAX to the same iterator consumed by the real SampleDepth::validate guard. All hooks are compiled only with cfg(coverage); the shared runner checks the public Unsupported / NotImplemented result at StillDecode and verifies a clean retry against a fresh decode. These states are target-only (oracle_status: not_applicable) and remain separate from Pillow parity.

The selected fault-contract run passed 1/1 for all three rows. The selected Pillow parity control passed 1/1 under coverage instrumentation. Reports are target/release-evidence/coverage-avif-i444-generic-guards-20261017.json and target/release-evidence/coverage-avif-i444-generic-rgb-control-20261017.json. Coverage MCP found the U, V, and sample-validation true arms missing in the control report, and no missing branch outcome at their source lines in the fault report. A selected-tests comparison reported six newly observed branch coordinates, but is limited because source/build identity and test attribution are unverified. Incremental union is incomparable because the selected report branch detail does not reconcile with aggregate totals. No aggregate coverage gain or full-suite coverage claim is made.

The parity matrix remains at 2,287 rows (1,793 decode / inspect / verify and 494 encode); the target-only fault lane now contains 54 rows. The coverage-origin inventory records 171 exact cfg(coverage) guards across 27 Rust files.

AV1 super-resolution geometry and chroma allocation faults — 2026-10-19

Added three target-only fault-contract rows against the active Pillow-backed AVIF sequence input decode:avif:animated_lossy_inter_420_superres_sgr_8bit_160x56: decoded-leaf geometry mismatch, chroma U output-plane reservation failure, and chroma V output-plane reservation failure. Each verifies the public sequence-decode error and a clean retry. The injected conditions are compiled only with cfg(coverage) and are recorded with oracle_status: not_applicable; they do not count as Pillow parity. The existing source row and luma/position fault contracts remain controls.

The selected run passed the AVIF source parity row and all five selected fault contracts (6/6 total). Its report is target/release-evidence/selected/20261019T_av1-superres-fault-contracts-final.json. Coverage MCP reports the selected report's source/build identity as unverified and test attribution as unknown, so the result establishes test execution but not an aggregate coverage gain. Its focused branch query still lists uncovered branch coordinates in upscale_subsampled_leaf; those coordinates require a later source-and-measurement-matched investigation before making a coverage claim.

The parity matrix remains at 2,287 rows (1,793 decode / inspect / verify and 494 encode); its separate target-only fault lane now contains 65 rows. The coverage-origin inventory records 184 exact cfg(coverage) guards across 27 Rust files.

AVIF clipped mixed-lossless inter B32 parity — 2026-10-20

Added the public Pillow parity case decode:avif:animated_mixed_lossless_inter_b32_i420_60x60. Its 60×60 I420 two-frame animation has a frame-1 inter B32 at the bottom-right, clipped to a 28×28 visible extent. The frame uses both qindex-zero lossless and lossy segments with a spatial segment map update. The deterministic input is tests/fixtures/input/images/avif/animated_mixed_lossless_inter_b32_i420_60x60.avif (1,083 bytes; SHA-256 618e40d92c2dd80005f841b5af4907e8f328512960621c6f1eb7e267c24b23ce). Pinned Pillow 12.2.0 produced two 10,800-byte RGB frame references with SHA-256 a3b4b27575bef66a5eb058529aee5cac545d4d43a9bace07421cea066b4d59b8 and 6b6f92c82d4962e2f59502cd76f454527f3a213fafa10130620e601812aa918c.

The selected make coverage-selected parity run passed 1/1 for this row. Its report is target/release-evidence/selected/avif-clipped-mixed-inter-b32-20261020.json (SHA-256 c3db40108516a8db2f4c57b3241949671e944bb83da562b5e2812b6df4865824), and the local run receipt records source_changed_during_run: false. Coverage MCP reports 3,070 / 32,044 branches covered and groups the largest missing AV1 entropy observations under validate_complete_lossy_420_partition, decode_inter_transform_size, and decode_inter_leaf. MCP source/build identity remains unverified and test attribution is unknown, so these are coordinate-only gaps and do not establish a coverage gain. The incremental comparison with target/release-evidence/coverage-main-full-20261020.json is incomparable because exact branch detail in the baseline does not reconcile with its reported totals. No aggregate coverage gain is claimed.

An already-started selected run of the existing 64×64 companion row also passed 1/1, but its receipt detected a source change during execution; that report is excluded from comparisons.

AVIF per-tile CDEF active-map reservation fault contract — 2026-10-20

fault-contract:avif:avif_tile_cdef_active_map_reservation_failure reuses the active decode:avif:multitile_color_split_groups Pillow input. Its coverage-only hook forces the per-tile CDEF active-map reservation to fail. The selected target-only contract passed 1/1 with an AVIF StillDecode Dimensions error and the exact message decode: AVIF AV1 validation failed: unable to allocate AV1 CDEF active map. Retry output matches a fresh uninjected decode. The case remains oracle_status: not_applicable and is excluded from Pillow parity counts.

The selected report is target/release-evidence/selected/avif-tile-cdef-active-map-reservation-20261020.json (SHA-256 030816355baa3a0fd76fd5d85dd2baf5ab2c14622deb271d773412dc570ef0f9). Its local receipt records source_changed_during_run: false. Coverage MCP's branch query at entropy.rs:11343 returned no missing branch locations for the active-map hook in this selected report. Source/build identity remains unverified and test attribution is unknown; no aggregate coverage gain is claimed.

TIFF separate-planar YCbCr subsampling error parity — 2026-10-20

Added decode:tiff:ycbcr_separate_subsampling_unsupported_pair_lzw_1x1 using the complete 253-byte LZW TIFF tests/fixtures/input/images/tiff/ycbcr_separate_subsampling_unsupported_pair_lzw_1x1.tiff (SHA-256 7c8a656e6d7a72c19a284b19260f5bf021f406526a17606f4f36bfaa96426905). The fixture changes only tag 530 from (1, 1) to (2, 2) in a separate-planar file. Pinned Pillow 12.2.0 opens and verifies the image, then reports builtins.OSError: decoder error -2 when pixels are loaded. The selected public parity case passed 1/1 and matched the expected TIFF malformed error contract.

The selected report is target/release-evidence/selected/tiff-separate-ycbcr-unsupported-pair-20261020.json (SHA-256 75d3297b5ac77da0568eb9c3cf0fce33943776ae3990e0b450e50e5a4ef57860). Its local receipt records source_changed_during_run: false. Coverage MCP queried src/codecs/tiff/decode.rs:317; its report remains source-unverified and does not support aggregate or regression claims. The exact branch comparison with target/release-evidence/coverage-main-full-20261020.json is incomparable because the saved baseline's detailed branch observations do not reconcile with its reported totals.

Token-aware WebP method-0 run-cap parity — 2026-10-20

Added encode:webp:enc_lossless_method_0_run_cap_token using the existing 4,356×1 PNG run-cap source tests/fixtures/input/images/png/webp_lossless_run_cap_4356x1.png (SHA-256 038d4a47bb2b7f22b62eaac823a897c74607b20ee0ab6999e30b5dc84f6a1a93). The new row calls encode_with_token with a fresh non-cancelled token on the 4,096-pixel repeated run, exercises cancellation checkpoints, and matches the same 186-byte Pillow output as the existing non-token row. The selected case passed 1/1 and re-decoded to the expected 4,356×1 RGB pixels.

The selected report is target/release-evidence/selected/webp-lossless-run-cap-token-20261020.json (SHA-256 5915498715e1c2e1e7271885fdd02b4dcce0eec2c963db1538c0bf2b067fc490). Its local receipt records source_changed_during_run: false. Coverage MCP's query at backward_refs.rs:241 returned no missing branch locations for the token checkpoint call, while the run-check and cap conditions at lines 240 and 244 still have candidate gaps in other monomorphizations. MCP source/build identity remains unverified and test attribution is unknown; no aggregate coverage gain is claimed.

The same selected report for the existing WebP run-cap case and three GIF median-cut parity rows passed 4/4. Their exact Pillow outputs were unchanged. Coverage MCP still reports an unobserved split > 0 outcome in GIF's median tie fallback; the valid median-cut rows keep each candidate box nonempty, so that remaining state is not represented as Pillow behavior.

The current fixture matrix contains 2,619 total rows: 2,091 decode / inspect / verify rows and 528 encode rows. Of those, 2,091 decode rows and 497 encode rows are active; 31 planned encode rows remain. The separate target-only fault lane contains 67 rows. The coverage-origin inventory records 213 exact cfg(coverage) guards across 28 Rust files.

JPEG baseline grayscale nonzero SOS spectral-start parity — 2026-10-26

Added decode:jpeg:grayscale_sampling_420_17x9_sos_ss_nonzero. Its maintained generator starts with the deterministic 17×9 grayscale 4:2:0 input and changes only the baseline SOS Ss byte from zero to one. The complete 468-byte input has SHA-256 52dbda00c3f20563251d3db1f4ec77debe55b90fc8838dce9bfee05e5730e5d0. Pinned Pillow 12.2.0 accepts the input and returns the same 17×9 L pixels as the zero-Ss source: 153 bytes with SHA-256 6cb8bf5ca5f3ecb5e63af750426a1af7823ef95743d030651deb9e7b9366728c. The selected public parity case passed 1/1.

The selected report is .coverage-mcp/local-evidence/selected/jpeg-gray-spectral-start-20261026/coverage.json (SHA-256 eeb0c61f1fe34f8299909c756dc70050cce65ed3435ee9faf99f4b364852ac8f). The active LLVM function instance records four true observations and zero false observations for scan.ss != 0 at src/codecs/jpeg/decode/decode.rs:2676; the full baseline had zero true observations. Coverage MCP lists duplicate zero-execution function instances for this location, and its incremental comparison is incomparable because baseline branch details do not reconcile with its totals. MCP source identity is unverified and test attribution is unknown, so no aggregate coverage gain is claimed.

JPEG grayscale SOS spectral-end and approximation parity — 2026-10-26

Added three public Pillow parity rows for grayscale 4:2:0 JPEGs derived from the deterministic 17×9 source: Se=62, Ah=1/Al=0, and Ah=0/Al=1. The generator changes only the corresponding SOS byte. Pinned Pillow accepts all three inputs and returns the same 153-byte L pixel output as the source (SHA-256 6cb8bf5ca5f3ecb5e63af750426a1af7823ef95743d030651deb9e7b9366728c). The three new public parity cases passed 3/3; the combined selection including the earlier nonzero-Ss row passed 4/4.

The selected LLVM report is .coverage-mcp/local-evidence/selected/jpeg-sos-boundary-fields-merged-main-20261026/coverage.json (SHA-256 2d10a141a5273a83ff5f179e9a21709f148e373dfcd1d912f5a8477900573084). Its active grayscale direct-path function instance recorded true outcomes for scan.ss != 0 (4 true, 9 false), scan.se != 63 (3 true, 6 false), scan.ah != 0 (3 true, 3 false), and scan.al != 0 (3 true, 0 false) at decode.rs:2676–2679. These are selected-case counters, not full-suite totals. The earlier full LLVM report recorded 0 true / 74 false for each guard.

Coverage MCP marks this report's source unverified and test attribution unknown. Its incremental comparison with the full baseline is incomparable because the baseline branch details do not reconcile with reported totals; no aggregate coverage gain is claimed. No Rust source or unit tests were added.

JPEG baseline grayscale empty-entropy parity — 2026-10-26

Added decode:jpeg:grayscale_sampling_420_17x9_empty_entropy. Its maintained generator starts from the deterministic 17×9 grayscale 4:2:0 JPEG and removes only the entropy payload, leaving a complete SOS header followed immediately by EOI. The generator is now part of make verify, which checks the full fixture family for deterministic regeneration. The complete 330-byte input has SHA-256 142f0ed4c9dc5dc0210a866d14702644f8dc5ae756b9bd4442eba518a8089afc. Pinned Pillow 12.2.0 accepts it and returns 153 L bytes with SHA-256 563114a366c030ebb8171aa3a92559ddbb650cebcee185eaa10c9bae576c44c5. The selected public parity case passed 1/1.

The selected LLVM report is .coverage-mcp/local-evidence/selected/jpeg-gray-empty-entropy-20261026/coverage.json (SHA-256 da0b989df51a88089ce8dff61e90300ac6ec6da304afb9f5cdd4c85fbbd77609). The active grayscale direct-path function recorded four true observations and no false observations for scan.entropy_start == scan.entropy_end at src/codecs/jpeg/decode/decode.rs:2681. This confirms the edge input reaches the empty-entropy guard. Coverage MCP reports the opposite arm as missing in this one-row selection; the existing all-JPEG selected run recorded 60 false observations. MCP source identity remains unverified and test attribution is unknown, so no aggregate coverage gain is claimed.

JPEG trailing DHT length-one parity — 2026-10-26

Added decode:jpeg:baseline_444_single_scan_trailing_dht_length_one, a complete JPEG whose trailing DHT marker declares the invalid one-byte segment length. The deterministic generator replaces the anchored trailing COM in the 8×8 baseline image. Pillow 12.2.0 verifies the file structurally and reports OSError: broken data stream when reading image file during pixel decoding; the selected Rust parity row passes with the same malformed result. The input SHA-256 is ce200aef72bb9a259f48cf9f154a51ca8ba16280601b39c7076c8c4c6df07b0a.

A clean full make coverage run on origin/main at 0d72fbda5757d1ff878bfeaa9d9d56d62d3110c3 passed all executed tests and reported 67.2685% lines, 58.0959% branches, 58.5237% functions, and 66.1997% regions. Its report is .coverage-mcp/local-evidence/full-20261026-main/coverage.json (SHA-256 552996f85421077b702606d73e00d71ef2943b724c5f68a665c27306bb312931). The full report had no true outcome for the segment_length < 2 branch at src/codecs/jpeg/decode/decode.rs:2900. The exact selected run passed 1/1 and its receipt records three true outcomes for that branch, with no source or fixture change during execution. Its report is .coverage-mcp/local-evidence/selected/20261025T213051.396026Z-4fd74cd709074907b76d0e5e0dfb41ca/coverage.json (SHA-256 97f41f835b3b1d5030c96f032235c4c3e7f465cf5084ecf3b90a13d13d237ccb).

Coverage MCP could not provide a grouped or incremental result: its shared daemon did not become healthy at 127.0.0.1:59471. The retained LLVM report and local receipt support this one source-bound case observation; no MCP snapshot or aggregate coverage gain is claimed. No Rust source or unit tests were added.

WebP two-node Huffman color-cache lookahead parity — 2026-10-26

Added decode:webp:lossless_vp8l_two_node_cache_peek. Its maintained generator writes a 4×1 RGB VP8L stream with a one-bit color cache and a dynamic green tree containing only the one-bit symbols 280 and 281. The code sequence 280, 280, 280, 281 makes lookahead select both leaves in HuffmanTree::peek_symbol. The 66-byte input has SHA-256 388dc731d98c2f58a7e0842ee1efaeff168047f6a336539a29fbbc8e22001f19. Pillow 12.2.0 returns twelve black RGB bytes with SHA-256 15ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b; the selected public parity row passes. The independent VP8L parser reports a one-bit cache, four lookups, and both cache indices.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261026T080421.416756Z-7e5ea112674c4bd4af32ee11130c7622/coverage.json (SHA-256 5b76ebfcaf47b835f62b7014119afb8fbb77d1e5f4f40bb168f2b780c3cdab60). Its source-hashed local receipt records three observations for each branch outcome at src/codecs/webp/native/huffman.rs:505; the preceding full WebP selection recorded zero for both outcomes. The report is selected-case evidence rather than a Coverage MCP snapshot or an aggregate coverage claim. No Rust runtime code or unit tests were added.

AV1 lossy intra I420 super-resolution parity — 2026-10-26

Added the public Pillow parity row decode:avif:superres_actual_upscaled_i420_no_restoration_17x17. It retains the existing 17x17 full-range 8-bit I420 input shape and denominator-9 super-resolution, with AV1 restoration disabled. The pinned fixture generator checks both byte-identical encodes, AV1 geometry, absent restoration on all three planes, and Pillow 12.2.0 RGB pixels. The input SHA-256 is 175f4eed6919458cd0f3af455f20e6a0be83bfd059b2e63e745ad8fab3e46c35; the 867-byte RGB reference SHA-256 is 36b2cbf4958b72a92a936b63d8b905bfd49dfb49b18511cc01723e880576b57b. The selected public parity case passed 1/1.

Coverage MCP previously identified the unobserved true arm at src/codecs/avif/av1/entropy.rs:10614 in the full report for source revision 3d918164137833338d5272430b17e224ceb4ea40. The exact selected LLVM report records 3 true and 0 false observations for that arm; the full baseline recorded 0 true and 166,368 false observations. The selected report is .coverage-mcp/local-evidence/selected/avif-superres-i420-intra-no-restoration-20261026/coverage.json (SHA-256 8ab75d7737b8becd18f26c4179e84ea225889e508155f608e8e39400230e8bf4). Its local receipt records unchanged source and fixtures during execution. This establishes the selected branch hit, not a refreshed full-suite percentage or a Coverage MCP incremental snapshot. No Rust source or unit tests were added.

AV1 lossless qmatrix sequence parity — 2026-10-26

Added active row decode:avif:animated_lossless_inter_420_qmatrix_level15_qindex0_16x64. The maintained generator reproduces a two-frame 16x64 8-bit I420 AVIF sequence with pinned libavif 1.4.1/libaom 3.13.2, qindex zero, qmatrix level 15 on all planes, and all-lossless key/inter frames. The 6,144-byte input SHA-256 is b76924ec8cf9fa01ad27e48dec5990332b089d75460fa7bf37d9fa00108100de; Pillow 12.2.0 reference frame hashes are 44c3002ad58c2b063ac9c560c8baf279052e13d007eaeb84fef33c77a81b9d39 and e121e6212ae783e1d2a9c83c99f0fe931df1682b045e772cce7f60e693b3f7e5, each with a 100 ms duration.

The focused selected parity run passed the qmatrix case, the no-restoration super-resolution case, three existing all-lossless inter controls, and three existing mixed-lossless controls (8/8). It retains exact RGB output, including 3,072 bytes for the qmatrix sequence. The narrow decoder admission change threads the parser-proven all-lossless frame flag into lossless inter reconstruction; ordinary and mixed-segment paths keep matrix admission disabled. Strict native Clippy and both x86-64 SSE2/AVX2 cross-Clippy lanes pass.

The selected LLVM report is .coverage-mcp/local-evidence/selected-worktree/qmatrix-superres-20261026/coverage.json (SHA-256 592a535961454465120de20c6230a95cd0d71454b521a291b5103fc58b8b8990). Its local receipt records all eight selected cases passing and unchanged source and fixtures during execution. Coverage MCP read the selected report and reported 4,452/45,193 branch observations for the selected binary; a gap query at src/codecs/avif/av1/block.rs:49247 shows unobserved generic monomorphizations in this selected run. Source identity is unverified and test attribution is unknown. Its incremental comparison to the older full baseline timed out, so no aggregate coverage gain is claimed. No unit tests were added.

AVIF lossy I422 split-transform neighbor context parity — 2026-10-26

Added active row decode:avif:animated_lossy_inter_422_tx_context_checker_b64x32. The maintained generator verifies the 64x32 two-frame lossy 4:2:2 input, pinned Pillow 12.2.0 RGB frame hashes, and reproducible AVIF bytes. The input SHA-256 is 38c94eed681628437dd11423d62573fee3b1325a749ffc9f74dda1301c6acd56; the frame hashes are 3268f29921f0c622303b8fcf16c10c8bcd25500338944422ea4c18ced0ae821e and aac1dfe4688ff506cb0b3eca55ae4094f8bee4b12100c1b2d7c2b962cf90aa1f. A pinned native libavif observation supplies the sequence-loop evidence.

The decoder now records coded block dimensions for an inter neighbor's tx_intra context while preserving the per-cell split-transform plan. The selected public parity run included the existing 32x32 I422 control and passed 2/2 exact RGB rows; the full AVIF decode matrix passed 605/605. Strict formatting, workspace Clippy, and the x86-64 SSE2 and AVX2 cross-Clippy lanes passed.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261026T120515.229922Z-c65a47bf1a7d4389bb5433ac3fa13f53/coverage.json (SHA-256 05482db667104e09730b44bf5cb0192e6bbb96165cbb0b0b4b94e3f35ba074c2). Coverage MCP measured 4,066/32,134 branch observations for this selected binary and still reports uncovered branches in TileState::commit_with_metadata. Source identity is unverified and named-test attribution is unknown, so this is targeting evidence rather than an aggregate coverage claim. No unit tests were added.

AVIF lossy I422 B32x64 vertical-split parity — 2026-10-26

Added active public row decode:avif:animated_lossy_inter_422_vertical_split_b32x64. The maintained generator checks a deterministic two-frame 32x64 lossy 4:2:2 AVIF, pinned Pillow 12.2.0 RGB output, and reproducible encoded bytes. The input SHA-256 is 0eb45159064b3f1c30919d0062afa19056415f76be203278cd3ddd7174e8a798; the 6,144-byte RGB frame hashes are f1aab4fdf740e5726556337b0287ec940079cc48a4f1995d5f2b8fb5fbc9348c and c72b8082dac958d7aeda2637782f8226e7238711a7e967959100d25ad270e39d. The independent pinned libavif record observes both frames and infinite repetition.

The selected public parity and LLVM coverage run passed 1/1 and matched all 6,144 RGB bytes. Its report is .coverage-mcp/local-evidence/selected/avif-i422-vertical-split-final-2-20261026/coverage.json (SHA-256 43b475948a8c5558b479d8a1a1b86e711cecadd194a5d2d81389df16f34f9f90). Raw branch counters at src/codecs/avif/av1/block.rs:48348 recorded true-arm counts of 2 and 6 in two selected specializations. The full run still has unobserved arms in other specializations at that source span, so the template-wide gap remains open.

A refreshed make coverage run passed its executed suites, including 57/57 coverage-matrix tests, 69/69 feature-gate tests, and the AVIF loop-evidence integrity test. Its LLVM report is .coverage-mcp/local-evidence/full-20261026-avif-i422-vertical-split/coverage.json (SHA-256 cd94d83e8f342f831f88b92523bc6329862e02f423581940b82d1678b7b6150e). Totals are 93,661/139,561 lines (67.1112%), 18,558/32,056 branches (57.8924%), 5,220/8,928 functions (58.4677%), and 143,043/216,607 regions (66.0380%). Coverage MCP reports source identity unverified and test attribution unknown; the full-report comparison is limited and the selected incremental comparison is incomparable because baseline detail is incomplete. No aggregate coverage gain is claimed. No production Rust code or unit tests were added.

AVIF high-depth monochrome inter parity — 2026-10-27

Added the active public parity row decode:avif:animated_lossless_inter_monochrome_b32x32_10bit. Its pinned 10-bit all-lossless key/inter sequence uses a full-size B32x32 monochrome leaf. The 1,114-byte input SHA-256 is 28427120f6a0e9de71d0abcfe36bbeaae4d701dacefb62f852dfd71eeb82d624; Pillow 12.2.0 RGB frame hashes are 9eb4dc1f2ea4eb4cd5bc4dca1bc035a1eeee1d08248a527348e3be8cb5d25129 and c40bb457a52128f753525937c909cd08ebd8f96d7a5431a4e9751392dc5b487f. The fixture generator checks deterministic bytes, monochrome AV1 sequence headers, and exact Pillow frame pixels. The complete AVIF loop-witness parity test also passed with the new two-frame case registered.

The focused make coverage-selected row passed 1/1. Its report is .coverage-mcp/local-evidence/selected/avif-hi10-monochrome-20261027/coverage.json (SHA-256 c4bd568056ec0057874090638622796c26ed583d601551307bb18ac0f91263a7). Raw LLVM branch counters record one false outcome at src/codecs/avif/av1/entropy.rs:10787, where the older full report recorded zero. Coverage MCP still lists the span because the selected report also has a zero-count branch record at that same coordinate. Both reports have unverified source identity, and the incremental comparison is incomparable because the baseline detail is incomplete; no aggregate coverage gain is claimed. No production Rust code or unit tests were added.

At the monochrome parity row, the fixture matrix contained 2,641 total rows: 2,113 decode / inspect / verify rows and 528 encode rows. Of those, 2,113 decode rows and 497 encode rows were active; 31 planned encode rows remained.

AVIF I422 compound-reference parity — 2026-10-27

Added the active public parity row decode:avif:animated_lossy_inter_422_compound_refs_b64x32. Its deterministic three-frame 64x32 8-bit I422 sequence uses compound prediction from both prior references on the final inter frame. The pinned generator verifies repeated encoding, AV1 4:2:2 headers, the selectable reference list, and exact Pillow 12.2.0 RGB frames. The 5,565-byte input SHA-256 is 58179bf4eec6cd6a78dc575646dc3db0fa30b0d8c844f74a1dbf02694c785350; frame hashes are aff58d48982f1c9f12bc4e1161fed09f6128f2f786b5d2c43c9f50f0fa0ec7b9, b971221eb15826e56645181490b7db5eb89625680368ea7d9453809714e30ecb, and df257674ce899a4c3fba6125261fd00827a9d1b551d4f8e1c55cc86f34b34491. The independent pinned libavif observation decodes all three frames and reports infinite repetition.

The selected public parity and branch-coverage run passed 1/1, matching all 6,144 RGB bytes per frame. Its LLVM report is .coverage-mcp/local-evidence/selected/avif-i422-compound-20261027/coverage.json (SHA-256 e5abd916ac03cf71c3656647b300abfa1b915b71c5ffcc3e505fdc13392e0bea). Raw branch counters at src/codecs/avif/av1/block.rs:48348 record eight true-arm hits in the decode_inter_compound_translation specialization; the saved full baseline had zero true-arm hits there. This is branch-specific selected evidence. Coverage MCP marks source identity unverified and test attribution unknown; its incremental comparison is incomparable because baseline detail is incomplete. No aggregate coverage gain is claimed. No production Rust code or unit tests were added.

The current fixture matrix contains 2,653 total rows: 2,117 decode / inspect / verify rows and 536 encode rows. Of those, 2,117 decode rows and 505 encode rows are active; 31 planned encode rows remain.

WebP alpha filter no-win parity — 2026-10-27

Added active encode parity row encode:webp:enc_lossy_rgba_alpha_filter_no_win. Its deterministic 512x512 RGBA PNG uses a seeded 32-color alpha palette whose sampled residuals favor horizontal filtering while the full-plane encoder keeps the unfiltered alpha representation. The generator checks the PNG bytes; the exact Pillow 12.2.0 encoded reference is 157,078 bytes. The input SHA-256 is 343008603074288cbdad755679e6e6f0c78e9cb8b96b73cffcb7b316f7229210, and the encoded reference SHA-256 is 715914879a0bcc255e9e736fbe69ce3f395be11bf7d9685cec7406079b7f5bac.

The selected public parity run passed 1/1 and matched the decoded 512x512 RGBA pixels. Its report is .coverage-mcp/local-evidence/selected/webp-alpha-filter-no-win-512-20261027/coverage.json (SHA-256 3b123e8d36d2b00410ede33334638ec523e0e00a6d8be9520fa5076c7e1065ef). Raw LLVM branch counters at src/codecs/webp/native/encoder.rs:3082 record 0 true and 3 false outcomes for this row, reaching the full-plane no-win arm. Coverage MCP returned I/O error: No such file or directory for this report path, so this is local selected-run evidence without an MCP source/build receipt.

The refreshed full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its retained report is .coverage-mcp/local-evidence/full-20261027-webp-alpha-filter-no-win/coverage.json (SHA-256 33574fd55eee1fca407017c16864582f83583eb6e5327de32078e17cfda1982e). Totals are 93,818/139,562 lines (67.2232%), 18,627/32,042 branches (58.1331%), 5,224/8,928 functions (58.5125%), and 143,268/216,612 regions (66.1404%). At line 3082, the full report records 23 true and 3 false outcomes. Relative to the preceding retained full report with the same denominators, the local LLVM totals add one covered line, branch, and region. Coverage MCP has not verified that incremental comparison or source/build identity. All four repository floors pass. No Rust implementation change or unit test was added.

WebP VP8L box-chain max-match parity — 2026-10-27

Added active parity rows encode:webp:enc_lossless_method_6_box_chain_max_match and encode:webp:enc_lossless_method_6_box_chain_max_match_token. Their pinned PNG source contains three rows of six colors arranged so palette packing gives the box-chain search a match longer than 4,095 packed pixels after a shorter hash-chain match. The source SHA-256 is c07464a1965f2fd029193f05cb0f1da90740d046570b30a66bd86dd2d2ea5df3; its RGB pixels hash to 809865969461d792ec552fbe8040f3f59abc39fa4f4da222d3b715d058f2dfe6. Pillow 12.2.0 produces the same 76-byte encoded reference for both API paths, SHA-256 d012caba3e51c61643abd86874b13d55c5a178de871c5469896f01bab7bc46c2.

The selected public parity run passed 2/2 and re-decoded exact 8,196x3 RGB pixels. Its LLVM report is .coverage-mcp/local-evidence/selected/webp-box-chain-max-match-3row-20261027/coverage.json (SHA-256 75812713bbe7aaf9fac5e426cf8d037c620837a739d780a0af6fedca0fd62a60). The selected report records both outcomes for the token-aware and ordinary search guards in src/codecs/webp/native/encoder/backward_refs.rs: line 655 has 4 true and 28,677 false outcomes, and line 695 has 24 true and 172,062 false outcomes. Coverage MCP returned I/O error: No such file or directory for this report, so source/build identity and incremental attribution remain unverified. This is local selected-case evidence; it does not establish an aggregate coverage gain. No Rust implementation change or unit test was added.

The refreshed full make coverage run passed 57/57 integration tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full-20261027-webp-box-chain-max-match/coverage.json (SHA-256 1dbec9f10af5d98aa82689d1af36930c2cc3ae62066689503fdd2d790b0eb500). Totals are 93,818/139,562 lines (67.2232%), 18,629/32,042 branches (58.1393%), 5,224/8,928 functions (58.5125%), and 143,268/216,612 regions (66.1404%). The full report records 4 true / 53,426 false outcomes at line 655 and 24 true / 4,396,437 false outcomes at line 695. Against the preceding full report with the same denominators, two additional branches are covered; the line, function, and region totals are unchanged. All four repository floors pass. Coverage MCP also returned I/O error: No such file or directory for this full report, so the new totals remain local LLVM evidence without MCP source/build attribution.

The current matrix contains 2,649 rows: 2,117 active decode rows, 501 active encode rows, and 31 planned encode rows.

WebP token-aware input preparation parity — 2026-10-27

Added active parity rows encode:webp:enc_lossless_bilevel_token, encode:webp:enc_lossless_luminance_alpha_partial_token, and encode:webp:enc_lossy_opaque_rgba_token, reusing the pinned Pillow source assets 1bit.png, gray_alpha_partial.png, and rgba.png. The exact Pillow 12.2.0 encoded references were generated; all three selected public parity rows passed and re-decoded their expected pixels.

The selected LLVM report is .coverage-mcp/local-evidence/selected/webp-token-adapter-branches-20261027/coverage.json (SHA-256 7e9e27eb60d88568a069c048b70c0c7dd11b3a00c7aa98e4fabb578daeeb398f). It records the token arms in src/codecs/webp/encode/mod.rs: line 533 has 1 true and 3 false outcomes, line 620 has 1 true and 3 false, line 731 has 1 true and 3 false, and line 738 has 1 true outcome for partial-alpha expansion. Coverage MCP returned I/O error: No such file or directory for this report, so these remain local selected-case observations without MCP source/build attribution. No codec implementation change or unit test was added; no aggregate coverage gain is claimed from this selected run.

