diff --git a/.github/workflows/energy-hardware.yml b/.github/workflows/energy-hardware.yml
index 00118e5f3..801826740 100644
--- a/.github/workflows/energy-hardware.yml
+++ b/.github/workflows/energy-hardware.yml
@@ -22,6 +22,10 @@ name: energy meters on real hardware
 # fetched with plain git, and each workspace keeps its target directory in the
 # runner's home between runs.
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/wai-conformance.yml b/.github/workflows/wai-conformance.yml
index 6c2973727..80346dcd8 100644
--- a/.github/workflows/wai-conformance.yml
+++ b/.github/workflows/wai-conformance.yml
@@ -195,7 +195,9 @@ jobs:
       # allocator) checks that a header past the caps is refused before anything sized from it
       # is allocated; tests/int_payload_cost.rs (its own binary, a live-bytes allocator) checks
       # that int_payload::declared_cost bounds what each decode holds, and, in the release
-      # step only, decodes a 2^30-byte clip a 3 KB payload codes. tests/staged_resources.rs (its
+      # step only, decodes a 2^30-byte clip a 3 KB payload codes; tests/int_video_enc_memory.rs
+      # (its own binary, the same allocator) checks that int_video_enc::working_bytes bounds
+      # what the encoder holds. tests/staged_resources.rs (its
       # own binary, a counting allocator) checks that the staged sink's work and memory per
       # layer grow linearly in the layer's units, that a layer past the chain budget is
       # refused before any stream is decoded, that what no unit holds is dropped, and that a
@@ -209,10 +211,10 @@ jobs:
       # wai.generate.spectral vector, which `generate` enables.
       - name: Fast integer kernels ≡ reference kernels (overflow checks on)
         working-directory: wai/wai-rs
-        run: cargo test --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,staged --lib --test int_kernels_vectors --test int_kernels_geometry --test int_mlicpp --test int_mlicpp_preflight --test int_audio --test int_splat --test generate --test int_payload --test int_payload_preflight --test int_payload_cost --test cli_stage --test staged_resources
+        run: cargo test --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,staged --lib --test int_kernels_vectors --test int_kernels_geometry --test int_mlicpp --test int_mlicpp_preflight --test int_audio --test int_splat --test generate --test int_payload --test int_payload_preflight --test int_payload_cost --test int_video_enc_memory --test cli_stage --test staged_resources
       - name: Fast integer kernels ≡ reference kernels (release, overflow checks off)
         working-directory: wai/wai-rs
-        run: cargo test --release --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,staged --lib --test int_kernels_vectors --test int_kernels_geometry --test int_mlicpp --test int_mlicpp_preflight --test int_audio --test int_splat --test generate --test int_payload --test int_payload_preflight --test int_payload_cost --test cli_stage --test staged_resources
+        run: cargo test --release --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,staged --lib --test int_kernels_vectors --test int_kernels_geometry --test int_mlicpp --test int_mlicpp_preflight --test int_audio --test int_splat --test generate --test int_payload --test int_payload_preflight --test int_payload_cost --test int_video_enc_memory --test cli_stage --test staged_resources
       # The integer decode path builds under each of its features alone, so a sink can take
       # one medium without the others, and for wasm32 (a browser sink); `int_payload` arms a
       # medium only under its feature, and none needs `neural`.
diff --git a/.github/workflows/wai-pack.yml b/.github/workflows/wai-pack.yml
new file mode 100644
index 000000000..6fd8ec5b4
--- /dev/null
+++ b/.github/workflows/wai-pack.yml
@@ -0,0 +1,192 @@
+name: wai-pack
+
+# The reference packager of WAI's packaging extension (wai/extensions/packaging.md) and
+# its conformance corpus (wai/pack-conformance). Three jobs:
+#
+# - legs: on each architecture of the fleet, clippy with float arithmetic denied (no
+#   float decides anything in a package), the tests in release with a floor on how many
+#   each target lists, and the corpus recomputed by the crate.
+# - independent: the corpus recomputed by its second implementation, written in Python
+#   from the extension text and sharing no code with wai-pack.
+# - licences: every crate in wai-pack's dependency graph is under a licence deny.toml
+#   allows; a source-available licence fails it.
+#
+# Push filters match the push's delta, so every path a build or a verifier reads is
+# listed: the crate, the wai crate it builds on, the corpus, the BLAKE3 and integer
+# payload verifiers and the registry export pack_verify.py reads, and this file.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    paths:
+      - 'wai/wai-pack/**'
+      - 'wai/wai-rs/**'
+      - 'wai/pack-conformance/**'
+      - 'wai/claim-conformance/_blake3.py'
+      - 'wai/int-payload-conformance/int_payload_verify.py'
+      - 'wai/registry/capabilities.json'
+      - '.github/workflows/wai-pack.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'wai/wai-pack/**'
+      - 'wai/wai-rs/**'
+      - 'wai/pack-conformance/**'
+      - 'wai/claim-conformance/_blake3.py'
+      - 'wai/int-payload-conformance/int_payload_verify.py'
+      - 'wai/registry/capabilities.json'
+      - '.github/workflows/wai-pack.yml'
+
+jobs:
+  legs:
+    name: wai-pack · ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # Self-hosted fleet labels: x86_64 by linux, arm64 by linux-arm64 and macos.
+        # A Windows leg waits for its runner (see wai-byte-equality.yml).
+        os: [linux, linux-arm64, macos]
+    steps:
+      - uses: actions/checkout@v5
+
+      # The docker runners ship no Rust, so rustup is bootstrapped; the macOS host has
+      # it, but launchd's PATH omits ~/.cargo/bin.
+      - name: Install Rust 1.98.0
+        shell: bash
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
+          rustup toolchain install 1.98.0 --profile minimal
+          rustup default 1.98.0
+          rustup component add --toolchain 1.98.0 clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      # clippy::float_arithmetic is denied for the library and the CLI (Cargo.toml and
+      # the crate attributes); -D warnings makes every other lint fail the step too.
+      - name: clippy, float arithmetic denied
+        working-directory: wai/wai-pack
+        run: cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Tests (release)
+        working-directory: wai/wai-pack
+        run: cargo test --release --locked
+
+      # A target that lost its tests (a module dropped, a cfg that compiles them out)
+      # would still report ok. Each target must list at least as many tests as it had
+      # when the floor was set; raise a floor when tests are added.
+      - name: Test-count floor per target
+        shell: bash
+        working-directory: wai/wai-pack
+        run: |
+          set -euo pipefail
+          fail=0
+          while read -r target floor; do
+            n=$(cargo test --release --locked $target -- --list 2>/dev/null | grep -c ': test$' || true)
+            echo "$target: $n tests (floor $floor)"
+            [ "$n" -ge "$floor" ] || { echo "::error::$target lists $n tests, under its floor of $floor"; fail=1; }
+          done <<'EOF'
+          --lib 17
+          --test=conformance 1
+          --test=scenecut 3
+          --test=source_alloc 1
+          EOF
+          exit $fail
+
+      - name: The corpus, recomputed by wai-pack
+        working-directory: wai/wai-pack
+        run: cargo run --release --locked --bin wai-pack -- conformance check ../pack-conformance
+
+  independent:
+    name: wai-pack · independent verifier (Python)
+    runs-on: linux
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      # Standard library only (tomllib, hashlib); BLAKE3 comes from the shared pure-Python
+      # module beside the claim corpus.
+      - name: pack_verify.py
+        working-directory: wai
+        shell: bash
+        run: python3 pack-conformance/pack_verify.py pack-conformance
+      - name: Install Rust 1.98.0
+        shell: bash
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
+          rustup toolchain install 1.98.0 --profile minimal
+          rustup default 1.98.0
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      # The source readers differentially: seeded Y4M and WAV mutations, every verdict of
+      # wai-pack (debug and release, both with overflow checks) equal to pack_verify.py's,
+      # and no reader panicking.
+      - name: source_diff.py, wai-pack against pack_verify.py
+        shell: bash
+        working-directory: wai/wai-pack
+        run: |
+          set -euo pipefail
+          cargo build --locked --bin wai-pack
+          cargo build --release --locked --bin wai-pack
+          for profile in debug release; do
+            python3 ../pack-conformance/source_diff.py "target/$profile/wai-pack" 1 3000
+          done
+      # The policy reader differentially: byte-level cases and seeded random policies,
+      # every verdict and digest of wai-pack equal to pack_verify.py's.
+      - name: policy_diff.py, wai-pack against pack_verify.py
+        shell: bash
+        working-directory: wai/wai-pack
+        run: python3 ../pack-conformance/policy_diff.py target/release/wai-pack 1 3000
+      # wai.pack.scenecut/1 differentially: the streaming segmenter against
+      # pack_verify.py's on-demand form on seeded random clips.
+      - name: segment_diff.py, wai-pack against pack_verify.py
+        shell: bash
+        working-directory: wai/wai-pack
+        run: python3 ../pack-conformance/segment_diff.py target/release/wai-pack 1 2000
+
+  licences:
+    name: wai-pack · dependency licences
+    runs-on: linux
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install Rust 1.98.0
+        shell: bash
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
+          rustup toolchain install 1.98.0 --profile minimal
+          rustup default 1.98.0
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - name: Install cargo-deny
+        shell: bash
+        run: cargo install --locked cargo-deny --version 0.19.8
+      - name: cargo deny check licenses
+        working-directory: wai/wai-pack
+        run: cargo deny --locked check licenses
+      # deny.toml's MPL-2.0 exception covers cbindgen as wai's build-time tool: it must
+      # reach wai-pack through no normal (linked) edge. The second query sees the build
+      # edge, so an empty answer from the first is an answer.
+      - name: cbindgen is a build dependency only
+        shell: bash
+        working-directory: wai/wai-pack
+        run: |
+          set -euo pipefail
+          err=$(mktemp)
+          if ! linked=$(cargo tree --locked -e normal --target all -i cbindgen 2>"$err"); then
+            grep -q "did not match any packages" "$err" || { cat "$err"; exit 1; }
+            linked=""
+          fi
+          if [ -n "$linked" ]; then
+            echo "::error::cbindgen is a linked dependency of wai-pack; its MPL-2.0 exception covers a build tool only"
+            echo "$linked"
+            exit 1
+          fi
+          cargo tree --locked -e normal,build --target all -i cbindgen | grep -q '^cbindgen v' || { echo "::error::cbindgen not found as wai's build dependency"; exit 1; }
+          echo "cbindgen is a build dependency only"
diff --git a/wai/CHANGELOG.md b/wai/CHANGELOG.md
index 9c4a4881d..d28ee9e05 100644
--- a/wai/CHANGELOG.md
+++ b/wai/CHANGELOG.md
@@ -6,6 +6,50 @@ wire format may change and such changes are recorded here.
 
 ## v0.4.0 — current
 
+### Packaging: a declared policy, its digest, and pieces cut at scene changes
+
+- **The extension** [packaging](extensions/packaging.md), first sections: a package is
+  made under one TOML policy, `wai.pack.policy/1` (§3), read in a fixed order with
+  every refusal named: value kinds a canonical JSON cannot carry exactly (floats,
+  dates, negatives, integers past `2^53 − 1`), then the schema, every default written
+  in, then the constraints across members (ladders and their refinement chains,
+  classes, rules, deadlines against layer lags). The effective policy's digest is
+  BLAKE3 over its RFC 8785 form, so two spellings of one policy have one digest.
+- **Pieces** (§4): `wai.pack.scenecut/1` cuts a video component at scene changes by
+  integer histogram distance, with a bounded lookahead whose return and revisit
+  clauses keep a short flash from cutting; a decision reads no frame past the
+  lookahead, so live and on-demand packing cut alike. Pieces are bounded by `min` and
+  `max`, aligned across components to the lead, and classified static, synthetic,
+  high-motion or natural. Y4M and WAV sources convert by stated integer rules.
+- **`wai-pack`**, the reference packager, as far as a plan (`wai-pack policy`,
+  `wai-pack plan`), with float arithmetic denied for the whole crate, and the corpus
+  [`pack-conformance/`](pack-conformance/) with a second implementation in Python.
+- **What a packager may emit** (§3.6): only capabilities SPEC §5 registers as payloads
+  with a pinned format, in a role each can play, and under `royalty_free_only` only
+  royalty-free ones; every refusal names the capability (`capability-unknown`,
+  `capability-not-payload`, `capability-candidate`, `capability-role`,
+  `license-unclassified`, `license-refused`).
+- **One integer video encoder** (§5.5): `int_video_enc` codes RGB8 frames as the
+  `WIV1` keyframe-0 payload SPEC §5 pins to `wai.video.int_motion`, with integer block
+  motion search (whole- or half-pel) over the decoder's own prediction, residuals
+  quantized in a closed loop, and one residual table for the clip; it states the SSE
+  of its reconstruction. `int_payload::encode_wiv1_zero_motion` is its zero-motion
+  case and writes the bytes it wrote before. The corpus holds its payloads for every
+  piece of every fixture, decoded independently to the same frames.
+- **`wai::jcs`**: the canonical JSON form moves out of `claim_receipt` into a module
+  of its own, compiled under every feature set, unchanged in behaviour.
+- **Choosing the step** (§5.6), specified and built ahead of the stage that writes
+  objects: the largest of `q_candidates` (read as a set) whose SSE per sample, in
+  thousandths, is at most `max_sse_px_milli`, else the smallest
+  (`wai_pack::encode::choose_q`), with goldens recomputed independently.
+- **Reading what a packager is given**: a policy is read from its bytes (UTF-8, no
+  byte-order mark, nesting at most 32 deep, `policy-toml` otherwise), ids are unique
+  across every kind, a cut window holds at least 3 scores, a WAV block alignment is
+  compared without wrapping, and no declared size sizes a buffer; the segmenter's state
+  is bounded by its lookahead and window. The encoder codes in two passes and states
+  what it holds (`int_video_enc::working_bytes`), and `rans::RansReverseEncoder` codes
+  values last-first into the same bytes.
+
 ### Staged delivery in the browser, a base writer, a trace and a bench
 
