Transcode: sources beyond H.264 #26

Goal

coreav transcode is supported for every source codec it accepts, not only H.264: HEVC, AV1, VP9, VP8 and ProRes sources meet bars B1 to B5 of docs/design/transcode.md, and the fixture CI job of B8 is in place.

Current state

• The native H.264 encoder now gates the P-picture intra 4x4 trial on the inter rank and doubles the split-search SATD bound for settled macroblocks (perf(h264): gate the P intra 4x4 trial on inter rank #534, merged as 60abf73c; perf(h264): raise the split bound for settled macroblocks #535, merged as 1833cfff). Together they remove 11.2% of encoder instructions and save 11.7% of one-thread and 10.8% of four-thread encode time (equal-cell mean over five reference inputs at QP 22 and 28, shared x86-64 runners). Every input stays within +0.5% PSNR BD-rate of the previous main in each plane (worst +0.18%), and output stays independent of the worker count.

• H.264 encoder motion scoring now admits the block width and resolves the SAD arithmetic once per block, with the per-row call inlined (perf(h264): hoist encoder SAD dispatch per block #529, merged as 383ede6a). Streams and reconstructions remain byte-identical to the previous main at one and four workers; row cutoffs, equal-score ties, AVX2 leaves and scalar paths are unchanged.

• H.264 row workers now help complete independently owned reconstruction planes while the caller writes syntax (perf(h264): share plane completion work #524, merged as 0bfc0453). Complete streams and reconstructions remain byte-identical across scalar and dispatched builds and worker counts; prediction inputs, per-plane filtering order, decision-error precedence and the existing thread limit are retained.

• H.264 encoder rate-distortion refinement now evaluates two trailing coefficient coordinates and DC by default (feat(h264): refine two trailing coefficients #490, merged as f4490112).

• Verify that the design-note regression test executes in CI.

• Reference Transcode: sources beyond H.264 #26 in the next related pull request.

• Remove dead compile-time branches in the H.264 encoder refinement path.

• H.264 encoder row decisions now overlap caller-owned syntax, reconstruction and ordered deblocking (perf(h264): overlap row deblocking #517, merged as 4155a338). Complete streams and reconstructions remain byte-identical across scalar and dispatched builds at one, two, three and eight workers; coding decisions, filtering order, public APIs and operating-system thread limits are unchanged.

• Eight-bit HEVC deblocking now uses private runtime-checked AVX2 arithmetic (perf(hevc): vectorize eight-bit deblocking #519, merged as 437e6d26). Decoded samples, rejection order, scalar fallback, Main10, SAO, default builds and source-allocation accounting remain unchanged. Complete native conformance and all census shards pass in automatic and forced-scalar modes.

• H.264 encoder tiles now use compact row storage (perf(h264): shrink encoder tiles #518, merged as bcfab385). Complete streams and reconstructions remain byte-identical across scalar and dispatched builds at one, two, three and eight workers; public APIs and coding decisions are unchanged.

• H.264 motion-search scoring now reuses validated reference rectangles and exact motion-vector syntax lengths (perf(h264): reuse motion probe setup #513, merged as eb978f4f). Complete streams and reconstructions remain byte-identical across scalar and dispatched builds at one, two, three and eight workers; search order, ties, row cutoffs and finalist evaluation are unchanged.

• Shared safe H.264 four-by-four intra prediction now avoids unused directional work (perf(h264): speed up four-by-four prediction #514, merged as b0098004). Complete streams and reconstructions remain byte-identical in scalar and dispatched builds at one, two, three and eight workers; settings, larger predictors, dispatch and default dependencies are unchanged.

• H.264 encoder row workers now fill temporary tiles in their final arrays and publish selected decisions without returning the complete value through the scheduler (perf(h264): avoid row decision copies #510, merged as b4b07dc3). Encoded streams and reconstructions remain byte-identical across scalar and dispatched builds and worker counts; scheduling, coding decisions and public APIs are unchanged.

• Native H.264 library settings now accept validated rational constant frame rates and sample aspect ratios (feat(h264): signal frame rate and sample shape #511, merged as 67cfa844). VUI uses fixed-frame-rate timing and table or Extended_SAR signalling; defaults preserve existing bytes. All 126 generated rate/SAR combinations pass the pinned oracle with clocks derived from emitted SPS fields. CLI selection and container timestamps are unchanged.

• H.264 encoder deblocking now borrows macroblock records during boundary-strength derivation (perf(h264): borrow deblocking records #508, merged as 074ac8b1). Complete streams and reconstructions remain byte-identical across scalar and dispatched builds and worker counts; filtering arithmetic, order and public APIs are unchanged.

• Native FFV1 encoding now accepts odd chroma dimensions such as 854x480 in 4:2:0 and 4:2:2 (fix(ffv1): accept odd chroma dimensions #498, merged as a0f6b667). Native output preserves every source sample against the pinned oracle; existing decoder admission and previously supported bitstreams are unchanged.

• The H.264 encoder kernel policy now permits new NEON arithmetic on AArch64 alongside AVX2 on x86-64 (docs(h264): permit NEON encoder kernels #489, merged as aff17330). x86-64 remains first. No NEON kernel or runtime behavior is added; the first NEON implementation must add passing arm64 encoder verification, with this prerequisite enforced by review until that coverage exists.

• Private H.264 encoder scalar and AVX2 inverse transforms now share signed-16-bit input admission (fix(h264): share inverse input validation #488, merged as c6dc8fc9). Out-of-domain results no longer depend on CPU dispatch; complete streams, reconstructed pixels, default builds and public APIs are unchanged.

• H.264 4x4 transform and quantizer arithmetic now uses runtime-dispatched AVX2 in opt-in builds (perf(h264): vectorize transform arithmetic #484, merged as 2022a0bb). Complete streams and reconstruction remain byte-identical to scalar; exact quantizer rounding, signed intermediate refusals, default builds and codec settings are unchanged.

• H.264 mode-decision SATD now uses runtime-dispatched AVX2 for independent 4x4 Hadamard sums over 4x4, 8x8 and 16x16 blocks (perf(h264): vectorize mode-decision Hadamard costs #478, merged as dd9174e7). Complete streams and reconstruction remain byte-identical to the scalar build; search policy, default builds and existing row SAD are unchanged.

• AV1 encoder process-boundary reference figures are merged (test(av1): measure the encoder process boundary #457, merged as 51a6e589). On three lossy 30-second H.264 inputs, sandboxed CoreAV took 1.063 times FFmpeg's end-to-end time and in-process CoreAV 1.037 times, with byte-identical AV1 packets in all arms. The encoder process boundary is 39% of the summed gap, about 1.8% of CoreAV time; the source of the remaining difference was not measured during transcoding. The in-process path exists only in a non-default measurement build; production keeps the sandbox (results).