The current matrix contains 2,652 rows: 2,117 active decode rows, 504 active encode rows, and 31 planned encode rows.

WebP token-aware CMYK preparation parity — 2026-10-27

Added active row encode:webp:enc_lossless_cmyk_token using the existing Pillow CMYK source baseline_cmyk.jpg. Its pinned Pillow 12.2.0 output matches the ordinary lossless CMYK case exactly: 16,780 encoded bytes with SHA-256 6f7509153181e2346a376b97c4b15e00ed5fe1fd0b19f74d25dcf93c5fe3ead1.

The selected public parity run passed 1/1 and re-decoded 128x128 RGB pixels. Its LLVM report is .coverage-mcp/local-evidence/selected/webp-cmyk-token-preparation-20261027/coverage.json (SHA-256 4341b9d2378483979a675bbd833fdaa0f811ff9f85ea3264fe2e916184dc1829). It records the token arm in src/codecs/webp/encode/mod.rs:1090 (1 true and 3 false outcomes). Coverage MCP still cannot access reports in this managed worktree; local selected evidence has no MCP source/build attribution. No codec implementation change or unit test was added, and no aggregate coverage gain is claimed from this selected run.

The current matrix contains 2,653 rows: 2,117 active decode rows, 505 active encode rows, and 31 planned encode rows.

The refreshed full make coverage run passed 57/57 integration tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full-20261027-webp-token-adapters/coverage.json (SHA-256 14c849230bf7f07e8403ed3ce5f3920ec7cec658a2fdb8d1547bc9a2a94f80cc). Totals are 93,858/139,562 lines (67.2518%), 18,633/32,042 branches (58.1518%), 5,224/8,928 functions (58.5125%), and 143,363/216,612 regions (66.1842%). The preceding full report has the same denominators; the four token parity cases add 40 covered lines, 4 branches, and 95 regions. All four repository floors pass. Coverage MCP still returns I/O error: No such file or directory for reports under this managed worktree, so the refreshed full totals are local LLVM evidence without MCP source/build attribution.

WebP encoder dimension boundary parity — 2026-10-27

Added five active parity rows at the WebP encoder's maximum side dimension, using deterministic one-row RGB PNGs. Both lossless and lossy Pillow 12.2.0 accept width 16,383 and reject 16,384; lossless also rejects 16,385. The Rust encoder had accepted width 16,384 in both modes. A shared maximum of 16,383 now guards the lossless and lossy paths. The accepted output matches Pillow at 44 bytes for lossless (SHA-256 8a4796055658062fb87856f6d048f1cf9b3944961b9e5b8e1d58357abcf1263f) and 542 bytes for lossy (SHA-256 e67238025de2835593afe703635fa8c58a220e7818affee2ce8a309b1a37608b).

The final-source selected parity run passed 5/5 with no panic. Its LLVM report is .coverage-mcp/local-evidence/selected/webp-dimension-boundaries-final2-20261027/coverage.json (SHA-256 4fef195cc7a038f679ac5013c39ee2d23326c4bf1b1a2f8db18db9a97ec8fe06). The lossless check at src/codecs/webp/native/encoder.rs:2765 records 2 true and 3 false selected outcomes; the lossy check at src/codecs/webp/encode/vp8/encoder.rs:117 records 1 true and 3 false.

The final full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its LLVM report is .coverage-mcp/local-evidence/full-20261027-webp-dimension-boundaries-final/coverage.json (SHA-256 0ccc09fbdd03827e4afa312b7373e8558dc5618a4528fe472d235b463fd65025). Totals are 93,875/139,578 lines (67.2563%), 18,639/32,050 branches (58.1560%), 5,225/8,929 functions (58.5172%), and 143,380/216,629 regions (66.1869%). All four repository floors pass. Coverage MCP previously returned I/O error: No such file or directory for a report under this managed worktree, so these totals are local LLVM evidence without MCP source/build attribution.

The current fixture matrix contains 2,673 total rows: 2,120 decode / inspect / verify rows and 553 encode rows. Of those, 2,120 decode rows and 522 encode rows are active; 31 planned encode rows remain.

WebP lossless EXIF output-reuse parity — 2026-10-27

Added active row encode:webp:enc_lossless_exif_metadata_reuse using the existing 1x1 PNG and EXIF bytes. The 74-byte output matches Pillow 12.2.0 (SHA-256 10418c63af7178aff19eb7b9f6ebe473621543f4e3dadee3e839b3747814cd35). The selected public parity run passed 1/1, including sink output parity and exact re-decode. Its LLVM report is .coverage-mcp/local-evidence/selected/webp-lossless-exif-reuse-20261027/coverage.json (SHA-256 53c006d7abb0a28366c24fd8ef38b45a77ffc100275dbf3cea4bcc618cf9069b). It reaches the VP8L base-container fallback in src/codecs/webp/encode/mod.rs:919; the full report now records both sides of that VP8X check (3 true, 16 false).

The refreshed full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. Its report is .coverage-mcp/local-evidence/full-20261027-webp-metadata-reuse/coverage.json (SHA-256 2931c9883d1de559c9fea7a00bd32fddf837d7a2f4bd159a2664a2d82563016d). All four repository floors pass. Coverage MCP has returned I/O error: No such file or directory for worktree-local reports, so this is local LLVM evidence without MCP source/build attribution.

WebP VP8 plane-padding helper cleanup — 2026-10-27

Local LLVM coverage showed an unobserved height == padded_height outcome in pad_plane. Its only caller, pad_plane_with_token, returns the input plane when both dimensions are already padded and calls pad_plane only otherwise. Renamed the helper to pad_plane_unaligned and removed that redundant guard; the aligned direct-return path remains in the caller. The existing aligned 32x32 and unaligned 17x17 Pillow parity cases passed 2/2, including exact encoded-byte parity, re-decode, and sink checks. Their selected LLVM report is .coverage-mcp/local-evidence/selected/webp-plane-padding-helper-final-20261027/coverage.json (SHA-256 d4616e5f21d26ffdf915317e561643c5a783b48e0f2360f4de1e01b462b0b740); its local receipt says the source did not change during the run.

The refreshed full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. All four repository floors pass. The report is .coverage-mcp/local-evidence/full-20261027-webp-pad-plane-cleanup/coverage.json (SHA-256 6f5d837cedc8937e160500758b142bde50e3c2e12f6685b94aa7d52be24355cf). Totals are 93,879/139,581 lines (67.2577%), 18,636/32,046 branches (58.1539%), 5,225/8,929 functions (58.5172%), and 143,377/216,624 regions (66.1870%). Coverage MCP still cannot read reports under this managed worktree, so these are local LLVM measurements without MCP source/build attribution. After the source change, make fmt, make lint, and make lint-x86-simd passed; make test-feature-matrix passed every native, wasm32-wasip1, and wasm32-unknown feature lane, and the generated capability tables agreed.

An exploratory exact-parity row for quality 80/method 4 on the same 32x32 source initially exposed a VP8 encoder difference: Rust produced 76 bytes while Pillow produced 80 bytes, although both decode to the same RGB pixel SHA-256 (0c1680535c7baa47105185e3f379d36376fd4b3be62cc9e76aceb696829f2d2d). That probe was not retained. An exhaustive public-API sweep over quality 0 through 100 and method 0 through 6 found no parameter pair matching Pillow's output. The follow-up below fixed the mode decision and added two active parity rows.

WebP quality-80 method-4 flat-block parity — 2026-10-27

The mismatch came from libwebp's PickBestIntra16 scoring rule: for a uniform source macroblock, it doubles distortion and spectral distortion while the quantized luma AC coefficients remain flat, then stops applying the rule once a candidate is no longer flat. The Rust encoder omitted that ordered update and could select Intra16 where Pillow/libwebp selected Intra4. The Rust path now applies the method-3-or-higher rate-distortion rule in candidate order.

Added active Pillow rows encode:webp:enc_lossy_quality_80_method_4_uniform_rgb_32x32 and encode:webp:enc_lossy_quality_80_method_4_nonuniform_rgb_17x17. The uniform 32x32 output is 80 bytes (SHA-256 d5b33a6a4452d87928c7956be970a09f66bf33b024f91df67b61222017617f3d); the nonuniform 17x17 edge-padded output is 380 bytes (SHA-256 9c01cd551254909ec5028d6470d2f83af7ab936fc0146c9b9738432d40f6df10). Both selected public parity rows passed, including exact reference bytes and re-decode pixel parity: 2/2 rows, 8 encode calls, no failures or panics. The selected LLVM report is .coverage-mcp/local-evidence/selected/webp-flat-intra16-q80-m4-final-20261027/coverage.json (SHA-256 441c71287eb33384d45ac980f60ab81306037d03c68dff1672e878aabbf595ec). Coverage MCP still returns I/O error: No such file or directory for reports inside this managed worktree, so the report is local LLVM evidence without MCP source/build attribution.

WebP shifted-row lossless cost-manager parity — 2026-10-27

Added active parity rows encode:webp:enc_lossless_cost_manager_shifted_rows and encode:webp:enc_lossless_cost_manager_shifted_rows_token. The deterministic 2,048x512 RGB input is generated by scripts/generate_webp_cost_manager_shifted_rows_fixture.py; its PNG SHA-256 is c190d493dc2f746a76d1b73be5aa7232ab2fddf4fbd496d54fc7691cc93a303f. Both Pillow 12.2.0 outputs are 5,336 bytes with SHA-256 16cbe243b738c77fd6f21ac77157fbb1de47ce129d36d4bec7ef304f40c32240.

The selected public parity run passed 2/2 rows, with 9 encode calls and no panics. The selected LLVM report is .coverage-mcp/local-evidence/selected/webp-cost-manager-shifted-rows-20261027/coverage.json (SHA-256 ad1166369ea05545d32d9ff20704b0688495712d57bdfa0d0061d3a2f56eb285). A local branch-coordinate comparison against the preceding full report found one newly covered token-aware histogram checkpoint outcome at src/codecs/webp/native/encoder.rs:1684. The input does not reach the cost-manager 500-interval fallback at backward_refs.rs:1604 or backward_refs.rs:1712; the separate fragmented-stream run below also stays below saturation. Coverage MCP cannot read reports in this managed worktree, so this selected result has no MCP source/build attribution. No unit test or codec implementation change was added.

WebP fragmented-stream lossless cost-manager parity — 2026-10-27

Added active rows encode:webp:enc_lossless_cost_manager_fragment_stream and encode:webp:enc_lossless_cost_manager_fragment_stream_token. Their seeded 1,024x1,024 RGB source is generated by scripts/generate_webp_cost_manager_fragment_stream_fixture.py; the PNG SHA-256 is a435566d1b22d8405e38ff5588213b5492050a180633586a3d67c673879aef40 and the pixel SHA-256 is 5afff9a4bc1b81d0f066a1f75fd2284cb1405cd28abfa0ffa01c17451e83146a. Both Pillow 12.2.0 outputs are 46,436 bytes with SHA-256 466d1a901e783a9fda34b3af56767991c2fc2be0d4cfc055403bf594d7b6c9a8.

The selected public parity run passed 2/2 rows, with 9 encode calls and no panics. These cases do not reach the ordinary or token-aware 500-interval fallback true arms. The counts previously reported at backward_refs.rs:1604 and :1712 were executions of the below-saturation false arms, not fallback hits. The selected LLVM report is .coverage-mcp/local-evidence/selected/webp-cost-manager-fragment-stream-final/coverage.json (SHA-256 8166475636b977c51ddd13195d8914cebda29767b5240f0f380128f022dd461e). Coverage MCP still cannot read reports in this managed worktree, so this selected result has no MCP source/build attribution.

Parity exposed an encoder limit mismatch: libwebp 1.6.0 caps MAX_COLOR_CACHE_BITS at 10, while the Rust writer allowed 11. The writer and palette candidate path now share the 10-bit cap, matching the upstream definition in libwebp 1.6.0. No unit tests were added.

Full parity coverage refresh — 2026-10-27

The final full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, and 69/69 feature-gate tests. The retained LLVM report is .coverage-mcp/local-evidence/full-20261027-webp-cost-manager-final/coverage.json (SHA-256 b7b2637a7f78c6134bf9d266c42be0a3ce1e6e7c2f6999d615d910aac86c22e). Totals are 93,914/139,613 lines (67.2674%), 18,647/32,056 branches (58.1701%), 5,229/8,933 functions (58.5358%), and 143,413/216,663 regions (66.1917%). All four repository floors pass; the 100% coverage goal remains open.

The selected WebP fragmented-stream parity run does not reach either cost-manager saturation arm at src/codecs/webp/native/encoder/backward_refs.rs:1604 or :1712; it reaches only the below-saturation arms. The earlier claim that its 175,224 and 29,204 branch counts represented saturated fallback hits was incorrect. The existing Rust feature-gate work-budget contract was rebased to the lower 6,547/6,548 boundary after the pinned libwebp cache limit was corrected. No unit tests were added. make fmt, strict stable/nightly make lint, make lint-x86-simd, and the native/WASI/WASM make test-feature-matrix all passed. The SSE2 and AVX2 checks compile their target lanes; no new x86 runtime benchmark was run.

WebP Huffman, predictor-grid, and full coverage recheck — 2026-10-27

After adding the WebP singleton copy-symbol and one-cell predictor-grid parity rows, the full make coverage run passed 57/57 coverage-matrix tests, 7/7 decode-policy tests, 1/1 determinism test, 69/69 feature-gate tests, and all four repository coverage floors. The report .coverage-mcp/local-evidence/full-20261027-predictor-grid-final/coverage.json has SHA-256 985db53124f1c6f35102a8908ba2b98aa247750332487bffd7cb051973b01f10 and totals 93,966/139,636 lines (67.293535%), 18,674/32,068 branches (58.232506%), 5,230/8,934 functions (58.540407%), and 143,479/216,699 regions (66.211196%). This report is local LLVM evidence; it has no Coverage MCP source/build receipt.

The fragmented-stream pair was rerun with the exact selected-coverage command. Both parity rows passed with 9 encode calls and no panics. Its report .coverage-mcp/local-evidence/selected/webp-cost-manager-fragment-stream-current-check/coverage.json has SHA-256 26833aaf106f46d219020a6aa4260b4da989c3226a27140ca3f63e4a0207ce56. Raw LLVM branch counters show zero true-arm hits and 175,224 false-arm hits for the ordinary saturation condition, and zero true-arm hits and 29,204 false-arm hits for the token-aware condition. The full report likewise records zero true-arm hits for both conditions. Coverage MCP identifies the token-aware true arm as missing; source and test attribution remain unverified because no MCP receipt is available. The 500-interval fallback therefore remains an open coverage gap, and 100% coverage is not achieved.

The new enc_lossless_tiny_predictor_grid pair uses a pinned 8×3 RGBA PNG with 24 colors to reach the one-cell predictor-grid case. Its selected parity run passed 2/2 rows with 9 encode calls and no panics; both encoded references are 74 bytes and decode to the expected RGBA pixels. Its local report .coverage-mcp/local-evidence/selected/webp-tiny-predictor-grid-final-20261027/coverage.json has SHA-256 66e3ba306b74eb39836b9bd790f30dbab3dc3698878d1f6253d0662d72133369. Coverage MCP's branch query on the refreshed full report now shows the one-cell clamp_transform_bits arm at line 497 as covered. The remaining missing arms at lines 493 and 501 are defensive under the public method-five and method-six configurations: they cap the initial bits at four and step histogram bits down while the next finer grid would still contain one cell. Under the parity-only test policy, these remain documented coverage gaps rather than being relabeled as Pillow-reachable behavior. Coverage MCP still identifies the ordinary and token-aware 500-interval saturation true arms at backward_refs.rs:1604 and :1712 as missing. These reports have no MCP source/build receipt; MCP results are limited to branch coordinates.

AVIF zero decoder-model tick parity — 2026-10-27

Coverage-guided inspection identified the AV1 sequence-header branch that rejects a zero decoder-model timing tick. Added active row decode:avif:error_sequence_zero_decoder_tick and a deterministic full-file mutation of the pinned animated.avif input. The generated AVIF SHA-256 is 5287aa51ceac1e2128487a90caf3b5b12fcb30348a866ae700da42ccd4d08b49. Pinned Pillow 12.2.0 and Rust produced matching public decode failures; the selected parity run passed 1/1.

The selected local LLVM report is .coverage-mcp/local-evidence/selected/avif-zero-decoder-tick-20261027.json (SHA-256 865eefe0a3fb17031a01002584a8914babacf13c2fdc23154f4d907317802d5b). Its branch record for src/codecs/avif/av1/sequence.rs:169 has 3 hits on the zero-tick true arm. This is selected-run evidence: its receipt marks Coverage MCP source/build attribution as unverified, and the full coverage suite was not rerun. The last full report remains the 2026-10-27 baseline recorded above; the 100% four-metric coverage goal remains open.

WebP token-aware sampling row-mismatch parity — 2026-10-27

Added active row encode:webp:enc_lossless_sampling_row_mismatch_early_stop with a deterministic 8×16,383 PNG source (SHA-256 262b8efe57c954caf1068ea6e63969fbc205b667e85ce4788cc34aa5a75098d6). The selected parity run passed 1/1; Pillow and Rust agree on the 41,090-byte WebP output and decoded pixels. The token-aware encoder enters optimize_sampling and exercises both outcomes of the row-equality check before stopping on a mismatch. It does not reach the 1,024-symbol compaction checkpoint; that checkpoint remains an open coverage gap.

The selected report is .coverage-mcp/local-evidence/selected-20261027-webp-sampling-row-mismatch-final/coverage.json. Coverage MCP identifies the remaining optimize_sampling branch gaps, but reports source attribution as unverified and test status as unknown. These selected-run observations do not establish a full-suite coverage gain or regression. An incremental comparison against the last full report was incomparable because that baseline lacks exact branch detail. No Rust production code or unit tests were added.

The current fixture matrix contains 2,674 total rows: 2,120 decode / inspect / verify rows and 554 encode rows. Of those, 2,120 decode rows and 523 encode rows are active; 31 planned encode rows remain.

WebP token-aware sampling copy-checkpoint parity — 2026-10-27

Added active row encode:webp:enc_lossless_sampling_copy_checkpoint with a deterministic 16,376×8 RGB PNG source (SHA-256 cded007438a8422352d2ff0caa0032487c139d0e594347af511409884cea32b6). The selected parity run passed 1/1: Pillow and Rust produced matching 135,770-byte WebP output and decoded RGB pixels. No Rust production code or unit tests were added.

The selected local LLVM report is .coverage-mcp/local-evidence/selected/20261027T114128.993076Z-96cc277b76a54dfeb8fc72bc3ad5e92e/coverage.json (SHA-256 e82178fd456a82daf739934e84835c25a5f81383bd119608c45b694fbd7b6db5). Its raw branch record at src/codecs/webp/native/encoder.rs:1521 has one true-arm hit and 1,023 false-arm hits, exercising the token-aware copy checkpoint at the 1,024th retained symbol. Coverage MCP's line-targeted query reports no missing arms there. The local receipt records the selected row passing and no source change during the run; Coverage MCP still marks source attribution unverified and test status unknown because no MCP source/build receipt is available. The incremental comparison with the saved full report remains incomparable because that baseline lacks exact branch detail. No aggregate coverage gain is claimed.

The fixture matrix now contains 2,676 total rows: 2,121 decode / inspect / verify rows and 555 encode rows. Of those, 2,121 decode rows and 524 encode rows are active; 31 planned encode rows remain.

AVIF compound I422 direct chroma-grid parity — 2026-10-27

Coverage MCP queried the latest full report, .coverage-mcp/local-evidence/full-20261027-predictor-grid-final/coverage.json (SHA-256 985db53124f1c6f35102a8908ba2b98aa247750332487bffd7cb051973b01f10), and identified the missing true arm at src/codecs/avif/av1/block.rs:48348 in the compound direct-chroma-grid instantiation. Added active row decode:avif:animated_lossy_inter_422_compound_direct_grid_b64x64 with a pinned three-frame 64x64 I422 AVIF. Its largest-transform final frame uses compound prediction and full B64x64 geometry; the fixture generator verifies that frame header and exact Pillow output.

The selected command make coverage-selected COVERAGE_CASES='decode:avif:animated_lossy_inter_422_compound_direct_grid_b64x64' passed 1/1 parity rows. Its local LLVM report .coverage-mcp/local-evidence/selected/20261027T122708.591697Z-83f49fcd5bb145d4ad2dc85e698646b0/coverage.json has SHA-256 0e921871eceaae79ae7db763299f0ae968d5f1b24d86f7525fa7fce6fa935675; the exact compound direct-chroma monomorph records one true-arm hit and zero false-arm hits at that condition. Coverage MCP's selected report query no longer lists that true arm as missing. The local run receipt records the row passing, while Coverage MCP marks source attribution unverified and test status unknown. An incremental comparison against the saved full report is incomparable because exact baseline branch detail is unavailable; no aggregate coverage gain or regression is claimed. No Rust production code or unit tests were added.

WebP token-aware lossy RGBA sequence parity — 2026-10-27

Extended active row encode:webp:enc_sequence_lossy_rgba_keyframes to invoke encode_sequence_with_token and compare its bytes with the ordinary public sequence encoder. The selected Pillow parity case passed 1/1: both APIs produce the same 224-byte WebP, and the decoded two 9×7 RGBA frames match the pinned Pillow pixels. No Rust production code or unit tests were added.

The selected LLVM report .coverage-mcp/local-evidence/selected-20261027-webp-lossy-sequence-token-parity2/coverage.json (SHA-256 2a02bd8fda59310e79190475255378b7a21a1e1230ae8dd5ca9a6e531fc019e7) records two hits on the VP8X true arm at src/codecs/webp/encode/mod.rs:376. The fresh full report .coverage-mcp/local-evidence/full-20261027-after-webp-token-sequence/coverage.json (SHA-256 5f880d21417505dd2a2a5cedd5406c3e17986cc966a5b606f3d2556058fff383) passed all 57 coverage-matrix tests and the full all-features campaign. Coverage MCP reports no missing arms at line 376 and one newly observed true arm versus the previous full report. Overall branches moved from 18,677/32,068 to 18,678/32,068; lines moved from 93,970/139,636 to 93,973/139,636; regions moved from 143,484/216,699 to 143,490/216,699; functions remained 5,230/8,934.

Coverage MCP marks source/build attribution unverified and test status unknown, so its comparison is limited to report coordinates. The local selected receipt records the parity test passing and fixture inputs unchanged during execution.

WebP dense-fragment cost-manager parity — 2026-10-27

Added active row encode:webp:enc_lossless_cost_manager_deep_fragment_stream_token over a deterministic 2,048×1,024 RGB input with a high-cardinality literal palette and overlapping copy fragments. The PNG SHA-256 is c3b7842b11dd2e67ce401cb095a354fd49cdb15ea1c934ca90bddca022995d16. Selected parity passed 1/1; Pillow and Rust produced matching WebP output, and Rust re-decoded the 2,048×1,024 RGB pixels. The local LLVM report .coverage-mcp/local-evidence/selected-20261027-cost-manager-deep-fragment/coverage.json has SHA-256 0d83782cd4a57ef67df85aee73c12b795bd9bf1a4240d6cac9f40b5b4169dada.

The line-targeted Coverage MCP query still reports the true arm of checkpoint_cost_manager_work at src/codecs/webp/native/encoder/backward_refs.rs:72 as missing. A selected-run comparison with the existing fragment-stream row observed four branch arms in the deep-fragment report that were absent from that row, while two arms seen by the existing row were absent from the candidate report. Coverage MCP marks source/build identity unverified and test status unknown, so this comparison is limited to report coordinates and does not establish a verified coverage gain. The larger input remains useful as a method-six token-aware parity stress case; no Rust production code or unit tests were added.

The fixture matrix now contains 2,677 total rows: 2,121 decode / inspect / verify rows and 556 encode rows. Of those, 2,121 decode rows and 525 encode rows are active; 31 planned encode rows remain.

AVIS-only animated sequence without top-level metadata — 2026-10-28

Added active decode row decode:avif:animated_sequence_only_no_meta for a five-frame AVIS sequence with no top-level still-image meta box. The fixture is derived deterministically from the existing animated track-only input and retains its pinned SHA-256. Pillow and pinned libavif 1.4.1 both decode all five 150×150 RGB frames with matching pixels and 33 ms durations; native libavif reports one play. The Rust inspector now accepts this valid sequence without weakening the requirement for an AVIS movie box. Selected parity passed, including exact metadata-limit enforcement.

The current fixture matrix contains 2,680 total rows: 2,124 decode / inspect / verify rows and 556 encode rows. Of those, 2,124 decode rows and 525 encode rows are active; 31 planned encode rows remain.

The local all-feature coverage run passed its configured floors: 94,040 / 139,653 lines (67.34%), 18,705 / 32,072 branches (58.32%), 5,235 / 8,937 functions (58.58%), and 143,580 / 216,726 regions (66.25%). Coverage MCP's report comparison is limited because source/build attribution is unverified; its coordinate query shows the newly exercised no-still-metadata branch and three remaining missing branches in pixel_payload_bytes.

Lossy I444 B8x16 transform-terminal parity — 2026-10-28

Added active row decode:avif:animated_lossy_inter_i444_b8x16_mode_select_64x64 for a deterministic two-frame 64x64 8-bit I444 sequence. The fixture-only libaom encoder controls force vertical B8x16 inter partitions while preserving positive qindex and TX_MODE_SELECT; the Rust decoder remains unchanged. Both exact Pillow RGB frame hashes and the independent pinned libavif one-play observation are retained. The selected parity run passed 1/1 rows and recorded 16 true and 30 false outcomes for the targeted branch at src/codecs/avif/av1/block.rs:51531. Coverage MCP still labels source/build identity unverified for this selected report, so the counts are local LLVM coordinate evidence rather than a verified full-suite coverage claim.

The current fixture matrix contains 2,729 total rows: 2,158 decode / inspect / verify rows and 571 encode rows. Of those, 2,158 decode rows and 540 encode rows are active; 31 planned encode rows remain.

Lossy I422 small-partition parity — 2026-10-28

Added active row decode:avif:animated_lossy_inter_422_small_partitions_32x64 for a deterministic two-frame 32×64 8-bit I422 AVIF sequence. Selected parity passed 1/1 cases with exact Pillow RGB hashes for both frames. The input SHA-256 is f150bd51312eee0a9e7dccc57b3d26fc08899c400d82565b839d704e98c6c029; pinned libavif independently decoded both frames and confirmed one-play sequence metadata.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T133544.038328Z-910da45580dc4afbb9dfcbc62b0a9e48/coverage.json. Raw branch coordinates show 14 branch-record outcomes at previously unhit AV1 block-decoder coordinates. Coverage MCP's older all-active report flagged both arms of decode_inter_split_luma_small_rect_topology at src/codecs/avif/av1/block.rs:52771 as missing; the selected report records one hit for each child_split arm at that span. Coverage MCP could not combine the reports because the older report's detail does not match its aggregate totals; both reports also lack verified source/build receipts. Treat this as targeted coordinate evidence, not a verified full-suite coverage gain. The fixture generator check and fixture-integrity gates pass. No Rust production code or unit tests were added.

The current fixture matrix contains 2,729 total rows: 2,158 decode / inspect / verify rows and 571 encode rows. Of those, 2,158 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF sequence decode A–B–B–A — 2026-10-28

Compared the committed 69a79d4c46b3c8598de020e47345ade1b0e1d304 source (A) with the current AVIF Rust edits (B; diff SHA-256 7f6e6279137c15c28608147ee7e20d2fe13b0bb4e743a3c5494f540aad04df1b) using the release avif-only public sequence-decode probe. The workload is animated_motion_temporal_mv_range_2048x128.avif (SHA-256 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a). Its exact parity row passed 1/1 before timing.

On an Apple M3 Pro running macOS 15.7.7 with rustc 1.96.1, two A–B–B–A cycles collected 48 timed decodes per version after one warm-up decode each. Median latency was 15.466 ms for A and 12.848 ms for B (16.93% lower for B). The timer covers decode_sequence plus dropping decoded output; compilation and input I/O are excluded. The local report is target/oracle-staging/avif-perf-abba-69a79d4c.json (SHA-256 788dcac0f3131a5d8ee292b5b03ce507608e72c8bf50e392f70f56341d32f146). This is one ARM64 workload and does not establish SSE2/AVX2 runtime speed or a general decoder speedup.

Lossy I420 B8x16 mixed-transform parity — 2026-10-28

Added public row decode:avif:animated_lossy_inter_420_b8x16_mixed_topology_64x64 for a deterministic two-frame 64x64 I420 sequence. The fixture-only libaom encoder patch forces vertical B8x16 inter leaves and a mixed transform tree: one TX8x8 child splits into TX4x4 blocks while the other stays TX8x8. Exact Pillow RGB parity passed for both frames, and the independent pinned libavif observer confirms a complete two-frame sequence.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T152427.654345Z-1ec332db4d9543b2a7651e6693cdda2a/coverage.json. Coverage MCP's selected comparison against the retained 32x64 I422 row reports six newly observed branch coordinates in decode_inter_split_luma_small_rect_topology, including the along_rows = true arm at src/codecs/avif/av1/block.rs:52753. The selected raw report records both child_split arms at line 52771. Source and build receipts are unverified, and other generic instantiations still have missing arms, so this is limited coordinate evidence rather than a verified aggregate gain or full branch closure. Two temporary 64x32 variants were removed after their selected reports showed no distinct branch observations. No production Rust code or unit tests were added.

The current fixture matrix contains 2,731 total rows: 2,160 decode / inspect / verify rows and 571 encode rows. Of those, 2,160 decode rows and 540 encode rows are active; 31 planned encode rows remain.

TIFF selected coverage and directory-count audit — 2026-10-29

Coverage MCP's retained TIFF report highlighted Directory::numeric_values_are_nonempty_and_uniform and the raw packed FillOrder path. Exact selected parity runs passed the active decode:tiff:multi_page, decode:tiff:multi_page_multipage_three, decode:tiff:later_ifd_mixed_bits, decode:tiff:later_ifd_empty_bits, and decode:tiff:cyclic_ifd_leniency rows (5/5), plus decode:tiff:fill_order_2_miniswhite_1bit and decode:tiff:fill_order_2_minisblack_2bit (2/2). A third run passed decode:tiff:ycbcr_coefficients_float_type_lzw_2x2, decode:tiff:ycbcr_coefficients_double_values_lzw_2x2, decode:tiff:ycbcr_reference_float_type_lzw_2x2, and decode:tiff:ycbcr_reference_double_type_lzw_2x2 (4/4). The first group compares first-page pixels while exercising multipage and later-directory behavior; the second compares raw 1-bit and 2-bit FillOrder 2 pixels; the third compares float and double YCbCr values against Pillow.

The selected reports are .coverage-mcp/local-evidence/selected/tiff-ifd-uniformity-20261029/coverage.json and .coverage-mcp/local-evidence/selected/tiff-fill-order-packed-20261029/coverage.json, and .coverage-mcp/local-evidence/selected/tiff-ycbcr-floating-values-20261029/coverage.json. Coverage MCP's branch query found no missing groups for Directory::floating_value in the selected float/double report. Coverage MCP still marks source/build identity unverified and test status unknown for these local reports. Its comparison with the retained full report is limited or incomparable, so no aggregate coverage gain or regression is claimed.