 - **A base is bounded before it is decoded, and its chain from the start**
diff --git a/wai/extensions/packaging.md b/wai/extensions/packaging.md
new file mode 100644
index 000000000..ec09f87fe
--- /dev/null
+++ b/wai/extensions/packaging.md
@@ -0,0 +1,349 @@
+# WAI Extension: Packaging
+
+> Status: Draft. A packager turns sources into WAI objects under a declared policy;
+> this extension fixes what a verifier recomputes. This revision defines the policy,
+> its digest and what it may ask a packager to emit (§3), how a source is cut into
+> pieces (§4), and the integer video payloads a packager writes (§5.5). Reference
+> impl: `wai-pack` — `policy`, `capcheck`, `source`, `scenecut`, `classify`; the
+> encoder `wai-rs` `int_video_enc`; the corpus
+> [`pack-conformance/`](../pack-conformance/). Keywords **MUST**, **MUST NOT**,
+> **SHOULD**, **MAY** are RFC 2119/8174.
+
+## 1. Scope
+
+A **packager** turns one or more sources into WAI objects, stage indexes, catalogs
+and a package receipt, under a declared **policy**. This extension fixes what a
+package contains and what a verifier recomputes. It fixes an encoder's choices only
+where it names them.
+
+## 2. Terms
+
+- **Component**: one media stream of a package (for example video, or audio).
+- **Piece**: a span of a component that decodes with no reference outside itself.
+- **Stage**: one object of a piece in staged order: the base is layer 0, refinement
+  *k* is layer *k* ([staged-delivery](staged-delivery.md)).
+- **Rung**: one entry of the policy's ladder: a capability a component's pieces are
+  coded in, with its role (base, refinement or floor) and parameters.
+- **Class**: a delivery profile the policy names.
+- **Moment**: a declared span of presentation time with tags.
+- **Floor**: a rendition in a standard codec, for sinks that lack the primary.
+- **Timebase** of a component: `num / den` units per second. For video one unit is
+  one frame; for audio, one sample.
+
+## 3. Policy
+
+**3.1** A package is made under exactly one policy, a TOML 1.0 document of schema
+`wai.pack.policy/1`, in UTF-8 with no byte-order mark.
+
+**3.2** The **effective policy** is the policy with every default written in (§3.3)
+and every override the packager applies (such as a command line forcing
+`royalty_free_only`). Its JSON form is §3.3's members, with an optional member that
+has no default omitted when absent, and arrays of tables in document order. Its
+**policy digest** is
+
+    BLAKE3("wai:pack-policy\x01" ‖ JCS(effective policy as JSON))
+
+where JCS is RFC 8785. Two spellings of one policy (member order, inline or standard
+tables, dotted keys, string or integer notation, comments, an omitted default or the
+default written out) therefore have one digest; the order of an array of tables is
+part of the policy.
+
+A packager **MUST** refuse with `policy-toml`, before anything else, a policy whose
+bytes are not UTF-8, that begins with a byte-order mark, that is not TOML 1.0 (an
+integer outside TOML's 64-bit range included), or that nests arrays and tables more
+than 32 deep: the document's own table is at depth 1, and an array or a table
+directly inside one at depth *k* is at depth *k* + 1. Then, before it reads any key, it
+**MUST** refuse one holding anywhere a float (`policy-float`), a date or time
+(`policy-datetime`), a negative integer (`policy-negative`), or an integer above
+`2^53 − 1` (`policy-integer-range`), visiting members in byte order of their keys and
+arrays in order.
+
+**3.3** *Schema.* Within each table, a key this section does not define is refused
+first (`policy-unknown-key`, the first in byte order), then each member in the order
+listed: a required member that is absent (`policy-missing-key`), a member of another
+type (`policy-type`), a value outside its range or vocabulary (`policy-value`). An
+absent table reads as empty.
+
+| Member | Type | Default | Range |
+|---|---|---|---|
+| `schema` | string | required | `wai.pack.policy/1` (else `policy-schema`) |
+| `asset_id` | string | required | 1 to 255 bytes |
+| `royalty_free_only` | boolean | `false` | |
+| `lead` | string | required | 1 to 255 bytes |
+| `component` | array of tables | required | |
+| `component.id` | string | required | 1 to 255 bytes |
+| `component.media` | string | required | `video`, `image`, `audio`, `world`, `feed`, `avatar`, `film` |
+| `component.source` | string | absent | |
+| `component.timebase` | table | required | members `num`, `den`, each 1 to `2^32 − 1`, required |
+| `segmentation.target_ms` | integer | 2000 | |
+| `segmentation.min_ms` | integer | 1000 | |
+| `segmentation.max_ms` | integer | 4000 | |
+| `segmentation.scene_cut` | string | `wai.pack.scenecut/1` | `wai.pack.scenecut/1` |
+| `segmentation.cut_abs_permille` | integer | 300 | 1 to 1000 |
+| `segmentation.cut_rel_permille` | integer | 3000 | 0 to 1000000 |
+| `segmentation.cut_window` | integer | 8 | 3 to 64 (a window of fewer than 3 scores never applies `cut_rel_permille`, §4.3) |
+| `segmentation.lookahead_frames` | integer | 6 | 0 to 64 |
+| `segmentation.closed` | boolean | `true` | |
+| `ladder` | array of tables | empty | |
+| `ladder.id` | string | required | 1 to 255 bytes |
+| `ladder.component` | string | required | 1 to 255 bytes |
+| `ladder.capability` | string | required | |
+| `ladder.role` | string | required | `base`, `refinement`, `floor` |
+| `ladder.refines` | string | absent | |
+| `ladder.params` | table | empty | by capability, below |
+| `floor.supplied_listing` | string | absent | 64 lowercase hexadecimal digits |
+| `floor.extra_keyframes` | boolean | `false` | |
+| `live.layer_lag_ms` | array of integers | one 0 per layer | §3.4 |
+| `class` | array of tables | empty | |
+| `class.id` | string | required | 1 to 255 bytes |
+| `class.max_layer` | integer | 0 | 0 to 255 |
+| `class.max_kbps` | integer | absent | 1 to `2^32 − 1` |
+| `class.floor_only` | boolean | `false` | |
+| `moment` | array of tables | empty | |
+| `moment.id` | string | required | 1 to 255 bytes |
+| `moment.from_ms`, `moment.to_ms` | integer | required | `to_ms` above `from_ms` |
+| `moment.tags` | array of strings | empty | |
+| `rule` | array of tables | empty | |
+| `rule.id` | string | required | 1 to 255 bytes |
+| `rule.when.piece_kind` | array of strings | absent | `natural`, `static`, `synthetic`, `motion_high` |
+| `rule.when.moment_tag` | array of strings | absent | |
+| `rule.then.ladder` | array of strings | absent | |
+| `rule.then.max_layer` | integer | absent | 0 to 255 |
+| `rule.then.deadline_ms` | integer | absent | 1 to `2^32 − 1` |
+| `defaults.deadline_ms` | integer | 1500 | 1 to `2^32 − 1` |
+| `classify.static_permille` | integer | 5 | 0 to 1000 |
+| `classify.static_mad_milli` | integer | 300 | |
+| `classify.synthetic_bins` | integer | 12 | 0 to 64 |
+| `classify.motion_high_milli` | integer | 9000 | |
+
+A rung's `params` are those of its capability; every other capability takes none.
+
+| Capability | Parameter | Default | Range |
+|---|---|---|---|
+| `wai.video.int_motion` | `block` | 16 | 4, 8, 16, 32 |
+| | `search` | 7 | 0 to 32 |
+| | `mv_precision` | 2 | 1, 2 |
+| | `q_candidates` | `[8]` | a non-empty array, each 1 to 255 |
+| | `max_sse_px_milli` | 0 | |
+| `wai.video.int_refine` | `q` | required | 1 to 255 |
+| `wai.video.av1`, `wai.video.av1.lossless` | `source` | `supplied` | `supplied`, `encode` |
+| `wai.audio.int_refine` | `to_rate`, `q` | required | 1 to 384000; 1 to 65535 |
+| `wai.audio.flac` | `source` | `encode` | `encode`, `supplied` |
+
+`wai.audio.int_layered` is reserved for the layered integer audio base: it is not
+registered yet, and its parameters are defined when it is.
+
+**3.4** *Constraints.* A policy that passes §3.3 is checked in this order, and the
+first that fails is the refusal:
+
+1. 1 to 8 components (`policy-too-many-components`); at most 64 rungs
+   (`policy-too-many-rungs`), 32 classes (`policy-too-many-classes`), 32 rules
+   (`policy-too-many-rules`) and 32 moments (`policy-too-many-moments`).
+2. Ids unique among components, rungs, classes, moments and rules taken together, so
+   a reference never names two things (`policy-duplicate-id`).
+3. `lead` names a component (`policy-lead`).
+4. `segmentation.closed` is true: every piece is closed, §4.1 (`policy-open-gop`).
+5. `1 ≤ min_ms ≤ target_ms ≤ max_ms` (`policy-piece-bounds`).
+6. Every rung names a component (`policy-ladder-component`).
+7. A rung carries `refines` exactly when its role is `refinement`
+   (`policy-refines-role`); `refines` names a rung (`policy-dangling-refines`); no
+   chain of `refines` returns to a rung it passed (`policy-refines-cycle`); every
+   chain stays in its component and ends at a base (`policy-refines-base`); no rung is
+   refined twice (`policy-refines-branch`).
+8. Every component has a base rung (`policy-no-base`).
+9. A rung's **layer** is 0 for a base or a floor, and one more than the rung it
+   refines for a refinement; the policy has one more layer than its highest rung
+   layer. No class's and no rule's `max_layer` exceeds the highest
+   (`policy-class-layer`).
+10. A rule's `then.ladder` names known rungs, all of one component, at least one of
+    them a base (`policy-rule-ladder`).
+11. `live.layer_lag_ms` has one entry per layer, the first 0, the entries
+    non-decreasing (`policy-layer-lag`).
+12. The deadline values (`defaults.deadline_ms` and every rule's `then.deadline_ms`)
+    number at most 4 (`policy-too-many-deadlines`), and for every refinement layer
+    *k* and every deadline value *d*, `d − layer_lag_ms[k] ≥ 1`
+    (`policy-deadline-unreachable`).
+
+Rules fold in document order: every matching rule applies, and a later `then` member
+overrides an earlier one.
+
+**3.5** A package receipt carries the policy digest. A verifier holding the effective
+policy recomputes it; it cannot check that the packager followed the policy, except
+by packing again.
+
+**3.6** *What a packager may emit.* A packager **MUST** refuse a policy with a rung it
+may not emit, reading SPEC §5's registry, never the policy. For each rung in ladder
+order the first rule that holds is its refusal, and a policy's refusal is its first
+rung's:
+
+1. SPEC §5 does not register the capability: `capability-unknown:<cap>`.
+2. SPEC §5 registers it as a record or a derivation operation, which names no payload
+   format: `capability-not-payload:<cap>`.
+3. It is a candidate, whose payload format no revision has pinned (SPEC §5,
+   *Candidate capabilities*): `capability-candidate:<cap>`.
+4. A base or a floor whose capability is not standalone media, or a refinement whose
+   capability is not refinement-only: `capability-role:<cap>`.
+5. Under `royalty_free_only`, a capability the registry gives no licence class:
+   `license-unclassified:<cap>`; one of any class other than royalty-free:
+   `license-refused:<cap>:<label>`, with the class's SPEC §5 label. The class is the
+   registry's, "licensed royalty-free by its standards body"; it is not an opinion on
+   freedom to operate, and a package states nothing about patents.
+
+## 4. Pieces
+
+**4.1** Every piece **MUST** be closed: its first frame, sample or tick is coded with
+no reference outside the piece, and no later object of the package references into
+it.
+
+**4.2** Piece boundaries are a pure function of the source frames and the effective
+policy. Where the policy names `wai.pack.scenecut/1`, the boundaries **MUST** be those
+§4.3 computes. The list of piece starts, in timebase units, is the **plan**, and its
+digest is
+
+    BLAKE3("wai:pack-plan\x01" ‖ u64 LE n ‖ n × u64 LE start)
+
+**4.3** `wai.pack.scenecut/1`. All arithmetic is integer; `>>` is a shift and every
+division rounds down. For each RGB8 frame *f* of `w × h` pixels:
+
+1. Luma `Y = (77R + 150G + 29B + 128) >> 8`, and the histogram `H_f` of 64 bins,
+   `Y >> 2`.
+2. `D(a, b) = (Σ_i |H_a[i] − H_b[i]|) · 1000 / (2wh)`: the share of pixels, in
+   thousandths, whose bin differs. The score of frame *f* ≥ 1 is `s_f = D(f, f − 1)`.
+3. The current piece starts at frame *p*, and `len = f − p`. Its window `W_f` is the
+   scores `s_g` for `p < g < f`, the last `cut_window` of them; `m_f` is their lower
+   median (sorted ascending, the element at index `(|W_f| − 1) / 2`).
+4. **Hard cut** at *f*: `len ≥ min`, `s_f ≥ cut_abs`, and either `|W_f| < 3` or
+   `s_f · 1000 ≥ cut_rel · m_f`.
+5. **Soft cut** at *f*: `len ≥ target` and `2 · s_f ≥ cut_abs`.
+6. **Return clause.** A cut at *f* is rejected when `D(f + k, f − 1) < cut_abs` for
+   some *k* in `1..=min(L, last − f)`: the content came back within *L* frames, so *f*
+   starts a flash.
+7. **Revisit clause.** A cut at *f* is rejected when `D(f, f − 1 − j) < cut_abs` for
+   some *j* in `1..=min(L, f − 1)`: *f* returns to content seen within *L* frames, so it
+   ends a flash. Frames before *p* count.
+8. A hard or soft cut that clauses 6 and 7 do not reject starts a piece at *f*.
+   Otherwise, when `len ≥ max`, a piece starts at *f*.
+
+Frame 0 starts the first piece. *L* is `lookahead_frames`, *last* the index of the
+source's last frame, `cut_abs` and `cut_rel` the policy's permille values, and `min`,
+`target` and `max` the policy's milliseconds on the component's timebase (§4.4). A
+decision about frame *f* reads no frame after `f + L`, so a live segmenter decides it
+once frame `f + L` has arrived, and a live and an on-demand segmenter with equal *L*
+produce equal boundaries. A piece that follows a cut is flagged a scene cut; one
+started at `max`, forced.
+
+**4.4** A piece's duration is an integer number of timebase units, and lies between
+`min` and `max` except the last piece of a source, which may be shorter than `min`.
+A duration in milliseconds converts to timebase units as
+`floor(ms · num / (1000 · den))`; a result of 0 becomes 1, and one above `2^64 − 1`
+becomes `2^64 − 1`.
+
+**4.5** *Components.* Every component of a package shares one presentation timeline
+that starts at 0. The policy names one **lead** component; every other component cuts
+its pieces at the lead's boundary instants, each converted to its own timebase as
+`floor(start_lead · num_c · den_lead / (den_c · num_lead))` (above `2^64 − 1`,
+`2^64 − 1`). A sink presents piece *p* of every component from that start.
+
+**4.6** *Classification.* Each video piece has a kind, which rules match
+(`rule.when.piece_kind`). Over the piece's consecutive frame pairs, with `Y` the luma
+of §4.3:
+
+- `mad_milli = Σ |Y_f − Y_{f−1}| · 1000 / (wh · (n − 1))`, and 0 when the piece has
+  one frame (*n* = 1);
+- `changed_permille` = the pixels whose luma differs, `· 1000 / (wh · (n − 1))`, and 0
+  when *n* = 1;
+- `occupancy` = the non-empty histogram bins of the piece's first frame.
+
+The kind is the first that holds of: **static** (`mad_milli ≤ static_mad_milli` and
+`changed_permille ≤ static_permille`); **synthetic** (`occupancy ≤ synthetic_bins`);
+**motion_high** (`mad_milli ≥ motion_high_milli`); **natural**.
+
+**4.7** *Sources.*
+
+- **Y4M**: 8-bit 4:2:0 (`C420jpeg`, `C420paldv`, `C420mpeg2`, `C420`, or no `C`
+  parameter) or 4:4:4 (`C444`), progressive. A header that is not `YUV4MPEG2` with a
+  width and a height is refused `y4m-header`; an interlaced stream or frame,
+  `y4m-interlaced`; another colour space, `y4m-colorspace`; a `FRAME` line that sets
+  the width, height or colour space, `y4m-size-change`; a frame that ends early or a
+  line that is not `FRAME`, `y4m-truncated`. Each pixel converts to RGB8 by BT.709
+  limited range, with 4:2:0 chroma taken at `(y >> 1, x >> 1)`:
+  - `R = clip((298(Y−16) + 459(Cr−128) + 128) >> 8)`
+  - `G = clip((298(Y−16) − 55(Cb−128) − 136(Cr−128) + 128) >> 8)`
+  - `B = clip((298(Y−16) + 541(Cb−128) + 128) >> 8)`
+
+  where `>>` is the arithmetic shift and `clip` clamps to 0..=255.
+- **WAV**: RIFF/WAVE with a PCM `fmt ` chunk (format tag 1) of 16-bit samples, block
+  alignment `2 · channels`. Anything else is refused `wav-format`; a chunk that ends
+  early, `wav-truncated`.
+
+## 5. Objects
+
+**5.1–5.4** Reserved: an object's identity, its independence of its position in a
+package, its name, and `refines` on a refinement object are specified with the
+packager stage that writes objects.
+
+**5.5** *Integer video.* An object of `wai.video.int_motion` carries a `WIV1` payload
+with keyframe 0, as SPEC §5 pins it ([integer-payloads](integer-payloads.md) §3); this
+extension defines no other layout for it, and its decode is that section's. The
+reference packager does not write objects yet; when it does, it will write these with
+one encoder (`wai-rs` `int_video_enc`) at the step §5.6 chooses. The encoder's choices
+make a payload a function of the source frames, the rung's `block`, `search` and
+`mv_precision` (§3.3), and the step `q`:
+
+- **Motion search** (frames 1 on): blocks in raster order; for each, every vector
+  `(dy, dx)` with both components in `−R..=R`, `R = search · mv_precision` (at most
+  127), `dy` outer and `dx` inner, each ascending. Its cost is the sum, over the
+  block's pixels inside the frame and the three channels, of `|source − prediction|`,
+  where the prediction is the decode's (integer-payloads §3) from the previous frame
+  as decoded. The least cost wins; a tie goes to the smaller `|dy| + |dx|`, then to the
+  earlier vector.
+- **Residual**: each frame, each pixel in raster order, each of R, G, B: the
+  prediction (128 for frame 0) is subtracted from the source and divided by `q`,
+  rounding halves away from zero; the frame as decoded is `clamp(prediction + r·q, 0,
+  255)`, and the next frame predicts from it.
+- **Table**: one residual table for the clip, with `offset` the least residual, `top`
+  the greatest, and `h_i` the count of residual `offset + i`, for
+  `n = min(top − offset + 1, 4095)` symbols. With `R = 2^16 − n − 1` and `H = Σ h_i`, symbol *i* gets frequency
+  `1 + ⌊R·h_i / H⌋`; the `R − Σ⌊R·h_i / H⌋` left over go one each to the symbols with
+  the largest `R·h_i mod H`, the lower symbol first on a tie; the escape gets 1. A
+  residual past the table's span is coded through the bypass escape
+  (integer-payloads §2).
+- A clip of one frame is written with `block` 1 and `mv_precision` 1, as the format
+  requires.
+
+The encoder also states the SSE of its reconstruction against the source: the sum of
+squared differences over every sample. It codes in two passes (the first finds the
+vectors, the reconstruction and the residuals' counts; the second derives each
+residual again and codes it last first), so beyond its input it holds the
+reconstruction, the vectors, the stream and the residual table: at most
+`n·h·w·3 + 24n + 12·v + 3·(2·n·h·w·3 + 16) + T` bytes for `n` frames and `v` motion
+vectors (`int_video_enc::working_bytes`). `T` is the widest table's, of `S = 2·255 + 1`
+symbols: its fit, `16·(S + 1) + 2·8·S + 4·(S + 2)` bytes (a frequency for each symbol
+and the escape, an index for each symbol and the sort's scratch, the table), and the
+table's three copies and the payload's header, `3·4·(S + 2) + 64`. For a clip past the
+format's caps, which the encoder refuses before it allocates, the figure is `2^64 − 1`.
+
+**5.6** *Choosing the step.* For each piece, the base encode of a `wai.video.int_motion`
+rung chooses its step from `q_candidates`, read as a set (a value listed twice is one
+candidate). It encodes the piece at each candidate, from the largest down, and chooses
+the first whose `floor(SSE · 1000 / (3·w·h·n)) ≤ max_sse_px_milli`, where `SSE` is the
+encoder's (§5.5) and *n* the piece's frames: the largest step that meets the bound, so
+candidates that meet it alike are decided by their step. Where no candidate meets it,
+it chooses the smallest. The function the reference packager's base encode calls is
+`wai_pack::encode::choose_q`.
+
+## 6–11. Stage index, floor, classes and delivery, receipt
+
+Reserved. This revision does not yet define a package's stage index, its floor, its
+class plans and catalogs, its receipt, royalty-free packaging of a whole package or
+re-pack equivalence; they are specified with the packager stages that write them.
+
+## 12. Reasons
+
+| Reason | Where |
+|---|---|
+| `policy-toml` (not UTF-8, a byte-order mark, not TOML 1.0, nesting past 32), `policy-float`, `policy-datetime`, `policy-negative`, `policy-integer-range` | §3.2 |
+| `policy-unknown-key`, `policy-missing-key`, `policy-type`, `policy-value`, `policy-schema` | §3.3 |
+| `policy-too-many-components`, `policy-too-many-rungs`, `policy-too-many-classes`, `policy-too-many-rules`, `policy-too-many-moments`, `policy-duplicate-id`, `policy-lead`, `policy-open-gop`, `policy-piece-bounds`, `policy-ladder-component`, `policy-refines-role`, `policy-dangling-refines`, `policy-refines-cycle`, `policy-refines-base`, `policy-refines-branch`, `policy-no-base`, `policy-class-layer`, `policy-rule-ladder`, `policy-layer-lag`, `policy-too-many-deadlines`, `policy-deadline-unreachable` | §3.4 |
+| `capability-unknown`, `capability-not-payload`, `capability-candidate`, `capability-role`, `license-unclassified`, `license-refused`, each naming the capability (and the licence label) | §3.6 |
+| `y4m-header`, `y4m-interlaced`, `y4m-colorspace`, `y4m-size-change`, `y4m-truncated`, `wav-format`, `wav-truncated` | §4.7 |
diff --git a/wai/pack-conformance/.gitattributes b/wai/pack-conformance/.gitattributes
new file mode 100644
index 000000000..eff1df73a
--- /dev/null
+++ b/wai/pack-conformance/.gitattributes
@@ -0,0 +1,2 @@
+# Hashed files: a line-ending conversion on checkout would change every digest.
+* -text
diff --git a/wai/pack-conformance/README.md b/wai/pack-conformance/README.md
new file mode 100644
index 000000000..663b82419
--- /dev/null
+++ b/wai/pack-conformance/README.md
@@ -0,0 +1,96 @@
+# pack-conformance — the packaging corpus
+
+Vectors for [`extensions/packaging.md`](../extensions/packaging.md): the policy, its
+digest and what it may ask a packager to emit (§3), how a source is cut into pieces
+(§4), and the integer video payloads a packager writes (§5.5).
+
+- `policy/` — policies a packager accepts (every rung one it may emit, §3.6), and
+  `expected.json`: each policy's effective canonical JSON and
+  digest (`example.toml` also with `royalty_free_only` overridden to false), and the
+  pairs `eq-<name>-a.toml` and `eq-<name>-b.toml`, two spellings of one policy that
+  must have one digest: every default omitted or written out; standard or inline
+  tables, dotted keys, member order, string escapes, integer notation and comments.
+- `refusals/` — `policy/*.toml`, one fault each (the byte layer's among them: a
+  byte-order mark, bytes that are not UTF-8, an integer at 2^63, nesting to depth 33 and
+  80), and `source/*` (Y4M and WAV), and `expected.json`: each one's reason (§12). Every
+  file is read as bytes. A policy's reason is a packager's: the
+  policy's own (§3.2–§3.4), or its first rung's capability refusal (§3.6), read from
+  SPEC §5's registry. The source files are written by the generator.
+- `conversions.json` and `conversions/` — milliseconds to a timebase (§4.4), a lead
+  start to a component's timebase (§4.5), and Y4M to RGB8 (§4.7) by the SHA-256 of each
+  frame, for 4:2:0 with odd dimensions and for 4:4:4. The Y4M files are written by the
+  generator.
+- `scenecut/` — `policy.toml` and `expected.json`: for each fixture, its SHA-256, the
+  score of every frame, every piece (start, frames, flags, kind, and the statistics the
+  kind is read from) and the plan digest (§4.2–§4.6).
+- `encode/` — `WIV1` payloads of the integer video encoder (§5.5; `wai-rs`
+  `int_video_enc`), written by the generator, and `expected.json`: one for every piece
+  of every fixture, coding the piece's first 12 frames, under a whole-pel and a
+  half-pel parameter set; for each, the encoder's parameters, the payload's BLAKE3,
+  the SSE of its reconstruction against the source, and the SHA-256 of every decoded
+  frame. Identical content gives identical bytes: `kinds-01`'s pieces 4 and 5 both
+  start inside one static shot, so their first frames, and their payloads, are the
+  same.
+
+- `qchoice/expected.json` — the step the base encode chooses (§5.6) for every piece of
+  every fixture (its first 12 frames), under two bounds: each candidate's SSE and SSE
+  per sample in thousandths, the step chosen, and the chosen payload's BLAKE3.
+
+The fixtures are not committed. `wai-pack fixture gen <name>` writes each from its
+definition (`wai-pack/src/fixture.rs`), every byte an integer function of the frame
+index and the pixel position, and the corpus pins its SHA-256:
+
+- `cuts-01` — hard cuts; a flash exactly as long as the lookahead, which is not cut;
+  a fade, which is not cut; and two shots cut against each other, each return a cut.
+- `kinds-01` — one shot of each kind, then a static shot longer than the longest
+  piece, cut where `max` forces it.
+
+Files are compared as bytes; `.gitattributes` turns off line-ending conversion.
+
+**Generation.**
+
+    cd wai/wai-pack
+    cargo run --release -- conformance regen ../pack-conformance
+
+**Verifiers.**
+
+- `wai-pack conformance check ../pack-conformance` recomputes every expected file and
+  every generated input and requires them to equal the committed ones, requires the
+  digests of each equal pair to be equal, decodes every encode payload through
+  `decode_int` to the encoder's reconstruction and recomputes its SSE. `cargo test`
+  runs the same check, with the scene cuts of each fixture stated as tests
+  (`tests/scenecut.rs`).
+- `pack_verify.py`, Python standard library only (TOML through `tomllib`, so 3.11 or
+  later) and sharing no code with wai-pack, written from the extension: its own policy
+  schema, constraints, canonical JSON and digest; its own Y4M and WAV readers; the
+  fixtures regenerated from their definition; `wai.pack.scenecut/1` in its on-demand
+  form, every frame known, against the vectors of the streaming segmenter; the
+  capability rules from the registry's published export
+  (`../registry/capabilities.json`); and every encode payload decoded to its frames'
+  SHA-256, with its SSE recomputed from the regenerated source. BLAKE3 comes from
+  `../claim-conformance/_blake3.py`, and the `WIV1` parser and decoder from
+  `../int-payload-conformance/int_payload_verify.py`.
+
+      python3 pack-conformance/pack_verify.py pack-conformance
+
+- `policy_diff.py` runs the policy reader differentially: byte-level cases (a
+  byte-order mark, bytes that are not UTF-8, integers past 2^53 and 2^63, nesting at
+  and past the cap, control characters, line endings) and seeded random policies with
+  faults in every table, each one's verdict and digest from `wai-pack policy-verdict`
+  equal to `pack_verify.py`'s.
+
+      python3 pack-conformance/policy_diff.py <wai-pack binary> 1 3000
+
+- `segment_diff.py` runs `wai.pack.scenecut/1` differentially: seeded random clips
+  under random parameters, every piece and score of the streaming segmenter
+  (`wai-pack segment-json`) equal to `pack_verify.py`'s on-demand form, and every piece
+  within `min` and `max`.
+
+      python3 pack-conformance/segment_diff.py <wai-pack binary> 1 2000
+
+- `source_diff.py` runs the source readers differentially: seeded Y4M and WAV
+  mutations (dimensions and channel counts at and past their range, every format
+  field, truncations, single-byte changes), each file's verdict from
+  `wai-pack source-verdict` equal to `pack_verify.py`'s, and no reader panicking.
+
+      python3 pack-conformance/source_diff.py <wai-pack binary> 1 3000
diff --git a/wai/pack-conformance/conversions.json b/wai/pack-conformance/conversions.json
new file mode 100644
index 000000000..0bc797fdd
--- /dev/null
+++ b/wai/pack-conformance/conversions.json
@@ -0,0 +1,149 @@
+{
+  "ms_to_units": [
+    {
+      "ms": 1000,
+      "num": 25,
+      "den": 1,
+      "units": 25
+    },
+    {
+      "ms": 40,
+      "num": 25,
+      "den": 1,
+      "units": 1
+    },
+    {
+      "ms": 39,
+      "num": 25,
+      "den": 1,
+      "units": 1
+    },
+    {
+      "ms": 0,
+      "num": 25,
+      "den": 1,
+      "units": 1
+    },
+    {
+      "ms": 1000,
+      "num": 30000,
+      "den": 1001,
+      "units": 29
+    },
+    {
+      "ms": 2000,
+      "num": 30000,
+      "den": 1001,
+      "units": 59
+    },
+    {
+      "ms": 1,
+      "num": 48000,
+      "den": 1,
+      "units": 48
+    },
+    {
+      "ms": 4000,
+      "num": 90000,
+      "den": 1,
+      "units": 360000
+    },
+    {
+      "ms": 9007199254740991,
+      "num": 4294967295,
+      "den": 1,
+      "units": 18446744073709551615
+    }
+  ],
+  "align": [
+    {
+      "start": 50,
+      "lead": [
+        25,
+        1
+      ],
+      "component": [
+        48000,
+        1
+      ],
+      "units": 96000
+    },
+    {
+      "start": 3,
+      "lead": [
+        25,
+        1
+      ],
+      "component": [
+        30000,
+        1001
+      ],
+      "units": 3
+    },
+    {
+      "start": 29,
+      "lead": [
+        30000,
+        1001
+      ],
+      "component": [
+        25,
+        1
+      ],
+      "units": 24
+    },
+    {
+      "start": 48000,
+      "lead": [
+        48000,
+        1
+      ],
+      "component": [
+        25,
+        1
+      ],
+      "units": 25
+    },
+    {
+      "start": 47999,
+      "lead": [
+        48000,
+        1
+      ],
+      "component": [
+        25,
+        1
+      ],
+      "units": 24
+    },
+    {
+      "start": 18446744073709551615,
+      "lead": [
+        1,
+        4294967295
+      ],
+      "component": [
+        4294967295,
+        1
+      ],
+      "units": 18446744073709551615
+    }
+  ],
+  "y4m_rgb": [
+    {
+      "file": "conversions/bt709-420.y4m",
+      "rgb_sha256": [
+        "c1d16f98e2ae61ba8cca146cb1856b462e5c7641590ad651fe727658377253a8",
+        "badec76a4621b64df3cf803df18c58e08d70ced9cf716dc6b7b7fb7fd278e74d",
+        "6d5c08c958a6cbe09257dddfa9976f9c0bdd9943995ed886b1334d4389586629"
+      ]
+    },
+    {
+      "file": "conversions/bt709-444.y4m",
+      "rgb_sha256": [
+        "d2d8ef122db155d44015cf30ff760bc2744cecedba19c6f0388f09dbb207acfd",
+        "ede0a218313910474b8bfd8e7d1fd5743328b800822516c760214e6fb55a711b"
+      ]
+    }
+  ]
+}
diff --git a/wai/pack-conformance/conversions/bt709-420.y4m b/wai/pack-conformance/conversions/bt709-420.y4m
new file mode 100644
index 000000000..901fddd6d
Binary files /dev/null and b/wai/pack-conformance/conversions/bt709-420.y4m differ
diff --git a/wai/pack-conformance/conversions/bt709-444.y4m b/wai/pack-conformance/conversions/bt709-444.y4m
new file mode 100644
index 000000000..7472bc929
Binary files /dev/null and b/wai/pack-conformance/conversions/bt709-444.y4m differ
diff --git a/wai/pack-conformance/encode/cuts-01-p0-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p0-a.wiv1
new file mode 100644
index 000000000..17f5cb1f0
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p0-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p0-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p0-b.wiv1
new file mode 100644
index 000000000..136448b36
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p0-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p1-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p1-a.wiv1
new file mode 100644
index 000000000..6d3868f4e
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p1-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p1-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p1-b.wiv1
new file mode 100644
index 000000000..d4bb35246
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p1-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p2-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p2-a.wiv1
new file mode 100644
index 000000000..065ec7132
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p2-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p2-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p2-b.wiv1
new file mode 100644
index 000000000..ab5d14c5a
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p2-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p3-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p3-a.wiv1
new file mode 100644
index 000000000..cdd1c6207
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p3-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p3-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p3-b.wiv1
new file mode 100644
index 000000000..ab1487f6a
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p3-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p4-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p4-a.wiv1
new file mode 100644
index 000000000..443067a35
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p4-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p4-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p4-b.wiv1
new file mode 100644
index 000000000..8f8451cbe
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p4-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p5-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p5-a.wiv1
new file mode 100644
index 000000000..8b099ab23
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p5-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p5-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p5-b.wiv1
new file mode 100644
index 000000000..8b2102d61
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p5-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p6-a.wiv1 b/wai/pack-conformance/encode/cuts-01-p6-a.wiv1
new file mode 100644
index 000000000..cc925b5a5
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p6-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/cuts-01-p6-b.wiv1 b/wai/pack-conformance/encode/cuts-01-p6-b.wiv1
new file mode 100644
index 000000000..c874db286
Binary files /dev/null and b/wai/pack-conformance/encode/cuts-01-p6-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/expected.json b/wai/pack-conformance/encode/expected.json
new file mode 100644
index 000000000..565a53c4d
--- /dev/null
+++ b/wai/pack-conformance/encode/expected.json
@@ -0,0 +1,733 @@
+{
+  "policy": "scenecut/policy.toml",
+  "vectors": [
+    {
+      "file": "cuts-01-p0-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 0,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "82c184824929e7d9d5991dfc687afa1589c0b3481771cf9828b509cede8316ab",
+      "sse": 65860,
+      "frame_sha256": [
+        "3cff6258acac16c58a4ad3707c76d05262c9a3c52b425e95b6f0fc5f5a67a03b",
+        "775e7a28d505fdd2f71b380ca2fb1053b115607b1f042941f8a0e7efcfacbf5f",
+        "ba2a788bae4a580fb412775763d1f0c4ec1c78f73345f27dbcbb7fd63a8be2cb",
+        "09fc77f8b2a7d0d529440636afea3130fdaea4a40f3a1619b3a25cb252cb995a",
+        "99853f11c57fa1cb916b50a3907f2f26e9b1022813c0c10e064c1c6cc7696dbf",
+        "b8881b58cba208757ee26f612dca8494f0b062c656418923733c26cf7b215adf",
+        "9984f48f5741d491691494ae417b58cd115f87bc3749d1f8cdfab5ab5aa56982",
+        "3b7f3aca06bfa97ad0d6b8e47b989206367a2b5b7c695e1ba6411f84ed37a020",
+        "8f98003b3bc9d33133f2b95565ad322b40595caf535c87eea937800fa1a3c71a",
+        "82d39aaa6022f22b11eeaf40106114d6c9585fb6c723f3b40b7cbd8984cd2565",
+        "9cc5a18e35c7474625f0f5654366d5b41481d06c81c0ad87f7fba9f4467fc050",
+        "88d140509801b044a5a951f766fb89141ce8619daf622743f7318e34567d6599"
+      ]
+    },
+    {
+      "file": "cuts-01-p0-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 0,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "a835e73bb923b83f4ed311fe382f3609032aec574b96463f40251dbc574d7aba",
+      "sse": 95473,
+      "frame_sha256": [
+        "d61975126ffe62cd0c8179814d385bd21d1a488c54442a3f7f6624f96da91585",
+        "6c8319fe6d1da2d1a4d4215acfca5abafc74f19208f9dccb351fbbdebf699ae9",
+        "6bc6e5d7ee2f32017c118494c4fbe099affe0395d43478ef1f4e169f3702c556",
+        "16d98f4b5c7eb132ed1009be567410840ac030f5a3941c180c9ee975f352f95d",
+        "4a9b19772544b266175415f82340b87ca50cf3b09d3afb71ce5ee4a7a97f0f6a",
+        "d9720d1ba4f03a92320c8e832dd191e4d910c158d4047071ad53d0e0950851b3",
+        "ea96e194c26247b5e77bdcc51c5aacc65ac353e29399a177f6bf6befb3ccb16f",
+        "bcaa9f33e72c3275c15add4dc028b6942454eefab7d1e2af03e8160d11270ad7",
+        "a28f0b51bfc5de0a41de9ead89b46eba5435a930cd364cf9fa5e5803ec45efe0",
+        "38d957495ad5717f819b82f6ecd75ad3c805dbd2c5b9c773a52049902330cb61",
+        "cc81641d12b00fe39babae6ac6a23b2da1f2ff30204c86e9ba486b7f396b4d14",
+        "18833421f00fc69cc3520fc85a90ba0991aab8f1716d13ffc0a8da9fd5ecf520"
+      ]
+    },
+    {
+      "file": "cuts-01-p1-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 60,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "a388b8ed1dc3b532aad8bd329e0e546460353eb72220b9113aee1b34c21cc3e1",
+      "sse": 61086,
+      "frame_sha256": [
+        "0ddfa6419692edfe727cce0a774ddfa90516ce8cae1ccc26d3f65512e82cc7c3",
+        "7360b6caab29d4fbaa2cf125d876f63a677e43fdc802de511f5a7073f0adbc5f",
+        "a503089b91621337b021d029200966d04dafc9cb80959d2e9e96f40a473aff17",
+        "d4c39a7b272c5f56bb0abe79cf9b0b68b75f4363926e90d5fa4a0951eb060552",
+        "42215a6423d562c2be3ede40172dfd67ab9859bc71f5af489fd5728a06b936ca",
+        "63293c12d046216725e6214b7b4e7251144bdf37371356d7db8e89746ebdecbf",
+        "756921c96f341be33166e35a26afa2f2b7e388e860f8611c08d2cd0e3676af60",
+        "4f43844c3c4fb1d67277bbcd4469c5c5455949a3fde317c40741871243bb5e2e",
+        "5370d5765038a88ce3114cf8639f4c30cc9a7403f7c6dfd06b1d299b0b58590d",
+        "3b46a945899e664cf5a05aadb97f07430bb9e40041e03c017b979b41545146e0",
+        "b5a53d33f86112860ee152276be85036b4e2d0cf43d5b171b1b1f84a821f3c65",
+        "9437ca4d407f9149a663613ca81dcc69e0e5d1257b1d6765642875ebfe1b5c95"
+      ]
+    },
+    {
+      "file": "cuts-01-p1-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 60,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "55190c77200c5a97951880b1848ed80ace658d7733224217cb7aef73d360bc23",
+      "sse": 226928,
+      "frame_sha256": [
+        "489d38c594d1d24925b3c6dd4aee6c01dae46cbae982e6ff4c33e7836b1ed916",
+        "2540eec6032a5a00ce4e13ce27799c88776c6a58b13b37cbf417cc8ebda7d2cd",
+        "e265c616ec2287e9ccfecb5eb2e2788d6e4607980479d6716a6af0cc731545ca",
+        "12f70afde687a334f57a03267fc9e86c9d025821ee865fdd599be6bce06ad23e",
+        "a7b9bc46d5678197831564b5359c4582dd7be355d0ee0baf29909ba3f8524f04",
+        "d80bb3788a5ec8269a6a7bd4abf310d4001213189102f8037598b9912e9e9217",
+        "5c82b24ac3a2d1d152ad1d778909068a6c929f73fbcf2b6e00c68ca00659e9fb",
+        "f31a3d7418ab38a1d6e6e85717200927939b446f29ccc8b35d198fbcd56c0c18",
+        "bab59398765097e1052a15422cf75e58792dab694f91f4fe8cd0fb9c86f09a6a",
+        "ea631566b0a902ded4de7f61a686a03ca9a002869fc28d1b97f04ea9affe878f",
+        "4e65728d70e58830cd22aecca93ee1d6a0238fcad2c1657cff367e7e53bb7726",
+        "181baedde018d87ec28c85e4564abb90d77a405f02b9fe8c06c8fef5cbf1b104"
+      ]
+    },
+    {
+      "file": "cuts-01-p2-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 140,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "f9461140ea940cb76ba37222527f6ce53b44f8b3eb9f5b7fd2bdf7bdccb61368",
+      "sse": 66866,
+      "frame_sha256": [
+        "bfd8abd42fc38591b062c9e3c9bd46ff6f2e176dde35372f4f280a706d2e1428",
+        "5b918970bbdec28e71c1edf1c5219bc3d1c85078963a22b8b0540620957d8c4b",
+        "dee2a4ca2d1e1c7387d08878f5c0fd11d70122fd0637c06b017ff57e36337125",
+        "aed26a7cd9788ac3ee339011c81ccec79370e3f15742692439a6e9d8a5ece972",
+        "be3a20ba6b953befa4d7dd1c5eb87304afebaaa358176c8287c249e78d28c4cb",
+        "c74c42cd26c8e20ee024636a24e58df134742ec51a80bdbbbf8591990ab8af73",
+        "646f9a83b42ddfd0c8e881ad98fba922fc6bb24908c5a49fe3afae9339e7a039",
+        "65c581a720835f8e9bc40d0bbf6a52eb93bbcd21dafb73cb533941b30a6ca7ad",
+        "7fa69bfa5943cb86bb19818cad136ca88572be84ec614146292978df50b98f0f",
+        "309bc39bd6c26991610db4262d6f3e3e3c793f927a15a0452b6d4d633952df62",
+        "3e1ca46691a1ce9d6901754aea3e8c6d8dfd4e01f341d71abd255431f7cfaf74",
+        "4b3af663ded21072b293bb0cead7b9dc7588ba6d139ee66ff088764b139822dd"
+      ]
+    },
+    {
+      "file": "cuts-01-p2-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 140,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "57f1d8509277334917b1d259cd203f36c809035e48f7ef3ee387ad3c1a1c9558",
+      "sse": 200595,
+      "frame_sha256": [
+        "4b2c07361dc312814ba40429509702347834b3c1f268acd7c15fb3a12a91325c",
+        "68acbe75e013f2fb53f6784ffff8a87243bd7bc338d9ed40fe5535d9a56d0163",
+        "0e527ffd2e12e0d97f9c6c6c8b1dcea80ebd769b923bf4f5f0e84747aec25e62",
+        "950bc59e3a2d7904fab1c73f96707c32aa41452b52cd2fd974e0a358ac9162bd",
+        "634dda3ec5f48b85b1d66a9c434beed345388bad4d3f708e08a5652486c3a0e6",
+        "9de2a3e05f104b7b66f403746ed17b8d65a2cfc563dd424367612abb28b3891c",
+        "08dca5625e2546b0fa6fafd3b0675ad4b26d0541248449eaf8acd09d6bc88bcf",
+        "6017249d3ed59a9293392b084634e3636e6f83d0c9fc2b64905e3990bb628a85",
+        "057ed2b9d3381a5886bef62003010d04a72bb46c1fbbc51882be5465bf2ed5cf",
+        "7f870e2527bca27567208fda37d91766bf95556fda0673382839d1d4fada9d50",
+        "14801b3c7a378898c9bc0b2db986b658923627fbd2e9ecbc145cfee308db5968",
+        "9151742aa699e767051d7a19847c7d13eaaf33f6ee877ac9c7275ab4dd33d0f1"
+      ]
+    },
+    {
+      "file": "cuts-01-p3-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 230,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "24757f506b83c54fad024dc97b1755dbdffbaaa5ca2cfff39aaf387c5dbff5ff",
+      "sse": 66685,
+      "frame_sha256": [
+        "741d9aa7f272dff807a69426deb7ab150c0a9c65361c50ab5d6c2fe9a8917881",
+        "97671870c5e1303babf547307ad54fa6cd6f1ed79daa3130fce255ab0308465b",
+        "5c5701477647d1458fd8f611ce94945b6ca88ebdd369a09ad5cb028a01a7a61b",
+        "49f03b827871f4b57f3a0eaa00c4cd64dba330db18aeddc39fb10baa75e168cd",
+        "6e683fd3677e503fde52a0ab1b06fe0254a7ba80635cf8d2808ba19ac4c15781",
+        "e243f3d1960e56127477615659d129e9e516d2741af05d20c8f6bf3522e31c02",
+        "b6d302fe0016c15abea4e1aba6eaa83ccce710740268318b0b524603c7926e46",
+        "0b671d71319eb0c2be52e41ee71741df6b8e0a6291ecf346f16381b0fed91f87",
+        "7016c4f757189b73ded10f978a3010a8bc5308fe99fd82a7979b7c7b3d95217e",
+        "d87256be1a85762feaa927557cf0ecc986b4d6822460bde82056b7b7644e4977",
+        "17aedec95ff51e9180db0bfc3bb5f260adb8d7b57d9c4d0293e78af75348505a",
+        "47f2d8dc9da1faef46cea538d95ffadb701bb387f6ab19a61e4854f331b6da4b"
+      ]
+    },
+    {
+      "file": "cuts-01-p3-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 230,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "83ca0892f4e8df6f3b585812fe68cb4e49dcb12f5c077d3eb3a91d2a6812975e",
+      "sse": 99914,
+      "frame_sha256": [
+        "f485f514c21faf5930b378242c86c59c632b0d26fe09443509348ce9b78cf911",
+        "d37665e84c8e5c4a46dcc65596dbfe4fe138aa37dcba7c8466b1e75fdbd35b7f",
+        "a80dc8e54202808636785cf23a5a3d81b46b29d65f25ba9bf156a76a6ac1e74b",
+        "7c74e4083958683343380239c151596f07adb444aab1ff8977711e4ef8a4504e",
+        "dd690998c665122053f58f6f4e15db9b6de700fd8c381fb898a982d9cd822825",
+        "88b40d4536bc67981629da9e7cd27c43ba613afe4ce874d9554214f92992ab09",
+        "b46d8eefa654477694edfdc9c66d296721a3d51f59c1423ba08dda0446981236",
+        "bc9fad021a3ba3fd63159814142e322e560a5757427edba4fc6998ae99df7426",
+        "460e3c38b7ef0ea9ec65deced48740d3c4c6b583fcf97217f935e7fa7b7ddd99",
+        "4798590ae15cb92ab6be61a40ff3f2acbdad3b11cb2e9a152c824f0f71fe86b4",
+        "93118bf43f6c23ae618bc35ff49ed4bcfeff253f230d7e4b7d3ad1349406909f",
+        "6536fec63f0780e9d8f6448993bbd880208d553f7cf7265f007f27b8adf2f52c"
+      ]
+    },
+    {
+      "file": "cuts-01-p4-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 260,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "341a1d752c0b9f4a422fe4f5e4f09926a4b5133a1a872cc34dc83f538a7bc96f",
+      "sse": 59834,
+      "frame_sha256": [
+        "8f2a997446d807b75ebb926e6798787346783e282fdc497e33c6b7c94d0ccaa1",
+        "c0eba080aa1c3a7c7b31a3dd26c4cab3a008a22d5dd2448465846025c78bec92",
+        "0524a4ca1af3f5f173e29057c9c66ec0162c96a88521423b3f4bda11474091de",
+        "6d60a170f6a018bc3d7a43b142f62fac6a0a75b5a8638d31730c5922545afc05",
+        "d69df67ac682c995324e5b5fd0c240604321e7ac903f3012441190bc193787d1",
+        "5b62bf515799d04ad4d559f2d6b74e7c672914f33f1fd979659e01d8d7bab8e8",
+        "01f04313d29874b66a562dcdfaac3ecdb516eb2cbb25c4b79e49704e829473b4",
+        "7a7c143b0b7d5e9c7dbe59b7d9610d595b89a881e52498d11473b5a2c12c1e0a",
+        "ceb3262e5f0341ea0aa52acabe4b42f9ef6e6a354d6cf1b9147a706c1a99be35",
+        "17cdcb7324d9ddcd814f2adaffd3044c2491cce7d71a91be78fb04987f569fd7",
+        "1490026fa8c7c33dec7bffd96f512b3e18c63de43b029e4e06dec846f4b12c0e",
+        "6a9e9d4d4b5b3eb738b77bef39573b89b7fe3da077198ffe9fc99b652e4accaf"
+      ]
+    },
+    {
+      "file": "cuts-01-p4-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 260,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "37e32ee5720049a3f0d668dc1f4a0bb2978ea1d49b9e9cf76ffe195c5936742d",
+      "sse": 109604,
+      "frame_sha256": [
+        "4659e05e960a980570ecb9a4ffebc03d85b9c1c14907a49474e9db1459ebd2cc",
+        "52f5bc85870434352d0acff7a7ab1e45e6e9ccd2fc2c9c337d903ea32b6d206c",
+        "1daf47029011a0b7c8332af995ebbf68f5309df2e55c805ac277cced51eceee1",
+        "61d309d8d83879032facbb9135f48010cf22b5ed588b4a91a46321547a5b1eea",
+        "89c37e10114310bb9fa47408d4b048fd5676d99c4ae09c5cf2b5cbd4a497bb62",
+        "d0f30ad1ce46f3f4362ad80ecf709427fc4d31cb70a1c68dbab37f831a0e0b52",
+        "33c89819fd9df62ec7b1f17c2facad6d67fa7cf748cf9e8f0aa315b768f1c192",
+        "e8ca9ff1fdd0ccb7bf77286db2c7bd37bb08cca598c572f052482287d2549652",
+        "4474d853a434c3bddf3ced9a9850f80b27ec8def92142d4c9e8c5567b2367856",
+        "6cb4606675ebfee11cdf731f34fd5dbec42f9a68dc2f68392ab6a533d4d27436",
+        "3cb0293ea46c6b2df1e6f473a20f68a0ad95a8f3ab4bc75a2134eb1841350f60",
+        "00c991f91d34cf92df5144e37d14a8abab93832f07091681551af5ecaba1b471"
+      ]
+    },
+    {
+      "file": "cuts-01-p5-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 290,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "619d1e788f863ea4b7cfebc2e6acdaefb1982746152adf5621e83923a5f25775",
+      "sse": 67743,
+      "frame_sha256": [
+        "0ad90eabc1d71d2313439d656439123448881bbf44b3c9300aaf124af74fee8f",
+        "513a26f17c8f984e318cc377f09fa6171d10f38d0558f4d5062aa89c7d1d28e8",
+        "0139bb0f3953e012eb132fab962e500b0b9d162c2d8160a0c2e9918fc7037a7b",
+        "2ba7d63410ae1f30bcee8a8f2b502f04a02b31794f6e6dbf856cfb07ad0dd6ba",
+        "738f68f9b8311603908a85e3a5ab87f970d1cc7916db03f706ff67e2444a5a8c",
+        "0c5bca8d6f5a4bf40b5de0de8f8322b094f07573c6855e6f0a59766c382bd3f4",
+        "816e5a8288382299eb7d73403d1b9b1c05ea2e62a04adf8a565babc37a4aa2cf",
+        "425f53d979c2e71cd09abac8b1d4c7b3a95b7a7911d8d8b18059054e2405ca1e",
+        "3af775795fc514976a2a648a94bf11a15b402662c56492571a94104f124f76b7",
+        "9a66ce4a620bb74843161fec086676ff201a1ac3bae91e57a142be8eef87e5bf",
+        "63b53b5c6f02e381012291097f5c3f7586a0211e1c37b128f576584785a4721c",
+        "d5269b47ef0790975172fdc1c59f95e171fd0bb3b35337301da42f21df70470b"
+      ]
+    },
+    {
+      "file": "cuts-01-p5-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 290,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "2e0619405b65904fa192eb79817a8380a6f224463319d18170c1a4960dea0053",
+      "sse": 95548,
+      "frame_sha256": [
+        "0fab47a2cc7f382016ef5d97d9f105efee6984437d0a00f742572cd0720e0181",
+        "16182e73392878e8e5de6855154b69715e4c493ceb7d20f6ac5fdc0c5af0235b",
+        "a51a1d4d3d0c8a7d494ac56daf24ce0184aec5bb7324bc6090904f6cc884250a",
+        "99416a45d18ee6dc02f75bbaf97b7f9fd9fb1b2b32f45f6f907907164aad5eae",
+        "acd7f955b7092fe58abe31451e2506ecda04e59b8cc0712a4141de5aad5695ee",
+        "5bc2728817a6f623bf4a6c6be2fd0473ab0019b32b703a3024fe2e9ca88d3246",
+        "a18b69ca838096b5633d189e49ea18c6b4db43fd52c02dd6b273ba9175a46fe6",
+        "bc44c51e7886286782e70a3bd6e3b548948f0da9dce55cd7416df808ced8f6f4",
+        "0320a0a6d197cdb97a7e6ea99b691edd1fe42ea776c23d5dedec30ab8abb039a",
+        "692574c81a73bc8597f828e9d5d235b0a395796fc069c25a653156bfa583e6bf",
+        "b43eb83fde913a7b85b30a5b6e9713be7091235a0d03718affd03c986f6bb261",
+        "8cf6cccf9c6273bf00762602785da56de609c20da478710e0c54707e7364e390"
+      ]
+    },
+    {
+      "file": "cuts-01-p6-a.wiv1",
+      "fixture": "cuts-01",
+      "first": 320,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "488ec040b6ef5d1ca32967e8bff948c2791f54e4e11d8ceca952eea82fc2d2c1",
+      "sse": 59254,
+      "frame_sha256": [
+        "64d71ac5eef11803dda0ad2b883642a6f03753cb68c7c91ac3833dd3a22df683",
+        "724b5f3c2fef10a077ac785a42319991ee1899335b8b5057b6215dfce05b99a1",
+        "2166ea9d196c509a43f466cf9139dbb1ee8583f702a8d22c89b515a27c27bf3a",
+        "c2af90a520055fb3c11b42d9bed536d93a4d42bd575de5bb62b087bf6ec4e4ce",
+        "1d2832b9e20e1540904991b958859b63a53acd20fa17a61dd73f550304001484",
+        "41629bfe6117547a3684fc7b7827ec859ec9c1c08009753c22e6ce24d29264dd",
+        "86f0a50d8674ac11fe8d5ad1d96459ee410ce272940803272a20d43c777e0454",
+        "bbc9280cf47fb337e07187df9288f1f4e76e8d7e5b7ef097f9dc02cbec88bbcf",
+        "f75c5ef8f7005e1a965019235ec73c9957669bcab166f7e5c37fc2af75ef6330",
+        "67cd329a969f86cf3a6128fd80b5d58fd082b4ce8f8b797c3e27b926f85a76f5",
+        "ef20daf7c1393e58eb623900b31906232ae589bbee3a726a0aefb291d22855e6",
+        "098c6f4d63ba6f845c051c94939cba73a914b26931284e085df34aa13f254bcc"
+      ]
+    },
+    {
+      "file": "cuts-01-p6-b.wiv1",
+      "fixture": "cuts-01",
+      "first": 320,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "fa4beffbc761f4e1f85d223b0f03a33e56639c8d309e2c1789796d2be2c3a539",
+      "sse": 97827,
+      "frame_sha256": [
+        "b12594c0e48af37386f5b12367b159cba8c169469b5ef99dd6e0f87c0edb156c",
+        "eb5c25b5dfad7b463c699ff3df85e51ee323c14518b44bb501488e9487f47f72",
+        "b66d5f6c510462bce269c75aa79d99dfe647f91faa33f6bcbba925e91fa424c5",
+        "cd724a8ea45fae24601a9c3f1e8f4b8d7ac99db20b84616c34e0617bd399a8fa",
+        "ac50e780c399d22147c062159f64b42759d29bc5bf30ff5bc9659b8ef6b1ef35",
+        "c3cd1c6a85e3a114f62555591523960db66b7dd3cc7a786b8b97823dce59cba6",
+        "52e533a854bfec84a0bd05cf8ff9574ef4404891444403a95a3c3dbde2fdd4bd",
+        "845f1a9c5c170f8b0f561858b85db2bbfa7d14fd94f92594b5816b95d0600028",
+        "a421cbc0a63d9aad0ff7fd4bb489f5591252218af648aab0067054931ade1cd9",
+        "6501e9384c4f791310aafbf27a2acd01993df8fa0175775b39f83cdcdf02d180",
+        "0db48da95f5bdce08144367732b4432e84f8fac23701a4e3201ec661093f38e9",
+        "a83526b03feeb9cde0571614508f3d8bc7891643bbd8816673b20864dd6b8c67"
+      ]
+    },
+    {
+      "file": "kinds-01-p0-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 0,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "5eab0a221e47ae51e5baf1d52cca4655bc2d0dfdf446af29dd1a7a2cb29c5dd7",
+      "sse": 68688,
+      "frame_sha256": [
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f",
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f",
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f",
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f",
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f",
+        "0a2938f2c054edfe16070bfdeaa0e170d610ce06745cd54f4763a1457ccb26cb",
+        "e56c28da016321b769b84c7e7a3ef22c7ebdeeae3a5417bd1efdfb5e09b4a01f"
+      ]
+    },
+    {
+      "file": "kinds-01-p0-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 0,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "341153c23382e50a91c4dc55f3629eb2e4eba4f2cbfb1f915c39285fbedfb871",
+      "sse": 95508,
+      "frame_sha256": [
+        "3e2acd0885cb6d953a705f389aa193188c1096df6267ee1b91b02f88c3928e2f",
+        "e78a475d495a65b873c30709c4c385deea80fc103c76c58d4e2904de7c436937",
+        "5a13e54a747ca7bee9a9f43b644447fe7feac723b4e245b837a6ce95e536b1a7",
+        "0369a08cb0dbd89889eb59a5cceb5d7f95768f06a7878cd815f4a669fdd57832",
+        "e982a3d83dd5504e93dbcfe98d27765713fdbb769e3cae4c4d97b8afcd5e2f9c",
+        "8c7a5152ec456e110a25e07d0108d42235c236e8097f01fb152b25a289915d0c",
+        "ce609c46df5240e3aa9601a686bd28af91ef5432ed884209e259938421ad867e",
+        "c5fba24d9fea260881b3f0a3a81ec441b8efa379e0012fcfe1914f543d51b193",
+        "07a68646cd3246a31be6099ec2c07d70e57177a634a51f6843af4700f03e98b6",
+        "9e6f20598a9dbcbc2e155cf826c50ec60bad8a51cfb66ea07d39a9b1fe1ebf90",
+        "c288d71734a35b3e31c9e74e248daf03a1a3651214c7e6e80acdb1567c0e89b4",
+        "24fa0951ad1382917fab6f6d6601a002b2a4d4c0080ccdbb5cfd64369b375930"
+      ]
+    },
+    {
+      "file": "kinds-01-p1-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 40,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "ca514e82998d647b769d68a64d3716187fa80cf8bb1346dfbbd067db5c14f6b4",
+      "sse": 62208,
+      "frame_sha256": [
+        "ce06f0939135d3114c2f9a466a83d735d56ecd9f472b363e7ab8d4b6b633e198",
+        "c5a121856f15b787f0a34e8a612644aafcdcf5838f4b96ac73b5ea1b5ef78c33",
+        "1b6f84cecfddcbacc0027729dba9ff7c4082c9c5b74c940e717062c1b15b87ac",
+        "8aa3b6c444f7d02a6a595f65915931bdcf16cc46af2338c9fc7f454d647e896c",
+        "add52ba49d80980da4aa5a5619e7ceedc76c343944c4b1c2ab18fe6d955c8606",
+        "41bcf40df80af7cd0e87b346c2b9951deae69534916efd3a81e14e36d6849300",
+        "599a8c15d6901d4c48e1afd9e8f4076a1e52212e38199374d5acaaec3ba5bdc0",
+        "ce860b5adda24e1318906e0bf2948e931d60d46b026e08da34fa5c1566caf272",
+        "6ac370c582a7044661e63c43f425792debe9fdff911f3a49f4fb6ce357d2f076",
+        "a2ab1ae35f4dc015ad47b61f67be9e07291b01c4532f62682e284f022f43b876",
+        "88a5474c8cb0f9f804a194032ddd0101da70669c7de068cf5fcfc95bc6371b55",
+        "4bfee3b3fcc14021cde9ca56e80530a3aa8d9c509d2a8bc6f90107d399743d40"
+      ]
+    },
+    {
+      "file": "kinds-01-p1-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 40,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "178b6851db871c42a0b622f534db19a911a39d60869f502267d0f70079426026",
+      "sse": 311040,
+      "frame_sha256": [
+        "ca9ea64bffac9c105747c5381e626c90df697d90d156125c890608910dc038f2",
+        "26762929396c8aae06f1454b2b6bf40a667a9cd0a43021a6211b3bb8c900749f",
+        "759294a008637d5550a1594dcf489f6f9ea377532b879f74be6654e66bd3252e",
+        "3f4d6d8ededf23b95f1ad540becd79abad83c1ad89d8fc4fbffeb17e0f9df2fc",
+        "df78456a59f4d34a38ef0011ce4a4390e4613614ecc664a106c20e1b1ef69220",
+        "2b5b2331c9383cb4af0cb309acc71af891170d6a1a766927d0f30552d938de79",
+        "3806756815a981b425f477280a9d6e60098b306c3f177cb3f0deeab61b3d3b19",
+        "c696a2aa0dfcb579e3cfb91d6a152c47928ba0fde4850b6c0dac0680783fb845",
+        "fd420fbc1e5128906745f691733f179c1aa00d0b4215cb8035581c9ae9fa4a64",
+        "e3aab8d1273fd235e9d019e23a7b58c64e2243033ea9f1d05c37b95f401172b2",
+        "40cf233a5d48195bb5c70a804ef97c236c22f2cbb6787994372944ba1ea0f059",
+        "65457095263ded9f59c3825ed0a882d636ff47029ff61891c280ff01d4c2be39"
+      ]
+    },
+    {
+      "file": "kinds-01-p2-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 80,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "95a93a718fef8d21ada403e700063650486ba81f1431f5ff6704d73bb4ac425d",
+      "sse": 63357,
+      "frame_sha256": [
+        "6196344a8b440a484d04a1a0f1d057a4a85d52b20e8c24d26a884f6f0239bb52",
+        "253d9926f9e065fc055d9bf6e5025528178735a9fb4fab750ab97baaaa562c55",
+        "a025e746b7e2ebb8535a44e53804c8bee0d1ba0641f6cc436b1cf39e6bed8c30",
+        "2a38c4effd3a11524e0819a7c5ee49c58206b9105a6e8b3c83ae3904ef1a342b",
+        "870f235469a2e9d9aeadd7c2440b84f8c4492008fc2fb6ae52850819c5602f24",
+        "0a06188a6711a6a63fd6da41ce275ec6259696071ca2b2be56ba9eae9dc563eb",
+        "852106274aa35f27db9418386f9a41ea07f46a8e732ed21f7babaf17b49ee06e",
+        "df91d5663beaf7f720c758461530ff12e5be328908d6e3505c2a5ef87ad07927",
+        "3d229e974d8170eb954b12c41137977cd0f8dccf5d939ab61fa3d7653b12e989",
+        "70ea629a2d6cb608564a3ae60e2c7b9d8904a3177588e56639c7d850bc273aff",
+        "b81050bdf241440ea08e25d7f20f12ee165a0879414987987d46c507c4b3b411",
+        "d100209e5ade35978c3b70f713ad5a66dd7db3105feb34a9e9696efd4c7df776"
+      ]
+    },
+    {
+      "file": "kinds-01-p2-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 80,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "5afdcaaf91b48a40e3d739ab3ea3c6913df6e1ced6bc509958c3612077fa1fa4",
+      "sse": 246720,
+      "frame_sha256": [
+        "44a47b64e68069922d866d39dc6f4a196dd3ca4117c0718d98dde931defb82fd",
+        "40b8df1ecd11a09cd75edb097c8cadd3a69eea56387e3e668fc84ec089c055c5",
+        "31b1f5c937efefb6d74431b962af8d0e7e34210ab0b4abf73f44d47998fdbe07",
+        "8e1d23e8e4309cbb024c9061e5af023a27d8f04854396482b783936724e7323f",
+        "d6ef42a29902be8389548f7da8e82cafbf71e6817d13e284603f38ab3b5578fc",
+        "e996d9c08087be3455fb24569b45c7555fa6121d0fe86f2ef06b11f6200b28a5",
+        "70a4e7f9bc606b0e1b5a8c2da6e3046d7a1534920d8ae5a4f1d6c736af796f17",
+        "775f99bc98c684bf4e5504bb78b4d2f3b93f1de3ef7c421c52465e9fabca8ac7",
+        "2aaa78a898f1e21492bfe173bf4d1bf3eadcad33c49a626afaa5fcafaa1c25a4",
+        "60e1d2b0dd0ffff13152dae030df50c0a3cc8c825ee105c044d5c2fc2fedb556",
+        "7cddae930312ae974c546f55d3b583688af1e9612272fac27f9a28b6d36671b6",
+        "423369b769a993dcffa56312447c3a6156489020978fba7d3c81aad11b20c889"
+      ]
+    },
+    {
+      "file": "kinds-01-p3-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 120,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "d54713622ff0cd6bbbf6dae0d2057813e41f277692d99258cee89c0b812f77af",
+      "sse": 63021,
+      "frame_sha256": [
+        "93b4b4ee7a0ec0dc28e7ce62ca096c7ba7e4722ecb17e763cbd0338c8325abb8",
+        "29dda7595723a8ae243767db9741acb1ed4f44494a59751326d957f53d56eb8f",
+        "8c6f2a939942f5c78cdbf1e7569a90e652cdd97254d286c39488cb137368044e",
+        "1486c3a531e0c582f643ad99698bdaa9a67904e30a113bdf336bdf03e0c38591",
+        "a37700046fbe7eb87546d5f3b0f82cc7a86c6d1d7e23326aae3304adf4b18175",
+        "f4722bf3b7f13c4e81ec329eaf7942fa871ccb5cacb6a5192bde912b36671dec",
+        "e5910a27d4876d99e1ea0d8caffc55d0da9671a7a8b578a7512fb86c26873c13",
+        "23415c862cdcc9c502a578fea08aed7b082d5a8c4f867dc25bfb342052e23078",
+        "4dec3aec6a7aaadbc4f0e48d662095c4a6e71b144590f84acc0a30eee7ad03db",
+        "9d5f657117ed167bcdbf92a5b27b992383683149c4b53ae56efdccf3d6bb0beb",
+        "cd77f44703afdd47ee3b128b84585e7049aa118286f003c3cce8749b6d0bc028",
+        "de2c10a2b8ad811ba255f4c8dce1bbd59e34a183119abc83ff21a820c17737af"
+      ]
+    },
+    {
+      "file": "kinds-01-p3-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 120,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "5bdc99ed0ca6b211ea976c6792610c23f57a8975cfea8085be8659c1dc2fc8ac",
+      "sse": 119757,
+      "frame_sha256": [
+        "30a7bf937c0ae12850822ac638c3c8bb45ed373c26d0d380a656cbdbe6fde5e7",
+        "2525365fcfb161d5b55e0a1b9181c570cea654efaef2b84663ec9d58efc8f917",
+        "8b37c53c7d3bb559faccdf6a9514cef95cff7b3e8fe6ef0de329889f236fa0bd",
+        "b31628db28ec03a75437976c224404e089ade2e3774237b15f7a6f5d47b99136",
+        "fb1d4bb64188b6935dff19604ffefd089accd265803744aa26732e6d916be34a",
+        "7be175e774b23f999e6a5c762dcde712d914424fedcf75bdb340bb9781e8b95c",
+        "f45711dc25ca6f6543c2e7b4074eda587ba161a1d4ebe5a1232ebfd5b8f546b7",
+        "44d2a0363d77296c1712406cbff00c109af4a04f92334ef5516985f5663bf668",
+        "28456d27aef2ee66da687cd55e0806de63b0888ed9c92356e4d885d642c43eee",
+        "98198c2be37074a3dff8d010fe2534e32d7e8ff4aa9f871b1708b5fb63e00cf3",
+        "524f8760dc3aaca077da08c889cc4d16e00b1a962b7a500d9e5cfca24075aef1",
+        "d4423581b2ff368b78e3e1a9f083565d817c51b364efa7be25e8e8d65c4a91f1"
+      ]
+    },
+    {
+      "file": "kinds-01-p4-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 160,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "bca3d8a50228c563702f126a86d8997fa7ea297814a517cbd7f03bbd0d63d160",
+      "sse": 65232,
+      "frame_sha256": [
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db"
+      ]
+    },
+    {
+      "file": "kinds-01-p4-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 160,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "18d7978c72a981bd552421cc37852eaf9ba58eaaf879b4c6dbd377d7ccf27400",
+      "sse": 237072,
+      "frame_sha256": [
+        "7729f108901954be29b8109ab0fb27406c017d478417094f68d22a60fec28ccd",
+        "cd1302ed80afd660e6d07a61d29d0b8960d1770f5ba3665414e3e231050cc7e8",
+        "72003e0cb5b3ff4e9d9be8b3a7d287edd2568889ef10a6e7396a845ae0e7e4f2",
+        "fc4f98eeccec46c705481fe9cf1282e63a0baec483bcf3470093870226fa6d41",
+        "8557f8e485cb9832699370e86beef151f04dbc17aa29936736dfa96afcbeee8f",
+        "870e87397459d169ee844397f196a92b996b38e6e01a5955a5008e0a988cdb0b",
+        "44966adbb04d010ff972acf9aa253c396bb76f05ecbc5179d6d83bd8242bd421",
+        "11736640641707b8decd7bde540478b47a9eedbb35c27f6af57aba280420e84b",
+        "9dade16421ec1bb2bd456f10c6a442c4d21cfb2db59447c55661fa2138bb8241",
+        "0de09deb3c0af0522e2ac890f833f270c9f27fb6c9312124c792bba3a2ddb5cc",
+        "efd20d61cfc984a75223ba6150164147911be2dd0dcb0b09641a565e5dcaf7cc",
+        "0de09deb3c0af0522e2ac890f833f270c9f27fb6c9312124c792bba3a2ddb5cc"
+      ]
+    },
+    {
+      "file": "kinds-01-p5-a.wiv1",
+      "fixture": "kinds-01",
+      "first": 260,
+      "frames": 12,
+      "params": {
+        "block": 8,
+        "search": 3,
+        "mv_precision": 1,
+        "q": 6
+      },
+      "blake3": "bca3d8a50228c563702f126a86d8997fa7ea297814a517cbd7f03bbd0d63d160",
+      "sse": 65232,
+      "frame_sha256": [
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db",
+        "f74dfe59e17737b9bc0459f73dd6267207039724574d853c5d69ab2387048e36",
+        "35b5d61ceb66d6f4dda5fcc7f573cef1f69ee8bb19da4caab96d2913cc6b68db"
+      ]
+    },
+    {
+      "file": "kinds-01-p5-b.wiv1",
+      "fixture": "kinds-01",
+      "first": 260,
+      "frames": 12,
+      "params": {
+        "block": 16,
+        "search": 2,
+        "mv_precision": 2,
+        "q": 12
+      },
+      "blake3": "18d7978c72a981bd552421cc37852eaf9ba58eaaf879b4c6dbd377d7ccf27400",
+      "sse": 237072,
+      "frame_sha256": [
+        "7729f108901954be29b8109ab0fb27406c017d478417094f68d22a60fec28ccd",
+        "cd1302ed80afd660e6d07a61d29d0b8960d1770f5ba3665414e3e231050cc7e8",
+        "72003e0cb5b3ff4e9d9be8b3a7d287edd2568889ef10a6e7396a845ae0e7e4f2",
+        "fc4f98eeccec46c705481fe9cf1282e63a0baec483bcf3470093870226fa6d41",
+        "8557f8e485cb9832699370e86beef151f04dbc17aa29936736dfa96afcbeee8f",
+        "870e87397459d169ee844397f196a92b996b38e6e01a5955a5008e0a988cdb0b",
+        "44966adbb04d010ff972acf9aa253c396bb76f05ecbc5179d6d83bd8242bd421",
+        "11736640641707b8decd7bde540478b47a9eedbb35c27f6af57aba280420e84b",
+        "9dade16421ec1bb2bd456f10c6a442c4d21cfb2db59447c55661fa2138bb8241",
+        "0de09deb3c0af0522e2ac890f833f270c9f27fb6c9312124c792bba3a2ddb5cc",
+        "efd20d61cfc984a75223ba6150164147911be2dd0dcb0b09641a565e5dcaf7cc",
+        "0de09deb3c0af0522e2ac890f833f270c9f27fb6c9312124c792bba3a2ddb5cc"
+      ]
+    }
+  ]
+}
diff --git a/wai/pack-conformance/encode/kinds-01-p0-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p0-a.wiv1
new file mode 100644
index 000000000..4476d6b1c
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p0-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p0-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p0-b.wiv1
new file mode 100644
index 000000000..9789bfdc2
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p0-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p1-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p1-a.wiv1
new file mode 100644
index 000000000..32e366005
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p1-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p1-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p1-b.wiv1
new file mode 100644
index 000000000..abf5976c6
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p1-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p2-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p2-a.wiv1
new file mode 100644
index 000000000..99d7fe0b7
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p2-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p2-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p2-b.wiv1
new file mode 100644
index 000000000..9c4354385
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p2-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p3-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p3-a.wiv1
new file mode 100644
index 000000000..6ffbc9f2d
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p3-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p3-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p3-b.wiv1
new file mode 100644
index 000000000..1abc4974f
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p3-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p4-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p4-a.wiv1
new file mode 100644
index 000000000..0942b76a6
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p4-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p4-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p4-b.wiv1
new file mode 100644
index 000000000..9cec20bfc
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p4-b.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p5-a.wiv1 b/wai/pack-conformance/encode/kinds-01-p5-a.wiv1
new file mode 100644
index 000000000..0942b76a6
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p5-a.wiv1 differ
diff --git a/wai/pack-conformance/encode/kinds-01-p5-b.wiv1 b/wai/pack-conformance/encode/kinds-01-p5-b.wiv1
new file mode 100644
index 000000000..9cec20bfc
Binary files /dev/null and b/wai/pack-conformance/encode/kinds-01-p5-b.wiv1 differ
diff --git a/wai/pack-conformance/pack_verify.py b/wai/pack-conformance/pack_verify.py
new file mode 100644
index 000000000..a32a71a8b
--- /dev/null
+++ b/wai/pack-conformance/pack_verify.py
@@ -0,0 +1,1247 @@
+#!/usr/bin/env python3
+"""Independent verifier of the packaging corpus (extensions/packaging.md).
+
+Written from the extension text. It shares no code with wai-pack, which generates the
+corpus. It takes BLAKE3 from ../claim-conformance/_blake3.py and the WIV1 parser and
+keyframe-0 decoder from ../int-payload-conformance/int_payload_verify.py, both written
+from their specifications, reads the capability registry from its published export
+(../registry/capabilities.json), reads TOML with the standard library's tomllib (TOML
+1.0), and implements the rest:
+
+- the policy (§3): the value-kind walk, the schema with every default, the constraints
+  and their refusal names, the effective policy as JSON, RFC 8785 canonical JSON and the
+  digest; every case of policy/ is recomputed, every equal pair compared, and every
+  policy of refusals/policy/ refused with its reason, the capability rules of §3.6
+  included;
+- the sources (§4.7): a Y4M reader with BT.709 limited-range conversion to RGB8, and a
+  WAV reader; every source of refusals/source/ refused with its reason, and every frame
+  of conversions/ converted to the SHA-256 the corpus states;
+- the unit conversions (§4.4, §4.5);
+- the fixtures, regenerated from their definition and checked against their pinned
+  SHA-256, and wai.pack.scenecut/1 (§4.3) with its lookahead clauses, written in the
+  on-demand form (every frame known), against the streaming segmenter's vectors; and the
+  classification (§4.6) of every piece;
+- the encode vectors: which frames each one codes (every piece of every fixture, cut by
+  the segmenter above), each payload's BLAKE3, its header's parameters, every decoded
+  frame's SHA-256, and the SSE of the decode against the regenerated source; and the
+  encoder's choices (§5.5) recomputed from the decode: every motion vector by the
+  search, its order and its tie-break, on the source and the previous decoded frame;
+  every coded residual (the stream's symbols) equal to quantize(source − prediction);
+  and the residual table and its offset equal to the fit of those residuals;
+- the choice of step (§5.6): every candidate's SSE from an encoder of its own (search,
+  quantization, reconstruction, closed loop), and the step the rule chooses.
+
+    python3 pack_verify.py <pack-conformance dir>
+
+Exit status 0 only if every vector verifies. Python 3.11 or later (tomllib).
+"""
+import hashlib
+import json
+import os
+import sys
+import tomllib
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "..", "claim-conformance"))
+sys.path.insert(0, os.path.join(HERE, "..", "int-payload-conformance"))
+from _blake3 import blake3  # noqa: E402
+import int_payload_verify as IPV  # noqa: E402
+
+MAX_INTEGER = (1 << 53) - 1
+U32 = (1 << 32) - 1
+# The frames of each piece an encode vector codes: the first ENCODE_FRAMES.
+ENCODE_FRAMES = 12
+
+# ---------------------------------------------------------------- canonical JSON (RFC 8785)
+
+
+def jcs(v):
+    if v is None:
+        return "null"
+    if v is True:
+        return "true"
+    if v is False:
+        return "false"
+    if isinstance(v, int):
+        if not 0 <= v <= MAX_INTEGER:
+            raise ValueError("an integer outside the canonical subset")
+        return str(v)
+    if isinstance(v, str):
+        return json.dumps(v, ensure_ascii=False)
+    if isinstance(v, list):
+        return "[" + ",".join(jcs(x) for x in v) + "]"
+    if isinstance(v, dict):
+        keys = sorted(v, key=lambda k: k.encode("utf-16-be"))
+        return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + jcs(v[k]) for k in keys) + "}"
+    raise ValueError("a value outside the canonical subset")
+
+
+# ---------------------------------------------------------------- policy (§3)
+
+
+class Refused(Exception):
+    def __init__(self, code, at=""):
+        super().__init__(code)
+        self.code = code
+        self.at = at
+
+
+def is_int(v):
+    return isinstance(v, int) and not isinstance(v, bool)
+
+
+def kinds(v, at):
+    """Stage 1: the value kinds canonical JSON cannot carry, members in key order."""
+    import datetime
+
+    if isinstance(v, float):
+        raise Refused("policy-float", at)
+    if isinstance(v, (datetime.datetime, datetime.date, datetime.time)):
+        raise Refused("policy-datetime", at)
+    if is_int(v) and v < 0:
+        raise Refused("policy-negative", at)
+    if is_int(v) and v > MAX_INTEGER:
+        raise Refused("policy-integer-range", at)
+    if isinstance(v, list):
+        for i, x in enumerate(v):
+            kinds(x, f"{at}[{i}]")
+    if isinstance(v, dict):
+        for k in sorted(v):
+            kinds(v[k], f"{at}.{k}" if at else k)
+
+
+class Tab:
+    def __init__(self, t, at):
+        self.t, self.at = t, at
+
+    def err(self, code, k):
+        return Refused(code, f"{self.at}.{k}" if self.at else k)
+
+    def keys(self, allowed):
+        for k in sorted(self.t):
+            if k not in allowed:
+                raise self.err("policy-unknown-key", k)
+
+    def string(self, k):
+        if k not in self.t:
+            return None
+        if not isinstance(self.t[k], str):
+            raise self.err("policy-type", k)
+        return self.t[k]
+
+    def string_req(self, k):
+        s = self.string(k)
+        if s is None:
+            raise self.err("policy-missing-key", k)
+        return s
+
+    def ident(self, k):
+        s = self.string_req(k)
+        if not s or len(s.encode()) > 255:
+            raise self.err("policy-value", k)
+        return s
+
+    def uint(self, k):
+        if k not in self.t:
+            return None
+        if not is_int(self.t[k]):
+            raise self.err("policy-type", k)
+        return self.t[k]
+
+    def uint_in(self, k, lo, hi, default):
+        v = self.uint(k)
+        if v is None:
+            if default is None:
+                raise self.err("policy-missing-key", k)
+            return default
+        if v < lo or v > hi:
+            raise self.err("policy-value", k)
+        return v
+
+    def uint_opt_in(self, k, lo, hi):
+        v = self.uint(k)
+        if v is not None and (v < lo or v > hi):
+            raise self.err("policy-value", k)
+        return v
+
+    def boolean(self, k, default):
+        if k not in self.t:
+            return default
+        if not isinstance(self.t[k], bool):
+            raise self.err("policy-type", k)
+        return self.t[k]
+
+    def table(self, k):
+        if k not in self.t:
+            return Tab({}, f"{self.at}.{k}" if self.at else k)
+        if not isinstance(self.t[k], dict):
+            raise self.err("policy-type", k)
+        return Tab(self.t[k], f"{self.at}.{k}" if self.at else k)
+
+    def table_req(self, k):
+        if k not in self.t:
+            raise self.err("policy-missing-key", k)
+        return self.table(k)
+
+    def tables(self, k):
+        if k not in self.t:
+            return []
+        v = self.t[k]
+        if not isinstance(v, list) or not all(isinstance(x, dict) for x in v):
+            raise self.err("policy-type", k)
+        return [Tab(x, f"{k}[{i}]") for i, x in enumerate(v)]
+
+    def strings(self, k):
+        if k not in self.t:
+            return None
+        v = self.t[k]
+        if not isinstance(v, list) or not all(isinstance(x, str) for x in v):
+            raise self.err("policy-type", k)
+        return list(v)
+
+    def uints(self, k):
+        if k not in self.t:
+            return None
+        v = self.t[k]
+        if not isinstance(v, list) or not all(is_int(x) for x in v):
+            raise self.err("policy-type", k)
+        return list(v)
+
+
+# §3.3: the parameters each capability's rung takes; another capability takes none.
+PARAMS = {
+    "wai.video.int_motion": [
+        ("block", ("one_of", [4, 8, 16, 32], 16)),
+        ("search", ("int", 0, 32, 7)),
+        ("mv_precision", ("one_of", [1, 2], 2)),
+        ("q_candidates", ("ints", 1, 255, [8])),
+        ("max_sse_px_milli", ("int", 0, MAX_INTEGER, 0)),
+    ],
+    "wai.video.int_refine": [("q", ("int", 1, 255, None))],
+    "wai.video.av1": [("source", ("word", ["supplied", "encode"], "supplied"))],
+    "wai.video.av1.lossless": [("source", ("word", ["supplied", "encode"], "supplied"))],
+    "wai.audio.int_refine": [("to_rate", ("int", 1, 384000, None)), ("q", ("int", 1, 65535, None))],
+    "wai.audio.flac": [("source", ("word", ["encode", "supplied"], "encode"))],
+}
+
+MEDIA = ["video", "image", "audio", "world", "feed", "avatar", "film"]
+KINDS = ["natural", "static", "synthetic", "motion_high"]
+
+
+def read_params(rung, cap):
+    p = rung.table("params")
+    schema = PARAMS.get(cap, [])
+    p.keys([k for k, _ in schema])
+    out = {}
+    for k, kind in schema:
+        if kind[0] == "int":
+            out[k] = p.uint_in(k, kind[1], kind[2], kind[3])
+        elif kind[0] == "one_of":
+            v = p.uint_in(k, 0, MAX_INTEGER, kind[2])
+            if v not in kind[1]:
+                raise p.err("policy-value", k)
+            out[k] = v
+        elif kind[0] == "ints":
+            v = p.uints(k)
+            v = list(kind[3]) if v is None else v
+            if not v or any(x < kind[1] or x > kind[2] for x in v):
+                raise p.err("policy-value", k)
+            out[k] = v
+        else:
+            v = p.string(k)
+            v = kind[2] if v is None else v
+            if v not in kind[1]:
+                raise p.err("policy-value", k)
+            out[k] = v
+    return out
+
+
+def is_hex64(s):
+    return len(s) == 64 and all(c in "0123456789abcdef" for c in s)
+
+
+def read_policy(doc):
+    """Stage 2. Returns the policy as a dict of its JSON members (layer_lag_ms unchecked)."""
+    top = Tab(doc, "")
+    top.keys(["schema", "asset_id", "royalty_free_only", "lead", "component", "segmentation", "ladder", "floor",
+              "live", "class", "moment", "rule", "defaults", "classify"])
+    if top.string_req("schema") != "wai.pack.policy/1":
+        raise top.err("policy-schema", "schema")
+    P = {"schema": "wai.pack.policy/1", "asset_id": top.ident("asset_id"),
+         "royalty_free_only": top.boolean("royalty_free_only", False), "lead": top.ident("lead")}
+    if "component" not in doc:
+        raise top.err("policy-missing-key", "component")
+    comps = []
+    for c in top.tables("component"):
+        c.keys(["id", "media", "source", "timebase"])
+        m = {"id": c.ident("id")}
+        media = c.string_req("media")
+        if media not in MEDIA:
+            raise c.err("policy-value", "media")
+        m["media"] = media
+        s = c.string("source")
+        if s is not None:
+            m["source"] = s
+        tb = c.table_req("timebase")
+        tb.keys(["num", "den"])
+        m["timebase"] = {"num": tb.uint_in("num", 1, U32, None), "den": tb.uint_in("den", 1, U32, None)}
+        comps.append(m)
+    P["component"] = comps
+    s = top.table("segmentation")
+    s.keys(["target_ms", "min_ms", "max_ms", "scene_cut", "cut_abs_permille", "cut_rel_permille", "cut_window",
+            "lookahead_frames", "closed"])
+    seg = {"target_ms": s.uint_in("target_ms", 0, MAX_INTEGER, 2000),
+           "min_ms": s.uint_in("min_ms", 0, MAX_INTEGER, 1000),
+           "max_ms": s.uint_in("max_ms", 0, MAX_INTEGER, 4000)}
+    sc = s.string("scene_cut")
+    sc = "wai.pack.scenecut/1" if sc is None else sc
+    if sc != "wai.pack.scenecut/1":
+        raise s.err("policy-value", "scene_cut")
+    seg["scene_cut"] = sc
+    seg["cut_abs_permille"] = s.uint_in("cut_abs_permille", 1, 1000, 300)
+    seg["cut_rel_permille"] = s.uint_in("cut_rel_permille", 0, 1000000, 3000)
+    seg["cut_window"] = s.uint_in("cut_window", 3, 64, 8)
+    seg["lookahead_frames"] = s.uint_in("lookahead_frames", 0, 64, 6)
+    seg["closed"] = s.boolean("closed", True)
+    P["segmentation"] = seg
+    ladder = []
+    for r in top.tables("ladder"):
+        r.keys(["id", "component", "capability", "role", "refines", "params"])
+        m = {"id": r.ident("id"), "component": r.ident("component"), "capability": r.string_req("capability")}
+        role = r.string_req("role")
+        if role not in ("base", "refinement", "floor"):
+            raise r.err("policy-value", "role")
+        m["role"] = role
+        t = r.string("refines")
+        if t is not None:
+            m["refines"] = t
+        m["params"] = read_params(r, m["capability"])
+        ladder.append(m)
+    P["ladder"] = ladder
+    f = top.table("floor")
+    f.keys(["supplied_listing", "extra_keyframes"])
+    fl = {}
+    sl = f.string("supplied_listing")
+    if sl is not None:
+        if not is_hex64(sl):
+            raise f.err("policy-value", "supplied_listing")
+        fl["supplied_listing"] = sl
+    fl["extra_keyframes"] = f.boolean("extra_keyframes", False)
+    P["floor"] = fl
+    lv = top.table("live")
+    lv.keys(["layer_lag_ms"])
+    lag = lv.uints("layer_lag_ms")
+    classes = []
+    for c in top.tables("class"):
+        c.keys(["id", "max_layer", "max_kbps", "floor_only"])
+        m = {"id": c.ident("id"), "max_layer": c.uint_in("max_layer", 0, 255, 0)}
+        k = c.uint_opt_in("max_kbps", 1, U32)
+        if k is not None:
+            m["max_kbps"] = k
+        m["floor_only"] = c.boolean("floor_only", False)
+        classes.append(m)
+    P["class"] = classes
+    moments = []
+    for m in top.tables("moment"):
+        m.keys(["id", "from_ms", "to_ms", "tags"])
+        x = {"id": m.ident("id"), "from_ms": m.uint_in("from_ms", 0, MAX_INTEGER, None),
+             "to_ms": m.uint_in("to_ms", 0, MAX_INTEGER, None)}
+        if x["to_ms"] <= x["from_ms"]:
+            raise m.err("policy-value", "to_ms")
+        x["tags"] = m.strings("tags") or []
+        moments.append(x)
+    P["moment"] = moments
+    rules = []
+    for r in top.tables("rule"):
+        r.keys(["id", "when", "then"])
+        x = {"id": r.ident("id")}
+        w = r.table("when")
+        w.keys(["piece_kind", "moment_tag"])
+        when = {}
+        pk = w.strings("piece_kind")
+        if pk is not None:
+            if any(k not in KINDS for k in pk):
+                raise w.err("policy-value", "piece_kind")
+            when["piece_kind"] = pk
+        mt = w.strings("moment_tag")
+        if mt is not None:
+            when["moment_tag"] = mt
+        t = r.table("then")
+        t.keys(["ladder", "max_layer", "deadline_ms"])
+        then = {}
+        ld = t.strings("ladder")
+        if ld is not None:
+            then["ladder"] = ld
+        ml = t.uint_opt_in("max_layer", 0, 255)
+        if ml is not None:
+            then["max_layer"] = ml
+        dl = t.uint_opt_in("deadline_ms", 1, U32)
+        if dl is not None:
+            then["deadline_ms"] = dl
+        x["when"], x["then"] = when, then
+        rules.append(x)
+    P["rule"] = rules
+    d = top.table("defaults")
+    d.keys(["deadline_ms"])
+    P["defaults"] = {"deadline_ms": d.uint_in("deadline_ms", 1, U32, 1500)}
+    c = top.table("classify")
+    c.keys(["static_permille", "static_mad_milli", "synthetic_bins", "motion_high_milli"])
+    P["classify"] = {"static_permille": c.uint_in("static_permille", 0, 1000, 5),
+                     "static_mad_milli": c.uint_in("static_mad_milli", 0, MAX_INTEGER, 300),
+                     "synthetic_bins": c.uint_in("synthetic_bins", 0, 64, 12),
+                     "motion_high_milli": c.uint_in("motion_high_milli", 0, MAX_INTEGER, 9000)}
+    return P, lag
+
+
+def first_dup(ids):
+    seen = set()
+    for i in ids:
+        if i in seen:
+            return i
+        seen.add(i)
+    return None
+
+
+def layers(P):
+    by = {r["id"]: r for r in P["ladder"]}
+    out = {}
+    for r in P["ladder"]:
+        k, cur = 0, r
+        while "refines" in cur and cur["refines"] in by:
+            k, cur = k + 1, by[cur["refines"]]
+        out[r["id"]] = k
+    return out
+
+
+def constrain(P, lag):
+    """Stage 3, in the order of the extension's list."""
+    def no(code):
+        raise Refused(code)
+    if not P["component"] or len(P["component"]) > 8:
+        no("policy-too-many-components")
+    if len(P["ladder"]) > 64:
+        no("policy-too-many-rungs")
+    if len(P["class"]) > 32:
+        no("policy-too-many-classes")
+    if len(P["rule"]) > 32:
+        no("policy-too-many-rules")
+    if len(P["moment"]) > 32:
+        no("policy-too-many-moments")
+    # One namespace for every id, so no reference names two things.
+    if first_dup(x["id"] for k in ("component", "ladder", "class", "moment", "rule") for x in P[k]) is not None:
+        no("policy-duplicate-id")
+    if P["lead"] not in [c["id"] for c in P["component"]]:
+        no("policy-lead")
+    s = P["segmentation"]
+    if not s["closed"]:
+        no("policy-open-gop")
+    if not (1 <= s["min_ms"] <= s["target_ms"] <= s["max_ms"]):
+        no("policy-piece-bounds")
+    comps = {c["id"] for c in P["component"]}
+    if any(r["component"] not in comps for r in P["ladder"]):
+        no("policy-ladder-component")
+    if any((r["role"] == "refinement") != ("refines" in r) for r in P["ladder"]):
+        no("policy-refines-role")
+    by = {r["id"]: r for r in P["ladder"]}
+    if any("refines" in r and r["refines"] not in by for r in P["ladder"]):
+        no("policy-dangling-refines")
+    for r in P["ladder"]:
+        seen, cur = {r["id"]}, r
+        while "refines" in cur:
+            if cur["refines"] in seen:
+                no("policy-refines-cycle")
+            seen.add(cur["refines"])
+            cur = by[cur["refines"]]
+    for r in P["ladder"]:
+        if r["role"] != "refinement":
+            continue
+        cur = r
+        while "refines" in cur:
+            cur = by[cur["refines"]]
+            if cur["component"] != r["component"]:
+                no("policy-refines-base")
+        if cur["role"] != "base":
+            no("policy-refines-base")
+    if first_dup(r["refines"] for r in P["ladder"] if "refines" in r) is not None:
+        no("policy-refines-branch")
+    for c in P["component"]:
+        if not any(r["component"] == c["id"] and r["role"] == "base" for r in P["ladder"]):
+            no("policy-no-base")
+    n = max(layers(P).values(), default=0) + 1
+    if any(c["max_layer"] > n - 1 for c in P["class"]):
+        no("policy-class-layer")
+    if any(r["then"].get("max_layer", 0) > n - 1 for r in P["rule"]):
+        no("policy-class-layer")
+    for r in P["rule"]:
+        if "ladder" in r["then"]:
+            rs = [by.get(i) for i in r["then"]["ladder"]]
+            ok = rs and all(rs) and all(x["component"] == rs[0]["component"] for x in rs) \
+                and any(x["role"] == "base" for x in rs)
+            if not ok:
+                no("policy-rule-ladder")
+    lag = [0] * n if lag is None else lag
+    if len(lag) != n or lag[0] != 0 or any(b < a for a, b in zip(lag, lag[1:])):
+        no("policy-layer-lag")
+    P["live"] = {"layer_lag_ms": lag}
+    deadlines = {r["then"]["deadline_ms"] for r in P["rule"] if "deadline_ms" in r["then"]}
+    deadlines.add(P["defaults"]["deadline_ms"])
+    if len(deadlines) > 4:
+        no("policy-too-many-deadlines")
+    for d in deadlines:
+        if any(d < x + 1 for x in lag[1:]):
+            no("policy-deadline-unreachable")
+    return P
+
+
+MAX_DEPTH = 32
+I64 = (-(1 << 63), (1 << 63) - 1)
+
+
+def shallow(v, depth):
+    """Every container in v, itself at depth `depth`, at most MAX_DEPTH deep (§3.2). The
+    recursion stops at the first container past it."""
+    if isinstance(v, list):
+        return depth <= MAX_DEPTH and all(shallow(x, depth + 1) for x in v)
+    if isinstance(v, dict):
+        return depth <= MAX_DEPTH and all(shallow(x, depth + 1) for x in v.values())
+    return True
+
+
+def in_i64(v):
+    """TOML's integers are 64-bit (TOML 1.0); tomllib reads any size."""
+    if is_int(v):
+        return I64[0] <= v <= I64[1]
+    if isinstance(v, list):
+        return all(in_i64(x) for x in v)
+    if isinstance(v, dict):
+        return all(in_i64(x) for x in v.values())
+    return True
+
+
+def parse_policy(text):
+    """§3.2: not TOML 1.0, a byte-order mark, an integer outside 64 bits, or nesting past
+    MAX_DEPTH are `policy-toml`, before any value kind; then the three stages."""
+    if text.startswith("\ufeff"):
+        raise Refused("policy-toml")
+    try:
+        doc = tomllib.loads(text)
+    except (tomllib.TOMLDecodeError, RecursionError):
+        raise Refused("policy-toml")
+    if not all(shallow(v, 2) for v in doc.values()) or not in_i64(doc):
+        raise Refused("policy-toml")
+    for k in sorted(doc):
+        kinds(doc[k], k)
+    P, lag = read_policy(doc)
+    return constrain(P, lag)
+
+
+def parse_policy_bytes(b):
+    """A policy's bytes: UTF-8 with no byte-order mark (§3.2)."""
+    if b.startswith(b"\xef\xbb\xbf"):
+        raise Refused("policy-toml")
+    try:
+        text = b.decode("utf-8")
+    except UnicodeDecodeError:
+        raise Refused("policy-toml")
+    return parse_policy(text)
+
+
+def digest(P):
+    return blake3(b"wai:pack-policy\x01" + jcs(P).encode()).hex()
+
+
+# ---------------------------------------------------------------- what a packager may emit (§3.6)
+
+with open(os.path.join(HERE, "..", "registry", "capabilities.json"), "rb") as _f:
+    REGISTRY = {c["capability"]: c for c in json.loads(_f.read())["capabilities"]}
+
+
+def rung_refusal(cap, role, royalty_free_only):
+    r = REGISTRY.get(cap)
+    if r is None:
+        return f"capability-unknown:{cap}"
+    if r["kind"] in ("record", "derivation"):
+        return f"capability-not-payload:{cap}"
+    if r["status"] == "candidate":
+        return f"capability-candidate:{cap}"
+    if r["role"] != ("refinement" if role == "refinement" else "standalone"):
+        return f"capability-role:{cap}"
+    if royalty_free_only:
+        if r["licence"] is None:
+            return f"license-unclassified:{cap}"
+        if r["licence"] != "royalty-free":
+            return f"license-refused:{cap}:{r['licence']}"
+    return None
+
+
+def admit(b):
+    """A packager's verdict on a policy's bytes: the policy's refusal, or the first rung's."""
+    P = parse_policy_bytes(b)
+    for r in P["ladder"]:
+        code = rung_refusal(r["capability"], r["role"], P["royalty_free_only"])
+        if code:
+            raise Refused(code)
+    return P
+
+
+# ---------------------------------------------------------------- sources (§4.7)
+
+
+def clip(v):
+    return 0 if v < 0 else 255 if v > 255 else v
+
+
+def bt709(y, cb, cr):
+    y, cb, cr = y - 16, cb - 128, cr - 128
+    return (clip((298 * y + 459 * cr + 128) >> 8), clip((298 * y - 55 * cb - 136 * cr + 128) >> 8),
+            clip((298 * y + 541 * cb + 128) >> 8))
+
+
+def line(b, pos, at_end):
+    """A line of at most 1024 bytes and its newline; None at the end of the bytes."""
+    if pos >= len(b):
+        return None, pos
+    nl = b.find(b"\n", pos, pos + 1025)
+    if nl < 0:
+        raise Refused(at_end)
+    return b[pos:nl], nl + 1
+
+
+def u32_digits(s):
+    if not s or len(s) > 10 or not s.isdigit():
+        return None
+    v = int(s)
+    return v if v <= U32 else None
+
+
+def read_y4m(b):
+    """(w, h, rate, chroma, frames as RGB8 bytes)."""