• Native H.264 packed output storage now returns to one bounded decoder-owned pool after CLI or asynchronous encoder consumption (perf(decode): reuse frame buffers #458, merged as 79fc6131). Raw output hashes and all packets and timestamps in the AV1 comparison are unchanged. Retained frames, deep clones, geometry changes and existing limits remain supported; the encoder sandbox and build defaults are unchanged. The reference run does not establish a transcode wall-time improvement.

• H.264 encoder P-picture decisions now use a quantizer-derived rate weight (fix(h264): calibrate P-picture rate weight #459), and its speed cost is mostly recovered (perf(h264): recover encoder throughput #461, perf(h264): inline syntax bit counting #462): byte-identical hot-path work, a quiet-skip decision when the skip residual quantizes to zero, and a 16x16-only intra proposal when a coded P16x16 at the skip vector does not beat skip. On the existing A/B/C references, BD-rate against the rate-weight change is +0.03% on A and -0.24% on C; QP28 driver throughput on one runner is level with the build before the rate-weight change on A, about 4% below on B and 6% above on C.

• Bit-identical H.264 encoder SIMD is merged (perf(h264): accelerate byte-identical encoding #454): runtime-dispatched interpolation and bounded row SAD preserve complete streams and reconstruction, with a scalar-forced build. The narrow kernel policy, unsafe-site inventory, differential fuzzing and scalar/dispatched identity checks are included. Five alternating local QP28 reference pairs improve median throughput from 43.13 to 50.97 pictures/s on A, 39.89 to 45.99 on B, and 25.68 to 32.51 on C, including native decoder verification and IO. Shared-host variation is disclosed; bitrate and quality remain those of perf(h264): recover bounded-search efficiency #452. These are reference figures, not a representative speed or quality verdict.

• The external MP3 worker now emits encoder-only MP3 rather than a Matroska intermediate (fix(mp3): keep external output encoder-only #451). Both availability and encoding starts pass the unchanged classifier; 216 generated commands preserve exact decoded samples and frame timing against FFmpeg 9.0.2. CoreAV retains gapless adaptation and AVI frame handling, with unchanged sandbox limits and default-build licensing. This does not establish AAC source equality or new command-set coverage.

• Opt-in sandboxed SVT-AV1 output is merged (feat(transcode): add opt-in AV1 encoding #396): coreav transcode --video av1 writes eight-bit planar 4:2:0 SDR video in MP4 with receipt v2, bounded native sessions and checked AV1 readback. Unscaled input retains the shared decoded-frame handoff. Unix full packages can opt into the pinned backend and notices; default builds and H.264 selection are unchanged. Real encode/decode fixtures run in CI. This establishes no general speed or source-support verdict.

• H.264 search-efficiency work is merged (perf(h264): avoid repeated encoder search work #425), following the reviewed technique note (docs(h264): add encoder speed technique note #421). Zero-error skip termination, checked direct reference reads and separable scalar transforms each beat the unchanged bounded encoder in a same-run reference comparison. All six final reference files are byte-identical to the preceding main build and reconstruct exactly under FFmpeg. The paired 640x480/60-picture reference improves from 0.408 to 0.863 fps; final-head confirmation reaches 1.005 fps, with shared-host variation disclosed rather than treated as another code improvement. Native rate and quality remain 346.272 kb/s, 45.660 dB PSNR and 0.998527 SSIM on that input, versus x264 medium's 466.94 fps, 350.140 kb/s, 47.831 dB and 0.998924. All 444 conformance cells, 38 Rust tests and the exact-head similarity guard pass. No default-build or unsafe change; the encoder remains search-bound and these are reference figures, not a judged speed or quality claim.

• Bounded H.264 motion search is merged (perf(h264): bound motion-search RDO trials #417): cheap prediction-cost probes feed at most six full-RDO finalists per searched partition, with reuse of independent unchanged trial work. All 444 conformance cells match CoreAV, pinned FFmpeg and JM. Normative admission, transactional failure, fixed-QP behavior and default builds are unchanged.

• The H.264 picture-budget rate-control design is merged (docs(h264): plan picture-budget rate control #343). It specifies complete-NAL accounting, bounded transactional picture-QP trials and acceptance checks. It does not implement or authorize a controller; fixed-QP library behavior and product commands are unchanged.

• The opt-in scalar H.264 encoder now supports one-reference fixed-GOP P pictures, including skip, 16x16, 16x8, 8x16 and all four 8x8 subpartition shapes (feat(h264): add one-reference P pictures #333). All 444 synthetic conformance cells match CoreAV, pinned FFmpeg and JM. Sequence/reference state commits only after normative and caller limits pass; dense fixed-QP content can be refused. Rate control, CABAC, I_PCM and QP fallback remain separate; product commands are unchanged.

• Opt-in scalar H.264 deblocking is merged (feat(h264): add opt-in reconstruction deblocking #325): zero-offset filtering runs after full coded-picture reconstruction and before visible cropping. All 150 existing and 168 enabled-filter synthetic cells match CoreAV, pinned FFmpeg and JM. Disabled filtering preserves the prior stream and reconstruction. P pictures and rate control remain separate.

• The scalar HEVC decode reference driver is merged (perf(hevc): add scalar decode reference driver #447): a manual, decoder-only workflow that checks each input picture by picture against the pinned FFmpeg decoder before timing it, and records scalar instruction counts and function hotspots for sizing SIMD and threading work. Its results stay internal.

• Native HEVC milestone 3 is merged (feat(hevc): filter scalar intra pictures #414): opt-in scalar Main/Main10 intra pictures apply original deblocking and SAO before picture hashes or publication. All 456 G3 targets (including all 17 G2 targets), 371 defined picture hashes and 740 runtime controls pass; all 26 development first-IRAP comparisons and the 54-file metadata census are complete. Available original serial pixel coverage includes 43 tiled, 15 WPP and nine dependent-segment candidates. Coverage remains explicitly unproved at 10-bit: tiles/dependent segments, no official candidate; this labelled gap does not authorize generated replacements. OPFLAG_B coded pictures 39 and 73 retain coded-picture reference (SEI), not output, without invented output indices. Inter prediction, production consumers, default-build changes and timing remain outside this milestone.

• Native HEVC milestone 2 is merged (feat(hevc): reconstruct scalar intra pictures #393): opt-in bounded CABAC and scalar reconstruction of one original unfiltered Main/Main10 intra picture. All 17 eligible pictures match their original references, including six oracle-derived references anchored to exact published whole-output MD5 agreement; all 17 defined picture hashes and 50 runtime controls pass. Serial tile, WPP and dependent-segment behavior is implemented and unit-tested, but effective pixel cases remain an explicit gap. G1's 147 archives, 144 distinct official streams, 151 source-audit rows and 54-file metadata census remain complete. No inter prediction, in-loop filters, production backend, default-build dependency or source-support/B5 verdict is added.