The current Directory::parse constructs each numeric entry's byte length as count * type_size, where supported types have a nonzero width. After the count == 0 early return, division by the count therefore yields that exact nonzero width, and the byte length is divisible by the count. The later chunks_exact remainder check is consequently false for entries produced by the public parser. These arithmetic rejection branches do not describe reachable malformed-file behavior; no private unit tests or duplicate parity rows were added. The active mixed-width and empty-field rows cover Pillow's first-page output and record its sequence-enumeration failures for unusable later-page metadata.

The current fixture matrix contains 2,746 total rows: 2,175 decode / inspect / verify rows and 571 encode rows. Of those, 2,715 rows are active (2,175 decode / inspect / verify and 540 encode); 31 planned encode rows remain.

Coverage gap disposition — AVIF, JPEG, and WebP paths — 2026-10-29

The retained full branch report .coverage-mcp/local-evidence/full/current-final-after-compound-tall-lossless-20261028/coverage.json (SHA-256 b12fbc40994d3cf94b6d730e7517e9d2209d7a89d4559f416c82bf97861b362f) lists missing arms in the generic WebP write_token_stream, apply_palette, and encode_alpha_stream helpers. The public frame encoder dispatches Some(token) together with TokenBitWriterCheckpoint, and None together with NoopBitWriterCheckpoint. The reported missing arms pair the no-op checkpoint type with a token or the token checkpoint type without one; that combination is not reachable through the public encoder, so no parity case can exercise it.

The same report lists the vertical_rows == 2 arm in the no-token JPEG downsample_two_to_one helper as unobserved. Public 4:2:0 encoding uses the already-downsampled batch conversion on that path; 4:2:2 reaches this helper with one vertical row, 4:4:4 bypasses it, and token-bearing encoding uses the checkpoint-aware helper. Adding a parity row cannot select the missing no-token 4:2:0 combination.

The report also lists invalid-input arms in container.rs::parse_iloc. The existing decode:avif:error_iloc_version_3 public parity case passed 1/1 under selected coverage. Its local LLVM counters reached the earlier samples.rs::parse_iloc rejection; the container.rs::parse_iloc specialization had zero calls because inspection receives an already-extracted AVIF. The selected report is .coverage-mcp/local-evidence/selected/iloc-version-3-20261029/coverage.json (SHA-256 ba0375814aeb3477ab9880b15dee54c513ef42dc253238648216ee16145d0439); the local receipt records one selected, executed, and passed parity case with no source change during the run. These repeated validation failures are therefore not additional public input paths for this case.

Coverage MCP marks both the retained full report and the selected report as having unverified source/build identity. This is a gap disposition only: no aggregate coverage gain is claimed, and no duplicate fixture or code change was made for these unreachable combinations.

AVIF parser parity and full coverage refresh — 2026-10-28

The full make coverage campaign passed after the AVIF sample-table, property, track, and top-level container parity changes. Its retained report is .coverage-mcp/local-evidence/full/current-final-avif-parser-and-decode-20261028/coverage.json. The configured floors passed: 95,063 / 139,980 lines (67.91%), 18,936 / 32,088 branches (59.01%), 5,272 / 8,955 functions (58.87%), and 145,016 / 217,240 regions (66.75%). All existing test suites in the campaign passed.

Coverage MCP returned no missing branch groups for the targeted samples::parse_stsc, samples::parse_iprp, container::parse_iprp, track_plane, and Meta::transform queries on this report. Public AVIF parity rows exercise the Pillow-compatible trailing stsc payload, malformed property-child cases, zero description index, and duplicate first-wins transforms. The presentation parser's second iprp pass now relies on the already validated InspectedAvif metadata and extracts the first two validated children without repeating structural guards. The full report still has large AV1 gaps, led by Lossy420Decoder::decode_inter_translation_impl.

Coverage MCP marks this local report's source/build identity unverified and its test status unknown because it has no matching receipt. The run output confirms the local suite passed, but no verified aggregate coverage gain is claimed. No unit tests were added. cargo fmt, strict debug/release/coverage Clippy, and the AVIF decode and loop-evidence parity selections passed on this source state; the broader 100% coverage goal remains open.

AVIF sample-table tail and property-child parity — 2026-10-28

Coverage MCP identified an unobserved trailing-payload rejection in samples::parse_stsc and unknown/duplicate-child guards in samples::parse_iprp. Added active rows decode:avif:animated_stsc_trailing_payload, decode:avif:error_iprp_unknown_child, and decode:avif:error_iprp_duplicate_ipma. The trailing-byte fixture preserves both original stsc mapping rows and encoded samples, rebasing iloc and stco offsets by one byte. Its input SHA-256 is afd53fee7738e9b4fe280bb0ff1a19f938cdaad326977abf2cb4266c8e376e4b. Pillow 12.2.0 and pinned libavif 1.4.1 both decode the same five exact frames with 33 ms timing and one play. The two malformed iprp fixtures replace ipma with an unknown child or append a duplicate ipma; Pillow rejects both at open. Their input SHA-256 values are 1d67de2af3d30be3ef552e461fb3a74c3badacd6c6fd84e1e8fb9937fa3d3580 and d6e09f8fcc13fd62817793463188f12b2583ec044a967368af9c977f4cf2b65f.

The Rust stsc parser now matches Pillow and libavif by ignoring bytes remaining after the declared mapping entries. The exact selected parity run passed 3/3 rows: .coverage-mcp/local-evidence/selected/20261028T170536.363506Z-613cb8b3d44c468c9ae3364f9fa65afc/coverage.json. Coverage MCP reports that selected LLVM source/build identity is unverified; these branch observations are targeted local evidence and do not establish a verified full-suite coverage gain. Other AVIF parser branches and the broader decoder coverage goal remain open. No unit tests were added.

The current fixture matrix contains 2,744 total rows: 2,173 decode / inspect / verify rows and 571 encode rows. Of those, 2,173 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF sample-table edge and zero-description-index parity — 2026-10-28

Coverage MCP's saved full report highlighted branches in parse_stsc, parse_iprp, and track_plane. Added five malformed-input parity rows for a nonzero stsc version, an empty stsc table, zero samples per chunk, an empty stco offset table, and a missing ipma association box. Added a successful two-chunk AVIF row whose first stsc description index is zero. The deterministic fixture recipes preserve the encoded mdat samples and are checked by the fixture-integrity command.

Pinned Pillow 12.2.0 and native libavif 1.4.1 both accept the zero-index file, decode five exact RGB frames with 33 ms durations, and report one play. The selected parity run first reproduced Rust's rejection in track_plane; mapping index zero to the first description fixed the mismatch without adding a new allocation or a test-only code path. The same six-case selection then passed 6/6, including exact 67,500-byte frame parity. No private unit tests were added.

The native loop observation uses clean libavif source commit 6543b22b5bc706c53f038a16fe515f921556d9b3; the input SHA-256 is c6f3ff4272a7ade6f51cd77a3c643fb7301e416e4e5ebbd75e4fca4397c5db64. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T164343.283144Z-22e94f916a054e708790594c69aacce7/coverage.json. Coverage MCP can locate the selected parser functions, but marks source/build identity unverified. The selected subset does not establish an aggregate coverage gain; a fresh full report is required for that comparison.

The current fixture matrix contains 2,741 total rows: 2,170 decode / inspect / verify rows and 571 encode rows. Of those, 2,170 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF malformed stsc ordering parity — 2026-10-28

Added active malformed-parity rows decode:avif:error_animated_stsc_first_chunk_not_one and decode:avif:error_animated_stsc_non_increasing_chunk. The first changes the first stsc mapping from chunk 1 to chunk 2; the second changes the later mapping from chunk 3 back to chunk 1. The deterministic generator preserves file length and all mdat bytes. Their input SHA-256 values are 9b54a6a24989c3ca9feaffb1779ced9407a9cad3f864415d0742e9def89eb46a and a6032faac42c6646befcb10470541495702600e98d70fc56dcde3c7fde787f73. Pillow 12.2.0 recognizes both files as AVIF and rejects them at open with UnidentifiedImageError; both exact public parity rows passed.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T162733.149537Z-e8b91d4448be45bb8fa8265ea2c14bfa/coverage.json. Raw counters for the exercised samples::parse_stsc specialization show both outcomes for the first-entry and increasing-chunk guards. A second generic specialization remains unexecuted in this selected run. Coverage MCP marks source/build identity unverified; the incremental comparison with the retained full report was incomparable because its branch detail did not reconcile with the totals, so no aggregate coverage gain is claimed.

The current fixture matrix contains 2,734 total rows: 2,163 decode / inspect / verify rows and 571 encode rows. Of those, 2,163 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF property-association order error parity — 2026-10-28

Added active malformed-parity row decode:avif:error_iprp_ipma_before_ipco. It moves the complete ipma box ahead of ipco in the baseline still AVIF without changing box bytes, file length, or encoded samples. The input SHA-256 is 06d3fa832ab0b96b7108926c8973b30d578617e75aa57a7bbcaabdd53ac2cdd7. Pillow 12.2.0 recognizes the full file as AVIF and rejects it at open; exact public parity passed 1/1. The selected report is .coverage-mcp/local-evidence/selected/20261028T162733.149537Z-e8b91d4448be45bb8fa8265ea2c14bfa/coverage.json. Raw LLVM counters record the first-child ipco ordering rejection in the exercised samples::parse_iprp specialization. Coverage MCP leaves other parse_iprp branches and a second specialization unobserved; source/build identity is unverified, so this is local coordinate evidence only.

The current fixture matrix contains 2,735 total rows: 2,164 decode / inspect / verify rows and 571 encode rows. Of those, 2,164 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF duplicate primary-item transform parity — 2026-10-28

Coverage MCP's saved AVIF branch report identified unobserved duplicate transform guards in Meta::transform. Added active parity row decode:avif:primary_item_duplicate_transform_properties_first_wins with conflicting duplicate irot, imir, pasp, and clap properties. The input SHA-256 is c6b9cfc406f9fd210aa2817d6311791ce27929ef0b0173c06e9b2945b82eeae7. Pinned Pillow 12.2.0 preserves the first property of each kind and produces 49,152 RGB bytes (SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf). The Rust inspection and sample-metadata paths now retain the first associated transform rather than rejecting later duplicates. Selected public parity passed 1/1 rows.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T160458.670138Z-5c88cb05a1594eff9b02085896c7ff5f/coverage.json. Its raw counters record eight true and eight false outcomes for each of the four samples.rs::Meta::transform duplicate guards in the exercised generic specialization. Coverage MCP marks source/build identity unverified and still lists the other specialization without observations. Its incremental comparison with the retained full report was incomparable because baseline branch detail did not match the reported totals. This is targeted local evidence rather than a verified aggregate coverage gain. No unit tests were added.

The current fixture matrix contains 2,732 total rows: 2,161 decode / inspect / verify rows and 571 encode rows. Of those, 2,161 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF monochrome grid 32-bit dimension descriptor parity — 2026-10-28

Added active public parity row decode:avif:portable_lossless_monochrome_grid_32bit_dimensions_73x64 for the 12-byte grid descriptor form that stores both canvas dimensions as 32-bit values. Its input SHA-256 is 40991aa9bee645ee683cb8c562d9db17e3c834e0c6998db90890dc0a498cd2f3. Pinned Pillow 12.2.0 parity passed 1/1 rows and produced the same 18,688 RGBA bytes as the 16-bit-form grid fixture (SHA-256 a553e8c265e29b0644101cff0da8cb54ac351ac4541b86d095ad960445cea987).

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261028T154651.754351Z-3331105e58824b8c952a25e791396dd6/coverage.json. Its local branch counters record eight outcomes for the complete descriptor prefix at src/codecs/avif/samples.rs:1727 and eight outcomes on the 32-bit dimension arm at line 1741. Coverage MCP reports source/build identity as unverified and its comparison does not establish a verified aggregate gain; these counters are targeted local coordinate evidence only. No production Rust code or unit tests were added.

The current fixture matrix contains 2,731 total rows: 2,160 decode / inspect / verify rows and 571 encode rows. Of those, 2,160 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF pasp compatibility parity — 2026-10-29

Coverage MCP's retained full AVIF branch report identified three unobserved invalid-value outcomes in each container::parse_pasp and samples::parse_pasp: zero horizontal spacing, zero vertical spacing, and a nonempty trailing payload. The report has no source/build receipt, so these coordinates were treated as candidates and checked against pinned Pillow 12.2.0 / libavif 1.4.1 before adding parity rows.

Added three deterministic public inputs from primary_item_irot_pasp_4x3.avif. They set horizontal spacing to zero, set vertical spacing to zero, or append one 0xff payload byte while rebasing the file-backed iloc extent. Their input SHA-256 values, in that order, are 1d8ad709f18d1bed97ca2e44178a8b9580aeb79763ea9543d4bc3ef73d62d799, 3f8eef88f63387e8de633f5783d56e3ca8ae6d0ccc5a397969377c2bda3f220a, and e62a08cb8bcb753fcae35739316bfc5ee4c0943879f4d9f6d0ecf087dee2f5c7. The pinned oracle accepts all three and returns the same 18 RGB bytes as the source fixture (SHA-256 efbe5247163f007591d148c7975ad74429fd2282feb0bdec402838155763da38). The encoded mdat bytes remain unchanged.

Both Rust pasp parser paths now preserve these unusable values as opaque properties, matching Pillow's behavior. The sample parser copies bytes only on this ignored-property path; valid pasp parsing retains its existing borrowed span. The three new manifest cases pass selected public parity 3/3. No unit tests were added.

The selected LLVM report is .coverage-mcp/local-evidence/selected/avif-pasp-compat-20261029-retry1/coverage.json. Coverage MCP records the report's source/build identity as unverified and its comparison with the retained full report as incomparable because baseline branch detail does not match its totals. These results are targeted local coordinate evidence; no aggregate coverage gain is claimed.

The current fixture matrix contains 2,749 total rows: 2,178 decode / inspect / verify rows and 571 encode rows. Of those, 2,178 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF truncated top-level header parity — 2026-10-29

Added active parity inputs for a one-byte partial box header after a complete AVIF and for a signature-recognized AVIF containing only its ftyp box followed by that partial header. Pinned Pillow 12.2.0 accepts the complete image with the trailing fragment and returns the same 49,152 RGB bytes as baseline.avif (SHA-256 f1a2555b1c61036af2bd1d3d125a6a1343993873d9e5d58e3caee79989095dcf). It recognizes the incomplete still's AVIF signature and rejects image open as malformed. Both inputs are generated and hash-checked by scripts/generate_avif_container_edge_fixtures.py.

The two new rows and the three existing pasp compatibility rows passed the selected parity run 5/5. Its report is .coverage-mcp/local-evidence/selected/avif-pasp-and-short-tail-20261029/coverage.json. Coverage MCP compared it with the selected over-budget trailing-box report and returned status=limited: source/build identity is unverified and test status is unknown to MCP. The selected reports contain 2,144/32,088 and 2,233/32,088 covered branch observations; the comparison reports 22 newly observed coordinates overall and six in the two extract_inner_with_metadata specializations, including the false meta.is_some() outcome. These are report-coordinate differences, not a verified aggregate coverage gain or regression. No full coverage run was performed for these selected additions.

The current fixture matrix contains 2,751 total rows: 2,180 decode / inspect / verify rows and 571 encode rows. Of those, 2,180 decode rows and 540 encode rows are active; 31 planned encode rows remain.

AVIF stsz branch parity follow-up — 2026-10-29

The retained full report .coverage-mcp/local-evidence/full/20261029-after-stsz-branch-cases/coverage.json had no remaining reported branch gaps in container::parse_stsz or samples::parse_stsz after two public parity rows were added: decode:avif:error_animated_stsz_nonzero_version exercises the samples parser's nonzero-version rejection, and decode:avif:error_animated_sequence_only_stsz_common_size_short_samples exercises the container parser's nonzero common sample-size path. Both rows passed the selected parity run (2/2).

The full all-feature coverage campaign passed all integration executables: animation loop 4/4, capability table 1/1, coverage matrix 57/57, decode policy 7/7, determinism 1/1, and feature gates 69/69. Its totals are lines 95,073 / 139,981 (67.918503%), branches 18,944 / 32,084 (59.045007%), functions 5,272 / 8,955 (58.872138%), and regions 145,030 / 217,242 (66.759651%).

Coverage MCP reports zero remaining parse_stsz branch gaps and two newly observed coordinates against the earlier full report: the false arm in container.rs:1774 and the true arm in samples.rs:2437. The comparison is limited because source/build identity and test attribution are unverified; the coordinate delta is not a verified aggregate gain. No production Rust code, unit tests, SIMD implementation, or benchmark changes were added, and the full 100% coverage goal remains open.

The current fixture matrix contains 2,759 total rows: 2,188 decode / inspect / verify rows and 571 encode rows. Of those, 2,188 decode rows and 540 encode rows are active; 31 planned encode rows remain. AVIF has 688 decode rows.

AVIF stsz trailing-payload parity — 2026-10-29

Coverage MCP's retained full report highlighted missing branch outcomes in container::parse_stsz and samples::parse_stsz. Added the active public parity row decode:avif:animated_stsz_trailing_payload. Its deterministic fixture appends one bounded byte after the declared five sample-size entries, rebases stco and iloc offsets, and preserves the encoded mdat payload. The input SHA-256 is ec5869776d517f36dcbd9d19eb05e8a87dd709b3651a2b2ca00a826cf546f8c3. Two malformed-input rows also exercise an empty sample-size table and a zero-sized sample entry. Pillow rejects both complete files at open; their input SHA-256 values are 00a12f15bb8a108afd79d4a8c3a38f03e2a00180b513c32ecc3c18a2544deffd and 6bf0b1208f1043014565adbfa368a46ac60462faaea837da36fe240604fd6b72.

Pillow 12.2.0 and pinned libavif 1.4.1 both accept the complete input, decode five exact RGB frames with 33 ms timing, and report one play. The two Rust sample-size parsers now stop after the declared entries while keeping all existing bounds checks. The selected public parity run passed 3/3: the valid sequence matched all five 67,500-byte Pillow frames, and both malformed rows matched Pillow's open-time rejection.

The selected report is .coverage-mcp/local-evidence/selected/20261029-stsz-edges/coverage.json. Coverage MCP reports its source identity as unverified and test attribution as unknown. Comparison with .coverage-mcp/local-evidence/full/current-after-loop-hash-fix-20261029/coverage.json is incomparable because the baseline branch detail does not reconcile with its totals. No aggregate coverage gain is claimed; the full 100% goal remains open. The current fixture matrix at that point contained 2,754 total rows: 2,183 decode / inspect / verify rows and 571 encode rows. Of those, 2,183 decode rows and 540 encode rows are active; 31 planned encode rows remain. No unit tests, SIMD implementation, or benchmark changes were added.

AVIF grid descriptor and ftyp parity — 2026-10-29

Coverage MCP's full report .coverage-mcp/local-evidence/full/20261029-after-avif-iref-parity/coverage.json identified three unobserved public grid-descriptor outcomes in samples::Meta::grid_properties: version one, zero output width, and zero output height. Added active rows error_grid_version_1, error_grid_zero_width, and error_grid_zero_height. Their input SHA-256 values are 6d75c008f18bf3c509c79ba810656a0e71d0f1da05c890456af598e51172ddeb, 37b53b695d8d8a97ddba92087ad15de6c75635c970c2dd94d037b6ad6f754bf2, and 3f2fd4d6f618c5527c25a1750b508c5ed7122f69b4a7c44a7c3bd9c4fb5292b6. The deterministic generator verifies that each mutation changes only the eight-byte descriptor and preserves all other file bytes and AV1 media. Pillow 12.2.0 rejects version one with Failed to decode image: Not implemented and both zero dimensions with Failed to decode image: Invalid image grid. The selected public parity run passed 3/3. Rust now classifies the unsupported descriptor version as malformed at the public boundary, matching Pillow's recorded RuntimeError contract.

Coverage inspection also motivated error_ftyp_misaligned_compatible_brand_payload. It appends one byte to the compatible-brand list in ftyp; the generator pins its SHA-256 as ada44e071b8609bc68b65ce123df4dac04b21e4b64d0865ec699bc7425400fc3 and checks that the encoded mdat and idat payloads are unchanged. Pillow rejects the file at open, and selected parity passed 1/1. A 1,025-brand input was also probed: Pillow accepts it, so the parser's existing resource cap was retained and that input was not recorded as an error parity case.

All four public rows were rerun together in this checkout and passed 4/4. The selected LLVM report, local receipt, and captured output are under .coverage-mcp/local-evidence/selected/avif-grid-ftyp-parity-20261029/. Coverage MCP could not combine that selection with the saved full report .coverage-mcp/local-evidence/full/20261029-final-stsd-parity/coverage.json: its baseline branch detail does not reconcile with its totals, and neither report has a verified source/build identity. No aggregate coverage gain is claimed from this selected run.

The final all-feature LLVM run is .coverage-mcp/local-evidence/full/20261029-after-avif-ftyp-parity/coverage.json. All integration executables passed: animation loop 4/4, capability table 1/1, coverage matrix 57/57, decode policy 7/7, determinism 1/1, and feature gates 69/69. Totals are 95,050/139,928 lines (67.927791%), 18,947/32,056 branches (59.105940%), 5,271/8,953 functions (58.874120%), and 145,009/217,183 regions (66.768117%); repository floors pass and the 100% objective remains open. Coverage MCP reports no remaining branches in samples::Meta::grid_properties. Its full-report comparison is coordinate-only because both reports lack verified source/build identities. The additional ftyp row did not change aggregate coverage coordinates. Duplicate private container-parser branches that public inspection rejects earlier remain unclaimed; no private unit tests were added. No SIMD implementation or performance benchmark changed in this batch.

The current fixture matrix contains 2,774 total rows: 2,203 decode / inspect / verify rows and 571 encode rows. Of those, 2,203 decode rows and 540 encode rows are active; 31 planned encode rows remain. AVIF has 703 active decode rows.

AVIF unterminated infe item-name parity — 2026-10-29

The saved full report .coverage-mcp/local-evidence/full/20261029-current-after-av1-inter-translation-depth-contract-final/coverage.json listed both missing branch outcomes in samples::Reader::c_string. Added the active parity row decode:avif:error_infe_missing_item_name_terminator. Its fixture changes the infe item-name terminator in baseline.avif to X, keeps the complete file and AV1 media payload intact, and has SHA-256 b8609cd7fd3acd8c4f7eacad072ed85dcce52c65df9ebd9760ab1e1a8328620d. Pinned Pillow 12.2.0 rejects the full input at open. The selected public parity run passed 1/1.

The selected report is .coverage-mcp/local-evidence/selected/20261029-avif-infe-unterminated-name/coverage.json. Coverage MCP shows one Reader::c_string branch outcome still missing in this measurement; the prior full report showed both outcomes missing. The incremental comparison is incomparable because baseline branch detail does not reconcile with its reported totals. Both reports lack verified source/build identity, so this is coordinate-level evidence and no aggregate coverage gain is claimed. No Rust code, unit tests, SIMD implementation, or benchmark changes were made. No full matrix rerun was performed.

The current fixture matrix contains 2,801 total rows: 2,229 decode / inspect / verify rows and 572 encode rows. Of those, 2,229 decode rows and 541 encode rows are active; 31 planned encode rows remain.

High-depth I422 super-resolution/restoration parity slice — 2026-10-29

The new animated_lossy_inter_422_superres_sgr_10bit_160x56.avif input is a two-frame, full-range 10-bit I422 sequence. Its inter frame is coded at 128x56, super-resolved to 160x56, and applies SGR restoration to all planes. The generator selects TX_MODE_LARGEST, which is required by the existing high-depth I422 restoration admission path. The pinned file hash is 60748f33355d8f8b54f48942e319c1791e75c75c94da55a1568fd6679edf578a; both Pillow 12.2.0 frame hashes and an independent pinned native loop observation are retained.

The focused public parity command make coverage-selected COVERAGE_CASES='decode:avif:animated_lossy_inter_422_superres_sgr_10bit_160x56' passed 1/1. Coverage MCP reports remaining branch gaps in high_depth_lossy_i422_superres_restoration_supported for the selected report at .coverage-mcp/local-evidence/selected/20261029T102753.700076Z-51b908da01e449298ea39b421d64e7de/coverage.json. That report has unverified source/build identity and unknown test attribution, so it does not support an aggregate coverage delta or a full-coverage claim. The fixture matrix now contains 2,801 rows, including 729 AVIF decode rows. This fixture-only slice made no decoder hot-path, SIMD, or benchmark changes.

AVIF inter-frame decoder profile baseline — 2026-10-29

The public workload decode:avif:animated_motion_temporal_mv_range_2048x128 passed its exact three-frame RGB parity case (1/1). On the current ARM64 host, the release avif_perf_probe measured 21 warmed calls at a 12.331 ms median, 12.090–13.661 ms range, and 12.617 ms nearest-rank p95. Host and toolchain details are in .coverage-mcp/local-evidence/perf/20261029-avif-motion-mv-arm64-control/metadata.txt; raw runs are in control-a1.txt.

A separate eight-second macOS sample profile recorded 6,775 stack samples. The largest visible AV1 path was tile entropy/partition reconstruction through validate_tile_entropy_prefixes, validate_complete_lossy_420_partition, and decode_inter_translation_impl; RGB materialization was a smaller path. This profile guides the next experiment but does not provide precise timing by function. The profile is retained as sample.txt beside the run data. This is a single diagnostic baseline from the dirty tree at commit 69a79d4c46b3c8598de020e47345ade1b0e1d304; the candidate comparison is recorded below. This ARM64 profile does not establish SSE2 or AVX2 performance. The repository's strict make lint-x86-simd compile/lint lanes passed for the SSE2 baseline and AVX2 flags on x86_64-unknown-linux-gnu; native x86 runtime parity and timing remain to be measured.

AV1 integer-motion block copy — 2026-10-29

put_unscaled_kernel now copies complete in-bounds rows when both interpolation filters are absent, which is the integer-motion path. The checked PlaneView row slices feed copy_from_slice; filtered blocks and any block touching a plane edge keep the existing replicated-sample kernel. This adds no unsafe code or allocation. It leaves the existing wide SIMD kernels intact; compiler lowering and runtime speed on x86 still need native measurement.

The public sequence probe was rebuilt with all features and measured the same three-frame motion-range input in sequential A-B-B-A order, 51 decoder calls per run and two runs per build. Across 102 measured calls per build, the control median was 13.224 ms and nearest-rank p95 was 14.527 ms; the candidate median was 12.666 ms and p95 was 13.406 ms, a 4.22% lower median on this ARM64 host. The candidate and control binary hashes, toolchain, host, and raw runs are retained in .coverage-mcp/local-evidence/perf/20261029-avif-motion-mv-copy-candidate/. This is one workload on a dirty tree, not a world-record or x86 SIMD claim.

The final candidate passed six selected Pillow parity rows covering the same motion-range workload plus left/right search-window and positive/negative motion on both axes. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261029-avif-motion-copy-final/coverage.json. Coverage MCP identifies the in-bounds copy and clipping fallback as exercised; one checked-add overflow outcome remains unseen. That outcome is unreachable for valid bounded AV1 block geometry on supported 32/64-bit targets, so no synthetic private-line test was added. Coverage MCP marks this selected report's source identity unverified and test attribution unknown; it is not full-suite coverage evidence.

AV1 unfiltered-copy fallback parity and coverage — 2026-10-30

The current candidate passed 13 selected Pillow sequence-parity rows covering multi-tile and large 4:2:0 motion, both temporal search-window sides, four motion-vector range directions, and five lossy inter partition layouts. A separate target-only fault contract forces the unfiltered copy's source-X end addition to overflow; scalar fallback output matched the source row's Pillow reference, and a clean retry matched the injected result. The contract has oracle_status: not_applicable and is reported separately from parity.

The selected report is .coverage-mcp/local-evidence/selected/20261029T215408.343449Z-d50845debbda49bf9b661ade0ca99b9c/coverage.json (SHA-256 3e9ed70bd6994e75a40fe190e1306300880c963ea4e6beff770294ea76ae8900). The selected run passed all 14 rows: 13 parity cases and one fault contract. Coverage MCP's line-filtered queries at the copy helper's checked conversion, addition, and bounds-check locations returned no missing branch groups; the file-level query still reported 29 missing branch groups elsewhere in mc.rs. Its report source identity is unverified and test attribution is unknown, so these results are local coordinate evidence and do not establish an aggregate coverage increase.

A blend-focused selection also passed 15 public inter-inter, inter-intra, and OBMC parity rows alongside 12 target-only fault contracts for motion geometry, copy fallback, difference-mask buffer validation, and wedge-mask validation. All 27 rows passed; the 12 contracts have oracle_status: not_applicable and remain separate from the 15 Pillow parity results. Coverage MCP reports no missing branch groups for fill_wedge_mask; it still reports seven in difference_mask_and_blend, three in reduce_wedge_mask, six in fill_inter_intra_mask, seven and four in the left and top OBMC blends, and one in copy_unfiltered_block_if_in_bounds for this different selection. The report is .coverage-mcp/local-evidence/selected/20261029T220325.244183Z-61b23febdf5b4888a48400724dd680ef/coverage.json (SHA-256 94736238319fa515a57e8f2090d3eb190d9a21301703b926394edd1f4d9a6457). Its source identity and test attribution are unverified, so these remaining function groups are selected coordinate findings rather than aggregate coverage results.

The public three-frame motion-range decode was also measured with five A–B–B–A cycles and five reverse-order B–A–A–B cycles. The baseline and fast-copy candidate medians were 13.428 ms and 12.552 ms in the first order (6.53% lower candidate latency), then 13.952 ms and 12.897 ms in the reverse order (7.56% lower). Raw reports are target/avif-motion-abba/results.json (SHA-256 c084409af23eb1f8541fe9b6fd09a081721cb6bdc68817959d178b47257f13c6) and target/avif-motion-abba/confirmation.json (SHA-256 f2fcd26c528763a4146998d47d9ea3377d3a389972d8072210b5634f29df5966). This repeatable result is for one workload on an Apple M3 Pro ARM64 host; it is not an x86 runtime, SSE2/AVX2, encoder, or project-wide speed claim.

AV1 inter-inter wedge parity — 2026-10-29

Added animated_lossy_interinter_wedge_i420_b16x16_64x64, a deterministic quality-99 64x64 I420 sequence whose sixteen B16x16 inter blocks select masked compound references. The fixture uses the pinned Pillow 12.2.0 / libavif 1.4.1 / libaom 3.13.2 encoder, exact timestamp-normalized input bytes, and retained native loop evidence. Its selected public parity case passed 1/1 with all three RGB frames matching Pillow.

The final selected LLVM report is .coverage-mcp/local-evidence/selected/20261029-avif-interinter-wedge-q99-final/coverage.json. It records 16 calls each to MotionScratch::blend_wedge, fill_wedge_mask, and reduce_wedge_mask, plus 32 retained chroma-mask blends. This confirms the public input reaches inter-inter wedge reconstruction and 4:2:0 mask reduction. Coverage MCP reports no missing branch groups for blend_wedge; it still shows three unobserved failure branches in fill_wedge_mask and ten in reduce_wedge_mask, including empty geometry and short scratch checks that valid bitstream geometry does not reach. The report has no verified source/build receipt and unknown test attribution; comparison with the earlier candidate was incomparable. This is selected-case evidence only, not an aggregate coverage gain or full-coverage claim.