+    l, pos = line(b, 0, "y4m-header")
+    if l is None:
+        raise Refused("y4m-header")
+    parts = l.split(b" ")
+    if parts[0] != b"YUV4MPEG2":
+        raise Refused("y4m-header")
+    w = h = rate = None
+    chroma = "420"
+    for p in parts[1:]:
+        if not p:
+            continue
+        tag, v = p[:1], p[1:]
+        if tag == b"W" or tag == b"H":
+            x = u32_digits(v)
+            if x is None:
+                raise Refused("y4m-header")
+            if tag == b"W":
+                w = x
+            else:
+                h = x
+        elif tag == b"F":
+            nd = v.split(b":")
+            n = u32_digits(nd[0]) if len(nd) == 2 else None
+            d = u32_digits(nd[1]) if len(nd) == 2 else None
+            if not n or not d:
+                raise Refused("y4m-header")
+            rate = (n, d)
+        elif tag == b"I" and v != b"p":
+            raise Refused("y4m-interlaced")
+        elif tag == b"C":
+            if v in (b"420jpeg", b"420paldv", b"420mpeg2", b"420"):
+                chroma = "420"
+            elif v == b"444":
+                chroma = "444"
+            else:
+                raise Refused("y4m-colorspace")
+    if not w or not h or w * h > (1 << 26) // 3:
+        raise Refused("y4m-header")
+    cw, ch = (w, h) if chroma == "444" else ((w + 1) // 2, (h + 1) // 2)
+    size = w * h + 2 * cw * ch
+    frames = []
+    while True:
+        l, pos = line(b, pos, "y4m-truncated")
+        if l is None:
+            break
+        parts = l.split(b" ")
+        if parts[0] != b"FRAME":
+            raise Refused("y4m-truncated")
+        for p in parts[1:]:
+            if p[:1] in (b"W", b"H", b"C"):
+                raise Refused("y4m-size-change")
+            if p[:1] == b"I" and p[1:] != b"p":
+                raise Refused("y4m-interlaced")
+        if pos + size > len(b):
+            raise Refused("y4m-truncated")
+        yp, up, vp = b[pos:pos + w * h], b[pos + w * h:pos + w * h + cw * ch], b[pos + w * h + cw * ch:pos + size]
+        pos += size
+        rgb = bytearray()
+        for y in range(h):
+            for x in range(w):
+                ci = y * w + x if chroma == "444" else (y >> 1) * cw + (x >> 1)
+                rgb.extend(bt709(yp[y * w + x], up[ci], vp[ci]))
+        frames.append(bytes(rgb))
+    return w, h, rate, chroma, frames
+
+
+def read_wav(b):
+    if len(b) < 12 or b[0:4] != b"RIFF" or b[8:12] != b"WAVE":
+        raise Refused("wav-format")
+    pos, fmt = 12, None
+    while True:
+        if pos + 8 > len(b):
+            raise Refused("wav-truncated")
+        cid, ln = b[pos:pos + 4], int.from_bytes(b[pos + 4:pos + 8], "little")
+        pos += 8
+        if cid == b"fmt ":
+            if not 16 <= ln <= 40:
+                raise Refused("wav-format")
+            if pos + ln > len(b):
+                raise Refused("wav-truncated")
+            f = b[pos:pos + ln]
+            tag, ch, rate = int.from_bytes(f[0:2], "little"), int.from_bytes(f[2:4], "little"), int.from_bytes(f[4:8], "little")
+            align, bits = int.from_bytes(f[12:14], "little"), int.from_bytes(f[14:16], "little")
+            if tag != 1 or bits != 16 or ch == 0 or rate == 0 or align != 2 * ch:
+                raise Refused("wav-format")
+            fmt = (ch, rate)
+            pos += ln + (ln & 1)
+        elif cid == b"data":
+            if fmt is None or ln % (2 * fmt[0]):
+                raise Refused("wav-format")
+            if pos + ln > len(b):
+                raise Refused("wav-truncated")
+            return fmt, b[pos:pos + ln]
+        else:
+            pos += ln + (ln & 1)
+            if pos > len(b):
+                raise Refused("wav-truncated")
+
+
+def source_verdict(name, b):
+    try:
+        read_y4m(b) if name.endswith(".y4m") else read_wav(b)
+        return "ok"
+    except Refused as r:
+        return r.code
+
+
+# ---------------------------------------------------------------- unit conversions (§4.4, §4.5)
+
+
+U64 = (1 << 64) - 1
+
+
+def units_from_ms(ms, num, den):
+    return min(max(ms * num // (1000 * den), 1), U64)
+
+
+def align(start, lead, comp):
+    return min(start * comp[0] * lead[1] // (comp[1] * lead[0]), U64)
+
+
+# ---------------------------------------------------------------- fixtures
+
+
+M32 = 0xFFFFFFFF
+
+
+def mix(v):
+    v ^= v >> 16
+    v = (v * 0x7FEB352D) & M32
+    v ^= v >> 15
+    v = (v * 0x846CA68B) & M32
+    v ^= v >> 16
+    return v
+
+
+def noise(seed, x, y, t):
+    return mix(seed ^ mix(x ^ mix(y ^ mix(t))))
+
+
+def ramp(lo, hi, dx, dy, speed, jitter, seed, cb, cr):
+    def y_of(x, y, t):
+        v = (x * dx + y * dy + t * speed) % 32
+        base = lo + v * (hi - lo) // 31
+        if jitter:
+            return min(max(max(base + noise(seed, x, y, t) % 3 - 1, 0), 16), 235)
+        return base
+    return y_of, (cb, cr)
+
+
+def blocks(levels, bw, bh, speed, cb, cr):
+    return (lambda x, y, t: levels[((x + t * speed) // bw + y // bh) % 3]), (cb, cr)
+
+
+def noise_shot(lo, hi, seed, cb, cr):
+    return (lambda x, y, t: lo + noise(seed, x, y, t) % (hi - lo + 1)), (cb, cr)
+
+
+def fixture_spans(name):
+    if name == "cuts-01":
+        a = ramp(20, 100, 1, 1, 1, True, 1, 110, 140)
+        b = ramp(120, 220, 2, 1, 1, True, 2, 150, 120)
+        flash = noise_shot(228, 235, 3, 128, 128)
+        c = ramp(30, 90, 1, 2, 1, True, 4, 120, 120)
+        d = ramp(150, 230, 1, 0, 2, True, 5, 136, 136)
+        e = ramp(40, 120, 0, 1, 1, True, 6, 100, 150)
+        f = ramp(140, 200, 1, 0, 1, True, 7, 160, 110)
+        return 32, 18, [(60, a, None), (30, b, None), (6, flash, None), (44, b, None), (20, c, None), (40, c, d),
+                        (30, d, None), (30, e, None), (30, f, None), (30, e, None), (30, f, None)]
+    if name == "kinds-01":
+        return 32, 18, [(40, ramp(20, 200, 1, 1, 0, False, 0, 128, 128), None),
+                        (40, blocks([40, 120, 200], 8, 6, 1, 128, 128), None),
+                        (40, noise_shot(16, 235, 7, 128, 128), None),
+                        (40, ramp(16, 80, 1, 1, 1, True, 8, 128, 128), None),
+                        (130, ramp(60, 180, 2, 1, 0, False, 0, 140, 116), None)]
+    return None
+
+
+def fixture(name):
+    w, h, spans = fixture_spans(name)
+    cw, ch = (w + 1) // 2, (h + 1) // 2
+    out = bytearray(f"YUV4MPEG2 W{w} H{h} F25:1 Ip A1:1 C420jpeg\n".encode())
+    t = 0
+    for n, (y_of, chroma), to in spans:
+        for i in range(n):
+            out += b"FRAME\n"
+            def blend(a, b):
+                return (a * (n - i - 1) + b * (i + 1)) // n
+            for y in range(h):
+                for x in range(w):
+                    v = y_of(x, y, t)
+                    out.append(blend(v, to[0](x, y, t)) if to else v)
+            cb, cr = chroma
+            if to:
+                cb, cr = blend(cb, to[1][0]), blend(cr, to[1][1])
+            out += bytes([cb]) * (cw * ch) + bytes([cr]) * (cw * ch)
+            t += 1
+    return bytes(out)
+
+
+# ---------------------------------------------------------------- scene cut (§4.3) and kinds (§4.6)
+
+
+def luma(r, g, b):
+    return (77 * r + 150 * g + 29 * b + 128) >> 8
+
+
+def distance(a, b, wh):
+    return sum(abs(x - y) for x, y in zip(a, b)) * 1000 // (2 * wh)
+
+
+def segment(frames, w, h, p):
+    """The on-demand form: every frame known, `last` the final index."""
+    wh = w * h
+    ys = [[luma(f[i], f[i + 1], f[i + 2]) for i in range(0, len(f), 3)] for f in frames]
+    hists = []
+    for y in ys:
+        hh = [0] * 64
+        for v in y:
+            hh[v >> 2] += 1
+        hists.append(hh)
+    n = len(frames)
+    last = n - 1
+    scores = [0] + [distance(hists[f], hists[f - 1], wh) for f in range(1, n)]
+    L = p["lookahead"]
+
+    def rejected(f):
+        if any(distance(hists[f + k], hists[f - 1], wh) < p["cut_abs"] for k in range(1, min(L, last - f) + 1)):
+            return True
+        return any(distance(hists[f], hists[f - 1 - j], wh) < p["cut_abs"] for j in range(1, min(L, f - 1) + 1))
+
+    starts, flags, window, start = [0], [0], [], 0
+    for f in range(1, n):
+        ln, s = f - start, scores[f]
+        med = sorted(window)[(len(window) - 1) // 2] if window else 0
+        hard = ln >= p["min"] and s >= p["cut_abs"] and (len(window) < 3 or s * 1000 >= p["cut_rel"] * med)
+        soft = ln >= p["target"] and 2 * s >= p["cut_abs"]
+        if (hard or soft) and not rejected(f):
+            flag = 1
+        elif ln >= p["max"]:
+            flag = 2
+        else:
+            flag = 0
+        if flag:
+            starts.append(f)
+            flags.append(flag)
+            start, window = f, []
+        else:
+            window = (window + [s])[-p["window"]:]
+    pieces = []
+    for i, st in enumerate(starts):
+        end = starts[i + 1] if i + 1 < len(starts) else n
+        abs_diff = changed = 0
+        for f in range(st + 1, end):
+            for a, b in zip(ys[f], ys[f - 1]):
+                abs_diff += abs(a - b)
+                changed += a != b
+        compared = wh * (end - st - 1)
+        pieces.append({"start": st, "len": end - st, "flags": flags[i], "abs_diff": abs_diff, "changed": changed,
+                       "compared": compared, "occupancy": sum(1 for c in hists[st] if c)})
+    return pieces, scores
+
+
+def classify(pc, c):
+    mad = pc["abs_diff"] * 1000 // pc["compared"] if pc["compared"] else 0
+    chg = pc["changed"] * 1000 // pc["compared"] if pc["compared"] else 0
+    if mad <= c["static_mad_milli"] and chg <= c["static_permille"]:
+        kind = "static"
+    elif pc["occupancy"] <= c["synthetic_bins"]:
+        kind = "synthetic"
+    elif mad >= c["motion_high_milli"]:
+        kind = "motion_high"
+    else:
+        kind = "natural"
+    return kind, mad, chg
+
+
+def plan_digest(starts):
+    b = b"wai:pack-plan\x01" + len(starts).to_bytes(8, "little")
+    for s in starts:
+        b += s.to_bytes(8, "little")
+    return blake3(b).hex()
+
+
+# ---------------------------------------------------------------- the encoder's choices (§5.5, §5.6)
+
+
+def quantize(r, q):
+    """r / q rounded to the nearest integer, halves away from zero."""
+    m = (2 * abs(r) + q) // (2 * q)
+    return -m if r < 0 else m
+
+
+def hist_to_cdf(hist, precision=16):
+    """§5.5's table: every symbol frequency 1 + floor(R·h/H), the remainder one each to the
+    largest R·h mod H (the lower symbol first), the escape 1."""
+    total, n = 1 << precision, len(hist)
+    r = total - n - 1
+    weight = [1] * n if all(h == 0 for h in hist) else list(hist)
+    big_h = sum(weight)
+    freq = [1 + r * x // big_h for x in weight]
+    given = sum(f - 1 for f in freq)
+    order = sorted(range(n), key=lambda i: -(r * weight[i] % big_h))
+    for i in order[:r - given]:
+        freq[i] += 1
+    freq.append(1)
+    cdf, acc = [0], 0
+    for f in freq:
+        acc += f
+        cdf.append(acc)
+    return cdf
+
+
+def residual_table(residuals):
+    """The table and offset of §5.5 from a clip's residuals."""
+    lo, hi = min(residuals), max(residuals)
+    width = min(hi - lo + 1, 4095)
+    hist = [0] * width
+    for r in residuals:
+        if lo <= r < lo + width:
+            hist[r - lo] += 1
+    return hist_to_cdf(hist), lo
+
+
+def clampi(v, lo, hi):
+    return lo if v < lo else hi if v > hi else v
+
+
+def block_rows(ref, h, w, y0, y1, x0, x1, dy, dx, prec):
+    """The decoder's prediction (integer-payloads §3) of the rows y0..y1, columns x0..x1
+    of a block from the reference frame `ref` (h·w·3 bytes) with vector (dy, dx): one
+    tuple of R, G, B samples per row."""
+    def cols(xs):
+        return [clampi(x, 0, w - 1) * 3 + c for x in xs for c in range(3)]
+
+    def rowsl(y):
+        k = clampi(y, 0, h - 1) * w * 3
+        return ref[k:k + w * 3]
+    out = []
+    if prec == 1:
+        get = cols(range(x0 + dx, x1 + dx))
+        for y in range(y0, y1):
+            row = rowsl(y + dy)
+            out.append([row[i] for i in get])
+        return out
+    fy, fx = dy & 1, dx & 1
+    ga = cols(range(x0 + (dx >> 1), x1 + (dx >> 1)))
+    gb = cols(range(x0 + (dx >> 1) + 1, x1 + (dx >> 1) + 1))
+    for y in range(y0, y1):
+        iy = y + (dy >> 1)
+        r0 = rowsl(iy)
+        a = [r0[i] for i in ga]
+        if not fy and not fx:
+            out.append(a)
+            continue
+        if not fy:
+            b = [r0[i] for i in gb]
+            out.append([(p + q + 1) >> 1 for p, q in zip(a, b)])
+            continue
+        r1 = rowsl(iy + 1)
+        c = [r1[i] for i in ga]
+        if not fx:
+            out.append([(p + q + 1) >> 1 for p, q in zip(a, c)])
+            continue
+        b = [r0[i] for i in gb]
+        d = [r1[i] for i in gb]
+        out.append([(p + q + s + t + 2) >> 2 for p, q, s, t in zip(a, b, c, d)])
+    return out
+
+
+def search_block(src, ref, h, w, y0, x0, block, rng, prec):
+    """§5.5's motion search for one block: dy outer, dx inner, each ascending over
+    -rng..=rng; the least SAD wins, a tie to the smaller |dy| + |dx|, then the earlier."""
+    y1, x1 = min(y0 + block, h), min(x0 + block, w)
+    srows = [src[(y * w + x0) * 3:(y * w + x1) * 3] for y in range(y0, y1)]
+    best = None  # (cost, l1, dy, dx)
+    for dy in range(-rng, rng + 1):
+        for dx in range(-rng, rng + 1):
+            cost = 0
+            for s, p in zip(srows, block_rows(ref, h, w, y0, y1, x0, x1, dy, dx, prec)):
+                cost += sum(abs(a - b) for a, b in zip(s, p))
+                if best is not None and cost > best[0]:
+                    break
+            l1 = abs(dy) + abs(dx)
+            if best is None or cost < best[0] or (cost == best[0] and l1 < best[1]):
+                best = (cost, l1, dy, dx)
+    return best[2], best[3]
+
+
+def frame_pred(ref, h, w, block, mvs, prec):
+    """A whole frame's prediction from `ref` with its blocks' vectors (raster order)."""
+    pred = [0] * (h * w * 3)
+    nbx = -(-w // block)
+    for by in range(-(-h // block)):
+        for bx in range(nbx):
+            y0, x0 = by * block, bx * block
+            y1, x1 = min(y0 + block, h), min(x0 + block, w)
+            dy, dx = mvs[by * nbx + bx]
+            for y, row in zip(range(y0, y1), block_rows(ref, h, w, y0, y1, x0, x1, dy, dx, prec)):
+                pred[(y * w + x0) * 3:(y * w + x1) * 3] = row
+    return pred
+
+
+def frame_vectors(src, ref, h, w, block, rng, prec):
+    nbx, nby = -(-w // block), -(-h // block)
+    return [search_block(src, ref, h, w, by * block, bx * block, block, rng, prec) for by in range(nby) for bx in range(nbx)]
+
+
+def closed_loop(frames, h, w, block, search, prec, q):
+    """The encoder's reconstruction and its SSE (§5.5), without the entropy coder: each
+    frame's vectors searched against the previous frame as reconstructed."""
+    if len(frames) == 1:
+        block, prec = 1, 1
+    rng = search * prec if len(frames) > 1 else 0
+    recon, sse = [], 0
+    for f, src in enumerate(frames):
+        if f == 0:
+            pred = [128] * len(src)
+        else:
+            mvs = frame_vectors(src, recon[f - 1], h, w, block, rng, prec)
+            pred = frame_pred(recon[f - 1], h, w, block, mvs, prec)
+        cur = []
+        for t, p in zip(src, pred):
+            v = clampi(p + quantize(t - p, q) * q, 0, 255)
+            sse += (t - v) * (t - v)
+            cur.append(v)
+        recon.append(cur)
+    return recon, sse
+
+
+def encoder_choices(v, params, src, decoded):
+    """Item by item, what §5.5 makes of the source against the payload: every motion
+    vector, every coded residual, and the table and its offset. Returns the failures."""
+    h, w, n, q, prec, block = v["h"], v["w"], v["n_frames"], v["q"], v["mv_precision"], v["block"]
+    bad = []
+    rng = params["search"] * prec if n > 1 else 0
+    nb = -(-h // block) * -(-w // block)
+    d = IPV.Rans(v["rans"])
+    residuals = []
+    for f in range(n):
+        if f == 0:
+            pred = [128] * (h * w * 3)
+        else:
+            mvs = frame_vectors(src[f], decoded[f - 1], h, w, block, rng, prec)
+            if mvs != [tuple(m) for m in v["mvs"][(f - 1) * nb:f * nb]]:
+                bad.append(f"frame {f}: a motion vector is not the search's")
+            pred = frame_pred(decoded[f - 1], h, w, block, [tuple(m) for m in v["mvs"][(f - 1) * nb:f * nb]], prec)
+        for t, p in zip(src[f], pred):
+            r = quantize(t - p, q)
+            residuals.append(r)
+            if d.decode(v["cdf"], v["offset"]) != r:
+                bad.append(f"frame {f}: a coded residual is not quantize(source - prediction)")
+                return bad
+    cdf, offset = residual_table(residuals)
+    if (cdf, offset) != (list(v["cdf"]), v["offset"]):
+        bad.append("the residual table or its offset is not the fit of the residuals")
+    return bad
+
+
+def sse_px_milli(sse, h, w, n):
+    return sse * 1000 // (3 * h * w * n)
+
+
+def choose_q(metric_of, candidates, bound):
+    """§5.6: the largest candidate meeting the bound, else the smallest."""
+    qs = sorted(set(candidates), reverse=True)
+    for q in qs:
+        if metric_of(q) <= bound:
+            return q
+    return qs[-1]
+
+
+# ---------------------------------------------------------------- the corpus
+
+
+class Report:
+    def __init__(self):
+        self.failures = 0
+        self.checked = 0
+
+    def check(self, ok, what):
+        self.checked += 1
+        if not ok:
+            self.failures += 1
+            print(f"FAIL {what}")
+
+
+def load(path):
+    with open(path, "rb") as f:
+        return f.read()
+
+
+def verify(d):
+    rep = Report()
+    pol = json.loads(load(os.path.join(d, "policy", "expected.json")))
+    for c in pol["cases"]:
+        P = parse_policy_bytes(load(os.path.join(d, "policy", c["file"])))
+        if c.get("overrides", {}).get("royalty_free_only") is not None:
+            P["royalty_free_only"] = c["overrides"]["royalty_free_only"]
+        rep.check(jcs(P) == c["canonical"], f"policy/{c['file']}: canonical JSON")
+        rep.check(digest(P) == c["digest"], f"policy/{c['file']}: digest")
+    names = sorted(n for n in os.listdir(os.path.join(d, "policy")) if n.endswith(".toml"))
+    rep.check(sorted({c["file"] for c in pol["cases"]}) == names, "policy/: every policy is a case")
+    for n in names:
+        try:
+            admit(load(os.path.join(d, "policy", n)))
+            got = "ok"
+        except Refused as r:
+            got = r.code
+        rep.check(got == "ok", f"policy/{n}: a packager accepts it ({got})")
+    for a, b in pol["equal"]:
+        da, db = (digest(parse_policy_bytes(load(os.path.join(d, "policy", f)))) for f in (a, b))
+        rep.check(da == db, f"policy/{a} and {b}: one policy, one digest")
+
+    ref = json.loads(load(os.path.join(d, "refusals", "expected.json")))
+    listed = set()
+    for c in ref["cases"]:
+        listed.add(c["file"])
+        b = load(os.path.join(d, "refusals", c["file"]))
+        if c["file"].startswith("policy/"):
+            try:
+                admit(b)
+                got = "ok"
+            except Refused as r:
+                got = r.code
+        else:
+            got = source_verdict(c["file"], b)
+        rep.check(got == c["reason"] and got != "ok", f"refusals/{c['file']}: {got}, the corpus says {c['reason']}")
+    for sub in ("policy", "source"):
+        for n in os.listdir(os.path.join(d, "refusals", sub)):
+            rep.check(f"{sub}/{n}" in listed, f"refusals/{sub}/{n} is a case")
+
+    conv = json.loads(load(os.path.join(d, "conversions.json")))
+    for c in conv["ms_to_units"]:
+        rep.check(units_from_ms(c["ms"], c["num"], c["den"]) == c["units"], f"ms_to_units {c}")
+    for c in conv["align"]:
+        rep.check(align(c["start"], c["lead"], c["component"]) == c["units"], f"align {c}")
+    for c in conv["y4m_rgb"]:
+        _, _, _, _, frames = read_y4m(load(os.path.join(d, c["file"])))
+        rep.check([hashlib.sha256(f).hexdigest() for f in frames] == c["rgb_sha256"], f"{c['file']}: RGB8 frames")
+
+    sc = json.loads(load(os.path.join(d, "scenecut", "expected.json")))
+    P = parse_policy_bytes(load(os.path.join(d, "scenecut", sc["policy"])))
+    comp = next(c for c in P["component"] if c["id"] == sc["component"])
+    tb = (comp["timebase"]["num"], comp["timebase"]["den"])
+    s = P["segmentation"]
+    p = {"min": units_from_ms(s["min_ms"], *tb), "target": units_from_ms(s["target_ms"], *tb),
+         "max": units_from_ms(s["max_ms"], *tb), "cut_abs": s["cut_abs_permille"], "cut_rel": s["cut_rel_permille"],
+         "window": s["cut_window"], "lookahead": s["lookahead_frames"]}
+    cut = {}
+    for fx in sc["fixtures"]:
+        b = fixture(fx["name"])
+        rep.check(hashlib.sha256(b).hexdigest() == fx["sha256"], f"fixture {fx['name']}: SHA-256")
+        w, h, rate, _, frames = read_y4m(b)
+        rep.check(len(frames) == fx["frames"] and rate == (25, 1), f"fixture {fx['name']}: frames and rate")
+        pieces, scores = segment(frames, w, h, p)
+        rep.check(scores == fx["scores"], f"scenecut {fx['name']}: scores")
+        got = []
+        for pc in pieces:
+            kind, mad, chg = classify(pc, P["classify"])
+            got.append({"start": pc["start"], "len": pc["len"], "flags": pc["flags"], "kind": kind,
+                        "mad_milli": mad, "changed_permille": chg, "occupancy": pc["occupancy"]})
+        rep.check(got == fx["pieces"], f"scenecut {fx['name']}: pieces")
+        rep.check(plan_digest([x["start"] for x in got]) == fx["plan_digest"], f"scenecut {fx['name']}: plan digest")
+        cut[fx["name"]] = (frames, got, w, h)
+
+    enc = json.loads(load(os.path.join(d, "encode", "expected.json")))
+    want = []
+    for fx in sc["fixtures"]:
+        for i, pc in enumerate(cut[fx["name"]][1]):
+            for s in ("a", "b"):
+                want.append((f"{fx['name']}-p{i}-{s}.wiv1", fx["name"], pc["start"], min(pc["len"], ENCODE_FRAMES)))
+    rep.check([(v["file"], v["fixture"], v["first"], v["frames"]) for v in enc["vectors"]] == want,
+              "encode: one vector per piece of each fixture and parameter set, at the piece's first frames")
+    names = sorted(n for n in os.listdir(os.path.join(d, "encode")) if n.endswith(".wiv1"))
+    rep.check(names == sorted(v["file"] for v in enc["vectors"]), "encode/: every payload is a vector")
+    for v in enc["vectors"]:
+        b = load(os.path.join(d, "encode", v["file"]))
+        rep.check(blake3(b).hex() == v["blake3"], f"encode/{v['file']}: BLAKE3")
+        try:
+            w = IPV.parse_wiv1(b, 0)
+            frames = IPV.decode_wiv1_k0(w)
+        except IPV.Refused as e:
+            rep.check(False, f"encode/{v['file']}: refused {e}")
+            continue
+        p = v["params"]
+        head = (w["block"], w["mv_precision"], w["q"], w["n_frames"])
+        rep.check(head == ((p["block"], p["mv_precision"], p["q"], v["frames"]) if v["frames"] > 1 else (1, 1, p["q"], 1)),
+                  f"encode/{v['file']}: the header's block, precision, step and frames")
+        rep.check([hashlib.sha256(f).hexdigest() for f in frames] == v["frame_sha256"], f"encode/{v['file']}: decoded frames")
+        src = cut[v["fixture"]][0][v["first"]:v["first"] + v["frames"]]
+        sse = sum((a - b) ** 2 for s, f in zip(src, frames) for a, b in zip(s, f))
+        rep.check(sse == v["sse"], f"encode/{v['file']}: SSE against the source")
+        for why in encoder_choices(w, p, src, frames):
+            rep.check(False, f"encode/{v['file']}: {why}")
+        rep.check(True, f"encode/{v['file']}: the encoder's choices")
+
+    qc = json.loads(load(os.path.join(d, "qchoice", "expected.json")))
+    cache = {}
+    for s in qc["sets"]:
+        p = s["params"]
+        for pc in s["pieces"]:
+            frames, _, w, h = cut[pc["fixture"]]
+            src = frames[pc["first"]:pc["first"] + pc["frames"]]
+
+            def sse_of(q, pc=pc, src=src, p=p, w=w, h=h):
+                key = (pc["fixture"], pc["first"], pc["frames"], p["block"], p["search"], p["mv_precision"], q)
+                if key not in cache:
+                    _, sse = closed_loop(src, h, w, p["block"], p["search"], p["mv_precision"], q)
+                    cache[key] = (sse, sse_px_milli(sse, h, w, len(src)))
+                return cache[key]
+            got = [{"q": q, "sse": sse_of(q)[0], "sse_px_milli": sse_of(q)[1]} for q in p["q_candidates"]]
+            rep.check(got == pc["candidates"], f"qchoice {pc['fixture']} piece {pc['piece']}: each candidate's SSE")
+            rep.check(choose_q(lambda q: sse_of(q)[1], p["q_candidates"], p["max_sse_px_milli"]) == pc["q"],
+                      f"qchoice {pc['fixture']} piece {pc['piece']} bound {p['max_sse_px_milli']}: the step chosen")
+    return rep
+
+
+def main(argv):
+    if len(argv) != 2:
+        print(__doc__)
+        return 2
+    rep = verify(argv[1])
+    print(f"pack_verify: {rep.checked - rep.failures}/{rep.checked} checks hold")
+    return 0 if rep.failures == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/wai/pack-conformance/policy/eq-defaults-a.toml b/wai/pack-conformance/policy/eq-defaults-a.toml
new file mode 100644
index 000000000..331bbc0c6
--- /dev/null
+++ b/wai/pack-conformance/policy/eq-defaults-a.toml
@@ -0,0 +1,15 @@
+# Every member left to its default.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/policy/eq-defaults-b.toml b/wai/pack-conformance/policy/eq-defaults-b.toml
new file mode 100644
index 000000000..d85466969
--- /dev/null
+++ b/wai/pack-conformance/policy/eq-defaults-b.toml
@@ -0,0 +1,43 @@
+# eq-defaults-a.toml with every default written out: one effective policy.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+royalty_free_only = false
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[segmentation]
+target_ms = 2000
+min_ms = 1000
+max_ms = 4000
+scene_cut = "wai.pack.scenecut/1"
+cut_abs_permille = 300
+cut_rel_permille = 3000
+cut_window = 8
+lookahead_frames = 6
+closed = true
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+params = { block = 16, search = 7, mv_precision = 2, q_candidates = [8], max_sse_px_milli = 0 }
+
+[floor]
+extra_keyframes = false
+
+[live]
+layer_lag_ms = [0]
+
+[defaults]
+deadline_ms = 1500
+
+[classify]
+static_permille = 5
+static_mad_milli = 300
+synthetic_bins = 12
+motion_high_milli = 9000
diff --git a/wai/pack-conformance/policy/eq-spelling-a.toml b/wai/pack-conformance/policy/eq-spelling-a.toml
new file mode 100644
index 000000000..fa71200f9
--- /dev/null
+++ b/wai/pack-conformance/policy/eq-spelling-a.toml
@@ -0,0 +1,40 @@
+# Standard tables, one member per line.
+schema = "wai.pack.policy/1"
+asset_id = "spélling\tid"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+
+[component.timebase]
+num = 25
+den = 1
+
+[segmentation]
+target_ms = 3000
+lookahead_frames = 4
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[ladder.params]
+block = 8
+q_candidates = [12, 6]
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+
+[ladder.params]
+q = 4
+
+[[class]]
+id = "tv"
+max_layer = 1
diff --git a/wai/pack-conformance/policy/eq-spelling-b.toml b/wai/pack-conformance/policy/eq-spelling-b.toml
new file mode 100644
index 000000000..7a88abe8a
--- /dev/null
+++ b/wai/pack-conformance/policy/eq-spelling-b.toml
@@ -0,0 +1,32 @@
+# eq-spelling-a.toml spelled otherwise: inline tables, dotted keys, members in
+# another order, literal strings, a hexadecimal and an underscored integer, comments.
+lead = 'v'   # the lead component
+schema = "wai.pack.policy/1"
+asset_id = "sp\u00e9l\u006cing\u0009id"
+segmentation.lookahead_frames = 0x4
+segmentation.target_ms = 3_000
+
+[[component]]
+timebase = { den = 1, num = 25 }
+media = "video"
+id = "v"
+
+[[ladder]]
+role = "base"
+params.q_candidates = [ 12, 6, ]
+params.block = 0o10
+capability = "wai.video.int_motion"
+component = "v"
+id = "b0"
+
+[[ladder]]
+params = { q = 4 }
+refines = "b0"
+role = "refinement"
+capability = 'wai.video.int_refine'
+component = "v"
+id = "r1"
+
+[[class]]
+max_layer = 1
+id = "tv"
diff --git a/wai/pack-conformance/policy/example.toml b/wai/pack-conformance/policy/example.toml
new file mode 100644
index 000000000..88829e747
--- /dev/null
+++ b/wai/pack-conformance/policy/example.toml
@@ -0,0 +1,131 @@
+# The example policy of extensions/packaging.md §3.3: two components (video lead,
+# audio), a staged video ladder with a still-image rung and a supplied floor, an audio
+# base, three classes, one moment and three rules. Every rung is one a packager may
+# emit (§3.6).
+schema = "wai.pack.policy/1"
+asset_id = "pack-fixture-01"
+royalty_free_only = true
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+source = "src/video.y4m"
+
+[component.timebase]
+num = 25
+den = 1
+
+[[component]]
+id = "a"
+media = "audio"
+source = "src/audio.wav"
+
+[component.timebase]
+num = 48000
+den = 1
+
+[segmentation]
+target_ms = 2000
+min_ms = 1000
+max_ms = 4000
+scene_cut = "wai.pack.scenecut/1"
+cut_abs_permille = 300
+cut_rel_permille = 3000
+cut_window = 8
+lookahead_frames = 6
+closed = true
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+params = { block = 16, search = 7, mv_precision = 2, q_candidates = [16, 12, 8], max_sse_px_milli = 40000 }
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 6 }
+
+[[ladder]]
+id = "r2"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "r1"
+params = { q = 3 }
+
+[[ladder]]
+id = "still"
+component = "v"
+capability = "wai.image.png"
+role = "base"
+params = {}
+
+[[ladder]]
+id = "f0"
+component = "v"
+capability = "wai.video.av1"
+role = "floor"
+params = { source = "supplied" }
+
+[[ladder]]
+id = "ab"
+component = "a"
+capability = "wai.audio.flac"
+role = "base"
+params = { source = "encode" }
+
+[floor]
+supplied_listing = "0000000000000000000000000000000000000000000000000000000000000000"
+extra_keyframes = false
+
+[live]
+layer_lag_ms = [0, 200, 400]
+
+[[class]]
+id = "mobile"
+max_layer = 1
+max_kbps = 900
+
+[[class]]
+id = "tv"
+max_layer = 2
+
+[[class]]
+id = "legacy"
+floor_only = true
+
+[[moment]]
+id = "m-goal"
+from_ms = 30000
+to_ms = 34000
+tags = ["event"]
+
+[[rule]]
+id = "static"
+when = { piece_kind = ["static"] }
+then = { ladder = ["still", "f0"] }
+
+[[rule]]
+id = "motion"
+when = { piece_kind = ["motion_high"] }
+then = { max_layer = 1 }
+
+[[rule]]
+id = "event"
+when = { moment_tag = ["event"] }
+then = { max_layer = 2, deadline_ms = 800 }
+
+[defaults]
+deadline_ms = 1500
+
+[classify]
+static_permille = 5
+static_mad_milli = 300
+synthetic_bins = 12
+motion_high_milli = 9000
diff --git a/wai/pack-conformance/policy/expected.json b/wai/pack-conformance/policy/expected.json
new file mode 100644
index 000000000..af918f9d2
--- /dev/null
+++ b/wai/pack-conformance/policy/expected.json
@@ -0,0 +1,47 @@
+{
+  "cases": [
+    {
+      "file": "eq-defaults-a.toml",
+      "canonical": "{\"asset_id\":\"r\",\"class\":[],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"timebase\":{\"den\":1,\"num\":25}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":16,\"max_sse_px_milli\":0,\"mv_precision\":2,\"q_candidates\":[8],\"search\":7},\"role\":\"base\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0]},\"moment\":[],\"royalty_free_only\":false,\"rule\":[],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":6,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":2000}}",
+      "digest": "5b195d09af5103475411ebd2d438f91e66b63bae230d2c2eafd27e7b99496f87"
+    },
+    {
+      "file": "eq-defaults-b.toml",
+      "canonical": "{\"asset_id\":\"r\",\"class\":[],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"timebase\":{\"den\":1,\"num\":25}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":16,\"max_sse_px_milli\":0,\"mv_precision\":2,\"q_candidates\":[8],\"search\":7},\"role\":\"base\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0]},\"moment\":[],\"royalty_free_only\":false,\"rule\":[],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":6,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":2000}}",
+      "digest": "5b195d09af5103475411ebd2d438f91e66b63bae230d2c2eafd27e7b99496f87"
+    },
+    {
+      "file": "eq-spelling-a.toml",
+      "canonical": "{\"asset_id\":\"spélling\\tid\",\"class\":[{\"floor_only\":false,\"id\":\"tv\",\"max_layer\":1}],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"timebase\":{\"den\":1,\"num\":25}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":8,\"max_sse_px_milli\":0,\"mv_precision\":2,\"q_candidates\":[12,6],\"search\":7},\"role\":\"base\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r1\",\"params\":{\"q\":4},\"refines\":\"b0\",\"role\":\"refinement\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0,0]},\"moment\":[],\"royalty_free_only\":false,\"rule\":[],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":4,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":3000}}",
+      "digest": "23bbf95c100bf114061d7986b113fac020f46b9edd95b53bd5dd99b27aae11c0"
+    },
+    {
+      "file": "eq-spelling-b.toml",
+      "canonical": "{\"asset_id\":\"spélling\\tid\",\"class\":[{\"floor_only\":false,\"id\":\"tv\",\"max_layer\":1}],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"timebase\":{\"den\":1,\"num\":25}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":8,\"max_sse_px_milli\":0,\"mv_precision\":2,\"q_candidates\":[12,6],\"search\":7},\"role\":\"base\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r1\",\"params\":{\"q\":4},\"refines\":\"b0\",\"role\":\"refinement\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0,0]},\"moment\":[],\"royalty_free_only\":false,\"rule\":[],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":4,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":3000}}",
+      "digest": "23bbf95c100bf114061d7986b113fac020f46b9edd95b53bd5dd99b27aae11c0"
+    },
+    {
+      "file": "example.toml",
+      "canonical": "{\"asset_id\":\"pack-fixture-01\",\"class\":[{\"floor_only\":false,\"id\":\"mobile\",\"max_kbps\":900,\"max_layer\":1},{\"floor_only\":false,\"id\":\"tv\",\"max_layer\":2},{\"floor_only\":true,\"id\":\"legacy\",\"max_layer\":0}],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"source\":\"src/video.y4m\",\"timebase\":{\"den\":1,\"num\":25}},{\"id\":\"a\",\"media\":\"audio\",\"source\":\"src/audio.wav\",\"timebase\":{\"den\":1,\"num\":48000}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false,\"supplied_listing\":\"0000000000000000000000000000000000000000000000000000000000000000\"},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":16,\"max_sse_px_milli\":40000,\"mv_precision\":2,\"q_candidates\":[16,12,8],\"search\":7},\"role\":\"base\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r1\",\"params\":{\"q\":6},\"refines\":\"b0\",\"role\":\"refinement\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r2\",\"params\":{\"q\":3},\"refines\":\"r1\",\"role\":\"refinement\"},{\"capability\":\"wai.image.png\",\"component\":\"v\",\"id\":\"still\",\"params\":{},\"role\":\"base\"},{\"capability\":\"wai.video.av1\",\"component\":\"v\",\"id\":\"f0\",\"params\":{\"source\":\"supplied\"},\"role\":\"floor\"},{\"capability\":\"wai.audio.flac\",\"component\":\"a\",\"id\":\"ab\",\"params\":{\"source\":\"encode\"},\"role\":\"base\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0,200,400]},\"moment\":[{\"from_ms\":30000,\"id\":\"m-goal\",\"tags\":[\"event\"],\"to_ms\":34000}],\"royalty_free_only\":true,\"rule\":[{\"id\":\"static\",\"then\":{\"ladder\":[\"still\",\"f0\"]},\"when\":{\"piece_kind\":[\"static\"]}},{\"id\":\"motion\",\"then\":{\"max_layer\":1},\"when\":{\"piece_kind\":[\"motion_high\"]}},{\"id\":\"event\",\"then\":{\"deadline_ms\":800,\"max_layer\":2},\"when\":{\"moment_tag\":[\"event\"]}}],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":6,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":2000}}",
+      "digest": "1997e19e06f6bf191d5de605ba1a4719a3372d5e7a168b5364cc82638d9dd0e9"
+    },
+    {
+      "file": "example.toml",
+      "canonical": "{\"asset_id\":\"pack-fixture-01\",\"class\":[{\"floor_only\":false,\"id\":\"mobile\",\"max_kbps\":900,\"max_layer\":1},{\"floor_only\":false,\"id\":\"tv\",\"max_layer\":2},{\"floor_only\":true,\"id\":\"legacy\",\"max_layer\":0}],\"classify\":{\"motion_high_milli\":9000,\"static_mad_milli\":300,\"static_permille\":5,\"synthetic_bins\":12},\"component\":[{\"id\":\"v\",\"media\":\"video\",\"source\":\"src/video.y4m\",\"timebase\":{\"den\":1,\"num\":25}},{\"id\":\"a\",\"media\":\"audio\",\"source\":\"src/audio.wav\",\"timebase\":{\"den\":1,\"num\":48000}}],\"defaults\":{\"deadline_ms\":1500},\"floor\":{\"extra_keyframes\":false,\"supplied_listing\":\"0000000000000000000000000000000000000000000000000000000000000000\"},\"ladder\":[{\"capability\":\"wai.video.int_motion\",\"component\":\"v\",\"id\":\"b0\",\"params\":{\"block\":16,\"max_sse_px_milli\":40000,\"mv_precision\":2,\"q_candidates\":[16,12,8],\"search\":7},\"role\":\"base\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r1\",\"params\":{\"q\":6},\"refines\":\"b0\",\"role\":\"refinement\"},{\"capability\":\"wai.video.int_refine\",\"component\":\"v\",\"id\":\"r2\",\"params\":{\"q\":3},\"refines\":\"r1\",\"role\":\"refinement\"},{\"capability\":\"wai.image.png\",\"component\":\"v\",\"id\":\"still\",\"params\":{},\"role\":\"base\"},{\"capability\":\"wai.video.av1\",\"component\":\"v\",\"id\":\"f0\",\"params\":{\"source\":\"supplied\"},\"role\":\"floor\"},{\"capability\":\"wai.audio.flac\",\"component\":\"a\",\"id\":\"ab\",\"params\":{\"source\":\"encode\"},\"role\":\"base\"}],\"lead\":\"v\",\"live\":{\"layer_lag_ms\":[0,200,400]},\"moment\":[{\"from_ms\":30000,\"id\":\"m-goal\",\"tags\":[\"event\"],\"to_ms\":34000}],\"royalty_free_only\":false,\"rule\":[{\"id\":\"static\",\"then\":{\"ladder\":[\"still\",\"f0\"]},\"when\":{\"piece_kind\":[\"static\"]}},{\"id\":\"motion\",\"then\":{\"max_layer\":1},\"when\":{\"piece_kind\":[\"motion_high\"]}},{\"id\":\"event\",\"then\":{\"deadline_ms\":800,\"max_layer\":2},\"when\":{\"moment_tag\":[\"event\"]}}],\"schema\":\"wai.pack.policy/1\",\"segmentation\":{\"closed\":true,\"cut_abs_permille\":300,\"cut_rel_permille\":3000,\"cut_window\":8,\"lookahead_frames\":6,\"max_ms\":4000,\"min_ms\":1000,\"scene_cut\":\"wai.pack.scenecut/1\",\"target_ms\":2000}}",
+      "digest": "53d2fb3b7ad5cfb211e86baaf4faec205b1332b0fe6875d9525c04ff021187bd",
+      "overrides": {
+        "royalty_free_only": false
+      }
+    }
+  ],
+  "equal": [
+    [
+      "eq-defaults-a.toml",
+      "eq-defaults-b.toml"
+    ],
+    [
+      "eq-spelling-a.toml",
+      "eq-spelling-b.toml"
+    ]
+  ]
+}
diff --git a/wai/pack-conformance/policy_diff.py b/wai/pack-conformance/policy_diff.py
new file mode 100644
index 000000000..c0dc9c0f1
--- /dev/null
+++ b/wai/pack-conformance/policy_diff.py
@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""The policy reader, differentially: wai-pack against pack_verify.py.
+
+Two sets of policies, each file's verdict (`ok`, or the reason a packager refuses it)
+and, when the policy itself parses, its digest, from `wai-pack policy-verdict`, must
+equal pack_verify.py's:
+
+- byte-level cases: a byte-order mark, bytes that are not UTF-8, integers at and past
+  2^53 and 2^63, nesting at and past the cap in arrays, inline tables and dotted keys,
+  control characters, line endings, NUL, escapes, ids at the byte limit, one id named
+  twice across kinds;
+- seeded random policies with random faults in every table (from a fixed seed).
+
+    python3 policy_diff.py <wai-pack binary> [seed] [count]
+
+Exit status 0 only if every verdict and digest agrees. Python 3.11 or later (tomllib).
+"""
+import os
+import random
+import subprocess
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import pack_verify as PV  # noqa: E402
+
+MIN = '''schema = "wai.pack.policy/1"
+asset_id = "a"
+lead = "v"
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+'''
+
+
+def byte_cases():
+    c = {}
+
+    def case(name, b):
+        c[name] = b.encode() if isinstance(b, str) else b
+    case("min", MIN)
+    case("bom", b"\xef\xbb\xbf" + MIN.encode())
+    case("int-2^53", MIN + "zzz = 9007199254740992\n")
+    case("int-2^63", MIN + "zzz = 9223372036854775808\n")
+    case("int-2^64", MIN + "zzz = 18446744073709551616\n")
+    case("int-i64max", MIN + "zzz = 9223372036854775807\n")
+    case("int-i64min", MIN + "zzz = -9223372036854775808\n")
+    case("hex-int", MIN + "[segmentation]\ntarget_ms = 0x7d0\n")
+    case("nan", MIN + "zzz = nan\n")
+    case("neg-zero", MIN + "[segmentation]\ncut_window = -0\n")
+    case("plus", MIN + "[segmentation]\ncut_window = +8\n")
+    case("non-utf8", MIN.encode() + b"# \xff\xfe comment\n")
+    case("non-utf8-str", MIN.replace('asset_id = "a"', 'asset_id = "a\xff"').encode("latin-1"))
+    case("surrogate-utf8", MIN.encode() + b"# \xed\xa0\x80\n")
+    for d in (31, 32, 33, 60, 79, 80, 200, 3000):
+        case(f"deep-array-{d}", "zzz = " + "[" * d + "]" * d + "\n" + MIN)
+    for d in (31, 32, 200):
+        case(f"deep-inline-{d}", "zzz = " + "{a=" * d + "1" + "}" * d + "\n" + MIN)
+    for d in (31, 32, 2000):
+        case(f"deep-dotted-{d}", "zzz." + ".".join(["a"] * d) + " = 1\n" + MIN)
+    case("deep-after-float", "aaa = 1.5\nzzz = " + "[" * 40 + "]" * 40 + "\n" + MIN)
+    case("dup-key", MIN + "asset_id = \"b\"\n")
+    case("ctrl-del", MIN.replace('asset_id = "a"', 'asset_id = "a\\u007f\\u001f\\b\\f"'))
+    case("u2028", MIN.replace('asset_id = "a"', 'asset_id = "a\\u2028\\u2029"'))
+    case("astral", MIN.replace('asset_id = "a"', 'asset_id = "\\U0001F600"'))
+    case("id-255-bytes", MIN.replace('asset_id = "a"', 'asset_id = "' + "é" * 127 + 'a"'))
+    case("id-256-bytes", MIN.replace('asset_id = "a"', 'asset_id = "' + "é" * 128 + '"'))
+    case("crlf", MIN.replace("\n", "\r\n"))
+    case("lone-cr", MIN.replace("\n", "\r"))
+    case("same-id-across-kinds", MIN.replace('id = "b0"', 'id = "v"'))
+    case("tab-in-literal", MIN.replace('asset_id = "a"', "asset_id = 'a\tb'"))
+    case("float-exp", MIN + "zzz = 1e3\n")
+    case("local-time", MIN + "zzz = 07:32:00\n")
+    case("int-refine-base", MIN.replace("wai.video.int_motion", "wai.video.int_refine"))
+    case("empty", b"")
+    case("nul", MIN.encode() + b"\x00")
+    case("u0000-escape", MIN.replace('asset_id = "a"', 'asset_id = "a\\u0000"'))
+    case("key-unicode", MIN + '"é" = 1\n')
+    case("ladder-empty", MIN.split("[[ladder]]")[0] + "ladder = []\n")
+    case("mixed-array", MIN + 'zzz = [1, "a"]\n')
+    case("params-wrong-type", MIN + "params = 5\n")
+    case("cut-window-2", MIN + "[segmentation]\ncut_window = 2\n")
+    return c
+
+
+CAPS = ["wai.video.int_motion", "wai.video.int_refine", "wai.video.av1", "wai.audio.flac", "wai.image.png",
+        "wai.audio.int_refine", "wai.audio.int_layered", "wai.splat.sog", "wai.video.avc", "wai.video.package",
+        "wai.meta.hdr10plus", "wai.nope"]
+PARAMS = ['{}', '{ block = 8 }', '{ block = 5 }', '{ search = 33 }', '{ q = 6 }', '{ rate = 8000 }',
+          '{ q_candidates = [] }', '{ q_candidates = [16, 12] }', '{ source = "encode" }', '{ bogus = 1 }',
+          '{ to_rate = 48000, q = 64 }']
+KINDS = ['"static"', '"bogus"', '']
+
+
+def random_policy(rng):
+    def biased(seq):
+        seq = list(seq)
+        return seq[0] if (rng.random() < 0.85 and seq) else rng.choice(seq)
+
+    def val(kind):
+        if rng.random() < 0.01:
+            return biased(['1.5', '-3', '9007199254740992', '"x"', 'true', '[]', '{}'])
+        return kind
+
+    q = '"'
+    L = []
+    if rng.random() > 0.03:
+        L.append("schema = " + val(q + "wai.pack.policy/1" + q))
+    if rng.random() > 0.03:
+        L.append("asset_id = " + val(q + biased(["a", "", "x" * 256]) + q))
+    if rng.random() < 0.5:
+        L.append("royalty_free_only = " + val(biased(["true", "false"])))
+    comps = [rng.choice(["v", "a", "v2", "v"]) for _ in range(biased([1, 2, 0, 3]))]
+    lead = rng.choice(comps if rng.random() < 0.95 else comps + ["zz"]) if comps else "v"
+    L.append(f'lead = "{lead}"')
+    if rng.random() < 0.05:
+        L.append("zz_unknown = 1")
+    body = []
+    for c in comps:
+        body += ["[[component]]", f'id = "{c}"', "media = " + val(q + biased(["video", "audio", "bogus"]) + q)]
+        if rng.random() > 0.05:
+            num, den = val(str(biased([25, 0, 48000]))), val(str(biased([1, 1001, 0])))
+            body.append("timebase = { num = " + num + ", den = " + den + " }")
+    if rng.random() < 0.6:
+        body.append("[segmentation]")
+        for k, choices in [("target_ms", [2000, 500, 0]), ("min_ms", [1000, 3000, 0]), ("max_ms", [4000, 100]),
+                           ("cut_abs_permille", [300, 0, 1001]), ("cut_window", [8, 0, 2, 3, 65]),
+                           ("lookahead_frames", [6, 65]), ("closed", ["true", "false"])]:
+            if rng.random() < 0.4:
+                body.append(f"{k} = " + val(str(biased(choices))))
+    rungs = []
+    for i in range(biased([2, 1, 3, 4, 0])):
+        rid = biased([f"r{i}", "r0", "b", "v"])
+        role = rng.choice(["base", "refinement", "base", "floor", "bogus"])
+        rungs.append(rid)
+        comp = rng.choice(comps if rng.random() < 0.95 else comps + ["zz"]) if comps else "v"
+        cap = rng.choice(CAPS[:5] if rng.random() < 0.8 else CAPS)
+        body += ["[[ladder]]", f'id = "{rid}"', f'component = "{comp}"', f'capability = "{cap}"', f'role = "{role}"']
+        if role == "refinement" or rng.random() < 0.1:
+            body.append(f'refines = "{rng.choice(rungs + ["nope"])}"')
+        if rng.random() < 0.5:
+            body.append("params = " + biased(PARAMS))
+    if rng.random() < 0.3:
+        body += ["[live]", "layer_lag_ms = " + biased(["[0]", "[0, 200]", "[0, 200, 400]", "[1]", "[0, 100, 50]"])]
+    for i in range(biased([0, 0, 1, 2])):
+        body += ["[[class]]", f'id = "{biased(["c" + str(i), "c0"])}"']
+        if rng.random() < 0.5:
+            body.append(f"max_layer = {biased([0, 1, 2, 3])}")
+        if rng.random() < 0.3:
+            body.append(f"max_kbps = {biased([1, 0, 900])}")
+    for i in range(biased([0, 0, 1, 2])):
+        body += ["[[moment]]", f'id = "m{i}"', f"from_ms = {biased([0, 100])}", f"to_ms = {biased([0, 100, 200])}"]
+        if rng.random() < 0.5:
+            body.append('tags = ["event"]')
+    for i in range(biased([0, 0, 1, 2, 5])):
+        body += ["[[rule]]", f'id = "{biased(["u" + str(i), "u0"])}"']
+        if rng.random() < 0.5:
+            body.append("when = { piece_kind = [" + biased(KINDS) + "] }")
+        t = []
+        if rng.random() < 0.4:
+            pick = rng.sample(rungs + ["nope"], k=min(2, len(rungs) + 1))
+            t.append("ladder = [" + ", ".join(q + x + q for x in pick) + "]")
+        if rng.random() < 0.4:
+            t.append(f"max_layer = {biased([0, 1, 2])}")
+        if rng.random() < 0.4:
+            t.append(f"deadline_ms = {biased([1, 100, 200, 300, 400, 800])}")
+        if t:
+            body.append("then = { " + ", ".join(t) + " }")
+    if rng.random() < 0.3:
+        body += ["[defaults]", f"deadline_ms = {biased([1500, 1, 0, 150])}"]
+    if rng.random() < 0.2:
+        body += ["[classify]", f"synthetic_bins = {biased([12, 65])}"]
+    return ("\n".join(L + body) + "\n").encode()
+
+
+def python_verdict(b):
+    try:
+        P = PV.parse_policy_bytes(b)
+    except PV.Refused as e:
+        return e.code, "-"
+    try:
+        PV.admit(b)
+        v = "ok"
+    except PV.Refused as e:
+        v = e.code
+    return v, PV.digest(P)
+
+
+def main(argv):
+    if len(argv) < 2:
+        print(__doc__)
+        return 2
+    binary = argv[1]
+    seed = int(argv[2]) if len(argv) > 2 else 1
+    count = int(argv[3]) if len(argv) > 3 else 3000
+    rng = random.Random(seed)
+    cases = list(byte_cases().items()) + [(f"random-{i}", random_policy(rng)) for i in range(count)]
+    bad = 0
+    with tempfile.TemporaryDirectory() as d:
+        paths = {}
+        for name, b in cases:
+            p = os.path.join(d, name + ".toml")
+            with open(p, "wb") as f:
+                f.write(b)
+            paths[p] = (name, b)
+        rust = {}
+        files = list(paths)
+        for k in range(0, len(files), 500):
+            r = subprocess.run([binary, "policy-verdict"] + files[k:k + 500], capture_output=True)
+            if r.returncode != 0:
+                print(r.stderr.decode(errors="replace")[-2000:])
+                return 1
+            for line in r.stdout.decode().splitlines():
+                p, v, dg = line.split("\t")
+                rust[p] = (v, dg)
+        for p, (name, b) in paths.items():
+            py = python_verdict(b)
+            if rust.get(p) != py:
+                bad += 1
+                if bad <= 10:
+                    print(f"DIFF {name}: wai-pack {rust.get(p)}, pack_verify.py {py}")
+    print(f"policy_diff: seed {seed}, {len(cases)} policies, {bad} differences")
+    return 0 if bad == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/wai/pack-conformance/qchoice/expected.json b/wai/pack-conformance/qchoice/expected.json
new file mode 100644
index 000000000..7563bf1f1
--- /dev/null
+++ b/wai/pack-conformance/qchoice/expected.json
@@ -0,0 +1,817 @@
+{
+  "policy": "scenecut/policy.toml",
+  "sets": [
+    {
+      "params": {
+        "block": 8,
+        "search": 1,
+        "mv_precision": 1,
+        "q_candidates": [
+          16,
+          12,
+          8,
+          4
+        ],
+        "max_sse_px_milli": 5000
+      },
+      "pieces": [
+        {
+          "fixture": "cuts-01",
+          "piece": 0,
+          "first": 0,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 392984,
+              "sse_px_milli": 18951
+            },
+            {
+              "q": 12,
+              "sse": 214400,
+              "sse_px_milli": 10339
+            },
+            {
+              "q": 8,
+              "sse": 97272,
+              "sse_px_milli": 4690
+            },
+            {
+              "q": 4,
+              "sse": 26376,
+              "sse_px_milli": 1271
+            }
+          ],
+          "q": 8,
+          "blake3": "2a39ae05e422739effee9c954abf13cb27440d34da97c661486093a15ca815f3"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 1,
+          "first": 60,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 401850,
+              "sse_px_milli": 19379
+            },
+            {
+              "q": 12,
+              "sse": 226928,
+              "sse_px_milli": 10943
+            },
+            {
+              "q": 8,
+              "sse": 99098,
+              "sse_px_milli": 4779
+            },
+            {
+              "q": 4,
+              "sse": 29032,
+              "sse_px_milli": 1400
+            }
+          ],
+          "q": 8,
+          "blake3": "1621b28f137c9f77e3790ffa3973460047a8057e9100d93ba6bf7a3499a8a4a8"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 2,
+          "first": 140,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 449922,
+              "sse_px_milli": 21697
+            },
+            {
+              "q": 12,
+              "sse": 233106,
+              "sse_px_milli": 11241
+            },
+            {
+              "q": 8,
+              "sse": 113634,
+              "sse_px_milli": 5480
+            },
+            {
+              "q": 4,
+              "sse": 30994,
+              "sse_px_milli": 1494
+            }
+          ],
+          "q": 4,
+          "blake3": "472767afea1e2a550ba95b7e61479ea9df27ba678ddd9ded362f6fbda606a2c9"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 3,
+          "first": 230,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 429869,
+              "sse_px_milli": 20730
+            },
+            {
+              "q": 12,
+              "sse": 239373,
+              "sse_px_milli": 11543
+            },
+            {
+              "q": 8,
+              "sse": 112253,
+              "sse_px_milli": 5413
+            },
+            {
+              "q": 4,
+              "sse": 29781,
+              "sse_px_milli": 1436
+            }
+          ],
+          "q": 4,
+          "blake3": "2cc5d4921c6683ad0c24f1ae2c23abd8d299128958453815a4217e5dead14a7e"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 4,
+          "first": 260,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 394448,
+              "sse_px_milli": 19022
+            },
+            {
+              "q": 12,
+              "sse": 217579,
+              "sse_px_milli": 10492
+            },
+            {
+              "q": 8,
+              "sse": 99520,
+              "sse_px_milli": 4799
+            },
+            {
+              "q": 4,
+              "sse": 27310,
+              "sse_px_milli": 1317
+            }
+          ],
+          "q": 8,
+          "blake3": "62599533301038a4e1eaf81a85aebceeae584f0d2c63f61078f4f1b5a585eaed"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 5,
+          "first": 290,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 403995,
+              "sse_px_milli": 19482
+            },
+            {
+              "q": 12,
+              "sse": 228499,
+              "sse_px_milli": 11019
+            },
+            {
+              "q": 8,
+              "sse": 109291,
+              "sse_px_milli": 5270
+            },
+            {
+              "q": 4,
+              "sse": 28451,
+              "sse_px_milli": 1372
+            }
+          ],
+          "q": 4,
+          "blake3": "3a852edd22164f93e7c1dda30ab756214025dfc03d96f1fc908f96dfa94309ff"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 6,
+          "first": 320,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 392855,
+              "sse_px_milli": 18945
+            },
+            {
+              "q": 12,
+              "sse": 224395,
+              "sse_px_milli": 10821
+            },
+            {
+              "q": 8,
+              "sse": 98769,
+              "sse_px_milli": 4763
+            },
+            {
+              "q": 4,
+              "sse": 27902,
+              "sse_px_milli": 1345
+            }
+          ],
+          "q": 8,
+          "blake3": "246de6fad51c9a199195b3d582b73bc3833e301332835faffa71c029292f96aa"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 0,
+          "first": 0,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 475632,
+              "sse_px_milli": 22937
+            },
+            {
+              "q": 12,
+              "sse": 247536,
+              "sse_px_milli": 11937
+            },
+            {
+              "q": 8,
+              "sse": 102384,
+              "sse_px_milli": 4937
+            },
+            {
+              "q": 4,
+              "sse": 34992,
+              "sse_px_milli": 1687
+            }
+          ],
+          "q": 8,
+          "blake3": "70aaa4f64eba86964b89050bb718530f95e84f5a061fb7bbd2adfddf51eb51c3"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 1,
+          "first": 40,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 698112,
+              "sse_px_milli": 33666
+            },
+            {
+              "q": 12,
+              "sse": 311040,
+              "sse_px_milli": 15000
+            },
+            {
+              "q": 8,
+              "sse": 145152,
+              "sse_px_milli": 7000
+            },
+            {
+              "q": 4,
+              "sse": 34560,
+              "sse_px_milli": 1666
+            }
+          ],
+          "q": 4,
+          "blake3": "d558f1575e493632dbf541b0bedf2450beb8ac5d4385d00ae1b35d396a9422ba"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 2,
+          "first": 80,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 437037,
+              "sse_px_milli": 21076
+            },
+            {
+              "q": 12,
+              "sse": 247704,
+              "sse_px_milli": 11945
+            },
+            {
+              "q": 8,
+              "sse": 113172,
+              "sse_px_milli": 5457
+            },
+            {
+              "q": 4,
+              "sse": 30987,
+              "sse_px_milli": 1494
+            }
+          ],
+          "q": 4,
+          "blake3": "a65efbc7e61cda363a4499be32f28e2d824d0604ae7453ec9364b65a24a1a7e5"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 3,
+          "first": 120,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 456189,
+              "sse_px_milli": 21999
+            },
+            {
+              "q": 12,
+              "sse": 230301,
+              "sse_px_milli": 11106
+            },
+            {
+              "q": 8,
+              "sse": 105885,
+              "sse_px_milli": 5106
+            },
+            {
+              "q": 4,
+              "sse": 31293,
+              "sse_px_milli": 1509
+            }
+          ],
+          "q": 4,
+          "blake3": "de3f1b968fe6f338a0e1fd1b5e87821f2ce3bb3597d948996f53b1e7a098c18e"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 4,
+          "first": 160,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 453168,
+              "sse_px_milli": 21854
+            },
+            {
+              "q": 12,
+              "sse": 249264,
+              "sse_px_milli": 12020
+            },
+            {
+              "q": 8,
+              "sse": 111024,
+              "sse_px_milli": 5354
+            },
+            {
+              "q": 4,
+              "sse": 28080,
+              "sse_px_milli": 1354
+            }
+          ],
+          "q": 4,
+          "blake3": "2386abca06f07180f0f23ca84d04e8df1519da6b214781b8f158f22daaeec0ae"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 5,
+          "first": 260,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 453168,
+              "sse_px_milli": 21854
+            },
+            {
+              "q": 12,
+              "sse": 249264,
+              "sse_px_milli": 12020
+            },
+            {
+              "q": 8,
+              "sse": 111024,
+              "sse_px_milli": 5354
+            },
+            {
+              "q": 4,
+              "sse": 28080,
+              "sse_px_milli": 1354
+            }
+          ],
+          "q": 4,
+          "blake3": "2386abca06f07180f0f23ca84d04e8df1519da6b214781b8f158f22daaeec0ae"
+        }
+      ]
+    },
+    {
+      "params": {
+        "block": 8,
+        "search": 1,
+        "mv_precision": 1,
+        "q_candidates": [
+          16,
+          12,
+          8,
+          4
+        ],
+        "max_sse_px_milli": 1300
+      },
+      "pieces": [
+        {
+          "fixture": "cuts-01",
+          "piece": 0,
+          "first": 0,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 392984,
+              "sse_px_milli": 18951
+            },
+            {
+              "q": 12,
+              "sse": 214400,
+              "sse_px_milli": 10339
+            },
+            {
+              "q": 8,
+              "sse": 97272,
+              "sse_px_milli": 4690
+            },
+            {
+              "q": 4,
+              "sse": 26376,
+              "sse_px_milli": 1271
+            }
+          ],
+          "q": 4,
+          "blake3": "e670e2721682f4369cce1edbb516b473c5b662c05d971156a08b0edf19bc8901"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 1,
+          "first": 60,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 401850,
+              "sse_px_milli": 19379
+            },
+            {
+              "q": 12,
+              "sse": 226928,
+              "sse_px_milli": 10943
+            },
+            {
+              "q": 8,
+              "sse": 99098,
+              "sse_px_milli": 4779
+            },
+            {
+              "q": 4,
+              "sse": 29032,
+              "sse_px_milli": 1400
+            }
+          ],
+          "q": 4,
+          "blake3": "d59f21a7bfccf236f903956111e6ce30d78968e0b4c145a1ac627e423a7a4944"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 2,
+          "first": 140,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 449922,
+              "sse_px_milli": 21697
+            },
+            {
+              "q": 12,
+              "sse": 233106,
+              "sse_px_milli": 11241
+            },
+            {
+              "q": 8,
+              "sse": 113634,
+              "sse_px_milli": 5480
+            },
+            {
+              "q": 4,
+              "sse": 30994,
+              "sse_px_milli": 1494
+            }
+          ],
+          "q": 4,
+          "blake3": "472767afea1e2a550ba95b7e61479ea9df27ba678ddd9ded362f6fbda606a2c9"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 3,
+          "first": 230,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 429869,
+              "sse_px_milli": 20730
+            },
+            {
+              "q": 12,
+              "sse": 239373,
+              "sse_px_milli": 11543
+            },
+            {
+              "q": 8,
+              "sse": 112253,
+              "sse_px_milli": 5413
+            },
+            {
+              "q": 4,
+              "sse": 29781,
+              "sse_px_milli": 1436
+            }
+          ],
+          "q": 4,
+          "blake3": "2cc5d4921c6683ad0c24f1ae2c23abd8d299128958453815a4217e5dead14a7e"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 4,
+          "first": 260,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 394448,
+              "sse_px_milli": 19022
+            },
+            {
+              "q": 12,
+              "sse": 217579,
+              "sse_px_milli": 10492
+            },
+            {
+              "q": 8,
+              "sse": 99520,
+              "sse_px_milli": 4799
+            },
+            {
+              "q": 4,
+              "sse": 27310,
+              "sse_px_milli": 1317
+            }
+          ],
+          "q": 4,
+          "blake3": "157a656d6ba75044cefd49e107dbb676a1ef03df5bd3a0aa7cbfb98420e27ca1"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 5,
+          "first": 290,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 403995,
+              "sse_px_milli": 19482
+            },
+            {
+              "q": 12,
+              "sse": 228499,
+              "sse_px_milli": 11019
+            },
+            {
+              "q": 8,
+              "sse": 109291,
+              "sse_px_milli": 5270
+            },
+            {
+              "q": 4,
+              "sse": 28451,
+              "sse_px_milli": 1372
+            }
+          ],
+          "q": 4,
+          "blake3": "3a852edd22164f93e7c1dda30ab756214025dfc03d96f1fc908f96dfa94309ff"
+        },
+        {
+          "fixture": "cuts-01",
+          "piece": 6,
+          "first": 320,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 392855,
+              "sse_px_milli": 18945
+            },
+            {
+              "q": 12,
+              "sse": 224395,
+              "sse_px_milli": 10821
+            },
+            {
+              "q": 8,
+              "sse": 98769,
+              "sse_px_milli": 4763
+            },
+            {
+              "q": 4,
+              "sse": 27902,
+              "sse_px_milli": 1345
+            }
+          ],
+          "q": 4,
+          "blake3": "74bcad209572370ba1b18378e7e4dcae02460fbdf0a271efc7315752a5f28a77"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 0,
+          "first": 0,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 475632,
+              "sse_px_milli": 22937
+            },
+            {
+              "q": 12,
+              "sse": 247536,
+              "sse_px_milli": 11937
+            },
+            {
+              "q": 8,
+              "sse": 102384,
+              "sse_px_milli": 4937
+            },
+            {
+              "q": 4,
+              "sse": 34992,
+              "sse_px_milli": 1687
+            }
+          ],
+          "q": 4,
+          "blake3": "ebe7348ac443e7b62193c0f125048b7dd9644e6043a9aa26d36954661d5f090d"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 1,
+          "first": 40,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 698112,
+              "sse_px_milli": 33666
+            },
+            {
+              "q": 12,
+              "sse": 311040,
+              "sse_px_milli": 15000
+            },
+            {
+              "q": 8,
+              "sse": 145152,
+              "sse_px_milli": 7000
+            },
+            {
+              "q": 4,
+              "sse": 34560,
+              "sse_px_milli": 1666
+            }
+          ],
+          "q": 4,
+          "blake3": "d558f1575e493632dbf541b0bedf2450beb8ac5d4385d00ae1b35d396a9422ba"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 2,
+          "first": 80,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 437037,
+              "sse_px_milli": 21076
+            },
+            {
+              "q": 12,
+              "sse": 247704,
+              "sse_px_milli": 11945
+            },
+            {
+              "q": 8,
+              "sse": 113172,
+              "sse_px_milli": 5457
+            },
+            {
+              "q": 4,
+              "sse": 30987,
+              "sse_px_milli": 1494
+            }
+          ],
+          "q": 4,
+          "blake3": "a65efbc7e61cda363a4499be32f28e2d824d0604ae7453ec9364b65a24a1a7e5"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 3,
+          "first": 120,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 456189,
+              "sse_px_milli": 21999
+            },
+            {
+              "q": 12,
+              "sse": 230301,
+              "sse_px_milli": 11106
+            },
+            {
+              "q": 8,
+              "sse": 105885,
+              "sse_px_milli": 5106
+            },
+            {
+              "q": 4,
+              "sse": 31293,
+              "sse_px_milli": 1509
+            }
+          ],
+          "q": 4,
+          "blake3": "de3f1b968fe6f338a0e1fd1b5e87821f2ce3bb3597d948996f53b1e7a098c18e"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 4,
+          "first": 160,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 453168,
+              "sse_px_milli": 21854
+            },
+            {
+              "q": 12,
+              "sse": 249264,
+              "sse_px_milli": 12020
+            },
+            {
+              "q": 8,
+              "sse": 111024,
+              "sse_px_milli": 5354
+            },
+            {
+              "q": 4,
+              "sse": 28080,
+              "sse_px_milli": 1354
+            }
+          ],
+          "q": 4,
+          "blake3": "2386abca06f07180f0f23ca84d04e8df1519da6b214781b8f158f22daaeec0ae"
+        },
+        {
+          "fixture": "kinds-01",
+          "piece": 5,
+          "first": 260,
+          "frames": 12,
+          "candidates": [
+            {
+              "q": 16,
+              "sse": 453168,
+              "sse_px_milli": 21854
+            },
+            {
+              "q": 12,
+              "sse": 249264,
+              "sse_px_milli": 12020
+            },
+            {
+              "q": 8,
+              "sse": 111024,
+              "sse_px_milli": 5354
+            },
+            {
+              "q": 4,
+              "sse": 28080,
+              "sse_px_milli": 1354
+            }
+          ],
+          "q": 4,
+          "blake3": "2386abca06f07180f0f23ca84d04e8df1519da6b214781b8f158f22daaeec0ae"
+        }
+      ]
+    }
+  ]
+}
diff --git a/wai/pack-conformance/refusals/expected.json b/wai/pack-conformance/refusals/expected.json
new file mode 100644
index 000000000..dc59a8eff
--- /dev/null
+++ b/wai/pack-conformance/refusals/expected.json
@@ -0,0 +1,228 @@
+{
+  "cases": [
+    {
+      "file": "policy/capability-candidate.toml",
+      "reason": "capability-candidate:wai.splat.sog"
+    },
+    {
+      "file": "policy/capability-not-payload.toml",
+      "reason": "capability-not-payload:wai.video.package"
+    },
+    {
+      "file": "policy/capability-role.toml",
+      "reason": "capability-role:wai.meta.hdr10plus"
+    },
+    {
+      "file": "policy/capability-unknown.toml",
+      "reason": "capability-unknown:wai.video.nope"
+    },
+    {
+      "file": "policy/class-layer.toml",
+      "reason": "policy-class-layer"
+    },
+    {
+      "file": "policy/dangling-refines.toml",
+      "reason": "policy-dangling-refines"
+    },
+    {
+      "file": "policy/datetime.toml",
+      "reason": "policy-datetime"
+    },
+    {
+      "file": "policy/deadline-unreachable.toml",
+      "reason": "policy-deadline-unreachable"
+    },
+    {
+      "file": "policy/duplicate-id-across-kinds.toml",
+      "reason": "policy-duplicate-id"
+    },
+    {
+      "file": "policy/duplicate-id.toml",
+      "reason": "policy-duplicate-id"
+    },
+    {
+      "file": "policy/float.toml",
+      "reason": "policy-float"
+    },
+    {
+      "file": "policy/integer-range.toml",
+      "reason": "policy-integer-range"
+    },
+    {
+      "file": "policy/ladder-component.toml",
+      "reason": "policy-ladder-component"
+    },
+    {
+      "file": "policy/layer-lag.toml",
+      "reason": "policy-layer-lag"
+    },
+    {
+      "file": "policy/lead.toml",
+      "reason": "policy-lead"
+    },
+    {
+      "file": "policy/license-refused.toml",
+      "reason": "license-refused:wai.video.avc:patent-pool"
+    },
+    {
+      "file": "policy/missing-key.toml",
+      "reason": "policy-missing-key"
+    },
+    {
+      "file": "policy/negative.toml",
+      "reason": "policy-negative"
+    },
+    {
+      "file": "policy/no-base.toml",
+      "reason": "policy-no-base"
+    },
+    {
+      "file": "policy/open-gop.toml",
+      "reason": "policy-open-gop"
+    },
+    {
+      "file": "policy/piece-bounds.toml",
+      "reason": "policy-piece-bounds"
+    },
+    {
+      "file": "policy/refines-base.toml",
+      "reason": "policy-refines-base"
+    },
+    {
+      "file": "policy/refines-branch.toml",
+      "reason": "policy-refines-branch"
+    },
+    {
+      "file": "policy/refines-cycle.toml",
+      "reason": "policy-refines-cycle"
+    },
+    {
+      "file": "policy/refines-role.toml",
+      "reason": "policy-refines-role"
+    },
+    {
+      "file": "policy/rule-ladder.toml",
+      "reason": "policy-rule-ladder"
+    },
+    {
+      "file": "policy/schema.toml",
+      "reason": "policy-schema"
+    },
+    {
+      "file": "policy/toml-bom.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml-depth-33.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml-depth-80.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml-duplicate-key.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml-integer-64.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml-non-utf8.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/toml.toml",
+      "reason": "policy-toml"
+    },
+    {
+      "file": "policy/too-many-components.toml",
+      "reason": "policy-too-many-components"
+    },
+    {
+      "file": "policy/too-many-deadlines.toml",
+      "reason": "policy-too-many-deadlines"
+    },
+    {
+      "file": "policy/too-many-moments.toml",
+      "reason": "policy-too-many-moments"
+    },
+    {
+      "file": "policy/too-many-rules.toml",
+      "reason": "policy-too-many-rules"
+    },
+    {
+      "file": "policy/type.toml",
+      "reason": "policy-type"
+    },
+    {
+      "file": "policy/unknown-key-params.toml",
+      "reason": "policy-unknown-key"
+    },
+    {
+      "file": "policy/unknown-key.toml",
+      "reason": "policy-unknown-key"
+    },
+    {
+      "file": "policy/value-block.toml",
+      "reason": "policy-value"
+    },
+    {
+      "file": "policy/value-cut-window.toml",
+      "reason": "policy-value"
+    },
+    {
+      "file": "policy/value-media.toml",
+      "reason": "policy-value"
+    },
+    {
+      "file": "source/y4m-header.y4m",
+      "reason": "y4m-header"
+    },
+    {
+      "file": "source/y4m-interlaced.y4m",
+      "reason": "y4m-interlaced"
+    },
+    {
+      "file": "source/y4m-interlaced-frame.y4m",
+      "reason": "y4m-interlaced"
+    },
+    {
+      "file": "source/y4m-colorspace.y4m",
+      "reason": "y4m-colorspace"
+    },
+    {
+      "file": "source/y4m-size-change.y4m",
+      "reason": "y4m-size-change"
+    },
+    {
+      "file": "source/y4m-truncated.y4m",
+      "reason": "y4m-truncated"
+    },
+    {
+      "file": "source/wav-format-float.wav",
+      "reason": "wav-format"
+    },
+    {
+      "file": "source/wav-format-8bit.wav",
+      "reason": "wav-format"
+    },
+    {
+      "file": "source/wav-truncated.wav",
+      "reason": "wav-truncated"
+    },
+    {
+      "file": "source/wav-format-channels-32768.wav",
+      "reason": "wav-format"
+    },
+    {
+      "file": "source/wav-format-channels-32769.wav",
+      "reason": "wav-format"
+    },
+    {
+      "file": "source/wav-truncated-huge-data.wav",
+      "reason": "wav-truncated"
+    }
+  ]
+}
diff --git a/wai/pack-conformance/refusals/policy/capability-candidate.toml b/wai/pack-conformance/refusals/policy/capability-candidate.toml
new file mode 100644
index 000000000..91c145693
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/capability-candidate.toml
@@ -0,0 +1,15 @@
+# Refused: a candidate capability, whose payload format is not pinned.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.splat.sog"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/capability-not-payload.toml b/wai/pack-conformance/refusals/policy/capability-not-payload.toml
new file mode 100644
index 000000000..cd6f1b9d6
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/capability-not-payload.toml
@@ -0,0 +1,15 @@
+# Refused: a registered record, which names no payload format.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.package"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/capability-role.toml b/wai/pack-conformance/refusals/policy/capability-role.toml
new file mode 100644
index 000000000..ee6cf4598
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/capability-role.toml
@@ -0,0 +1,15 @@
+# Refused: a companion-only capability as a base.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.meta.hdr10plus"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/capability-unknown.toml b/wai/pack-conformance/refusals/policy/capability-unknown.toml
new file mode 100644
index 000000000..b7400a334
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/capability-unknown.toml
@@ -0,0 +1,15 @@
+# Refused: a capability SPEC §5 does not register.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.nope"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/class-layer.toml b/wai/pack-conformance/refusals/policy/class-layer.toml
new file mode 100644
index 000000000..136b935bf
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/class-layer.toml
@@ -0,0 +1,19 @@
+# Refused: a class layer no rung reaches.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[class]]
+id = "tv"
+max_layer = 1
diff --git a/wai/pack-conformance/refusals/policy/dangling-refines.toml b/wai/pack-conformance/refusals/policy/dangling-refines.toml
new file mode 100644
index 000000000..b499d2b2e
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/dangling-refines.toml
@@ -0,0 +1,23 @@
+# Refused: refines names no rung.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "nope"
+params = { q = 4 }
diff --git a/wai/pack-conformance/refusals/policy/datetime.toml b/wai/pack-conformance/refusals/policy/datetime.toml
new file mode 100644
index 000000000..0b38cd87d
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/datetime.toml
@@ -0,0 +1,20 @@
+# Refused: a date-time.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[moment]]
+id = "m"
+from_ms = 1979-05-27T07:32:00Z
+to_ms = 5
diff --git a/wai/pack-conformance/refusals/policy/deadline-unreachable.toml b/wai/pack-conformance/refusals/policy/deadline-unreachable.toml
new file mode 100644
index 000000000..0a15bf0a5
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/deadline-unreachable.toml
@@ -0,0 +1,29 @@
+# Refused: a deadline layer 1 cannot meet.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 4 }
+
+[live]
+layer_lag_ms = [0, 300]
+
+[defaults]
+deadline_ms = 300
diff --git a/wai/pack-conformance/refusals/policy/duplicate-id-across-kinds.toml b/wai/pack-conformance/refusals/policy/duplicate-id-across-kinds.toml
new file mode 100644
index 000000000..e34fce225
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/duplicate-id-across-kinds.toml
@@ -0,0 +1,15 @@
+# Refused: a component and a rung both named v.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "v"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/duplicate-id.toml b/wai/pack-conformance/refusals/policy/duplicate-id.toml
new file mode 100644
index 000000000..845deb40f
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/duplicate-id.toml
@@ -0,0 +1,21 @@
+# Refused: two rungs named b0.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.image.png"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/float.toml b/wai/pack-conformance/refusals/policy/float.toml
new file mode 100644
index 000000000..35a9ea778
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/float.toml
@@ -0,0 +1,18 @@
+# Refused: a float.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[segmentation]
+target_ms = 2000.0
diff --git a/wai/pack-conformance/refusals/policy/integer-range.toml b/wai/pack-conformance/refusals/policy/integer-range.toml
new file mode 100644
index 000000000..2945d89af
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/integer-range.toml
@@ -0,0 +1,18 @@
+# Refused: an integer past 2^53 - 1.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[segmentation]
+max_ms = 9007199254740992
diff --git a/wai/pack-conformance/refusals/policy/ladder-component.toml b/wai/pack-conformance/refusals/policy/ladder-component.toml
new file mode 100644
index 000000000..a56a17b01
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/ladder-component.toml
@@ -0,0 +1,21 @@
+# Refused: a rung of a component the policy does not define.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "x0"
+component = "x"
+capability = "wai.image.png"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/layer-lag.toml b/wai/pack-conformance/refusals/policy/layer-lag.toml
new file mode 100644
index 000000000..2d88186ef
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/layer-lag.toml
@@ -0,0 +1,26 @@
+# Refused: a first layer lag that is not 0.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 4 }
+
+[live]
+layer_lag_ms = [100, 200]
diff --git a/wai/pack-conformance/refusals/policy/lead.toml b/wai/pack-conformance/refusals/policy/lead.toml
new file mode 100644
index 000000000..9b7953ee7
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/lead.toml
@@ -0,0 +1,15 @@
+# Refused: a lead that names no component.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "x"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/license-refused.toml b/wai/pack-conformance/refusals/policy/license-refused.toml
new file mode 100644
index 000000000..51685a95b
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/license-refused.toml
@@ -0,0 +1,16 @@
+# Refused: under royalty_free_only, a capability the registry classifies otherwise.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+royalty_free_only = true
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.avc"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/missing-key.toml b/wai/pack-conformance/refusals/policy/missing-key.toml
new file mode 100644
index 000000000..f54080164
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/missing-key.toml
@@ -0,0 +1,14 @@
+# Refused: a component with no timebase.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/negative.toml b/wai/pack-conformance/refusals/policy/negative.toml
new file mode 100644
index 000000000..ec7a9d36a
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/negative.toml
@@ -0,0 +1,18 @@
+# Refused: a negative integer.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[defaults]
+deadline_ms = -5
diff --git a/wai/pack-conformance/refusals/policy/no-base.toml b/wai/pack-conformance/refusals/policy/no-base.toml
new file mode 100644
index 000000000..749dbc017
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/no-base.toml
@@ -0,0 +1,26 @@
+# Refused: a component with no base rung.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[component]]
+id = "a"
+media = "audio"
+timebase = { num = 48000, den = 1 }
+
+[[ladder]]
+id = "af"
+component = "a"
+capability = "wai.audio.flac"
+role = "floor"
diff --git a/wai/pack-conformance/refusals/policy/open-gop.toml b/wai/pack-conformance/refusals/policy/open-gop.toml
new file mode 100644
index 000000000..5e6b16a54
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/open-gop.toml
@@ -0,0 +1,18 @@
+# Refused: pieces that are not closed.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[segmentation]
+closed = false
diff --git a/wai/pack-conformance/refusals/policy/piece-bounds.toml b/wai/pack-conformance/refusals/policy/piece-bounds.toml
new file mode 100644
index 000000000..7e2cca573
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/piece-bounds.toml
@@ -0,0 +1,18 @@
+# Refused: min_ms above target_ms.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[segmentation]
+min_ms = 3000
diff --git a/wai/pack-conformance/refusals/policy/refines-base.toml b/wai/pack-conformance/refusals/policy/refines-base.toml
new file mode 100644
index 000000000..8ec664cdc
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/refines-base.toml
@@ -0,0 +1,29 @@
+# Refused: a refinement of a floor.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "f0"
+component = "v"
+capability = "wai.video.av1"
+role = "floor"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "f0"
+params = { q = 4 }
diff --git a/wai/pack-conformance/refusals/policy/refines-branch.toml b/wai/pack-conformance/refusals/policy/refines-branch.toml
new file mode 100644
index 000000000..b40dc7727
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/refines-branch.toml
@@ -0,0 +1,31 @@
+# Refused: two refinements of one base.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 3 }
+
+[[ladder]]
+id = "r2"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 4 }
diff --git a/wai/pack-conformance/refusals/policy/refines-cycle.toml b/wai/pack-conformance/refusals/policy/refines-cycle.toml
new file mode 100644
index 000000000..eaeba0c78
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/refines-cycle.toml
@@ -0,0 +1,31 @@
+# Refused: two refinements that refine each other.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "r2"
+params = { q = 4 }
+
+[[ladder]]
+id = "r2"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "r1"
+params = { q = 4 }
diff --git a/wai/pack-conformance/refusals/policy/refines-role.toml b/wai/pack-conformance/refusals/policy/refines-role.toml
new file mode 100644
index 000000000..20863a827
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/refines-role.toml
@@ -0,0 +1,22 @@
+# Refused: a refinement that refines nothing.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+params = { q = 4 }
diff --git a/wai/pack-conformance/refusals/policy/rule-ladder.toml b/wai/pack-conformance/refusals/policy/rule-ladder.toml
new file mode 100644
index 000000000..5882304a9
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/rule-ladder.toml
@@ -0,0 +1,25 @@
+# Refused: a rule ladder with no base.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "f0"
+component = "v"
+capability = "wai.video.av1"
+role = "floor"
+
+[[rule]]
+id = "x"
+then = { ladder = ["f0"] }
diff --git a/wai/pack-conformance/refusals/policy/schema.toml b/wai/pack-conformance/refusals/policy/schema.toml
new file mode 100644
index 000000000..ff06874b1
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/schema.toml
@@ -0,0 +1,15 @@
+# Refused: another schema.
+schema = "wai.pack.policy/2"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-bom.toml b/wai/pack-conformance/refusals/policy/toml-bom.toml
new file mode 100644
index 000000000..cf49c98cb
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-bom.toml
@@ -0,0 +1,15 @@
+# Refused: a byte-order mark before the document.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-depth-33.toml b/wai/pack-conformance/refusals/policy/toml-depth-33.toml
new file mode 100644
index 000000000..be2358f50
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-depth-33.toml
@@ -0,0 +1,16 @@
+# Refused: arrays nested to depth 33 (the document's table is depth 1).
+zzz = [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-depth-80.toml b/wai/pack-conformance/refusals/policy/toml-depth-80.toml
new file mode 100644
index 000000000..0989938c0
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-depth-80.toml
@@ -0,0 +1,16 @@
+# Refused: arrays nested to depth 80 (the document's table is depth 1).
+zzz = [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-duplicate-key.toml b/wai/pack-conformance/refusals/policy/toml-duplicate-key.toml
new file mode 100644
index 000000000..de75978d7
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-duplicate-key.toml
@@ -0,0 +1,16 @@
+# Refused: not TOML (a key defined twice).
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-integer-64.toml b/wai/pack-conformance/refusals/policy/toml-integer-64.toml
new file mode 100644
index 000000000..1e34075ee
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-integer-64.toml
@@ -0,0 +1,16 @@
+# Refused: an integer outside TOML's 64-bit range (2^63).
+zzz = 9223372036854775808
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml-non-utf8.toml b/wai/pack-conformance/refusals/policy/toml-non-utf8.toml
new file mode 100644
index 000000000..e5a8709e3
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml-non-utf8.toml
@@ -0,0 +1,15 @@
+# Refused: bytes that are not UTF-8 (in this comment: ÿþ).
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/toml.toml b/wai/pack-conformance/refusals/policy/toml.toml
new file mode 100644
index 000000000..72d1d424f
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/toml.toml
@@ -0,0 +1,15 @@
+# Refused: not TOML (an unterminated string).
+schema = "wai.pack.policy/1"
+asset_id = "r
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/too-many-components.toml b/wai/pack-conformance/refusals/policy/too-many-components.toml
new file mode 100644
index 000000000..56da5945f
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/too-many-components.toml
@@ -0,0 +1,55 @@
+# Refused: nine components.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[component]]
+id = "c0"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c1"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c2"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c3"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c4"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c5"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c6"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[component]]
+id = "c7"
+media = "video"
+timebase = { num = 25, den = 1 }
diff --git a/wai/pack-conformance/refusals/policy/too-many-deadlines.toml b/wai/pack-conformance/refusals/policy/too-many-deadlines.toml
new file mode 100644
index 000000000..810816194
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/too-many-deadlines.toml
@@ -0,0 +1,39 @@
+# Refused: five distinct deadline values.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[ladder]]
+id = "r1"
+component = "v"
+capability = "wai.video.int_refine"
+role = "refinement"
+refines = "b0"
+params = { q = 4 }
+
+[[rule]]
+id = "d0"
+then = { deadline_ms = 100 }
+
+[[rule]]
+id = "d1"
+then = { deadline_ms = 200 }
+
+[[rule]]
+id = "d2"
+then = { deadline_ms = 300 }
+
+[[rule]]
+id = "d3"
+then = { deadline_ms = 400 }
diff --git a/wai/pack-conformance/refusals/policy/too-many-moments.toml b/wai/pack-conformance/refusals/policy/too-many-moments.toml
new file mode 100644
index 000000000..e331e60a6
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/too-many-moments.toml
@@ -0,0 +1,180 @@
+# Refused: 33 moments.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[moment]]
+id = "m0"
+from_ms = 0
+to_ms = 1
+
+[[moment]]
+id = "m1"
+from_ms = 1
+to_ms = 2
+
+[[moment]]
+id = "m2"
+from_ms = 2
+to_ms = 3
+
+[[moment]]
+id = "m3"
+from_ms = 3
+to_ms = 4
+
+[[moment]]
+id = "m4"
+from_ms = 4
+to_ms = 5
+
+[[moment]]
+id = "m5"
+from_ms = 5
+to_ms = 6
+
+[[moment]]
+id = "m6"
+from_ms = 6
+to_ms = 7
+
+[[moment]]
+id = "m7"
+from_ms = 7
+to_ms = 8
+
+[[moment]]
+id = "m8"
+from_ms = 8
+to_ms = 9
+
+[[moment]]
+id = "m9"
+from_ms = 9
+to_ms = 10
+
+[[moment]]
+id = "m10"
+from_ms = 10
+to_ms = 11
+
+[[moment]]
+id = "m11"
+from_ms = 11
+to_ms = 12
+
+[[moment]]
+id = "m12"
+from_ms = 12
+to_ms = 13
+
+[[moment]]
+id = "m13"
+from_ms = 13
+to_ms = 14
+
+[[moment]]
+id = "m14"
+from_ms = 14
+to_ms = 15
+
+[[moment]]
+id = "m15"
+from_ms = 15
+to_ms = 16
+
+[[moment]]
+id = "m16"
+from_ms = 16
+to_ms = 17
+
+[[moment]]
+id = "m17"
+from_ms = 17
+to_ms = 18
+
+[[moment]]
+id = "m18"
+from_ms = 18
+to_ms = 19
+
+[[moment]]
+id = "m19"
+from_ms = 19
+to_ms = 20
+
+[[moment]]
+id = "m20"
+from_ms = 20
+to_ms = 21
+
+[[moment]]
+id = "m21"
+from_ms = 21
+to_ms = 22
+
+[[moment]]
+id = "m22"
+from_ms = 22
+to_ms = 23
+
+[[moment]]
+id = "m23"
+from_ms = 23
+to_ms = 24
+
+[[moment]]
+id = "m24"
+from_ms = 24
+to_ms = 25
+
+[[moment]]
+id = "m25"
+from_ms = 25
+to_ms = 26
+
+[[moment]]
+id = "m26"
+from_ms = 26