• Native HEVC milestone 1 is merged (feat(hevc): add bounded header inspection #373): opt-in Main/Main10 bounded header inspection, explicit refusals and a fixed header-only POC/reference/output simulator. The complete census accounts for 147 archives and 144 distinct official bitstreams, with two SHA-bound maintainer exclusions and one named unequal-depth refusal; four synthetic Main10 sources remain separate. All 151 source-audit rows match the verified census, and the fixed 54-file metadata census is complete with only aggregate results public. This adds no reconstructed pixels, decoder backend, default-build dependency or source-support/B5 verdict.

• Byte-identical FLAC planning improvements are merged (perf(flac): cache exact residual costs #369): bounded exact partition-cost reuse, shared Rice-method selection and independent autocorrelation sums. All 1,152 complete-file comparisons and 93 CLI comparisons pass without changing encoder search, output bytes or source admission. The measured diagnostic breakdown and component-erasure results are retained with the plan. The exact merged-code comparison completed all 24 cases, 216 triples and 747 verified calls. Observed candidate/before-change time is 0.4863, but four startup-calibration misses prevent a qualified milestone pass. Default-FFmpeg time is 4.3876 with 0/24 faster, while size passes at 0.9137. Both native arms emit identical files. The completed miss was not rerun; the separate complete results and raw evidence are merged in docs(flac): record the cost-cache comparison #378 after green CI and independent replay review. No qualified speed or FFmpeg-parity pass is claimed. Development-only native profiling and replay diagnostics are complete. Rice-cost work alone does not provide a parity path; the proposed next candidate addresses planning and frame emission together. Timer controls identify insufficient workload duration relative to startup, not a demonstrated polling defect. No new judged comparison or product change was made.

• The native HEVC milestone-0 plan is merged (docs(hevc): plan the native decoder #363): Main/Main10, opt-in native-hevc, specification-only development, staged conformance gates and pre-registered speed bars. The fixed metadata roster binds 54 existing files by SHA-256, with development and evaluation kept separate. This adds no decoder code, changes no default build and establishes no new source-support or B5 verdict.

• Native FFV1 version 3 video output is merged (feat(ffv1): add native lossless Matroska encoding #324): coreav ffmpeg -c:v ffv1 output.mkv writes one progressive 8-bit planar YUV 4:2:0/4:2:2/4:4:4 video stream without an external encoder or pixel conversion, with a supported decoder backend. Geometry, format and colour changes after encoding starts are terminal, preserve the destination and never retry through fallback. All 75 generated exact/refusal cases passed against the pinned FFmpeg 9.0.2 oracle. RGB, higher bit depths, audio, transformations and non-default chroma siting remain separate; no speed or output-size claim is made. Native FFV1 encodes now share the one-hour command limit of the other native encodes instead of stopping after 60 seconds (fix(cli): give FFV1 encodes the one-hour limit #463).

• Public audio-output differences from FFmpeg 9.0.2 are documented in the audio-output reference and linked from the measurements page (docs(audio): record output oracle differences #314). The records cover Opus re-encoding, the separately versioned composed AAC presentation check, Opus-to-Matroska copy, MP3 boundary padding, and tiny-FLAC default refusal. No runtime behavior, acceptance rule, baseline, registration, frozen input, or measured result changed.

• Native FLAC output is merged (feat(flac): encode lossless audio natively #298): coreav ffmpeg writes lossless .flac files from supported 16-bit/24-bit FLAC tracks in MP4 or Matroska without an external encoder. It preserves complete samples, rate, speaker identity and STREAMINFO MD5, including tiny final frames. All 93 generated command comparisons match exact samples and probe fields; cover images, broader sources and conversion remain separate. The registered comparison completed all 24 cases and 216 verified pairs, but missed the size bar because four compressible cases exceeded their individual ceiling despite an aggregate ratio of 1.0175. Shared-host timing remains diagnostic only. The failed results and unchanged evidence are merged in docs(flac): record the failed comparison #326. Residual-coder completion is merged in fix(flac): complete residual coding #335: five-bit Rice parameters and escaped partitions are chosen by exact bit cost, with the same correctness gates. CPU-only residual loops and reusable scratch are merged in perf(flac): streamline residual construction #345, with 1,152 complete-file byte-identity checks against the completed coder. The second registered comparison is recorded in docs(flac): record the second comparison #353: all 24 cases and 216 pairs verified; size passes at 0.9137 and shared-host diagnostic timing misses its bar at a median ratio of 6.9653. Both rounds and their unchanged raw evidence are retained; no rerun or fixed-host performance claim was made.

• Standalone hardware-only HEVC Main encoding is merged (feat(apple): encode HEVC with VideoToolbox #409), with the existing HEVC header parser, native hvcC and bounded ordered ownership. Default and release builds and CLI integration are unchanged. M1 hardware HEVC reference figures are merged in docs(apple): report M1 HEVC reference figures #411: the median per-input CoreAV/FFmpeg process-time ratio is 1.098 on nine prepared clips, with no acceptance verdict. Report-only buffering is merged in perf(apple): buffer VideoToolbox reports #415. The separate old/new/FFmpeg reference comparison is merged in docs(apple): report buffered M1 encoding figures #419: median new/old process time is 0.922 for H.264 and 0.938 for HEVC, with byte-identical final native outputs and reports. New/FFmpeg ratios are 1.001 and 1.016 on these nine inputs, without a significance or general speed claim. The earlier fractional-rate H.264 quality-clock correction is disclosed; timing records and encoded bytes are unchanged.

• VideoToolbox stage-one source/tool registration is merged (feat(apple): freeze prepared VideoToolbox inputs #342): thirty prepared-I420 inputs, ten each at 360/720/1080, complete ordered selection and an explicit uncovered-2160 reconciliation. Its native-content amendment is merged (fix(apple): pin frozen native bytes to main #355), binding all 129 native files to merged candidate 7abf723411f9dacb6e8f5dca148fa5ea03b62932 without changing tools, sources or the strict validator. Actual macOS exporter and Linux decoder build records are merged (docs(apple): record actual exporter builds #358), with pinned toolchain, source tree, locked dependencies, configuration and executable identities. Pinned macOS baseline and cache-observer identity receipts are merged (ci(apple): capture pre-rental tool identities #362), with exact hosted metadata recapture and generated non-media cache compatibility checks. Release-owner review and physical-host identity/residency checks remain required before judged use; these receipts are not availability or measurement evidence. The pinned macOS reference passed integer/fractional synthetic identity and exact packet-byte checks; baseline controls that cannot be observed remain requested-only. This covers prepared-raw encoder behavior, not end-to-end source-colour preservation. The macOS 15.8.2 profile and actual host facts are merged (fix(apple): bind the observed OS profile #391). Hardware-only reference figures are recorded in docs(apple): report M1 encoding reference figures #395: nine prepared clips, median CoreAV/FFmpeg process-time ratio 1.079, with close PSNR/SSIM measurements. These are reference figures, not a judged verdict; the separate final seal and judged campaign are not being pursued.

