### Packaging: refinement layers, stills, a piece's ladder, live windows and delivery

- **Refinement layers in packages** ([packaging](extensions/packaging.md) §5.4). For
  each refinement rung of a piece's ladder the packer writes a `wai.video.int_refine`
  object over the piece's `wai.video.int_motion` base: the manifest `wai stage refine`
  writes, and a `WIR1` from `wai-rs`'s refinement encoder (`staged::wir1::encode`), one
  unit per frame, toward the source from the stage below as a sink reconstructs it. Each
  layer is applied to the decoded base by the reference sink before it is kept; the
  index states each prefix's tier, digest, SSE and deadline.
- **A piece's ladder, and stills** (§5.7). A rule's `then.ladder` chooses the rungs a
  piece is coded in; otherwise the component's first base rung, its refinement chain and
  its floors. §3.4 item 10 now requires a rule's ladder to name exactly one base, every
  refinement over a rung it names, and every floor of its component. A base of
  `wai.image.png` is a still: the piece's first frame, held for the piece, as a PNG every
  byte of which is stated (the `Sub` filter, one fixed-Huffman deflate block whose
  matches are stated), so an independent implementation writes the same file.
- **Catalogs** (§8.3, §8.4). The MoQ catalog is now a stage set of moq-streaming-format
  §4.1, written by `wai::staged::moq`: `wai_staged` on every track, a receipts track and
  an alias per media track, `depends` on a track of every layer below; it replaces
  `priority` (MOQT's own, §8.5) and `wai_layer`, which the registry no longer lists. Over
  HTTP, whose variants cannot mix bases with no capability in common (http-delivery §4.2),
  a still's piece is played from the floor; its stage view and MoQ tracks list it.
- **Live windows** (§9.2). `wai-pack live` packs a Y4M stream from standard input as it
  arrives, with the coder the on-demand packer uses, in windows sealed by version-2
  receipts chained `live-window`; its bases and refinements are the on-demand package's,
  byte for byte. `wai-pack listing --primary` lists what the two share. It writes as it
  goes: each object when it is published and each window when it is sealed, every file
  whole, and the plan file and `LISTING` at the end. It does not keep an object's bytes
  once written, or a record per file: each listing line goes to a hidden file and is
  sorted into `LISTING` at the end. A source that fails mid-stream keeps every sealed window and the objects
  it lists, removes the rest, and exits 1 saying what it kept.
  `wai::pin::listing_from_sha256` writes a listing from per-file digests.
- **Stills read by PNG's rules** (§5.7). Both reference readers take a PNG of 8-bit RGB
  without interlace and agree on what that admits. They read a suggested palette,
  ancillary chunks and split image data. They refuse an interlace, bytes after `IEND`
  or after the zlib stream, a short row, a zlib window past 32 KiB, and every other
  chunk fault (`stills/`). Both inflate as the zlib library does: no over-subscribed
  Huffman code, and no incomplete one but a lone one-bit code. wai-pack's reader has
  its own inflater, and `png_diff.py` runs it against `pack_verify.py`'s zlib.
- **The longest piece** (§3.4, §4.4). `max_ms` is at most ten minutes, and at most
  `2^24` units on every component's timebase (`policy-piece-bounds`). A verifier
  refuses a piece longer than the policy's `max_ms` before it decodes a frame. It
  checks each floor object's unit count before decoding (§11.3). It hashes a still's
  frame held for its piece without repeating the frame.
- **Manifests checked by both verifiers** (§11.3). A base's manifest must be §5.2's and a
  refinement's §5.4's (`object-manifest`, a new reason). A base that does not decode
  is `prefix-digest`.
- **A repeated object over HTTP** ([http-delivery](extensions/http-delivery.md) §4.2).
  A repeated object contributes once, with its layers, and a layer joins every
  occurrence of its base. `http_verify.py` and `wai-rs` now agree on a playlist's
  codecs and floor where a piece repeats. `pack_verify.py` checks every golden playlist
  with `http_verify.py`'s union, floor and adjacency checks.
- **One stall bound.** `stage_measure::sim::stall_bound_for` is the only bound: a
  model's, which takes each refinement's own timeout. wai-web's simulator prints it, as
  the native tool does.
- **Delivery, simulated** (§8.9). `wai_pack::delivery` and `wai-pack sim` run
  staged-measurement's simulator over what a live packer publishes and what a class
  subscribes to: per-track delivery timeouts, §8.5's priorities, the subscriber's cap,
  group receipts on each track's chain. The simulator's model gains a refinement's own
  `timeout_us`, and §10.4's bound takes the longest refinement timeout
  ([staged-measurement](extensions/staged-measurement.md) Appendix B); its corpus adds a
  per-track model.
- **The corpus**: the golden `video-staged-01` (a moving shot, a bumper played twice, a
  still shot, a second moving shot; two refinement layers, a still, the event's deadline,
  three classes), its supplied floor and how it was written (`supplied_floor.py`),
  `staged-mutations/`, `delivery/`, `stills/` and `live/` (the golden packed live in
  windows of two pieces, whose chain `pack_verify.py` checks). `stage_diff.py` runs
  refinement layers, stills (wide ones among them, so every deflate distance code is
  used), piece plans and deliveries differentially against `pack_verify.py`, which
  re-derives every layer and still from the source byte for byte. `sim_diff.py` runs the
  delivery simulator differentially against `sim_verify.py`. `pack-refinement-unsupported` and
  `pack-rule-ladder-unsupported` are gone.
- The base golden `video-base-01` keeps its objects, index and receipt; its MoQ catalog
  and its `LISTING` change.