+to_ms = 27
+
+[[moment]]
+id = "m27"
+from_ms = 27
+to_ms = 28
+
+[[moment]]
+id = "m28"
+from_ms = 28
+to_ms = 29
+
+[[moment]]
+id = "m29"
+from_ms = 29
+to_ms = 30
+
+[[moment]]
+id = "m30"
+from_ms = 30
+to_ms = 31
+
+[[moment]]
+id = "m31"
+from_ms = 31
+to_ms = 32
+
+[[moment]]
+id = "m32"
+from_ms = 32
+to_ms = 33
diff --git a/wai/pack-conformance/refusals/policy/too-many-rules.toml b/wai/pack-conformance/refusals/policy/too-many-rules.toml
new file mode 100644
index 000000000..38ed85f67
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/too-many-rules.toml
@@ -0,0 +1,114 @@
+# Refused: 33 rules.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[[rule]]
+id = "r0"
+
+[[rule]]
+id = "r1"
+
+[[rule]]
+id = "r2"
+
+[[rule]]
+id = "r3"
+
+[[rule]]
+id = "r4"
+
+[[rule]]
+id = "r5"
+
+[[rule]]
+id = "r6"
+
+[[rule]]
+id = "r7"
+
+[[rule]]
+id = "r8"
+
+[[rule]]
+id = "r9"
+
+[[rule]]
+id = "r10"
+
+[[rule]]
+id = "r11"
+
+[[rule]]
+id = "r12"
+
+[[rule]]
+id = "r13"
+
+[[rule]]
+id = "r14"
+
+[[rule]]
+id = "r15"
+
+[[rule]]
+id = "r16"
+
+[[rule]]
+id = "r17"
+
+[[rule]]
+id = "r18"
+
+[[rule]]
+id = "r19"
+
+[[rule]]
+id = "r20"
+
+[[rule]]
+id = "r21"
+
+[[rule]]
+id = "r22"
+
+[[rule]]
+id = "r23"
+
+[[rule]]
+id = "r24"
+
+[[rule]]
+id = "r25"
+
+[[rule]]
+id = "r26"
+
+[[rule]]
+id = "r27"
+
+[[rule]]
+id = "r28"
+
+[[rule]]
+id = "r29"
+
+[[rule]]
+id = "r30"
+
+[[rule]]
+id = "r31"
+
+[[rule]]
+id = "r32"
diff --git a/wai/pack-conformance/refusals/policy/type.toml b/wai/pack-conformance/refusals/policy/type.toml
new file mode 100644
index 000000000..0cb2fd5a1
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/type.toml
@@ -0,0 +1,16 @@
+# Refused: a string where a boolean belongs.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+royalty_free_only = "yes"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/unknown-key-params.toml b/wai/pack-conformance/refusals/policy/unknown-key-params.toml
new file mode 100644
index 000000000..47699927c
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/unknown-key-params.toml
@@ -0,0 +1,16 @@
+# Refused: a parameter int_motion does not take.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+params = { block = 16, qp = 3 }
diff --git a/wai/pack-conformance/refusals/policy/unknown-key.toml b/wai/pack-conformance/refusals/policy/unknown-key.toml
new file mode 100644
index 000000000..22b0b6742
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/unknown-key.toml
@@ -0,0 +1,18 @@
+# Refused: a key the schema does not define.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+
+[segmentation]
+keyframe_ms = 2000
diff --git a/wai/pack-conformance/refusals/policy/value-block.toml b/wai/pack-conformance/refusals/policy/value-block.toml
new file mode 100644
index 000000000..8491f9504
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/value-block.toml
@@ -0,0 +1,16 @@
+# Refused: an int_motion block size outside 4, 8, 16, 32.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+params = { block = 12 }
diff --git a/wai/pack-conformance/refusals/policy/value-cut-window.toml b/wai/pack-conformance/refusals/policy/value-cut-window.toml
new file mode 100644
index 000000000..6bc23c40d
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/value-cut-window.toml
@@ -0,0 +1,18 @@
+# Refused: a cut window of 2, under which the relative test never applies.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[segmentation]
+cut_window = 2
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/policy/value-media.toml b/wai/pack-conformance/refusals/policy/value-media.toml
new file mode 100644
index 000000000..f08f55b5c
--- /dev/null
+++ b/wai/pack-conformance/refusals/policy/value-media.toml
@@ -0,0 +1,15 @@
+# Refused: a media class the schema does not list.
+schema = "wai.pack.policy/1"
+asset_id = "r"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "hologram"
+timebase = { num = 25, den = 1 }
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/refusals/source/wav-format-8bit.wav b/wai/pack-conformance/refusals/source/wav-format-8bit.wav
new file mode 100644
index 000000000..3338c1fd9
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-format-8bit.wav differ
diff --git a/wai/pack-conformance/refusals/source/wav-format-channels-32768.wav b/wai/pack-conformance/refusals/source/wav-format-channels-32768.wav
new file mode 100644
index 000000000..11a2bb170
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-format-channels-32768.wav differ
diff --git a/wai/pack-conformance/refusals/source/wav-format-channels-32769.wav b/wai/pack-conformance/refusals/source/wav-format-channels-32769.wav
new file mode 100644
index 000000000..e89a69d96
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-format-channels-32769.wav differ
diff --git a/wai/pack-conformance/refusals/source/wav-format-float.wav b/wai/pack-conformance/refusals/source/wav-format-float.wav
new file mode 100644
index 000000000..2d31a9b01
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-format-float.wav differ
diff --git a/wai/pack-conformance/refusals/source/wav-truncated-huge-data.wav b/wai/pack-conformance/refusals/source/wav-truncated-huge-data.wav
new file mode 100644
index 000000000..0245f6c51
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-truncated-huge-data.wav differ
diff --git a/wai/pack-conformance/refusals/source/wav-truncated.wav b/wai/pack-conformance/refusals/source/wav-truncated.wav
new file mode 100644
index 000000000..3f668bd84
Binary files /dev/null and b/wai/pack-conformance/refusals/source/wav-truncated.wav differ
diff --git a/wai/pack-conformance/refusals/source/y4m-colorspace.y4m b/wai/pack-conformance/refusals/source/y4m-colorspace.y4m
new file mode 100644
index 000000000..e4db1cccf
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-colorspace.y4m
@@ -0,0 +1,3 @@
+YUV4MPEG2 W2 H2 F25:1 C422
+FRAME
+
\ No newline at end of file
diff --git a/wai/pack-conformance/refusals/source/y4m-header.y4m b/wai/pack-conformance/refusals/source/y4m-header.y4m
new file mode 100644
index 000000000..52b3e409d
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-header.y4m
@@ -0,0 +1 @@
+YUV4MPEG W2 H2 F25:1
diff --git a/wai/pack-conformance/refusals/source/y4m-interlaced-frame.y4m b/wai/pack-conformance/refusals/source/y4m-interlaced-frame.y4m
new file mode 100644
index 000000000..fd9ee8e2b
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-interlaced-frame.y4m
@@ -0,0 +1,3 @@
+YUV4MPEG2 W2 H2 F25:1 C420jpeg
+FRAME Ib
+
\ No newline at end of file
diff --git a/wai/pack-conformance/refusals/source/y4m-interlaced.y4m b/wai/pack-conformance/refusals/source/y4m-interlaced.y4m
new file mode 100644
index 000000000..e79c77f25
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-interlaced.y4m
@@ -0,0 +1,3 @@
+YUV4MPEG2 W2 H2 F25:1 It C420jpeg
+FRAME
+
\ No newline at end of file
diff --git a/wai/pack-conformance/refusals/source/y4m-size-change.y4m b/wai/pack-conformance/refusals/source/y4m-size-change.y4m
new file mode 100644
index 000000000..8a3f6c94e
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-size-change.y4m
@@ -0,0 +1,4 @@
+YUV4MPEG2 W2 H2 F25:1 C420jpeg
+FRAME
+FRAME W4
+
\ No newline at end of file
diff --git a/wai/pack-conformance/refusals/source/y4m-truncated.y4m b/wai/pack-conformance/refusals/source/y4m-truncated.y4m
new file mode 100644
index 000000000..b705063c7
--- /dev/null
+++ b/wai/pack-conformance/refusals/source/y4m-truncated.y4m
@@ -0,0 +1,3 @@
+YUV4MPEG2 W2 H2 F25:1 C420jpeg
+FRAME
+
\ No newline at end of file
diff --git a/wai/pack-conformance/scenecut/expected.json b/wai/pack-conformance/scenecut/expected.json
new file mode 100644
index 000000000..b6c42336c
--- /dev/null
+++ b/wai/pack-conformance/scenecut/expected.json
@@ -0,0 +1,783 @@
+{
+  "policy": "policy.toml",
+  "component": "v",
+  "fixtures": [
+    {
+      "name": "cuts-01",
+      "sha256": "d88e954311b77355c4ae980a0c5d1853be34326d5b24c4d74e5c1f69a8f568dd",
+      "frames": 350,
+      "scores": [
+        0,
+        36,
+        46,
+        65,
+        41,
+        39,
+        57,
+        67,
+        45,
+        59,
+        55,
+        60,
+        45,
+        45,
+        53,
+        39,
+        48,
+        48,
+        86,
+        71,
+        64,
+        45,
+        52,
+        55,
+        52,
+        45,
+        53,
+        57,
+        59,
+        78,
+        60,
+        57,
+        60,
+        53,
+        50,
+        48,
+        39,
+        52,
+        48,
+        50,
+        55,
+        52,
+        60,
+        36,
+        52,
+        86,
+        64,
+        38,
+        52,
+        81,
+        41,
+        52,
+        65,
+        67,
+        48,
+        72,
+        59,
+        52,
+        69,
+        64,
+        1000,
+        65,
+        41,
+        59,
+        71,
+        50,
+        64,
+        65,
+        48,
+        53,
+        57,
+        45,
+        55,
+        64,
+        60,
+        38,
+        53,
+        57,
+        57,
+        45,
+        48,
+        39,
+        52,
+        69,
+        46,
+        55,
+        52,
+        45,
+        71,
+        57,
+        1000,
+        48,
+        34,
+        10,
+        20,
+        46,
+        1000,
+        59,
+        71,
+        53,
+        88,
+        86,
+        41,
+        53,
+        55,
+        59,
+        53,
+        53,
+        57,
+        46,
+        72,
+        50,
+        62,
+        55,
+        50,
+        59,
+        52,
+        53,
+        50,
+        46,
+        50,
+        57,
+        67,
+        72,
+        64,
+        55,
+        55,
+        64,
+        74,
+        45,
+        55,
+        65,
+        67,
+        50,
+        74,
+        67,
+        43,
+        43,
+        50,
+        50,
+        1000,
+        48,
+        46,
+        50,
+        62,
+        60,
+        45,
+        45,
+        50,
+        39,
+        55,
+        60,
+        43,
+        52,
+        57,
+        57,
+        62,
+        34,
+        50,
+        59,
+        107,
+        121,
+        170,
+        97,
+        175,
+        81,
+        74,
+        135,
+        95,
+        154,
+        78,
+        90,
+        140,
+        93,
+        149,
+        93,
+        100,
+        116,
+        90,
+        149,
+        81,
+        88,
+        119,
+        85,
+        114,
+        97,
+        83,
+        163,
+        114,
+        140,
+        78,
+        86,
+        138,
+        86,
+        121,
+        98,
+        112,
+        123,
+        102,
+        197,
+        81,
+        72,
+        59,
+        59,
+        52,
+        41,
+        64,
+        53,
+        52,
+        48,
+        60,
+        53,
+        53,
+        41,
+        50,
+        62,
+        60,
+        65,
+        50,
+        45,
+        41,
+        59,
+        59,
+        43,
+        60,
+        52,
+        36,
+        36,
+        46,
+        48,
+        1000,
+        85,
+        100,
+        119,
+        85,
+        83,
+        81,
+        86,
+        97,
+        105,
+        97,
+        111,
+        109,
+        71,
+        97,
+        118,
+        104,
+        86,
+        107,
+        100,
+        79,
+        104,
+        88,
+        116,
+        104,
+        78,
+        76,
+        92,
+        83,
+        71,
+        1000,
+        48,
+        62,
+        71,
+        50,
+        43,
+        39,
+        31,
+        27,
+        52,
+        36,
+        57,
+        43,
+        59,
+        65,
+        62,
+        52,
+        39,
+        46,
+        74,
+        90,
+        74,
+        71,
+        41,
+        20,
+        52,
+        48,
+        52,
+        52,
+        53,
+        1000,
+        104,
+        97,
+        98,
+        116,
+        95,
+        90,
+        90,
+        100,
+        100,
+        83,
+        98,
+        97,
+        105,
+        92,
+        88,
+        92,
+        90,
+        88,
+        86,
+        90,
+        95,
+        90,
+        93,
+        97,
+        92,
+        114,
+        76,
+        86,
+        83,
+        1000,
+        53,
+        64,
+        59,
+        50,
+        71,
+        41,
+        46,
+        57,
+        52,
+        36,
+        60,
+        39,
+        50,
+        67,
+        46,
+        48,
+        43,
+        55,
+        62,
+        46,
+        64,
+        38,
+        52,
+        60,
+        41,
+        52,
+        53,
+        53,
+        46
+      ],
+      "pieces": [
+        {
+          "start": 0,
+          "len": 60,
+          "flags": 0,
+          "kind": "natural",
+          "mad_milli": 5562,
+          "changed_permille": 944,
+          "occupancy": 23
+        },
+        {
+          "start": 60,
+          "len": 80,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 8485,
+          "changed_permille": 991,
+          "occupancy": 30
+        },
+        {
+          "start": 140,
+          "len": 90,
+          "flags": 1,
+          "kind": "motion_high",
+          "mad_milli": 9435,
+          "changed_permille": 974,
+          "occupancy": 19
+        },
+        {
+          "start": 230,
+          "len": 30,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 5911,
+          "changed_permille": 947,
+          "occupancy": 14
+        },
+        {
+          "start": 260,
+          "len": 30,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 4198,
+          "changed_permille": 881,
+          "occupancy": 19
+        },
+        {
+          "start": 290,
+          "len": 30,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 5752,
+          "changed_permille": 942,
+          "occupancy": 14
+        },
+        {
+          "start": 320,
+          "len": 30,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 4205,
+          "changed_permille": 876,
+          "occupancy": 19
+        }
+      ],
+      "plan_digest": "b911c034e31db99779f2547623fd0da9987eea22a5d1a538217b4c7766438816"
+    },
+    {
+      "name": "kinds-01",
+      "sha256": "3f87fcdc5f884095cc1284d2157ddd0f3411ea5760b3ea0fbc782c9303c54604",
+      "frames": 290,
+      "scores": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        937,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        947,
+        192,
+        187,
+        185,
+        189,
+        185,
+        173,
+        182,
+        187,
+        166,
+        206,
+        189,
+        152,
+        197,
+        211,
+        182,
+        178,
+        208,
+        192,
+        220,
+        196,
+        206,
+        164,
+        159,
+        180,
+        215,
+        194,
+        163,
+        159,
+        190,
+        177,
+        163,
+        163,
+        170,
+        171,
+        185,
+        211,
+        166,
+        178,
+        175,
+        701,
+        43,
+        69,
+        53,
+        64,
+        45,
+        46,
+        43,
+        43,
+        72,
+        57,
+        50,
+        52,
+        45,
+        52,
+        83,
+        62,
+        59,
+        69,
+        69,
+        52,
+        39,
+        43,
+        65,
+        62,
+        57,
+        41,
+        50,
+        48,
+        55,
+        60,
+        46,
+        41,
+        57,
+        64,
+        39,
+        67,
+        59,
+        55,
+        65,
+        803,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "pieces": [
+        {
+          "start": 0,
+          "len": 40,
+          "flags": 0,
+          "kind": "static",
+          "mad_milli": 0,
+          "changed_permille": 0,
+          "occupancy": 32
+        },
+        {
+          "start": 40,
+          "len": 40,
+          "flags": 1,
+          "kind": "synthetic",
+          "mad_milli": 15500,
+          "changed_permille": 125,
+          "occupancy": 3
+        },
+        {
+          "start": 80,
+          "len": 40,
+          "flags": 1,
+          "kind": "motion_high",
+          "mad_milli": 85954,
+          "changed_permille": 995,
+          "occupancy": 64
+        },
+        {
+          "start": 120,
+          "len": 40,
+          "flags": 1,
+          "kind": "natural",
+          "mad_milli": 4649,
+          "changed_permille": 897,
+          "occupancy": 20
+        },
+        {
+          "start": 160,
+          "len": 100,
+          "flags": 1,
+          "kind": "static",
+          "mad_milli": 0,
+          "changed_permille": 0,
+          "occupancy": 32
+        },
+        {
+          "start": 260,
+          "len": 30,
+          "flags": 2,
+          "kind": "static",
+          "mad_milli": 0,
+          "changed_permille": 0,
+          "occupancy": 32
+        }
+      ],
+      "plan_digest": "9aa1cba4566b039a1a62e42314a48a9c10dcbca901a94bdae0075c5ec3a42988"
+    }
+  ]
+}
diff --git a/wai/pack-conformance/scenecut/policy.toml b/wai/pack-conformance/scenecut/policy.toml
new file mode 100644
index 000000000..815c2a41a
--- /dev/null
+++ b/wai/pack-conformance/scenecut/policy.toml
@@ -0,0 +1,23 @@
+# The policy the scene-cut vectors are computed under: the fixtures are 25 frames per
+# second, so a piece is 25 to 100 frames, 50 from the target on, with a 6-frame
+# lookahead. Every other member keeps its default.
+schema = "wai.pack.policy/1"
+asset_id = "scenecut-vectors"
+lead = "v"
+
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+
+[segmentation]
+target_ms = 2000
+min_ms = 1000
+max_ms = 4000
+lookahead_frames = 6
+
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
diff --git a/wai/pack-conformance/segment_diff.py b/wai/pack-conformance/segment_diff.py
new file mode 100644
index 000000000..51b473d71
--- /dev/null
+++ b/wai/pack-conformance/segment_diff.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""wai.pack.scenecut/1, differentially: wai-pack's streaming segmenter against
+pack_verify.py's on-demand form.
+
+Seeded random clips (flat and noisy shots, cuts, flashes, small perturbations, empty and
+one-frame clips) under random parameters; every piece (start, length, flags and the
+statistics classification reads) and every score from `wai-pack segment-json`, pushed
+a frame at a time or in a batch, must equal pack_verify.py's, and every piece but the
+last must lie between `min` and `max` frames (the last at most `max`).
+
+    python3 segment_diff.py <wai-pack binary> [seed] [count]
+
+Exit status 0 only if every clip agrees.
+"""
+import json
+import os
+import random
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import pack_verify as PV  # noqa: E402
+
+
+def clip(rng):
+    w, h = rng.randint(1, 5), rng.randint(1, 4)
+    scenes = []
+    for _ in range(rng.randint(1, 5)):
+        if rng.random() < 0.5:
+            scenes.append([rng.randrange(256)] * (w * h * 3))
+        else:
+            scenes.append([rng.randrange(256) for _ in range(w * h * 3)])
+    n = rng.randint(0, 40) if rng.random() < 0.9 else rng.randint(0, 3)
+    frames, cur = [], 0
+    for _ in range(n):
+        if rng.random() < 0.15:
+            cur = rng.randrange(len(scenes))
+        f = scenes[cur]
+        if rng.random() < 0.1:
+            f = scenes[rng.randrange(len(scenes))]
+        if rng.random() < 0.2:
+            f = [min(255, max(0, x + rng.randint(-6, 6))) for x in f]
+        frames.append(list(f))
+    mn = rng.randint(1, 6)
+    tg = mn + rng.randint(0, 6)
+    mx = tg + rng.randint(0, 8)
+    p = {"min": mn, "target": tg, "max": mx, "cut_abs": rng.choice([1, 50, 100, 300, 500, 1000]),
+         "cut_rel": rng.choice([0, 1000, 3000, 1000000]), "window": rng.randint(1, 8), "lookahead": rng.randint(0, 7)}
+    return {"w": w, "h": h, "p": p, "frames": frames, "stream": rng.random() < 0.5}
+
+
+def main(argv):
+    if len(argv) < 2:
+        print(__doc__)
+        return 2
+    binary = argv[1]
+    seed = int(argv[2]) if len(argv) > 2 else 1
+    count = int(argv[3]) if len(argv) > 3 else 2000
+    rng = random.Random(seed)
+    cases = [clip(rng) for _ in range(count)]
+    r = subprocess.run([binary, "segment-json"], input=("\n".join(json.dumps(c) for c in cases) + "\n").encode(),
+                       capture_output=True)
+    outs = r.stdout.decode().splitlines()
+    if r.returncode != 0 or len(outs) != count:
+        print(r.stderr.decode(errors="replace")[-2000:])
+        return 1
+    bad = 0
+    for c, o in zip(cases, outs):
+        ro = json.loads(o)
+        if not c["frames"]:
+            ok = ro["pieces"] == []
+        else:
+            pp, ps = PV.segment(c["frames"], c["w"], c["h"], c["p"])
+            py = [[x["start"], x["len"], x["flags"], x["abs_diff"], x["changed"], x["compared"], x["occupancy"]] for x in pp]
+            ok = py == ro["pieces"] and ps == ro["scores"]
+        pcs = ro["pieces"]
+        for i, x in enumerate(pcs):
+            if x[1] > c["p"]["max"] or (i + 1 < len(pcs) and x[1] < c["p"]["min"]):
+                ok = False
+        if not ok:
+            bad += 1
+            if bad <= 5:
+                print("DIFF", json.dumps(c["p"]), "frames", len(c["frames"]), "stream", c["stream"])
+    print(f"segment_diff: seed {seed}, {count} clips, {bad} differences")
+    return 0 if bad == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/wai/pack-conformance/source_diff.py b/wai/pack-conformance/source_diff.py
new file mode 100644
index 000000000..bb8be4929
--- /dev/null
+++ b/wai/pack-conformance/source_diff.py
@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""The source readers, differentially: wai-pack against pack_verify.py on seeded mutations.
+
+Generates Y4M and WAV files from a fixed seed: headers with every parameter the readers
+treat (dimensions at and past their range, frame rates, interlacing, colour spaces,
+FRAME-line parameters), WAV format chunks with every tag, channel count (2^15 and
+2^16 − 1 among them), sample size, block alignment and chunk length the readers treat,
+chunks in either order, and truncations and single-byte changes of each. Every file's
+verdict from `wai-pack source-verdict` must equal pack_verify.py's, and no reader may
+panic (`PANIC`).
+
+    python3 source_diff.py <wai-pack binary> [seed] [count]
+
+Exit status 0 only if every verdict agrees. The run is reproducible: Python's `random`
+with a fixed seed.
+"""
+import os
+import random
+import struct
+import subprocess
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import pack_verify as PV  # noqa: E402
+
+
+def y4m(rng):
+    w, h = rng.randint(1, 5), rng.randint(1, 5)
+    toks = [b"YUV4MPEG2", b"W%d" % w, b"H%d" % h]
+    c = rng.choice([b"", b" C420jpeg", b" C444", b" C420", b" C422", b" C420p10", b" Cmono"])
+    extra = rng.choice([b"", b" F25:1", b" F0:1", b" F25", b" Ip", b" It", b" I", b" A1:1", b" XYSCSS=420JPEG", b"  ",
+                        b" W0", b" H99999999999", b" W4294967295", b" F4294967296:1"])
+    hdr = b" ".join(toks) + c + extra + b"\n"
+    cw, ch = (w, h) if c == b" C444" else ((w + 1) // 2, (h + 1) // 2)
+    size = w * h + 2 * cw * ch
+    body = b""
+    for _ in range(rng.randint(0, 3)):
+        fl = rng.choice([b"FRAME\n", b"FRAME\n", b"FRAME Ip\n", b"FRAME Ib\n", b"FRAME W4\n", b"FRAME X1\n", b"FRAMEX\n",
+                         b"FRAME  \n", b"FRAME I\n"])
+        body += fl + bytes(rng.randrange(256) for _ in range(size))
+    b = hdr + body
+    r = rng.random()
+    if r < 0.3 and b:
+        b = b[:rng.randrange(len(b))]
+    elif r < 0.5 and b:
+        i = rng.randrange(len(b))
+        b = b[:i] + bytes([rng.randrange(256)]) + b[i + 1:]
+    return b
+
+
+def wav(rng):
+    tag = rng.choice([1, 1, 1, 3, 0xFFFE])
+    ch = rng.choice([1, 2, 6, 0, 32768, 32769, 65535])
+    bits = rng.choice([16, 16, 8, 24])
+    align = rng.choice([2 * ch & 0xFFFF, 2 * ch & 0xFFFF, 0, 4])
+    rate = rng.choice([8000, 0])
+    fl = rng.choice([16, 18, 40, 41, 15, 17])
+    fmt = struct.pack("<HHIIHH", tag, ch, rate, rate * 2 & 0xFFFFFFFF, align, bits) + bytes(max(fl - 16, 0))
+    fmt = fmt[:fl]
+    chunks = []
+    if rng.random() < 0.3:
+        chunks.append(b"LIST" + struct.pack("<I", 3) + b"abc" + (b"\0" if rng.random() < 0.7 else b""))
+    chunks.append(b"fmt " + struct.pack("<I", fl) + fmt + (b"\0" if fl % 2 else b""))
+    nd = rng.randint(0, 3) * 2 * max(ch, 1) if ch < 100 else rng.choice([0, 2 * ch])
+    dl = rng.choice([nd, nd, nd + 1, 0xFFFFFFFE])
+    chunks.append(b"data" + struct.pack("<I", dl & 0xFFFFFFFF) + bytes(nd))
+    if rng.random() < 0.2:
+        chunks.reverse()
+    b = b"RIFF\0\0\0\0WAVE" + b"".join(chunks)
+    if rng.random() < 0.25:
+        b = b[:rng.randrange(len(b))]
+    return b
+
+
+def main(argv):
+    if len(argv) < 2:
+        print(__doc__)
+        return 2
+    binary = argv[1]
+    seed = int(argv[2]) if len(argv) > 2 else 1
+    count = int(argv[3]) if len(argv) > 3 else 3000
+    rng = random.Random(seed)
+    with tempfile.TemporaryDirectory() as d:
+        paths = []
+        for i in range(count):
+            p = os.path.join(d, f"{i}.y4m" if i % 2 else f"{i}.wav")
+            with open(p, "wb") as f:
+                f.write(y4m(rng) if i % 2 else wav(rng))
+            paths.append(p)
+        rust = {}
+        for k in range(0, len(paths), 500):
+            r = subprocess.run([binary, "source-verdict"] + paths[k:k + 500], capture_output=True)
+            if r.returncode != 0:
+                print(r.stderr.decode(errors="replace")[-2000:])
+                return 1
+            for line in r.stdout.decode().splitlines():
+                a, v = line.split("\t")
+                rust[a] = v
+        bad = 0
+        for p in paths:
+            with open(p, "rb") as f:
+                b = f.read()
+            py = PV.source_verdict(p, b)
+            if rust.get(p) != py:
+                bad += 1
+                if bad <= 10:
+                    print(f"DIFF {os.path.basename(p)}: wai-pack {rust.get(p)}, pack_verify.py {py}")
+    print(f"source_diff: seed {seed}, {count} files, {bad} differences")
+    return 0 if bad == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/wai/wai-pack/Cargo.lock b/wai/wai-pack/Cargo.lock
new file mode 100644
index 000000000..bbccb4b60
--- /dev/null
+++ b/wai/wai-pack/Cargo.lock
@@ -0,0 +1,529 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "blake3"
+version = "1.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9e454fc11f76977dc803893aff6304ed33d6a26efae8696573bea74baa27ae"
+dependencies = [
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cbindgen"
+version = "0.29.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ecb53484c9c167ba674026b656d8a27d7657a58e6066aa902bfb1a4aa00ae20"
+dependencies = [
+ "heck",
+ "indexmap",
+ "log",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "syn 2.0.119",
+ "tempfile",
+ "toml 0.9.12+spec-1.1.0",
+]
+
+[[package]]
+name = "cc"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned 1.1.1",
+ "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wai"
+version = "0.3.0"
+dependencies = [
+ "blake3",
+ "cbindgen",
+ "pkg-config",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
+[[package]]
+name = "wai-pack"
+version = "0.1.0"
+dependencies = [
+ "blake3",
+ "serde_json",
+ "sha2",
+ "toml 0.8.23",
+ "wai",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/wai/wai-pack/Cargo.toml b/wai/wai-pack/Cargo.toml
new file mode 100644
index 000000000..6a96e5a27
--- /dev/null
+++ b/wai/wai-pack/Cargo.toml
@@ -0,0 +1,39 @@
+[package]
+name = "wai-pack"
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.97"
+license = "Apache-2.0"
+description = "The reference packager of WAI's packaging extension: a declared policy and its digest, scene-cut segmentation with a bounded lookahead, piece classification, and the conformance corpus that pins them."
+repository = "https://git.transaction.science/Transaction-Science/open-standards"
+publish = false
+
+# Its own workspace and Cargo.lock, like the other crates beside wai-rs.
+[workspace]
+
+[lib]
+name = "wai_pack"
+
+[[bin]]
+name = "wai-pack"
+path = "src/bin/wai_pack.rs"
+
+[dependencies]
+# The standard's crate: canonical JSON and the capability registry (ungated), and the
+# integer video encoder and decoder (video_int). No codec library is linked.
+wai = { path = "../wai-rs", default-features = false, features = ["video_int"] }
+# TOML 1.0 (the 0.8 line; later lines read TOML 1.1, which a policy must not use).
+toml = { version = "0.8", default-features = false, features = ["parse"] }
+serde_json = "1"
+blake3 = "1"
+sha2 = "0.10"
+
+# Release builds check integer overflow as debug builds do, so the release tests in CI
+# catch a wrapped product (a field read as u16 and doubled) rather than run past it.
+[profile.release]
+overflow-checks = true
+
+# R3 of the design: no float decides anything. The library and the CLI deny float
+# arithmetic outright.
+[lints.clippy]
+float_arithmetic = "deny"
diff --git a/wai/wai-pack/deny.toml b/wai/wai-pack/deny.toml
new file mode 100644
index 000000000..e8d0b8c76
--- /dev/null
+++ b/wai/wai-pack/deny.toml
@@ -0,0 +1,36 @@
+# The licences wai-pack's dependency graph may carry, checked in CI by
+# `cargo deny check licenses` (.github/workflows/wai-pack.yml, job `licences`).
+#
+# An allow-list: a licence not named here fails the check, so a dependency under a
+# source-available licence (the Business Source License among them) or a strong
+# copyleft cannot enter the graph unnoticed. Ideas from source-available code are
+# re-implemented from the idea, never depended on.
+
+[graph]
+all-features = true
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MIT",
+    "MIT-0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "CC0-1.0",
+    "Unicode-3.0",
+    "Unlicense",
+]
+confidence-threshold = 0.9
+unused-allowed-license = "allow"
+
+# wai's build script generates its C header with cbindgen, a build-time tool: it is
+# not linked into wai-pack, and its output is not covered by its licence. The exception
+# names the version reviewed; another version fails the check until it is reviewed.
+# CI also asserts that cbindgen reaches wai-pack through no normal (linked) edge
+# (.github/workflows/wai-pack.yml, job `licences`).
+[[licenses.exceptions]]
+crate = "cbindgen@0.29.4"
+allow = ["MPL-2.0"]
diff --git a/wai/wai-pack/src/bin/wai_pack.rs b/wai/wai-pack/src/bin/wai_pack.rs
new file mode 100644
index 000000000..d434c9a57
--- /dev/null
+++ b/wai/wai-pack/src/bin/wai_pack.rs
@@ -0,0 +1,231 @@
+//! `wai-pack`: the reference packager's command line.
+//!
+//! ```text
+//! wai-pack policy <policy.toml> [--royalty-free-only]
+//!     the effective policy's canonical JSON, then its digest; a refused policy, or a
+//!     rung whose capability a packager may not emit, prints its reason and exits 1
+//! wai-pack plan --policy <policy.toml> --component <id> [--source <file.y4m>] [--out <plan.txt>]
+//!     segment a video component with wai.pack.scenecut/1: one piece per line
+//!     (start, frames, flags, kind), then the plan digest
+//! wai-pack policy-verdict <file>...
+//!     each policy's verdict (`ok`, or the reason a packager refuses it) and, when the
+//!     policy itself parses, its digest (else `-`): `<file>\t<verdict>\t<digest>`
+//! wai-pack source-verdict <file>...
+//!     each source's verdict (`ok`, or the reason it is refused), one `<file>\t<verdict>`
+//!     line each; a reader that panics prints `PANIC`
+//! wai-pack segment-json
+//!     a conformance aid: reads JSON lines {"w","h","p":{min,target,max,cut_abs,cut_rel,
+//!     window,lookahead},"frames":[[RGB8 bytes]...],"stream":bool} and writes, per line,
+//!     {"pieces":[[start,len,flags,abs_diff,changed,compared,occupancy]...],"scores":[...]},
+//!     pushing frames one at a time when "stream" is true
+//! wai-pack fixture gen <name> [-o <file>]
+//!     write a conformance fixture (Y4M); `fixture list` names them
+//! wai-pack conformance regen|check <pack-conformance dir>
+//! ```
+
+#![deny(clippy::float_arithmetic)]
+
+use std::path::Path;
+use std::process::ExitCode;
+use wai_pack::policy::{Overrides, Policy};
+use wai_pack::{classify, conformance, fixture, hex, scenecut, source};
+
+fn opt<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
+}
+
+fn usage() -> ExitCode {
+    eprintln!(
+        "usage:\n  wai-pack policy <policy.toml> [--royalty-free-only]\n  \
+         wai-pack plan --policy <policy.toml> --component <id> [--source <file.y4m>] [--out <plan.txt>]\n  \
+         wai-pack policy-verdict <file>...\n  \
+         wai-pack source-verdict <file>...\n  \
+         wai-pack fixture gen <name> [-o <file>] | fixture list\n  \
+         wai-pack conformance regen|check <dir>"
+    );
+    ExitCode::from(2)
+}
+
+fn load_policy(path: &str) -> Result<Policy, String> {
+    let bytes = std::fs::read(path).map_err(|e| format!("{path}: {e}"))?;
+    Policy::parse_bytes(&bytes).map_err(|e| e.to_string())
+}
+
+fn cmd_policy(args: &[String]) -> Result<(), String> {
+    let path = args.first().ok_or("policy: a policy file")?;
+    let o = Overrides { royalty_free_only: args.iter().any(|a| a == "--royalty-free-only").then_some(true) };
+    let p = load_policy(path)?.effective(&o);
+    println!("{}", p.canonical_json());
+    println!("{}", hex(&p.digest()));
+    // The digest is the policy's; whether a packager may emit what it asks is a second
+    // question (packaging §3.6).
+    match wai_pack::capcheck::check(&p) {
+        Ok(()) => Ok(()),
+        Err(v) => Err(v.iter().map(|r| format!("ladder.{}: {}", r.rung, r.code)).collect::<Vec<_>>().join("; ")),
+    }
+}
+
+fn cmd_plan(args: &[String]) -> Result<(), String> {
+    let path = opt(args, "--policy").ok_or("plan: --policy")?;
+    let id = opt(args, "--component").ok_or("plan: --component")?;
+    let p = load_policy(path)?;
+    let c = p.component(id).ok_or_else(|| format!("plan: the policy has no component {id}"))?;
+    let src = opt(args, "--source")
+        .map(str::to_string)
+        .or_else(|| c.source.as_ref().map(|s| Path::new(path).parent().unwrap_or(Path::new(".")).join(s).to_string_lossy().into_owned()))
+        .ok_or("plan: the component names no source; pass --source")?;
+    let file = std::fs::File::open(&src).map_err(|e| format!("{src}: {e}"))?;
+    let mut r = source::y4m::Y4mReader::new(std::io::BufReader::new(file)).map_err(|e| e.to_string())?;
+    if let Some((n, d)) = r.header.rate
+        && (n, d) != (c.timebase.num, c.timebase.den)
+    {
+        return Err(format!("plan: the source's frame rate {n}:{d} is not the component's timebase"));
+    }
+    let mut s = scenecut::Segmenter::new(scenecut::SegParams::from_policy(&p.segmentation, c.timebase), r.header.w, r.header.h);
+    let mut pieces = Vec::new();
+    while let Some(f) = r.next_frame() {
+        pieces.extend(s.push(&f.map_err(|e| e.to_string())?.rgb));
+    }
+    pieces.extend(s.finish());
+    let mut text = String::new();
+    for x in &pieces {
+        let kind = classify::classify(&x.stats, &p.classify).label();
+        text.push_str(&format!("{} {} {} {}\n", x.start, x.len, x.flags, kind));
+    }
+    let starts: Vec<u64> = pieces.iter().map(|x| x.start).collect();
+    match opt(args, "--out") {
+        Some(o) => std::fs::write(o, &text).map_err(|e| format!("{o}: {e}"))?,
+        None => print!("{text}"),
+    }
+    println!("{}", hex(&scenecut::plan_digest(&starts)));
+    Ok(())
+}
+
+fn cmd_policy_verdict(args: &[String]) -> Result<(), String> {
+    for p in args {
+        let b = std::fs::read(p).map_err(|e| format!("{p}: {e}"))?;
+        let v = conformance::policy_verdict(&b);
+        let d = Policy::parse_bytes(&b).map(|x| hex(&x.digest())).unwrap_or_else(|_| "-".into());
+        println!("{p}\t{v}\t{d}");
+    }
+    Ok(())
+}
+
+fn cmd_source_verdict(args: &[String]) -> Result<(), String> {
+    for p in args {
+        let b = std::fs::read(p).map_err(|e| format!("{p}: {e}"))?;
+        let v = std::panic::catch_unwind(|| conformance::source_verdict(p, &b)).unwrap_or("PANIC");
+        println!("{p}\t{v}");
+    }
+    Ok(())
+}
+
+fn cmd_segment_json() -> Result<(), String> {
+    use std::io::BufRead as _;
+    for line in std::io::stdin().lock().lines() {
+        let line = line.map_err(|e| e.to_string())?;
+        let v: serde_json::Value = serde_json::from_str(&line).map_err(|e| e.to_string())?;
+        let n = |x: &serde_json::Value| x.as_u64().ok_or("segment-json: a field is not an integer");
+        let (w, h) = (n(&v["w"])? as u32, n(&v["h"])? as u32);
+        let q = &v["p"];
+        let p = scenecut::SegParams {
+            min: n(&q["min"])?,
+            target: n(&q["target"])?,
+            max: n(&q["max"])?,
+            cut_abs: n(&q["cut_abs"])?,
+            cut_rel: n(&q["cut_rel"])?,
+            window: n(&q["window"])? as usize,
+            lookahead: n(&q["lookahead"])?,
+        };
+        let frames: Vec<Vec<u8>> = v["frames"]
+            .as_array()
+            .ok_or("segment-json: frames")?
+            .iter()
+            .map(|f| f.as_array().map(|a| a.iter().map(|x| x.as_u64().unwrap_or(0) as u8).collect()).unwrap_or_default())
+            .collect();
+        let (pieces, scores) = if v["stream"].as_bool().unwrap_or(false) {
+            let mut s = scenecut::Segmenter::with_scores(p, w, h);
+            let mut out = Vec::new();
+            for f in &frames {
+                out.extend(s.push(f));
+            }
+            let sc = s.scores().to_vec();
+            out.extend(s.finish());
+            (out, sc)
+        } else {
+            scenecut::segment(p, w, h, &frames)
+        };
+        let ps: Vec<serde_json::Value> = pieces
+            .iter()
+            .map(|x| serde_json::json!([x.start, x.len, x.flags, x.stats.abs_diff, x.stats.changed, x.stats.compared, x.stats.occupancy]))
+            .collect();
+        println!("{}", serde_json::json!({"pieces": ps, "scores": scores}));
+    }
+    Ok(())
+}
+
+fn cmd_fixture(args: &[String]) -> Result<(), String> {
+    match args.first().map(String::as_str) {
+        Some("list") => {
+            fixture::NAMES.iter().for_each(|n| println!("{n}"));
+            Ok(())
+        }
+        Some("gen") => {
+            let name = args.get(1).ok_or("fixture gen: a name")?;
+            let b = fixture::generate(name).ok_or_else(|| format!("fixture gen: no fixture {name}"))?;
+            match opt(args, "-o") {
+                Some(o) => std::fs::write(o, b).map_err(|e| format!("{o}: {e}")),
+                None => {
+                    use std::io::Write as _;
+                    std::io::stdout().write_all(&b).map_err(|e| e.to_string())
+                }
+            }
+        }
+        _ => Err("fixture: gen <name> | list".into()),
+    }
+}
+
+fn cmd_conformance(args: &[String]) -> Result<(), String> {
+    let dir = Path::new(args.get(1).ok_or("conformance: a corpus directory")?);
+    match args.first().map(String::as_str) {
+        Some("regen") => conformance::regen(dir).map_err(|e| e.to_string()),
+        Some("check") => {
+            let m = conformance::check(dir).map_err(|e| e.to_string())?;
+            for x in &m {
+                eprintln!("MISMATCH {x}");
+            }
+            if m.is_empty() {
+                println!("pack-conformance: every vector holds");
+                Ok(())
+            } else {
+                Err(format!("{} mismatches", m.len()))
+            }
+        }
+        _ => Err("conformance: regen|check <dir>".into()),
+    }
+}
+
+fn main() -> ExitCode {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let Some(cmd) = args.first() else {
+        return usage();
+    };
+    let rest = &args[1..];
+    let r = match cmd.as_str() {
+        "policy" => cmd_policy(rest),
+        "plan" => cmd_plan(rest),
+        "policy-verdict" => cmd_policy_verdict(rest),
+        "source-verdict" => cmd_source_verdict(rest),
+        "segment-json" => cmd_segment_json(),
+        "fixture" => cmd_fixture(rest),
+        "conformance" => cmd_conformance(rest),
+        _ => return usage(),
+    };
+    match r {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(e) => {
+            eprintln!("wai-pack: {e}");
+            ExitCode::from(1)
+        }
+    }
+}
diff --git a/wai/wai-pack/src/capcheck.rs b/wai/wai-pack/src/capcheck.rs
new file mode 100644
index 000000000..5fb93bd43
--- /dev/null
+++ b/wai/wai-pack/src/capcheck.rs
@@ -0,0 +1,113 @@
+//! What a packager may emit ([packaging] §3.6): only capabilities SPEC §5 registers as
+//! payloads with a pinned format, each in a role it can play, and, under
+//! `royalty_free_only`, only those the registry classifies royalty-free. Read from
+//! the registry of the `wai` crate (`codecs`), never from the policy.
+//!
+//! For each rung in ladder order, the first that holds is its refusal:
+//!
+//! 1. `capability-unknown:<cap>`: SPEC §5 does not register the string.
+//! 2. `capability-not-payload:<cap>`: it is registered as a record or a derivation
+//!    operation, which names no payload format.
+//! 3. `capability-candidate:<cap>`: a candidate, whose payload format no revision has
+//!    pinned (SPEC §5, *Candidate capabilities*); an encoder MUST NOT emit it.
+//! 4. `capability-role:<cap>`: a base or a floor whose capability is not standalone
+//!    media, or a refinement whose capability is not refinement-only.
+//! 5. Under `royalty_free_only`: `license-unclassified:<cap>` where the registry gives
+//!    no licence class, and `license-refused:<cap>:<label>` for any class other than
+//!    royalty-free, with the class's SPEC §5 label.
+//!
+//! [packaging]: ../../../extensions/packaging.md
+
+use crate::policy::{Policy, PolicyError, Role};
+use wai::codecs::{self, Kind, LicenseClass};
+
+/// One rung's refusal: the rung's id and the reason, which names the capability.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CapRefusal {
+    pub rung: String,
+    pub code: String,
+}
+
+/// The refusal of capability `cap` in role `role`, or `None` when a packager may emit it.
+pub fn rung_refusal(cap: &str, role: Role, royalty_free_only: bool) -> Option<String> {
+    match codecs::capability_kind(cap) {
+        None => return Some(format!("capability-unknown:{cap}")),
+        Some(Kind::Record | Kind::Derivation) => return Some(format!("capability-not-payload:{cap}")),
+        Some(Kind::Payload | Kind::Companion | Kind::Refinement) => {}
+    }
+    if codecs::is_candidate(cap) {
+        return Some(format!("capability-candidate:{cap}"));
+    }
+    let want = match role {
+        Role::Base | Role::Floor => "standalone",
+        Role::Refinement => "refinement",
+    };
+    if codecs::capability_role(cap) != Some(want) {
+        return Some(format!("capability-role:{cap}"));
+    }
+    if royalty_free_only {
+        match codecs::capability_license(cap) {
+            None => return Some(format!("license-unclassified:{cap}")),
+            Some(LicenseClass::RoyaltyFree) => {}
+            Some(c) => return Some(format!("license-refused:{cap}:{}", c.label())),
+        }
+    }
+    None
+}
+
+/// Every rung's refusal, in ladder order; `Ok` when there is none.
+pub fn check(p: &Policy) -> Result<(), Vec<CapRefusal>> {
+    let r: Vec<CapRefusal> = p
+        .ladder
+        .iter()
+        .filter_map(|x| rung_refusal(&x.capability, x.role, p.royalty_free_only).map(|code| CapRefusal { rung: x.id.clone(), code }))
+        .collect();
+    if r.is_empty() { Ok(()) } else { Err(r) }
+}
+
+/// Why a packager refuses a policy: the policy itself (§3), or what it asks to emit
+/// (§3.6).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Refused {
+    Policy(PolicyError),
+    Capability(Vec<CapRefusal>),
+}
+
+impl Refused {
+    /// The reason a corpus states: the policy's, or the first rung's.
+    pub fn code(&self) -> String {
+        match self {
+            Refused::Policy(e) => e.code().to_string(),
+            Refused::Capability(v) => v[0].code.clone(),
+        }
+    }
+}
+
+/// A policy a packager accepts, from its bytes: parsed, checked, with the overrides
+/// applied, and every rung emittable.
+pub fn admit(bytes: &[u8], o: &crate::policy::Overrides) -> Result<Policy, Refused> {
+    let p = Policy::parse_bytes(bytes).map_err(Refused::Policy)?.effective(o);
+    check(&p).map_err(Refused::Capability)?;
+    Ok(p)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn each_refusal_in_its_order() {
+        let r = |cap, role, rf| rung_refusal(cap, role, rf);
+        assert_eq!(r("wai.video.int_motion", Role::Base, true), None);
+        assert_eq!(r("wai.video.int_refine", Role::Refinement, true), None);
+        assert_eq!(r("wai.video.av1", Role::Floor, true), None);
+        assert_eq!(r("wai.video.nope", Role::Base, false).unwrap(), "capability-unknown:wai.video.nope");
+        assert_eq!(r("wai.video.package", Role::Base, false).unwrap(), "capability-not-payload:wai.video.package");
+        assert_eq!(r("wai.splat.sog", Role::Base, false).unwrap(), "capability-candidate:wai.splat.sog");
+        assert_eq!(r("wai.video.int_refine", Role::Base, false).unwrap(), "capability-role:wai.video.int_refine");
+        assert_eq!(r("wai.video.int_motion", Role::Refinement, false).unwrap(), "capability-role:wai.video.int_motion");
+        assert_eq!(r("wai.meta.hdr10plus", Role::Base, false).unwrap(), "capability-role:wai.meta.hdr10plus");
+        assert_eq!(r("wai.video.avc", Role::Base, true).unwrap(), "license-refused:wai.video.avc:patent-pool");
+        assert_eq!(r("wai.video.avc", Role::Base, false), None);
+    }
+}
diff --git a/wai/wai-pack/src/classify.rs b/wai/wai-pack/src/classify.rs
new file mode 100644
index 000000000..42bb21f2f
--- /dev/null
+++ b/wai/wai-pack/src/classify.rs
@@ -0,0 +1,81 @@
+//! Piece classification ([packaging] §4.6), from the statistics the segmenter
+//! gathers. Precedence: static, then synthetic, then high motion, then natural.
+//!
+//! - `mad_milli = abs_diff · 1000 / compared`, 0 for a one-frame piece: the mean
+//!   absolute luma change between consecutive frames, in thousandths.
+//! - `changed_permille = changed · 1000 / compared`, 0 for a one-frame piece.
+//! - static: `mad_milli ≤ static_mad_milli` and `changed_permille ≤ static_permille`;
+//! - synthetic: the first frame's histogram has at most `synthetic_bins` non-empty bins;
+//! - high motion: `mad_milli ≥ motion_high_milli`.
+//!
+//! [packaging]: ../../../extensions/packaging.md
+
+use crate::policy::ClassifyParams;
+use crate::scenecut::PieceStats;
+
+/// A piece's kind. The discriminant is the stage index's `kind` code.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PieceKind {
+    Natural = 0,
+    Static = 1,
+    Synthetic = 2,
+    MotionHigh = 3,
+}
+
+impl PieceKind {
+    /// The policy's spelling (`rule.when.piece_kind`).
+    pub fn label(self) -> &'static str {
+        match self {
+            PieceKind::Natural => "natural",
+            PieceKind::Static => "static",
+            PieceKind::Synthetic => "synthetic",
+            PieceKind::MotionHigh => "motion_high",
+        }
+    }
+}
+
+/// `mad_milli` of a piece.
+pub fn mad_milli(s: &PieceStats) -> u64 {
+    (s.abs_diff * 1000).checked_div(s.compared).unwrap_or(0)
+}
+
+/// `changed_permille` of a piece.
+pub fn changed_permille(s: &PieceStats) -> u64 {
+    (s.changed * 1000).checked_div(s.compared).unwrap_or(0)
+}
+
+/// The kind of a piece.
+pub fn classify(s: &PieceStats, p: &ClassifyParams) -> PieceKind {
+    let mad = mad_milli(s);
+    if mad <= p.static_mad_milli && changed_permille(s) <= p.static_permille {
+        PieceKind::Static
+    } else if s.occupancy as u64 <= p.synthetic_bins {
+        PieceKind::Synthetic
+    } else if mad >= p.motion_high_milli {
+        PieceKind::MotionHigh
+    } else {
+        PieceKind::Natural
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const P: ClassifyParams = ClassifyParams { static_permille: 5, static_mad_milli: 300, synthetic_bins: 12, motion_high_milli: 9000 };
+
+    #[test]
+    fn precedence_and_thresholds() {
+        let st = |abs_diff, changed, occupancy| PieceStats { abs_diff, changed, compared: 1000, occupancy };
+        assert_eq!(classify(&st(300, 5, 40), &P), PieceKind::Static);
+        // Static and synthetic both hold: static comes first.
+        assert_eq!(classify(&st(0, 0, 3), &P), PieceKind::Static);
+        assert_eq!(classify(&st(301, 5, 40), &P), PieceKind::Natural);
+        assert_eq!(classify(&st(300, 6, 12), &P), PieceKind::Synthetic);
+        assert_eq!(classify(&st(9000, 900, 12), &P), PieceKind::Synthetic);
+        assert_eq!(classify(&st(9000, 900, 13), &P), PieceKind::MotionHigh);
+        assert_eq!(classify(&st(8999, 900, 13), &P), PieceKind::Natural);
+        // A one-frame piece compares nothing: static.
+        assert_eq!(classify(&PieceStats { occupancy: 40, ..PieceStats::default() }, &P), PieceKind::Static);
+    }
+}
diff --git a/wai/wai-pack/src/conformance.rs b/wai/wai-pack/src/conformance.rs
new file mode 100644
index 000000000..d0e6cc51a
--- /dev/null
+++ b/wai/wai-pack/src/conformance.rs
@@ -0,0 +1,510 @@
+//! The packaging conformance corpus (`wai/pack-conformance/`): what this crate
+//! computes from its inputs, written by [`regen`] and checked by [`check`]. An
+//! independent verifier (`pack-conformance/pack_verify.py`) recomputes the same
+//! values from the extension text.
+//!
+//! - `policy/`: policies a packager accepts, and `expected.json` (each one's canonical
+//!   JSON and digest, with any overrides; and the pairs `eq-<name>-a.toml`,
+//!   `eq-<name>-b.toml`, two spellings of one policy, which must have one digest).
+//! - `refusals/`: policies and sources a packager refuses, and `expected.json` (each
+//!   one's reason). The binary sources are written by [`regen`] from
+//!   [`source_refusals`].
+//! - `conversions/` and `conversions.json`: the unit conversions (milliseconds to a
+//!   timebase, alignment to the lead) and the Y4M-to-RGB conversion, by the SHA-256 of
+//!   each RGB8 frame.
+//! - `scenecut/`: a policy and `expected.json`: per fixture, its SHA-256, every frame's
+//!   score, and the pieces with their flags, statistics and kinds, and the plan digest.
+//! - `encode/`: `WIV1` payloads of the integer video encoder (`wai::int_video_enc`),
+//!   written by [`regen`], and `expected.json`: for each, the fixture frames it codes,
+//!   the encoder's parameters, the payload's BLAKE3, the SSE of its reconstruction
+//!   against the source, and the SHA-256 of every decoded frame.
+//! - `qchoice/expected.json`: the step the base encode chooses for every piece of every
+//!   fixture ([`crate::encode::choose_q`]): each candidate's SSE and its SSE per sample
+//!   in thousandths, the step chosen, and the chosen payload's BLAKE3.
+
+use crate::classify::{changed_permille, classify, mad_milli};
+use crate::policy::{Overrides, Policy, Timebase};
+use crate::scenecut::{plan_digest, segment, SegParams};
+use crate::source::{wav::WavReader, y4m};
+use crate::{fixture, hex, sha256_hex};
+use crate::encode::{choose_q, sse_px_milli, MotionParams};
+use wai::int_video_enc::{self, EncParams};
+use serde_json::{json, Value};
+use std::path::Path;
+
+/// One difference between the corpus and what this crate computes.
+pub type Mismatch = String;
+
+fn read(p: &Path) -> std::io::Result<Vec<u8>> {
+    std::fs::read(p).map_err(|e| std::io::Error::new(e.kind(), format!("{}: {e}", p.display())))
+}
+
+fn read_json(p: &Path) -> std::io::Result<Value> {
+    serde_json::from_slice(&read(p)?).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{}: {e}", p.display())))
+}
+
+fn write_json(p: &Path, v: &Value) -> std::io::Result<()> {
+    let mut s = serde_json::to_string_pretty(v).expect("JSON");
+    s.push('\n');
+    std::fs::write(p, s)
+}
+
+/// The `.toml` files of `dir`, sorted bytewise.
+fn tomls(dir: &Path) -> std::io::Result<Vec<String>> {
+    let mut v: Vec<String> = std::fs::read_dir(dir)?
+        .filter_map(|e| e.ok())
+        .map(|e| e.file_name().to_string_lossy().into_owned())
+        .filter(|n| n.ends_with(".toml"))
+        .collect();
+    v.sort();
+    Ok(v)
+}
+
+// ─────────────────────────────── policy ───────────────────────────────
+
+/// The overrides a policy case applies: `example.toml` is also digested with
+/// `royalty_free_only` forced off.
+fn policy_cases(names: &[String]) -> Vec<(String, Overrides)> {
+    let mut v: Vec<(String, Overrides)> = names.iter().map(|n| (n.clone(), Overrides::default())).collect();
+    if names.iter().any(|n| n == "example.toml") {
+        v.push(("example.toml".into(), Overrides { royalty_free_only: Some(false) }));
+    }
+    v
+}
+
+fn policy_expected(dir: &Path) -> std::io::Result<Value> {
+    let names = tomls(dir)?;
+    let mut cases = Vec::new();
+    for (name, o) in policy_cases(&names) {
+        let p = Policy::parse_bytes(&read(&dir.join(&name))?)
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{name}: {e}")))?
+            .effective(&o);
+        let mut c = json!({"file": name, "canonical": p.canonical_json(), "digest": hex(&p.digest())});
+        if let Some(b) = o.royalty_free_only {
+            c["overrides"] = json!({"royalty_free_only": b});
+        }
+        cases.push(c);
+    }
+    let equal: Vec<Value> = names
+        .iter()
+        .filter_map(|n| n.strip_suffix("-a.toml").filter(|s| s.starts_with("eq-")))
+        .map(|s| json!([format!("{s}-a.toml"), format!("{s}-b.toml")]))
+        .collect();
+    Ok(json!({"cases": cases, "equal": equal}))
+}
+
+// ─────────────────────────────── refusals ───────────────────────────────
+
+/// The source refusal cases, written by [`regen`]: a file name and its bytes. Each
+/// is refused with the reason its name carries.
+pub fn source_refusals() -> Vec<(&'static str, Vec<u8>)> {
+    let frame = [16u8; 6];
+    let y4m = |head: &[u8], body: &[u8]| [head, body].concat();
+    // A WAV file with its block alignment and data length stated, so a case can make
+    // either disagree with the rest.
+    let wav_with = |tag: u16, channels: u16, bits: u16, align: u16, data_len: u32, data: &[u8]| {
+        let mut b = b"RIFF\0\0\0\0WAVEfmt \x10\0\0\0".to_vec();
+        b.extend_from_slice(&tag.to_le_bytes());
+        b.extend_from_slice(&channels.to_le_bytes());
+        b.extend_from_slice(&8000u32.to_le_bytes());
+        b.extend_from_slice(&(8000u32.wrapping_mul(align as u32)).to_le_bytes());
+        b.extend_from_slice(&align.to_le_bytes());
+        b.extend_from_slice(&bits.to_le_bytes());
+        b.extend_from_slice(b"data");
+        b.extend_from_slice(&data_len.to_le_bytes());
+        b.extend_from_slice(data);
+        b
+    };
+    let wav = |tag: u16, channels: u16, bits: u16, data: &[u8]| {
+        wav_with(tag, channels, bits, (channels as u32 * bits as u32 / 8) as u16, data.len() as u32, data)
+    };
+    vec![
+        ("y4m-header.y4m", y4m(b"YUV4MPEG W2 H2 F25:1\n", &[])),
+        ("y4m-interlaced.y4m", y4m(b"YUV4MPEG2 W2 H2 F25:1 It C420jpeg\nFRAME\n", &frame)),
+        ("y4m-interlaced-frame.y4m", y4m(b"YUV4MPEG2 W2 H2 F25:1 C420jpeg\nFRAME Ib\n", &frame)),
+        ("y4m-colorspace.y4m", y4m(b"YUV4MPEG2 W2 H2 F25:1 C422\nFRAME\n", &[16; 8])),
+        ("y4m-size-change.y4m", y4m(b"YUV4MPEG2 W2 H2 F25:1 C420jpeg\nFRAME\n", &[&frame[..], b"FRAME W4\n", &frame].concat())),
+        ("y4m-truncated.y4m", y4m(b"YUV4MPEG2 W2 H2 F25:1 C420jpeg\nFRAME\n", &frame[..5])),
+        ("wav-format-float.wav", wav(3, 1, 32, &[0; 8])),
+        ("wav-format-8bit.wav", wav(1, 1, 8, &[0; 4])),
+        ("wav-truncated.wav", {
+            let mut w = wav(1, 2, 16, &[0; 8]);
+            w.truncate(w.len() - 2);
+            w
+        }),
+        // 2 · channels past 2^16: a block alignment equal to the wrapped product.
+        ("wav-format-channels-32768.wav", wav_with(1, 32768, 16, 0, 0, &[])),
+        ("wav-format-channels-32769.wav", wav_with(1, 32769, 16, 2, 0, &[])),
+        // A data chunk that declares 4 GiB − 2 bytes and holds 4.
+        ("wav-truncated-huge-data.wav", wav_with(1, 1, 16, 2, 0xffff_fffe, &[0; 4])),
+    ]
+}
+
+/// The reason a source file is refused with, or `ok`.
+pub fn source_verdict(name: &str, bytes: &[u8]) -> &'static str {
+    if name.ends_with(".y4m") {
+        y4m::read_all(bytes).map(|_| "ok").unwrap_or_else(|e| e.code())
+    } else {
+        let read = || -> Result<(), crate::source::SourceError> {
+            let mut r = WavReader::new(bytes)?;
+            while r.remaining() > 0 {
+                r.next_block(1 << 16)?;
+            }
+            Ok(())
+        };
+        read().map(|_| "ok").unwrap_or_else(|e| e.code())
+    }
+}
+
+/// A packager's verdict on a policy's bytes: `ok`, or the reason it refuses it (the
+/// policy's, or the first rung's).
+pub fn policy_verdict(bytes: &[u8]) -> String {
+    crate::capcheck::admit(bytes, &Overrides::default()).map(|_| "ok".to_string()).unwrap_or_else(|e| e.code())
+}
+
+fn refusals_expected(dir: &Path) -> std::io::Result<Value> {
+    let mut cases = Vec::new();
+    for name in tomls(&dir.join("policy"))? {
+        let bytes = read(&dir.join("policy").join(&name))?;
+        cases.push(json!({"file": format!("policy/{name}"), "reason": policy_verdict(&bytes)}));
+    }
+    for (name, bytes) in source_refusals() {
+        cases.push(json!({"file": format!("source/{name}"), "reason": source_verdict(name, &bytes)}));
+    }
+    Ok(json!({"cases": cases}))
+}
+
+// ─────────────────────────────── conversions ───────────────────────────────
+
+const MS_CASES: &[(u64, u32, u32)] = &[
+    (1000, 25, 1),
+    (40, 25, 1),
+    (39, 25, 1),
+    (0, 25, 1),
+    (1000, 30000, 1001),
+    (2000, 30000, 1001),
+    (1, 48000, 1),
+    (4000, 90000, 1),
+    (9_007_199_254_740_991, 4_294_967_295, 1),
+];
+
+/// A timebase as `(num, den)`.
+type Rate = (u32, u32);
+
+const ALIGN_CASES: &[(u64, Rate, Rate)] = &[
+    (50, (25, 1), (48000, 1)),
+    (3, (25, 1), (30000, 1001)),
+    (29, (30000, 1001), (25, 1)),
+    (48000, (48000, 1), (25, 1)),
+    (47999, (48000, 1), (25, 1)),
+    (u64::MAX, (1, 4_294_967_295), (4_294_967_295, 1)),
+];
+
+/// The Y4M conversion cases, written by [`regen`]: 4:2:0 with odd dimensions, and 4:4:4,
+/// whose samples sweep the range so that every clip of the conversion is reached.
+pub fn conversion_sources() -> Vec<(&'static str, Vec<u8>)> {
+    let planes = |w: usize, h: usize, cw: usize, ch: usize, frames: usize| {
+        let mut b = Vec::new();
+        for t in 0..frames {
+            b.extend_from_slice(b"FRAME\n");
+            for i in 0..w * h {
+                b.push(((i * 37 + t * 101) % 256) as u8);
+            }
+            for i in 0..cw * ch {
+                b.push(((i * 59 + t * 7 + 13) % 256) as u8);
+            }
+            for i in 0..cw * ch {
+                b.push(((i * 83 + t * 29 + 101) % 256) as u8);
+            }
+        }
+        b
+    };
+    vec![
+        ("bt709-420.y4m", [&b"YUV4MPEG2 W7 H5 F25:1 Ip C420jpeg\n"[..], &planes(7, 5, 4, 3, 3)].concat()),
+        ("bt709-444.y4m", [&b"YUV4MPEG2 W6 H4 F25:1 C444\n"[..], &planes(6, 4, 6, 4, 2)].concat()),
+    ]
+}
+
+fn conversions_expected() -> Value {
+    let ms: Vec<Value> = MS_CASES
+        .iter()
+        .map(|&(ms, num, den)| json!({"ms": ms, "num": num, "den": den, "units": Timebase { num, den }.units_from_ms(ms)}))
+        .collect();
+    let align: Vec<Value> = ALIGN_CASES
+        .iter()
+        .map(|&(start, (ln, ld), (cn, cd))| {
+            let units = Timebase { num: cn, den: cd }.align_from(start, Timebase { num: ln, den: ld });
+            json!({"start": start, "lead": [ln, ld], "component": [cn, cd], "units": units})
+        })
+        .collect();
+    let rgb: Vec<Value> = conversion_sources()
+        .into_iter()
+        .map(|(name, b)| {
+            let (_, frames) = y4m::read_all(&b).expect("a conversion source reads");
+            let shas: Vec<String> = frames.iter().map(|f| sha256_hex(&f.rgb)).collect();
+            json!({"file": format!("conversions/{name}"), "rgb_sha256": shas})
+        })
+        .collect();
+    json!({"ms_to_units": ms, "align": align, "y4m_rgb": rgb})
+}
+
+// ─────────────────────────────── scene cut ───────────────────────────────
+
+/// The scene-cut vectors of every fixture under the policy at `policy`, component `v`.
+pub fn scenecut_expected(policy: &[u8]) -> Result<Value, String> {
+    let p = Policy::parse_bytes(policy).map_err(|e| e.to_string())?;
+    let c = p.component("v").ok_or("the scene-cut policy has no component v")?;
+    let sp = SegParams::from_policy(&p.segmentation, c.timebase);
+    let mut out = Vec::new();
+    for name in fixture::NAMES {
+        let bytes = fixture::generate(name).expect("a listed fixture");
+        let (hd, frames) = y4m::read_all(&bytes).map_err(|e| e.to_string())?;
+        let (pieces, scores) = segment(sp, hd.w, hd.h, frames.iter().map(|f| &f.rgb));
+        let starts: Vec<u64> = pieces.iter().map(|x| x.start).collect();
+        let pieces: Vec<Value> = pieces
+            .iter()
+            .map(|x| {
+                json!({
+                    "start": x.start, "len": x.len, "flags": x.flags,
+                    "kind": classify(&x.stats, &p.classify).label(),
+                    "mad_milli": mad_milli(&x.stats), "changed_permille": changed_permille(&x.stats),
+                    "occupancy": x.stats.occupancy,
+                })
+            })
+            .collect();
+        out.push(json!({
+            "name": name, "sha256": sha256_hex(&bytes), "frames": frames.len(),
+            "scores": scores, "pieces": pieces, "plan_digest": hex(&plan_digest(&starts)),
+        }));
+    }
+    Ok(json!({"policy": "policy.toml", "component": "v", "fixtures": out}))
+}
+
+// ─────────────────────────────── encode ───────────────────────────────
+
+/// The encoder parameter sets the encode vectors run: whole-pel and half-pel, two
+/// block sizes, two steps.
+pub const ENCODE_SETS: &[(&str, EncParams)] = &[
+    ("a", EncParams { block: 8, search: 3, mv_precision: 1, q: 6 }),
+    ("b", EncParams { block: 16, search: 2, mv_precision: 2, q: 12 }),
+];
+
+/// The frames of each piece an encode vector codes: the first of the piece's frames.
+pub const ENCODE_FRAMES: usize = 12;
+
+/// One encode vector: its file name, the payload, and its record.
+pub struct EncodeVector {
+    pub file: String,
+    pub wiv1: Vec<u8>,
+    pub record: Value,
+    /// The source frames it codes.
+    pub clip: Vec<Vec<u8>>,
+}
+
+/// Every encode vector: each piece of each fixture (its first [`ENCODE_FRAMES`]
+/// frames, cut by the scene-cut policy), under each of [`ENCODE_SETS`].
+pub fn encode_vectors(scenecut_policy: &[u8]) -> Result<Vec<EncodeVector>, String> {
+    let p = Policy::parse_bytes(scenecut_policy).map_err(|e| e.to_string())?;
+    let c = p.component("v").ok_or("the scene-cut policy has no component v")?;
+    let sp = SegParams::from_policy(&p.segmentation, c.timebase);
+    let mut out = Vec::new();
+    for name in fixture::NAMES {
+        let bytes = fixture::generate(name).expect("a listed fixture");
+        let (hd, frames) = y4m::read_all(&bytes).map_err(|e| e.to_string())?;
+        let (pieces, _) = segment(sp, hd.w, hd.h, frames.iter().map(|f| &f.rgb));
+        for (i, piece) in pieces.iter().enumerate() {
+            let first = piece.start as usize;
+            let n = (piece.len as usize).min(ENCODE_FRAMES);
+            let clip: Vec<Vec<u8>> = frames[first..first + n].iter().map(|f| f.rgb.clone()).collect();
+            for (set, ep) in ENCODE_SETS {
+                let e = int_video_enc::encode(&clip, hd.h, hd.w, ep).map_err(|e| e.to_string())?;
+                let file = format!("{name}-p{i}-{set}.wiv1");
+                let shas: Vec<String> = e.recon.iter().map(|f| sha256_hex(f)).collect();
+                let record = json!({
+                    "file": file, "fixture": name, "first": first, "frames": n,
+                    "params": {"block": ep.block, "search": ep.search, "mv_precision": ep.mv_precision, "q": ep.q},
+                    "blake3": hex(blake3::hash(&e.wiv1).as_bytes()), "sse": e.sse, "frame_sha256": shas,
+                });
+                out.push(EncodeVector { file, wiv1: e.wiv1, record, clip: clip.clone() });
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// Decode a payload through `wai.video.int_motion` and state what test 4 asserts of
+/// it: the decode equals the encoder's reconstruction (each frame's SHA-256 in the
+/// record), and the record's SSE is the one recomputed from the source.
+fn check_encode_vector(v: &EncodeVector, out: &mut Vec<Mismatch>) {
+    use wai::int_payload::{decode_int, IntDecoded, IntParams};
+    let frames = match decode_int(wai::codecs::CAP_VIDEO_INT_MOTION, &v.wiv1, &IntParams::none()) {
+        Ok(IntDecoded::Video { frames, .. }) => frames,
+        Ok(_) | Err(_) => {
+            out.push(format!("encode/{}: does not decode as wai.video.int_motion", v.file));
+            return;
+        }
+    };
+    let shas: Vec<Value> = frames.iter().map(|f| Value::from(sha256_hex(f))).collect();
+    if Value::from(shas) != v.record["frame_sha256"] {
+        out.push(format!("encode/{}: the decode is not the encoder's reconstruction", v.file));
+    }
+    let sse: u64 = v.clip.iter().flatten().zip(frames.iter().flatten()).map(|(&a, &b)| (a as i64 - b as i64).pow(2) as u64).sum();
+    if v.record["sse"] != sse {
+        out.push(format!("encode/{}: the stated SSE is not the decode's against the source", v.file));
+    }
+}
+
+// ─────────────────────────────── the choice of step ───────────────────────────────
+
+/// The rung parameters the step goldens run: one set whose bound some pieces meet at 8
+/// and others only at 4, and one whose bound most pieces meet at no step.
+pub fn qchoice_params() -> Vec<MotionParams> {
+    [5000, 1300]
+        .into_iter()
+        .map(|max_sse_px_milli| MotionParams { block: 8, search: 1, mv_precision: 1, q_candidates: vec![16, 12, 8, 4], max_sse_px_milli })
+        .collect()
+}
+
+/// Every piece of every fixture (its first [`ENCODE_FRAMES`] frames): each candidate's
+/// SSE, the step chosen and the chosen payload's BLAKE3.
+pub fn qchoice_expected(scenecut_policy: &[u8]) -> Result<Value, String> {
+    let p = Policy::parse_bytes(scenecut_policy).map_err(|e| e.to_string())?;
+    let c = p.component("v").ok_or("the scene-cut policy has no component v")?;
+    let sp = SegParams::from_policy(&p.segmentation, c.timebase);
+    let mut sets = Vec::new();
+    for mp in qchoice_params() {
+        let mut out = Vec::new();
+        for name in fixture::NAMES {
+            let bytes = fixture::generate(name).expect("a listed fixture");
+            let (hd, frames) = y4m::read_all(&bytes).map_err(|e| e.to_string())?;
+            let (pieces, _) = segment(sp, hd.w, hd.h, frames.iter().map(|f| &f.rgb));
+            for (i, piece) in pieces.iter().enumerate() {
+                let first = piece.start as usize;
+                let n = (piece.len as usize).min(ENCODE_FRAMES);
+                let clip: Vec<Vec<u8>> = frames[first..first + n].iter().map(|f| f.rgb.clone()).collect();
+                let mut candidates = Vec::new();
+                for &q in &mp.q_candidates {
+                    let ep = EncParams { block: mp.block, search: mp.search, mv_precision: mp.mv_precision, q };
+                    let e = int_video_enc::encode(&clip, hd.h, hd.w, &ep).map_err(|e| e.to_string())?;
+                    candidates.push(json!({"q": q, "sse": e.sse, "sse_px_milli": sse_px_milli(e.sse, hd.h, hd.w, n)}));
+                }
+                let chosen = choose_q(&clip, hd.h, hd.w, &mp).map_err(|e| e.to_string())?;
+                out.push(json!({
+                    "fixture": name, "piece": i, "first": first, "frames": n, "candidates": candidates,
+                    "q": chosen.q, "blake3": hex(blake3::hash(&chosen.encoded.wiv1).as_bytes()),
+                }));
+            }
+        }
+        sets.push(json!({
+            "params": {"block": mp.block, "search": mp.search, "mv_precision": mp.mv_precision, "q_candidates": mp.q_candidates, "max_sse_px_milli": mp.max_sse_px_milli},
+            "pieces": out,
+        }));
+    }
+    Ok(json!({"policy": "scenecut/policy.toml", "sets": sets}))
+}
+
+// ─────────────────────────────── regen and check ───────────────────────────────
+
+/// Write every expected file, and the generated inputs, under `dir`.
+pub fn regen(dir: &Path) -> std::io::Result<()> {
+    write_json(&dir.join("policy/expected.json"), &policy_expected(&dir.join("policy"))?)?;
+    std::fs::create_dir_all(dir.join("refusals/source"))?;
+    for (name, bytes) in source_refusals() {
+        std::fs::write(dir.join("refusals/source").join(name), bytes)?;
+    }
+    write_json(&dir.join("refusals/expected.json"), &refusals_expected(&dir.join("refusals"))?)?;
+    std::fs::create_dir_all(dir.join("conversions"))?;
+    for (name, bytes) in conversion_sources() {
+        std::fs::write(dir.join("conversions").join(name), bytes)?;
+    }
+    write_json(&dir.join("conversions.json"), &conversions_expected())?;
+    let text = read(&dir.join("scenecut/policy.toml"))?;
+    let sc = scenecut_expected(&text).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    write_json(&dir.join("scenecut/expected.json"), &sc)?;
+    let vectors = encode_vectors(&text).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    std::fs::create_dir_all(dir.join("encode"))?;
+    for v in &vectors {
+        std::fs::write(dir.join("encode").join(&v.file), &v.wiv1)?;
+    }
+    let records: Vec<Value> = vectors.into_iter().map(|v| v.record).collect();
+    write_json(&dir.join("encode/expected.json"), &json!({"policy": "scenecut/policy.toml", "vectors": records}))?;
+    std::fs::create_dir_all(dir.join("qchoice"))?;
+    let qc = qchoice_expected(&text).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    write_json(&dir.join("qchoice/expected.json"), &qc)?;
+    Ok(())
+}
+
+fn same(what: &str, want: &Value, got: &Value, out: &mut Vec<Mismatch>) {
+    if want != got {
+        out.push(format!("{what}: the corpus and this implementation differ"));
+    }
+}
+
+/// Recompute the corpus under `dir` and list every difference; empty means it holds.
+/// Generated inputs are compared byte for byte with what [`regen`] would write.
+pub fn check(dir: &Path) -> std::io::Result<Vec<Mismatch>> {
+    let mut out = Vec::new();
+    // The equal pairs are checked on the digests this implementation computes, not on
+    // the committed ones, which an implementation that diverged would still match.
+    let pol = policy_expected(&dir.join("policy"))?;
+    same("policy/expected.json", &read_json(&dir.join("policy/expected.json"))?, &pol, &mut out);
+    let digest_of = |f: &str| {
+        pol["cases"].as_array().and_then(|c| c.iter().find(|x| x["file"] == f && x.get("overrides").is_none())).map(|x| x["digest"].clone())
+    };
+    // Every policy of the corpus is one a packager accepts, its rungs included (§3.6):
+    // the example is a policy someone can pack under.
+    for name in tomls(&dir.join("policy"))? {
+        let v = policy_verdict(&read(&dir.join("policy").join(&name))?);
+        if v != "ok" {
+            out.push(format!("policy/{name}: a packager refuses it ({v})"));
+        }
+    }
+    for pair in pol["equal"].as_array().into_iter().flatten() {
+        let (a, b) = (pair[0].as_str().unwrap_or(""), pair[1].as_str().unwrap_or(""));
+        if digest_of(a).is_none() || digest_of(a) != digest_of(b) {
+            out.push(format!("policy: {a} and {b} spell one policy but their digests differ"));
+        }
+    }
+    for (name, bytes) in source_refusals() {
+        if read(&dir.join("refusals/source").join(name))? != bytes {
+            out.push(format!("refusals/source/{name}: not the bytes the corpus generator writes"));
+        }
+    }
+    let refusals = read_json(&dir.join("refusals/expected.json"))?;
+    same("refusals/expected.json", &refusals, &refusals_expected(&dir.join("refusals"))?, &mut out);
+    for c in refusals["cases"].as_array().into_iter().flatten() {
+        if c["reason"] == "ok" {
+            out.push(format!("refusals: {} is not refused", c["file"]));
+        }
+    }
+    for (name, bytes) in conversion_sources() {
+        if read(&dir.join("conversions").join(name))? != bytes {
+            out.push(format!("conversions/{name}: not the bytes the corpus generator writes"));
+        }
+    }
+    same("conversions.json", &read_json(&dir.join("conversions.json"))?, &conversions_expected(), &mut out);
+    let text = read(&dir.join("scenecut/policy.toml"))?;
+    match scenecut_expected(&text) {
+        Ok(sc) => same("scenecut/expected.json", &read_json(&dir.join("scenecut/expected.json"))?, &sc, &mut out),
+        Err(e) => out.push(format!("scenecut/policy.toml: {e}")),
+    }
+    match encode_vectors(&text) {
+        Ok(vectors) => {
+            for v in &vectors {
+                if read(&dir.join("encode").join(&v.file))? != v.wiv1 {
+                    out.push(format!("encode/{}: not the bytes the encoder writes", v.file));
+                }
+                check_encode_vector(v, &mut out);
+            }
+            let records: Vec<Value> = vectors.into_iter().map(|v| v.record).collect();
+            let want = json!({"policy": "scenecut/policy.toml", "vectors": records});
+            same("encode/expected.json", &read_json(&dir.join("encode/expected.json"))?, &want, &mut out);
+        }
+        Err(e) => out.push(format!("encode: {e}")),
+    }
+    match qchoice_expected(&text) {
+        Ok(qc) => same("qchoice/expected.json", &read_json(&dir.join("qchoice/expected.json"))?, &qc, &mut out),
+        Err(e) => out.push(format!("qchoice: {e}")),
+    }
+    Ok(out)
+}
diff --git a/wai/wai-pack/src/encode.rs b/wai/wai-pack/src/encode.rs
new file mode 100644
index 000000000..0c572bb62
--- /dev/null
+++ b/wai/wai-pack/src/encode.rs
@@ -0,0 +1,104 @@
+//! The base encode's choice of step ([packaging] §5.6): the function the packer's base
+//! encode of a `wai.video.int_motion` rung calls for each piece.
+//!
+//! `q_candidates` is read as a set. The piece is encoded at each candidate from the
+//! largest down, and the first whose `floor(SSE · 1000 / (3·w·h·n)) ≤
+//! max_sse_px_milli` is chosen, `SSE` being its reconstruction's against the source and
+//! `n` the piece's frames: the largest step that meets the bound, so candidates that meet
+//! it equally are decided by their step. Where none meets it, the smallest candidate is
+//! chosen.
+//!
+//! [packaging]: ../../../extensions/packaging.md
+
+use crate::policy::Rung;
+use wai::int_payload::{IntPayloadError, Refusal};
+use wai::int_video_enc::{encode, EncParams, Encoded};
+
+/// The parameters of a `wai.video.int_motion` rung that fix its encode.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MotionParams {
+    pub block: u32,
+    pub search: u32,
+    pub mv_precision: u8,
+    pub q_candidates: Vec<u32>,
+    pub max_sse_px_milli: u64,
+}
+
+impl MotionParams {
+    /// A rung's parameters, every default written in by the policy (§3.3); `None` for a
+    /// rung of another capability.
+    pub fn of(rung: &Rung) -> Option<MotionParams> {
+        if rung.capability != "wai.video.int_motion" {
+            return None;
+        }
+        Some(MotionParams {
+            block: rung.param_u64("block")? as u32,
+            search: rung.param_u64("search")? as u32,
+            mv_precision: rung.param_u64("mv_precision")? as u8,
+            q_candidates: rung.param_u64_list("q_candidates")?.into_iter().map(|q| q as u32).collect(),
+            max_sse_px_milli: rung.param_u64("max_sse_px_milli")?,
+        })
+    }
+}
+
+/// A piece's step and its encode.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct QChoice {
+    pub q: u32,
+    pub encoded: Encoded,
+}
+
+/// `floor(sse · 1000 / (3·w·h·n))`: the SSE per sample, in thousandths.
+pub fn sse_px_milli(sse: u64, h: u32, w: u32, n: usize) -> u64 {
+    let samples = 3 * h as u128 * w as u128 * n as u128;
+    (sse as u128 * 1000 / samples.max(1)) as u64
+}
+
+/// Choose the step for a piece of `frames` (each `h × w` RGB8) under `p`, and encode it.
+pub fn choose_q(frames: &[Vec<u8>], h: u32, w: u32, p: &MotionParams) -> Result<QChoice, IntPayloadError> {
+    let mut qs: Vec<u32> = p.q_candidates.clone();
+    qs.sort_unstable_by(|a, b| b.cmp(a));
+    qs.dedup();
+    let smallest = *qs.last().ok_or_else(|| IntPayloadError::new(Refusal::FieldRange, "no step to choose from"))?;
+    for &q in &qs {
+        let e = encode(frames, h, w, &EncParams { block: p.block, search: p.search, mv_precision: p.mv_precision, q })?;
+        if sse_px_milli(e.sse, h, w, frames.len()) <= p.max_sse_px_milli || q == smallest {
+            return Ok(QChoice { q, encoded: e });
+        }
+    }
+    unreachable!("the smallest step is always chosen when it is reached")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn clip() -> Vec<Vec<u8>> {
+        (0..4).map(|t| (0..12 * 10 * 3).map(|i| ((i * 37 + t * 11) % 251) as u8).collect()).collect()
+    }
+
+    fn params(q_candidates: Vec<u32>, max_sse_px_milli: u64) -> MotionParams {
+        MotionParams { block: 4, search: 1, mv_precision: 1, q_candidates, max_sse_px_milli }
+    }
+
+    fn metric(q: u32) -> u64 {
+        let e = encode(&clip(), 10, 12, &EncParams { block: 4, search: 1, mv_precision: 1, q }).unwrap();
+        sse_px_milli(e.sse, 10, 12, 4)
+    }
+
+    /// The largest step that meets the bound; the smallest when none does; candidates
+    /// read as a set, in any order.
+    #[test]
+    fn the_largest_step_meeting_the_bound() {
+        let (m16, m8, m2) = (metric(16), metric(8), metric(2));
+        assert!(m16 > m8 && m8 > m2, "{m16} {m8} {m2}");
+        let pick = |c: Vec<u32>, bound| choose_q(&clip(), 10, 12, &params(c, bound)).unwrap().q;
+        assert_eq!(pick(vec![2, 16, 8], m16), 16);
+        assert_eq!(pick(vec![2, 16, 8], m16 - 1), 8);
+        assert_eq!(pick(vec![8, 2, 16, 8], m8), 8);
+        assert_eq!(pick(vec![16, 8, 2], m2), 2);
+        assert_eq!(pick(vec![16, 8, 2], 0), 2, "none meets it: the smallest");
+        let c = choose_q(&clip(), 10, 12, &params(vec![16, 8], m8)).unwrap();
+        assert_eq!(c.encoded, encode(&clip(), 10, 12, &EncParams { block: 4, search: 1, mv_precision: 1, q: 8 }).unwrap());
+    }
+}
diff --git a/wai/wai-pack/src/fixture.rs b/wai/wai-pack/src/fixture.rs
new file mode 100644
index 000000000..a74514f2b
--- /dev/null
+++ b/wai/wai-pack/src/fixture.rs
@@ -0,0 +1,161 @@
+//! Synthetic sources for the conformance corpus, generated rather than committed.
+//!
+//! Each fixture is a Y4M stream (`C420jpeg`, progressive, 25 frames per second) whose
+//! every byte is an integer function of the frame index and the pixel position, so an
+//! independent implementation regenerates it byte for byte; the corpus pins each
+//! fixture's SHA-256. A fixture is a list of spans; a span shows one shot, or fades from
+//! one shot to another, for a number of frames. Shots read the global frame index `t`,
+//! so a shot that resumes after an interruption continues its motion.
+//!
+//! - `ramp`: `Y = lo + v·(hi − lo) / (period − 1)`, `v = (x·dx + y·dy + t·speed) mod
+//!   period`; with `jitter` 1, `Y` moves by `noise mod 3 − 1`, clamped to 16..=235.
+//! - `blocks`: `Y = levels[((x + t·speed) / bw + y / bh) mod 3]`.
+//! - `noise`: `Y = lo + noise mod (hi − lo + 1)`.
+//! - A fade of `n` frames from shot `a` to shot `b`, at its `i`-th frame (from 0), is
+//!   `(a·(n − i − 1) + b·(i + 1)) / n` per sample, chroma included.
+//!
+//! `noise(seed, x, y, t) = mix(seed ^ mix(x ^ mix(y ^ mix(t))))`, where `mix` is the
+//! 32-bit finaliser `v ^= v >> 16; v *= 0x7feb352d; v ^= v >> 15; v *= 0x846ca68b;
+//! v ^= v >> 16` (wrapping). Chroma is constant per shot.
+
+/// The fixtures this module generates.
+pub const NAMES: &[&str] = &["cuts-01", "kinds-01"];
+
+fn mix(mut v: u32) -> u32 {
+    v ^= v >> 16;
+    v = v.wrapping_mul(0x7feb_352d);
+    v ^= v >> 15;
+    v = v.wrapping_mul(0x846c_a68b);
+    v ^= v >> 16;
+    v
+}
+
+/// The fixtures' noise.
+pub fn noise(seed: u32, x: u32, y: u32, t: u32) -> u32 {
+    mix(seed ^ mix(x ^ mix(y ^ mix(t))))
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Shot {
+    Ramp { lo: u32, hi: u32, dx: u32, dy: u32, speed: u32, period: u32, jitter: bool, seed: u32, cb: u8, cr: u8 },
+    Blocks { levels: [u8; 3], bw: u32, bh: u32, speed: u32, cb: u8, cr: u8 },
+    Noise { lo: u32, hi: u32, seed: u32, cb: u8, cr: u8 },
+}
+
+impl Shot {
+    fn y(&self, x: u32, y: u32, t: u32) -> u32 {
+        match *self {
+            Shot::Ramp { lo, hi, dx, dy, speed, period, jitter, seed, .. } => {
+                let v = (x * dx + y * dy + t * speed) % period;
+                let base = lo + v * (hi - lo) / (period - 1);
+                if jitter { (base + noise(seed, x, y, t) % 3).saturating_sub(1).clamp(16, 235) } else { base }
+            }
+            Shot::Blocks { levels, bw, bh, speed, .. } => levels[(((x + t * speed) / bw + y / bh) % 3) as usize] as u32,
+            Shot::Noise { lo, hi, seed, .. } => lo + noise(seed, x, y, t) % (hi - lo + 1),
+        }
+    }
+    fn chroma(&self) -> (u32, u32) {
+        match *self {
+            Shot::Ramp { cb, cr, .. } | Shot::Blocks { cb, cr, .. } | Shot::Noise { cb, cr, .. } => (cb as u32, cr as u32),
+        }
+    }
+}
+
+struct Span {
+    frames: u32,
+    shot: Shot,
+    fade_to: Option<Shot>,
+}
+
+#[allow(clippy::too_many_arguments)]
+const fn ramp(lo: u32, hi: u32, dx: u32, dy: u32, speed: u32, jitter: bool, seed: u32, cb: u8, cr: u8) -> Shot {
+    Shot::Ramp { lo, hi, dx, dy, speed, period: 32, jitter, seed, cb, cr }
+}
+
+fn spans(name: &str) -> Option<(u32, u32, Vec<Span>)> {
+    let s = |frames, shot| Span { frames, shot, fade_to: None };
+    Some(match name {
+        // Hard cuts; a flash of exactly 6 frames (the default lookahead) inside shot B;
+        // a 40-frame fade from C to D; and two shots cut against each other, E and F.
+        "cuts-01" => {
+            let a = ramp(20, 100, 1, 1, 1, true, 1, 110, 140);
+            let b = ramp(120, 220, 2, 1, 1, true, 2, 150, 120);
+            let flash = Shot::Noise { lo: 228, hi: 235, seed: 3, cb: 128, cr: 128 };
+            let c = ramp(30, 90, 1, 2, 1, true, 4, 120, 120);
+            let d = ramp(150, 230, 1, 0, 2, true, 5, 136, 136);
+            let e = ramp(40, 120, 0, 1, 1, true, 6, 100, 150);
+            let f = ramp(140, 200, 1, 0, 1, true, 7, 160, 110);
+            (32, 18, vec![
+                s(60, a), s(30, b), s(6, flash), s(44, b), s(20, c),
+                Span { frames: 40, shot: c, fade_to: Some(d) },
+                s(30, d), s(30, e), s(30, f), s(30, e), s(30, f),
+            ])
+        }
+        // One shot of each kind, cut against each other, then a static shot longer than
+        // the longest piece.
+        "kinds-01" => (32, 18, vec![
+            s(40, ramp(20, 200, 1, 1, 0, false, 0, 128, 128)),
+            s(40, Shot::Blocks { levels: [40, 120, 200], bw: 8, bh: 6, speed: 1, cb: 128, cr: 128 }),
+            s(40, Shot::Noise { lo: 16, hi: 235, seed: 7, cb: 128, cr: 128 }),
+            s(40, ramp(16, 80, 1, 1, 1, true, 8, 128, 128)),
+            s(130, ramp(60, 180, 2, 1, 0, false, 0, 140, 116)),
+        ]),
+        _ => return None,
+    })
+}
+
+/// The fixture `name` as Y4M bytes, or `None` for a name [`NAMES`] does not hold.
+pub fn generate(name: &str) -> Option<Vec<u8>> {
+    let (w, h, spans) = spans(name)?;
+    let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
+    let mut out = format!("YUV4MPEG2 W{w} H{h} F25:1 Ip A1:1 C420jpeg\n").into_bytes();
+    let mut t = 0u32;
+    for span in &spans {
+        for i in 0..span.frames {
+            out.extend_from_slice(b"FRAME\n");
+            let blend = |a: u32, b: u32| (a * (span.frames - i - 1) + b * (i + 1)) / span.frames;
+            for y in 0..h {
+                for x in 0..w {
+                    let v = span.shot.y(x, y, t);
+                    let v = span.fade_to.map_or(v, |to| blend(v, to.y(x, y, t)));
+                    out.push(v as u8);
+                }
+            }
+            let (cb, cr) = span.shot.chroma();
+            let (cb, cr) = span.fade_to.map_or((cb, cr), |to| {
+                let (tb, tr) = to.chroma();
+                (blend(cb, tb), blend(cr, tr))
+            });
+            out.extend(std::iter::repeat_n(cb as u8, (cw * ch) as usize));
+            out.extend(std::iter::repeat_n(cr as u8, (cw * ch) as usize));
+            t += 1;
+        }
+    }
+    Some(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Known answers computed independently (Python, arbitrary-precision integers
+    /// masked to 32 bits).
+    #[test]
+    fn mix_and_noise_known_answers() {
+        assert_eq!(mix(0), 0);
+        assert_eq!(mix(1), 0x6889_90c0);
+        assert_eq!(mix(0xdead_beef), 0xe628_c683);
+        assert_eq!(noise(3, 5, 7, 11), 3_929_262_924);
+    }
+
+    #[test]
+    fn every_fixture_is_a_y4m_stream() {
+        for n in NAMES {
+            let b = generate(n).unwrap();
+            let (hd, frames) = crate::source::y4m::read_all(&b).unwrap();
+            assert_eq!((hd.w, hd.h, hd.rate), (32, 18, Some((25, 1))), "{n}");
+            assert!(frames.len() > 200, "{n}");
+        }
+        assert!(generate("nope").is_none());
+    }
+}
diff --git a/wai/wai-pack/src/lib.rs b/wai/wai-pack/src/lib.rs
new file mode 100644
index 000000000..7fec099e5
--- /dev/null
+++ b/wai/wai-pack/src/lib.rs
@@ -0,0 +1,38 @@
+//! wai-pack: the reference packager of WAI's packaging extension
+//! ([`extensions/packaging.md`](../../../extensions/packaging.md)).
+//!
+//! What this revision builds: the policy and its digest ([`policy`]), what a packager
+//! may emit ([`capcheck`]), the source readers ([`source`]), `wai.pack.scenecut/1`
+//! ([`scenecut`]), piece classification ([`classify`]), the synthetic fixtures
+//! ([`fixture`]), and the conformance corpus's regeneration and check
+//! ([`conformance`]), whose encode vectors run the integer video encoder
+//! (`wai::int_video_enc`); and the base encode's choice of step ([`encode`]).
+//!
+//! No float decides anything here: every computation is integer, and float arithmetic
+//! is denied for the whole crate.
+
+#![deny(clippy::float_arithmetic)]
+
+pub mod capcheck;
+pub mod classify;
+pub mod conformance;
+pub mod encode;
+pub mod fixture;
+pub mod policy;
+pub mod scenecut;
+pub mod source;
+
+/// Lowercase hex of `b`.
+pub fn hex(b: &[u8]) -> String {
+    use std::fmt::Write as _;
+    b.iter().fold(String::with_capacity(2 * b.len()), |mut s, x| {
+        let _ = write!(s, "{x:02x}");
+        s
+    })
+}
+
+/// SHA-256 of `b`, as lowercase hex.
+pub fn sha256_hex(b: &[u8]) -> String {
+    use sha2::Digest as _;
+    hex(&sha2::Sha256::digest(b))
+}
diff --git a/wai/wai-pack/src/policy.rs b/wai/wai-pack/src/policy.rs
new file mode 100644
index 000000000..b652a2a15
--- /dev/null
+++ b/wai/wai-pack/src/policy.rs
@@ -0,0 +1,1258 @@
+//! The packaging policy, schema `wai.pack.policy/1` ([packaging] §3).
+//!
+//! A package is made under one policy, a TOML 1.0 document in UTF-8 with no
+//! byte-order mark. [`Policy::parse_bytes`] reads it in three stages, and the first fault
+//! it meets is the refusal:
+//!
+//! 0. **Bytes.** Bytes that are not UTF-8, a byte-order mark, a document that is not
+//!    TOML 1.0 (an integer outside TOML's 64-bit range among them), and arrays and
+//!    tables nested more than [`MAX_DEPTH`] deep are all `policy-toml`, whichever comes
+//!    first.
+//! 1. **Value kinds.** Anything canonical JSON cannot carry exactly is refused before
+//!    any key is read: a float, a date or time, a negative integer, an integer past
+//!    `2^53 − 1`. The walk visits members in byte order of their keys and arrays in
+//!    order.
+//! 2. **Schema.** In each table, a key the schema does not define is refused first (in
+//!    byte order); then each member in schema order: a missing required member, a member
+//!    of the wrong type, a value outside its range.
+//! 3. **Constraints** across members, in the order [`PolicyReason`] lists them from
+//!    `TooManyComponents` on.
+//!
+//! The **effective policy** is the parsed policy with every default written in and the
+//! overrides applied ([`Policy::effective`]). Its canonical JSON
+//! ([`Policy::canonical_json`]) is RFC 8785 over the JSON form [`Policy::to_value`]
+//! states, and its digest is `BLAKE3("wai:pack-policy\x01" ‖ canonical JSON)`. Two
+//! spellings of one policy (key order, inline or standard tables, dotted keys,
+//! comments, an omitted default or the default written out) therefore have one digest.
+//!
+//! [packaging]: ../../../extensions/packaging.md
+
+use serde_json::{Map, Value};
+use std::collections::{BTreeMap, BTreeSet};
+
+/// The schema string a policy names.
+pub const SCHEMA: &str = "wai.pack.policy/1";
+/// The domain of the policy digest.
+pub const DOMAIN_POLICY: &[u8] = b"wai:pack-policy\x01";
+/// The scene-cut algorithm of [packaging] §4.3, the one `segmentation.scene_cut` names.
+///
+/// [packaging]: ../../../extensions/packaging.md
+pub const SCENECUT_V1: &str = "wai.pack.scenecut/1";
+/// The largest integer a policy may hold: canonical JSON's exact-integer bound.
+pub const MAX_INTEGER: u64 = wai::jcs::MAX_INTEGER;