AV1 difference-weighted inter-inter parity — 2026-10-29

Added four deterministic quality-100 64x64 AV1 sequences with B16x16 compound-selectable references: normal I420, inverted I420, I422, and I444. The final source frames follow the difference-weighted blend pattern, and all four selected public Pillow parity rows passed with exact RGB output. Their complete inputs and native repetition observations are retained.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261029-avif-diffwtd-masks-all-layouts/coverage.json. It records 64 calls to difference_mask_and_blend across the four cases and observes both mask-inversion outcomes and the supported I420, I422, and I444 mask-layout paths. Coverage MCP still reports 11 branch observations missing inside that helper, including short-buffer and short-scratch rejection paths. An isolated inverted-I420 run also passed 1/1; its line-filtered query leaves only the non-inverted mask arm missing, while the combined report has no missing observation there. Its source/build receipt is unverified and test attribution is unknown; comparison with the earlier single-case report was incomparable. This is selected-case evidence, not an aggregate coverage delta or full-coverage claim.

Added four target-only fault contracts for first-reference, second-reference, output-buffer, and mask-scratch length guards. The selected run .coverage-mcp/local-evidence/selected/20261029-avif-diffwtd-parity-and-buffer-contracts/coverage.json passed four parity rows and all four contracts. Each contract injects a short internal buffer through the public sequence decoder, checks its Unsupported(NotImplemented) outcome, then retries cleanly and matches the stored sequence parity references. The AV1 block layer maps these internal guard failures to the public unsupported result. Coverage MCP line filters show no missing branch arm at mc.rs:2207, 2212, 2217, 2223, 2230, or 2246; seven other branch observations remain missing inside the helper. The report's source/build identity is unverified and MCP test attribution is unknown; its local log records four parity rows and four contracts passing. This remains selected-case evidence, not an aggregate coverage delta or a full-coverage claim.

AV1 wedge layout parity and mask fault contracts — 2026-10-29

Added deterministic quality-99 I422 and I444 variants of the existing inter-inter wedge sequence. The selected public parity run passed all three supported layouts (I420, I422, and I444). Their three decoded frames match the pinned Pillow outputs, and native loop observations are retained in the AVIF loop bundle.

The same selected run passed six target-only public fault contracts for empty width, empty height, and short scratch in both wedge-mask fill and reduction. Each injected failure returns Unsupported(NotImplemented) through sequence decode, then a clean retry succeeds. Their oracle is not_applicable because the injected invalid private scratch states have no reference input behavior.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261029T084251.538350Z-c5d4841fbb01496daf0b359b4902bd64/coverage.json; its local log records three parity rows and six contracts passing. Coverage MCP reports no remaining branches in fill_wedge_mask and three in reduce_wedge_mask, at mc.rs:704, 707, and 725. A limited selected-test comparison against the I420-plus-contract run observes four additional branch outcomes in this helper and leaves those three. All three require the y-only 4:4:0 subsampling layout, which ChromaSampling::from_subsampling(false, true) rejects. The supported I420, I422, and I444 layout branches are observed; no synthetic private test was added for an unsupported bitstream layout.

Coverage MCP marks both reports' source identity unverified and test attribution unknown, so that comparison is a report-coordinate change rather than a verified coverage gain. This is local selected-case evidence, not a full-suite coverage result or a 100% coverage claim.

Full local coverage refresh and nclx parity contract correction — 2026-10-29

The full local LLVM coverage campaign passed after removing a stale feature contract that treated any bounded nclx tail as malformed. Its byte insertion also enlarged meta, shifting the media extents, so it did not isolate the property. The existing colr_nclx_trailing_payload_ignored parity row moves a tail byte from clap into nclx while preserving container sizes and matches Pillow. The reserved-bit and truncated-field checks remain. The focused avif_primary_cicp_color_matches_the_container_contract integration check passed, and the full AVIF matrix passed with the parity row active.

The full report is .coverage-mcp/local-evidence/full/20261029-current-tree/coverage.json. All coverage-run integration tests passed (139 tests). The repository's current coverage floors pass at 95,217/140,121 lines (67.953412%), 19,032/32,140 branches (59.215930%), 5,279/8,962 functions (58.904262%), and 145,320/217,552 regions (66.797823%). This is a refreshed local baseline, not 100% coverage.

Coverage MCP marks the report source unverified, build ID absent, and test attribution unknown. It reports 13,108 branch observations and 72,232 regions missing. A focused decode_inter_transform_size group has 174 missing branch observations.

A maintained five-frame wide-I444 mode-2 sequence now reaches the true all_roots_split && all_children_split LossyWideMode2Deep16 path at entropy.rs:7165. Its flat gray key frame is followed by checkerboards with 2-, 4-, 8-, and 16-pixel periods. The pinned generator produces a deterministic 62,628-byte input with SHA-256 a806f4585aa11699bc831fff1b02b7f1eacbd2089a88a2578bb6933afbcbdaf0; all five Rust-decoded RGB frames match Pillow exactly at 100 ms each. The selected public parity run passed 1/1. Its LLVM report records four true evaluations for each condition in the Deep16 branch. The independent native loop witness decodes all five frames and reports infinite repetition.

The selected report is .coverage-mcp/local-evidence/selected/20261029T093646.778150Z-c0c438e07bb3402189ec175efd2af3c8/coverage.json. Coverage MCP marks its source unverified and test attribution unknown. The incremental comparison with the preceding full report was incomparable because the baseline branch detail is incomplete. No aggregate coverage gain is claimed, and the full report above remains the pre-row baseline. Other specializations of decode_inter_transform_size still have missing outcomes. The report also leaves seven observations in difference_mask_and_blend; the y-only 4:4:0 mask path remains unavailable through supported AV1 chroma layouts. No synthetic unit test was added.

A deterministic two-frame 10-bit I444 super-resolution/SGR sequence adds input-driven parity for the narrow high-depth I444 restoration profile. Its largest-transform inter frame uses denominator 10, coded size 128x56, upscaled size 160x56, and SGR on all three planes. The 1,656-byte input hashes to d0f13c712995e0464efb51575ca353aabd26c8ff6e3001c415fd98f239c8221c; its two exact Pillow RGB frame hashes are 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 855f30260049bc5f85a057fa91223c85259acc4a55c4ae2d4ec66e45d88e4be6. The selected public parity run passed 1/1 and its LLVM report records the specialized restoration admission path reaching its successful return. The report's source identity is unverified and test attribution is unknown; the incremental comparison with the saved full report is incomparable because its branch detail is incomplete. No aggregate coverage gain is claimed. Native loop evidence confirms two decoded frames and infinite repetition.

The focused report is .coverage-mcp/local-evidence/selected/20261029T095423.557742Z-9a9e5275a438434a93802b8df7b4c102/coverage.json.

8-bit I422 super-resolution/SGR parity — 2026-10-29

Added the active public parity case decode:avif:animated_lossy_inter_422_superres_sgr_8bit_160x56. Its pinned 1,601-byte sequence uses an 8-bit I422 inter frame coded at 128x56, upscaled to 160x56, with largest-transform mode and SGR on all three planes. The two exact Pillow RGB frames match SHA-256 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 06f17713c7758faaac74cd5cabd7d441aed55a41e8e03322a3e339b4a345ac2f. The focused public parity selection passed 1/1. The independent pinned native loop observation decodes both frames and reports infinite repetition. No private unit tests were added.

The public fixture matrix now contains 2,802 total rows: 2,230 decode / inspect / verify rows and 572 encode rows. Of those, 2,230 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 730 active decode rows.

The refreshed full report is .coverage-mcp/local-evidence/full/20261029-avif-i422-superres-refresh/coverage.json. All 139 coverage-run integration tests passed, including the 57-test matrix and 69 feature-gate tests. Totals are 95,700/140,121 lines (68.298114%), 19,286/32,140 branches (60.006223%), 5,299/8,962 functions (59.127427%), and 145,995/217,552 regions (67.108094%), above the current floors. Coverage MCP still reports 12,854 missing branch outcomes overall and 59 in lossy_i422_superres_restoration_supported (with additional outcomes missing in its closures and the high-depth sibling).

The report-coordinate comparison with the preceding full report observed 58 new branch locations, including the accepted I422 restoration path. Source and build identity remain unverified and test attribution is unknown, so this is limited coordinate evidence, not a verified aggregate coverage gain or regression. The 100% coverage objective remains open.

12-bit I422 super-resolution no-restoration parity — 2026-10-29

Added the active public parity case decode:avif:animated_lossy_inter_422_superres_12bit_160x56. Its deterministic 1,675-byte sequence has a 12-bit I422 inter frame coded at 128x56 and super-resolved to 160x56 with restoration disabled. The two exact Pillow RGB frame hashes are 69db76fd576323ba0a068072e8473ed16740c868e8c8c7199063056f97b4f9ed and 3acbd991ecc3cdbea09be468ef346e16f3413c9766e2cc6ebb8690b8e2f69ab6. Its selected public parity run passed 1/1, and the independent native loop observation confirms two decoded frames with infinite repetition.

The selected report is .coverage-mcp/local-evidence/selected/20261029T110505.345865Z-ed4be997988b4adcb851447db40fcd5b/coverage.json. The selected LLVM report records the no-restoration early-return outcome at entropy.rs:13909; Coverage MCP still reports missing outcomes across other function instances. The report's source identity is unverified, build ID is absent, and test attribution is unknown. Its incremental comparison with the full report is incomparable because baseline branch detail is incomplete, so no aggregate coverage gain is claimed. No private unit test was added. The public fixture matrix now contains 2,803 total rows: 2,231 decode / inspect / verify rows and 572 encode rows. Of those, 2,231 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 731 active decode rows.

AVIF trailing incomplete top-level payload parity — 2026-10-29

Added the active public parity case decode:avif:trailing_truncated_top_level_payload. It appends a complete eight-byte free box header declaring an absent eight-byte payload after the complete baseline still. Pinned Pillow accepts the file and preserves the baseline image information and RGB pixels. The selected public parity run passed 1/1 with exact 49,152-byte RGB output.

The selected report is .coverage-mcp/local-evidence/selected/20261029T111854.337976Z-0f0d7202ea63491bb66094fa5e668f57/coverage.json. Its LLVM data records four true-arm hits for the completed-image predicate at container.rs:364. Coverage MCP still reports missing outcomes at that location in other function instances. The report has unverified source identity, no build ID, and unknown test attribution; incremental comparison with the full report is incomparable because its branch detail is incomplete. No aggregate coverage gain is claimed, and no private unit test was added.

The public fixture matrix now contains 2,804 total rows: 2,232 decode / inspect / verify rows and 572 encode rows. Of those, 2,232 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 732 active decode rows.

AVIF animated stss table parity — 2026-10-29

Coverage MCP highlighted samples.rs::parse_u32_records. The public input animated_stss_trailing_payload.avif declares zero stss entries and retains the original sync-sample index as bounded trailing payload. Pillow 12.2.0 and the pinned libavif 1.4.1 observer both preserve five exact 150x150 RGB frames at 33 ms and report one play. The parser now ignores bytes after the declared entries, matching Pillow while continuing to validate each declared index. Two companion full-file cases exercise its failures: a table declaring two indices with only one present, and an unsupported FullBox version. Pillow and Rust both reject each case.

All three selected public parity runs passed 1/1: .coverage-mcp/local-evidence/selected/20261029T113039.761715Z-e28eafef2ac349d7b51623100a843110/coverage.json. .coverage-mcp/local-evidence/selected/20261029T113805.902403Z-ee899468e25f447ead25b495183a3c67/coverage.json, and .coverage-mcp/local-evidence/selected/20261029T113956.214247Z-b670f5556b244611b47ed48cf5a71e1d/coverage.json. The fresh error-case reports show no remaining missing branch at the removed trailing-byte check; their per-case reports still omit the opposite FullBox version outcome. Coverage MCP marks source identity unverified, and the saved full-report comparison remains incomparable because its branch detail is incomplete. No aggregate coverage gain is claimed. No private unit test was added, and no full matrix refresh was run.

The public fixture matrix now contains 2,807 total rows: 2,235 decode / inspect / verify rows and 572 encode rows. Of those, 2,235 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 735 active decode rows.

AVIF track-reference zero target parity — 2026-10-29

Coverage MCP identified missing branches in samples.rs::parse_tref. Added a full-file animated AVIF whose sole auxl reference targets track ID zero. Pillow 12.2.0 and the pinned libavif 1.4.1 observer ignore that target and preserve all five exact RGB frames, 33 ms timing, and one play. The Rust parser now treats target zero as no auxiliary-track mapping while still rejecting duplicate auxl children within one tref box. A companion input with two such children is rejected by Pillow at image open and Rust as well.

The selected parity run included both new rows and the existing duplicate hint reference control; all three passed. Coverage MCP's branch query reports no remaining branch groups in either AVIF parse_tref function for this selected report. The report is .coverage-mcp/local-evidence/selected/avif-tref-auxl-parity-with-hint-20261029/coverage.json (SHA-256 993394543e9bf7fa1b657e211adb1cce6cae87bc67898cbdc4165d422c0f13e8). It has unverified source identity and unknown test attribution, so this is focused parity and branch evidence, not a verified aggregate coverage gain or a 100% coverage claim. No private unit tests were added.

The public fixture matrix now contains 2,809 total rows: 2,237 decode / inspect / verify rows and 572 encode rows. Of those, 2,237 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 737 active decode rows.

AVIF alpha-track timescale parity — 2026-10-29

Coverage MCP highlighted samples.rs::sequence_payload. Added the active sequence_alpha_timescale_mismatch case by changing the alpha track timescale while preserving the color track timescale. Pillow and the pinned libavif observer accept the input and preserve all five RGBA frames with color-track timing. The parser pairs alpha samples by position and keeps color-track timing, matching those observations. No unit test was added.

The focused parity selection, including alpha timescale, duration, and sample count controls, passed 3/3. A wider six-case selection also passed 6/6 and included ordinary animation, a missing-handler track, and an unknown sample entry hint-track control. Its report is .coverage-mcp/local-evidence/selected/avif-sequence-payload-coverage-controls-20261029/coverage.json (SHA-256 6406b51b55b6f39ade719f73b9848fb3517af24fcaeeeeb38a45c1836bceabf9). For this selected report, Coverage MCP still identifies an uncovered false arm in the fallback color-track configuration search and an uncovered true arm at duplicate-alpha-track rejection. The report has unverified source identity and unknown test attribution, so it is focused branch evidence only; no aggregate coverage gain or 100% coverage claim is made.

The public fixture matrix now contains 2,810 total rows: 2,238 decode / inspect / verify rows and 572 encode rows. Of those, 2,238 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 738 active decode rows.

AVIF sequence track selection parity — 2026-10-29

Coverage MCP's sequence_payload query showed the duplicate-alpha rejection and fallback color-track selection branches were still missing. Added sequence_duplicate_alpha_tracks, which duplicates the auxiliary alpha track under a distinct ID while preserving its color reference and sample payloads. Pillow preserves all five exact RGBA frames, and the pinned libavif observer parses and decodes five frames. The parser now selects the first matching auxiliary alpha track, matching Pillow's tolerance of the repeated track. Added error_sequence_no_color_track_candidate, which changes the color handler to soun and its sample entry to zzzz; Pillow and Rust reject this file at open, exercising the fallback search's no-configuration path.

The selected public parity run included these inputs and six alpha/handler controls; all eight cases passed. Coverage MCP reports no missing branch groups for sequence_payload in this selection. Its report is .coverage-mcp/local-evidence/selected/avif-sequence-selection-parity-20261029/coverage.json (SHA-256 92332bda21fc210daeee3530b6d955e64ef49d112492b026ae006797dee0704b). The report has unverified source identity and unknown test attribution, so the result is selected branch evidence only and does not establish aggregate coverage or 100% coverage. No private unit tests were added.

The public fixture matrix now contains 2,813 total rows: 2,241 decode / inspect / verify rows and 572 encode rows. Of those, 2,241 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 741 active decode rows.

The new error_iloc_empty_extent_list parity row uses a primary item with no declared extents. Pillow and Rust both report the public malformed empty-item outcome, and the selected parity run passed 1/1. Its LLVM report records the empty-span branch for both inspection and decode validation. The report is .coverage-mcp/local-evidence/selected/20261029T123329.798172Z-04c836bc22f94f2da32991ea26cf410e/coverage.json (SHA-256 c2514e9acc58d5b2b7b28f37c522d1a518b485f94be34f2379786a9bb7e00b4a). Its local receipt records that the source and fixtures did not change during the run. Coverage MCP returns source=unverified and tests=unknown for this local report, so this is focused branch evidence rather than an aggregate coverage claim.

The current full coverage_matrix_tests run passed 57/57 tests after this row was added. Its report is .coverage-mcp/local-evidence/full/20261029-post-iloc-empty/coverage.json (SHA-256 034c832b488168bfeeb12ffc0642f3097f9d0ef664117a25df20024d8f05fdbc). The local full report records 19,094/32,132 branches; the preceding full report recorded 19,093/32,132 at the same denominator. Coverage MCP now reports no missing groups at the no-payload span check. Its remaining validate_plane gaps are the empty-plane guard, which current AVIF payload construction cannot reach, and opposite READ_PAYLOAD arms in each const-generic specialization, which are compile-time impossible. Coverage MCP still marks this full report source=unverified and tests=unknown, so the aggregate comparison remains local exploration evidence.

AV1 motion predictor geometry fault contract — 2026-10-29

Coverage MCP showed the invalid-geometry arm in MotionScratch::length was unreached by valid AV1 block geometry. Added the target-only fault contract fault-contract:avif:av1_motion_predictor_zero_width_rejected on the existing three-frame motion-range input. The coverage-only hook forces zero width; the public sequence decode reports failure and a clean retry succeeds. The selected case passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261029T124959.015899Z-07eb1054576b4506bdb98a761e97beb1/coverage.json (SHA-256 6abf896b7f0ff32d20ea89d5b0e2d8a84a40fa03964f2598a471b85aef101dc0). The release decoder has no fault branch or added work. Coverage MCP still reports the empty-height and over-limit geometry arms as missing; these are defensive states unavailable from valid AV1 block geometry, so no additional private-line cases were added.

The refreshed all-feature LLVM coverage run passed all six integration executables (139 tests total), including all 57 coverage-matrix tests and every active parity and fault-contract row. Its report records 95,703/140,116 lines (68.302692%), 19,291/32,134 branches (60.032987%), 5,300/8,962 functions (59.138585%), and 146,001/217,543 regions (67.113628%). The report is .coverage-mcp/local-evidence/full/20261029-av1-motion-geometry-contract/coverage.json (SHA-256 d1915b964edb1ada03b98b17024a15933e61795f5d40205413c53261e632670c). Coverage MCP reports 12,843 missing branches, led by 1,574 outcomes in the AV1 inter translation decoder. It marks report source identity unverified and test attribution unknown; the measured totals are local exploration evidence, not a verified aggregate gain or a 100% coverage claim. No private unit tests were added.

AV1 reference-MV geometry fault contract — 2026-10-31

The retained full parity report showed the invalid geometry arms in motion::find_reference_mvs were not reached by active public parity inputs. The report's source identity is unverified, so it served as a local gap hypothesis. Added the target-only fault contract fault-contract:avif:av1_motion_reference_mv_geometry_guard_sweep_rejected using the existing distance-compound AVIF sequence fixture. Its coverage-only hook sends 17 malformed geometry requests through the same validation path; the public sequence decode fails and a clean retry succeeds. The selected fault-contract case passed 1/1 with the oracle marked not applicable. Its source- and fixture-bound local LLVM report is .coverage-mcp/local-evidence/selected/20261031T021111.257732Z-a74c34f89e5e4881b3fdefc6617d5931/coverage.json (SHA-256 05438e46a209acf1d632e40f7c992bd4f7c864fd84cad01f1a7ddb88a9965301). Coverage MCP returned Transport closed, so no managed comparison or coverage gain is claimed.

The normal decoder no longer compares absolute tile starts with ends after checked additions: the shared nonnegative origin preserves relative ordering, and overflow already returns an error. End-versus-frame checks also reject a zero frame extent. The fault hook and sweep compile only for coverage builds; normal decode has no added runtime work. No unit tests were added.

AVIF compatible-brand list parity — 2026-10-29

Pinned Pillow 12.2.0 / libavif 1.4.1 decodes a complete AVIF with 1,025 compatible brands, while the Rust still-image and sequence parsers previously rejected lists above 1,024 entries. Removed that arbitrary cap in both parsers and reserve space for the validated list length, reporting allocation failure through the existing codec error contract. Added the deterministic ftyp_1025_compatible_brands fixture and an active input-only decode parity row; the fixture retains the original metadata and AV1 payload.

The selected exact parity run passed 1/1 with a 128x128 RGB8 output matching the pinned reference (49,152 bytes). Its report is .coverage-mcp/local-evidence/selected/20261029-avif-ftyp-1025-compatible-brands/coverage.json (SHA-256 c65c9306d674d9414289a5fb7f1905f12184a3edc921d4fc0cc6c94a7891232b). Coverage MCP marks this local report's source identity unverified and test attribution unknown; it is focused parity evidence, not an aggregate coverage claim. No unit tests were added.

The existing error_ftyp_misaligned_compatible_brand_payload parity row also passed 1/1 in a separate exact selection. Its report is .coverage-mcp/local-evidence/selected/20261029-avif-ftyp-misaligned-brands/coverage.json (SHA-256 2dc36188e9a1575fed124ed9cd9e5e7e90c6a9fd11aa1c7fe81799b5f8409392). Coverage MCP still returns missing parse_ftyp branch locations for that selection. Both selected reports have unverified source identity and unknown test attribution, so this run confirms the public malformed-input result but does not establish branch closure.

At this coverage refresh, the fixture matrix contained 2,817 total rows: 2,245 decode / inspect / verify rows and 572 encode rows. Of those, 2,245 decode rows and 541 encode rows were active; 31 planned encode rows remained. AVIF had 745 active decode rows.

AV1 wide lossless inter parity and coverage refresh — 2026-10-29

The existing public cases animated_lossless_inter_420_b128x128_10bit, animated_lossless_inter_420_wide_grid_b128x128, and animated_lossless_compound_wide_i420_b128x128 passed exact Pillow parity (3/3). Their selected LLVM report is .coverage-mcp/local-evidence/selected/20261029-av1-wide-inter-parity/coverage.json (SHA-256 a67c69e6591ca2f9a7711f13ad0784461e08de61b908cf8672bf74d8c6713995). Coverage MCP still reports branch outcomes in decode_inter_translation_impl around lines 48437 and 48469 for other compiler specializations. The report has unverified source identity and unknown test attribution; selected-case gaps do not establish a full-suite regression or justify adding cases that only force internal state.

The refreshed all-feature LLVM coverage run passed all six integration executables (139 tests total), including all active parity and fault-contract rows. Its report records 95,704/140,121 lines (68.300968%), 19,286/32,126 branches (60.032373%), 5,300/8,964 functions (59.125390%), and 146,001/217,547 regions (67.112394%). make coverage passed the owner-approved alpha floors. The report is .coverage-mcp/local-evidence/full/20261029-exporter-refresh-retry/coverage.json (SHA-256 17555db046f3ecd2425703abdcdc971217d460bdc7da67c06cf1b4205a18138a). Coverage MCP reports 12,840 missing branches, led by 1,574 outcomes in the AV1 inter translation decoder. Its source identity remains unverified and test attribution unknown, so these totals are local exploration evidence rather than a verified aggregate gain or a 100% coverage result.

AVIF I444 direct-chroma-grid parity — 2026-10-29

Coverage MCP identified missing branch outcomes around the direct chroma-grid sampling decisions in decode_inter_translation_impl. Added the active parity case animated_lossy_inter_444_direct_grid_mode_select_mixed_b128x64, using a pinned 8-bit I444, three-frame 128x64 AVIF fixture (SHA-256 8eb2916792a241372d03d5ccf1802549363ad61325c3ec3489b36752aaa7cfc2). The fixture generator verifies deterministic bytes, AV1 profile/frame syntax, and all three pinned Pillow RGB frame hashes. The native loop bundle independently records three decoded frames and the infinite-repeat observation.

The selected public parity run for the existing I422 companion and new I444 case passed 2/2, with exact RGB comparison for both sequences. Its LLVM report records both branch outcomes at source lines 48335 and 48369 in the executed single-reference lossy direct-grid specialization. Coverage MCP still reports other groups at those source coordinates; the report is local-only, its source identity is unverified, and test attribution is unknown. This is focused parity/coverage evidence, not verified aggregate branch closure. Report: .coverage-mcp/local-evidence/selected/20261029T144419.910177Z-a2f04b18bae841c2889af2239472a0ed/coverage.json (SHA-256 8a03cfb5aa1a23c238763fdbb8c0af88f0971c852c496243987d482599917fca). No Rust unit tests or runtime decoder changes were added.

AV1 clipped-wide monochrome parity and lossless-grid invariant — 2026-10-29

Added the input-only parity row animated_lossless_inter_monochrome_clipped_b128x128_124x128, a two-frame monochrome AV1 sequence with a 124x128 frame and a B128x128 lossless inter grid. The deterministic generator checks the AV1 syntax and pinned Pillow 12.2.0 RGB hashes. The fixture is 21,898 bytes (SHA-256 7553404e35f1583e5bb2e785acb4908de5a4bbfa8d888054b163cc8da32391e8); its two Pillow frame hashes are f503c9af04a4099c03bedb1461014aa8e4ef8668506fd169c523d7a862e22b87 and 6717767046bca15b0c19c8ef51ad4abd60dbc6d1effacd520dd2398f2d572f1a. The selected matrix parity run passed 1/1, and the native loop witness check passed with two decoded frames and infinite repetition.

The coverage audit found allow_clipped short-circuit arms in decode_inter_lossless_wide_grid. Its only caller passes lossless_partial_grid, whose predicate permits B32x32 plans, while this wide path requires a dimension above 64. Those arms were therefore unreachable in this function. Removed the redundant parameter and retained full coded-raster validation; the call graph has the same accepted inputs and fewer runtime conditions. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261029-av1-lossless-wide-invariant/coverage.json (SHA-256 00b0137fc00b8f54042a0572c6a19574a6502a178318c7dabb2b6170d434dc8c). Coverage MCP marks its source unverified and test attribution unknown, so the report is focused local evidence only. No Rust unit tests were added.

The current fixture matrix contains 2,821 total rows: 2,249 decode / inspect / verify rows and 572 encode rows. Of those, 2,249 decode rows and 541 encode rows are active; 31 planned encode rows remain. AVIF has 749 active decode rows.

The refreshed all-feature LLVM run passed all six integration executables (139 tests total), including 57 coverage-matrix tests and every active parity row. make coverage-check passed the maintained floors. The strict 100% gate still fails: lines are 95,701/140,117 (68.300777%), branches 19,284/32,122 (60.033622%), functions 5,300/8,964 (59.125390%), and regions 145,999/217,544 (67.112400%). Report: .coverage-mcp/local-evidence/full/20261029-cwd-wide-grid-invariant/coverage.json (SHA-256 aab419bd797f37e5128618e4d37f5e618b6176e4ae1ee5b0be84ec1441f4b8a2). Coverage MCP reports 12,838 missing branches, led by 1,574 outcomes grouped under decode_inter_translation_impl. It marks source identity unverified and test attribution unknown; these aggregate totals remain local exploration evidence, not a verified coverage gain or 100% result.

10-bit mixed-lossless AV1 inter parity — 2026-10-29

Added the active input-only parity row animated_mixed_lossless_inter_b32_i420_10bit_impulse_residual_64x64. Its deterministic fixture generator proves a 10-bit I420 sequence, a TX_MODE_SELECT inter frame with mixed lossy and lossless segments, and one residual in the non-skipped B32 ROI. The 2,948-byte AVIF input SHA-256 is 9a136b442ee7f742259cabc9bb1b2ce68004f9831eb4b169f08fa507f6dabbce; its Pillow RGB frame hashes are dcf046d69b3aa8558665fb2b20eddc466cd6a3c1cacc05104345a251a302b0b2 and 4d19f63fcc4cbee56812b9cca517b4d27f5fadfb3c75e9dad84543026f430e32. The native loop bundle records two decoded frames and infinite repetition.

The selected public parity row and the existing av1_inter_translation_sample_depth_mismatch fault contract passed together (2/2). Coverage MCP reports no remaining branch locations in mixed_lossless_inter_transform_mode_enabled for that selection, including the high-bit-depth arm. The selected report is .coverage-mcp/local-evidence/selected/20261029T174202.868798Z-42d5ff2298c64d26896c06a1cf4e078d/coverage.json (SHA-256 ec7ef2862f0b54fc447d39dc8e92f026b70d97edbbb6174b1d023045c609beaf). Its source identity is unverified and test attribution is unknown, so it proves focused branch reachability only; no aggregate coverage gain is claimed. No Rust unit tests were added.

make lint and make lint-x86-simd pass, including strict debug, release, coverage-configured, SSE2-baseline, and AVX2 Clippy lanes. The fixture matrix now has 2,820 rows, including 748 active AVIF decode rows. A seven-iteration local AVIF probe on Darwin 24.6 arm64 and Rust 1.96.1 decoded animated_motion_temporal_mv_range_2048x128 (input SHA-256 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a) in a median of 11,936,583 ns (range 11,740,500–12,998,583 ns). This is a current working-tree diagnostic without an A/B comparison, so it does not establish a speedup. The broader 100% coverage and SIMD performance goals remain open.

AV1 chroma-mask sampling type and parity check — 2026-10-30

Motion-compensation wedge and difference-mask helpers now take the existing ChromaSampling enum instead of independent X/Y booleans. This prevents the unsupported 4:4:0 y-only layout from entering private mask code. Wedge reduction handles 4:2:0 and 4:2:2 explicitly, while full-resolution and monochrome masks remain unchanged. Difference-mask reconstruction copies full-resolution rows directly for those layouts. No buffer allocation or per-sample arithmetic was added, and odd-width edge replication remains preserved.

The selected run passed eight input-only Pillow parity rows for inter-intra wedge and inter-inter wedge/difference masks across 4:2:0, 4:2:2, and 4:4:4, including both difference-mask polarities. It also passed ten existing target-only fault contracts for difference-buffer and wedge-mask guards. The LLVM report is .coverage-mcp/local-evidence/selected/20261029T221912.083316Z-455f985281524acfb822fc5455c1f664/coverage.json (SHA-256 d114342f524ea8e90e55b9566af46fb07fe608d729802abf1c29d11afcf69e7f). Coverage MCP reports no remaining branch locations in reduce_wedge_mask or fill_wedge_mask. difference_mask_and_blend retains two unobserved branch outcomes at mc.rs:2369 and mc.rs:2378, both in its odd-height vertical-pair fallback. Public AV1 luma transform and grid dimensions are multiples of four, so those outcomes are outside valid input geometry; the defensive fallback remains in place.

The report has no verified source/build receipt and unknown test attribution. It is selected-case evidence only and does not establish an aggregate coverage increase. No Rust unit tests were added. The broader 100% coverage and SIMD runtime-performance goals remain open.

AV1 compound distance-ratio parity edge — 2026-10-30

Added active parity row decode:avif:animated_lossy_interinter_distance_ratio_edge_i420_b16x16_64x64. Its deterministic six-frame 4:2:0 sequence makes the final order-hint-5 frame select references at order hints 3 and 6, exercising both outcomes of the distance-weight ratio comparison. The pinned AVIF input SHA-256 is abc38ca334493341926ff5f728ece919a1b71569cd8bfd4dec08f18d180811ba.

