# Compiled format 1.1

Wire `1.1` is the only supported compiled format. It contains a bounded
container, elementary codec payloads, a state graph, timelines, integrity
relations, resource declarations, and decoded-output qualification for packed
alpha. The 64-byte header uses version `1.1`, and the manifest must declare
`"formatVersion": "1.1"`. Header and manifest versions must match exactly.

The version adds a compiler-authored proof for packed-alpha decoder output.
This proof lets the runtime reject a codec candidate that accepts and decodes
the bitstream but returns semantically wrong alpha pixels.

## Rendition rules

An opaque `1.1` rendition must not contain `outputQualification`. Every
packed-alpha `1.1` rendition must contain exactly one witness:

```json
{
  "kind": "packed-alpha-v1",
  "unit": "idle",
  "frame": 0,
  "samples": [
    { "x": 12, "y": 9, "expectedRange": [0, 64] }
  ]
}
```

`unit` names a readiness bootstrap unit and `frame` is its zero-based local
presentation index. A witness contains one to eight unique logical alpha-pane
coordinates. Coordinates must fit the visible alpha rectangle. Each inclusive
range uses integer endpoints from 0 through 255, has `minimum <= maximum`, and
has width at most 96. The witness unit, frame, readiness membership, and
rendition chunk span are cross-validated before playback.

Unknown keys, a witness on an opaque rendition, a missing packed-alpha witness,
invalid bounds, or a header/manifest version mismatch make the asset invalid.
They are terminal asset failures and never select another codec.

## Compiler verification

The compiler chooses deterministic source candidates while canonical RGBA16
frames are available. Readiness bootstrap-unit order and then local frame index
choose the witness frame; low orthogonal alpha gradient and row-major order
rank coordinates within that frame. Selection is bounded to eight samples.

For every rendition, the compiler decodes the exact emitted unit bytes through
the codec's elementary transport and samples the decoded alpha pane. A source
candidate survives only when its canonical and emitted 8-bit values differ by
at most 32. For canonical value `c` and emitted value `e`, the inclusive range
is:

```text
[max(0, min(c, e) - 32), min(255, max(c, e) + 32)]
```

When the authored alpha span is at least 128, the retained witness must keep
separated coverage. Compilation fails rather than emitting an unqualified
packed-alpha rendition when no bounded witness survives.

## Runtime qualification

Before publishing `visualReady` or `interactiveReady`, the runtime decodes
through the exact witness unit and local presentation frame. It materializes
that frame once as bounded RGBA, offsets each logical coordinate through the
canonical alpha rectangle, and requires every red-channel value to fall inside
its inclusive range.

Only an observed sample outside its range is a provisional
`decoded-output-incompatible` result that may advance to the next authored
codec. Missing or malformed witnesses, wrong frame identity, materialization,
renderer, resource, transport, cleanup, abort, and post-readiness failures are
terminal. A decoder-local codec support-probe, decode, or flush progress timeout
during provisional startup may advance to the next codec; after readiness, a
decoder progress timeout is terminal. Detailed diagnostics are evidence; they
are not parsed to reconstruct fallback policy.

Cross-file codec preference is the runtime's fixed AV1 → VP9 → H.265/HEVC →
H.264 policy, declared by each direct child's required `data-codec` family.
DOM order cannot change it. H.264 is touched only after the three higher-ranked
present candidates are unavailable or fail one of the closed provisional
codec/output checks. AVAL renders no alternate image or video when the ladder
is exhausted; applications handle the terminal typed error themselves.