+/// The deepest a policy nests arrays and tables: the document's own table is at depth
+/// 1, and a container directly inside one at depth `k` is at depth `k + 1`.
+pub const MAX_DEPTH: usize = 32;
+/// UTF-8's byte-order mark, which a policy must not begin with.
+const BOM: &[u8] = b"\xef\xbb\xbf";
+
+/// The most components, rungs, classes, rules and moments a policy may hold, and the
+/// most distinct deadline values.
+pub const MAX_COMPONENTS: usize = 8;
+pub const MAX_RUNGS: usize = 64;
+pub const MAX_CLASSES: usize = 32;
+pub const MAX_RULES: usize = 32;
+pub const MAX_MOMENTS: usize = 32;
+pub const MAX_DEADLINES: usize = 4;
+
+/// Why a policy was refused. [`PolicyReason::code`] is the name the conformance corpus
+/// and [packaging] §12 use.
+///
+/// [packaging]: ../../../extensions/packaging.md
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum PolicyReason {
+    /// Not a policy's bytes: not UTF-8, a byte-order mark, not a TOML 1.0 document (a
+    /// syntax error, a key defined twice, an integer outside 64 bits), or arrays and
+    /// tables nested more than [`MAX_DEPTH`] deep.
+    Toml,
+    /// A float anywhere in the document.
+    Float,
+    /// A date, time or date-time anywhere in the document.
+    Datetime,
+    /// A negative integer anywhere in the document.
+    Negative,
+    /// An integer past `2^53 − 1` anywhere in the document.
+    IntegerRange,
+    /// A key the schema does not define.
+    UnknownKey,
+    /// A required member is absent.
+    MissingKey,
+    /// A member of the wrong type.
+    Type,
+    /// A value outside its member's range or vocabulary.
+    Value,
+    /// `schema` is not `wai.pack.policy/1`.
+    Schema,
+    /// More than 8 components, or none.
+    TooManyComponents,
+    /// More than 64 ladder rungs.
+    TooManyRungs,
+    /// More than 32 classes.
+    TooManyClasses,
+    /// More than 32 rules.
+    TooManyRules,
+    /// More than 32 moments.
+    TooManyMoments,
+    /// Two ids are equal, among components, rungs, classes, moments and rules together.
+    DuplicateId,
+    /// `lead` names no component.
+    Lead,
+    /// `segmentation.closed` is false: every piece must be closed (§4.1).
+    OpenGop,
+    /// Not `1 ≤ min_ms ≤ target_ms ≤ max_ms`.
+    PieceBounds,
+    /// A rung names a component the policy does not define.
+    LadderComponent,
+    /// A refinement without `refines`, or `refines` on another role.
+    RefinesRole,
+    /// `refines` names no rung.
+    DanglingRefines,
+    /// A `refines` chain returns to a rung it passed.
+    RefinesCycle,
+    /// A `refines` chain does not end at a base of the refinement's own component.
+    RefinesBase,
+    /// Two refinements refine one rung.
+    RefinesBranch,
+    /// A component has no base rung.
+    NoBase,
+    /// A class's or a rule's `max_layer` that no rung reaches.
+    ClassLayer,
+    /// A rule's `then.ladder` names an unknown rung, rungs of two components, or no base.
+    RuleLadder,
+    /// `live.layer_lag_ms` is not one entry per layer, starting at 0, non-decreasing.
+    LayerLag,
+    /// More than 4 distinct deadline values.
+    TooManyDeadlines,
+    /// A deadline that a refinement layer cannot meet: `deadline_ms − layer_lag_ms(k) < 1`.
+    DeadlineUnreachable,
+}
+
+impl PolicyReason {
+    /// The refusal's name.
+    pub fn code(self) -> &'static str {
+        use PolicyReason::*;
+        match self {
+            Toml => "policy-toml",
+            Float => "policy-float",
+            Datetime => "policy-datetime",
+            Negative => "policy-negative",
+            IntegerRange => "policy-integer-range",
+            UnknownKey => "policy-unknown-key",
+            MissingKey => "policy-missing-key",
+            Type => "policy-type",
+            Value => "policy-value",
+            Schema => "policy-schema",
+            TooManyComponents => "policy-too-many-components",
+            TooManyRungs => "policy-too-many-rungs",
+            TooManyClasses => "policy-too-many-classes",
+            TooManyRules => "policy-too-many-rules",
+            TooManyMoments => "policy-too-many-moments",
+            DuplicateId => "policy-duplicate-id",
+            Lead => "policy-lead",
+            OpenGop => "policy-open-gop",
+            PieceBounds => "policy-piece-bounds",
+            LadderComponent => "policy-ladder-component",
+            RefinesRole => "policy-refines-role",
+            DanglingRefines => "policy-dangling-refines",
+            RefinesCycle => "policy-refines-cycle",
+            RefinesBase => "policy-refines-base",
+            RefinesBranch => "policy-refines-branch",
+            NoBase => "policy-no-base",
+            ClassLayer => "policy-class-layer",
+            RuleLadder => "policy-rule-ladder",
+            LayerLag => "policy-layer-lag",
+            TooManyDeadlines => "policy-too-many-deadlines",
+            DeadlineUnreachable => "policy-deadline-unreachable",
+        }
+    }
+}
+
+/// A refusal: the reason and where in the document it was found.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PolicyError {
+    pub reason: PolicyReason,
+    pub at: String,
+}
+
+impl PolicyError {
+    fn new(reason: PolicyReason, at: impl Into<String>) -> Self {
+        PolicyError { reason, at: at.into() }
+    }
+    /// The refusal's name.
+    pub fn code(&self) -> &'static str {
+        self.reason.code()
+    }
+}
+
+impl std::fmt::Display for PolicyError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{} at {}", self.reason.code(), self.at)
+    }
+}
+
+impl std::error::Error for PolicyError {}
+
+type R<T> = Result<T, PolicyError>;
+
+/// The media class of a component.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Media {
+    Video,
+    Image,
+    Audio,
+    World,
+    Feed,
+    Avatar,
+    Film,
+}
+
+impl Media {
+    const ALL: [Media; 7] = [Media::Video, Media::Image, Media::Audio, Media::World, Media::Feed, Media::Avatar, Media::Film];
+    /// The policy's spelling.
+    pub fn label(self) -> &'static str {
+        match self {
+            Media::Video => "video",
+            Media::Image => "image",
+            Media::Audio => "audio",
+            Media::World => "world",
+            Media::Feed => "feed",
+            Media::Avatar => "avatar",
+            Media::Film => "film",
+        }
+    }
+    fn from_label(s: &str) -> Option<Media> {
+        Media::ALL.into_iter().find(|m| m.label() == s)
+    }
+}
+
+/// A component's timebase: `num / den` units per second. For video one unit is one
+/// frame, for audio one sample.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Timebase {
+    pub num: u32,
+    pub den: u32,
+}
+
+impl Timebase {
+    /// A policy duration in milliseconds as a count of this timebase's units:
+    /// `floor(ms · num / (1000 · den))`, 1 where that is 0, and `2^64 − 1` where it is
+    /// more ([packaging] §4.4).
+    ///
+    /// [packaging]: ../../../extensions/packaging.md
+    pub fn units_from_ms(self, ms: u64) -> u64 {
+        let u = (ms as u128 * self.num as u128) / (1000 * self.den as u128);
+        u64::try_from(u).unwrap_or(u64::MAX).max(1)
+    }
+
+    /// A start on the lead component's timebase `lead`, as a start on this one:
+    /// `floor(start · num · lead.den / (den · lead.num))`, and `2^64 − 1` where that is
+    /// more ([packaging] §4.5). The product fits 128 bits.
+    ///
+    /// [packaging]: ../../../extensions/packaging.md
+    pub fn align_from(self, start: u64, lead: Timebase) -> u64 {
+        let n = start as u128 * self.num as u128 * lead.den as u128;
+        u64::try_from(n / (self.den as u128 * lead.num as u128)).unwrap_or(u64::MAX)
+    }
+}
+
+/// One media stream of the package.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Component {
+    pub id: String,
+    pub media: Media,
+    pub source: Option<String>,
+    pub timebase: Timebase,
+}
+
+/// `[segmentation]`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Segmentation {
+    pub target_ms: u64,
+    pub min_ms: u64,
+    pub max_ms: u64,
+    pub scene_cut: String,
+    pub cut_abs_permille: u64,
+    pub cut_rel_permille: u64,
+    pub cut_window: u64,
+    pub lookahead_frames: u64,
+    pub closed: bool,
+}
+
+/// What a rung is in its piece's staged order.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Role {
+    Base,
+    Refinement,
+    Floor,
+}
+
+impl Role {
+    pub fn label(self) -> &'static str {
+        match self {
+            Role::Base => "base",
+            Role::Refinement => "refinement",
+            Role::Floor => "floor",
+        }
+    }
+}
+
+/// One rung of the ladder: a capability a component's pieces are coded in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Rung {
+    pub id: String,
+    pub component: String,
+    pub capability: String,
+    pub role: Role,
+    pub refines: Option<String>,
+    /// The parameters, every default written in, as the canonical JSON carries them.
+    pub params: Map<String, Value>,
+}
+
+impl Rung {
+    /// An integer parameter (present after defaults, for the capabilities whose schema
+    /// defines it).
+    pub fn param_u64(&self, k: &str) -> Option<u64> {
+        self.params.get(k).and_then(Value::as_u64)
+    }
+    /// A list-of-integers parameter.
+    pub fn param_u64_list(&self, k: &str) -> Option<Vec<u64>> {
+        self.params.get(k)?.as_array()?.iter().map(Value::as_u64).collect()
+    }
+}
+
+/// `[floor]`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Floor {
+    pub supplied_listing: Option<String>,
+    pub extra_keyframes: bool,
+}
+
+/// One delivery class.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Class {
+    pub id: String,
+    pub max_layer: u64,
+    pub max_kbps: Option<u64>,
+    pub floor_only: bool,
+}
+
+/// A declared span of presentation time.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Moment {
+    pub id: String,
+    pub from_ms: u64,
+    pub to_ms: u64,
+    pub tags: Vec<String>,
+}
+
+/// The piece kinds `wai.pack.scenecut/1`'s classification gives ([packaging] §4.6).
+///
+/// [packaging]: ../../../extensions/packaging.md
+pub const PIECE_KINDS: [&str; 4] = ["natural", "static", "synthetic", "motion_high"];
+
+/// A rule's condition: every listed key must hold; an absent key does not constrain.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct When {
+    pub piece_kind: Option<Vec<String>>,
+    pub moment_tag: Option<Vec<String>>,
+}
+
+/// What a rule sets for the pieces it matches; an absent key leaves the value as it was.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct Then {
+    pub ladder: Option<Vec<String>>,
+    pub max_layer: Option<u64>,
+    pub deadline_ms: Option<u64>,
+}
+
+/// One rule, applied in file order.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Rule {
+    pub id: String,
+    pub when: When,
+    pub then: Then,
+}
+
+/// `[classify]`: the thresholds of the piece classification.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ClassifyParams {
+    pub static_permille: u64,
+    pub static_mad_milli: u64,
+    pub synthetic_bins: u64,
+    pub motion_high_milli: u64,
+}
+
+/// Values the command line may override before the digest is taken.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct Overrides {
+    pub royalty_free_only: Option<bool>,
+}
+
+/// A policy, every default written in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Policy {
+    pub asset_id: String,
+    pub royalty_free_only: bool,
+    pub lead: String,
+    pub components: Vec<Component>,
+    pub segmentation: Segmentation,
+    pub ladder: Vec<Rung>,
+    pub floor: Floor,
+    /// `live.layer_lag_ms`: one entry per layer.
+    pub layer_lag_ms: Vec<u64>,
+    pub classes: Vec<Class>,
+    pub moments: Vec<Moment>,
+    pub rules: Vec<Rule>,
+    pub deadline_ms: u64,
+    pub classify: ClassifyParams,
+}
+
+// ─────────────────────────────── stage 0: nesting ───────────────────────────────
+
+/// Whether every container in `v`, at depth `depth`, is at most [`MAX_DEPTH`] deep. The
+/// recursion stops at the first container past it.
+fn shallow(v: &toml::Value, depth: usize) -> bool {
+    match v {
+        toml::Value::Array(a) => depth <= MAX_DEPTH && a.iter().all(|x| shallow(x, depth + 1)),
+        toml::Value::Table(t) => depth <= MAX_DEPTH && t.values().all(|x| shallow(x, depth + 1)),
+        _ => true,
+    }
+}
+
+// ─────────────────────────────── stage 1: value kinds ───────────────────────────────
+
+fn value_kinds(v: &toml::Value, at: &str) -> R<()> {
+    match v {
+        toml::Value::Float(_) => Err(PolicyError::new(PolicyReason::Float, at)),
+        toml::Value::Datetime(_) => Err(PolicyError::new(PolicyReason::Datetime, at)),
+        toml::Value::Integer(i) if *i < 0 => Err(PolicyError::new(PolicyReason::Negative, at)),
+        toml::Value::Integer(i) if *i as u64 > MAX_INTEGER => Err(PolicyError::new(PolicyReason::IntegerRange, at)),
+        toml::Value::Array(a) => {
+            for (i, x) in a.iter().enumerate() {
+                value_kinds(x, &format!("{at}[{i}]"))?;
+            }
+            Ok(())
+        }
+        toml::Value::Table(t) => table_kinds(t, at),
+        _ => Ok(()),
+    }
+}
+
+fn table_kinds(t: &toml::Table, at: &str) -> R<()> {
+    // toml::Table is ordered by key, bytewise.
+    for (k, v) in t {
+        value_kinds(v, &join(at, k))?;
+    }
+    Ok(())
+}
+
+fn join(at: &str, k: &str) -> String {
+    if at.is_empty() { k.to_string() } else { format!("{at}.{k}") }
+}
+
+// ─────────────────────────────── stage 2: schema ───────────────────────────────
+
+/// A table being read against its schema.
+struct Tab<'a> {
+    t: &'a toml::Table,
+    at: String,
+}
+
+static EMPTY: std::sync::LazyLock<toml::Table> = std::sync::LazyLock::new(toml::Table::new);
+
+impl<'a> Tab<'a> {
+    fn new(t: &'a toml::Table, at: String) -> Self {
+        Tab { t, at }
+    }
+    fn err(&self, reason: PolicyReason, k: &str) -> PolicyError {
+        PolicyError::new(reason, join(&self.at, k))
+    }
+    /// Refuse the first key, in byte order, that `allowed` does not hold.
+    fn keys(&self, allowed: &[&str]) -> R<()> {
+        match self.t.keys().find(|k| !allowed.contains(&k.as_str())) {
+            Some(k) => Err(self.err(PolicyReason::UnknownKey, k)),
+            None => Ok(()),
+        }
+    }
+    fn get(&self, k: &str) -> Option<&'a toml::Value> {
+        self.t.get(k)
+    }
+    fn string(&self, k: &str) -> R<Option<String>> {
+        match self.get(k) {
+            None => Ok(None),
+            Some(toml::Value::String(s)) => Ok(Some(s.clone())),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    fn string_req(&self, k: &str) -> R<String> {
+        self.string(k)?.ok_or_else(|| self.err(PolicyReason::MissingKey, k))
+    }
+    /// A required, non-empty string of at most 255 bytes: an id.
+    fn id(&self, k: &str) -> R<String> {
+        let s = self.string_req(k)?;
+        if s.is_empty() || s.len() > 255 {
+            return Err(self.err(PolicyReason::Value, k));
+        }
+        Ok(s)
+    }
+    fn uint(&self, k: &str) -> R<Option<u64>> {
+        match self.get(k) {
+            None => Ok(None),
+            // Stage 1 admitted only integers in 0..=2^53 − 1.
+            Some(toml::Value::Integer(i)) => Ok(Some(*i as u64)),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    /// An integer in `lo..=hi`, `default` when absent (`None`: required).
+    fn uint_in(&self, k: &str, lo: u64, hi: u64, default: Option<u64>) -> R<u64> {
+        let v = match (self.uint(k)?, default) {
+            (Some(v), _) => v,
+            (None, Some(d)) => return Ok(d),
+            (None, None) => return Err(self.err(PolicyReason::MissingKey, k)),
+        };
+        if v < lo || v > hi {
+            return Err(self.err(PolicyReason::Value, k));
+        }
+        Ok(v)
+    }
+    fn uint_opt_in(&self, k: &str, lo: u64, hi: u64) -> R<Option<u64>> {
+        match self.uint(k)? {
+            None => Ok(None),
+            Some(v) if v < lo || v > hi => Err(self.err(PolicyReason::Value, k)),
+            Some(v) => Ok(Some(v)),
+        }
+    }
+    fn boolean(&self, k: &str, default: bool) -> R<bool> {
+        match self.get(k) {
+            None => Ok(default),
+            Some(toml::Value::Boolean(b)) => Ok(*b),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    /// A table member; an absent one reads as empty.
+    fn table(&self, k: &str) -> R<Tab<'a>> {
+        match self.get(k) {
+            None => Ok(Tab::new(&EMPTY, join(&self.at, k))),
+            Some(toml::Value::Table(t)) => Ok(Tab::new(t, join(&self.at, k))),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    fn table_req(&self, k: &str) -> R<Tab<'a>> {
+        if self.get(k).is_none() {
+            return Err(self.err(PolicyReason::MissingKey, k));
+        }
+        self.table(k)
+    }
+    /// An array of tables; an absent one reads as empty.
+    fn tables(&self, k: &str) -> R<Vec<Tab<'a>>> {
+        match self.get(k) {
+            None => Ok(Vec::new()),
+            Some(toml::Value::Array(a)) => a
+                .iter()
+                .enumerate()
+                .map(|(i, v)| match v {
+                    toml::Value::Table(t) => Ok(Tab::new(t, format!("{}[{i}]", join(&self.at, k)))),
+                    _ => Err(self.err(PolicyReason::Type, k)),
+                })
+                .collect(),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    fn strings(&self, k: &str) -> R<Option<Vec<String>>> {
+        match self.get(k) {
+            None => Ok(None),
+            Some(toml::Value::Array(a)) => a
+                .iter()
+                .map(|v| match v {
+                    toml::Value::String(s) => Ok(s.clone()),
+                    _ => Err(self.err(PolicyReason::Type, k)),
+                })
+                .collect::<R<Vec<_>>>()
+                .map(Some),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+    fn uints(&self, k: &str) -> R<Option<Vec<u64>>> {
+        match self.get(k) {
+            None => Ok(None),
+            Some(toml::Value::Array(a)) => a
+                .iter()
+                .map(|v| match v {
+                    toml::Value::Integer(i) => Ok(*i as u64),
+                    _ => Err(self.err(PolicyReason::Type, k)),
+                })
+                .collect::<R<Vec<_>>>()
+                .map(Some),
+            Some(_) => Err(self.err(PolicyReason::Type, k)),
+        }
+    }
+}
+
+/// One parameter of a capability's `params` table.
+enum Param {
+    /// An integer in `lo..=hi`; `default` when absent, required when `None`.
+    Int { lo: u64, hi: u64, default: Option<u64> },
+    /// An integer from `allowed`.
+    OneOf { allowed: &'static [u64], default: u64 },
+    /// A non-empty list of integers in `lo..=hi`.
+    Ints { lo: u64, hi: u64, default: &'static [u64] },
+    /// A string from `allowed`.
+    Word { allowed: &'static [&'static str], default: &'static str },
+}
+
+/// The parameters each capability's rung takes ([packaging] §3.3). A capability the
+/// table does not list takes none.
+///
+/// [packaging]: ../../../extensions/packaging.md
+fn param_schema(cap: &str) -> &'static [(&'static str, Param)] {
+    use Param::*;
+    match cap {
+        "wai.video.int_motion" => &[
+            ("block", OneOf { allowed: &[4, 8, 16, 32], default: 16 }),
+            ("search", Int { lo: 0, hi: 32, default: Some(7) }),
+            ("mv_precision", OneOf { allowed: &[1, 2], default: 2 }),
+            ("q_candidates", Ints { lo: 1, hi: 255, default: &[8] }),
+            ("max_sse_px_milli", Int { lo: 0, hi: MAX_INTEGER, default: Some(0) }),
+        ],
+        "wai.video.int_refine" => &[("q", Int { lo: 1, hi: 255, default: None })],
+        "wai.video.av1" | "wai.video.av1.lossless" => &[("source", Word { allowed: &["supplied", "encode"], default: "supplied" })],
+        "wai.audio.int_refine" => &[
+            ("to_rate", Int { lo: 1, hi: 384_000, default: None }),
+            ("q", Int { lo: 1, hi: 65_535, default: None }),
+        ],
+        "wai.audio.flac" => &[("source", Word { allowed: &["encode", "supplied"], default: "encode" })],
+        _ => &[],
+    }
+}
+
+fn read_params(rung: &Tab<'_>, cap: &str) -> R<Map<String, Value>> {
+    let p = rung.table("params")?;
+    let schema = param_schema(cap);
+    let names: Vec<&str> = schema.iter().map(|(k, _)| *k).collect();
+    p.keys(&names)?;
+    let mut out = Map::new();
+    for (k, kind) in schema {
+        let v = match kind {
+            Param::Int { lo, hi, default } => Value::from(p.uint_in(k, *lo, *hi, *default)?),
+            Param::OneOf { allowed, default } => {
+                let v = p.uint_in(k, 0, MAX_INTEGER, Some(*default))?;
+                if !allowed.contains(&v) {
+                    return Err(p.err(PolicyReason::Value, k));
+                }
+                Value::from(v)
+            }
+            Param::Ints { lo, hi, default } => {
+                let v = p.uints(k)?.unwrap_or_else(|| default.to_vec());
+                if v.is_empty() || v.iter().any(|x| x < lo || x > hi) {
+                    return Err(p.err(PolicyReason::Value, k));
+                }
+                Value::from(v)
+            }
+            Param::Word { allowed, default } => {
+                let v = p.string(k)?.unwrap_or_else(|| default.to_string());
+                if !allowed.contains(&v.as_str()) {
+                    return Err(p.err(PolicyReason::Value, k));
+                }
+                Value::from(v)
+            }
+        };
+        out.insert(k.to_string(), v);
+    }
+    Ok(out)
+}
+
+fn is_hex64(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+
+/// Stage 2: read the document against the schema, defaults written in. `layer_lag_ms`
+/// is returned as written; stage 3 checks it and writes its default.
+fn read(doc: &toml::Table) -> R<(Policy, Option<Vec<u64>>)> {
+    let top = Tab::new(doc, String::new());
+    top.keys(&[
+        "schema", "asset_id", "royalty_free_only", "lead", "component", "segmentation", "ladder", "floor", "live",
+        "class", "moment", "rule", "defaults", "classify",
+    ])?;
+    if top.string_req("schema")? != SCHEMA {
+        return Err(top.err(PolicyReason::Schema, "schema"));
+    }
+    let asset_id = top.id("asset_id")?;
+    let royalty_free_only = top.boolean("royalty_free_only", false)?;
+    let lead = top.id("lead")?;
+
+    if top.get("component").is_none() {
+        return Err(top.err(PolicyReason::MissingKey, "component"));
+    }
+    let mut components = Vec::new();
+    for c in top.tables("component")? {
+        c.keys(&["id", "media", "source", "timebase"])?;
+        let id = c.id("id")?;
+        let media = Media::from_label(&c.string_req("media")?).ok_or_else(|| c.err(PolicyReason::Value, "media"))?;
+        let source = c.string("source")?;
+        let tb = c.table_req("timebase")?;
+        tb.keys(&["num", "den"])?;
+        let num = tb.uint_in("num", 1, u32::MAX as u64, None)? as u32;
+        let den = tb.uint_in("den", 1, u32::MAX as u64, None)? as u32;
+        components.push(Component { id, media, source, timebase: Timebase { num, den } });
+    }
+
+    let s = top.table("segmentation")?;
+    s.keys(&[
+        "target_ms", "min_ms", "max_ms", "scene_cut", "cut_abs_permille", "cut_rel_permille", "cut_window",
+        "lookahead_frames", "closed",
+    ])?;
+    let segmentation = Segmentation {
+        target_ms: s.uint_in("target_ms", 0, MAX_INTEGER, Some(2000))?,
+        min_ms: s.uint_in("min_ms", 0, MAX_INTEGER, Some(1000))?,
+        max_ms: s.uint_in("max_ms", 0, MAX_INTEGER, Some(4000))?,
+        scene_cut: {
+            let v = s.string("scene_cut")?.unwrap_or_else(|| SCENECUT_V1.to_string());
+            if v != SCENECUT_V1 {
+                return Err(s.err(PolicyReason::Value, "scene_cut"));
+            }
+            v
+        },
+        cut_abs_permille: s.uint_in("cut_abs_permille", 1, 1000, Some(300))?,
+        cut_rel_permille: s.uint_in("cut_rel_permille", 0, 1_000_000, Some(3000))?,
+        // At least 3: the relative test (§4.3 step 4) applies only to a window of 3 or
+        // more scores, so a window of 1 or 2 would leave cut_rel_permille inert.
+        cut_window: s.uint_in("cut_window", 3, 64, Some(8))?,
+        lookahead_frames: s.uint_in("lookahead_frames", 0, 64, Some(6))?,
+        closed: s.boolean("closed", true)?,
+    };
+
+    let mut ladder = Vec::new();
+    for r in top.tables("ladder")? {
+        r.keys(&["id", "component", "capability", "role", "refines", "params"])?;
+        let id = r.id("id")?;
+        let component = r.id("component")?;
+        let capability = r.string_req("capability")?;
+        let role = match r.string_req("role")?.as_str() {
+            "base" => Role::Base,
+            "refinement" => Role::Refinement,
+            "floor" => Role::Floor,
+            _ => return Err(r.err(PolicyReason::Value, "role")),
+        };
+        let refines = r.string("refines")?;
+        let params = read_params(&r, &capability)?;
+        ladder.push(Rung { id, component, capability, role, refines, params });
+    }
+
+    let f = top.table("floor")?;
+    f.keys(&["supplied_listing", "extra_keyframes"])?;
+    let supplied_listing = f.string("supplied_listing")?;
+    if supplied_listing.as_deref().is_some_and(|s| !is_hex64(s)) {
+        return Err(f.err(PolicyReason::Value, "supplied_listing"));
+    }
+    let floor = Floor { supplied_listing, extra_keyframes: f.boolean("extra_keyframes", false)? };
+
+    let l = top.table("live")?;
+    l.keys(&["layer_lag_ms"])?;
+    let lag = l.uints("layer_lag_ms")?;
+
+    let mut classes = Vec::new();
+    for c in top.tables("class")? {
+        c.keys(&["id", "max_layer", "max_kbps", "floor_only"])?;
+        classes.push(Class {
+            id: c.id("id")?,
+            max_layer: c.uint_in("max_layer", 0, 255, Some(0))?,
+            max_kbps: c.uint_opt_in("max_kbps", 1, u32::MAX as u64)?,
+            floor_only: c.boolean("floor_only", false)?,
+        });
+    }
+
+    let mut moments = Vec::new();
+    for m in top.tables("moment")? {
+        m.keys(&["id", "from_ms", "to_ms", "tags"])?;
+        let id = m.id("id")?;
+        let from_ms = m.uint_in("from_ms", 0, MAX_INTEGER, None)?;
+        let to_ms = m.uint_in("to_ms", 0, MAX_INTEGER, None)?;
+        if to_ms <= from_ms {
+            return Err(m.err(PolicyReason::Value, "to_ms"));
+        }
+        let tags = m.strings("tags")?.unwrap_or_default();
+        moments.push(Moment { id, from_ms, to_ms, tags });
+    }
+
+    let mut rules = Vec::new();
+    for r in top.tables("rule")? {
+        r.keys(&["id", "when", "then"])?;
+        let id = r.id("id")?;
+        let w = r.table("when")?;
+        w.keys(&["piece_kind", "moment_tag"])?;
+        let piece_kind = w.strings("piece_kind")?;
+        if piece_kind.as_ref().is_some_and(|k| k.iter().any(|x| !PIECE_KINDS.contains(&x.as_str()))) {
+            return Err(w.err(PolicyReason::Value, "piece_kind"));
+        }
+        let moment_tag = w.strings("moment_tag")?;
+        let t = r.table("then")?;
+        t.keys(&["ladder", "max_layer", "deadline_ms"])?;
+        let then = Then {
+            ladder: t.strings("ladder")?,
+            max_layer: t.uint_opt_in("max_layer", 0, 255)?,
+            deadline_ms: t.uint_opt_in("deadline_ms", 1, u32::MAX as u64)?,
+        };
+        rules.push(Rule { id, when: When { piece_kind, moment_tag }, then });
+    }
+
+    let d = top.table("defaults")?;
+    d.keys(&["deadline_ms"])?;
+    let deadline_ms = d.uint_in("deadline_ms", 1, u32::MAX as u64, Some(1500))?;
+
+    let c = top.table("classify")?;
+    c.keys(&["static_permille", "static_mad_milli", "synthetic_bins", "motion_high_milli"])?;
+    let classify = ClassifyParams {
+        static_permille: c.uint_in("static_permille", 0, 1000, Some(5))?,
+        static_mad_milli: c.uint_in("static_mad_milli", 0, MAX_INTEGER, Some(300))?,
+        synthetic_bins: c.uint_in("synthetic_bins", 0, 64, Some(12))?,
+        motion_high_milli: c.uint_in("motion_high_milli", 0, MAX_INTEGER, Some(9000))?,
+    };
+
+    let policy = Policy {
+        asset_id,
+        royalty_free_only,
+        lead,
+        components,
+        segmentation,
+        ladder,
+        floor,
+        layer_lag_ms: Vec::new(),
+        classes,
+        moments,
+        rules,
+        deadline_ms,
+        classify,
+    };
+    Ok((policy, lag))
+}
+
+// ─────────────────────────────── stage 3: constraints ───────────────────────────────
+
+fn first_duplicate<'a>(ids: impl Iterator<Item = &'a str>) -> Option<&'a str> {
+    let mut seen = BTreeSet::new();
+    ids.into_iter().find(|id| !seen.insert(*id))
+}
+
+impl Policy {
+    /// Parse and check a policy, every default written in ([packaging] §3).
+    ///
+    /// [packaging]: ../../../extensions/packaging.md
+    pub fn parse(text: &str) -> Result<Policy, PolicyError> {
+        let toml = || PolicyError::new(PolicyReason::Toml, "");
+        if text.as_bytes().starts_with(BOM) {
+            return Err(toml());
+        }
+        let doc: toml::Table = text.parse().map_err(|_| toml())?;
+        if !doc.values().all(|v| shallow(v, 2)) {
+            return Err(toml());
+        }
+        table_kinds(&doc, "")?;
+        let (mut p, lag) = read(&doc)?;
+        p.constrain(lag)?;
+        Ok(p)
+    }
+
+    /// [`Policy::parse`] over a policy's bytes: bytes that are not UTF-8 are not a policy
+    /// (`policy-toml`), and neither is a byte-order mark.
+    pub fn parse_bytes(b: &[u8]) -> Result<Policy, PolicyError> {
+        let text = std::str::from_utf8(b).map_err(|_| PolicyError::new(PolicyReason::Toml, ""))?;
+        Policy::parse(text)
+    }
+
+    /// The effective policy: this one with `o` applied.
+    pub fn effective(&self, o: &Overrides) -> Policy {
+        let mut p = self.clone();
+        if let Some(b) = o.royalty_free_only {
+            p.royalty_free_only = b;
+        }
+        p
+    }
+
+    /// The layer of each rung: 0 for a base or a floor, one more than the rung it
+    /// refines for a refinement. Defined once stage 3 has checked the chains.
+    pub fn layers(&self) -> BTreeMap<&str, u64> {
+        let by_id: BTreeMap<&str, &Rung> = self.ladder.iter().map(|r| (r.id.as_str(), r)).collect();
+        let mut out = BTreeMap::new();
+        for r in &self.ladder {
+            let mut k = 0u64;
+            let mut cur = r;
+            while let Some(up) = cur.refines.as_deref().and_then(|id| by_id.get(id)) {
+                k += 1;
+                cur = up;
+            }
+            out.insert(r.id.as_str(), k);
+        }
+        out
+    }
+
+    /// The number of layers: one more than the highest rung layer.
+    pub fn layer_count(&self) -> u64 {
+        self.layers().values().copied().max().map_or(1, |m| m + 1)
+    }
+
+    /// The distinct deadline values a refinement may carry: the default and every
+    /// rule's.
+    pub fn deadlines(&self) -> BTreeSet<u64> {
+        let mut d: BTreeSet<u64> = self.rules.iter().filter_map(|r| r.then.deadline_ms).collect();
+        d.insert(self.deadline_ms);
+        d
+    }
+
+    fn constrain(&mut self, lag: Option<Vec<u64>>) -> R<()> {
+        use PolicyReason as P;
+        let e = |r: P, at: &str| Err(PolicyError::new(r, at));
+        if self.components.is_empty() || self.components.len() > MAX_COMPONENTS {
+            return e(P::TooManyComponents, "component");
+        }
+        if self.ladder.len() > MAX_RUNGS {
+            return e(P::TooManyRungs, "ladder");
+        }
+        if self.classes.len() > MAX_CLASSES {
+            return e(P::TooManyClasses, "class");
+        }
+        if self.rules.len() > MAX_RULES {
+            return e(P::TooManyRules, "rule");
+        }
+        if self.moments.len() > MAX_MOMENTS {
+            return e(P::TooManyMoments, "moment");
+        }
+        // One namespace for every id, so a reference (a lead, a rung's component, a
+        // refines, a rule's ladder) never names two things.
+        let ids = self.components.iter().map(|c| c.id.as_str())
+            .chain(self.ladder.iter().map(|r| r.id.as_str()))
+            .chain(self.classes.iter().map(|c| c.id.as_str()))
+            .chain(self.moments.iter().map(|m| m.id.as_str()))
+            .chain(self.rules.iter().map(|r| r.id.as_str()));
+        if let Some(id) = first_duplicate(ids) {
+            return e(P::DuplicateId, id);
+        }
+        if !self.components.iter().any(|c| c.id == self.lead) {
+            return e(P::Lead, "lead");
+        }
+        if !self.segmentation.closed {
+            return e(P::OpenGop, "segmentation.closed");
+        }
+        let s = &self.segmentation;
+        if !(1 <= s.min_ms && s.min_ms <= s.target_ms && s.target_ms <= s.max_ms) {
+            return e(P::PieceBounds, "segmentation");
+        }
+        let comps: BTreeSet<&str> = self.components.iter().map(|c| c.id.as_str()).collect();
+        if let Some(r) = self.ladder.iter().find(|r| !comps.contains(r.component.as_str())) {
+            return e(P::LadderComponent, &format!("ladder.{}", r.id));
+        }
+        if let Some(r) = self.ladder.iter().find(|r| (r.role == Role::Refinement) != r.refines.is_some()) {
+            return e(P::RefinesRole, &format!("ladder.{}", r.id));
+        }
+        let by_id: BTreeMap<&str, &Rung> = self.ladder.iter().map(|r| (r.id.as_str(), r)).collect();
+        if let Some(r) = self.ladder.iter().find(|r| r.refines.as_deref().is_some_and(|t| !by_id.contains_key(t))) {
+            return e(P::DanglingRefines, &format!("ladder.{}", r.id));
+        }
+        for r in &self.ladder {
+            let mut seen = BTreeSet::from([r.id.as_str()]);
+            let mut cur: &Rung = r;
+            while let Some(up) = cur.refines.as_deref() {
+                if !seen.insert(up) {
+                    return e(P::RefinesCycle, &format!("ladder.{}", r.id));
+                }
+                cur = by_id[up];
+            }
+        }
+        for r in self.ladder.iter().filter(|r| r.role == Role::Refinement) {
+            let mut cur: &Rung = r;
+            while let Some(up) = cur.refines.as_deref() {
+                cur = by_id[up];
+                if cur.component != r.component {
+                    return e(P::RefinesBase, &format!("ladder.{}", r.id));
+                }
+            }
+            if cur.role != Role::Base {
+                return e(P::RefinesBase, &format!("ladder.{}", r.id));
+            }
+        }
+        if let Some(t) = first_duplicate(self.ladder.iter().filter_map(|r| r.refines.as_deref())) {
+            return e(P::RefinesBranch, &format!("ladder.{t}"));
+        }
+        if let Some(c) = self.components.iter().find(|c| !self.ladder.iter().any(|r| r.component == c.id && r.role == Role::Base)) {
+            return e(P::NoBase, &format!("component.{}", c.id));
+        }
+        let top = self.layer_count() - 1;
+        if let Some(c) = self.classes.iter().find(|c| c.max_layer > top) {
+            return e(P::ClassLayer, &format!("class.{}", c.id));
+        }
+        if let Some(r) = self.rules.iter().find(|r| r.then.max_layer.is_some_and(|m| m > top)) {
+            return e(P::ClassLayer, &format!("rule.{}", r.id));
+        }
+        for r in &self.rules {
+            if let Some(ids) = &r.then.ladder {
+                let rungs: Option<Vec<&Rung>> = ids.iter().map(|id| by_id.get(id.as_str()).copied()).collect();
+                let ok = rungs.is_some_and(|rs| {
+                    !rs.is_empty()
+                        && rs.iter().all(|x| x.component == rs[0].component)
+                        && rs.iter().any(|x| x.role == Role::Base)
+                });
+                if !ok {
+                    return e(P::RuleLadder, &format!("rule.{}", r.id));
+                }
+            }
+        }
+        let n = self.layer_count() as usize;
+        let lag = lag.unwrap_or_else(|| vec![0; n]);
+        if lag.len() != n || lag[0] != 0 || lag.windows(2).any(|w| w[1] < w[0]) {
+            return e(P::LayerLag, "live.layer_lag_ms");
+        }
+        self.layer_lag_ms = lag;
+        let deadlines = self.deadlines();
+        if deadlines.len() > MAX_DEADLINES {
+            return e(P::TooManyDeadlines, "rule");
+        }
+        for &d in &deadlines {
+            if self.layer_lag_ms.iter().skip(1).any(|&lag| d < lag + 1) {
+                return e(P::DeadlineUnreachable, "live.layer_lag_ms");
+            }
+        }
+        Ok(())
+    }
+
+    /// The effective policy as JSON ([packaging] §3.2): every member the schema
+    /// defines, defaults written in; an optional member with no default (`source`,
+    /// `supplied_listing`, `max_kbps`, `refines`, and a rule's `when` and `then` keys) is
+    /// omitted when absent. Arrays of tables keep their file order.
+    ///
+    /// [packaging]: ../../../extensions/packaging.md
+    pub fn to_value(&self) -> Value {
+        let mut top = Map::new();
+        top.insert("schema".into(), SCHEMA.into());
+        top.insert("asset_id".into(), self.asset_id.clone().into());
+        top.insert("royalty_free_only".into(), self.royalty_free_only.into());
+        top.insert("lead".into(), self.lead.clone().into());
+        let comps = self
+            .components
+            .iter()
+            .map(|c| {
+                let mut m = Map::new();
+                m.insert("id".into(), c.id.clone().into());
+                m.insert("media".into(), c.media.label().into());
+                if let Some(s) = &c.source {
+                    m.insert("source".into(), s.clone().into());
+                }
+                let mut tb = Map::new();
+                tb.insert("num".into(), c.timebase.num.into());
+                tb.insert("den".into(), c.timebase.den.into());
+                m.insert("timebase".into(), tb.into());
+                Value::Object(m)
+            })
+            .collect::<Vec<_>>();
+        top.insert("component".into(), comps.into());
+        let s = &self.segmentation;
+        let mut seg = Map::new();
+        seg.insert("target_ms".into(), s.target_ms.into());
+        seg.insert("min_ms".into(), s.min_ms.into());
+        seg.insert("max_ms".into(), s.max_ms.into());
+        seg.insert("scene_cut".into(), s.scene_cut.clone().into());
+        seg.insert("cut_abs_permille".into(), s.cut_abs_permille.into());
+        seg.insert("cut_rel_permille".into(), s.cut_rel_permille.into());
+        seg.insert("cut_window".into(), s.cut_window.into());
+        seg.insert("lookahead_frames".into(), s.lookahead_frames.into());
+        seg.insert("closed".into(), s.closed.into());
+        top.insert("segmentation".into(), seg.into());
+        let ladder = self
+            .ladder
+            .iter()
+            .map(|r| {
+                let mut m = Map::new();
+                m.insert("id".into(), r.id.clone().into());
+                m.insert("component".into(), r.component.clone().into());
+                m.insert("capability".into(), r.capability.clone().into());
+                m.insert("role".into(), r.role.label().into());
+                if let Some(t) = &r.refines {
+                    m.insert("refines".into(), t.clone().into());
+                }
+                m.insert("params".into(), Value::Object(r.params.clone()));
+                Value::Object(m)
+            })
+            .collect::<Vec<_>>();
+        top.insert("ladder".into(), ladder.into());
+        let mut floor = Map::new();
+        if let Some(l) = &self.floor.supplied_listing {
+            floor.insert("supplied_listing".into(), l.clone().into());
+        }
+        floor.insert("extra_keyframes".into(), self.floor.extra_keyframes.into());
+        top.insert("floor".into(), floor.into());
+        let mut live = Map::new();
+        live.insert("layer_lag_ms".into(), self.layer_lag_ms.clone().into());
+        top.insert("live".into(), live.into());
+        let classes = self
+            .classes
+            .iter()
+            .map(|c| {
+                let mut m = Map::new();
+                m.insert("id".into(), c.id.clone().into());
+                m.insert("max_layer".into(), c.max_layer.into());
+                if let Some(k) = c.max_kbps {
+                    m.insert("max_kbps".into(), k.into());
+                }
+                m.insert("floor_only".into(), c.floor_only.into());
+                Value::Object(m)
+            })
+            .collect::<Vec<_>>();
+        top.insert("class".into(), classes.into());
+        let moments = self
+            .moments
+            .iter()
+            .map(|x| {
+                let mut m = Map::new();
+                m.insert("id".into(), x.id.clone().into());
+                m.insert("from_ms".into(), x.from_ms.into());
+                m.insert("to_ms".into(), x.to_ms.into());
+                m.insert("tags".into(), x.tags.clone().into());
+                Value::Object(m)
+            })
+            .collect::<Vec<_>>();
+        top.insert("moment".into(), moments.into());
+        let rules = self
+            .rules
+            .iter()
+            .map(|r| {
+                let mut when = Map::new();
+                if let Some(k) = &r.when.piece_kind {
+                    when.insert("piece_kind".into(), k.clone().into());
+                }
+                if let Some(t) = &r.when.moment_tag {
+                    when.insert("moment_tag".into(), t.clone().into());
+                }
+                let mut then = Map::new();
+                if let Some(l) = &r.then.ladder {
+                    then.insert("ladder".into(), l.clone().into());
+                }
+                if let Some(m) = r.then.max_layer {
+                    then.insert("max_layer".into(), m.into());
+                }
+                if let Some(d) = r.then.deadline_ms {
+                    then.insert("deadline_ms".into(), d.into());
+                }
+                let mut m = Map::new();
+                m.insert("id".into(), r.id.clone().into());
+                m.insert("when".into(), when.into());
+                m.insert("then".into(), then.into());
+                Value::Object(m)
+            })
+            .collect::<Vec<_>>();
+        top.insert("rule".into(), rules.into());
+        let mut d = Map::new();
+        d.insert("deadline_ms".into(), self.deadline_ms.into());
+        top.insert("defaults".into(), d.into());
+        let c = &self.classify;
+        let mut cl = Map::new();
+        cl.insert("static_permille".into(), c.static_permille.into());
+        cl.insert("static_mad_milli".into(), c.static_mad_milli.into());
+        cl.insert("synthetic_bins".into(), c.synthetic_bins.into());
+        cl.insert("motion_high_milli".into(), c.motion_high_milli.into());
+        top.insert("classify".into(), cl.into());
+        Value::Object(top)
+    }
+
+    /// RFC 8785 over [`Policy::to_value`].
+    pub fn canonical_json(&self) -> String {
+        // Every integer was checked against 2^53 − 1 and every value is a string, a
+        // boolean, an integer, an array or an object, so the subset holds it.
+        wai::jcs::jcs(&self.to_value()).expect("a parsed policy is inside the canonical subset")
+    }
+
+    /// `BLAKE3("wai:pack-policy\x01" ‖ canonical JSON)`.
+    pub fn digest(&self) -> [u8; 32] {
+        let mut h = blake3::Hasher::new();
+        h.update(DOMAIN_POLICY);
+        h.update(self.canonical_json().as_bytes());
+        *h.finalize().as_bytes()
+    }
+
+    /// The component `id`.
+    pub fn component(&self, id: &str) -> Option<&Component> {
+        self.components.iter().find(|c| c.id == id)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const MIN: &str = r#"
+schema = "wai.pack.policy/1"
+asset_id = "a"
+lead = "v"
+[[component]]
+id = "v"
+media = "video"
+timebase = { num = 25, den = 1 }
+[[ladder]]
+id = "b0"
+component = "v"
+capability = "wai.video.int_motion"
+role = "base"
+"#;
+
+    fn code(s: &str) -> &'static str {
+        Policy::parse(s).map(|_| "ok").unwrap_or_else(|e| e.code())
+    }
+
+    #[test]
+    fn a_minimal_policy_gets_every_default() {
+        let p = Policy::parse(MIN).unwrap();
+        assert_eq!(p.segmentation.target_ms, 2000);
+        assert_eq!(p.segmentation.lookahead_frames, 6);
+        assert_eq!(p.deadline_ms, 1500);
+        assert_eq!(p.layer_lag_ms, vec![0]);
+        assert_eq!(p.ladder[0].param_u64("block"), Some(16));
+        assert_eq!(p.ladder[0].param_u64_list("q_candidates"), Some(vec![8]));
+        // The digest covers the effective policy: an override changes it.
+        let o = Overrides { royalty_free_only: Some(true) };
+        assert_ne!(p.digest(), p.effective(&o).digest());
+        assert_eq!(p.digest(), p.effective(&Overrides::default()).digest());
+    }
+
+    /// Each value kind canonical JSON cannot carry is refused wherever it sits, even
+    /// under a key the schema does not define.
+    #[test]
+    fn value_kinds_are_refused_before_keys() {
+        assert_eq!(code(&format!("{MIN}\nzzz = 1.5")), "policy-float");
+        assert_eq!(code(&format!("{MIN}\nzzz = 1979-05-27")), "policy-datetime");
+        assert_eq!(code(&format!("{MIN}\nzzz = -1")), "policy-negative");
+        assert_eq!(code(&format!("{MIN}\nzzz = 9007199254740992")), "policy-integer-range");
+        assert_eq!(code(&format!("{MIN}\nzzz = 9007199254740991")), "policy-unknown-key");
+        assert_eq!(code("schema = "), "policy-toml");
+    }
+
+    /// The bytes before TOML: not UTF-8, a byte-order mark, an integer outside 64 bits,
+    /// nesting past 32 (the document's table at 1), all `policy-toml`, and before any
+    /// value kind.
+    #[test]
+    fn the_byte_layer() {
+        let b = |x: &[u8]| Policy::parse_bytes(x).map(|_| "ok").unwrap_or_else(|e| e.code());
+        assert_eq!(b(MIN.as_bytes()), "ok");
+        assert_eq!(b(&[b"\xef\xbb\xbf", MIN.as_bytes()].concat()), "policy-toml");
+        assert_eq!(b(&[MIN.as_bytes(), b"# \xff\n"].concat()), "policy-toml");
+        assert_eq!(b(format!("{MIN}zzz = 9223372036854775808\n").as_bytes()), "policy-toml");
+        // The deep value comes first, in the document's own table (depth 1): `zzz` is at
+        // depth 2 and each array inside it one deeper.
+        let nest = |d: usize| format!("zzz = {}{}\n{MIN}", "[".repeat(d), "]".repeat(d));
+        assert_eq!(b(nest(31).as_bytes()), "policy-unknown-key");
+        assert_eq!(b(nest(32).as_bytes()), "policy-toml");
+        assert_eq!(b(nest(79).as_bytes()), "policy-toml");
+        // `zzz.a.….a = 1` with d tables: the deepest at depth d + 1.
+        let dotted = |d: usize| format!("zzz.{} = 1\n{MIN}", vec!["a"; d].join("."));
+        assert_eq!(b(dotted(31).as_bytes()), "policy-unknown-key");
+        assert_eq!(b(dotted(32).as_bytes()), "policy-toml");
+        // Nesting outranks a float found earlier in key order.
+        assert_eq!(b(format!("aaa = 1.5\nzzz = {}{}\n{MIN}", "[".repeat(32), "]".repeat(32)).as_bytes()), "policy-toml");
+    }
+
+    #[test]
+    fn units_and_alignment_round_down() {
+        let tb = Timebase { num: 30000, den: 1001 };
+        assert_eq!(tb.units_from_ms(1000), 29);
+        assert_eq!(tb.units_from_ms(0), 1);
+        let a = Timebase { num: 48000, den: 1 };
+        assert_eq!(a.align_from(50, Timebase { num: 25, den: 1 }), 96000);
+        assert_eq!(tb.align_from(3, Timebase { num: 25, den: 1 }), 3);
+    }
+}
diff --git a/wai/wai-pack/src/scenecut.rs b/wai/wai-pack/src/scenecut.rs
new file mode 100644
index 000000000..fa74210e1
--- /dev/null
+++ b/wai/wai-pack/src/scenecut.rs
@@ -0,0 +1,422 @@
+//! `wai.pack.scenecut/1` ([packaging] §4.3): piece boundaries as a pure function of
+//! the frames and the policy, decided with a bounded lookahead so that a live and an
+//! on-demand segmenter with equal lookahead cut alike.
+//!
+//! All integer. For frame `f` (RGB8, `w × h`):
+//!
+//! 1. Luma `Y = (77R + 150G + 29B + 128) >> 8`; histogram `H_f` of 64 bins, `Y >> 2`.
+//! 2. `D(a, b) = (Σ_i |H_a[i] − H_b[i]|) · 1000 / (2wh)`, rounded down: the share of
+//!    pixels, in thousandths, whose bin differs. The score `s_f = D(f, f − 1)`, `f ≥ 1`.
+//! 3. The current piece starts at `p`; `len = f − p`. Its window `W_f` is the scores
+//!    `s_g`, `p < g < f`, the last `cut_window` of them. `m_f` is the lower median of
+//!    `W_f` (sorted ascending, the element at index `(|W_f| − 1) / 2`).
+//! 4. **Hard cut** at `f`: `len ≥ min`, `s_f ≥ cut_abs`, and `|W_f| < 3` or
+//!    `s_f · 1000 ≥ cut_rel · m_f`.
+//! 5. **Soft cut** at `f`: `len ≥ target` and `2 · s_f ≥ cut_abs`.
+//! 6. **Return clause.** A cut at `f` is rejected when `D(f + k, f − 1) < cut_abs` for some
+//!    `k` in `1..=min(L, last − f)`: the content came back within `L` frames, so `f`
+//!    starts a flash.
+//! 7. **Revisit clause.** A cut at `f` is rejected when `D(f, f − 1 − j) < cut_abs` for
+//!    some `j` in `1..=min(L, f − 1)`: `f` returns to content seen within `L` frames, so
+//!    it ends a flash. The frames before `p` count.
+//! 8. A hard or soft cut that clauses 6 and 7 do not reject starts a piece at `f`
+//!    (flag `SCENE_CUT`). Otherwise, when `len ≥ max`, a piece starts at `f` (flag
+//!    `FORCED`).
+//!
+//! `L` is `lookahead_frames` and `last` the index of the source's last frame. A
+//! decision at `f` reads no frame after `f + L`, so [`Segmenter::push`] decides frame
+//! `f` as soon as frame `f + L` arrives, and [`Segmenter::finish`] decides the rest
+//! once `last` is known. What the segmenter holds is bounded by `L` and the window, not
+//! by the stream's length ([`Segmenter::retained`]): every frame's score is kept only by
+//! [`Segmenter::with_scores`], for a batch caller. Every piece has `min ≤ len ≤ max`, except the source's last,
+//! which may be shorter than `min`. There is one implementation, used by both
+//! on-demand and live packing.
+//!
+//! [packaging]: ../../../extensions/packaging.md
+
+use crate::policy::{Segmentation, Timebase};
+use std::collections::VecDeque;
+
+/// Histogram bins.
+pub const BINS: usize = 64;
+/// A luma histogram.
+pub type Hist = [u32; BINS];
+
+/// A piece's first frame follows a scene cut.
+pub const FLAG_SCENE_CUT: u8 = 1;
+/// A piece's first frame was forced at `max`.
+pub const FLAG_FORCED: u8 = 2;
+
+/// The domain of the plan digest.
+pub const DOMAIN_PLAN: &[u8] = b"wai:pack-plan\x01";
+
+/// BT.601-weighted integer luma of one RGB8 pixel.
+#[inline]
+pub fn luma(r: u8, g: u8, b: u8) -> u8 {
+    ((77 * r as u32 + 150 * g as u32 + 29 * b as u32 + 128) >> 8) as u8
+}
+
+/// The luma plane of an RGB8 frame.
+pub fn luma_plane(rgb: &[u8]) -> Vec<u8> {
+    rgb.as_chunks::<3>().0.iter().map(|p| luma(p[0], p[1], p[2])).collect()
+}
+
+/// The 64-bin histogram of a luma plane.
+pub fn histogram(y: &[u8]) -> Hist {
+    let mut h = [0u32; BINS];
+    for &v in y {
+        h[(v >> 2) as usize] += 1;
+    }
+    h
+}
+
+/// `D(a, b)`: the share of `wh` pixels, in thousandths, whose bin differs, rounded down.
+pub fn distance(a: &Hist, b: &Hist, wh: u64) -> u64 {
+    let sum: u64 = a.iter().zip(b).map(|(x, y)| x.abs_diff(*y) as u64).sum();
+    sum * 1000 / (2 * wh)
+}
+
+/// `wai.pack.scenecut/1`'s parameters, in frames.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SegParams {
+    pub min: u64,
+    pub target: u64,
+    pub max: u64,
+    pub cut_abs: u64,
+    pub cut_rel: u64,
+    pub window: usize,
+    pub lookahead: u64,
+}
+
+impl SegParams {
+    /// The policy's segmentation on a component's timebase (one unit per frame).
+    pub fn from_policy(s: &Segmentation, tb: Timebase) -> Self {
+        SegParams {
+            min: tb.units_from_ms(s.min_ms),
+            target: tb.units_from_ms(s.target_ms),
+            max: tb.units_from_ms(s.max_ms),
+            cut_abs: s.cut_abs_permille,
+            cut_rel: s.cut_rel_permille,
+            window: s.cut_window as usize,
+            lookahead: s.lookahead_frames,
+        }
+    }
+}
+
+/// What classification reads of a piece ([packaging] §4.6), gathered while segmenting.
+///
+/// [packaging]: ../../../extensions/packaging.md
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct PieceStats {
+    /// `Σ |Y_f − Y_{f−1}|` over every pixel of every consecutive pair in the piece.
+    pub abs_diff: u64,
+    /// Pixels of consecutive pairs whose luma differs.
+    pub changed: u64,
+    /// `wh · (n − 1)`: the pixels compared.
+    pub compared: u64,
+    /// Non-empty histogram bins of the piece's first frame.
+    pub occupancy: u32,
+}
+
+/// A closed piece of a component.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Piece {
+    /// First frame.
+    pub start: u64,
+    /// Frames.
+    pub len: u64,
+    /// `FLAG_SCENE_CUT`, `FLAG_FORCED`, or 0 for the source's first piece.
+    pub flags: u8,
+    pub stats: PieceStats,
+}
+
+/// What the segmenter keeps of a frame while it may still be read.
+#[derive(Clone)]
+struct Rec {
+    hist: Hist,
+    /// `s_f`; 0 for frame 0.
+    score: u64,
+    /// `Σ |Y_f − Y_{f−1}|` and the changed count of the pair `(f − 1, f)`.
+    abs_diff: u64,
+    changed: u64,
+    occupancy: u32,
+}
+
+/// The streaming segmenter: frames in, closed pieces out.
+pub struct Segmenter {
+    p: SegParams,
+    wh: u64,
+    /// Frames `base..n`.
+    recs: VecDeque<Rec>,
+    base: u64,
+    /// Frames pushed.
+    n: u64,
+    /// The next frame to decide.
+    next: u64,
+    start: u64,
+    flags: u8,
+    stats: PieceStats,
+    window: VecDeque<u64>,
+    prev_y: Vec<u8>,
+    /// Every frame's score, in order (frame 0's is 0), when the caller asked for them.
+    scores: Option<Vec<u64>>,
+}
+
+impl Segmenter {
+    pub fn new(p: SegParams, w: u32, h: u32) -> Self {
+        Segmenter {
+            p,
+            wh: w as u64 * h as u64,
+            recs: VecDeque::new(),
+            base: 0,
+            n: 0,
+            next: 0,
+            start: 0,
+            flags: 0,
+            stats: PieceStats::default(),
+            window: VecDeque::new(),
+            prev_y: Vec::new(),
+            scores: None,
+        }
+    }
+
+    /// A segmenter that also keeps every frame's score: a batch output, which grows with
+    /// the stream.
+    pub fn with_scores(p: SegParams, w: u32, h: u32) -> Self {
+        Segmenter { scores: Some(Vec::new()), ..Segmenter::new(p, w, h) }
+    }
+
+    /// Every frame's score so far, frame 0's as 0; empty unless made
+    /// [`Segmenter::with_scores`].
+    pub fn scores(&self) -> &[u64] {
+        self.scores.as_deref().unwrap_or(&[])
+    }
+
+    /// The per-frame records and window scores the segmenter holds (and the scores, when
+    /// it keeps them): without scores, at most `2·L + 2` records and the window.
+    pub fn retained(&self) -> usize {
+        self.recs.len() + self.window.len() + self.scores.as_ref().map_or(0, Vec::len)
+    }
+
+    fn rec(&self, f: u64) -> &Rec {
+        &self.recs[(f - self.base) as usize]
+    }
+
+    /// Push the next RGB8 frame; returns the pieces this closed.
+    pub fn push(&mut self, rgb: &[u8]) -> Vec<Piece> {
+        let y = luma_plane(rgb);
+        let hist = histogram(&y);
+        let (mut abs_diff, mut changed, mut score) = (0, 0, 0);
+        if self.n > 0 {
+            for (a, b) in y.iter().zip(&self.prev_y) {
+                let d = a.abs_diff(*b) as u64;
+                abs_diff += d;
+                changed += (d != 0) as u64;
+            }
+            score = distance(&hist, &self.rec(self.n - 1).hist, self.wh);
+        }
+        let occupancy = hist.iter().filter(|&&c| c != 0).count() as u32;
+        self.recs.push_back(Rec { hist, score, abs_diff, changed, occupancy });
+        if let Some(s) = self.scores.as_mut() {
+            s.push(score);
+        }
+        self.prev_y = y;
+        self.n += 1;
+        let mut out = Vec::new();
+        while self.next + self.p.lookahead < self.n {
+            self.decide(None, &mut out);
+        }
+        out
+    }
+
+    /// The source has ended: decide the remaining frames and close the last piece.
+    pub fn finish(mut self) -> Vec<Piece> {
+        let mut out = Vec::new();
+        if self.n == 0 {
+            return out;
+        }
+        let last = self.n - 1;
+        while self.next < self.n {
+            self.decide(Some(last), &mut out);
+        }
+        out.push(Piece { start: self.start, len: self.n - self.start, flags: self.flags, stats: self.stats });
+        out
+    }
+
+    fn rejected(&self, f: u64, last: Option<u64>) -> bool {
+        let l = self.p.lookahead;
+        let ahead = last.map_or(l, |last| l.min(last - f));
+        let cut = self.p.cut_abs;
+        let prev = &self.rec(f - 1).hist;
+        if (1..=ahead).any(|k| distance(&self.rec(f + k).hist, prev, self.wh) < cut) {
+            return true;
+        }
+        let cur = &self.rec(f).hist;
+        (1..=l.min(f - 1)).any(|j| distance(cur, &self.rec(f - 1 - j).hist, self.wh) < cut)
+    }
+
+    fn decide(&mut self, last: Option<u64>, out: &mut Vec<Piece>) {
+        let f = self.next;
+        self.next += 1;
+        if f == 0 {
+            self.stats.occupancy = self.rec(0).occupancy;
+        } else {
+            let p = self.p;
+            let len = f - self.start;
+            let s = self.rec(f).score;
+            let hard = len >= p.min
+                && s >= p.cut_abs
+                && (self.window.len() < 3 || s * 1000 >= p.cut_rel * lower_median(&self.window));
+            let soft = len >= p.target && 2 * s >= p.cut_abs;
+            let flag = if (hard || soft) && !self.rejected(f, last) {
+                Some(FLAG_SCENE_CUT)
+            } else if len >= p.max {
+                Some(FLAG_FORCED)
+            } else {
+                None
+            };
+            match flag {
+                Some(flag) => {
+                    out.push(Piece { start: self.start, len, flags: self.flags, stats: self.stats });
+                    self.start = f;
+                    self.flags = flag;
+                    self.stats = PieceStats { occupancy: self.rec(f).occupancy, ..PieceStats::default() };
+                    self.window.clear();
+                }
+                None => {
+                    let (abs_diff, changed) = (self.rec(f).abs_diff, self.rec(f).changed);
+                    self.stats.abs_diff += abs_diff;
+                    self.stats.changed += changed;
+                    self.stats.compared += self.wh;
+                    self.window.push_back(s);
+                    if self.window.len() > p.window {
+                        self.window.pop_front();
+                    }
+                }
+            }
+        }
+        // Keep frames from next − 1 − L on: the revisit clause reads that far back.
+        let keep = self.next.saturating_sub(1 + self.p.lookahead);
+        while self.base < keep {
+            self.recs.pop_front();
+            self.base += 1;
+        }
+    }
+}
+
+fn lower_median(w: &VecDeque<u64>) -> u64 {
+    let mut v: Vec<u64> = w.iter().copied().collect();
+    v.sort_unstable();
+    v[(v.len() - 1) / 2]
+}
+
+/// Segment frames held in memory: the pieces and every frame's score.
+pub fn segment(p: SegParams, w: u32, h: u32, frames: impl IntoIterator<Item = impl AsRef<[u8]>>) -> (Vec<Piece>, Vec<u64>) {
+    let mut s = Segmenter::with_scores(p, w, h);
+    let mut pieces = Vec::new();
+    for f in frames {
+        pieces.extend(s.push(f.as_ref()));
+    }
+    let scores = s.scores().to_vec();
+    pieces.extend(s.finish());
+    (pieces, scores)
+}
+
+/// The plan digest ([packaging] §4.2): `BLAKE3("wai:pack-plan\x01" ‖ u64 LE n ‖ n ×
+/// u64 LE start)`.
+///
+/// [packaging]: ../../../extensions/packaging.md
+pub fn plan_digest(starts: &[u64]) -> [u8; 32] {
+    let mut h = blake3::Hasher::new();
+    h.update(DOMAIN_PLAN);
+    h.update(&(starts.len() as u64).to_le_bytes());
+    for s in starts {
+        h.update(&s.to_le_bytes());
+    }
+    *h.finalize().as_bytes()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const W: u32 = 8;
+    const H: u32 = 8;
+
+    /// A flat grey frame of luma level `v` (R = G = B, so `Y = v`).
+    fn flat(v: u8) -> Vec<u8> {
+        vec![v; (W * H * 3) as usize]
+    }
+
+    fn params(lookahead: u64) -> SegParams {
+        SegParams { min: 4, target: 8, max: 12, cut_abs: 300, cut_rel: 3000, window: 8, lookahead }
+    }
+
+    fn starts(p: SegParams, frames: &[Vec<u8>]) -> Vec<u64> {
+        segment(p, W, H, frames).0.iter().map(|x| x.start).collect()
+    }
+
+    #[test]
+    fn distance_is_the_moved_share_in_thousandths() {
+        let (a, b) = (histogram(&[0; 64]), histogram(&[255; 64]));
+        assert_eq!(distance(&a, &b, 64), 1000);
+        assert_eq!(distance(&a, &a, 64), 0);
+        let half: Vec<u8> = (0..64).map(|i| if i < 32 { 0 } else { 255 }).collect();
+        assert_eq!(distance(&a, &histogram(&half), 64), 500);
+    }
+
+    /// A flash of exactly L frames is not a cut (the piece runs to `max`); with a
+    /// lookahead one frame shorter, the flash's first frame cuts.
+    #[test]
+    fn a_flash_of_lookahead_frames_is_not_cut() {
+        let mut f: Vec<Vec<u8>> = (0..6).map(|_| flat(40)).collect();
+        f.extend((0..3).map(|_| flat(200)));
+        f.extend((0..6).map(|_| flat(40)));
+        assert_eq!(starts(params(3), &f), vec![0, 12]);
+        assert_eq!(starts(params(2), &f), vec![0, 6]);
+    }
+
+    /// A cut is hard only once the piece has `min` frames; a piece never passes `max`.
+    #[test]
+    fn min_and_max_bound_every_piece() {
+        let mut f: Vec<Vec<u8>> = (0..2).map(|_| flat(40)).collect();
+        f.extend((0..30).map(|_| flat(200)));
+        let (pieces, _) = segment(params(2), W, H, &f);
+        let got: Vec<(u64, u64, u8)> = pieces.iter().map(|p| (p.start, p.len, p.flags)).collect();
+        assert_eq!(got, vec![(0, 12, 0), (12, 12, FLAG_FORCED), (24, 8, FLAG_FORCED)]);
+    }
+
+    /// Pushed one at a time, the pieces come out as soon as their end is decided, and
+    /// are those `segment` gives.
+    #[test]
+    fn streaming_decides_after_lookahead() {
+        let mut f: Vec<Vec<u8>> = (0..6).map(|_| flat(40)).collect();
+        f.extend((0..10).map(|_| flat(200)));
+        let mut s = Segmenter::new(params(3), W, H);
+        let mut closed_at = Vec::new();
+        for (i, x) in f.iter().enumerate() {
+            if !s.push(x).is_empty() {
+                closed_at.push(i);
+            }
+        }
+        // The cut at 6 is decided when frame 6 + 3 arrives.
+        assert_eq!(closed_at, vec![9]);
+        assert_eq!(plan_digest(&[0, 6]), plan_digest(&starts(params(3), &f)));
+    }
+
+    /// Over a long stream, what the segmenter holds stays within its lookahead and window:
+    /// `2·L + 2` records and the window, whatever the stream's length.
+    #[test]
+    fn state_is_bounded_over_a_long_stream() {
+        let p = params(6);
+        let mut s = Segmenter::new(p, 2, 2);
+        let mut pieces = 0;
+        for t in 0..60_000u32 {
+            let v = ((t / 7) * 37 % 251) as u8;
+            pieces += s.push(&[v; 12]).len();
+            assert!(s.retained() <= 2 * p.lookahead as usize + 2 + p.window, "frame {t}: {}", s.retained());
+        }
+        assert!(pieces > 1000);
+        assert!(s.scores().is_empty());
+    }
+}
diff --git a/wai/wai-pack/src/source/mod.rs b/wai/wai-pack/src/source/mod.rs
new file mode 100644
index 000000000..f5d9ab836
--- /dev/null
+++ b/wai/wai-pack/src/source/mod.rs
@@ -0,0 +1,88 @@
+//! Source readers ([packaging] §4.7): Y4M video to RGB8 frames, and WAV (PCM s16le)
+//! audio. Each refuses what it does not read with a named reason.
+//!
+//! [packaging]: ../../../../extensions/packaging.md
+
+pub mod wav;
+pub mod y4m;
+
+/// Why a source was refused.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SourceReason {
+    /// A Y4M stream header that is not `YUV4MPEG2` with a width and a height.
+    Y4mHeader,
+    /// An interlaced Y4M stream or frame (`I` other than `p`).
+    Y4mInterlaced,
+    /// A Y4M colour space other than 8-bit 4:2:0 or 4:4:4.
+    Y4mColorspace,
+    /// A Y4M `FRAME` line that sets the width, height or colour space.
+    Y4mSizeChange,
+    /// A Y4M frame that ends before its planes do, or a line that is not `FRAME`.
+    Y4mTruncated,
+    /// A WAV file that is not RIFF/WAVE PCM with 16-bit samples.
+    WavFormat,
+    /// A WAV file that ends before a chunk it declares.
+    WavTruncated,
+}
+
+impl SourceReason {
+    pub fn code(self) -> &'static str {
+        match self {
+            SourceReason::Y4mHeader => "y4m-header",
+            SourceReason::Y4mInterlaced => "y4m-interlaced",
+            SourceReason::Y4mColorspace => "y4m-colorspace",
+            SourceReason::Y4mSizeChange => "y4m-size-change",
+            SourceReason::Y4mTruncated => "y4m-truncated",
+            SourceReason::WavFormat => "wav-format",
+            SourceReason::WavTruncated => "wav-truncated",
+        }
+    }
+}
+
+/// A source refusal, or an I/O failure reading the source.
+#[derive(Debug)]
+pub enum SourceError {
+    Refused(SourceReason),
+    Io(std::io::Error),
+}
+
+impl SourceError {
+    /// The refusal's name; `io` for an I/O failure.
+    pub fn code(&self) -> &'static str {
+        match self {
+            SourceError::Refused(r) => r.code(),
+            SourceError::Io(_) => "io",
+        }
+    }
+}
+
+impl std::fmt::Display for SourceError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            SourceError::Refused(r) => f.write_str(r.code()),
+            SourceError::Io(e) => write!(f, "io: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for SourceError {}
+
+impl From<std::io::Error> for SourceError {
+    fn from(e: std::io::Error) -> Self {
+        SourceError::Io(e)
+    }
+}
+
+impl From<SourceReason> for SourceError {
+    fn from(r: SourceReason) -> Self {
+        SourceError::Refused(r)
+    }
+}
+
+/// One RGB8 frame: `w × h` pixels, rows top to bottom, R, G, B bytes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Frame {
+    pub w: u32,
+    pub h: u32,
+    pub rgb: Vec<u8>,
+}
diff --git a/wai/wai-pack/src/source/wav.rs b/wai/wai-pack/src/source/wav.rs
new file mode 100644
index 000000000..bc8f1287c
--- /dev/null
+++ b/wai/wai-pack/src/source/wav.rs
@@ -0,0 +1,182 @@
+//! WAV audio: RIFF/WAVE with a PCM `fmt ` chunk (format tag 1) of 16-bit samples,
+//! read a block at a time as interleaved `i16` ([packaging] §4.7). Anything else is
+//! refused `wav-format`; a chunk that ends early, `wav-truncated`.
+//!
+//! No field of the file sizes a buffer: a block grows only with the bytes that arrive,
+//! so a `data` chunk that declares 4 GiB and holds a few bytes is refused
+//! `wav-truncated` having allocated what it held.
+//!
+//! [packaging]: ../../../../extensions/packaging.md
+
+use super::{SourceError, SourceReason};
+use std::io::Read;
+
+/// The stream's format.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct WavFormat {
+    pub channels: u16,
+    pub rate: u32,
+}
+
+/// A WAV stream positioned at its sample data.
+pub struct WavReader<R: Read> {
+    r: R,
+    pub format: WavFormat,
+    /// Sample frames not yet read.
+    left: u64,
+}
+
+fn refuse<T>(r: SourceReason) -> Result<T, SourceError> {
+    Err(SourceError::Refused(r))
+}
+
+fn read_exact<R: Read>(r: &mut R, b: &mut [u8]) -> Result<(), SourceError> {
+    r.read_exact(b).map_err(|e| match e.kind() {
+        std::io::ErrorKind::UnexpectedEof => SourceError::Refused(SourceReason::WavTruncated),
+        _ => SourceError::Io(e),
+    })
+}
+
+/// Skip `n` bytes of a chunk.
+fn skip<R: Read>(r: &mut R, n: u64) -> Result<(), SourceError> {
+    let got = std::io::copy(&mut r.take(n), &mut std::io::sink())?;
+    if got != n {
+        return refuse(SourceReason::WavTruncated);
+    }
+    Ok(())
+}
+
+impl<R: Read> WavReader<R> {
+    /// Read the RIFF header and every chunk up to `data`.
+    pub fn new(mut r: R) -> Result<Self, SourceError> {
+        let mut h = [0u8; 12];
+        read_exact(&mut r, &mut h).map_err(|_| SourceError::Refused(SourceReason::WavFormat))?;
+        if &h[0..4] != b"RIFF" || &h[8..12] != b"WAVE" {
+            return refuse(SourceReason::WavFormat);
+        }
+        let mut format = None;
+        loop {
+            let mut c = [0u8; 8];
+            read_exact(&mut r, &mut c)?;
+            let len = u32::from_le_bytes([c[4], c[5], c[6], c[7]]) as u64;
+            match &c[0..4] {
+                b"fmt " => {
+                    if !(16..=40).contains(&len) {
+                        return refuse(SourceReason::WavFormat);
+                    }
+                    let mut f = vec![0u8; len as usize];
+                    read_exact(&mut r, &mut f)?;
+                    let tag = u16::from_le_bytes([f[0], f[1]]);
+                    let channels = u16::from_le_bytes([f[2], f[3]]);
+                    let rate = u32::from_le_bytes([f[4], f[5], f[6], f[7]]);
+                    let align = u16::from_le_bytes([f[12], f[13]]);
+                    let bits = u16::from_le_bytes([f[14], f[15]]);
+                    // 2 · channels is formed without wrapping: 32768 channels and an
+                    // alignment of 0 is a contradiction, not a match.
+                    if tag != 1 || bits != 16 || channels == 0 || rate == 0 || channels.checked_mul(2) != Some(align) {
+                        return refuse(SourceReason::WavFormat);
+                    }
+                    format = Some(WavFormat { channels, rate });
+                    if len % 2 == 1 {
+                        skip(&mut r, 1)?;
+                    }
+                }
+                b"data" => {
+                    let Some(format) = format else {
+                        return refuse(SourceReason::WavFormat);
+                    };
+                    let frame = 2 * format.channels as u64;
+                    if !len.is_multiple_of(frame) {
+                        return refuse(SourceReason::WavFormat);
+                    }
+                    return Ok(WavReader { r, format, left: len / frame });
+                }
+                _ => skip(&mut r, len + (len & 1))?,
+            }
+        }
+    }
+
+    /// Sample frames not yet read.
+    pub fn remaining(&self) -> u64 {
+        self.left
+    }
+
+    /// The next block of at most `frames` sample frames, interleaved; empty at the end.
+    /// The block grows with the bytes read, never to a size the file or `frames`
+    /// declares ahead of them.
+    pub fn next_block(&mut self, frames: u64) -> Result<Vec<i16>, SourceError> {
+        let n = frames.min(self.left);
+        let want = n.saturating_mul(2 * self.format.channels as u64);
+        let mut b = Vec::new();
+        (&mut self.r).take(want).read_to_end(&mut b)?;
+        if (b.len() as u64) < want {
+            return refuse(SourceReason::WavTruncated);
+        }
+        self.left -= n;
+        Ok(b.as_chunks::<2>().0.iter().map(|s| i16::from_le_bytes(*s)).collect())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    pub(crate) fn wav(tag: u16, channels: u16, bits: u16, data: &[u8]) -> Vec<u8> {
+        let mut f = Vec::new();
+        f.extend_from_slice(&tag.to_le_bytes());
+        f.extend_from_slice(&channels.to_le_bytes());
+        f.extend_from_slice(&8000u32.to_le_bytes());
+        f.extend_from_slice(&(8000 * channels as u32 * bits as u32 / 8).to_le_bytes());
+        f.extend_from_slice(&(channels * bits / 8).to_le_bytes());
+        f.extend_from_slice(&bits.to_le_bytes());
+        let mut b = b"RIFF\0\0\0\0WAVEfmt ".to_vec();
+        b.extend_from_slice(&16u32.to_le_bytes());
+        b.extend_from_slice(&f);
+        b.extend_from_slice(b"data");
+        b.extend_from_slice(&(data.len() as u32).to_le_bytes());
+        b.extend_from_slice(data);
+        b
+    }
+
+    fn code(b: &[u8]) -> &'static str {
+        let read = || -> Result<Vec<i16>, SourceError> {
+            let mut r = WavReader::new(b)?;
+            let n = r.remaining();
+            r.next_block(n)
+        };
+        read().map(|_| "ok").unwrap_or_else(|e| e.code())
+    }
+
+    #[test]
+    fn pcm16_reads_and_the_rest_is_refused() {
+        let s = wav(1, 2, 16, &[1, 0, 255, 255, 2, 0, 0, 128]);
+        let mut r = WavReader::new(&s[..]).unwrap();
+        assert_eq!(r.format, WavFormat { channels: 2, rate: 8000 });
+        assert_eq!(r.next_block(9).unwrap(), vec![1, -1, 2, i16::MIN]);
+        assert_eq!(code(&wav(3, 1, 32, &[0; 4])), "wav-format");
+        assert_eq!(code(&wav(1, 1, 8, &[0; 4])), "wav-format");
+        assert_eq!(code(&wav(1, 1, 24, &[0; 6])), "wav-format");
+        // 8-bit samples under a block alignment of 2 (a header that contradicts
+        // itself): the sample size alone refuses it.
+        let mut odd = wav(1, 1, 8, &[0; 4]);
+        odd[32] = 2;
+        assert_eq!(code(&odd), "wav-format");
+        assert_eq!(code(b"RIFX\0\0\0\0WAVE"), "wav-format");
+        let mut t = wav(1, 1, 16, &[0; 4]);
+        t.truncate(t.len() - 1);
+        assert_eq!(code(&t), "wav-truncated");
+        // 2 · channels past u16: 32768 channels with alignment 0, and 32769 with 2,
+        // agree with a wrapped product and are refused.
+        for (channels, align) in [(32768u16, 0u16), (32769, 2)] {
+            let mut x = wav(1, 1, 16, &[0; 4]);
+            x[22..24].copy_from_slice(&channels.to_le_bytes());
+            x[32..34].copy_from_slice(&align.to_le_bytes());
+            assert_eq!(code(&x), "wav-format", "{channels} channels");
+        }
+        // A data chunk that declares 4 GiB and holds 4 bytes.
+        let mut big = wav(1, 1, 16, &[0; 4]);
+        let at = big.len() - 8;
+        big[at..at + 4].copy_from_slice(&0xffff_fffeu32.to_le_bytes());
+        assert_eq!(code(&big), "wav-truncated");
+    }
+}
diff --git a/wai/wai-pack/src/source/y4m.rs b/wai/wai-pack/src/source/y4m.rs
new file mode 100644
index 000000000..50d13c23e
--- /dev/null
+++ b/wai/wai-pack/src/source/y4m.rs
@@ -0,0 +1,233 @@
+//! Y4M (`YUV4MPEG2`) video, read a frame at a time and converted to RGB8 ([packaging]
+//! §4.7).
+//!
+//! Accepted: 8-bit 4:2:0 (`C420jpeg`, `C420paldv`, `C420mpeg2`, `C420`, or no `C`
+//! parameter) and 4:4:4 (`C444`), progressive (`Ip` or no `I`). The conversion is
+//! BT.709 limited range in integers, with 4:2:0 chroma taken at the nearest sample
+//! (`(y >> 1, x >> 1)`):
+//!
+//! ```text
+//! R = clip((298(Y−16) + 459(Cr−128) + 128) >> 8)
+//! G = clip((298(Y−16) − 55(Cb−128) − 136(Cr−128) + 128) >> 8)
+//! B = clip((298(Y−16) + 541(Cb−128) + 128) >> 8)
+//! ```
+//!
+//! where `>>` is the arithmetic shift and `clip` clamps to 0..=255.
+//!
+//! [packaging]: ../../../../extensions/packaging.md
+
+use super::{Frame, SourceError, SourceReason};
+use std::io::{BufRead, BufReader, Read};
+
+/// Chroma layout of the stream.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Chroma {
+    C420,
+    C444,
+}
+
+/// The stream header's parameters.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Header {
+    pub w: u32,
+    pub h: u32,
+    /// The frame rate `F<num>:<den>`, when the header gives one.
+    pub rate: Option<(u32, u32)>,
+    pub chroma: Chroma,
+}
+
+/// The most pixels a frame may hold (`w·h`), so a header never sizes an allocation
+/// past what a 2^26-element RGB frame needs.
+pub const MAX_PIXELS: u64 = (1 << 26) / 3;
+
+/// A Y4M stream, read one frame at a time.
+pub struct Y4mReader<R: Read> {
+    r: BufReader<R>,
+    pub header: Header,
+    buf: Vec<u8>,
+}
+
+fn refuse<T>(r: SourceReason) -> Result<T, SourceError> {
+    Err(SourceError::Refused(r))
+}
+
+/// Read one `\n`-terminated line, at most 1024 bytes. `None` at a clean end of stream.
+fn line<R: Read>(r: &mut BufReader<R>, at_end: SourceReason) -> Result<Option<Vec<u8>>, SourceError> {
+    let mut l = Vec::new();
+    let n = r.by_ref().take(1025).read_until(b'\n', &mut l)?;
+    if n == 0 {
+        return Ok(None);
+    }
+    if l.last() != Some(&b'\n') {
+        return refuse(at_end);
+    }
+    l.pop();
+    Ok(Some(l))
+}
+
+fn parse_u32(s: &[u8]) -> Option<u32> {
+    if s.is_empty() || s.len() > 10 || !s.iter().all(u8::is_ascii_digit) {
+        return None;
+    }
+    std::str::from_utf8(s).ok()?.parse().ok()
+}
+
+impl<R: Read> Y4mReader<R> {
+    /// Read and check the stream header.
+    pub fn new(r: R) -> Result<Self, SourceError> {
+        let mut r = BufReader::new(r);
+        let l = line(&mut r, SourceReason::Y4mHeader)?.ok_or(SourceError::Refused(SourceReason::Y4mHeader))?;
+        let mut parts = l.split(|&b| b == b' ');
+        if parts.next() != Some(&b"YUV4MPEG2"[..]) {
+            return refuse(SourceReason::Y4mHeader);
+        }
+        let (mut w, mut h, mut rate, mut chroma) = (None, None, None, Chroma::C420);
+        for p in parts.filter(|p| !p.is_empty()) {
+            let v = &p[1..];
+            match p[0] {
+                b'W' => w = Some(parse_u32(v).ok_or(SourceError::Refused(SourceReason::Y4mHeader))?),
+                b'H' => h = Some(parse_u32(v).ok_or(SourceError::Refused(SourceReason::Y4mHeader))?),
+                b'F' => {
+                    let mut it = v.split(|&b| b == b':');
+                    let (n, d) = (it.next().and_then(parse_u32), it.next().and_then(parse_u32));
+                    match (n, d, it.next()) {
+                        (Some(n), Some(d), None) if n > 0 && d > 0 => rate = Some((n, d)),
+                        _ => return refuse(SourceReason::Y4mHeader),
+                    }
+                }
+                b'I' if v != b"p" => return refuse(SourceReason::Y4mInterlaced),
+                b'C' => {
+                    chroma = match v {
+                        b"420jpeg" | b"420paldv" | b"420mpeg2" | b"420" => Chroma::C420,
+                        b"444" => Chroma::C444,
+                        _ => return refuse(SourceReason::Y4mColorspace),
+                    }
+                }
+                _ => {}
+            }
+        }
+        let (w, h) = match (w, h) {
+            (Some(w), Some(h)) if w > 0 && h > 0 && (w as u64) * (h as u64) <= MAX_PIXELS => (w, h),
+            _ => return refuse(SourceReason::Y4mHeader),
+        };
+        Ok(Y4mReader { r, header: Header { w, h, rate, chroma }, buf: Vec::new() })
+    }
+
+    /// The bytes of one frame's planes.
+    pub fn frame_bytes(&self) -> usize {
+        let (w, h) = (self.header.w as usize, self.header.h as usize);
+        match self.header.chroma {
+            Chroma::C444 => 3 * w * h,
+            Chroma::C420 => w * h + 2 * w.div_ceil(2) * h.div_ceil(2),
+        }
+    }
+
+    /// The next frame as RGB8, `None` at the end of the stream.
+    pub fn next_frame(&mut self) -> Option<Result<Frame, SourceError>> {
+        self.read_frame().transpose()
+    }
+
+    fn read_frame(&mut self) -> Result<Option<Frame>, SourceError> {
+        let Some(l) = line(&mut self.r, SourceReason::Y4mTruncated)? else {
+            return Ok(None);
+        };
+        let mut parts = l.split(|&b| b == b' ');
+        if parts.next() != Some(&b"FRAME"[..]) {
+            return refuse(SourceReason::Y4mTruncated);
+        }
+        for p in parts.filter(|p| !p.is_empty()) {
+            match p[0] {
+                b'W' | b'H' | b'C' => return refuse(SourceReason::Y4mSizeChange),
+                b'I' if &p[1..] != b"p" => return refuse(SourceReason::Y4mInterlaced),
+                _ => {}
+            }
+        }
+        // The frame grows with the bytes read, never to the header's size ahead of them.
+        let n = self.frame_bytes();
+        self.buf.clear();
+        (&mut self.r).take(n as u64).read_to_end(&mut self.buf)?;
+        if self.buf.len() < n {
+            return refuse(SourceReason::Y4mTruncated);
+        }
+        Ok(Some(to_rgb(&self.header, &self.buf)))
+    }
+}
+
+/// One frame's planes (Y, then Cb, then Cr) as RGB8, BT.709 limited range.
+pub fn to_rgb(hd: &Header, planes: &[u8]) -> Frame {
+    let (w, h) = (hd.w as usize, hd.h as usize);
+    let (cw, ch) = match hd.chroma {
+        Chroma::C444 => (w, h),
+        Chroma::C420 => (w.div_ceil(2), h.div_ceil(2)),
+    };
+    let (yp, rest) = planes.split_at(w * h);
+    let (up, vp) = rest.split_at(cw * ch);
+    let mut rgb = Vec::with_capacity(3 * w * h);
+    for y in 0..h {
+        for x in 0..w {
+            let ci = match hd.chroma {
+                Chroma::C444 => y * w + x,
+                Chroma::C420 => (y >> 1) * cw + (x >> 1),
+            };
+            let (r, g, b) = bt709(yp[y * w + x], up[ci], vp[ci]);
+            rgb.extend_from_slice(&[r, g, b]);
+        }
+    }
+    Frame { w: hd.w, h: hd.h, rgb }
+}
+
+/// BT.709 limited range, one pixel.
+pub fn bt709(y: u8, cb: u8, cr: u8) -> (u8, u8, u8) {
+    let (y, cb, cr) = (y as i32 - 16, cb as i32 - 128, cr as i32 - 128);
+    let clip = |v: i32| v.clamp(0, 255) as u8;
+    (
+        clip((298 * y + 459 * cr + 128) >> 8),
+        clip((298 * y - 55 * cb - 136 * cr + 128) >> 8),
+        clip((298 * y + 541 * cb + 128) >> 8),
+    )
+}
+
+/// Every frame of a Y4M stream held in memory, with its header.
+pub fn read_all(bytes: &[u8]) -> Result<(Header, Vec<Frame>), SourceError> {
+    let mut r = Y4mReader::new(bytes)?;
+    let mut frames = Vec::new();
+    while let Some(f) = r.next_frame() {
+        frames.push(f?);
+    }
+    Ok((r.header, frames))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn code(b: &[u8]) -> &'static str {
+        read_all(b).map(|_| "ok").unwrap_or_else(|e| e.code())
+    }
+
+    #[test]
+    fn refusals_are_named() {
+        let frame = [16u8; 6];
+        let ok = [&b"YUV4MPEG2 W2 H2 F25:1 C420jpeg\nFRAME\n"[..], &frame].concat();
+        assert_eq!(code(&ok), "ok");
+        assert_eq!(code(b"YUV4MPEG W2 H2\n"), "y4m-header");
+        assert_eq!(code(b"YUV4MPEG2 W2\n"), "y4m-header");
+        assert_eq!(code(b"YUV4MPEG2 W2 H2 It\n"), "y4m-interlaced");
+        assert_eq!(code(b"YUV4MPEG2 W2 H2 C422\n"), "y4m-colorspace");
+        assert_eq!(code(b"YUV4MPEG2 W2 H2 C420p10\n"), "y4m-colorspace");
+        assert_eq!(code(&[&b"YUV4MPEG2 W2 H2\nFRAME W4\n"[..], &frame].concat()), "y4m-size-change");
+        assert_eq!(code(&[&b"YUV4MPEG2 W2 H2\nFRAME Ib\n"[..], &frame].concat()), "y4m-interlaced");
+        assert_eq!(code(&[&b"YUV4MPEG2 W2 H2\nFRAME\n"[..], &frame[..5]].concat()), "y4m-truncated");
+        assert_eq!(code(b"YUV4MPEG2 W2 H2\nFRAMEX"), "y4m-truncated");
+    }
+
+    #[test]
+    fn bt709_limited_range_endpoints() {
+        assert_eq!(bt709(16, 128, 128), (0, 0, 0));
+        assert_eq!(bt709(235, 128, 128), (255, 255, 255));
+        assert_eq!(bt709(126, 128, 128), (128, 128, 128));
+        // Limited-range red, worked by hand: R = 65542 >> 8 clipped, G = 332 >> 8,
+        // B = 68 >> 8.
+        assert_eq!(bt709(63, 102, 240), (255, 1, 0));
+    }
+}
diff --git a/wai/wai-pack/tests/conformance.rs b/wai/wai-pack/tests/conformance.rs
new file mode 100644
index 000000000..1610b2808
--- /dev/null
+++ b/wai/wai-pack/tests/conformance.rs
@@ -0,0 +1,12 @@
+//! The packaging corpus (`wai/pack-conformance`) holds: every expected file is what
+//! this crate computes from the corpus's inputs, and every generated input is what the
+//! generator writes.
+
+use std::path::Path;
+
+#[test]
+fn the_corpus_holds() {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../pack-conformance");
+    let m = wai_pack::conformance::check(&dir).expect("the corpus reads");
+    assert!(m.is_empty(), "{m:#?}");
+}
diff --git a/wai/wai-pack/tests/scenecut.rs b/wai/wai-pack/tests/scenecut.rs
new file mode 100644
index 000000000..39695c0b8
--- /dev/null
+++ b/wai/wai-pack/tests/scenecut.rs
@@ -0,0 +1,60 @@
+//! `wai.pack.scenecut/1` on the corpus fixtures, stated as the cuts a reader can check
+//! against the fixture's definition (`src/fixture.rs`), beside the corpus's pinned
+//! vectors.
+
+use wai_pack::classify::classify;
+use wai_pack::policy::Policy;
+use wai_pack::scenecut::{segment, SegParams, FLAG_FORCED, FLAG_SCENE_CUT};
+use wai_pack::{fixture, source::y4m};
+
+const POLICY: &str = include_str!("../../pack-conformance/scenecut/policy.toml");
+
+fn run(name: &str, lookahead: u64) -> Vec<(u64, u8, &'static str)> {
+    let p = Policy::parse(POLICY).unwrap();
+    let mut sp = SegParams::from_policy(&p.segmentation, p.component("v").unwrap().timebase);
+    sp.lookahead = lookahead;
+    let (hd, frames) = y4m::read_all(&fixture::generate(name).unwrap()).unwrap();
+    let (pieces, _) = segment(sp, hd.w, hd.h, frames.iter().map(|f| &f.rgb));
+    pieces.iter().map(|x| (x.start, x.flags, classify(&x.stats, &p.classify).label())).collect()
+}
+
+fn starts(v: &[(u64, u8, &str)]) -> Vec<u64> {
+    v.iter().map(|x| x.0).collect()
+}
+
+/// cuts-01: hard cuts at 60, 140 and 230, and at every switch between E and F (260,
+/// 290, 320), each a return after more than the lookahead. The flash at 90..96 lasts
+/// exactly the lookahead: neither its first frame (the return clause) nor the frame
+/// that returns to B (the revisit clause) is a cut. The fade from C to D (160..200)
+/// is not cut.
+#[test]
+fn cuts_01_cuts_where_its_shots_change() {
+    let got = run("cuts-01", 6);
+    assert_eq!(starts(&got), vec![0, 60, 140, 230, 260, 290, 320]);
+    assert!(got[1..].iter().all(|x| x.1 == FLAG_SCENE_CUT));
+}
+
+/// With a lookahead one frame shorter than the flash, its first frame is a cut: live
+/// and on-demand packing agree only at equal lookahead.
+#[test]
+fn a_shorter_lookahead_cuts_the_flash() {
+    let got = starts(&run("cuts-01", 5));
+    assert!(got.contains(&90), "{got:?}");
+    assert!(!starts(&run("cuts-01", 6)).contains(&90));
+}
+
+/// kinds-01: one shot of each kind, then a static shot longer than `max` (100 frames
+/// at 25 per second), forced at 260.
+#[test]
+fn kinds_01_classifies_each_shot() {
+    let got = run("kinds-01", 6);
+    let want = [
+        (0, 0, "static"),
+        (40, FLAG_SCENE_CUT, "synthetic"),
+        (80, FLAG_SCENE_CUT, "motion_high"),
+        (120, FLAG_SCENE_CUT, "natural"),
+        (160, FLAG_SCENE_CUT, "static"),
+        (260, FLAG_FORCED, "static"),
+    ];
+    assert_eq!(got, want);
+}
diff --git a/wai/wai-pack/tests/source_alloc.rs b/wai/wai-pack/tests/source_alloc.rs
new file mode 100644
index 000000000..592d765ed
--- /dev/null
+++ b/wai/wai-pack/tests/source_alloc.rs
@@ -0,0 +1,66 @@
+//! No field of a source sizes an allocation: a WAV `data` chunk that declares 4 GiB, and
+//! a Y4M header that declares a 4096 × 4096 frame, each followed by a few bytes, are
+//! refused having allocated about what they held. Its own binary: it installs a
+//! counting global allocator.
+
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+struct Peak;
+static LIVE: AtomicUsize = AtomicUsize::new(0);
+static PEAK: AtomicUsize = AtomicUsize::new(0);
+
+unsafe impl GlobalAlloc for Peak {
+    unsafe fn alloc(&self, l: Layout) -> *mut u8 {
+        let p = unsafe { System.alloc(l) };
+        if !p.is_null() {
+            let now = LIVE.fetch_add(l.size(), Ordering::SeqCst) + l.size();
+            PEAK.fetch_max(now, Ordering::SeqCst);
+        }
+        p
+    }
+    unsafe fn dealloc(&self, p: *mut u8, l: Layout) {
+        unsafe { System.dealloc(p, l) };
+        LIVE.fetch_sub(l.size(), Ordering::SeqCst);
+    }
+}
+
+#[global_allocator]
+static A: Peak = Peak;
+
+/// The most a reader may hold beyond what it was handed, for files of a few bytes.
+const BOUND: usize = 1 << 20;
+
+fn peak_of(f: impl FnOnce() -> &'static str) -> (&'static str, usize) {
+    let base = LIVE.load(Ordering::SeqCst);
+    PEAK.store(base, Ordering::SeqCst);
+    let v = f();
+    (v, PEAK.load(Ordering::SeqCst) - base)
+}
+
+#[test]
+fn a_declared_size_never_sizes_a_buffer() {
+    let mut wav = b"RIFF\0\0\0\0WAVEfmt \x10\0\0\0".to_vec();
+    wav.extend_from_slice(&[1, 0, 1, 0]); // PCM, one channel
+    wav.extend_from_slice(&8000u32.to_le_bytes());
+    wav.extend_from_slice(&16000u32.to_le_bytes());
+    wav.extend_from_slice(&[2, 0, 16, 0]); // align 2, 16 bits
+    wav.extend_from_slice(b"data");
+    wav.extend_from_slice(&0xffff_fffeu32.to_le_bytes());
+    wav.extend_from_slice(&[0; 4]);
+    let (v, peak) = peak_of(|| wai_pack::conformance::source_verdict("x.wav", &wav));
+    assert_eq!(v, "wav-truncated");
+    assert!(peak < BOUND, "a 4 GiB data claim allocated {peak} bytes");
+    // The reader's own bound, whatever block a caller asks for.
+    let (v, peak) = peak_of(|| {
+        let mut r = wai_pack::source::wav::WavReader::new(&wav[..]).unwrap();
+        r.next_block(u64::MAX).map(|_| "ok").unwrap_or_else(|e| e.code())
+    });
+    assert_eq!(v, "wav-truncated");
+    assert!(peak < BOUND, "next_block(u64::MAX) on a 4 GiB data claim allocated {peak} bytes");
+
+    let y4m = [&b"YUV4MPEG2 W4096 H4096 F25:1 C444\nFRAME\n"[..], &[16; 6]].concat();
+    let (v, peak) = peak_of(|| wai_pack::conformance::source_verdict("x.y4m", &y4m));
+    assert_eq!(v, "y4m-truncated");
+    assert!(peak < BOUND, "a 4096 × 4096 frame header allocated {peak} bytes");
+}
diff --git a/wai/wai-rs/Cargo.toml b/wai/wai-rs/Cargo.toml
index bbeef6fa5..e06b16118 100644
--- a/wai/wai-rs/Cargo.toml
+++ b/wai/wai-rs/Cargo.toml
@@ -714,6 +714,11 @@ name = "int_payload_cost"
 path = "tests/int_payload_cost.rs"
 required-features = ["video_int", "audio_int", "splat_int"]
 