The focused selection of this row plus the existing distance and altref controls passed 3/3, including exact RGB parity for all frames. Its LLVM report is .coverage-mcp/local-evidence/selected/20261030T043729.219398Z-22cec4c3371d46c7a64064a122cb0d51/coverage.json (SHA-256 7c7aba9ce90f4c41821af8426169a555bc20c20ba4700cdfc263eea4da4f9b27). Coverage MCP reports 4,033/47,825 selected-binary branch observations. The executed distance_weight instance has nonzero true and false counts for both distance orderings and both threshold comparisons. Its remaining gap result points to a zero-count symbol at reported line 2427, while the current function is at line 2459; with source identity unverified, this coordinate is not treated as a reachable current-source gap. No aggregate coverage gain is claimed. The case's pinned native loop evidence validates independently. No Rust unit tests were added. The broader 100% coverage and SIMD runtime-performance goals remain open.

AV1 inter-translation invariant cleanup — 2026-10-30

Removed two redundant admission checks from AV1 inter reconstruction. The ChromaSampling check listed every variant of its closed internal enum, and the SampleDepth check listed every value constructible through its private fields and checked constructor. The common-geometry helper no longer accepts the unused sampling argument; reference depth/layout, nonzero visible dimensions, valid block layout, and inter-intra prediction constraints remain validated. This removes impossible rejection paths without adding work to the reconstruction hot path.

The current selected run passed six active input-only Pillow parity rows: 4:4:4 lossless B8x8 inter-intra plus 4:2:0 inter-intra mask modes 0–3 and wedge blending. Report: .coverage-mcp/local-evidence/selected/20261030T044233.969762Z-624584168adf48dab456ee01184379fc/coverage.json (SHA-256 e5966408e973c841c4d820e177c898445341426eae3f684cfd4d0a1a09743e63). Coverage MCP measured 4,170/47,825 selected-binary branch observations. The valid inter-intra modes exercise both sides of the mode and mask-coordinate branches. Remaining gaps in fill_inter_intra_mask are its coverage-only invalid-mode and geometry injections; inter_translation_common_geometry_is_valid still has defensive invalid-reference/depth/layout and zero-dimension arms. Those private invalid states were not made into unit tests or claimed as Pillow behavior. Source identity remains unverified and test attribution unknown, so no aggregate coverage gain is claimed.

make lint and make lint-x86-simd passed, including strict debug, release, coverage-configured, SSE2-baseline, and AVX2 Clippy lanes. cargo fmt --all -- --check and git diff --check also passed. No Rust unit tests were added. The broader 100% coverage and measured SIMD performance goals remain open.

AVIF CLLI trailing-payload parity and coverage refresh — 2026-10-30

Coverage MCP's preceding full-report gaps pointed to trailing-payload handling in both AVIF parse_clli paths. Added active parity row decode:avif:clli_trailing_payload_ignored, derived from hdr.avif. Its deterministic generator appends one zero byte to the four-byte primary-item CLLI property, rebuilds the enclosing boxes, and rebases all five file-backed iloc extents. It verifies that every item extent and the complete AV1 media payload remain byte-identical, then compares Pillow's full image information, frames, and decoded RGB bytes with hdr.avif. The fixture SHA-256 is 7862991cf4424c784f22d4a27ef128949eea8ad927c8ad05eed23a6e9effd108.

Both bounded CLLI parsers now read the two required 16-bit fields and retain the entire payload, including a Pillow-tolerated tail. The existing empty-CLLI contract still rejects a payload too short to contain those fields. The obsolete Rust-only assertion that treated a one-byte tail as malformed was removed; no Rust unit tests were added. The selected hdr plus trailing-CLLI parity run passed 2/2. Its report is .coverage-mcp/local-evidence/selected/20261030-clli-trailing-payload-ignored/coverage.json (SHA-256 31cac774f7d784d1644a33fc2e70e04ca5e1599dd49dbcc0b87037fcc22ea706).

The full make coverage refresh passed the all-feature suite and configured coverage floors: lines 98,440/140,272 (70.178%), branches 19,932/32,128 (62.039%), functions 5,426/8,974 (60.464%), and regions 150,262/217,749 (69.007%). Report: .coverage-mcp/local-evidence/full/20261030-after-clli-trailing-payload/coverage.json (SHA-256 37564d07f005c02dbf856809dcdeecae09a08cbeb5d2ead38878c7ad8bac659a). Coverage MCP returns no grouped branch gaps for parse_clli in this report, but marks source identity unverified and test attribution unknown. Treat it as local full-suite evidence, not a verified aggregate comparison. The incremental union with the selected report was incomparable because the baseline branch detail did not reconcile with its reported totals. make lint, make lint-x86-simd, make test-feature-matrix, and fixture integrity checks pass. No SIMD implementation or performance benchmark changed in this slice; the 100% coverage and measured SIMD speed goals remain open.

AVIF nested property size below its header — 2026-10-30

Added active parity row decode:avif:error_ipco_property_size_below_header. Its full-file fixture changes the first ipco/ispe size from 20 to 4 while preserving the file length and AV1 mdat bytes. Pillow 12.2.0 rejects it at open with UnidentifiedImageError. The fixture SHA-256 is 1376cc7d7360eae6b03c97b6d3808dc95bfa945aa8578e4443c540489ea2ed20. The focused selection with the existing nested zero-size control passed 2/2; its local LLVM report SHA-256 is 4afa4957216bb3b0dbf5a4486e683fd3fa95b0094ca3e48c885aea97e4b35565. An isolated selection of the new row also passed 1/1. Its report SHA-256 is 0aee1e9a43a7955af56b653dfeef57dab40c7421cce38d22ddc3156637b77308.

The full all-feature coverage run passed its configured floors: lines 98,441/140,272 (70.179%), branches 19,933/32,128 (62.042%), functions 5,426/8,974 (60.464%), and regions 150,264/217,749 (69.008%). Report: .coverage-mcp/local-evidence/full/20261030-after-ipco-size-below-header/coverage.json (SHA-256 1cfaf61e3920b8ad8b0491aea153cf77e190bcfd9160a53f8647f9ba57fa3ebe). Coverage MCP's comparison against the preceding full report observes one new branch coordinate, the true arm of samples::next_box at samples.rs:325. MCP marks this limited because source/build identity is unverified and test attribution is unknown; it is not a verified aggregate gain or proof that this specific selected case caused the full-report observation. In the one-case LLVM export, one samples::next_box function record at that location has six true-arm and 80 false-arm counts; a second record for the same source span has zero counts. The MCP gap grouping surfaces that unexecuted record. This is local branch evidence for the selected fixture, while source identity and MCP-level test attribution remain unverified.

The public matrix now has 2,848 rows: 2,276 active decode rows and 541 active encode rows, with 31 planned encode rows; AVIF has 776 active decode rows. Fixture integrity, the roadmap count, and generated capability documentation verify. No Rust unit tests were added. No SIMD implementation or runtime benchmark changed; 100% coverage and measured SIMD speed remain open.

AV1 frame-canvas completeness accounting — 2026-10-30

The AVIF sequence profile showed repeated full-canvas completeness scans in FrameCanvas::finish_with_filters_inner. The frame canvas now counts copied samples in coded and visible extents and compares the relevant count at finish. The written bitmap remains in place for overlap rejection and intra-edge availability. Counts update only after a placement passes geometry and overlap validation. No Rust unit tests were added.

On ARM64, the pre-change five-second sample profile recorded 3,768 stack samples; its collapsed stacks include 351 samples in validate_plane_placement and 333 in finish_with_filters_inner. The profile is retained at .coverage-mcp/local-evidence/perf/20261030-framecanvas-counts/arm64-profile.txt. An A–B–B–A comparison used 60 decode calls per block, the same release settings, and public decode_sequence on both binaries. For animated_motion_temporal_mv_range_2048x128, the pooled median fell from 11.524 ms to 10.502 ms (8.9%). For animated_motion_temporal_mv_range_negative_y_128x2048, it fell from 11.793 ms to 10.461 ms (11.3%). Raw timing blocks and host/build metadata are in framecanvas-counts-abba.json and framecanvas-counts-tall-abba.json in that directory. These are local ARM64 results for two workloads, not a claim of general AVIF speedup or x86 SSE2/AVX2 runtime performance.

The five-row focused parity selection passed baseline, grid, alpha, odd-sized I420, and the profiled sequence cases. make lint, make lint-x86-simd, and make test-feature-matrix passed. The post-change full all-feature coverage run passed configured floors: lines 98,466/140,300 (70.182%), branches 19,936/32,132 (62.044%), functions 5,423/8,973 (60.437%), and regions 150,305/217,795 (69.012%). Report: .coverage-mcp/local-evidence/full/20261030-after-framecanvas-counts/coverage.json (SHA-256 484dfbb0d856f2394c73953db847af9b5a397b6ed89e795817cf122230a4393b). Coverage MCP finds no missing branch observations in the changed finish and copy-count spans, but the report has unverified source identity and unknown test attribution. The four-metric 100% goal remains open.

AVIF lazy item-table inspection reservation contract — 2026-10-30

Coverage MCP identified the uncovered fault-injection true arm in parse_iinf::<LazyItemExtentPolicy> at src/codecs/avif/samples.rs:623. The existing item-table reservation contract exercised decode's bounded policy, while inspection uses the lazy policy. Added the target-only matrix row fault-contract:avif:avif_item_table_inspection_reservation_failure using inspection_error_then_retry_succeeds; its oracle status is not_applicable. No Rust unit test was added.

The exact selected fault-contract run passed 1/1. Its report is .coverage-mcp/local-evidence/selected/20261030-avif-item-table-inspection-reservation/coverage.json (SHA-256 60b3c648218b41c3912ffaffe8dee24a174d81f308dfa9fc29bf9f0cf9276d94). The raw LLVM record for the lazy-policy specialization shows one injected true-arm count and two false-arm counts. The refreshed all-feature make coverage run passed configured floors: lines 98,467/140,300 (70.183%), branches 19,936/32,132 (62.044%), functions 5,423/8,973 (60.437%), and regions 150,306/217,795 (69.013%). Report: .coverage-mcp/local-evidence/full/20261030-after-item-table-inspection-fault/coverage.json (SHA-256 c6960d031d0d4250cb6a34499c5194d22e44fd4672dce4120457e7cd262e17ce).

Coverage MCP now reports no missing branch observations at line 623 and one newly observed coordinate there in the full-report comparison. It marks that comparison limited because source/build identity is unverified and test attribution is unknown; treat this as local report evidence, not a verified aggregate coverage gain. The selected-report incremental union was incomparable because its instrumented inventory differs from the full report. The 100% coverage goal remains open.

AVIF duplicate item IDs use policy dispatch — 2026-10-30

Coverage MCP reported the opposite missing arms of the generic constant check in parse_iinf for its lazy-inspection and bounded-decode specializations. Those arms cannot occur for either policy. Replaced the constant condition with ItemExtentPolicy::on_duplicate_item_id: bounded decoding lazily constructs the existing parse error, while lazy inspection retains the first entry. Valid inputs do not call this handler, and inspection does not allocate an error for a tolerated duplicate. No Rust unit test was added.

The existing parity case decode:avif:error_iinf_duplicate_item_id passed 1/1. make lint passed, and the full all-feature make coverage run passed the configured floors. At local HEAD 69a79d4c4 plus working-tree changes, coverage measured lines 98,473/140,305 (70.185%), branches 19,935/32,130 (62.045%), functions 5,426/8,976 (60.450%), and regions 150,312/217,801 (69.013%). Report: .coverage-mcp/local-evidence/full/20261030-after-static-duplicate-policy/coverage.json (SHA-256 f8a1843b26bdc468ddfa96b605f34cfe73a56f4bd44918040f0587d205c7cf02).

Coverage MCP reports no missing branch observations at the changed duplicate handler line in this full report. Its source identity is unverified and test attribution is unknown, so this is local coordinate evidence and does not establish a verified aggregate coverage gain. The four-metric 100% goal remains open.

AVIF incomplete auxiliary-alpha declarations — 2026-10-30

Coverage MCP's retained full report listed missing arms in samples::Meta::non_primary_item_plane_properties for an alpha item with no extent dimensions and no pixel-depth declaration. Added the input-only parity row decode:avif:error_alpha_auxiliary_missing_ispe_and_pixi, derived from alpha.avif by clearing item 2's ispe and pixi associations while keeping its av1C and auxC associations. Pillow rejects the complete file at open. The existing missing-ispe row retains pixi, so it checks a distinct input.

The exact selected parity/coverage run passed 1/1. The new full make coverage run passed all integration targets and configured floors: lines 98,483/140,309 (70.190%), branches 19,929/32,118 (62.049%), functions 5,430/8,980 (60.468%), and regions 150,311/217,794 (69.015%). Report: .coverage-mcp/local-evidence/full/20261030-after-alpha-missing-ispe-pixi/coverage.json (SHA-256 4db19dad61747ab23c1c8bc8616668a16272be3aaa9658c4547db11da12b65dd). Its raw LLVM branch record at samples.rs:1668 records both outcomes, including the missing-dimensions arm. Coverage MCP no longer lists a missing branch for the samples::Meta projection, while three branches remain listed for the parallel container::Meta projection.

Coverage MCP marks this report's source identity unverified and test attribution unknown; its comparison with the preceding full report is limited because source/build identity and instrumented coordinates differ. The counts are local run evidence, not a verified aggregate gain. No Rust unit tests were added, and the four-metric 100% coverage goal remains open.

AV1 inter-translation admission coverage consolidation — 2026-10-30

Coverage MCP had grouped the common admission result as a missing branch in multiple decode_inter_translation_impl callback specializations. Moved that shared validation into validate_inter_translation_admission, keeping the coverage build out of the generic callback and using inline(always) in non-coverage builds. This retains the checked behavior and avoids a release call boundary; no runtime speedup is claimed.

The existing target-only contract fault-contract:avif:av1_inter_translation_sample_depth_mismatch passed 1/1 after the refactor, using decode:avif:animated_mixed_lossless_inter_b32_i420_impulse_residual_64x64. Its oracle status is not_applicable; it checks the structured sequence failure and successful retry. The selected report is .coverage-mcp/local-evidence/selected/20261030T154722.946987Z-46548de26e36400a9572d428bf2d2980/coverage.json (SHA-256 efb3fbc23221bea012dad02fcb9ace6b3b7162599a0e42b4daa1d7b37800b252).

The refreshed full make coverage run passed all integration targets, including 57/57 matrix tests, and cleared all configured floors: lines 98,521/140,311 (70.216163%), branches 19,955/32,102 (62.161236%), functions 5,435/8,984 (60.496438%), and regions 150,354/217,796 (69.034326%). The retained report is .coverage-mcp/local-evidence/full/20261030-after-inter-translation-admission-refactor/coverage.json (SHA-256 fe85ca54330771a0dd0a1dc72e8352a5ff009600c998f0eae221da7ea36a49bb). Coverage MCP groups the admission helper as one function group and still reports 12 missing branch outcomes within it. Its largest remaining AV1 group is the lossless-small prediction guard in decode_inter_translation_impl; the generic callback specializations still produce repeated missing branch groups there.

Coverage MCP marks the full report's source identity unverified and test attribution unknown, so the totals are local measurements and do not prove an aggregate coverage gain. No Rust unit tests were added. The four-metric 100% coverage goal and measured SSE2/AVX2 runtime goals remain open.

AV1 lossless-small inter-translation branch — 2026-10-30

Added the input-only parity row decode:avif:animated_lossless_inter_420_fixed_b4x4_64x64, backed by a deterministic 64×64, two-frame, all-lossless 8-bit I420 AVIF whose inter frames use fixed 4×4 AV1 partitions. The selected parity run passed 1/1 with full 12,288-byte Rgb8 pixel parity. Its raw LLVM branch record at src/codecs/avif/av1/block.rs:49501 records the lossless_small true arm 256 times and its false arm zero times for the executed specialization.

Command: make coverage-selected COVERAGE_CASES='decode:avif:animated_lossless_inter_420_fixed_b4x4_64x64'. Selected report: .coverage-mcp/local-evidence/selected/20261030T171950.823465Z-74d2144025a34b419ed8b0c513cd704f/coverage.json (SHA-256 d55e9f56e15e6864f831c253710dbfab1f155d2cd53d375fe81353bab48cd8de). The local evidence receipt is stored alongside it; fixtures were unchanged during the run. Coverage MCP marks source identity unverified and test attribution unknown for this report. Its grouped query still lists both arms across callback specializations; the executed specialization's raw LLVM record is the direct local evidence for this input. This does not establish a verified aggregate coverage gain. The incremental comparison against the preceding full report is incomparable because its branch detail does not reconcile with reported totals. No Rust unit tests were added; the four-metric 100% coverage and measured SSE2/AVX2 runtime goals remain open.

8-bit I422 inter-frame CDEF parity — 2026-10-31

The current public evidence matrix contains 2,889 total rows: 2,316 decode / inspect / verify rows and 573 encode rows. Of those, 2,316 decode rows are active, alongside 542 active encode rows and 31 planned encoder rows.

Added the input-only parity case decode:avif:animated_lossy_inter_422_cdef_8bit_16x16. Its deterministic two-frame AVIF is 8-bit I422 at 16×16 with inter-frame CDEF enabled, the largest transform, and no loop restoration. The fixture generator's --check passed, and the exact selected parity run passed 1/1 with both 768-byte RGB frames matching pinned Pillow references. Independent loop evidence verification passed for all 185 AVIF sequence references.

The retained local LLVM report, .coverage-mcp/local-evidence/selected/20261031T034145.456411Z-c691778d52534010a603a42424df8cdb/coverage.json, contains two emitted records for complete_bounded_i422_cdef_inter_reconstruction_context in entropy.rs; each records all seven branch pairs with an observed arm. Its adjacent local receipt records the selected case passing and fixtures unchanged. Coverage MCP returned Transport closed; the receipt therefore marks MCP source identity unverified and test attribution unknown. This is local selected-case evidence, not an MCP-confirmed gap closure or aggregate coverage gain. The 100% coverage goal remains open. No Rust unit tests were added.

AVIF duplicate sample-table container parity — 2026-10-31

The local full LLVM report at target/release-evidence/coverage.json showed the duplicate-child arm of samples::parse_minf at samples.rs:2391 unobserved (0 hits versus 2,061 for the non-duplicate arm). Existing duplicate-minf and duplicate-stco cases do not exercise a second stbl inside one minf. Added the input-only parity row decode:avif:error_animated_duplicate_stbl and a deterministic complete AVIS mutation. The generator rebases the item and sample offsets, verifies the box structure, and confirms that pinned Pillow 12.2.0 rejects the file at open. Its SHA-256 is 82117e58d5518cead7a53bc76cb705b3b02261558c6d5b34cf90328700b8bb4d.

make coverage-selected COVERAGE_CASES='decode:avif:error_animated_duplicate_stbl' passed 1/1. The selected report is .coverage-mcp/local-evidence/selected/20261031T040311.313482Z-379056a26e2d456a834a2dc8f6d2fa3b/coverage.json (SHA-256 e9d80cea32b6fcd80b1cf627998f29c654b577924ced961553e033c208d0951e). Its raw branch record at samples.rs:2391 records both outcomes six times in the executed parser specialization. Coverage MCP returned Transport closed for both the full and selected reports, so this is local LLVM evidence, not an MCP-confirmed gap closure or aggregate coverage gain. No Rust unit tests were added; the 100% coverage goal remains open.

AVIF zero track-ID parity — 2026-10-31

The local full LLVM report at target/release-evidence/coverage.json showed the zero-ID arm of samples::parse_tkhd at samples.rs:2264 unobserved (0 hits versus 2,143 for nonzero IDs). Added the active public parity row decode:avif:error_track_tkhd_zero_id. Its complete animated AVIF fixture sets the version-one tkhd track identifier to zero without changing box sizes or sample offsets; the pinned Pillow 12.2.0 oracle rejects the file at open. The fixture SHA-256 is 5b9718040db403bad0122fd59426e3e4d61652b88cea1a5654435075475180a3.

make coverage-selected COVERAGE_CASES='decode:avif:error_track_tkhd_zero_id' passed 1/1. The selected report is .coverage-mcp/local-evidence/selected/20261031T041022.555957Z-73491296284247a79160e36436e5a8fd/coverage.json (SHA-256 959daca7b66e8ad99b86cc4a3505d13d600309384e1f318be61e4651e53b0ec6). Its raw parse_tkhd branch record at samples.rs:2264 records six hits on the zero-ID arm in the executed parser specialization. Coverage MCP returned Transport closed for the full report, so this is local LLVM evidence, not an MCP-confirmed gap closure or aggregate coverage gain. No Rust unit tests were added; the 100% coverage goal remains open.

JPEG ZRL batching trial — 2026-10-31

A release sample of RGB 512×512 Q10 4:2:0 encoding identified repeated AC zero-run-length (ZRL) Huffman writes in encode_raw_ac_value. A candidate combined two adjacent ZRL codes into one RawBlockWriter::write call; each code is at most 16 bits, so the combined call stays within the writer's 32-bit bound and emits the same bit sequence. The candidate was built with CARGO_TARGET_DIR=target/jpeg-zrl-batch-arm64-20261031 cargo build --manifest-path benchmarks/jpeg-production/rust/Cargo.toml --release --locked. Baseline and candidate binary SHA-256 values are ae481f7245766a33ebda4d46826a09540a3fe0820822a824590b691c4ddadd64 and 5229207069b68731555a9d9f96f473dfbed999a6103975fa90bc4422b0686d69.

Three A–B–B–A cohorts ran the same generated 512×512 RGB, quality-10, 4:2:0 workload for 1,200 iterations per process with 100 warmups. The input FNV-1a was 75efb3d33c9418ec; all twelve runs emitted 29,341 bytes with FNV-1a 4280bc9f48852fbe. Candidate paired medians were about 1.5%, 3.2%, and 2.6% slower than their controls. Across all six runs per build, the medians were 1,523,813 ns baseline and 1,554,063 ns candidate. Host load averages started at 8.44 and remained above 6.8, so these timings do not establish the exact regression size; they provide no evidence of a gain. The candidate was rejected and the JPEG source was restored without a retained code change.

Selected public parity passed 2/2 for encode:jpeg:enc_q10 and encode:jpeg:enc_optimize, including exact reference outputs and 128×128 re-decode pixel parity. Its local LLVM report is .coverage-mcp/local-evidence/selected/20261031T041842.324296Z-50f829c2b4e840e880e9b21fe4ba988e/coverage.json (SHA-256 834c2de6261d4445fbe65bec3eb2f5edce478c1d1da1de3bd2c9eb730f7189ae). Coverage MCP returned Transport closed for both this selected report and the latest full report, so no MCP gap attribution or aggregate coverage claim is made. No Rust unit tests were added.

Current-checkout AVIF 12-bit alpha parity recheck — 2026-10-31

In /Users/lazytrot/work/image-slash-star, the selected public parity run passed 3/3 for decode:avif:error_12bit420_alpha_ispe_extent_mismatch, decode:avif:high_bitdepth_still_12bit_420_alpha_odd_edge_17x9, and decode:avif:high_bitdepth_still_12bit_444_alpha_9x9. The two valid controls matched Pillow RGBA pixels (612 and 324 bytes); the auxiliary extent mismatch was rejected like Pillow. The fixture generator --check reproduced the 1,436-byte mismatch fixture with SHA-256 9150d49f7f499f86c9e778a70d6525bd06a5509e409366d082097e6d7c4a2be6.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T042316.942023Z-fef06ba59ea74e81b92facd7af50a39c/coverage.json (SHA-256 43f507358c3305eac3d3f52d5822488dc47264ed658d0fffdf4288292cc9646c); its local receipt SHA-256 is 878b4495ec297f43d45b2335e625311be1d1211aec240768f94ae83ba2313322. Coverage MCP returned Transport closed for the targeted branch query, so this remains local selected evidence and does not establish aggregate coverage gain or MCP attribution. No unit tests or fault-contract cases were selected.

JPEG progressive restart interval cleanup — 2026-10-31

The latest local full LLVM report showed an unobserved true outcome for current_restart_interval.is_some() at src/codecs/jpeg/encode/mod.rs:5127 in both Noop and token checkpoint instantiations of encode_progressive_scans_exact. Coverage MCP returned Transport closed for the full report and the focused report, so this finding is local LLVM evidence, not MCP attribution.

Source inspection established the state invariant: restart_rows is fixed for one encode; every scan interval is zero when row restarts are disabled (or the row count exceeds Pillow's limit), and positive otherwise because every valid scan has at least one MCU column. The current interval can change between positive scan intervals, but cannot transition from nonzero to zero. The redundant current_restart_interval.is_some() fallback was removed, leaving the direct restart_interval != 0 marker condition.

Selected Pillow parity passed 4/4 for encode:jpeg:enc_progressive, encode:jpeg:enc_progressive_restart_rows, encode:jpeg:enc_progressive_restart_rows_partial_mcu_420, and encode:jpeg:enc_cmyk_progressive_restart_rows. The LLVM report is .coverage-mcp/local-evidence/selected/20261031T042845.528400Z-c9ee384b906148218addd16aee84ace7/coverage.json (SHA-256 6f9a9f9bb79f9a232c22a59344c73e1c5fec1e5635eaac1c37560da59faa0437); both outcomes of the simplified condition were observed in the no-token and token instantiations. make lint and make lint-x86-simd passed, including strict debug, release, coverage-hook, x86-64 SSE2, and AVX2 Clippy builds. No fixture, unit test, or fault-contract case was added; no benchmark speedup is claimed for this small branch simplification.

AV1 frame-ID continuity boundary and wrap parity — 2026-10-31

Added the input-only parity cases decode:avif:error_animated_frame_id_outside_continuity and decode:avif:error_animated_frame_id_wrapped_outside_continuity. Both mutate only the second 15-bit frame ID in a deterministic full-file AVIF. The half-range case changes 4,627 to 21,010, exactly 16,384 (1 << 14) after its predecessor ID 4,626. The wrap case changes 4,627 to 4,625, producing modulo difference 32,767. Pillow 12.2.0 decodes the first 16×16 RGB frame exactly (768 bytes), then rejects frame 1 in both inputs with RuntimeError: Failed to decode frame 1: Decoding of color planes failed.

The selected command passed 2/2:

make PYTHON=.oracle-venv/bin/python coverage-selected \
  COVERAGE_CASES='decode:avif:error_animated_frame_id_outside_continuity decode:avif:error_animated_frame_id_wrapped_outside_continuity'

The combined LLVM report records both outcomes of frame_id > previous and two hits on the true outcome of difference >= 1 << (frame_id_bits - 1) at src/codecs/avif/av1/frame.rs:3415. The local receipt reports no source or fixture changes during the run. The report is .coverage-mcp/local-evidence/selected/20261031T051142.471584Z-c82168dbbbc34b5b945223b981408b23/coverage.json (SHA-256 11545f9f7e7a9ba4c128bb15d76800597c7c81c5add8776769bc62d885896c40); the receipt SHA-256 is ed01739fc7e1ff58e4472c1ac2ba50777988790c729782a75c78002314dd6be2. Coverage MCP returned Transport closed, so this remains local selected evidence and makes no aggregate coverage or MCP-attribution claim. No unit tests were added.

The existing parity case decode:avif:error_animated_repeated_frame_id was also run by itself to confirm the equality guard. It passed 1/1 with exact 768-byte RGB8 pixel parity for ordinary decode and the expected malformed sequence result. LLVM recorded true=1, false=0 for frame_id == previous at src/codecs/avif/av1/frame.rs:3412. The local receipt records unchanged source and fixtures during the run, with source manifest SHA-256 ce9d7365fe646859675988242f990ee3cda3944542a70f0e5b74330f340f7fb8. Report: .coverage-mcp/local-evidence/selected/20261031T051747.695923Z-799a4334b17e4532a2766e519fe61a36/coverage.json (SHA-256 9d36f14c824f33aefdae160d4f4ce5ba4ce053b5e0c80522ae6e56d496d5fcb4); its receipt SHA-256 is 0d114c78117329909be0e0154ec13a129d09abc0ffcd921f372985f2df4777dd6. Coverage MCP again returned Transport closed; this single-case report does not update or claim aggregate coverage totals.

JPEG MCU offset arithmetic trial — 2026-10-31

A targeted experiment replaced saturating arithmetic for MCU-derived offsets inside encode_baseline_420_mcu_row_streaming with ordinary addition and multiplication. Allocation sizing and restart countdown saturation were left unchanged. Release binaries on Apple M3 Pro with Rust 1.96.1 ran the public 512×512 RGB Q10 4:2:0 encode with the same deterministic input (FNV-1a 75efb3d33c9418ec), 100 warmup calls, and 1,000 measured calls per process. Two A–B–B–A sequences produced these per-process medians:

Sequence	Baseline A (ms)	Candidate B (ms)	Candidate B (ms)	Baseline A (ms)
1	1.462709	1.499000	1.481000	1.450667
2	1.464709	1.437875	1.454417	1.454542

The median of the four baseline process medians was 1.458626 ms; the candidate was 1.467709 ms, 0.62% slower. The direction reversed between sequences, so there was no stable speedup. Every run produced 29,341 bytes with FNV-1a 4280bc9f48852fbe, matching the retained TurboJPEG comparison for this input. The candidate was rejected and the source restored. This targeted ARM64 diagnostic does not establish SSE2 or AVX2 runtime performance.

AV1 stale reference-slot invalidation parity — 2026-10-31

Added the active public parity row decode:avif:animated_frame_id_stale_reference_invalidation. Its deterministic AVIF uses frame IDs 0, 8,000, and 17,000. The middle inter frame refreshes one reference slot, leaving seven slots at ID 0; the independently decodable final key frame reaches the stale-reference invalidation branch. The input SHA-256 is 3b8ce1b8ddccf7b114f2ceac3505c254d73bc823d2138cae01106ce04029dd6d.

Pillow 12.2.0 and the pinned native libavif observer decode three 16×16 RGB frames with hashes 9ce641a4c1891e5972484b17881d0eb60763ca14bff21762a7b4e1abaf17ea9b, 6d4525df688f4dbfe6ecf5b6ae3c8764f01941441bbade31be70e0be766579d7, and 9ce641a4c1891e5972484b17881d0eb60763ca14bff21762a7b4e1abaf17ea9b; both observers report an infinite loop. Selected Rust parity passed 1/1 with exact pixel output.

The selected LLVM report records seven taken and nine untaken outcomes at src/codecs/avif/av1/frame.rs:846 in the active decoder instance, matching the seven stale slots. Its source and fixture receipts remained stable during the run. The report is .coverage-mcp/local-evidence/selected/20261031T070510.612353Z-57deae32ab7a4b5cbf5471e0abcb3bd1/coverage.json (SHA-256 6d481d7e8ba52ec733dbd901283e664875607bfdd18a3c8fa8109366f613ebaf); the local receipt SHA-256 is d523bd7b3a6c02e82c838d4086d2bba7964fa44ba3e49bd709371e72c45a725d. Coverage MCP returned Transport closed for the incremental comparison, so this is local selected evidence and makes no MCP attribution or full-suite coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 future-reference invalidation parity — 2026-10-31

Added active parity row decode:avif:animated_frame_id_future_reference_invalidation. Its frame IDs are 30,000, 10,000, and 20,000. The second frame wraps by a valid 12,768-step delta and refreshes one slot; seven retained slots still identify frame 30,000 when frame 20,000 arrives. The final independent key frame must invalidate those higher-ID references. The input SHA-256 is ebe40d4c20e39723979ac8fc5968c846b54f30045739af26d8d91974d7492cbb.