• Standalone VideoToolbox H.264 encoding and its registered evidence tools are merged (feat(apple): own VideoToolbox encoding #289): bounded owner-thread sessions, callback retirement, exact frame clocks, observed encoder identity and effective controls, plus hosted synthetic capture and Linux two-decoder verification. Hardware and automatic output passed; hosted software mode records only a distinct refusal when hardware status is unobservable, not software availability or conformance. On a physical M1 running macOS 15.8.2, software mode also refuses because the encoder-list entry has no hardware flag (docs(apple): report M1 encoding reference figures #395); this does not establish encoder absence. CLI integration and software-status observability remain separate.

• The G1 H.264 encoder now refuses oversized macroblock layers with Error::MacroblockLimit instead of emitting a nonconforming stream (fix(h264): reject oversized intra macroblocks #336). Failed calls publish no access unit and preserve sequence state; fixed QP can still refuse dense content because I_PCM and QP fallback are not implemented. All 150 conformance cells match CoreAV, pinned FFmpeg and JM. This is a correctness fix, not a quality or speed result.

• The self-written G1 H.264 intra encoder is merged (feat(h264): add the intra encoder spike #282): library-only, explicit full feature, fixed-QP CAVLC, complete access units and reconstructed planes with bounded transactional output. All 150 synthetic and existing non-judged conformance cells match CoreAV, pinned FFmpeg and JM. The measurement harness retains audited metrics and recoverable atomic checkpoints, but no quality or timing run has been performed. Default builds, CLI selection and packaging are unchanged; judging still requires a complete merged freeze and a separately authorized run.

• Native image and raw-video output is merged (feat(ffmpeg): write image and raw video outputs #260): coreav ffmpeg writes PNG and BMP images, numbered image2 sequences, rawvideo files or stdout, and progressive 8-bit YUV4MPEG2. A decoder backend feature is required. Image encoders round-trip their input samples exactly; exact FFmpeg RGB-converter parity remains separate. Cover-image writers can reuse coreav_thumbnail::encode_png and encode_png_with_aspect.

• Native signed 16-bit PCM output is merged (feat(ffmpeg): write signed 16-bit PCM audio #261): coreav ffmpeg writes WAV or raw -f s16le from FLAC sources, without an external encoder. Both output formats preserve decoded samples, source rate and layout, with atomic refusal for unsupported options; MP3, Opus and AAC sources retain the existing refusal and fallback. Both build configurations passed 109 generated exact sample/probe comparisons.

• Checked H.264 output metadata is merged in the standalone Apple backend (feat(apple): validate H.264 output metadata #271): bounded owned SPS/PPS/avcC and length-prefixed access units, checked progressive High-profile 8-bit 4:2:0 geometry, picture-header identity, sync agreement and auxiliary-NAL ordering. All 18 new hosted macOS fixtures and the affected fuzz target pass. These readers alone do not validate compressed slices, decoded pixels, source/timestamp accounting or final drain; the separate owner and synthetic decode smoke are now merged in feat(apple): own VideoToolbox encoding #289.

• Rooted Rust linkage against the pinned SVT-AV1 LTO archive is verified on all four x86-64/AArch64 Linux-musl and macOS targets (ci(svt-av1): verify rooted Rust static links #269). Hosted jobs retain compiler-bound proof manifests after checking executable API roots, architecture, static/system-only dependencies and successful Rust entry execution. Linux uses the archive's GCC/musl driver and the pinned Rust target's unwind archive. This is standalone link evidence; production FFI, sandboxed encoding, release packaging and acceptance bars remain separate.

• Audio encodes now accept Opus and feature-gated AAC-LC sources, with source selection and presentation trimming owned by the decoder (feat(transcode): accept decoded audio sources #254). AAC-enabled CI runs the complete fixture target and validates source summaries against the schema. The exact two-pair Opus MP4 padding difference from the pinned FFmpeg is documented and checked.

• The standalone AudioToolbox AAC-LC adapter is merged (feat(apple): encode AAC with AudioToolbox #232): bounded source and tail accounting, checked effective settings and component identity, explicit drain, owned output and cookies, cancellation and failure cleanup. Hosted macOS independently decoded all four 44.1/48 kHz mono/stereo cells with exactly 5,000 trimmed frames and channel impulses within one sample. This is synthetic correctness evidence, not pinned-FFmpeg conformance or an acceptance-bar result. The adapter is not connected to the CLI.

• The SVT-only native licence and notice gate is merged (chore(svt-av1): enforce native notice policy #256). It checks the pinned recipe identity, retained-file integrity and exact source-bound notice bytes on all four native Unix targets. The 12 gate tests and hosted checks pass, including rejection of a replaced notice with a rewritten manifest hash. Cargo policy and CoreAV's crate licences are unchanged. Runtime encoding and release-package notice coverage remain separate.

• Native SVT-AV1 static-build CI is merged (ci(svt-av1): verify native static builds #238). All four x86-64/AArch64 Linux-musl and macOS targets pass the 20 recipe tests and installed v4.2.0 probe, with retained manifests and logs. This verifies the native dependency's build, linkage and version only; Rust encoder integration, acceptance bars and distribution remain separate.

• The pinned SVT-AV1 4.2.0 static-build recipe is merged (chore(svt-av1): add pinned static build recipe #236), with verified acquisition, retained notices, an API-rooted link/version probe, explicit Linux LTO archive tools and descendant cleanup on timeout. The 20 recipe tests pass. This builds the native dependency only; no Rust encoder, worker entry, CLI option or acceptance result is enabled.

• Unsafe-site registration now travels with its backend source in the same pull request, with integration-owner row content and sign-off plus independent review (docs(encoders): keep unsafe rows with their source #230). The missing-file guard is unchanged; this documentation change enables no encoder and changes no licence policy.

• Checked AV1 sequence configuration and a four-byte av1C prefix are implemented (feat(svt-av1): validate AV1 sequence configuration #228), with caller byte/dimension limits, explicit malformed/unsupported errors and a sequence fuzz target. The standalone reader tests pass. Frame validation, submitted-work accounting, native encoding and acceptance bars remain separate.

• Transcode encoder selection groundwork is merged (feat(transcode): prepare built-in encoder selection #227): codec-neutral owned-frame and packet accounting, explicit AV1/platform refusals before media I/O, independent AAC encoder selection and hardware requirements. No built-in encoder is connected; successful summaries remain coreav.transcode/1. Hosted CI passed the frozen-command comparison of legacy media, stdout, stderr and exit status.