+[[test]]
+name = "int_video_enc_memory"
+path = "tests/int_video_enc_memory.rs"
+required-features = ["video_int"]
+
 [[test]]
 name = "generate"
 path = "tests/generate.rs"
diff --git a/wai/wai-rs/src/claim_receipt.rs b/wai/wai-rs/src/claim_receipt.rs
index 54ad62508..52fe29148 100644
--- a/wai/wai-rs/src/claim_receipt.rs
+++ b/wai/wai-rs/src/claim_receipt.rs
@@ -118,9 +118,8 @@ pub const DOMAIN_CLAIM_LINK: &[u8] = b"moq-jwp:claim-link\x01";
 pub use crate::jwp_hash::{content_hash as object_content_hash, DOMAIN_OBJECT};
 
 /// The largest integer a claim may carry: I-JSON's (RFC 7493) exact-integer bound,
-/// which is what keeps RFC 8785 number serialisation trivial. Crate-private so the
-/// C header (cbindgen exports public integer constants) does not gain a generic name.
-pub(crate) const MAX_INTEGER: u64 = (1 << 53) - 1;
+/// the canonical form's (`crate::jcs::MAX_INTEGER`).
+pub(crate) const MAX_INTEGER: u64 = crate::jcs::MAX_INTEGER;
 