Pillow 12.2.0 and pinned libavif preserve the same three exact 16×16 RGB frames as the stale-ID case and report an infinite loop. Selected Rust parity passed 1/1 with exact output. The LLVM report records seven taken outcomes for retained.header.frame_id > frame_id at src/codecs/avif/av1/frame.rs:837, plus seven taken outcomes in the slot-clear branch at line 846. Source and fixture hashes remained stable during the run. The report is .coverage-mcp/local-evidence/selected/20261031T071007.884581Z-0f19927ef06c4bd3b3dadc65e4e7c286/coverage.json (SHA-256 43acb87dee5ed2984f010e43a1e1a25cd81226485084ae35ec721a27a61f2ae6); the local receipt SHA-256 is ccc3d4fe814a144a7d32451ce97b57879bc874cc6a6745cb5c4bf6ed749a38d4. Coverage MCP remains Transport closed, so this is local selected evidence, not MCP attribution or an aggregate coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 timing without decoder-model parity — 2026-10-31

Added the active input case decode:avif:animated_timing_without_decoder_model. It enables valid AV1 timing information while leaving decoder_model_info_present_flag clear in the sequence header. The complete AVIF input is 1,243 bytes with SHA-256 7978ad21887be7ec5e74b13ab9555e2c2caef9911b900947b67c231b74f1f5cf.

Pinned Pillow 12.2.0 and libavif 1.4.1 decode five 150×150 RGB frames at 33 ms each; all five pixel hashes match animated.avif. The independently compiled libavif loop observer decodes all five frames and reports one play. Selected Rust parity passed 1/1 with exact 67,500-byte RGB pixel parity.

The retained 835-row active AVIF report previously recorded only the true outcome for decoder_model_present at src/codecs/avif/av1/sequence.rs:166 (15 true, 0 false). This isolated case records the false outcome three times (0 true, 3 false). The source-file hash for sequence.rs is identical in both receipts, so this is a reachable new branch outcome against the same implementation source. The selected report is .coverage-mcp/local-evidence/selected/20261031T085355.229370Z-7ac58d73edac40399e1ec7c1f3e21f0d/coverage.json (SHA-256 517ad9c0dd3f6e835bb89e503ef4c096553edb58ac31e116b87b278bbe56c991); its local receipt SHA-256 is dcf15147325daeecb6cc7c9ac16caee4f22335f53d0f5d41b4c8936237395473. Coverage MCP returned Transport closed, so the branch evidence is local and does not claim MCP attribution or an aggregate coverage increase. No unit tests or Rust decoder-source changes were added.

Maximum valid AV1 initial-display-delay parity — 2026-10-31

Added active parity case decode:avif:animated_initial_display_delay_10. Its deterministic AVIF enables timing and display-model syntax and sets the valid initial display delay to the boundary value 10. The input is 1,244 bytes with SHA-256 aa95d8f4b6f2576f91a010fd0cc1cd5ed10ea826b89f8aba661c3dd6a9fa1b7d.

Pillow 12.2.0 preserves all five 150×150 RGB frames and their 33 ms durations. The pinned native libavif observer decodes five frames and reports one play. Selected Rust parity passed 1/1 with exact 67,500-byte pixel parity. The selected LLVM report records the previously unhit false outcome of initial_display_delay > 10 at src/codecs/avif/av1/sequence.rs:212 three times; the retained 835-row AVIF selection recorded only the true outcome (3 true, 0 false). Both receipts have the same source manifest and sequence.rs hash. Combining that baseline with the two selected timing cases yields 91/106 covered branch outcomes in this file, up from 89/106; this case adds the valid-delay false outcome.

The report is .coverage-mcp/local-evidence/selected/20261031T090520.372596Z-910f9113b03b4926a53091b4ca1efbf2/coverage.json (SHA-256 60e37cd8067e6c97d9591ccd445b9018ad3cddf69d07d12b1dd8abbd15f738d9); its local receipt SHA-256 is 0673fa5bc8ed29d1f16b2c7721ca259d103f3923f244346e7932674ae968617a. Coverage MCP returned Transport closed, so this is local selected evidence and makes no MCP attribution or whole-repository coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 identity-matrix profile parity — 2026-10-31

Added three active public parity cases around the AV1 identity-matrix profile guard. decode:avif:animated_identity_matrix_profile1_444 covers the valid 8-bit 4:4:4 profile-1 path, and decode:avif:animated_identity_matrix_profile2_12bit_444 covers the valid 12-bit 4:4:4 profile-2 path. Their fixture SHA-256 values are 4535db4548ddf82d23c72ef970b01f1632f4db4c9f7ddfd392bf0d5d011bdd4a and d0079f47a1f7709a373191d2248d42daec16d01132b6aaf1cdb1d7dc613fb1da. Pillow and the pinned native libavif observer decode five frames from each; the selected Rust parity rows passed with exact RGB output.

The error row decode:avif:error_animated_identity_matrix_profile0_8bit_420 uses a complete 8-bit 4:2:0 profile-0 AVIF whose sequence header and both nclx declarations carry matching identity CICP values 1/13/0. Pillow opens the five-frame container and reports RuntimeError: Failed to decode frame 0: Decoding of color planes failed on load; Rust rejects the same public input. The deterministic mutation hashes to a88b8b552040ea93afb486c17efca9c7cdb0e7151854e1a0e350375489cd5526, and its selected parity row passed 1/1.

All three fixtures pass their generator --check commands. The selected profile-1 report is .coverage-mcp/local-evidence/selected/20261031T100757.418610Z-369dea0685974d72b38e05cafd8858a4/coverage.json (SHA-256 57fc9eb6df96ad48aec4d7ff7bc85288086a5bf4ebef464b1dac4f88474fd6dc); its local receipt SHA-256 is cfc102cd22402a989f70ac817f5aa3548cceb54f3b5106fb7ca4c792b63f62c8. The selected profile-2 report is .coverage-mcp/local-evidence/selected/20261031T101259.691540Z-369a087c36e742c38f70064c0ce0326f/coverage.json (SHA-256 54fb071ff8602add6f916af5a36ab921b2b0301476f3bcace458f57d90cc1e68); its receipt SHA-256 is 01c22d8612950c10651a9fdbaa518f1f7fd9c49e89dfb35fa4000b77166cf404. The profile-0 report is .coverage-mcp/local-evidence/selected/20261031T101941.683743Z-82b18ce5cd534ef1b633a8edc16b61fd/coverage.json (SHA-256 9481bd2fb5999e91f1c5a1c117de7b87059f7ec2e54df7bb489420918e95be12); its receipt SHA-256 is 0bc5acb192c97adff018755a65f174c758258c2f5c6927194dc74b4f0fbdd2d5.

The profile-0 report adds the previously unobserved false outcome for profile == 2 at src/codecs/avif/av1/sequence.rs:326 (column 30), three hits. A local union of 14 passing selected reports with matching sequence source and manifest hashes now observes 99 of 108 branch outcomes in that file, up from 98 of 108 before this row. This is a coordinate-level union of selected LLVM reports, not full-suite coverage. Coverage MCP returned Transport closed for the report query, so it could not verify attribution or the aggregate. The local receipt records the selected case passing 1/1 and the source and fixture hashes unchanged during execution. No unit tests or Rust decoder-source changes were added.

AV1 high-tier operating-point parity — 2026-10-31

Added active parity case decode:avif:animated_operating_point_high_tier. It sets seq_level_idx to 8 and inserts the required main-tier bit in the first AV1 operating point. The resulting input is 1,235 bytes with SHA-256 bb06afad6c56b58389eede0bdda980ca42ee36ca045eb92e39de7f5a85e19fb0.

Pillow 12.2.0 and the pinned native libavif observer decode five 150×150 RGB frames at 33 ms each and report one play; their frame pixels match exactly. Selected Rust parity passed 1/1 with exact 67,500-byte RGB pixel parity. The selected LLVM report records the true outcome of level > 7 at src/codecs/avif/av1/sequence.rs:199 three times. The source-matched baseline records the false outcome 456 times and no true outcome. Combining that baseline with the timing-without-model, maximum-display-delay, and high-tier selected reports covers 92/106 branch outcomes in sequence.rs, up from 89/106; all four reports have the same source manifest and sequence source hash.

The report is .coverage-mcp/local-evidence/selected/20261031T091247.190127Z-b5e574d00ae1410e9414e5adb1b0b319/coverage.json (SHA-256 2f77f5f09206b7762199f1dac4a3b119e78aa23132976930a245373d427f35cb); its local receipt SHA-256 is 885229c975e9a1d7bfcf69dacbf66251cca7c68e5a1ae3cd68debba8fab63068. Coverage MCP returned Transport closed, so this is local selected evidence and makes no MCP attribution or whole-repository coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 decoder-model parameters absent parity — 2026-10-31

Added active parity row decode:avif:animated_decoder_model_without_operating_point_parameters. It enables valid sequence-level decoder-model timing, leaves decoder_model_present_for_this_op clear, and adds the required false buffer-removal flags to the frame headers. The resulting input is 1,249 bytes with SHA-256 e220130a0614df8c5fce0acf525c2c69a9fccaa8ec140373eac1f91d424d757d.

Pillow 12.2.0 and the pinned native libavif observer decode five 150×150 RGB frames at 33 ms each, preserve the source pixels, and report one play. Selected Rust parity passed 1/1 with exact 67,500-byte RGB pixel parity. The selected LLVM report records the false outcome of the per-operating-point decoder-model flag at src/codecs/avif/av1/sequence.rs:200 three times; the source-matched baseline records only the true outcome (9 true, 0 false). Combining that baseline with the four selected sequence-header cases covers 93/106 branch outcomes in sequence.rs, up from 89/106. All reports have the same source manifest and sequence.rs hash.

The report is .coverage-mcp/local-evidence/selected/20261031T092252.124788Z-54854731d7fb407797b0bdbd3e805573/coverage.json (SHA-256 7f2b7394fae0b7b17e336dece774eeaa234c87c1fe019a89a6e7aa086b7741c7); its local receipt SHA-256 is 6889b846843287c3bc3d97b2d7fb58ad03efa68d8d8017503c91c3e7c6a9457e. Coverage MCP returned Transport closed, so this is local selected evidence and makes no MCP attribution or whole-repository coverage claim. No unit tests or Rust decoder-source changes were added.

AV1 equal-picture interval UVLC parity — 2026-10-31

Added active parity case decode:avif:animated_equal_picture_interval_two_ticks. It enables AV1 equal-picture-interval timing and encodes num_ticks_per_picture_minus_1 as uvlc(1) (010), reaching the valid leading-zero path while leaving BMFF sample timing and encoded frame payloads unchanged. The 1,243-byte AVIF has SHA-256 e49851e6d94c721525f3b4130d7279c2ed2329a68032ea81f3714ae68119db7d.

Pillow 12.2.0 and the pinned native libavif observer decode five 150×150 RGB frames with exact pixels, 33 ms timing, and one total play. Selected Rust parity passed 1/1 with exact 67,500-byte pixel parity. The selected LLVM report records both outcomes of the while !self.bit()? loop at src/codecs/avif/av1/bit_reader.rs:241 three times each. The source-matched selected report for animated_decoder_model_without_operating_point_parameters recorded only the false outcome (0 true, 3 false); their local union covers 15/50 bit-reader branch outcomes versus 13/50 in that prior report. Both receipts have the same source-manifest hash.

The report is .coverage-mcp/local-evidence/selected/20261031T111225.003911Z-577217dab3d74d4ea69c4b514c7ad684/coverage.json (SHA-256 54ded30bab283f79977404c76c40b1e9370e22bf86fc5a9c055ff0b7c3c3ada3); its local receipt SHA-256 is 9ef554d0bceff5a8289fefeb8eddb40b73f5367bded577249a3090ecb13d5c23. Coverage MCP returned Transport closed, so this remains local selected evidence and makes no MCP attribution or whole-repository coverage claim. The public evidence matrix now contains 2,916 total rows: 2,343 decode / inspect / verify rows and 573 encode rows. Of those, 2,343 decode rows and 546 encode rows are active; 27 encode rows are planned. AVIF has 843 active decode rows. No unit tests or Rust decoder-source changes were added.

BMP signed-dimension encoder guard — 2026-10-31

Added target-only case fault-contract:bmp:bmp_encode_height_over_signed_limit_rejected to the shared coverage matrix. It decodes the active decode:bmp:depth_24 fixture, checks its pixels against the pinned Pillow reference, and arms a cfg(coverage) fault point that presents a copied image height of i32::MAX + 1 to the BMP file-size guard. The public img::encode call must return a BMP Dimensions error at the StillEncode stage. The case has oracle_status: not_applicable and does not add a Pillow parity row.

The selected coverage run passed 1/1. Its LLVM report records the false outcome of the height limit at src/codecs/bmp/encode.rs:269 once. The previous local baseline recorded no false outcome at the same guard before the coverage hook was added. Because the source revisions differ, these reports are not combined into a coverage total.

WebP VP8 method-one lossy encoder parity — 2026-10-31

Added active parity row encode:webp:enc_lossy_method_1_intra16_candidate_pruning for the existing 128×128 RGB WebP source at quality 80, method 1. The first run exposed a mismatch: Rust produced 4,056 bytes while Pillow produced 4,088. Tracing the fast VP8 path showed that method 1 must choose its chroma mode from pixel distortion and fixed mode cost before quantization. The Rust encoder now uses that search and evaluates only the selected chroma candidate, following libwebp 1.6.0's RefineUsingDistortion path in quant_enc.c.

The clean selected parity run passed 1/1. Regular and token-aware public encode calls matched Pillow's exact 4,088-byte output, and re-decoded pixels matched for all 128×128 RGB pixels. Its LLVM report observes both outcomes of the Intra16 candidate-pruning branch at src/codecs/webp/encode/vp8/intra16.rs:332. The current evidence matrix contains 2,917 rows: 2,343 decode / inspect / verify rows and 574 encode rows, with 2,343 decode rows and 547 encode rows active and 27 encode rows planned. This is a single-case local report, not an aggregate coverage claim; Coverage MCP attribution was not verified. make lint passed, including formatting, strict Clippy, release Clippy, and coverage-configured Clippy. No unit tests were added, and no performance benchmark was run.

The report is .coverage-mcp/local-evidence/selected/20261031T142557.000511Z-9251eddb912c45e98db9f3df888ca217/coverage.json (SHA-256 97ee518be68b721ef25fc729337c4aa0e26d808e42b47aba51faad603ca18f8a); its local receipt SHA-256 is a343a547c7e3d4671962cf49382cbe3efdfd9fbe29f77fa18f256da8d1a3c139.

WebP VP8 method-four search parity — 2026-10-31

Ran the existing active parity row encode:webp:enc_lossy_quality_80_method_4_nonuniform_rgb_17x17. It passed 1/1 with the exact 380-byte Pillow output and re-decoded 17×17 RGB pixel parity; the row made four public encode calls and reported no panics. The selected report covers both outcomes of the method threshold at src/codecs/webp/encode/vp8/frame.rs:303 and :431, plus both Intra4/Intra16 selection outcomes at :309 (9 and 3 hits).

The method-0, method-1, and method-4 reports share source-manifest hash 638eb4f23ea7bae92f6497e82a546f8073484d0a00d8e9b42bc5bcb5477309c5 and frame.rs hash a6750749e4c5b07cd66e6367c7d8486748867099ea0ee46b8d0fa3cd251708de. A local coordinate-level union covers 20/22 branch outcomes in that file, up from 16/22 for method 0 plus method 1; method 4 adds four outcomes. This is selected file-level evidence, not a whole-repository coverage result. Coverage MCP returned Transport closed for the report query, so managed attribution was not verified. The source and fixture inventories were unchanged during the run. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T143500.811534Z-71c33d3019db41d5abd73d75228f7eee/coverage.json (SHA-256 5826a5862ce4c25ef5f668d83622e86050f32364449332ba341ec9a9256ccfc9); its local receipt SHA-256 is 4835f9787c1a0aa4f18c7a1afd1ca6cec0825f64d558256d4208833a536994b1.

WebP VP8 method-six token-aware parity — 2026-10-31

Ran the existing active parity row encode:webp:enc_lossy_method_6_token_checkpoint on the 128×128 RGB lossless.webp source. It passed 1/1 with the exact 3,570-byte Pillow output and re-decoded pixel parity; the row made five public encode calls and reported no panics. Across matching local reports for the method-0, method-1, method-4, and method-6 cases, method 6 adds 58 distinct branch outcomes in src/codecs/webp/encode/: 28 in vp8/quant.rs, 22 in vp8/cost.rs, five in vp8/partition.rs, and one each in vp8/intra16.rs, vp8/intra4.rs, and vp8/encoder.rs. The method-6 report observes all 34 branch outcomes reported for vp8/quant.rs.

All four reports have source-manifest hash 638eb4f23ea7bae92f6497e82a546f8073484d0a00d8e9b42bc5bcb5477309c5; source and fixture inventories were unchanged during this run. The union is local coordinate-level evidence for selected cases, not full-suite coverage. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T143813.451293Z-cbbaa85c96594a22982449b69ec5c727/coverage.json (SHA-256 899455084dcda2996233a51e98d6539aa0ce7100681ac43a8acc2da39b7814b5); its local receipt SHA-256 is a412ef77798d83cf2a1e822ac67b6be1e42e49b1c5fe0f712e9af79cc7a32271.

WebP VP8 large-frame parity — 2026-10-31

Ran the existing active parity row encode:webp:enc_lossy_quality_0_method_0_large_frame_skip_sample on its 513×257 RGB source. It passed 1/1 with the exact 506-byte Pillow output and re-decoded pixel parity; the row made four public encode calls and reported no panics. Against the four source-matched selected reports above, it adds nine branch outcomes in src/codecs/webp/encode/: three in vp8/intra16.rs, three in vp8/residual.rs, two in vp8/partition.rs, and one in vp8/encoder.rs. This is a local coordinate-level union of selected reports, not a full-suite coverage result. The source and fixture inventories were unchanged during the run. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T144036.446167Z-d0ab386dc9314852bf13a9a7a167522b/coverage.json (SHA-256 e991f104612d693ea40c38f0d4e243fb2fba8178d0added59c5f98537b6dd35e); its local receipt SHA-256 is 3352e98edd229b3bdde1bd8043de2416f3f97e923e998f235bcf61141ca61f50.

WebP VP8 204-macroblock parity boundary — 2026-10-31

Ran the existing active parity row encode:webp:enc_lossy_quality_0_method_0_sampling_boundary_204_macroblocks on its 192×272 RGB source. It passed 1/1 with the exact 2,218-byte Pillow output and re-decoded pixel parity; the row made four public encode calls and reported no panics. Its selected report added no new branch outcomes to the local coordinate-level union of the five preceding WebP encoder reports. The case remains useful as a parity regression at this geometry boundary; it is not counted as a coverage gain. Source and fixture inventories were unchanged during the run. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T144224.728035Z-7e7299b06fb24b9cbd969f6e7ba95ab9/coverage.json (SHA-256 33e9e2de25f42301370012d123fa1baa1c8d0332142c2445a384dfacb714f046); its local receipt SHA-256 is 7734422f22964a2a5a8abdbc4fa5f19ac1687ec2d0e9f52c727c20fbe0a8d012.

WebP VP8 method-zero capped-statistics parity — 2026-10-31

Ran the existing active parity row encode:webp:enc_lossy_quality_0_method_0_capped_statistics on the 128×128 RGB rgb.png source. It passed 1/1 with the exact 698-byte Pillow output and re-decoded pixel parity; the row made four public encode calls and reported no panics. Its selected report adds no new branch outcomes to the local coordinate-level union of the method-0, method-1, method-4, method-6, large-frame, and 204-macroblock WebP encoder reports. The case remains a useful Pillow parity regression for the 50-macroblock capped-statistics behavior; it is not counted as a coverage gain. All seven reports share source-manifest hash 638eb4f23ea7bae92f6497e82a546f8073484d0a00d8e9b42bc5bcb5477309c5; source and fixture inventories were unchanged during execution. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T144520.365963Z-3ee04de5720048659796896605049c15/coverage.json (SHA-256 fc27f96cb876526429f2991ab18b43068b35ca916150b5e36cbefaa68504d281); its local receipt SHA-256 is 9f0573d0a97aef9c818830ed0da697ae60b65d93cd142636f195b210413cf59b.

WebP VP8 single-pixel segment parity — 2026-10-31

Ran the existing active parity row encode:webp:enc_1x1. It passed 1/1 with the exact 64-byte Pillow output and re-decoded 1×1 RGB pixel parity; the row made four public encode calls and reported no panics. Its selected report records the true outcome of maximum_center == minimum_center at src/codecs/webp/encode/vp8/analysis.rs:478 three times. The source-matched local union across the prior nine WebP encoder reports had only the false outcome there; this row adds six branch outcomes to that union: one in vp8/analysis.rs, three in vp8/partition.rs, and two in vp8/encoder.rs. The union is coordinate-level selected evidence, not full-suite coverage.

All ten reports share source-manifest hash 638eb4f23ea7bae92f6497e82a546f8073484d0a00d8e9b42bc5bcb5477309c5; the source and fixture inventories were unchanged during execution. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T145031.965138Z-a9649f4aaa2d4965bbb138a0248d7688/coverage.json (SHA-256 7eee58362aecd3106cd616deb3d31432f4526249b07a05f953a13ca8cdbc4c95); its local receipt SHA-256 is 261491e5ccf14c6c3396ee9448b8775b6c6f84a487937ac2af936fa45e5989f3.

WebP VP8 aligned segment-cluster checkpoint parity — 2026-10-31

Added the active parity row encode:webp:enc_lossy_method_4_segment_cluster_full_span_48x48 for a 48×48 RGB image with a checkerboard macroblock beside flat blocks. Temporary local tracing confirmed that its macroblock alphas span 192 through 255, so the scan visits exactly 64 values. The final uninstrumented selected run passed 1/1 with the exact 124-byte Pillow output and re-decoded pixel parity; it made five public encode calls and reported no panics. Its report records the previously missing false outcome of the 64-value checkpoint condition at src/codecs/webp/encode/vp8/analysis.rs:438 six times. This is local coordinate-level selected evidence, not full-suite coverage.

The source manifest hash is 638eb4f23ea7bae92f6497e82a546f8073484d0a00d8e9b42bc5bcb5477309c5; source and fixture inventories were unchanged during the final run. Coverage MCP returned Transport closed, so managed attribution was not verified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T152058.184462Z-a11c23719f7f43c18545edb0ae6775a4/coverage.json (SHA-256 06b55dde8db3ebe9c3508c3f68e7ec1c0863df6b71a8d2af9fe70d1dec6a2b18); its local receipt SHA-256 is d334fa71f7cc80973a19da07db31ca79571a6d780b1391bc3c595f15c873351a.

WebP VP8 segment-map update parity — 2026-10-31

Added the active parity row encode:webp:enc_lossy_quality_80_method_0_intra4_macroblock_grid_32x32 for a 32×32 RGB input whose alternating 4×4 gray tiles select intra4 luma modes. The exact Pillow output is 490 bytes and the re-decoded pixels match. This case exposed a segment-header mismatch: libwebp omits segment-map probability updates and per-macroblock segment IDs when all segment probabilities are the default. Rust now carries the header's update_map decision into mode writing and emits those fields only when the map is updated.

The new case and the existing encode:webp:enc_lossy_method_4_segment_cluster_full_span_48x48 regression both pass exact byte and pixel parity (2/2 rows, 10 public encode calls, no panics). The selected report records 66/136 branch outcomes in src/codecs/webp/encode/vp8/partition.rs; selected-run counts are not a full-suite coverage percentage. The source manifest SHA-256 is 8bc3fa69195ce50effc28eead29c0d5466e6d1ede9e2affc507d940e8019bd25; source and fixture inventories were unchanged during the run. Coverage MCP returned Transport closed, so managed attribution remains unverified. No unit tests were added.

The report is .coverage-mcp/local-evidence/selected/20261031T160947.235936Z-35cd057dd62a4c1480b6c45d64d2e63b/coverage.json (SHA-256 c133f4086934e34e65de41d7af14e553be09f074a5e118cfb35b79b908b89989); its local receipt SHA-256 is 09da4736dcc811d201d4b1a75f7471c58b0707e05533977f4bfe910fe6c40992.

Full all-feature coverage refresh — 2026-10-31

The standard all-feature coverage command completed with all 139 existing integration and contract test cases passing, including all active public parity-matrix rows. The maintained coverage floors pass: 99,441/140,533 lines (70.759893%), 19,859/31,522 branches (63.000444%), 5,527/9,015 functions (61.308930%), and 151,671/218,011 regions (69.570343%). The report remains below the project's 100% four-metric goal.

The run exposed a stale AVIF census assertion: the manifest and roadmap list 27 planned former-native encode rows, while the existing assertion expected 31. The assertion and current roadmap evidence now agree with the 27-row matrix; fixture integrity, strict Clippy, and formatting checks pass.

The local source-manifest SHA-256 is 4b6ea098df08afba1e99aa6ad9cac73b6675cf822f751578f83a11a1c05a4f9a. The fixture manifest and matrix hashes are 2cf34ef9833788ec44b2361b1d5d36abff0ceb41bbc7d99c7065cd44deb056cf and 02ebbdcbf5879e228da6bf45fce266a9e37eb77df227b35eb11da50382c471e7. Coverage MCP returned Transport closed, so the report has no managed source or test attribution and does not replace the managed baseline. No unit tests were added.

The full report is .coverage-mcp/local-evidence/full-20261031-current/coverage.json (SHA-256 fea09cc7fd393a962006f007380348009065e4e5ea4aeb578f56559eaad67d81).

AVIF still alpha-count invariant cleanup — 2026-10-31

The full report above showed the true arm of the still-image alpha sample-count check in ExtractedAvif::validate was never reached. still_payload constructs both planes from their item-ID lists and rejects unequal lengths before constructing ExtractedAvif, so no public image input can reach the later duplicate check. Removed that duplicate guard while retaining the earlier input-level check. The animated alpha-count mismatch remains checked by the full-sequence decoder.

The selected parity run passed 3/3: the still-grid alpha-count mismatch, the animated alpha-count mismatch, and the 12-bit 4:2:0 alpha-extent mismatch. No unit tests or new fixture cases were added. The selected report's source manifest SHA-256 is 453b9d2cc4ad53c5bb84fd2c7c926fe0740b996684e2e4c400769c9bd56457ef; source and fixture hashes were stable during the run. These selected rows do not refresh the full-suite coverage totals, and the full report predates this edit. Coverage MCP returned Transport closed, so managed attribution remains unverified.

The selected report is .coverage-mcp/local-evidence/selected/20261031-avif-alpha-invariant-cleanup/coverage.json (SHA-256 67f4a52673c57c0cd82a7108f3d16bd78165de41ba42f0682a470327d7c232bf); its local receipt SHA-256 is 6f05f4e951504f035a5cd9abd46203be2b5131054625bf19d531c12689131d45. Formatting, strict all-feature Clippy, and make lint-x86-simd passed. The x86 SSE2 and AVX2 lanes were cross-compiled on an ARM64 host; no x86 runtime performance measurement is claimed.

Full all-feature coverage after AVIF invariant cleanup — 2026-10-31

The standard make coverage run completed all 139 existing test cases with no failures. Current coverage is 99,439/140,528 lines (70.760987%), 19,858/31,520 branches (63.001269%), 5,527/9,015 functions (61.308930%), and 151,667/218,006 regions (69.570104%). All configured alpha floors pass; the four-metric 100% goal remains open.

The source-manifest SHA-256 after the AVIF invariant cleanup is 453b9d2cc4ad53c5bb84fd2c7c926fe0740b996684e2e4c400769c9bd56457ef. Coverage MCP again returned Transport closed; this local full report has no managed source or test attribution. No unit tests were added.

The full report is .coverage-mcp/local-evidence/full-20261031-post-alpha-invariant/coverage.json (SHA-256 1fe7bef9e6b28000e2882de2bb660d4117998a8050567035c961324840c26615).

AVIF reconstructed-plane borrow optimization — 2026-10-31

The portable AVIF decoder now validates reconstructed Y/U/V extents and borrows the already complete, origin-aligned planes directly. This removes a redundant full-frame FrameCanvas allocation and copy from each decoded frame. Coverage builds still inject plane-length faults through an isolated clone; release builds do not include that hook.

Four existing public AVIF parity rows passed exact Pillow pixel comparison: the three-frame 4:2:0 sequence, multi-tile super-resolution, and 10-bit and 12-bit 4:2:0 alpha cases. The Y, U, and V portable-plane fault contracts also passed (7/7 selected rows total). No codec unit tests or new fixtures were added. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261031T172513.024928Z-6e942eb2e8e9463abff0e99a321a29bc/coverage.json (SHA-256 db7645d4652c7a2d9fe4233f827e226e57e82ea3faa741327b60daec132b201b); its local receipt SHA-256 is bcf191bcd6c855bf820f65709dc689333167be2c93985418dab19d5737039ce7.

Two release A/B cohorts used the same public sequence probe, fixture, binary path, 100 timed decodes, and two warmups per cohort, in A–B–B–A and B–A–A–B order. Across 400 timed decodes per binary on an Apple M3 Pro (aarch64, rustc 1.96.1), the direct-plane candidate reduced pooled median time from 10.336 ms to 9.781 ms (5.37%) and linearly interpolated p90 from 10.787 ms to 10.407 ms (3.52%). Every B cohort median was below its neighboring A cohort; the B samples include one 17.063 ms scheduling outlier. The baseline executable SHA-256 is 0da84e66450e93754c8e4d788ad4e000ab91a58883876244a2c2989f504cbbbd; the candidate executable SHA-256 is 8a2819c67ff5572436068f8602d2de9cfc785086c5fb73d77cec66b0c60ccfa1. Both used fixture SHA-256 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a. The 127-file source-closure manifests differ only in src/codecs/avif/decode.rs (baseline SHA-256 28d4c0305090ab1ff0bbcc34aedd6a51ff2c02b250ab43a244b927210cc5cb6f, candidate SHA-256 9a97a90099680bf3c4effc57948236da310b18b3c8e258ed5f7c6451210e5ca8).

At the time of this direct-plane change, the full all-feature report recorded 99,458/140,541 lines (70.7680%), 19,865/31,528 branches (63.0075%), 5,528/9,017 functions (61.3064%), and 151,697/218,027 regions (69.5772%). All 139 integration tests passed and the configured floors pass; the 100% goal remains open. The report is .coverage-mcp/local-evidence/full-20261031-avif-plane-borrow/coverage.json (SHA-256 0aed5abd72336558ae8ae05fee6f92c159c9e3ec8f2bc2d7b0044fb52b478d77). Coverage MCP returned Transport closed, so this is local LLVM evidence without managed attribution.

Formatting, strict all-feature Clippy, x86-64 SSE2 and AVX2 compile-only Clippy, and the native/WASI/WebAssembly feature matrix passed. The x86 lanes were cross-compiled on the ARM64 host; no SSE2 or AVX2 runtime speed claim is made.

AVIF duplicate sample-description color parity — 2026-10-31

The earlier full LLVM report showed that the duplicate-color-property arm of samples::parse_sample_description had no witness: the branch at samples.rs:2664 recorded 2,134 hits for the first-color path and zero for the duplicate path. Added active parity row decode:avif:error_animated_duplicate_sample_description_colr. Its generated AVIS fixture inserts a conflicting second nclx property, rebases sample offsets, and preserves the encoded media data. Pinned Pillow 12.2.0 recognizes AVIF, then rejects the file as malformed. The Rust parser now rejects the duplicate color property with the same public outcome. The selected case passed 1/1 with no target-only fault rows and no codec unit tests.