• Checked AAC-LC output metadata readers are available in the standalone Apple backend (feat(apple): validate AAC output metadata #224), with 10 passing hosted macOS fixtures, strict Clippy, and an affected-target fuzz run. They validate configuration, packet boundaries and declared trim accounting only; these readers do not themselves call a framework.

• Bounded AV1 OBU framing is implemented in the standalone SVT-AV1 backend crate (feat(svt-av1): validate bounded OBU framing #222), with 13 hostile-input tests, a fuzz target, and passing hosted Linux tests and Clippy. It validates framing only, not sequence configuration, frame accounting, or muxing suitability. No native encoder is linked or enabled.

• Standalone encoder backend CI is in place (ci(encoders): check standalone backend crates #221): Apple reader tests and Clippy run on hosted macOS, and SVT-AV1 reader tests and Clippy run on Linux x86-64. An existing crate with a missing manifest fails rather than skipping. This adds no runtime encoder or acceptance result.

• Built-in encoder phase 0 is complete (docs(encoders): define backend implementation tracks #216): policy record, independent backend contracts and pre-registered bars. No encoder implementation changed. The static-musl linked-code estimate for SVT-AV1 is 6.62 MiB above the matched CLI base, not a finished backend size. This does not change any source-support or B5 verdict below.

• The VP9 release-cost round is complete as results only (docs(perf): record final VP9 parity miss #190, method and evidence). All three candidates miss the overall CPU parity bar. The last candidate/Debian median is 1.1807 against a 1.03 bar; candidate/FFmpeg is 1.3850, with two of ten files cheaper. Thread caps trade lower CPU for higher latency, and the 64-byte copy loop has no clear automatic-thread CPU benefit. The in-process owned-output harness differs from the shipped sandboxed lending path. No allocator, copy or release-default change was retained, and this is not a B5 or shipped-default speed claim.

• Audio encodes are available: libopus through coreav transcode --audio opus and coreav ffmpeg -c:a libopus (feat(transcode): encode audio to Opus with libopus #91, feat(ffmpeg): encode audio with -c:a libopus #92), and AAC-LC through coreav transcode --audio aac and coreav ffmpeg -c:a aac (feat(transcode): encode audio to AAC-LC with FFmpeg's aac #112, feat(ffmpeg): encode audio with -c:a aac #165). Matroska audio starts are preserved as edit-list offsets in the shared encode path; the encodes take FLAC or MP3 sources.

• The strict-safe guide documents the external AAC encoder: which ffmpeg program runs, what happens when it or its aac encoder is missing, the FLAC-or-MP3 inputs, and the MP4 leading-empty-edit limit (docs(site): note the external AAC encoder #184).

• Encoder test stand-ins are written by a child process to avoid inherited write descriptors causing ETXTBSY (test(transcode): write stand-in scripts from a child process #163).

From docs/design/transcode.md ("Results") and docs/measurements/transcode.md:

• H.264 sources are supported; any other source codec is experimental, because those classes missed bars.

• Speed (B5, bar 1.05 against ffmpeg -c:v libx264): H.264 1.038 (ffmpeg decoder arm) and 1.024 (x264 arm); HEVC 1.057 and 1.200, AV1 1.068 and 1.054, VP9 1.099 and 1.095, VP8 1.060 and 1.046, ProRes 1.108 and 1.890.

• The misses: the encoder's memory cap on a 16 GB host at 8K output, the pacing of one HEVC stream, repeated millisecond times in WebM, one 8K AV1 stream through --encoder ffmpeg, and the cost of the sandboxed decoders.

• The x264 arm's extra time on 10-bit sources (HEVC, AV1 and ProRes) is the x264 program's own conversion of 10-bit input, not CoreAV's code. Most of it was a stall on transparent huge pages, so coreav transcode now runs the x264 program without them on input of more than 8 bits (perf(transcode): run x264 without huge pages on 10-bit #88). On the corpus, the x264 arm's median over the ffmpeg arm on 10-bit sources went from 1.428 to 1.172 (8-bit: 1.007), measured against FFmpeg 9.0.2. Against the B5 baseline, the x264 arm is at 1.146 overall and 1.407 in ProRes, and the ffmpeg arm at 1.069; both still miss B5 (docs/measurements/transcode-x264-10bit.md).

• B6 (hostile files) and B7 (fuzz targets) are met; B8's fixture job is not in place, since it would fail on the size_inband_sps.mp4 fixture's B2 miss.

• The VP9-to-H.264 attribution against FFmpeg 9.0.2 is documented in docs/measurements/vp9-libvpx.md (docs(measure): attribute the VP9 transcode gap #158): the median ratio is 1.074; about 70% of the summed extra seconds is frame transfer and about 23% is decoding. This is diagnosis, not a B5 verdict.

• VP9 and other sandboxed sources: each decoded frame is now copied once on its way to the encoder, and no frame-sized buffer is allocated per frame (perf(transcode): copy each decoded frame once #178). Output is unchanged. In a judged run on the 10 VP9 files of B5, the time against main was 0.978 with the FFmpeg encoder (CI 0.943 to 0.999) and 0.977 with x264 (CI 0.940 to 1.0005, so the x264 speedup is not claimed). Against FFmpeg's single command on the same host, x264 went from 1.056 to 1.022 and the FFmpeg encoder from 1.072 to 1.035.

• Release-configured VP9 decode CPU is documented in docs(measure): compare release libvpx CPU #182: on the three 4K/8K files, the median ratio against FFmpeg native VP9 is 1.226 for release musl and 1.207 for Debian. Debian packaging does not explain the gap. The harness includes frame export and allocation, and pairwise build order was not balanced; these results do not isolate library kernels or establish a B5 verdict.

Checklist

• Add test-only instrumentation for actual full-RDO call counts through the bounded motion-search path.

• Repeat encoder references with longer sequences and larger dimensions before making quality or speed claims.

• Profile fixed-QP P-picture encoding before changing its motion or partition search.

• Add explicit sample assertions for normal chroma filtering and asymmetric or fallback strong-luma deblocking branches.

HEVC decoder follow-ups

• Increase valid eight-bit edge coverage in the HEVC deblocking fuzz generator while retaining malformed-input checks (follow-up to perf(hevc): vectorize eight-bit deblocking #519).

• Batch HEVC loop-filter decisions and add checked 8-bit AVX2 SAO rows with scalar fallback, complete conformance and both census modes (perf(hevc): batch in-loop filtering #501).

• Measure the remaining HEVC deblocking arithmetic and add checked 8-bit AVX2 with scalar fallback (perf(hevc): vectorize eight-bit deblocking #519).

• Measure Main10 SAO and add vector lanes only if their removable cost justifies them.

• Give scalar and automatic HEVC full checks distinct names so an unfinished mode cannot be hidden by the pull-request rollup.

• Define the native Main/Main10 decoder scope, opt-in packaging, clean-room rules and pre-registered gates (docs(hevc): plan the native decoder #363).