 // ───────────────────────────── reasons ─────────────────────────────
 
@@ -2276,52 +2275,12 @@ pub fn recover(
 
 // ───────────────────────────── canonical JSON ─────────────────────────────
 
-/// RFC 8785 over the claim subset: member names sorted by UTF-16 code units, strings
-/// escaped as RFC 8785 §3.2.2.2 requires (which is serde_json's escaping), integers in
-/// `0..=MAX_INTEGER` in plain decimal. Anything else is outside the subset.
+/// RFC 8785 over the claim subset (`crate::jcs`): member names sorted by UTF-16 code
+/// units, strings escaped as RFC 8785 §3.2.2.2 requires (which is serde_json's
+/// escaping), integers in `0..=MAX_INTEGER` in plain decimal. Anything else is outside
+/// the subset, and a claim's reason for it is `malformed`.
 pub fn jcs(v: &Value) -> Result<String, Reason> {
-    let mut out = String::new();
-    jcs_into(v, &mut out)?;
-    Ok(out)
-}
-
-fn jcs_into(v: &Value, out: &mut String) -> Result<(), Reason> {
-    match v {
-        Value::Null => out.push_str("null"),
-        Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
-        Value::Number(n) => match n.as_u64() {
-            Some(u) if u <= MAX_INTEGER => {
-                let _ = write!(out, "{u}");
-            }
-            _ => return Err(Reason::Malformed),
-        },
-        Value::String(s) => out.push_str(&serde_json::to_string(s).map_err(|_| Reason::Malformed)?),
-        Value::Array(a) => {
-            out.push('[');
-            for (i, x) in a.iter().enumerate() {
-                if i > 0 {
-                    out.push(',');
-                }
-                jcs_into(x, out)?;
-            }
-            out.push(']');
-        }
-        Value::Object(m) => {
-            let mut keys: Vec<&String> = m.keys().collect();
-            keys.sort_by(|a, b| a.encode_utf16().cmp(b.encode_utf16()));
-            out.push('{');
-            for (i, k) in keys.iter().enumerate() {
-                if i > 0 {
-                    out.push(',');
-                }
-                out.push_str(&serde_json::to_string(k).map_err(|_| Reason::Malformed)?);
-                out.push(':');
-                jcs_into(&m[k.as_str()], out)?;
-            }
-            out.push('}');
-        }
-    }
-    Ok(())
+    crate::jcs::jcs(v).map_err(|_| Reason::Malformed)
 }
 
 /// §3.1 step 1's reading of a JSON text: RFC 8259 with a claim's limits — no repeated
diff --git a/wai/wai-rs/src/int_entropy.rs b/wai/wai-rs/src/int_entropy.rs
index 88272b1ba..65673dda8 100644
--- a/wai/wai-rs/src/int_entropy.rs
+++ b/wai/wai-rs/src/int_entropy.rs
@@ -123,7 +123,10 @@ pub fn hist_to_cdf(hist: &[u64], precision: u32) -> Option<Vec<i32>> {
     let all_zero = hist.iter().all(|&h| h == 0);
     let weight = |h: u64| -> u128 { if all_zero { 1 } else { h as u128 } };
     let h_total: u128 = hist.iter().map(|&h| weight(h)).sum();
-    let mut freq: Vec<u128> = hist.iter().map(|&h| 1 + r * weight(h) / h_total).collect();
+    // Room for the escape too, so pushing it below never regrows the vector: the fit
+    // holds one frequency per symbol and the escape, never twice that.
+    let mut freq: Vec<u128> = Vec::with_capacity(hist.len() + 1);
+    freq.extend(hist.iter().map(|&h| 1 + r * weight(h) / h_total));
     let given: u128 = freq.iter().map(|f| f - 1).sum();
     let mut order: Vec<usize> = (0..hist.len()).collect();
     // Largest remainder first; equal remainders to the lower index (a stable sort).
diff --git a/wai/wai-rs/src/int_payload/mod.rs b/wai/wai-rs/src/int_payload/mod.rs
index ffd49ffb3..62cd667a4 100644
--- a/wai/wai-rs/src/int_payload/mod.rs
+++ b/wai/wai-rs/src/int_payload/mod.rs
@@ -393,7 +393,8 @@ pub fn decode_int(cap: &str, payload: &[u8], params: &IntParams<'_>) -> Result<I
 /// stream can make a large output from few bytes (a table can make one symbol nearly
 /// free), so it is the header, not the stream's length, that bounds the work. A sink
 /// applies its own size policy to this and refuses a payload past it before
-/// decoding.
+/// decoding. The encoder's counterpart, what `int_video_enc::encode` holds for a clip,
+/// is `int_video_enc::working_bytes`.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 #[non_exhaustive]
 pub struct DeclaredCost {
@@ -830,17 +831,6 @@ pub fn wis1_from_json(bs: &serde_json::Value) -> Result<Vec<u8>, IntPayloadError
 