The selected local LLVM report is .coverage-mcp/local-evidence/selected/20261031T174846.958160Z-ebb7759b93984b08be46bfb253a276db/coverage.json (SHA-256 cc6e9498f4ec236d1babac894ed2c56fe20c9eec5c37335e6f20549dbe25c73e); the local-only receipt SHA-256 is e2a5f8c9b7d67e5700c26cea61e6f8199490672d7a1cb26fcc11bbd56ae870dc. The fixture SHA-256 is 99f4051b60a85669670f9664d20a061a57a7e8ad00115219ab34bfb2ef65c396. In the refreshed full report, the branch at samples.rs:2664 records both outcomes (2,140 and 6 hits); the AVIF parser file has 583/588 branches covered.

The refreshed all-feature run passed all 139 integration tests and records 99,459/140,542 lines (70.7682%), 19,866/31,528 branches (63.0107%), 5,528/9,017 functions (61.3064%), and 151,699/218,028 regions (69.5778%). Its report is .coverage-mcp/local-evidence/full-20261031-post-duplicate-stsd-colr/coverage.json (SHA-256 dd2f4bd56a161b91d0a342566acfb23f4a8c9a70d85a809372c1de7dd4401faa). Coverage MCP again returned Transport closed; these are local LLVM measurements with no managed attribution. The 100% goal remains open.

After this parser change, a release A/B rerun used the same public sequence fixture and four 100-decode cohorts per binary. Timing varied substantially between adjacent cohorts: candidate medians ranged from 10.199 to 23.199 ms; the pooled p90 was 31.798 ms for the baseline and 33.512 ms for the candidate. This run is inconclusive and is not treated as a speedup claim. The earlier lower-noise result applies to the direct-plane change alone. Raw cohort logs and the current candidate summary are retained under target/avif-perf-evidence/ for local inspection.

make lint, make lint-x86-simd, make test-feature-matrix, make refresh-fixture-integrity, and pinned-Python make verify pass. The SSE2 and AVX2 lanes are compile-only cross-checks on the ARM64 host.

AVIF word-packed raster coverage — 2026-11-01

FrameCanvas and MonochromeFrameCanvas now share a checked u64 coverage mask. Row overlap and completeness checks inspect word ranges, and monochrome placements keep checked written-sample counts so CDEF completion does not rescan the bitmap. The storage remains one bit per sample; the change targets per-sample coverage iteration and does not add CPU-specific intrinsics.

Five public AVIF parity rows passed against the pinned Pillow references: 12-bit 4:2:0 alpha odd edges, the 12-bit alpha extent error, animated alpha sample-count mismatch, monochrome multi-tile CDEF, and the 2048x128 temporal motion sequence. No codec unit tests were added or run. The selected LLVM report records 1,441/4,646 lines and 224/898 branches in raster.rs; this is selected-run coverage, not a full-suite total. Its report is .coverage-mcp/local-evidence/selected/20261031T225526.013834Z-59ee43640398411a94fc4bc53a4c2d23/coverage.json (SHA-256 87e1f15709267e670e2d09b0ef59503167ec84deb5027285c66aea1540c11fa0), and its local receipt SHA-256 is 606e6e426402a34ec84994018c42138562facba615b720c2be1cd7ec7ef3b6db. Coverage MCP returned Transport closed; these are local LLVM measurements without managed attribution.

The release probe compared the same 2048x128 AVIF input in A–B–B–A order, with two warmups and 100 timed decodes per cohort. On an Apple M3 Pro with rustc 1.96.1, the pooled median over 200 baseline samples was 10.506 ms and over 200 candidate samples was 9.356 ms (10.94% lower). Cohort medians were 10.379 and 10.656 ms for A, and 9.318 and 9.399 ms for B; each B cohort was faster than both A medians. The fixture SHA-256 is 294468c2498c8fa494bfcc2e701a944e90f15ec4b5f08eb64fa34f907e5a6a1a; the candidate raster.rs SHA-256 is 0fef4a662acf7e778b16de04b90f5473ea86df7a40985c276cbfe5a56943d4fb. The baseline and candidate probe executable SHA-256 values are 1113e916cce052b3260f2a3107bc8de46b9022269cff8ed0944d2d50025155b7 and 92f64005912fca8688750e9690d373272c72d9157f7430aa3619f39c8eca75e7. Per-cohort samples are retained under target/avif-perf-evidence/.

Formatting, strict all-feature Clippy, and x86-64 SSE2-baseline and AVX2 Clippy cross-checks passed. The x86 lanes were compile-only on this ARM64 host; no SSE2 or AVX2 runtime speed claim is made.

Full native coverage refresh — 2026-11-02

The all-feature native integration run on local develop at 69a79d4c4 plus uncommitted changes passed all 139 checks across six executables. Every active matrix ID reconciled exactly once: 3,470 parity cases passed, and all 167 existing target-only fault contracts passed in their separate lane. The 27 planned parity rows were not executed. No private unit-test executable ran, and no unit tests were added.

The unfiltered LLVM report records 101,693/141,986 lines (71.621850%), 20,556/31,936 branches (64.366232%), 5,634/9,123 functions (61.756001%), and 154,917/220,119 regions (70.378750%). The alpha floors pass; make coverage-complete exits 2 at its final 100% gate after all tests pass. No source exclusions or threshold changes were introduced.

The report and per-case results are retained outside target/ under .coverage-mcp/local-evidence/full/20261102-current/. The report SHA-256 is c2c44af02a511c5518741e7c4618721b861ccc6852eb09e542d1b876f89891bc. The command, environment, tool versions, six instrumented executables and raw profiles are retained there. All 150 full-run source/setup hashes and 9,469 fixture hashes remained unchanged during measurement; source snapshots and before/after hash manifests bind this local result to the checkout.

Nine Coverage MCP CLI queries succeeded. The connector was unavailable; CLI imports remain source-unverified and test attribution unknown. The LLVM file summaries put 9,971 of 11,380 uncovered branch outcomes in AV1 entropy and block reconstruction. The all-children-deep B16x64/B64x16 inter-transform arms remain concrete input-generation candidates, with no cases added for those candidates in this refresh. Generic function groups overlap, so their gap counts are not added. This local report does not replace historical managed claims or establish an incremental gain against changed source.

This refresh adds no runtime changes or timing samples. Existing style and platform checks retain their earlier source-bound scope. SSE2/AVX2 runtime performance, fastest-codec ranking, and 100% coverage remain unfinished.

AVIF bounded metadata policy parity — 2026-11-02

Six existing AVIF inputs now also exercise public decode_with_policy with an explicit metadata limit equal to the complete input length. They cover size-zero free and skip boxes, an unknown box, a truncated trailing box header, and duplicate trailing meta and animated moov boxes. Coverage MCP identified missing paths in the bounded-extent, omitted-metadata parser specialization. No runtime code or private codec unit tests changed.

The pinned Pillow 12.2.0 oracle replayed all six inputs and ten frames with exact existing pixel references. Regenerating the AVIF matrix changed only the six policy limits; input bytes and reference pixels stayed unchanged. Both selected coverage campaigns passed all six parity rows with no fault rows selected. Their 139 source hashes match. The local LLVM summaries for src/codecs/avif/samples.rs changed from 1,699 to 1,748 covered lines (of 2,375), 306 to 315 branches (of 588), 153 to 158 functions (of 235), and 2,668 to 2,739 regions (of 3,967). These are selected-campaign observations, not full-suite gains or evidence of 100% coverage.

Reports, source receipts, exact test executables, oracle replay, and matrix delta are retained outside target/ under .coverage-mcp/local-evidence/parity/avif-metadata-policy-20261102/. The before/after report SHA-256 values are 0c585209bd609e313c30e19a5886fd132d4579b522d882c549cc440f21aa0a8a and 878ed2642a44a9107328deb340ee99f9948fdad66482ac2d2cf1c01937fe0ee0. Coverage MCP recognizes each locally derived source receipt and passing test status, but returns incomparable for their comparison: embedding the changed matrix produces different test-executable build IDs. This evidence is local, not managed Coverage MCP attribution. It makes no performance claim.

AVIF sequence EOF boundaries and native profile attribution, 2026-11-03

Six ordinary malformed AVIF inputs stop the internal sequence header before the decoder-model flag, buffer-removal delay width, frame-width field size, maximum frame width, frame-ID flag, and order-hint flag. Complete BMFF sample and primary-item extents remain consistent. Pinned Pillow header verification succeeds and decoding rejects each input; the public Rust decoder agrees. The existing healthy decoder-model animation remains the complete control.

The focused manifest campaign passes seven cases, including that control, with 139 codec/build/test source hashes unchanged. Public input probes identify six distinct previously uncovered sequence-parser regions against the retained full baseline, with an identical 492-region mapping. Complete unfiltered LLVM exports and actual invoked executables are retained under .coverage-mcp/local-evidence/parity/avif-sequence-boundary-probe-20261102/. This is a source-region projection, not a new whole-repository coverage run. All 3,751 preceding matrix rows, 1,299 preceding AVIF observations, 167 existing target-only fault rows, and the native loop index remain unchanged. No codec unit tests or new target-only faults are added.

The native profiler now pins Cargo release debug information without stripping or split files and requires actual ELF DWARF sections and converter source-line mapping. A small CLI counts bounded raw perf sample records instead of rounded report headers. Five retained native profiles reproduce their exact counts; seven local public JPEG workloads retain identical complete encoded bytes between the original and revised debug builds. These diagnostic checks do not establish a runtime speedup. The preceding native profile lacks DWARF line information; its function self samples remain usable, while source-line and complete-unwind claims are withheld.

Mixed-super-resolution film-grain parity — 2026-11-03

Eight new AVIF decode rows cover active display grain with mixed-segment super-resolution: 400 at 10/12 bits, 420 at 12 bits, 422 at 8/10/12 bits, and 444 at 10/12 bits. The 4:4:4 cases use 128x64 display dimensions and a coded width of 64 to fit the decoder's bounded grain geometry. The pinned producer reproduced all eight inputs twice, and the selected parity campaign passed 8/8 exact RGB frame comparisons against Pillow 12.2.0.

Coverage MCP's selected-report query found eight branch arms still uncovered in mixed_segment_superres_film_grain_supported. The report is retained at .coverage-mcp/local-evidence/selected/20261103T010050.321471Z-d354387b8c274118a45abea21f0b4209/; it is a local, selected-only measurement with unverified source identity and unknown test attribution, so it does not establish a whole-repository coverage gain.

An 8-bit 4:4:4 candidate was excluded after the public Rust decode path returned Unsupported without a retained primary surface, while the pinned Pillow and libavif references decoded it. That remains a decoder parity gap for a later implementation pass. No runtime code or unit tests changed in this campaign, and it makes no performance claim.

AV1 exact B8x4 inter geometry parity — 2026-11-03

The new public parity row decode:avif:animated_lossy_inter_420_b8x4_mode_select_64x64 uses a deterministic two-frame lossy 8-bit 4:2:0 input. Its inter frame reaches the exact B8x4 geometry guard at src/codecs/avif/av1/block.rs:49889 while retaining TX_MODE_SELECT. The selected run passed 1/1 parity row, matching both 64x64 RGB frames byte-for-byte with pinned Pillow 12.2.0. The pinned native AVIF observer independently decoded both frames and reported one total play.

Coverage MCP's full-report baseline had zero true-arm hits at that source guard; the selected LLVM report records 12 true hits for each of the two short-circuit condition spans. The reports are retained outside target/ under .coverage-mcp/local-evidence/full/20261103-ca295c920-current/ and .coverage-mcp/local-evidence/selected/20261103T102040.663199Z-c589049aeed24b2699cf6d1b71f6649d/. The selected report SHA-256 is 0a0624e1838004ab68591f0c4e5aa06ba2c12492da3b8fce462ac633525ee4ac. The local coverage-mcp gaps result marks source identity unverified and test attribution unknown; this is selected-case evidence, not a whole-suite coverage gain or a managed source/build receipt. No runtime code or unit tests changed.

AV1 exact B4x8 inter geometry parity — 2026-11-03

The public parity row decode:avif:animated_lossy_inter_420_b4x8_mode_select_64x64 adds the vertical counterpart to the B8x4 case. Its pinned two-frame 8-bit 4:2:0 AVIF reaches the exact B4x8 geometry at src/codecs/avif/av1/block.rs:49887 with TX_MODE_SELECT. The selected parity run passed 1/1 row and matched both 64x64 RGB frames byte-for-byte with Pillow 12.2.0. The independent pinned libavif observer decoded both frames and reported one total play.

The local selected LLVM report records 15 observations on the exact B4x8 block-size arm and 15 on its width check. Coverage MCP's full-report baseline lists uncovered arms at this guard. The report is retained at .coverage-mcp/local-evidence/selected/20261103T111010.071678Z-4686afd83e3847c381f364886711a9ba/coverage.json; its SHA-256 is 6b469cac95d293fecef267bf76dccfc2f97e263f3be39714ce3fb5d5548c0587. Coverage MCP marks the local measurement source as unverified and test attribution as unknown, so this is selected-case evidence rather than a whole-suite coverage claim. No Rust runtime code or unit tests changed, and this parity case makes no performance claim.

AV1 4:4:4 B4x8 inter geometry parity — 2026-11-03

The public parity row decode:avif:animated_lossy_inter_444_b4x8_mode_select_64x64 adds a vertical B4x8 TX_MODE_SELECT inter sequence in 8-bit 4:4:4. Selected parity passed 1/1 and matched both 64x64 RGB frames byte-for-byte with Pillow 12.2.0. The pinned libavif observer independently decoded both frames and reported one total play. The retained frame hashes are f3bd9d9b5393974efe11e1273ba728f3fcb56803a0335a4c49b26ca9856c0811 and 43a7e9fd294fde37a6c5c5887c468097134a5409b51da72bc2d141e5931e92c1.

The selected LLVM report records 15 observations for the exact B4x8 block-size arm and 15 for its width check at src/codecs/avif/av1/block.rs:49887. The report is retained at .coverage-mcp/local-evidence/selected/20261103T115120.739619Z-94bd8a99d3214c7c99165e5aeb94172c/coverage.json; its SHA-256 is ca3bd1a4abf1d0406223dfc56541e00de03e26dc0a36cb0b8dcc276d2d9bb47f. Coverage MCP marks the selected measurement source as unverified and test attribution as unknown, so this is selected-case evidence rather than a whole-suite coverage claim. No Rust runtime code or unit tests changed, and this parity case makes no performance claim.

AV1 4:4:4 B8x4 inter geometry parity — 2026-11-03

The public parity row decode:avif:animated_lossy_inter_444_b8x4_mode_select_64x64 adds the horizontal B8x4 TX_MODE_SELECT inter sequence in 8-bit 4:4:4. Selected parity passed 1/1 and matched both 64x64 RGB frames byte-for-byte with Pillow 12.2.0. The retained frame hashes are 62f80b849b2615a028e9d8b7be51e37e63752922898439d37ebc89bd4f69dfe6 and 73367a93996d2e243c46f0c3b52c50ea43fdcee83e3c18452efcf37dd833bd04. The pinned libavif observer decoded both frames and reported one total play.

The selected LLVM report records 14 observations for both the exact B8x4 block-size check and its width check at src/codecs/avif/av1/block.rs:49889. The report is retained at .coverage-mcp/local-evidence/selected/20261103T122912.661948Z-16a2daa8324d475e86779b2654eac6ba/coverage.json; its SHA-256 is eddea33238563fb8a3edeb63b732a8df98bf2212127fe8e98e01a27d7526e985. Coverage MCP marks the selected measurement source as unverified and test attribution as unknown, so this is selected-case evidence rather than a whole-suite coverage claim. No Rust runtime code or unit tests changed, and this parity case makes no performance claim.

AV1 nonuniform tile-column cap parity — 2026-11-03

Two public parity rows cover a valid nonuniform tile grid and the 64-column cap boundary. The valid 256x256 fixture matches Pillow RGB output exactly. The 4097x1 malformed still fixture leaves one of 65 superblocks uncovered after 64 tile columns; a second, one-bit tile-payload mutation makes Pillow reject the input while Rust rejects the earlier cap violation. Selected parity passed 2/2 rows.

Coverage MCP found one uncovered false arm at src/codecs/avif/av1/frame.rs:3841 in the retained full baseline. The selected LLVM report gives the same line zero gap groups. It is retained at .coverage-mcp/local-evidence/selected/20261103T135033.272433Z-cba7aae085b849d3b7cceb293517a051/coverage.json; its SHA-256 is 989540e62fe6f0921c52332272bc80ba8ab4fb19176be614b82fc41d9c12b0c2. Coverage MCP labels the report source unverified and test attribution unknown, so this records a selected branch observation rather than a whole-suite coverage gain. No Rust runtime code or unit tests changed, and this parity case makes no performance claim.

AV1 odd-width high-depth lossless inter edge — 2026-11-03

The public parity row decode:avif:animated_lossless_inter_420_b4x8_10bit_odd_65x64. The two-frame 65x64 full-range 10-bit I420 AVIF has lossless B4x8 inter leaves, with one visible luma column at the odd right edge. Pillow 12.2.0 decodes both frames; the public still-image API matches frame zero exactly (12,480 RGB bytes, SHA-256 006469f39295cec2dc6e36ecf1900ee939ca3bd060a4bdc88f22c5b2d47beef0). The independent pinned libavif 1.4.1 observer decodes two frames, reports repetition count zero, and produces stable output. Rust now admits this bounded high-depth I420 sequence profile. The inter decoder processes the complete TX4x4 residual cells that overlap the clipped B4x8 right edge, then publishes only the visible luma column. The selected public parity row passes 1/1 with exact parity for both sequence frames.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261103T175749.790567Z-3e4966b9177943f1bae45a9d706b4a92/coverage.json (SHA-256 ea9a639d31369ae48b04c02cafa75194d405bd3520df4a3c68d00a0bd0c8abeb). This receipt is local evidence with source identity unverified and test attribution unknown. A Coverage MCP query of this selected report identifies the unexecuted high-depth fallback in decode_inter_transform_size; this valid fixture follows the admitted lossless-grid path instead. The query is useful for locating the remaining edge, but the local report does not prove a suite-wide coverage change. The successful parity run independently proves the public pixel behavior. No unit tests or SIMD changes were added, and the full coverage baseline was not refreshed.

AV1 69-pixel odd-width high-depth lossless inter edge — 2026-11-04

The public parity row decode:avif:animated_lossless_inter_420_b4x8_10bit_odd_69x64 covers a valid two-frame, 69x64 full-range 10-bit I420 all-lossless sequence. Its pinned AOM generator produces the fixture reproducibly, and Pillow 12.2.0 plus the pinned libavif 1.4.1 observer decode both frames. Public decode_sequence output matches the independent RGB frame references byte-for-byte (13,248 bytes per frame; frame SHA-256 values 5b47ce4079e56271e7163f1795422c04d05e70f96340b3c510085e68a22fd9f0 and a2fa968856ff74c57daf8f7100d088bad57d0c8a06f77e0fc2b4e57622c48aa5).

The frame admission bound in complete_high_depth_lossless_inter_reconstruction_context now accepts widths 65 through 71 for this fixed 64-row profile. Coverage MCP records the width gate's true arm in the selected 69x64 run; the false arm remains unobserved. Coverage MCP also showed that the separate clipped-B4x8 geometry helper was not entered by either the 65x64 or 69x64 parity fixtures, so its bound was left unchanged at the time of the original change.

Follow-up on 2026-11-05: tracing the public call path showed that the partition walker passes node.width * 4 to decode_inter_leaf. A B4x8 leaf therefore supplies a width of four, and the ordinary exact-size geometry check already admits it. The extra helper required a width from one through three, which no caller could supply, so it was dead code rather than a missing public parity case. The helper and its redundant admission arm were removed without changing behavior for inputs reaching the decoder. The existing 65x64 and 69x64 public parity rows passed 2/2 after removal. Coverage MCP reports no remaining locations for the removed helper in that selected report; its source identity is unverified and test attribution is unknown, so this is not an aggregate coverage claim. The report is .coverage-mcp/local-evidence/selected/20261105T015034.504493Z-34f0865735724e49bc2c09b92f567aa2/coverage.json (SHA-256 d787425465edf109c808b92d8509afc32a43b99e6dc23e82e818e66227bc1c58).

The original selected LLVM report is .coverage-mcp/local-evidence/selected/20261104T164158.691688Z-69d30c625c284406b9286d32c10fe47a/coverage.json (SHA-256 28be03b545bd58addf1b1b49db72b6382dad65d651984a59292ca9d0cf8c0626). This local report has source=unverified and tests=unknown; it is selected-case evidence, not an aggregate coverage claim. No unit tests, SIMD code, or hot pixel loops changed, and this admission-only change makes no performance claim.

Lossless I444 Square64 sequence parity and fallback contract — 2026-11-04

The new public row decode:avif:animated_lossless_inter_i444_fixed_b64x64_64x64 adds an exact two-frame 64x64 8-bit lossless I444 sequence with textured chroma residuals. The pinned Pillow 12.2.0 references cover both RGB frames byte-for-byte, and the pinned native libavif observer confirms two frames with infinite repetition. The sequence parity harness and the selected matrix parity row both pass. The generator checks repeat encoding, frame hashes, all-lossless I444 headers, fixed 64x64 partitions, and the canonical input digest.

The selected sequence parity measurement did not cover the first-partition fallback: its ordinary complete-frame path stays in the supported decoder. The existing target-only fault contract fault-contract:avif:av1_lossless_i444_first_partition_fallback_matches_parity injects Av1LosslessI444FirstPartitionFallback while decoding a separate 10-bit lossless I444 still. It compares the public decode result with Pillow, then requires a clean retry to match. The contract passed 1/1 with oracle_status: not_applicable. Coverage MCP reports zero remaining branch gaps at src/codecs/avif/av1/block.rs:20993 for this retained fault-contract measurement.

The selected matrix report is .coverage-mcp/local-evidence/selected/20261103T205918.907601Z-c58830d120c44384ab44e06cd5f61e5a/coverage.json (SHA-256 2f75094b2a5d38edc22c417fb89d773250d07c652dba04cb3147ed95249d5d4b). The target-only fault-contract report is .coverage-mcp/local-evidence/selected/20261103T211820.742902Z-aaced1ef9ff84eaa89744cc32ca628b4/coverage.json (SHA-256 a00a24d285dc3d07e27d69b4b69f7cfc99f818254c2551613452c9a798438edd). Both are local selected measurements with source identity unverified and test attribution unknown. The targeted zero-gap result does not claim complete repository coverage; the retained fault report still has 29,943 of 31,998 branches unobserved overall. No runtime implementation changed, no unit tests were added, and no performance gain is claimed. Strict Rust lint and x86-64 SSE2/AVX2 lint both pass.

WebP metadata signature guards and public reachability — 2026-11-04

The retained full LLVM report records both branches of the RIFF and WEBP signature guard in src/codecs/webp/decode.rs as unhit: lines 185 and 186 each have counts (0, 57). The refreshed full local report is .coverage-mcp/local-evidence/full/20261104-main-561a1de/coverage.json (SHA-256 c55551d8702868c9fc8fc5e7b0311d9ced40e1c77fb569b5d2fe6f3e3639d705), generated by make coverage at main commit 561a1de87. Its aggregates are lines 72.254851%, branches 65.942618%, functions 62.164824%, and regions 70.980892%. It is a local full-suite report, not a Coverage MCP source/build receipt; MCP source and case attribution remain unverified.

These guards are defensive: normal WebP detection requires RIFF, WEBP, and a recognized first image chunk before selecting the WebP decoder. The public decode path also validates an explicitly supplied format against detection. Malformed-signature parity rows therefore fail before metadata_bytes can reach these checks. No honest public parity input can exercise the rejected signature arms through the current API, and a private direct-call test would violate the parity-only test policy. Keep the defensive checks and count them in coverage totals; do not manufacture a public case or exclude the lines.

This documents a coverage disposition, not completion: the fresh report still has 10,897 of 31,996 branches unobserved, and reachable gaps still need public parity cases. Coverage MCP is not connected in this run, so no MCP attribution is claimed.

JPEG singleton chroma upsampling parity — 2026-11-04

The existing public YCCK parity rows for 1x1 and 2x2 H2V1 and H2V2 inputs already cover both one-pixel and two-pixel destination rows. The row dispatcher previously sent all one-sample source rows through its nearest-neighbor fallback, leaving the singleton branches in upsample_h2v1_row and upsample_h2v2_row unreachable. It now uses those helpers for a one-sample source, where they preserve the same replicated pixels; H2V2 copies the selected source row instead of blending an adjacent row. Width-two inputs keep the fallback. The common source-width-greater-than-two path retains its first guard comparison and short-circuit behavior.

Selected coverage and Pillow parity passed six existing rows: decode:jpeg:ycck_h2v1_single_sample_1x1, decode:jpeg:ycck_h2v1_single_sample_2x2, decode:jpeg:ycck_h2v2_single_sample_1x1, decode:jpeg:ycck_h2v2_single_sample_2x2, decode:jpeg:jpeg_chroma_1x9_420_progressive, and encode:jpeg:enc_cmyk_subsampling_420_single_sample_width. The latter two guard against changing ordinary 4:2:0 decode or CMYK encode round-trip pixels. The local selected report is .coverage-mcp/local-evidence/selected/20261104T041504.424190Z-5649901011014679b733063e84b2aad6/coverage.json (SHA-256 4cff67a5179bcb7d082b67302049daa1223a29a013d9ef8fe13fa6604eed4989). It records the singleton arm in upsample_h2v1_row at line 465 (18 hits) and upsample_h2v2_row at line 495 (130 hits); each helper's nested output-length condition has both outcomes observed. The report and receipt are local-only; Coverage MCP was not queried and test attribution is unknown. This focused result is complemented by the refreshed full local baseline above. No unit tests or new parity rows were needed, and no performance gain is claimed.

JPEG destination-row geometry fault contract — 2026-11-05

Added target-only case fault-contract:jpeg:jpeg_fancy_upsample_row_destination_y_out_of_bounds on the active decode:jpeg:color_ycck_app14_transform_2 fixture. Its one-shot cfg(coverage) hook supplies an out-of-range destination row after the component height has been checked. The public decode must return a malformed JPEG StillDecode error, and a clean retry must succeed. The manifest records oracle_status: not_applicable; the row is target-only fault-contract evidence.

The focused run included the ordinary Pillow YCCK parity row and both the source-length and destination-row fault contracts. All three selected rows passed. In src/codecs/jpeg/decode/upsample.rs:400, the source-length predicate recorded true/false counts of 1/145, and the destination-height predicate recorded 1/144. The retained local report is .coverage-mcp/local-evidence/selected/20261105T070038.116113Z-8083d031a2d4479c9a6aff0959ca0bf4/coverage.json (SHA-256 bee7e47e5284dcd3b24b726ece289514c07e478ff12c5623ba123c889231cc8f); its local receipt is .coverage-mcp/local-evidence/selected/20261105T070038.116113Z-8083d031a2d4479c9a6aff0959ca0bf4/coverage.local-evidence.json (SHA-256 6897a3f66081250ceb3346e1aefd2bdfeb67603bca3561b8b393d99d716924a3). The receipt marks source identity unverified and test attribution unknown; this selected result does not claim aggregate coverage. The injection compiles only for coverage builds, so the release decoder path has no added runtime work.

WebP metadata reuse selected parity — 2026-11-05

Selected public encoder parity for encode:webp:enc_exif and encode:webp:enc_lossless_exif_metadata_reuse passed 2/2 rows. The lossless 1x1 EXIF case exercises the existing_start = 12 path in attach_metadata_reusing_output: the selected report records the false arm of the VP8X-header condition at src/codecs/webp/encode/mod.rs:949 six times. This branch was absent from the older full report but already has a valid input-driven parity case, so another fixture is unnecessary for it.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261105T075429.713935Z-746dbac08727438d9bfbe5d64ffb8947/coverage.json (SHA-256 320e276b66b99f56f252eb81714ba2d965c2e422f05cefb344e0bb7b3bc89040); its local receipt is .coverage-mcp/local-evidence/selected/20261105T075429.713935Z-746dbac08727438d9bfbe5d64ffb8947/coverage.local-evidence.json (SHA-256 de19396cc50f99fd84e53e2e3fc8c67da77034a1c7ac77045bd11f9236e073fc). The receipt is local-only and does not establish MCP source identity or test attribution. This focused run does not refresh aggregate coverage.

WebP animated-alpha dimension-guard reachability — 2026-11-05

Selected public Pillow parity for decode:webp:animated_animated_alpha_lossy and decode:webp:error_malformed_container_animated_alpha_vp8_too_large passed 2/2 rows. The malformed fixture is generated by changing the nested VP8 chunk's declared size to 0x100000; the decoder rejects it at the ANMF extent check in src/codecs/webp/native/decoder.rs:748, before calling Vp8Decoder::decode_frame or reaching the following dimension guard at line 755. The selected report records the extent predicate true/false counts as 2/4 and the dimension predicate true/false counts as 4/0.

The false arm of the dimension guard is unreachable from a VP8 frame header: src/codecs/webp/native/vp8.rs:1227-1228 masks both dimensions with 0x3fff, so each is at most 16,383. The existing fixture checks the declared chunk extent, not an oversized decoded dimension. Keep the guard as a defensive invariant; do not add a private test or claim that this fixture covers its false arm.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261105T080258.892233Z-efc5729c2b2c49efbee77262a0e694b9/coverage.json (SHA-256 e5600e8ec0336fde7e5dea869ccdd07a1dd56057bb5e2512e2f629acccd6cc15); its local receipt is .coverage-mcp/local-evidence/selected/20261105T080258.892233Z-efc5729c2b2c49efbee77262a0e694b9/coverage.local-evidence.json (SHA-256 8702313a68d833fbe1a8ae2402e91839338147296000dcf7f781aeceacedee01). The receipt is local-only, and this focused run does not refresh aggregate coverage.

BMP invalid-signature decoder contract — 2026-11-05

Coverage MCP identified an unobserved branch arm at src/codecs/bmp/decode.rs:375. The active Pillow parity row decode:bmp:error_not_bmp reaches public format detection, which returns UnknownFormat before selecting the BMP parser. Added a target-only contract that reuses that fixture and invokes BMP dispatch through a cfg(coverage) hook. It checks the stable malformed-BMP error and leaves normal decoder selection unchanged. The hook is absent from non-coverage builds.

The focused selected run passed the Pillow parity row and target-only contract (1/1 in each lane). Coverage MCP then reported only the false arm of the signature condition as missing in that selected report, so the malformed signature arm was observed. The report is .coverage-mcp/local-evidence/selected/bmp-invalid-signature-20261105-retry1/coverage.json (SHA-256 9e99ef64735fef0866bc59f22fe5ab89aa23e6491b75038247c0f9661ae7489f); its local receipt is .coverage-mcp/local-evidence/selected/bmp-invalid-signature-20261105-retry1/coverage.local-evidence.json (SHA-256 9630f77abcda9ca78498835a566017dbb3ff95aed8e397b359e4cf2871890fb9). The receipt marks source identity unverified and test attribution unknown. This selected result does not claim aggregate coverage.

BMP metadata-size invalid-signature contract — 2026-11-05

Coverage MCP also identified the unobserved invalid-signature arm in src/codecs/bmp/decode.rs:845, the BMP metadata-size parser. Public decoding validates the format signature before measuring metadata, so the existing decode:bmp:error_not_bmp fixture cannot reach that parser through normal dispatch. Added a target-only fault contract that reuses this fixture and calls the metadata parser through a cfg(coverage) hook. It checks for a malformed BMP inspection error with the invalid-signature message; the hook is absent from non-coverage builds.

