### Packaging: a title's whole ladder in one package

- **Several floor rungs per package** ([packaging](extensions/packaging.md) §7.1). A
  component may have any number of floor rungs; each piece then has one floor object per
  floor rung, in ladder order, all over one base, so the base of a ladder is coded once.
  Each floor rung has a **floor name**: the component's id when it has one floor rung (so
  existing packages are unchanged, byte for byte), the rung's id when it has several. The
  name names the supplied stream (`<name>.obu`, §7.3), the CMAF files (`floor/<name>/`,
  §7.6), the floor playlist (`hls/classic/floor-<name>.m3u8`), the DASH representation
  (`<name>-floor`) and the MoQ track (`<name>/floor`); a floor name that cannot be one path
  segment, or two equal in any case, is refused (`pack-id`). The classical master lists one
  variant per floor rung; with several, `dash/classic.mpd` carries each representation's
  codecs and size on the representation. The verifier holds the *k*-th floor entry of each
  piece to the *k*-th floor rung.
- **A re-pack from a parent** (§11.5). A packer may take every piece's base and
  refinements from an earlier package instead of coding them (`wai-pack pack
  --base-from <package>`), so a title's integer base is coded once and taken by every
  package made from the same source after it. It refuses a parent that does not verify
  (`repack-parent-invalid`), one whose pieces, kinds, rungs, parameters or deadlines are
  not this pack's (`repack-parent-mismatch`), and one whose prefixes do not reconstruct
  this source with the SSE their entries state (`repack-source-mismatch`). Its receipt
  names the parent with parent kind `re-pack`, and its other files are those of a pack
  that codes. A verifier holding the parent checks the re-pack against it (`wai-pack
  verify --parent`).
- **A floor that is the ladder's own CMAF segments** (§7.7). With
  `floor.supplied_form = "cmaf"` (absent, the OBU form; existing policy digests are
  unchanged), a supplied floor is an existing ladder's `init.mp4` and media segments, one
  segment per piece, read box by box: the floor's temporal units are the samples, each
  with a temporal delimiter before it. The package's floor files are the ladder's files,
  byte for byte, named by their SHA-256, and the package carries the supplied floor's
  listing (`floor.listing`), whose SHA-256 the policy pins, so the receipt binds every
  byte of the ladder. A server can hold those files once for the classic site and the
  package. New refusals: `floor-cmaf-malformed`, `floor-cmaf-timing`, `floor-cmaf-pieces`.
  `wai-pack pack --link-supplied` writes them as hard links to the supplied files.
- **A floor-only profile** (§7.8). A component of `profile = "floor-only"` is its floor
  rungs alone: no integer base, no refinement, no source (`policy-floor-only`
  otherwise). Its pieces are its first floor rung's media segments (the CMAF form) or
  shown key frames (the OBU form), each at most `max_ms` (`floor-piece-length`); each piece
  is its floor objects, which present no base and so carry no `derived_from`, and its kind
  is `none` (stage index kind 6). It attests delivery: the receipt binds every floor
  object and the supplied floor's bytes, and the verifier holds them to the AV1 stream's
  structure and the CMAF files; it states no decoded output, no fidelity to a source and
  no primary. The stage index now requires a floor's `derived_from` exactly when its piece
  has a base (`floor-derived-from`).
- **The independent verifier at scale** (`pack_verify.py`). Each object is hashed once,
  and `http_verify.resolve_uri` finds an object by its content id rather than by hashing
  every object for every URI. `--jobs N` runs every object's hash and every base's decode
  and layers in N worker processes, piece by piece, ahead of checks that are unchanged in
  order and reason. `--native-blake3` takes BLAKE3 from the `blake3` module after it
  agrees with the pure implementation on the published vectors (opt-in: that module is
  the implementation wai-rs links). `--package <dir>` verifies one package without its
  sources or its key. **The measurement claim is checked** (§9.4): the claim corpus's
  verifier reads it, and it is held to the receipt's figure, class, evidence and signer, so
  a correctly metered package passes; `package-mutations/` gains a metered package (`ok`),
  a claim about another figure (`measurement-claim-invalid`) and none
  (`measurement-claim-missing`).
- **§7.3: key-frame sequence headers** (an informative note). A floor taken from an
  existing ladder needs a sequence header in every key-frame unit; a producer that puts
  one back must put back the stream's own first sequence header, byte for byte, not the
  sample entry's `av1C` header, which can differ in its tool flags and is refused
  (`floor-av1-malformed`). `tests/refusals.rs` holds the rule.
- **The DASH renderer** (`wai::http_binding::dash`) writes a representation's own
  `@codecs`, `@width` and `@height` when given, and an adaptation set's `@codecs` only when
  every representation shares it.
- **A streaming on-demand packer** (§11.4). The packer reads the source twice, a frame
  at a time, once to cut it and once to code it, and each floor stream a temporal unit at
  a time, and `wai-pack pack` writes each file into its directory as it is made, reading
  objects back for the catalogs. What it holds no longer grows with the title, but for a
  record per piece and per entry and a byte per frame per floor; a refusal removes what it
  wrote. `--jobs <n>` codes n pieces at once, each alone, so the package is the same for
  any n. A source that does not read the same twice is refused (`pack-source-changed`).
  `tests/pack_alloc.rs` packs a source eight times as long in the same peak memory.
- **Conformance.** `packs/video-ladder-01/` (two floors, one at half size, over
  `video-base-01`'s bases, which are the same objects), `ladder-mutations/`,
  `packs/video-repack-01/` (the ladder re-packed from `video-base-01`),
  `packs/video-cmaf-01/` and `cmaf-mutations/` (the ladder's streams as a muxer's fMP4
  segments), `packs/video-floor-only-01/` and `-02/` (both forms, no base), index cases of
  a piece of floors alone, `tests/ladder.rs`, `tests/repack.rs`, `tests/cmaf.rs`,
  `tests/floor_only.rs`, and the independent
  verifier `pack_verify.py`, with a box reader of its own, which re-derives every golden
  from its sources and checks the re-pack against its parent. `supplied_floor.py` writes
  one stream per floor rung; `supplied_cmaf.py` the CMAF form.
- **What a metered pack's figure brackets, and what a CMAF floor must agree with.** The
  meter starts once the policy's own refusals have passed, before the source's first
  read, so the figure covers the whole pack: both reads, the floor checks and a parent's
  verification (§9.4). A CMAF floor's `av1C` and sample entry must be its sequence
  header's, and every sample is a sync sample exactly when its unit starts at a shown key
  frame (§7.7, §11.3). A re-pack's verification holds its parent whole (§11.4).