 // ───────────────────────── a reference keyframe-0 encoder ─────────────────────────
 
-/// `n / d` rounded to the nearest integer, halves away from zero, for `d ≥ 1`: the
-/// quantizer of [`encode_wiv1_zero_motion`] (the rounding of
-/// `staged::predict::rdiv`, which this module cannot reach without `staged`).
-#[cfg(feature = "video_int")]
-fn round_div(n: i64, d: u64) -> i64 {
-    let m = n.unsigned_abs();
-    let (q, r) = (m / d, m % d);
-    let mag = (q + (r >= d - r) as u64) as i64;
-    if n < 0 { -mag } else { mag }
-}
-
 /// Code `frames` (each `h × w` RGB8, rows top to bottom) as a `WIV1` keyframe-0
 /// payload (`wai.video.int_motion`) with zero motion and one block per frame: frame 0
 /// is predicted from grey (128), each later frame from the previous frame as decoded,
@@ -850,78 +840,14 @@ fn round_div(n: i64, d: u64) -> i64 {
 /// it is coded through the bypass escape). Returns the payload and its decode, each
 /// frame as `decode_int` gives it.
 ///
-/// A reference encoder for the format, not a rate-distortion encoder: it searches no
-/// motion. It writes a closed group of pictures, since frame 0 refers to nothing. A
-/// clip past the format's caps (`MAX_TENSOR` elements in a frame, `MAX_FRAMES` frames,
-/// `MAX_CLIP` elements) is refused `too_large` before anything is allocated.
+/// The zero-motion case of the crate's one `WIV1` encoder, [`crate::int_video_enc`]:
+/// block `max(h, w)`, search radius 0, whole-pel. It writes a closed group of
+/// pictures, since frame 0 refers to nothing. A clip past the format's caps
+/// (`MAX_TENSOR` elements in a frame, `MAX_FRAMES` frames, `MAX_CLIP` elements) is
+/// refused `too_large` before anything is allocated.
 #[cfg(feature = "video_int")]
 pub fn encode_wiv1_zero_motion(frames: &[Vec<u8>], h: u32, w: u32, q: u32) -> Result<(Vec<u8>, Vec<Vec<u8>>), IntPayloadError> {
-    let field = |why: &str| IntPayloadError::new(Refusal::FieldRange, why.to_string());
-    if !(1..=wire::MAX_Q).contains(&q) {
-        return Err(field("q is outside 1..=65535"));
-    }
-    if frames.is_empty() || h == 0 || w == 0 {
-        return Err(field("a clip needs a frame of at least one pixel"));
-    }
-    // The format's caps, checked before anything is allocated: a frame of at most
-    // MAX_TENSOR elements, at most MAX_FRAMES frames and MAX_CLIP elements in the clip.
-    let too_large = |why: &str| IntPayloadError::new(Refusal::TooLarge, why.to_string());
-    let len = (h as u64).checked_mul(w as u64).and_then(|p| p.checked_mul(3)).filter(|&l| l <= wire::MAX_TENSOR).ok_or_else(|| too_large("h × w × 3 exceeds the tensor cap"))?;
-    if frames.len() as u64 > wire::MAX_FRAMES {
-        return Err(too_large("more frames than the frame cap"));
-    }
-    if (frames.len() as u64).checked_mul(len).is_none_or(|c| c > wire::MAX_CLIP) {
-        return Err(too_large("the clip exceeds the clip cap"));
-    }
-    let n = frames.len() as u32;
-    if frames.iter().any(|f| f.len() as u64 != len) {
-        return Err(field("a frame is not h × w × 3 bytes"));
-    }
-    let mut recon: Vec<Vec<u8>> = Vec::with_capacity(frames.len());
-    let mut rs: Vec<i64> = Vec::with_capacity(frames.len() * len as usize);
-    for (f, src) in frames.iter().enumerate() {
-        let mut cur = Vec::with_capacity(src.len());
-        for (i, &t) in src.iter().enumerate() {
-            let pred = if f == 0 { 128 } else { recon[f - 1][i] as i64 };
-            let r = round_div(t as i64 - pred, q as u64);
-            rs.push(r);
-            cur.push((pred + r * q as i64).clamp(0, 255) as u8);
-        }
-        recon.push(cur);
-    }
-    let lo = *rs.iter().min().expect("at least one sample");
-    let hi = *rs.iter().max().expect("at least one sample");
-    let width = ((hi - lo + 1) as u64).min(4095);
-    let mut hist = vec![0u64; width as usize];
-    for &r in &rs {
-        if r >= lo && r < lo + width as i64 {
-            hist[(r - lo) as usize] += 1;
-        }
-    }
-    let cdf = crate::int_entropy::hist_to_cdf(&hist, 16).ok_or_else(|| field("no residual table fits"))?;
-    let mut e = crate::rans::RansEncoder::new();
-    for &r in &rs {
-        if !e.encode(r as i32, &cdf, cdf.len(), lo as i32) {
-            return Err(field("a residual the stream cannot code"));
-        }
-    }
-    let stream = e.flush();
-    let one = n == 1;
-    let v = wire::Wiv1 {
-        mv_precision: 1,
-        keyframe: 0,
-        n_frames: n,
-        h,
-        w,
-        block: if one { 1 } else { h.max(w) },
-        q,
-        offset: lo as i32,
-        cdf,
-        mvs: vec![(0, 0); if one { 0 } else { n as usize - 1 }],
-        rans: &stream,
-        wih1: None,
-    };
-    let out = wire::write_wiv1(&v);
-    wire::parse_wiv1(&out, Some(0))?;
-    Ok((out, recon))
+    let p = crate::int_video_enc::EncParams { block: h.max(w).max(1), search: 0, mv_precision: 1, q };
+    let e = crate::int_video_enc::encode(frames, h, w, &p)?;
+    Ok((e.wiv1, e.recon))
 }
diff --git a/wai/wai-rs/src/int_video.rs b/wai/wai-rs/src/int_video.rs
index 92773bec7..7ab32eea0 100644
--- a/wai/wai-rs/src/int_video.rs
+++ b/wai/wai-rs/src/int_video.rs
@@ -251,7 +251,7 @@ impl VideoJson {
 /// sub-pixel motion (real footage) predicts well while the decode stays exact.
 #[inline]
 #[allow(clippy::too_many_arguments)]
-fn predict(rf: &[u8], y: usize, x: usize, dy: i64, dx: i64, c: usize, prec: i64, h: usize, w: usize) -> i64 {
+pub fn predict(rf: &[u8], y: usize, x: usize, dy: i64, dx: i64, c: usize, prec: i64, h: usize, w: usize) -> i64 {
     let p = |yy: i64, xx: i64| -> i64 {
         let cy = yy.clamp(0, h as i64 - 1) as usize;
         let cx = xx.clamp(0, w as i64 - 1) as usize;
diff --git a/wai/wai-rs/src/int_video_enc.rs b/wai/wai-rs/src/int_video_enc.rs
new file mode 100644
index 000000000..f059686a5
--- /dev/null
+++ b/wai/wai-rs/src/int_video_enc.rs
@@ -0,0 +1,431 @@
+//! The integer video encoder: RGB8 frames to a `WIV1` keyframe-0 payload
+//! (`wai.video.int_motion`, `extensions/integer-payloads.md` §3), whose decode is
+//! [`crate::int_video`]'s. It is the one encoder of the format in this crate:
+//! `int_payload::encode_wiv1_zero_motion` is its zero-motion case.
+//!
+//! All integer, so a clip, its parameters and this module's revision fix the payload's
+//! every byte:
+//!
+//! - **Motion search** (frames 1 on): blocks in raster order; for each, every vector
+//!   `(dy, dx)` with both components in `−R..=R`, `R = search · mv_precision`, `dy`
+//!   outer and `dx` inner, each ascending; its cost is the sum, over the block's pixels
+//!   inside the frame and the three channels, of `|source − prediction|`, the
+//!   prediction being the decoder's ([`crate::int_video::predict`]) from the previous
+//!   frame **as decoded**. The least cost wins; a tie goes to the smaller
+//!   `|dy| + |dx|`, then to the earlier vector.
+//! - **Residual**: for each frame, each pixel in raster order, each of R, G, B, the
+//!   prediction (128 for frame 0) is subtracted from the source and quantized at step
+//!   `q`, rounding halves away from zero ([`quantize`]); the frame as decoded is
+//!   `clamp(prediction + r·q, 0, 255)`, and the next frame predicts from it, so the
+//!   encoder and every decoder hold the same reference (a closed loop).
+//! - **Table**: one residual table for the clip ([`residual_table`]): the histogram of
+//!   the residuals from the least, at most 4,095 symbols wide, through
+//!   `int_entropy::hist_to_cdf` at precision 16; a residual past it would be coded
+//!   through the bypass escape (`extensions/integer-payloads.md` §2), and none is.
+//!
+//! It runs in two passes, so it holds no residual and no symbol per sample: the first
+//! finds the vectors and builds the reconstruction, its SSE and the residuals' counts;
+//! the second derives each residual again and codes it, last first, into
+//! `rans::RansReverseEncoder`. [`working_bytes`] states what it holds.
+//!
+//! A clip of one frame is written with `block` 1 and `mv_precision` 1, as the format
+//! requires. The caps (a frame, the clip, the frame count, the motion-vector field) are
+//! checked before anything is allocated.
+
+use crate::int_payload::{wire, IntPayloadError, Refusal};
+use crate::int_video::predict;
+
+/// The most `search · mv_precision` this encoder searches: a vector component's range.
+///
+/// cbindgen:ignore
+pub const MAX_SEARCH_RANGE: u32 = 127;
+
+/// What the encoder is asked for.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct EncParams {
+    /// The block edge in pixels, at least 1.
+    pub block: u32,
+    /// The search radius in whole pixels; 0 searches only the zero vector.
+    pub search: u32,
+    /// 1, whole-pel vectors; 2, half-pel.
+    pub mv_precision: u8,
+    /// The quantizer step, `1..=65535`.
+    pub q: u32,
+}
+
+/// An encoded clip.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Encoded {
+    /// The `WIV1` payload.
+    pub wiv1: Vec<u8>,
+    /// Each frame as every decoder reconstructs it.
+    pub recon: Vec<Vec<u8>>,
+    /// `Σ (source − recon)²` over every sample of every frame.
+    pub sse: u64,
+}
+
+/// `r / q` rounded to the nearest integer, halves away from zero: `sign(r)·⌊(2|r| +
+/// q) / 2q⌋`, for `q ≥ 1` (the rounding of `staged::predict::rdiv`).
+pub fn quantize(r: i64, q: u32) -> i64 {
+    let (m, d) = (r.unsigned_abs(), q.max(1) as u64);
+    let (n, rem) = (m / d, m % d);
+    let mag = (n + (rem >= d - rem) as u64) as i64;
+    if r < 0 { -mag } else { mag }
+}
+
+/// The largest residual magnitude: a source and a prediction are both in 0..=255 and
+/// `q ≥ 1`, so every residual is in `−255..=255`.
+///
+/// cbindgen:ignore
+pub const RESIDUAL_MAX: i64 = 255;
+
+/// The count of each residual `−255..=255`, at index `r + 255`.
+pub type ResidualCounts = [u64; 2 * RESIDUAL_MAX as usize + 1];
+
+/// The clip's residual table and offset from its residual counts: the histogram of the
+/// residuals from the least (`offset`) to the greatest, at most 4,095 symbols wide,
+/// fitted by `int_entropy::hist_to_cdf` at precision 16. A residual past its span would
+/// be coded through the bypass escape; the residuals' span, at most 511, never is.
+pub fn residual_table(counts: &ResidualCounts) -> Result<(Vec<i32>, i32), IntPayloadError> {
+    let field = |why: &str| IntPayloadError::new(Refusal::FieldRange, why.to_string());
+    let lo = counts.iter().position(|&c| c != 0).ok_or_else(|| field("no residual to fit a table to"))?;
+    let hi = counts.iter().rposition(|&c| c != 0).unwrap_or(lo);
+    let width = (hi - lo + 1).min(4095);
+    let cdf = crate::int_entropy::hist_to_cdf(&counts[lo..lo + width], 16).ok_or_else(|| field("no residual table fits"))?;
+    Ok((cdf, lo as i32 - RESIDUAL_MAX as i32))
+}
+
+/// The widest residual table: one symbol for each residual `−255..=255`.
+const TABLE_SYMBOLS: u64 = 2 * RESIDUAL_MAX as u64 + 1;
+
+/// What fitting the widest table holds at once (`int_entropy::hist_to_cdf`): a 16-byte
+/// frequency for each symbol and the escape, an 8-byte index for each symbol and as much
+/// again for the stable sort's scratch, and the table, 4 bytes for each of its
+/// `symbols + 2` entries.
+const TABLE_FIT_BYTES: u64 = 16 * (TABLE_SYMBOLS + 1) + 2 * 8 * TABLE_SYMBOLS + 4 * (TABLE_SYMBOLS + 2);
+
+/// The widest table as `encode` keeps it, as the payload carries it and as the payload's
+/// check parses it, and the payload's fixed header with its stream length.
+const TABLE_HELD_BYTES: u64 = 3 * 4 * (TABLE_SYMBOLS + 2) + 64;
+
+/// The most bytes [`encode`] holds at once beyond the frames it is given, for a clip of
+/// `n_frames` frames of `h × w` at block `block` (any, for one frame). The decoder's
+/// counterpart is `int_payload::DeclaredCost`.
+///
+/// It holds the reconstruction it returns and its frame list (`n·h·w·3` and 24 bytes a
+/// frame), the motion vectors (4 bytes each), and the stream: its words as emitted, in a
+/// vector that may hold twice their length, then the stream and the payload that copies
+/// it, the payload's own copy of the vectors and the check's parse of them. The stream
+/// is at most 2 bytes a sample and 16 more: every residual is a table symbol (no
+/// escape), and a symbol's frequency is at least 1 in 2^16. The fixed term is the widest
+/// table's: its fit (`TABLE_FIT_BYTES`) and the copies held of it
+/// (`TABLE_HELD_BYTES`).
+///
+/// A clip past the format's caps (a frame of more than `2^26` samples, more than `2^20`
+/// frames, a clip of more than `2^30` bytes, or a motion-vector field of more than `2^26`
+/// elements) is one `encode` refuses before it allocates anything sized from it; for one,
+/// this is `u64::MAX`. Every other figure is formed in `u128` and saturates at
+/// `u64::MAX`, so no input wraps.
+pub fn working_bytes(n_frames: u64, h: u32, w: u32, block: u32) -> u64 {
+    let (n, h, w, b) = (n_frames as u128, h as u128, w as u128, block.max(1) as u128);
+    let frame = h * w * 3;
+    let clip = n * frame;
+    let n_mv = if n <= 1 { 0 } else { h.div_ceil(b) * w.div_ceil(b) * (n - 1) };
+    if frame > wire::MAX_TENSOR as u128 || n > wire::MAX_FRAMES as u128 || clip > wire::MAX_CLIP as u128 || 2 * n_mv > wire::MAX_TENSOR as u128 {
+        return u64::MAX;
+    }
+    let stream = 2 * clip + 16;
+    let total = clip + 24 * n + 12 * n_mv + 3 * stream + (TABLE_FIT_BYTES + TABLE_HELD_BYTES) as u128;
+    u64::try_from(total).unwrap_or(u64::MAX)
+}
+
+/// The vector of one block: the least-cost candidate under the search order and
+/// tie-break of the module documentation.
+#[allow(clippy::too_many_arguments)]
+fn search_block(src: &[u8], rf: &[u8], h: usize, w: usize, y0: usize, x0: usize, block: usize, range: i64, prec: i64) -> (i16, i16) {
+    let (y1, x1) = ((y0 + block).min(h), (x0 + block).min(w));
+    let mut best: (u64, i64, i64, i64) = (u64::MAX, 0, 0, 0); // cost, |dy|+|dx|, dy, dx
+    for dy in -range..=range {
+        for dx in -range..=range {
+            let mut cost = 0u64;
+            'px: for y in y0..y1 {
+                for x in x0..x1 {
+                    for c in 0..3 {
+                        let p = predict(rf, y, x, dy, dx, c, prec, h, w);
+                        cost += (src[(y * w + x) * 3 + c] as i64 - p).unsigned_abs();
+                    }
+                    // A candidate already past the best cannot win; stopping early
+                    // changes no outcome.
+                    if cost > best.0 {
+                        break 'px;
+                    }
+                }
+            }
+            let l1 = dy.abs() + dx.abs();
+            if cost < best.0 || (cost == best.0 && l1 < best.1) {
+                best = (cost, l1, dy, dx);
+            }
+        }
+    }
+    (best.2 as i16, best.3 as i16)
+}
+
+/// Encode `frames`, each `h × w` RGB8 (rows top to bottom), as a `WIV1` keyframe-0
+/// payload under `p`. Refuses `field_range` for a parameter outside its range (`q`
+/// outside `1..=65535`, `block` 0, `mv_precision` other than 1 or 2, `search ·
+/// mv_precision` past [`MAX_SEARCH_RANGE`]), an empty clip, a zero dimension or a frame
+/// that is not `h·w·3` bytes; `too_large` for a clip past the format's caps, before
+/// anything is allocated.
+pub fn encode(frames: &[Vec<u8>], h: u32, w: u32, p: &EncParams) -> Result<Encoded, IntPayloadError> {
+    let field = |why: &str| IntPayloadError::new(Refusal::FieldRange, why.to_string());
+    if !(1..=wire::MAX_Q).contains(&p.q) {
+        return Err(field("q is outside 1..=65535"));
+    }
+    if p.block == 0 || !matches!(p.mv_precision, 1 | 2) || p.search.saturating_mul(p.mv_precision as u32) > MAX_SEARCH_RANGE {
+        return Err(field("block is 0, mv_precision is neither 1 nor 2, or the search range is past 127"));
+    }
+    if frames.is_empty() || h == 0 || w == 0 {
+        return Err(field("a clip needs a frame of at least one pixel"));
+    }
+    // The format's caps, checked before anything is allocated: a frame of at most
+    // MAX_TENSOR elements, at most MAX_FRAMES frames and MAX_CLIP elements in the clip,
+    // and a motion-vector field of at most MAX_TENSOR elements.
+    let too_large = |why: &str| IntPayloadError::new(Refusal::TooLarge, why.to_string());
+    let len = (h as u64)
+        .checked_mul(w as u64)
+        .and_then(|p| p.checked_mul(3))
+        .filter(|&l| l <= wire::MAX_TENSOR)
+        .ok_or_else(|| too_large("h × w × 3 exceeds the tensor cap"))?;
+    if frames.len() as u64 > wire::MAX_FRAMES {
+        return Err(too_large("more frames than the frame cap"));
+    }
+    if (frames.len() as u64).checked_mul(len).is_none_or(|c| c > wire::MAX_CLIP) {
+        return Err(too_large("the clip exceeds the clip cap"));
+    }
+    let n = frames.len();
+    let one = n == 1;
+    let (block, prec) = if one { (1, 1) } else { (p.block, p.mv_precision) };
+    let (nby, nbx) = ((h as u64).div_ceil(block as u64), (w as u64).div_ceil(block as u64));
+    let nb = nby * nbx;
+    if nb.checked_mul(2 * (n as u64 - 1)).is_none_or(|m| m > wire::MAX_TENSOR) {
+        return Err(too_large("the motion vectors exceed the tensor cap"));
+    }
+    if frames.iter().any(|f| f.len() as u64 != len) {
+        return Err(field("a frame is not h × w × 3 bytes"));
+    }
+    let (h, w, block, nbx) = (h as usize, w as usize, block as usize, nbx as usize);
+    let range = if one { 0 } else { (p.search * prec as u32) as i64 };
+    let mut recon: Vec<Vec<u8>> = Vec::with_capacity(n);
+    let mut mvs: Vec<(i16, i16)> = Vec::with_capacity(nb as usize * (n - 1));
+    let mut counts: ResidualCounts = [0; 2 * RESIDUAL_MAX as usize + 1];
+    let mut sse = 0u64;
+    let residual = |src: &[u8], recon: &[Vec<u8>], mvs: &[(i16, i16)], f: usize, y: usize, x: usize, c: usize| {
+        let pred = match f {
+            0 => 128,
+            _ => {
+                let (dy, dx) = mvs[(f - 1) * nb as usize + (y / block) * nbx + x / block];
+                predict(&recon[f - 1], y, x, dy as i64, dx as i64, c, prec as i64, h, w)
+            }
+        };
+        let t = src[(y * w + x) * 3 + c] as i64;
+        (pred, t, quantize(t - pred, p.q))
+    };
+    // Pass 1: the vectors, the reconstruction and its SSE, and the residuals' counts.
+    for (f, src) in frames.iter().enumerate() {
+        if f > 0 {
+            let rf = &recon[f - 1];
+            for by in 0..nby as usize {
+                for bx in 0..nbx {
+                    mvs.push(search_block(src, rf, h, w, by * block, bx * block, block, range, prec as i64));
+                }
+            }
+        }
+        let mut cur = Vec::with_capacity(src.len());
+        for y in 0..h {
+            for x in 0..w {
+                for c in 0..3 {
+                    let (pred, t, r) = residual(src, &recon, &mvs, f, y, x, c);
+                    counts[(r + RESIDUAL_MAX) as usize] += 1;
+                    let v = (pred + r * p.q as i64).clamp(0, 255);
+                    sse += ((t - v) * (t - v)) as u64;
+                    cur.push(v as u8);
+                }
+            }
+        }
+        recon.push(cur);
+    }
+    let (cdf, offset) = residual_table(&counts)?;
+    // Pass 2: each residual again, from the source, the reconstruction and the vectors,
+    // last first, into a writer that holds only the words it emits.
+    let mut e = crate::rans::RansReverseEncoder::new();
+    for f in (0..n).rev() {
+        for y in (0..h).rev() {
+            for x in (0..w).rev() {
+                for c in (0..3).rev() {
+                    let (_, _, r) = residual(&frames[f], &recon, &mvs, f, y, x, c);
+                    if !e.put(r as i32, &cdf, cdf.len(), offset) {
+                        return Err(field("a residual the stream cannot code"));
+                    }
+                }
+            }
+        }
+    }
+    let stream = e.finish();
+    let v = wire::Wiv1 {
+        mv_precision: prec,
+        keyframe: 0,
+        n_frames: n as u32,
+        h: h as u32,
+        w: w as u32,
+        block: block as u32,
+        q: p.q,
+        offset,
+        cdf,
+        mvs,
+        rans: &stream,
+        wih1: None,
+    };
+    let wiv1 = wire::write_wiv1(&v);
+    wire::parse_wiv1(&wiv1, Some(0))?;
+    Ok(Encoded { wiv1, recon, sse })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::int_payload::{decode_int, IntDecoded, IntParams};
+
+    /// A clip with motion: a textured square drifting over a gradient, with a
+    /// brightness step, so blocks have vectors to find and residuals to code.
+    fn clip(h: usize, w: usize, n: usize) -> Vec<Vec<u8>> {
+        (0..n)
+            .map(|t| {
+                let mut f = Vec::with_capacity(h * w * 3);
+                for y in 0..h {
+                    for x in 0..w {
+                        let inside = (y + 7 * t / 3) % h < h / 2 && (x + 2 * t) % w < w / 2;
+                        let g = ((x * 9 + y * 5) % 200) as u8;
+                        let v = if inside { 255 - ((x * 31 + y * 17 + t) % 90) as u8 } else { g.saturating_add(t as u8) };
+                        f.extend_from_slice(&[v, v / 2 + 40, 255 - v]);
+                    }
+                }
+                f
+            })
+            .collect()
+    }
+
+    fn decode(wiv1: &[u8]) -> Vec<Vec<u8>> {
+        match decode_int(crate::codecs::CAP_VIDEO_INT_MOTION, wiv1, &IntParams::none()).unwrap() {
+            IntDecoded::Video { frames, .. } => frames,
+            other => panic!("not video: {other:?}"),
+        }
+    }
+
+    /// Every decoder reconstructs exactly the frames the encoder predicted from, and the
+    /// stated SSE is the one recomputed from them, at every block size, precision,
+    /// search radius and step.
+    #[test]
+    fn the_decode_is_the_encoders_reconstruction() {
+        let (h, w) = (19, 23);
+        let src = clip(h, w, 5);
+        for &(block, search, prec, q) in &[(4, 2, 2, 1), (8, 3, 1, 4), (16, 1, 2, 9), (7, 0, 1, 3), (1, 1, 1, 2), (32, 2, 2, 40)] {
+            let p = EncParams { block, search, mv_precision: prec, q };
+            let e = encode(&src, h as u32, w as u32, &p).unwrap();
+            assert_eq!(decode(&e.wiv1), e.recon, "{p:?}");
+            let sse: u64 = src.iter().flatten().zip(e.recon.iter().flatten()).map(|(&a, &b)| (a as i64 - b as i64).pow(2) as u64).sum();
+            assert_eq!(sse, e.sse, "{p:?}");
+            if q == 1 {
+                assert_eq!(e.recon, src, "q 1 is lossless");
+            }
+        }
+    }
+
+    /// A frame that is the previous one moved by a whole number of pixels: every
+    /// interior block finds that vector, at both precisions (in units of 1/prec pel).
+    #[test]
+    fn motion_search_finds_a_known_shift() {
+        let (h, w) = (32usize, 32usize);
+        let f0: Vec<u8> = (0..h * w)
+            .flat_map(|i| {
+                let (y, x) = (i / w, i % w);
+                let v = ((x * x * 7 + y * 13 + x * y * 3) % 251) as u8;
+                [v, v.wrapping_mul(3), v ^ 0x5a]
+            })
+            .collect();
+        // frame 1 at (y, x) is frame 0 at (y + 1, x − 2).
+        let f1: Vec<u8> = (0..h * w)
+            .flat_map(|i| {
+                let (y, x) = ((i / w + 1).min(h - 1), (i % w).saturating_sub(2));
+                let j = (y * w + x) * 3;
+                [f0[j], f0[j + 1], f0[j + 2]]
+            })
+            .collect();
+        for prec in [1u8, 2] {
+            let p = EncParams { block: 8, search: 3, mv_precision: prec, q: 1 };
+            let e = encode(&[f0.clone(), f1.clone()], h as u32, w as u32, &p).unwrap();
+            let v = wire::parse_wiv1(&e.wiv1, Some(0)).unwrap();
+            let k = prec as i16;
+            // Interior blocks: neither the bottom row (clamped) nor the left column.
+            for by in 0..3 {
+                for bx in 1..4 {
+                    assert_eq!(v.mvs[by * 4 + bx], (k, -2 * k), "block ({by}, {bx}) at precision {prec}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn quantize_rounds_halves_away_from_zero() {
+        let cases = [(5, 2, 3), (-5, 2, -3), (3, 2, 2), (1, 2, 1), (-1, 2, -1), (7, 4, 2), (6, 4, 2), (2, 4, 1), (-2, 4, -1), (1, 4, 0), (0, 9, 0), (255, 1, 255), (-255, 255, -1)];
+        for (r, q, want) in cases {
+            assert_eq!(quantize(r, q), want, "quantize({r}, {q})");
+        }
+    }
+
+    /// A one-frame clip is written as the format requires, whatever was asked.
+    #[test]
+    fn one_frame_is_block_1_whole_pel() {
+        let p = EncParams { block: 16, search: 4, mv_precision: 2, q: 3 };
+        let e = encode(&clip(5, 6, 1), 5, 6, &p).unwrap();
+        let v = wire::parse_wiv1(&e.wiv1, Some(0)).unwrap();
+        assert_eq!((v.block, v.mv_precision, v.mvs.len()), (1, 1, 0));
+        assert_eq!(decode(&e.wiv1), e.recon);
+    }
+
+    /// Past the format's caps the bound is `u64::MAX`, never a wrapped figure: the
+    /// review's three inputs (2^62 one-pixel frames; 2^40 frames of 2^16 × 2^16; one frame
+    /// past the frame cap at the tensor cap's size).
+    #[test]
+    fn working_bytes_saturates_past_the_caps() {
+        assert_eq!(working_bytes(1 << 62, 1, 1, 1), u64::MAX);
+        assert_eq!(working_bytes(1 << 40, 1 << 16, 1 << 16, 1), u64::MAX);
+        assert_eq!(working_bytes((1 << 20) + 1, 4096, 5461, 1), u64::MAX);
+        assert_eq!(working_bytes(1, u32::MAX, u32::MAX, u32::MAX), u64::MAX);
+        // At the caps it is a figure: the largest clip, one frame.
+        let at = working_bytes(1, 4096, 5461, 1);
+        assert!(at < u64::MAX && at > 4096 * 5461 * 3, "{at}");
+        // The fixed term is derived from the widest table.
+        assert_eq!(TABLE_FIT_BYTES + TABLE_HELD_BYTES, 24_640);
+    }
+
+    #[test]
+    fn refusals_before_allocation() {
+        let code = |r: Result<Encoded, IntPayloadError>| r.map(|_| "ok").unwrap_or_else(|e| e.code());
+        let f = clip(4, 4, 2);
+        let p = |block, search, mv_precision, q| EncParams { block, search, mv_precision, q };
+        assert_eq!(code(encode(&f, 4, 4, &p(4, 1, 1, 0))), "field_range");
+        assert_eq!(code(encode(&f, 4, 4, &p(4, 1, 1, 65_536))), "field_range");
+        assert_eq!(code(encode(&f, 4, 4, &p(0, 1, 1, 4))), "field_range");
+        assert_eq!(code(encode(&f, 4, 4, &p(4, 1, 3, 4))), "field_range");
+        assert_eq!(code(encode(&f, 4, 4, &p(4, 64, 2, 4))), "field_range");
+        assert_eq!(code(encode(&f, 4, 4, &p(4, 127, 1, 4))), "ok");
+        assert_eq!(code(encode(&f, 4, 5, &p(4, 1, 1, 4))), "field_range");
+        assert_eq!(code(encode(&[], 4, 4, &p(4, 1, 1, 4))), "field_range");
+        // A frame past the tensor cap is refused before its bytes are read.
+        assert_eq!(code(encode(&f, 4097, 5462, &p(4, 1, 1, 4))), "too_large");
+        // Block 1 on a 4096 × 4096 frame is 2^24 vectors a frame: three P-frames pass the
+        // field's cap (2·nb·(n − 1) > 2^26), refused before a frame's bytes are read.
+        let big = vec![Vec::new(); 4];
+        assert_eq!(code(encode(&big, 4096, 4096, &p(1, 0, 1, 4))), "too_large");
+    }
+}
diff --git a/wai/wai-rs/src/jcs.rs b/wai/wai-rs/src/jcs.rs
new file mode 100644
index 000000000..eb3d8b0fc
--- /dev/null
+++ b/wai/wai-rs/src/jcs.rs
@@ -0,0 +1,116 @@
+//! RFC 8785 (JSON Canonicalization Scheme) over the subset WAI signs and digests.
+//!
+//! One canonical form for every JSON object WAI hashes or signs: a claim's body and
+//! signing input (`claim_receipt`), a key log's revisions, grants and statuses
+//! (`key_log`), an energy figure's claim body (`energy_figure`), and a packaging
+//! policy's digest (`extensions/packaging.md` §3). It needs `serde_json` alone, so it is
+//! compiled under every feature set.
+//!
+//! The subset: `null`, `true`, `false`, strings, arrays, objects, and integers in
+//! `0..=MAX_INTEGER` written in plain decimal. Member names are sorted by their UTF-16
+//! code units and strings are escaped as RFC 8785 §3.2.2.2 requires, which is how
+//! `serde_json` escapes them. Any other number (a negative, a fraction, an exponent
+//! form, an integer past `2^53 − 1`) is outside the subset and refused, so a value is
+//! never canonicalised in a form two readers could read differently.
+
+use serde_json::Value;
+use std::fmt::Write as _;
+
+/// The largest integer the subset admits: I-JSON's (RFC 7493) exact-integer bound,
+/// which is what keeps RFC 8785 number serialisation trivial.
+///
+/// cbindgen:ignore
+pub const MAX_INTEGER: u64 = (1 << 53) - 1;
+
+/// Why a value has no canonical form in the subset.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum JcsError {
+    /// A number that is not an integer in `0..=MAX_INTEGER`.
+    Number,
+    /// A string or member name the serialiser refused (a valid `String` never is).
+    String,
+}
+
+impl std::fmt::Display for JcsError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            JcsError::Number => "a number outside the integers 0..=2^53-1",
+            JcsError::String => "a string the serialiser refused",
+        })
+    }
+}
+
+impl std::error::Error for JcsError {}
+
+/// The canonical form of `v`: RFC 8785 over the subset above.
+pub fn jcs(v: &Value) -> Result<String, JcsError> {
+    let mut out = String::new();
+    jcs_into(v, &mut out)?;
+    Ok(out)
+}
+
+fn jcs_into(v: &Value, out: &mut String) -> Result<(), JcsError> {
+    match v {
+        Value::Null => out.push_str("null"),
+        Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
+        Value::Number(n) => match n.as_u64() {
+            Some(u) if u <= MAX_INTEGER => {
+                let _ = write!(out, "{u}");
+            }
+            _ => return Err(JcsError::Number),
+        },
+        Value::String(s) => out.push_str(&serde_json::to_string(s).map_err(|_| JcsError::String)?),
+        Value::Array(a) => {
+            out.push('[');
+            for (i, x) in a.iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                jcs_into(x, out)?;
+            }
+            out.push(']');
+        }
+        Value::Object(m) => {
+            let mut keys: Vec<&String> = m.keys().collect();
+            keys.sort_by(|a, b| a.encode_utf16().cmp(b.encode_utf16()));
+            out.push('{');
+            for (i, k) in keys.iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                out.push_str(&serde_json::to_string(k).map_err(|_| JcsError::String)?);
+                out.push(':');
+                jcs_into(&m[k.as_str()], out)?;
+            }
+            out.push('}');
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    /// Member order by UTF-16 code units (so a supplementary-plane character sorts
+    /// before U+FF61, which it follows in code-point order), RFC 8785's escapes, and
+    /// `null` admitted.
+    #[test]
+    fn sorts_by_utf16_and_escapes_like_rfc8785() {
+        let v = json!({"b": 1, "a": "x\u{1}\n\"", "A": [2, "é"], "é": null});
+        assert_eq!(jcs(&v).unwrap(), "{\"A\":[2,\"é\"],\"a\":\"x\\u0001\\n\\\"\",\"b\":1,\"é\":null}");
+        let v = json!({"\u{ff61}": 1, "\u{1f600}": 2});
+        assert_eq!(jcs(&v).unwrap(), "{\"\u{1f600}\":2,\"\u{ff61}\":1}");
+    }
+
+    /// The subset's numbers: integers up to `2^53 − 1`, and nothing else.
+    #[test]
+    fn refuses_numbers_outside_the_subset() {
+        assert_eq!(jcs(&json!({"n": -1})), Err(JcsError::Number));
+        assert_eq!(jcs(&json!({"n": 1.5})), Err(JcsError::Number));
+        assert_eq!(jcs(&json!([MAX_INTEGER + 1])), Err(JcsError::Number));
+        assert_eq!(jcs(&json!({"n": MAX_INTEGER})).unwrap(), "{\"n\":9007199254740991}");
+        assert_eq!(jcs(&json!(0)).unwrap(), "0");
+    }
+}
diff --git a/wai/wai-rs/src/lib.rs b/wai/wai-rs/src/lib.rs
index 86f4df9a9..db13734df 100644
--- a/wai/wai-rs/src/lib.rs
+++ b/wai/wai-rs/src/lib.rs
@@ -143,6 +143,12 @@ pub mod generate;
 #[cfg(feature = "video_int")]
 pub mod int_video;
 
+// The integer video encoder: RGB8 frames to a WIV1 keyframe-0 payload, with integer
+// motion search and a closed-loop reconstruction the decoder reproduces. The one
+// encoder of the format; int_payload::encode_wiv1_zero_motion is its zero-motion case.
+#[cfg(feature = "video_int")]
+pub mod int_video_enc;
+
 // Integer-exact LEARNED audio codec (`wai.audio.int_codec`) — a learned 1-D
 // transform codec whose synthesis is a stack of integer transposed convolutions +
 // integer IGDN, decoding to int16 PCM byte-identically on every machine
@@ -294,6 +300,11 @@ pub mod energy_binding;
 #[cfg(feature = "c2pa_emit")]
 pub mod c2pa_emit;
 
+// RFC 8785 canonical JSON over the subset WAI signs and digests (integers up to
+// 2^53 − 1, no floats). Needs serde_json alone, so it is ungated: claims, key logs,
+// energy figures and packaging policies canonicalise through this one function.
+pub mod jcs;
+
 // jwp-receipts §2.1: an object's content hash, BLAKE3 over a domain and the envelope.
 // One module, gated only on BLAKE3, so every receipt family computes it in one place.
 #[cfg(feature = "jwp_hash")]
diff --git a/wai/wai-rs/src/rans.rs b/wai/wai-rs/src/rans.rs
index 0af9a457f..df19c66a3 100644
--- a/wai/wai-rs/src/rans.rs
+++ b/wai/wai-rs/src/rans.rs
@@ -317,14 +317,105 @@ pub struct RansEncoder {
     syms: Vec<Sym>, // forward order
 }
 
-/// One buffered symbol: a table symbol `(start, freq)` at precision 16, or a 4-bit
-/// bypass group.
+/// One coded symbol: a table symbol `(start, freq)` at precision 16, or a 4-bit bypass
+/// group.
 #[derive(Clone, Copy)]
 enum Sym {
     Table { start: u32, freq: u32 },
     Bits(u32),
 }
 
+/// The most symbols one value codes as: the table symbol, one count group (a raw value
+/// of at most 32 bits has at most eight groups, fewer than 15) and eight value groups.
+const MAX_VALUE_SYMS: usize = 10;
+
+/// The symbols `value` codes as against `cdf[0..cdf_len]` with `offset`, in the order
+/// the decoder reads them, or `None` where no stream can code it (see
+/// [`RansEncoder::encode`]).
+fn value_syms(value: i32, cdf: &[i32], cdf_len: usize, offset: i32) -> Option<([Sym; MAX_VALUE_SYMS], usize)> {
+    if cdf_len < 3 || cdf_len > cdf.len() {
+        return None;
+    }
+    let max_value = cdf_len as i64 - 2;
+    let v = i32::try_from(value as i64 - offset as i64).ok()? as i64;
+    let (sym, raw) = if v < 0 {
+        (max_value, Some((-2 * v - 1) as u64))
+    } else if v >= max_value {
+        (max_value, Some(2 * (v - max_value) as u64))
+    } else {
+        (v, None)
+    };
+    let (lo, hi) = (cdf[sym as usize], cdf[sym as usize + 1]);
+    if lo < 0 || hi <= lo || hi > (1 << PRECISION) {
+        return None;
+    }
+    let mut out = [Sym::Bits(0); MAX_VALUE_SYMS];
+    let mut n = 0;
+    let mut push = |s: Sym| {
+        out[n] = s;
+        n += 1;
+    };
+    push(Sym::Table { start: lo as u32, freq: (hi - lo) as u32 });
+    if let Some(raw) = raw {
+        // The raw value is at most 2^32 − 1, so at most eight groups.
+        let mut n_bypass = 0u32;
+        while (raw >> (n_bypass * BYPASS_PRECISION)) != 0 {
+            n_bypass += 1;
+        }
+        let mut count = n_bypass;
+        while count >= MAX_BYPASS_VAL {
+            push(Sym::Bits(MAX_BYPASS_VAL));
+            count -= MAX_BYPASS_VAL;
+        }
+        push(Sym::Bits(count));
+        for j in 0..n_bypass {
+            push(Sym::Bits(((raw >> (j * BYPASS_PRECISION)) & MAX_BYPASS_VAL as u64) as u32));
+        }
+    }
+    Some((out, n))
+}
+
+/// One step of the encoder, symbols taken last-decoded first: the state takes the
+/// symbol, after emitting the low 32 bits while it is too large to.
+fn put_sym(state: &mut u64, renorm: &mut Vec<u32>, s: Sym) {
+    match s {
+        Sym::Table { start, freq } => {
+            // renorm so the division stays in range: emit low 32 bits while too big.
+            let x_max = ((RANS64_L >> PRECISION) << 32) * freq as u64;
+            while *state >= x_max {
+                renorm.push(*state as u32);
+                *state >>= 32;
+            }
+            *state = ((*state / freq as u64) << PRECISION) + (*state % freq as u64) + start as u64;
+        }
+        Sym::Bits(val) => {
+            // A group of BYPASS_PRECISION bits is a symbol of frequency
+            // 2^(PRECISION − BYPASS_PRECISION): the state takes the bits
+            // directly, the inverse of `RansDecoder::get_bits`.
+            let freq = 1u64 << (PRECISION - BYPASS_PRECISION);
+            let x_max = ((RANS64_L >> PRECISION) << 32) * freq;
+            if *state >= x_max {
+                renorm.push(*state as u32);
+                *state >>= 32;
+            }
+            *state = (*state << BYPASS_PRECISION) | val as u64;
+        }
+    }
+}
+
+/// The stream: the final state (low word, then high: the decoder seeds `hi << 32 | lo`),
+/// then the emitted words in the order the decoder consumes them. Built at its exact
+/// length, the words dropped as it is.
+fn finish_stream(state: u64, renorm: Vec<u32>) -> Vec<u8> {
+    let mut out = Vec::with_capacity(8 + 4 * renorm.len());
+    out.extend_from_slice(&(state as u32).to_le_bytes());
+    out.extend_from_slice(&((state >> 32) as u32).to_le_bytes());
+    for w in renorm.iter().rev() {
+        out.extend_from_slice(&w.to_le_bytes());
+    }
+    out
+}
+
 impl RansEncoder {
     pub fn new() -> Self {
         Self::default()
@@ -338,43 +429,13 @@ impl RansEncoder {
     /// or `value − offset` outside `i32` (the decoder forms the escaped value in
     /// `i32`).
     pub fn encode(&mut self, value: i32, cdf: &[i32], cdf_len: usize, offset: i32) -> bool {
-        if cdf_len < 3 || cdf_len > cdf.len() {
-            return false;
-        }
-        let max_value = cdf_len as i64 - 2;
-        let Ok(v) = i32::try_from(value as i64 - offset as i64) else {
-            return false;
-        };
-        let v = v as i64;
-        let (sym, raw) = if v < 0 {
-            (max_value, Some((-2 * v - 1) as u64))
-        } else if v >= max_value {
-            (max_value, Some(2 * (v - max_value) as u64))
-        } else {
-            (v, None)
-        };
-        let (lo, hi) = (cdf[sym as usize], cdf[sym as usize + 1]);
-        if lo < 0 || hi <= lo || hi > (1 << PRECISION) {
-            return false;
-        }
-        self.syms.push(Sym::Table { start: lo as u32, freq: (hi - lo) as u32 });
-        if let Some(raw) = raw {
-            // The raw value is at most 2^32 − 1, so at most eight groups.
-            let mut n_bypass = 0u32;
-            while (raw >> (n_bypass * BYPASS_PRECISION)) != 0 {
-                n_bypass += 1;
-            }
-            let mut count = n_bypass;
-            while count >= MAX_BYPASS_VAL {
-                self.syms.push(Sym::Bits(MAX_BYPASS_VAL));
-                count -= MAX_BYPASS_VAL;
-            }
-            self.syms.push(Sym::Bits(count));
-            for j in 0..n_bypass {
-                self.syms.push(Sym::Bits(((raw >> (j * BYPASS_PRECISION)) & MAX_BYPASS_VAL as u64) as u32));
+        match value_syms(value, cdf, cdf_len, offset) {
+            Some((syms, n)) => {
+                self.syms.extend_from_slice(&syms[..n]);
+                true
             }
+            None => false,
         }
-        true
     }
 
     /// Encode the buffered symbols (in reverse) and return the bitstream that
@@ -383,34 +444,57 @@ impl RansEncoder {
         let mut state: u64 = RANS64_L;
         let mut renorm: Vec<u32> = Vec::new();
         for &s in self.syms.iter().rev() {
-            match s {
-                Sym::Table { start, freq } => {
-                    // renorm so the division stays in range: emit low 32 bits while too big.
-                    let x_max = ((RANS64_L >> PRECISION) << 32) * freq as u64;
-                    while state >= x_max {
-                        renorm.push(state as u32);
-                        state >>= 32;
-                    }
-                    state = ((state / freq as u64) << PRECISION) + (state % freq as u64) + start as u64;
-                }
-                Sym::Bits(val) => {
-                    // A group of BYPASS_PRECISION bits is a symbol of frequency
-                    // 2^(PRECISION − BYPASS_PRECISION): the state takes the bits
-                    // directly, the inverse of `RansDecoder::get_bits`.
-                    let freq = 1u64 << (PRECISION - BYPASS_PRECISION);
-                    let x_max = ((RANS64_L >> PRECISION) << 32) * freq;
-                    if state >= x_max {
-                        renorm.push(state as u32);
-                        state >>= 32;
-                    }
-                    state = (state << BYPASS_PRECISION) | val as u64;
-                }
-            }
+            put_sym(&mut state, &mut renorm, s);
         }
-        renorm.reverse(); // decoder consumes these forward
-        let mut words = vec![state as u32, (state >> 32) as u32]; // flush: lo, hi (decoder seeds hi<<32|lo)
-        words.extend(renorm);
-        words.iter().flat_map(|w| w.to_le_bytes()).collect()
+        finish_stream(state, renorm)
+    }
+}
+
+/// The same encoder, fed values in reverse: each [`put`](Self::put) codes a value the
+/// decoder reads *before* every value put so far. It holds the state and the words it
+/// has emitted, never a buffer of symbols, so a caller that can produce its values
+/// last-first (a two-pass encoder) codes a stream in about the stream's own size. Fed a
+/// sequence of values last-first, it writes exactly the bytes [`RansEncoder`] writes for
+/// the sequence.
+pub struct RansReverseEncoder {
+    state: u64,
+    renorm: Vec<u32>,
+}
+
+impl Default for RansReverseEncoder {
+    fn default() -> Self {
+        RansReverseEncoder { state: RANS64_L, renorm: Vec::new() }
+    }
+}
+
+impl RansReverseEncoder {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Code `value` ahead of every value put so far, against `cdf[0..cdf_len]` with
+    /// `offset`; `false`, coding nothing, exactly where [`RansEncoder::encode`] is
+    /// `false`.
+    pub fn put(&mut self, value: i32, cdf: &[i32], cdf_len: usize, offset: i32) -> bool {
+        match value_syms(value, cdf, cdf_len, offset) {
+            Some((syms, n)) => {
+                for &s in syms[..n].iter().rev() {
+                    put_sym(&mut self.state, &mut self.renorm, s);
+                }
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// The words emitted so far.
+    pub fn words(&self) -> usize {
+        self.renorm.len()
+    }
+
+    /// The bitstream.
+    pub fn finish(self) -> Vec<u8> {
+        finish_stream(self.state, self.renorm)
     }
 }
 
@@ -457,6 +541,41 @@ mod tests {
         assert_eq!(out, syms, "rANS round-trip must be lossless");
     }
 
+    /// The reverse writer, fed the values last-first, writes the bytes the buffering
+    /// encoder writes, table symbols and bypass escapes alike, and refuses what it
+    /// refuses.
+    #[test]
+    fn the_reverse_writer_writes_the_same_bytes() {
+        let mut x: u64 = 0x2545_f491_4f6c_dd1d;
+        let mut next = || {
+            x ^= x << 13;
+            x ^= x >> 7;
+            x ^= x << 17;
+            x
+        };
+        for (n, offset, count) in [(1usize, 0i32, 0usize), (1, 0, 1), (4, -2, 300), (16, -8, 5000), (255, 7, 3000), (511, -255, 20000)] {
+            let cdf = gauss_cdf(n as f64 / 6.0 + 0.5, n);
+            let cdf_len = cdf.len();
+            let vals: Vec<i32> = (0..count)
+                .map(|_| {
+                    let r = next();
+                    match r % 8 {
+                        0 => r as i32,
+                        1 => ((r >> 8) as i32) >> ((r >> 40) % 31),
+                        _ => offset + ((r >> 8) % (n as u64 + 2)) as i32 - 1,
+                    }
+                })
+                .collect();
+            let mut fwd = RansEncoder::new();
+            let fits: Vec<bool> = vals.iter().map(|&v| fwd.encode(v, &cdf, cdf_len, offset)).collect();
+            let mut rev = RansReverseEncoder::new();
+            for (i, &v) in vals.iter().enumerate().rev() {
+                assert_eq!(rev.put(v, &cdf, cdf_len, offset), fits[i], "value {v}");
+            }
+            assert_eq!(rev.finish(), fwd.flush(), "n={n} offset={offset} count={count}");
+        }
+    }
+
     /// The bypass escape round-trips every `i32` the decoder can return, against
     /// tables of several lengths and offsets, the boundaries `±2^31` included, and
     /// every stream ends canonically. A value no stream can code (`value − offset`
diff --git a/wai/wai-rs/tests/int_kernels_vectors.rs b/wai/wai-rs/tests/int_kernels_vectors.rs
index a7da2a40f..e226b7c6d 100644
--- a/wai/wai-rs/tests/int_kernels_vectors.rs
+++ b/wai/wai-rs/tests/int_kernels_vectors.rs
@@ -219,6 +219,7 @@ fn every_decoded_output_states_a_sha256() {
         ("claim-conformance", "receipt claims: receipt content, no decoded output"),
         ("jwp-conformance", "JWP delivery receipts: receipt content, no decoded output"),
         ("oer-conformance", "OER/2 receipts: receipt content, no decoded output"),
+        ("pack-conformance", "encode/expected.json states the SHA-256 of every decoded frame (RGB8); the rest are policies, refusals, conversions and scene cuts, with no decoded output"),
         ("pin-conformance", "parameter-set pins: every digest there is a SHA-256 of a parameter set"),
         ("signer-conformance", "key logs, grants and statuses: signed documents, no decoded output"),
         ("byte-exact-conformance", "goldens over tests/vectors, whose sidecars state the SHA-256"),
diff --git a/wai/wai-rs/tests/int_video_enc_memory.rs b/wai/wai-rs/tests/int_video_enc_memory.rs
new file mode 100644
index 000000000..a9bd93ab5
--- /dev/null
+++ b/wai/wai-rs/tests/int_video_enc_memory.rs
@@ -0,0 +1,131 @@
+//! What the integer video encoder holds (`int_video_enc::working_bytes`) against what it
+//! holds in fact, measured with a global allocator that tracks the bytes live and their
+//! peak, as `tests/int_payload_cost.rs` measures the decoder.
+//!
+//! The encoder codes in two passes and keeps no residual or symbol per sample, so beyond
+//! the frames it is given it holds the reconstruction it returns, the motion vectors and
+//! the stream (as emitted, finished and copied into the payload): a small multiple of
+//! the clip at worst, about one clip for content that codes well. The clips: noise at
+//! step 1 (a wide residual table, a long stream), a smooth pan, block 1 (a vector for
+//! every pixel), one frame; tiny clips whose residual table is wide, where the table's
+//! fit is most of what is held (1 × 3 noise, 2 frames; 2 × 5, 4 frames, block 5); and a
+//! seeded sweep of small random clips over every block, precision, search and step.
+//!
+//! Its own test binary with a single test, so that no other test's allocations land in
+//! the window it measures.
+#![cfg(feature = "video_int")]
+
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::sync::atomic::{AtomicUsize, Ordering::Relaxed};
+
+use wai::int_video_enc::{encode, working_bytes, EncParams};
+
+/// The system allocator, tracking the bytes live and the most live at once.
+struct Live;
+static CUR: AtomicUsize = AtomicUsize::new(0);
+static PEAK: AtomicUsize = AtomicUsize::new(0);
+
+unsafe impl GlobalAlloc for Live {
+    unsafe fn alloc(&self, l: Layout) -> *mut u8 {
+        PEAK.fetch_max(CUR.fetch_add(l.size(), Relaxed) + l.size(), Relaxed);
+        unsafe { System.alloc(l) }
+    }
+    unsafe fn alloc_zeroed(&self, l: Layout) -> *mut u8 {
+        PEAK.fetch_max(CUR.fetch_add(l.size(), Relaxed) + l.size(), Relaxed);
+        unsafe { System.alloc_zeroed(l) }
+    }
+    unsafe fn realloc(&self, p: *mut u8, l: Layout, new: usize) -> *mut u8 {
+        if new >= l.size() {
+            PEAK.fetch_max(CUR.fetch_add(new - l.size(), Relaxed) + (new - l.size()), Relaxed);
+        } else {
+            CUR.fetch_sub(l.size() - new, Relaxed);
+        }
+        unsafe { System.realloc(p, l, new) }
+    }
+    unsafe fn dealloc(&self, p: *mut u8, l: Layout) {
+        CUR.fetch_sub(l.size(), Relaxed);
+        unsafe { System.dealloc(p, l) }
+    }
+}
+
+#[global_allocator]
+static ALLOC: Live = Live;
+
+fn clip(h: usize, w: usize, n: usize, f: impl Fn(usize, usize, usize, usize) -> u8) -> Vec<Vec<u8>> {
+    (0..n).map(|t| (0..h * w * 3).map(|i| f(t, i / 3 / w, i / 3 % w, i % 3)).collect()).collect()
+}
+
+/// A clip: its name, height, width, frames and the encoder's parameters.
+type Case = (&'static str, u32, u32, Vec<Vec<u8>>, EncParams);
+
+#[test]
+fn the_encoder_holds_at_most_its_working_bytes() {
+    let mut x: u64 = 0x9e37_79b9_7f4a_7c15;
+    let mut noise = move || {
+        x ^= x << 13;
+        x ^= x >> 7;
+        x ^= x << 17;
+        (x >> 24) as u8
+    };
+    let noisy: Vec<Vec<u8>> = (0..10).map(|_| (0..40 * 48 * 3).map(|_| noise()).collect()).collect();
+    let cases: Vec<Case> = vec![
+        ("noise, q 1", 40, 48, noisy, EncParams { block: 4, search: 2, mv_precision: 2, q: 1 }),
+        ("smooth pan", 36, 64, clip(36, 64, 16, |t, y, x, c| ((x * 3 + y + 2 * t + c * 40) % 200) as u8), EncParams { block: 8, search: 3, mv_precision: 1, q: 6 }),
+        ("block 1", 16, 16, clip(16, 16, 6, |t, y, x, c| ((x * 7 + y * 5 + t * 3 + c) % 256) as u8), EncParams { block: 1, search: 1, mv_precision: 1, q: 2 }),
+        ("one frame", 50, 70, clip(50, 70, 1, |_, y, x, c| ((x ^ y) as u8).wrapping_mul(c as u8 + 1)), EncParams { block: 16, search: 4, mv_precision: 2, q: 3 }),
+        ("1 x 3 noise, 2 frames, q 1", 1, 3, vec![vec![0, 255, 7, 250, 3, 128, 255, 0, 90], vec![255, 0, 250, 5, 255, 0, 0, 255, 1]], EncParams { block: 1, search: 1, mv_precision: 1, q: 1 }),
+        ("2 x 5 noise, 4 frames, block 5, q 1", 2, 5, clip(2, 5, 4, |t, y, x, c| ((x * 97 + y * 31 + t * 151 + c * 67) * 2654435761 % 256) as u8), EncParams { block: 5, search: 1, mv_precision: 2, q: 1 }),
+    ];
+    for (name, h, w, frames, p) in cases {
+        let base = CUR.load(Relaxed);
+        PEAK.store(base, Relaxed);
+        let e = encode(&frames, h, w, &p).expect("a clip the encoder codes");
+        let peak = (PEAK.load(Relaxed) - base) as u64;
+        let bound = working_bytes(frames.len() as u64, h, w, p.block);
+        let clip_bytes = frames.len() as u64 * h as u64 * w as u64 * 3;
+        assert!(peak <= bound, "{name}: held {peak} bytes, past the stated {bound}");
+        // The reconstruction it returns is held, so at least one clip.
+        assert!(peak >= clip_bytes, "{name}: held {peak} bytes, under the clip's {clip_bytes}");
+        drop(e);
+    }
+    // The review's sweep, seeded: small clips of noise, ramps and extremes, every block
+    // size to 8, both precisions, search to 2, steps from 1 to 65535.
+    let mut s: u64 = 0x1234_5678_9abc_def1;
+    let mut next = move || {
+        s ^= s << 13;
+        s ^= s >> 7;
+        s ^= s << 17;
+        s
+    };
+    let count = 3000;
+    for i in 0..count {
+        let h = 1 + (next() % 12) as u32;
+        let w = 1 + (next() % 12) as u32;
+        let n = 1 + (next() % 30) as usize;
+        let block = 1 + (next() % 8) as u32;
+        let mv_precision = 1 + (next() % 2) as u8;
+        let search = (next() % 3) as u32;
+        let q = [1u32, 2, 5, 64, 255, 65535][(next() % 6) as usize];
+        let kind = next() % 3;
+        let len = h as usize * w as usize * 3;
+        let frames: Vec<Vec<u8>> = (0..n)
+            .map(|t| {
+                (0..len)
+                    .map(|j| match kind {
+                        0 => (next() >> 24) as u8,
+                        1 => ((j * 7 + t * 13) % 251) as u8,
+                        _ => if (j + t) % 2 == 0 { 0 } else { 255 },
+                    })
+                    .collect()
+            })
+            .collect();
+        let p = EncParams { block, search, mv_precision, q };
+        let base = CUR.load(Relaxed);
+        PEAK.store(base, Relaxed);
+        let e = encode(&frames, h, w, &p).expect("a clip the encoder codes");
+        let peak = (PEAK.load(Relaxed) - base) as u64;
+        let bound = working_bytes(n as u64, h, w, block);
+        assert!(peak <= bound, "sweep case {i} ({h} x {w}, {n} frames, {p:?}): held {peak} bytes, past the stated {bound}");
+        drop(e);
+    }
+}