• Implement milestone 1: bounded headers and parameter sets, explicit refusals, the SHA-256-pinned conformance manifest and header/correctness harness, accounting for all 147 candidate archives (feat(hevc): add bounded header inspection #373).

• Implement milestone 2 scalar intra reconstruction against the registered Main/Main10 references, including serial tile, WPP and dependent-segment semantics before G3, while retaining opt-in packaging (feat(hevc): reconstruct scalar intra pictures #393).

• Implement milestone 3 scalar deblocking and SAO before hashes or publication, with complete original G3 and development first-IRAP comparisons and unchanged opt-in packaging (feat(hevc): filter scalar intra pictures #414).

• Close available effective tile/WPP/dependent pixel coverage using original filtered G3 references without changing official filter signalling (feat(hevc): filter scalar intra pictures #414); absent ten-bit tile/dependent candidates remain an explicit gap.

• Add a manual decoder-only reference driver that verifies each input exactly before timing it and records scalar instruction counts and hotspots (perf(hevc): add scalar decode reference driver #447).

• Let the reference driver verify the two longest development inputs within its time limit, so every reference input is timed.

• Add original or already-held ten-bit tile/dependent-segment intra coverage when available; keep the absent-case gap explicit and do not generate replacements.

• Add closed, non-sensitive error labels to HEVC synthetic-fixture CLI failures without echoing external exception text.

FFV1 lossless output follow-ups

• Use collision-resistant temporary directories and failure cleanup in the generated FFV1 backend fixture test.
• Add native FFV1 v3 video-only Matroska output with exact oracle checks and terminal mid-stream parameter failures (feat(ffv1): add native lossless Matroska encoding #324).
• Extend native FFV1 output to RGB while retaining exact decoded samples.
• Extend native FFV1 output to higher bit depths with exact native-format comparisons.
• Expose decoded-frame scan metadata before admitting additional source decoders for FFV1.
• Add audio beside FFV1 video in Matroska with complete sample and presentation accounting.
• Give native FFV1 encodes the shared one-hour command limit instead of the 60-second decoder default (fix(cli): give FFV1 encodes the one-hour limit #463).
• Decide whether the AVI MP3 encode's own 120-second deadline should use the shared encode limit.
• Decide whether an FFV1 encode that runs out of time should fall back to FFmpeg.
• Preserve non-default chroma siting in Matroska before admitting those declarations.

H.264 encoder follow-ups

• Evaluate row-checked squared pixel-error accumulation while preserving exact sums and output; retain the existing loop because the full comparison missed the improvement threshold for opening a pull request (follow-up to perf(h264): share plane completion work #524).

• Share plane-owned row completion across existing workers without changing output or the thread limit (perf(h264): share plane completion work #524).

• If a tall-input profile shows a decision critical-path regression, bound ready-row assistance before claiming the next decision row (follow-up to perf(h264): share plane completion work #524).

• Make row-preparation handshake timeouts identify the stalled phase without weakening concurrency assertions (follow-up to perf(h264): share plane completion work #524).

• Overlap ordered syntax, reconstruction and deblocking with immutable row decisions without changing output (perf(h264): overlap row deblocking #517).

• Quantify the one-worker recovery ceiling and remaining row-pipeline cost before the next output-preserving change; carry the four-worker design wording clarification into that implementation (follow-up to perf(h264): overlap row deblocking #517).

• Clarify the H.264 edition and horizontal-up repeated-endpoint wording in the intra-prediction design note (perf(h264): speed up four-by-four prediction #514).

• Reduce encoder tile storage while preserving prediction neighbours, exact extents and byte output (perf(h264): shrink encoder tiles #518).

• Limit luma top-border filling to its consumed top-right samples and enforce the compact stride constraint at compile time (follow-up to perf(h264): shrink encoder tiles #518).

• Evaluate reusable bounded picture planes and the candidate table; retain the existing ownership because the isolated reuse result did not justify a product change.

• Evaluate output-preserving AVX2 deblocking pixel filtering under the encoder kernel policy and the removable-cost gate.

• Revisit vector reconstruction add-and-clip only after other encoder costs materially change: the current-main ceiling check did not justify a kernel; preserve byte output, pixel clipping and malformed-view behavior (perf(h264): vectorize transform arithmetic #484).

• Share inverse coefficient-domain validation between scalar and AVX2, and compare both twins on full i32 inputs rather than only the caller's admitted i16 values (fix(h264): share inverse input validation #488; follow-up to perf(h264): vectorize transform arithmetic #484).

• Pin admitted AC coefficient 32767 and refused 32768 with cancelling partner coefficients in normal and scalar-forced inverse tests (fix(h264): share inverse input validation #488).

• Assess whether reconstruction can omit its repeated pre-DC inverse admission without changing refusal ordering or nonzero-DC-level override behavior (fix(h264): share inverse input validation #488).

• Consider a signed-16-bit inverse input type that carries the shared domain while preserving scalar and AVX2 results (fix(h264): share inverse input validation #488).

• Clarify the encoder fuzz inventory row in docs/unsafe-sites.md: SAD uses fixed arrays, while SATD uses checked slice extents, with the same production detection and memory preconditions (perf(h264): vectorize mode-decision Hadamard costs #478).

• Assert that AVX2 detection returns Some on an AVX2 host in the encoder differential tests, so they cannot silently compare scalar with scalar (perf(h264): vectorize mode-decision Hadamard costs #478).

• Calibrate the P-picture mode-decision rate weight against the quantizer using complete-sequence RD curves and per-frame error and skip statistics.

• Separate bounded proposal-ranking regret from probe, finalist and layout-budget losses before widening encoder tools.

• Study partition pruning and early skip against the committed first-principles design, then independently review the technique note before implementation.

• Study padded reference access and reusable fractional-pixel interpolation under exact normative sample arithmetic.

• Study cheaper motion scoring, predictor ordering and early termination, measuring finalist quality as well as work avoided.

• Study exact incremental finalist state beyond the existing unchanged-region cache, including coupled chroma DC and syntax dependencies.

• Study specialized scalar transforms and QP-derived quantization arithmetic while preserving rounding and refusal behavior.

• Close the remaining QP28 driver-throughput gap on B (about 4% below the build before the rate-weight change) only with a profiled site worth at least 3%; the remaining entries (scattered copies, the fractional-motion tile fill, deblocking) were each below that.

• Design a conforming fallback for dense fixed-QP macroblocks, considering I_PCM or a per-macroblock QP raise without weakening Annex A admission.

• Compare heuristic split-layout pruning with the current all-layout bounded search, including motion boundaries, chroma, rate and quality.

• Compare bounded fractional-sample reuse with checked direct reference reads, including preparation cost, memory and reference invalidation.

• Compare arithmetic motion-bit lengths, strict partial-SAD cutoffs and a small SATD reranking stage without silently changing probe or finalist caps.