The selected run passed the existing Pillow rows decode:bmp:error_not_bmp and decode:bmp:compression_none, plus the direct decoder and metadata-size fault contracts (2/2 parity rows and 2/2 target-only contracts). Coverage MCP reported only the false arm at line 845 as missing in this selected report, confirming the malformed-signature arm ran. Its report also recorded no missing arms at the direct decoder signature check (line 375) or indexed-palette attachment check (line 825).

The report is .coverage-mcp/local-evidence/selected/bmp-signature-and-metadata-20261105/coverage.json (SHA-256 3bb9d8cc99da4fa68b6482270842bdb89a4018d821a35ad1555245fadfbe2bfa); its local receipt is .coverage-mcp/local-evidence/selected/bmp-signature-and-metadata-20261105/coverage.local-evidence.json (SHA-256 3d65e221af4eefb28419c1868920b666e8700bcd3bb3dd3a0fcb68fe5f7236e0). The receipt marks source identity unverified and test attribution unknown. This focused result does not claim aggregate coverage.

GIF and WebP metadata signature contracts — 2026-11-05

Coverage MCP identified signature-rejection arms that normal public format detection cannot reach in gif::decode_sequence, GIF metadata measurement, and WebP metadata measurement. Added four target-only fault contracts using existing Pillow unknown-format inputs:

• fault-contract:gif:gif_sequence_decoder_invalid_signature_contract
• fault-contract:gif:gif_metadata_extent_invalid_signature_contract
• fault-contract:webp:webp_metadata_riff_signature_contract
• fault-contract:webp:webp_metadata_webp_signature_contract

Coverage-only hooks invoke the selected parser below public detection and are absent from normal builds. All four focused contracts passed. Coverage MCP on the selected report observed the GIF invalid-signature branches at src/codecs/gif/decode.rs:48 and :368, and both WebP signature rejection branches at src/codecs/webp/decode.rs:185-186. The selected report still shows other, unselected continuation arms as missing.

The report is .coverage-mcp/local-evidence/selected/20261105T145242.093363Z-5f9162404b70488297dcea31b1cd54ae/coverage.json (SHA-256 1986e3ebfb619fe31899f02519ee5414b57e7ced9b3f7e0815e3fd113d854649); its local receipt is .coverage-mcp/local-evidence/selected/20261105T145242.093363Z-5f9162404b70488297dcea31b1cd54ae/coverage.local-evidence.json (SHA-256 236eb4cdff172e314855ac91c8b088a502225c434536701c59a184588e700187). The receipt marks source identity unverified and test attribution unknown. This focused result does not claim aggregate coverage.

WebP inspection signature contracts — 2026-11-07

The retained full-parity report showed both rejection outcomes missing at src/codecs/webp/inspect.rs:25. Existing malformed WebP Pillow parity fixtures cover an invalid RIFF signature and an invalid WEBP form type, while public format detection returns UnknownFormat before this inspector is reached. Added two target-only inspection hooks and fault-contract rows that reuse those parity inputs and assert structured Malformed inspection errors:

• fault-contract:webp:webp_inspect_riff_signature_contract
• fault-contract:webp:webp_inspect_webp_signature_contract

The focused selected-coverage run passed both rows. At line 25 it recorded the first signature condition true/false counts as 1/1 and the second as 1/0; the retained full-parity report records 956 false outcomes for each condition. These are separate selected and full-parity observations, not an aggregate coverage claim.

The selected report is .coverage-mcp/local-evidence/selected/20261107T060831.391722Z-56dc54b468c046209412a4315b9b34dc/coverage.json (SHA-256 ded25c1cc09510be8e99297a14427b598e93e33ae70f9852dc00b0be9ba1b51c); its local receipt is .coverage-mcp/local-evidence/selected/20261107T060831.391722Z-56dc54b468c046209412a4315b9b34dc/coverage.local-evidence.json (SHA-256 d89779dc6a2c0e827dec08d0db98dbd563ffb4f54f20ac9d2004f9d87275e679). The receipt marks the source unverified and Coverage MCP unqueried, so this remains local selected evidence only.

JPEG inspection signature contract — 2026-11-07

The retained full-parity report showed the invalid-signature outcome missing at src/codecs/jpeg/inspect.rs:35 (2,359 false outcomes). The active Pillow-backed decode:jpeg:subsampling_444 case already covers valid JPEG input. The target-only fault contract validates that normal decode against its Pillow pixels, flips the first signature byte, calls the coverage-only direct inspector, and requires the structured Malformed inspection error with the stable JPEG signature message:

• fault-contract:jpeg:jpeg_inspect_invalid_signature_rejected

The selected run passed 1/1 fault-contract row. It recorded true/false branch counts of 1/0 at line 35; the fault row has oracle status not_applicable.

The local report is .coverage-mcp/local-evidence/selected/20261107T072437.904726Z-02414ac63dac4d7bb57a28cf4f568e89/coverage.json (SHA-256 75c06f902b73ba38565c9c7d54b51cec2d43afb530d596c8cb20781ab2158746); its receipt is .coverage-mcp/local-evidence/selected/20261107T072437.904726Z-02414ac63dac4d7bb57a28cf4f568e89/coverage.local-evidence.json (SHA-256 11e2cf7cc110b4e3bba83fba25d7ccafff59007e9e48a8c2994d7bf6dc206d19). The receipt marks the source unverified and Coverage MCP unqueried, so this is local selected evidence only and does not claim aggregate coverage.

ICO inspection header contracts — 2026-11-07

The retained full-parity report showed both malformed-header rejection outcomes missing in src/codecs/ico/inspect.rs:16 and :22. The existing Pillow malformed ICO fixtures already provide invalid reserved-field and unsupported-type inputs, but public format detection rejects them before the inspector is reached. Added a target-only direct-inspection hook and fault contracts that assert structured Malformed errors at offsets 0 and 2:

• fault-contract:ico:ico_inspect_reserved_header_nonzero_rejected
• fault-contract:ico:ico_inspect_unsupported_header_type_rejected

Both selected cases passed. The selected report records the line 16 condition true/false counts as 1/1 and line 22 as 1/0; the retained full-parity report records 205 false outcomes for each condition. These separate observations do not claim aggregate coverage.

The selected report is .coverage-mcp/local-evidence/selected/20261107T064603.072257Z-eb2adfc774db496793c9211fbb9a28e8/coverage.json (SHA-256 75d3699ddb0e49311f2b5d7642af1518e1a62794ec12443d1251963b5bad9041); its local receipt is .coverage-mcp/local-evidence/selected/20261107T064603.072257Z-eb2adfc774db496793c9211fbb9a28e8/coverage.local-evidence.json (SHA-256 bfe9cbdaffdd456def96cd1f562f9b0ebb2722edc6301538a8794197c190ef39). The receipt marks the source unverified and Coverage MCP unqueried, so this remains local selected evidence only.

AVIF rectangular luma split selected coverage — 2026-11-07

The existing Pillow parity rows decode:avif:animated_lossy_inter_420_b4x16_q99_16x64 and decode:avif:animated_lossy_inter_420_b16x4_q99_64x16 passed together (2/2). They exercise the horizontal and vertical rectangular luma split paths in Lossy420Decoder::decode_inter_split_luma_b4_rect_pair. The selected LLVM report records both outcomes for the orientation branch (2/2), both inner orientation outcomes (4/4), and both child-index outcomes (2/2).

The local report is .coverage-mcp/local-evidence/selected/20261106T203152.738919Z-cb5b109d34234193b8e1effceaf35ddf/coverage.json (SHA-256 e45cce804239a6a4b13d095ebe9fa25f77f28278ea01eb2790ae5e86b603fefe); its receipt is .coverage-mcp/local-evidence/selected/20261106T203152.738919Z-cb5b109d34234193b8e1effceaf35ddf/coverage.local-evidence.json (SHA-256 0da4a4f5bcdc945fafa46ba95b511eb9716ab7bb360097a4624d4719b047fdb9). The receipt records source revision 2c35ff0a6e3249f58c56cf231b8398b5deba35ee, source manifest SHA-256 36814d700017049945424d0aed1ed77a1f6275e1084503b25c1755117541a55b, and no source or fixture changes during the run. It also explicitly marks the report local-only, Coverage MCP as not queried, source attribution as unverified, and test attribution as unknown. These counters are diagnostic evidence only; they do not establish aggregate coverage or a Coverage MCP result.

JPEG YCCK component-plane count contract — 2026-11-07

The retained full-parity report left the invalid plane-count outcome uncovered in ycck_to_cmyk_pixels. The active Pillow row decode:jpeg:color_ycck_app14_transform_2 covers the valid four-plane path. A target-only fault point now drops the last plane in coverage builds and checks that the decoder returns the structured malformed-input error; a clean retry must match a fresh decode. This has no release-build branch or runtime cost.

The selected run passed both the Pillow parity row and the separate fault contract. At the current condition in src/codecs/jpeg/decode/decode.rs:1276, the plane-count condition observed true/false counts of 0/7, the injected short-buffer condition observed 1/6, and the combined guard rejected once. These selected outcomes do not claim aggregate coverage.

The report is .coverage-mcp/local-evidence/selected/20261107T083944.034413Z-8b9b1a6178614493af2fc1ad507d1287/coverage.json (SHA-256 d6a5e21007ed59dc6bf7b3a3980eae87730292691a13b1208e04660f9b0bd8b2); its receipt is .coverage-mcp/local-evidence/selected/20261107T083944.034413Z-8b9b1a6178614493af2fc1ad507d1287/coverage.local-evidence.json (SHA-256 9ff723ad711cd0e824bd63ef5ece702955a6868536905cfe0bd98cd126bd985a). The receipt marks Coverage MCP as unqueried and its source identity as unverified, so this is local selected evidence only.

JPEG YCCK component geometry fault contracts — 2026-11-07

The retained full-matrix coverage report showed the valid YCCK decoder path but missed the invalid stride, height, and component-plane-length outcomes in ycck_to_cmyk_pixels. Four target-only fault contracts now exercise short stride, short height, insufficient sample data, and checked plane-length overflow against the active Pillow source row decode:jpeg:color_ycck_app14_transform_2. Each injected decode must return the structured malformed-input result, and the subsequent clean decode must match its retry.

The selected run passed the source parity row (1/1) and all four fault contracts (4/4). In the selected LLVM report, the YCCK geometry guards at src/codecs/jpeg/decode/decode.rs:1374, :1375, and :1376 recorded true/false counts of 1/51, 1/50, and 2/48. These counters describe this selected run only; they are not aggregate coverage.

The report is .coverage-mcp/local-evidence/selected/20261107T134514.620587Z-67e4c3d2da534a79bccc2680948670e6/coverage.json (SHA-256 e4fd37a4e57feee3f904c72b8dcbf12f7bcba26697967958a331a71cba84b56d); its receipt is .coverage-mcp/local-evidence/selected/20261107T134514.620587Z-67e4c3d2da534a79bccc2680948670e6/coverage.local-evidence.json (SHA-256 26d83c5672f2b6188b25b6ee348592d351bb4a15fb3c16dcef90ffa2fbbc7652). No source or fixture files changed during the run. Coverage MCP was not queried, and the receipt identifies this as local selected evidence only.

WebP VP8 method-two header-budget parity — 2026-11-07

Added active parity row encode:webp:enc_lossy_quality_80_method_2_header_budget_noise_gray_4096x3072. Its deterministic 4,096×3,072 grayscale source uses a pinned xorshift pixel stream and a platform-independent stored-DEFLATE PNG writer. The source PNG SHA-256 is f2821e63e4de32ca6113807da7ba2742c047610a72084368ea46e84c15668b39; the decoded source-pixel SHA-256 is 5c16d025c0764c693e8733e816e8f1e4888a726d58c8907f318cbc3249498b71.

The selected Pillow 12.2.0 parity run passed 1/1 row, with five public encode calls, no panics, exact encoded bytes (13,312,062 bytes; SHA-256 ee56640fc2ed618b1456d13ff12d099076871d6b4303497e84ac153a9fa61983) and decoded pixel parity for 4,096×3,072 RGB output. The selected LLVM report records both outcomes of the method-two intra4 header-budget comparison at src/codecs/webp/encode/vp8/frame.rs:328: 177,856 within-budget and 5,800 over-budget outcomes. The latter reaches the Intra16 fallback when Intra4 scored better but exceeded the frame's per-macroblock header budget.

The local report is .coverage-mcp/local-evidence/selected/20261107T231652.470132Z-8abd6cb923a44607a0e1fb83bf94ffd4/coverage.json (SHA-256 d98fc929299c728efde333c95a2d09cc8b8375eca586c505ae9573e5e04612ba). Its receipt identifies a local LLVM run on aarch64-apple-darwin with nightly-2026-07-16, but marks Coverage MCP as not queried and source attribution as unverified. These selected counters prove this case reaches the branch; they do not establish aggregate coverage or a Coverage MCP result.

Baseline multi-scan JPEG truncated COM parity — 2026-11-08

Added the input-only parity row decode:jpeg:baseline_444_multiscan_com_oversized_length. Its generator starts from the pinned multi-scan interleaved-restart JPEG and replaces the terminal EOI with a COM marker declaring a 65,533-byte payload but containing only two bytes. Pillow 12.2.0 accepts and verifies the JPEG RGB 16×8 header, then rejects pixel loading with OSError: image file is truncated (0 bytes not processed); the Rust public decoder returned the matching malformed result. The source fixture SHA-256 is ddbcf29eb1549aae0356661ff2b879b7b2b23b7aae924adbb424af22246e20d7; the mutated input SHA-256 is 4177af354fc11b8ff4ecd71f7e75e37afb9528806c18e524927946e4b004853c.

The selected public parity run passed 1/1. Coverage MCP's preceding full report showed the false outcome missing at src/codecs/jpeg/decode/parser.rs:741; the selected case report leaves the true outcome missing, showing that this case exercised the false multi-scan arm. Both reports remain local measurements: Coverage MCP labels source identity unverified and test attribution unknown. The aggregate full report was not refreshed, so this does not claim a new whole-suite percentage.

Selected report: .coverage-mcp/local-evidence/selected/20261108T063050.792605Z-a43bbc8532c64dabbf57a4884438e501/coverage.json (SHA-256 5365e77b5a4c8cc621fbc9dbefc2cb0dfe395f2aa83528fd0bde97bd7186ff5b). Its local receipt records the exact selector, fixture hash, toolchain, and passing execution. No Rust decoder code or unit tests changed.

Big-endian I;16 → PNG parity — 2026-11-09

Added the active Pillow-backed row encode:png:enc_i16_big_endian to exercise TIFF I;16B input through PNG encoding. The 17×17 fixture has asymmetric samples; the selected run matched Pillow's 153 encoded bytes and re-decoded I;16 samples exactly (1/1). TIFF's public L16 transfer buffer normalizes samples to little-endian even when its header identity is I;16B, so the existing PNG byte swap is required. No production encoder change was needed.

The selected LLVM report is .coverage-mcp/local-evidence/selected/20261108T214145.559689Z-0f970e0a17f94a87bad76f029341c679/coverage.json (SHA-256 b87e2d0048e6c0f3ee1b0dbbac0467e3b1258b653cf0f2709aa80ad0df9ebfb0); its local receipt SHA-256 is 76f0342111b538649b5fde26644240c611032f2ebe0e912c00bd173abdbf7524. Coverage MCP labels this selected measurement's source identity unverified and test attribution unknown. It is local selected-case evidence and does not establish aggregate coverage.

The current public evidence matrix contains 3,892 total rows: 3,201 decode / inspect / verify rows and 691 encode rows. Of those, 3,201 decode rows and 664 encode rows are active; 27 encode rows remain planned.

WebP mode and checkpoint parity — 2026-11-09

The 38 indexed mode-decode rows and 59 indexed mode-encode rows passed in one selected run (97/97). Every indexed successful encoder also exercised the append-only sink path and matched the Pillow bytes while preserving its pre-existing prefix. The nine WebP fault-contract rows passed separately (9/9); those target-only outcomes are not Pillow parity.

Added the active parity row encode:webp:enc_lossy_bool_checkpoint_pending_run for deterministic 128×192 RGB noise from scripts/generate_webp_bool_checkpoint_noise_fixture.py. Pillow 12.2.0 with libwebp 1.6.0 emitted the exact 28,376-byte output; Rust matched its encoded bytes, re-decoded RGB pixels, and append-only sink output (1/1, no panics). It shares the existing WebP Rgb8→Rgb8 pair, so the append-only mode_encode_cases index remains at 59 entries.

The tall-frame probe first reproduced a method-6 mismatch: Rust emitted 74,856 bytes versus Pillow's 73,812, with decoded RGB first differing at (8, 192). The input pixels matched Pillow. The divergence began at the first coefficient probability refresh. Pinned libwebp 1.6.0 refreshes token probabilities before macroblock 97 and after each max(96, macroblock_count / 8) + 1 macroblocks in VP8EncTokenLoop. The Rust selector had used fixed probabilities for the entire frame. It now records coefficient statistics as each macroblock is selected and refreshes from the accumulated prefix without rescanning prior blocks. Method 6 also uses one trellis frame-selection pass instead of computing and discarding an initial non-trellis selection.

For method 5, pinned libwebp chooses modes without trellis, then applies its simple final quantizer to those selected modes; method 6 includes trellis in mode selection. Rust now performs that method-5 final pass over the chosen modes and reuses the macroblock-edge contexts used by libwebp's final pass (pinned libwebp source).

Added active parity rows for methods 3, 4, 5, and 6 on the seeded 128×512 RGB noise fixture. Pillow 12.2.0/libwebp 1.6.0 emitted 73,982, 73,982, 73,898, and 73,812 bytes. Rust matched the exact encoded bytes and re-decoded RGB pixels. The fixture PNG SHA-256 is c4aba34e29dc463d104c9628e467c7f11415004605d3c7d57028d19103ef8b6a.

Added a flat 1024×1024 RGB method-3 row for zero-coefficient statistics and the 1,024-macroblock checkpoint, plus quality-100 method-2 baseline rows for the flat and tall fixtures. The smooth/checkerboard 128×512 fixture at method 2, qualities 80 and 90, reaches the non-token probability adaptation path, including node 10. Its PNG SHA-256 is dee4e35d06dcdb2e8f82b7be8cd1bbef9e6fff60a96898b95e0f3f00fc80c487. The pinned fixture generator is scripts/generate_webp_bool_checkpoint_segmented_fixture.py.

The final selected run combined those new rows with the existing large method-2 noise row. All 10/10 active cases passed exact Pillow byte parity and decoded pixel parity (50 public encode calls, no panics); the matrix runner also checked append-only sink output and prefix preservation for these successful encodes.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261109T162006.820773Z-9f37cdb4065b43369f6c9adbc9ff953e/coverage.json (SHA-256 3827225725fbf780d19f52abb68d56019a87681d6f095208212a600684808002); local receipt SHA-256: 109905f0b03844e422b1e8627357eb863ed600db3892236bcc3a8ef3ce73bbe5. Coverage MCP's follow-up branch query found no remaining gaps in src/codecs/webp/encode/vp8/probability.rs for this selected cohort. The instrumented report totals 9,092/142,863 lines, 974/32,126 branches, 617/9,180 functions, and 14,396/221,254 regions. Coverage MCP marks source identity unverified and test attribution unknown; these local selected-case figures are not aggregate project coverage.

The current public evidence matrix contains 3,919 total rows: 3,207 decode / inspect / verify rows and 712 encode rows. Of those, 3,207 decode rows and 685 encode rows are active; 27 encode rows remain planned.

CIELAB encode identity parity — 2026-11-09

Added Pillow-backed parity rows for TIFF LAB encoding and PNG's unsupported LAB outcome. TIFF emitted the exact 158-byte Pillow output and decoded back to the same 3×2 LAB pixels. The existing public-mode contract now also checks that a LAB raster identity paired with an L8 transfer carrier returns a structured parameter error. The selected run passed all three rows with no panics.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261108T225105.016293Z-1e69b86f8aef46db9b645c64dc2bc5f4/coverage.json (SHA-256 2aec37edae09c0b5075b98be2540a21eb3ae0a45229eb900bb3f8f77c04a611a). Its local receipt SHA-256 is 3db7c518efb7ae7d62b4c760723bf6140eea1d19aae106e05be19283a1096798. The receipt marks Coverage MCP as not queried, source identity unverified, and test attribution unknown. This selected subset is not an aggregate coverage measurement.

The current public evidence matrix contains 3,892 total rows: 3,201 decode / inspect / verify rows and 691 encode rows. Of those, 3,201 decode rows and 664 encode rows are active; 27 encode rows remain planned.

TIFF palette extra-sample parity — 2026-11-10

Added an active error parity row for a separate-planar palette TIFF whose second sample is marked unspecified. The fixture is derived from the existing separate-planar PA sample and changes only its ExtraSamples value; Pillow rejects the resulting TIFF during open. The focused five-row cohort passed: palette alpha, associated-alpha rejection, separate-planar PA rejection, contiguous unspecified-extra P decoding, and separate-planar unspecified-extra rejection (5/5).

Coverage MCP reports no remaining branch gaps at src/codecs/tiff/inspect.rs:440 for this cohort. The selected LLVM report is .coverage-mcp/local-evidence/selected/20261110T004909.866076Z-67585ef43c0c414f8888f93165dabe01/coverage.json; MCP marks source identity unverified and test attribution unknown, so this is targeted local evidence and not an aggregate coverage claim.

The subsequent full parity matrix passed 3,214/3,214 active decode rows, 686/686 active encode rows, and 206/206 fault contracts; 27 planned encode rows were not executed. Its LLVM report is .coverage-mcp/local-evidence/selected/20261110T005206.216445Z-05e07e499362481bbed69ec9a3f6b3a4/coverage.json (SHA-256 02623f12c47f1888013b64e2395fb8ebe6b9dabe81ebbabd50ae900492a81ec0). Coverage MCP found no remaining branch gaps at TIFF inspect line 440 in this report; the report records 20,921/32,126 branches. Its source identity remains unverified and test attribution unknown, so it does not establish verified aggregate project coverage.

The current public evidence matrix contains 3,927 total rows: 3,214 decode / inspect / verify rows and 713 encode rows. Of those, 3,214 decode rows and 686 encode rows are active; 27 encode rows remain planned.

TIFF carrier-mode identity parity — 2026-11-10

Appended explicit mode-decode representatives for decode:tiff:ycbcr and decode:tiff:extra_samples_zero_rgbx_contiguous_strips_raw. Pillow reports both source layouts as RGB, and both cases retain exact decoded pixel parity. The mode index now permits multiple fixtures for the same public mode pair so distinct carrier layouts remain represented. Every indexed still-image row now checks owned and borrowed encoded-source header identity before loading, then checks the decoded transfer identity and exact Pillow image.

The focused selection passed both rows (2/2). Its Coverage MCP report is .coverage-mcp/local-evidence/selected/20261110T014748.340237Z-19fa993e84f440deb096cc67ac844713/coverage.json. The two-row report totals are 1,734/142,863 lines, 191/32,126 branches, 175/9,180 functions, and 2,468/221,254 regions. Coverage MCP marks source identity unverified and test attribution unknown, so this result is focused evidence and not an aggregate coverage claim. cargo fmt --check, strict all-target/all-feature Clippy, and git diff --check passed.

PA encoder parity audit — 2026-11-10

The selected PA encoder cohort passed all three active rows: TIFF produced the Pillow-matching 1,706-byte output and re-decoded to exact 3×2 PA samples; PNG and BMP returned their Pillow-compatible PA rejection. Coverage MCP still reports unvisited branches in the TIFF, PNG, and BMP encoder functions for this narrow cohort; those observations are not evidence that the other branches are unreachable. The selected report is .coverage-mcp/local-evidence/selected/20261110T015121.528652Z-6f3d28b22d144bbcaf97e0e635257025/coverage.json. Its totals are 2,212/142,863 lines, 237/32,126 branches, 207/9,180 functions, and 3,020/221,254 regions. Source identity is unverified and test attribution unknown, so these totals describe this selected run only.

TIFF big-endian mode identity parity — 2026-11-10

Appended decode:tiff:byte_order_be to the mode-decode index. Together with the existing little-endian row, it keeps both TIFF byte-order layouts represented for the same public Rgb8 header and decoded-transfer pair. The focused parity run passed 1/1 row, including exact 49,152-byte Pillow pixel parity and the indexed owned/borrowed header and decoded-transfer identity checks. The mode-decode index now contains 45 cases.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261110T050954.701380Z-0dda224f222b46dbb3612e0f18fa0ec9/coverage.json (SHA-256 48bd7a1a7f403921473619f4275886f6014c0daca901b43dbbc2a36985a1dfcb). It records 1,658/142,863 lines, 169/32,126 branches, 172/9,180 functions, and 2,327/221,254 regions. Coverage MCP was not queried; source identity is unverified and test attribution unknown, so this is selected local evidence, not an aggregate coverage claim.

Cross-format decode mode representatives — 2026-11-10

Appended four public parity representatives to the mode-decode index: 8-bit indexed BMP, packed 2-bit grayscale PNG expanded to L8, straight-alpha RGBA TIFF, and lossless RGB WebP. Their public mode pairs are respectively P→P, L8→L8, Rgba8→Rgba8, and Rgb8→Rgb8. All four selected rows passed exact Pillow pixel parity and the indexed header/decoded-transfer identity checks. The append-only mode-decode index now contains 49 cases.

Selected LLVM report: .coverage-mcp/local-evidence/selected/20261110T054515.053263Z-3ef98d6a2c9b4911bb640f2c5f010a8c/coverage.json (SHA-256 3a1ee14a11c4c839649826ec76001a4cf00f37dd594824abdc909b746b56b75d). It records 4,252/142,863 lines, 525/32,126 branches, 366/9,180 functions, and 6,387/221,254 regions. Coverage MCP was not queried; source identity is unverified and test attribution unknown, so these are focused local figures, not an aggregate coverage claim.

WebP empty metadata encoding parity — 2026-11-10

Added enc_lossless_empty_metadata_omitted for empty ICC and XMP payloads and an EXIF value containing only Pillow's optional Exif\0\0 prefix. Pillow 12.2.0 omits all three chunks and emits the 36-byte lossless WebP reference; before the fix, the Rust encoder emitted 78 bytes. The encoder now strips the optional EXIF prefix before filtering empty payloads, then returns the original codec output directly when no metadata remains. This keeps the token-aware and buffer-reuse paths consistent without adding payload copies.

The focused six-row parity selection passed, including the new case, both existing prefixed/unprefixed EXIF reuse cases, and token-aware ICC, EXIF, and XMP cases. All 28 public encode calls completed without a panic. The complete parity matrix then passed 3,214/3,214 active decode rows and 687/687 active encode rows; 27 planned AVIF encode rows were not executed. The run selected 3,928 rows and executed 3,901; fault-contract rows are not part of this matrix run.

The full-run LLVM report is .coverage-mcp/local-evidence/selected/20261110T070603.401257Z-89a55fda0edf4011a4c2fc6c832f2d64/coverage.json (SHA-256 d1dd53e340c9eaf34e9f28db84b0da84c145f6af430758681ce44104b89f24fb). It records 97,950/142,865 lines (68.5612%), 20,369/32,126 branches (63.4035%), 5,274/9,182 functions (57.4385%), and 148,965/221,250 regions (67.3288%). Its local receipt SHA-256 is cc40a1f048a3f6372ea4da17b62c8e0e7c0b32d6a119ec73ff81b34d60749200. Coverage MCP marks source identity unverified and test attribution unknown; these local measurements do not establish verified aggregate project coverage. The queried helper had no reportable missing groups. Broader WebP, TIFF, and JPEG source gaps remain visible in the report and are not treated as reachable through valid public parity inputs without a concrete case.

WebP token-aware I32 mode parity — 2026-11-10

Added enc_lossless_i32_signed_clamp_token using the existing signed 32-bit grayscale TIFF input, alongside its ordinary encode parity row. The new row calls the public token-aware encoder with a fresh token and checks the exact 48-byte Pillow output plus the decoded 257×1 RGB pixels. Its focused parity selection passed (1/1); all five public encode calls completed without a panic.

Coverage MCP's full-report branch gap at src/codecs/webp/encode/mod.rs:1226 was the token-present arm of the I32 conversion specialization. The selected report and comparison record that arm as newly observed; the helper's I32 branch is no longer listed as missing in the selected report. This does not cover the cancellation-error edge at the checkpoint call. The comparison is limited local evidence because Coverage MCP marks source identity unverified and test attribution unknown.

Selected report: .coverage-mcp/local-evidence/selected/20261110T074723.739599Z-7c9825cc5a744104b596916aac646077/coverage.json (SHA-256 f7d80ae4fb9c3b81985d1f026e8f53543a1ea81d611c751116650e7b28d33a32). Its local receipt SHA-256 is a2e3410ac70f581268bd63889bc4063e037a238b97c5684a785073a35dda1c9c. Coverage MCP comparison against the prior full report found one newly observed branch arm at line 1226; it explicitly labels the comparison limited and the source/build identity unverified.

PNG policy work-budget error parity — 2026-11-10

Extended the existing Pillow-backed reserved-DEFLATE-distance PNG error row with a decode_with_policy call carrying a maximum work budget. The public policy path returns the same structured malformed-input result as Pillow and the existing token-aware call; the selected parity case passed 1/1.

Coverage MCP reported no remaining branch gaps in decode_token_format_with_mode for this selected case. Comparison against the current full report observed its previously missing incremental == false error arm at line 289. The selected report records 1,322/142,880 lines, 132/32,132 branches, 134/9,183 functions, and 1,776/221,268 regions. MCP marks source identity unverified and test attribution unknown, so this is a focused coordinate comparison rather than a verified aggregate coverage gain.

Selected report: .coverage-mcp/local-evidence/selected/20261110T175107.472724Z-b51d860aadc24206944c4ef83daeb9cb/coverage.json (SHA-256 78c47d199f6249faaa913544890d63612a33b77374feb97d189fd593e3583a4c).

JPEG oversized trailing APP1 without EOI parity — 2026-11-11

Added decode:jpeg:baseline_444_single_scan_app1_oversized_length_no_eoi, a variant of the pinned baseline 4:4:4 fixture with its terminal EOI removed. Pillow 12.2.0 decodes its complete 8×8 RGB scan. The Rust parser now stops at the oversized trailing APP1 marker when no EOI is present and leaves the completed entropy scan available to the decoder; existing EOI handling is unchanged. The fixture SHA-256 is 32d94f32fb02847aae56bc1915b12820466de025aecfabe8e254e8034f837d26, and its 192-byte Pillow pixel reference SHA-256 is 7382706a9ecb0f6acae26e7c1c9a9be0e9471233c1a0c0da48d08a458115be2f.

The focused public parity selection passed 6/6 rows: the new no-EOI APP1 case, the existing oversized APP1, COM, and DHT cases, the trailing-DHT no-EOI case, and the multi-scan COM rejection guard. The no-EOI case also exercised token-aware decode, sequence decode, and sequence work-budget paths. No unit tests were added.

Coverage MCP queries against the selected report returned no missing branch groups at parse_jpeg lines 746 or 751. The report has 357/32,128 branches observed overall; source identity is unverified and test attribution unknown. The coordinate comparison to the previous full report could not establish a verified gain, so these figures are selected local evidence rather than an aggregate coverage claim.

Selected report: .coverage-mcp/local-evidence/selected/20261110T233248.149443Z-3d8fd0fd6b1740d3b6251ce7b2dada1a/coverage.json (SHA-256 d3314cb0f3f214cbd08ecd6e73c2035108a4d7b5eb30537dad788e79c8c9ef07). Its local receipt SHA-256 is 9afa136901cb641b93a77f59553b1ae687c716ea1e31d4352fa85fd0f9c3ee34.