• Extend incremental finalist reuse only where complete costs, syntax, reconstruction and refusal behavior match uncached evaluation, including coupled chroma DC.

• Evaluate picture-QP-derived quantization parameters while preserving signed rounding, coefficient limits and refusal behavior.

Image and raw-video output follow-ups

• Add native PNG, BMP, image2 sequences, rawvideo and progressive 8-bit YUV4MPEG2 output (feat(ffmpeg): write image and raw video outputs #260).
• Match the pinned FFmpeg's RGB conversion exactly, independently of image encoder losslessness.
• Add frame duplication for output rates above the source rate.
• Add resizing for image and raw-video output.
• Add high-bit-depth YUV4MPEG2 output.
• Integrate shared PNG cover images with FLAC and MP3 audio output, coordinating channel conversion, dithering, sample-format conversion and resampling with their owners.
• Add encoded PNG in MOV with its default audio encoder integration.
• Add multiple-input mapping and attached-picture disposition and muxing for MP4 and MP3 output.

PCM and FLAC output follow-ups

• Attribute the remaining native FLAC gap against default FFmpeg on development inputs and measure removable-work ceilings before proposing another optimization; diagnose startup calibration separately without rerunning the completed comparison.

• Evaluate a combined FLAC prediction-search and bit-output approach under unchanged lossless, size and default-reference speed bars, using a separately reviewed plan.

• Prospectively register longer workloads for a future FLAC candidate comparison, retaining the original calibration miss and unchanged startup, size and speed predicates.

• Add native signed 16-bit WAV and raw PCM output, with exact sample checks and atomic replacement (feat(ffmpeg): write signed 16-bit PCM audio #261).

• Add a specification-written FLAC encoder with fixed and LPC subframes, Rice coding, STREAMINFO MD5, .flac output and independent decode checks (feat(flac): encode lossless audio natively #298).

• Run the registered default-level FLAC size/speed comparison once on merged main and retain its failed outcome and raw evidence (docs(flac): record the failed comparison #326).

• Complete FLAC residual coding with five-bit Rice parameters and escaped partitions, retaining exact correctness gates (fix(flac): complete residual coding #335).

• Optimize FLAC residual generation while keeping output byte-identical to the completed residual coder (perf(flac): streamline residual construction #345).

• Run one new registered FLAC comparison after both fixes merge, with unchanged bars and the former failed result retained (docs(flac): record the second comparison #353).

• Profile the remaining native FLAC encoder CPU cost against pinned FFmpeg at matched settings and measure component ceilings before further optimization (perf(flac): cache exact residual costs #369).

• Reuse exact FLAC partition costs and independently accumulate autocorrelation lags while preserving complete encoded bytes (perf(flac): cache exact residual costs #369).

• Register and run the merged FLAC cost-cache comparison with complete candidate/reference/before-change triples and unchanged bars; retain every miss and merge the separate complete results (docs(flac): record the cost-cache comparison #378).

• Extend native FLAC output to raw PCM and ALAC sources, retaining exact sample, rate and layout checks.

• Add raw PCM input and sample-rate conversion to native PCM output.

• Add mixing and pipe/realtime input to native PCM output.

• Preserve WAV and FLAC metadata and chapters, or keep explicit refusals until preservation is implemented.

• Add nonzero and stateful-codec seeking, multichannel conversion and early termination after a PCM duration limit.

• Connect PCM output to additional container and video paths, including Matroska and HuffYUV, and coordinate the held bitstream-filter work.

• Add the pinned SVT-AV1 static-build recipe and verified link/version probe (chore(svt-av1): add pinned static build recipe #236).

• Verify the static SVT-AV1 recipe on all four native Unix targets in hosted CI (ci(svt-av1): verify native static builds #238).

• Add the standalone SVT-AV1 raw-frame and A1–A3/A5 acceptance drivers, with the exact frozen encoder release in the reference build before judging.

• Measure the AV1 encoder process boundary against in-process encoding and FFmpeg (test(av1): measure the encoder process boundary #457).

• Locate the remaining in-process AV1 transcode difference against FFmpeg with accounting inside the transcode path, rather than from decode-only calls.

• Add checked AV1 sequence configuration and a derived av1C prefix (feat(svt-av1): validate AV1 sequence configuration #228).

• Add codec-neutral video contracts and transcode-only selection groundwork without connecting a built-in backend (feat(transcode): prepare built-in encoder selection #227).

• Add the bounded AAC-LC metadata readers and hostile-output tests (feat(apple): validate AAC output metadata #224).

• Extract bounded AudioToolbox magic cookies and validate the required AAC configuration forms (feat(apple): encode AAC with AudioToolbox #232).

• Add safe AudioToolbox ownership, bounded session accounting, cancellation and failure tests, and actual component identity (feat(apple): encode AAC with AudioToolbox #232).

• Complete pinned-FFmpeg AAC conformance for all four accepted rate/channel cells, including final sample counts, channel order, impulse placement and complete drain.

• Add full runtime platform capability and hardware reporting before integrating the Apple encoders into transcode.

• Add checked H.264 configuration and access-unit readers (feat(apple): validate H.264 output metadata #271).

• Add safe VideoToolbox ownership, bounded frame accounting, callback lifetime tests and hosted hardware/automatic two-decoder smoke (feat(apple): own VideoToolbox encoding #289).

• Validate the relatively-prime requirement of nonzero Extended_SAR fields before claiming general H.264 bitstream conformance.

• Add the registered VideoToolbox raw-frame driver, symmetric preflights, two-decoder conformance and quality/timing evidence tools (feat(apple): own VideoToolbox encoding #289); this does not establish an acceptance result.

• Add the AudioToolbox PCM acceptance driver.

• Add the reviewed pinned macOS FFmpeg/ffprobe reference, exact post-exit EncoderID/hardware queries and integer/fractional synthetic observation and whole-packet-byte smoke; keep unobservable baseline controls explicitly requested-only (feat(apple): freeze prepared VideoToolbox inputs #342).

• Freeze thirty prepared-I420 source/raw/frame identities, ordered selection, explicit 2160 shortfall and native/tool/plan content hashes before judging (feat(apple): freeze prepared VideoToolbox inputs #342).

• Amend the six outdated native digests to exact merged candidate bytes, preserving every other registration field and strict comparison (fix(apple): pin frozen native bytes to main #355).

• Commit the actual clean macOS exporter and Linux decoder build records for the frozen candidate, retaining strict executable and merged-review bindings (docs(apple): record actual exporter builds #358).

• Merge the M1 VideoToolbox hardware reference figures and their per-call/quality data (docs(apple): report M1 encoding reference figures #395). The existing prepared references were reused; no final registration seal or judged campaign is underway.

• Add standalone hardware-only HEVC Main encoding with checked hvcC, parameter sets and independent synthetic decoding (feat(apple): encode HEVC with VideoToolbox #409).

• Record M1 HEVC hardware reference speed and distortion figures without a judged verdict (docs(apple): report M1 HEVC reference figures #411).

• Buffer standalone JSON reporting without changing native outputs, encoder settings or default builds (perf(apple): buffer VideoToolbox reports #415).

• Merge the separate same-input old/new/FFmpeg reference figures and disclosed quality-clock correction (docs(apple): report buffered M1 encoding figures #419).

• Establish a separate ten-input native 2160 cohort with validated HEVC/AV1/ProRes progressive-header proof and eligible rights-cleared sources; do not upscale or substitute inputs in the existing freeze.

• Add the bounded AV1 OBU framing reader and hostile-output tests (feat(svt-av1): validate bounded OBU framing #222).

• Add hosted CI for the standalone encoder reader crates (ci(encoders): check standalone backend crates #221).

• Define built-in encoder policy, independent backend tracks and pre-registered bars (docs(encoders): define backend implementation tracks #216).

• Implement the sandboxed SVT-AV1 backend and checked AV1 output reader on all four Unix release targets, with the diagnostic in-process isolation-cost comparison.

• Implement the VideoToolbox H.264 and AudioToolbox AAC backend and checked output readers on both macOS release architectures.

• Assign one integration owner for workspace and feature registration, worker dispatch, transcode selection, CLI options and versioned summary schema.

• Enforce the SVT-only native licence exception and exact upstream notice bytes against the pinned recipe installation (chore(svt-av1): enforce native notice policy #256).

• Add the actual SVT-AV1 unsafe-site registrations, required distribution notices and static release packaging with implementation.

• Verify the native Rust link against the pinned LTO archive on all four Unix targets, without system-library lookup or dynamic fallback (ci(svt-av1): verify rooted Rust static links #269).

• Record reference speed and distortion figures on available Mac hardware for VideoToolbox and AudioToolbox, naming the input scope, method and limits.

• Resolve the physical-M1 software VideoToolbox status-observability refusal, then submit, drain and independently decode. Never infer software status from a missing hardware flag or treat a refusal as encoder absence.

• Run the integrated encoder acceptance bars and repeat finished-package size measurements. Coordinate compatibility vocabulary, command help, schema publication and release-plan changes with their owners.

• Preserve or explicitly refuse gaps between Matroska audio blocks during audio encoding; the decoder currently closes those gaps.

• Carry an MP4 audio source's leading empty edit as an edit instead of encoding silence, while preserving the current sound position.

• Document the AAC encoder in the strict-safe guide (docs(site): note the external AAC encoder #184).

• Test refusal of an undefined AAC sample rate inside the 8-64 kHz range.

• If the same ETXTBSY race occurs in the CLI fallback or strict-safe tests, move their stand-in script writers to the child-process pattern used in test(transcode): write stand-in scripts from a child process #163.

• docs-site/commands/ffmpeg.mdx says a -c:a aac line is refused with exit status 4 when no ffmpeg program is found or it has no aac encoder. Both are not-native refusals, so outside strict-safe mode the fallback can still run the line; say so.

• docs-site/strict-safe.mdx says the default release build has no decoder backend, while docs-site/install.mdx says the Linux and macOS default release build has thumbnail and transcode for AV1, VP8 and VP9. Make the two pages agree.

• Speed: bring every source class to the B5 bar, starting with the sandboxed decoder's overhead (ProRes, VP9, HEVC).

• 8K output within the memory cap on a 16 GB host.

• The pacing of the HEVC stream and the repeated millisecond times in WebM (B2).

• The B2 fixture miss, then the fixture CI job (B8).

• A new round on new code; drop the experimental label per class that meets the bars.

• The x264 arm on 10-bit sources: close the remaining gap over the ffmpeg arm (median 1.12 times at 4:2:0 and 1.24 times at 4:2:2), which is the x264 program's serial conversion of 10-bit input, for example by giving it 10-bit frames another way.

• scripts/transcode_speed_gcp.py writes its run budget fields (*_usd) into plan.json, and docs/measurements/transcode/round-2/speed/plan.json carries them. Keep those fields out of the published plan and remove them from the round-2 copy.

• Optional: confirm which instruction the x264 program's 10-bit conversion stall waits on, using precise or load-latency sampling on a host that offers it. Nothing in CoreAV depends on it.

• Optional: measure the end-to-end cost of writing 16-bit frames to a memfd or file before x264 starts, against the roughly 19% faster encode it gives on 10-bit sources.

• coreav ffmpeg -c:v libx264 without -fps_mode passthrough refuses a one-frame H.264 MP4 (codec_h264_one_frame.mp4) as "reordered frames without composition offsets". A single frame has nothing to reorder, so B9 should transcode it in every configuration, not only x11.

• VP9 frame transfer: decode directly into the shared-memory slot and feed the encoder from that slot, removing two intermediate full-frame copies (perf(transcode): copy each decoded frame once #178).

• VP9 large frames: reuse buffers to avoid repeated mapping and zeroing (perf(transcode): copy each decoded frame once #178: no frame-sized buffer per frame; the 8K effect was measured together with the copy removal, 0.93 on the 8000x4500 file).

• VP9 decoder diagnosis: compare release static libvpx 1.14.1, Debian libvpx 1.15.0 and FFmpeg native VP9 on the same files (docs(measure): compare release libvpx CPU #182).

• VP9 encoder settings: pass the correct frame rate to x264 so keyint_min matches the baseline.

• Optional: measure a larger encoder stdin pipe buffer; the profile bounds its possible gain by the small pipe-write share.

• Update "Attribution of the B5 gap" in docs/measurements/vp9-libvpx.md with the judged run of perf(transcode): copy each decoded frame once #178.

• Lend frames on the worker's inline path too (a sandbox without shared memory), which still allocates a buffer per frame.

• Optional: write lent frames to the encoder's pipe straight from the shared mapping. It needs a new unsafe site; a diagnostic arm of the perf(transcode): copy each decoded frame once #178 run measured 0.06 points of transcode time in the median 4K/8K file, so it is low value.

• Diagnose the additional CPU cost of the release musl target/toolchain, separating allocation and frame-export costs before choosing a build change; no tested build in docs(measure): compare release libvpx CPU #182 closes the large-file gap.

MP3 output follow-ups

• Add audio-only MP3-in-MP4 sample entries, edits and mux parity.
• Admit identity-only MP3 sample-rate and channel options before adding broader conversion.
• Add bounded raw-S16 stdin to MP3 stdout encoding, including the PCM adapter and nonseekable Xing/Info behavior.
• Add MP3 beside video in MP4, then qualify generic quality aliases and seek/trim behavior.

Not in scope

• Encoder implementations in the source-parity round above; the built-in encoder follow-ups have their own acceptance bars.
• Output containers other than MP4.
• MPEG-TS input.