### The session claim: what a sink reconstructed

- **The `reconstruct-session` class** ([jwp-receipts](extensions/jwp-receipts.md)
  §2.4.12, the next number after `stage` and `delivery-gap`): a sink's statement of one
  session, about its entry object — the decoders it used, on which host and against
  which parameter sets; the path each unit took and why it switched; the presentations
  it made after their deadline; a commitment to every output it presented, by the root
  and leaf count of [staged-measurement](extensions/staged-measurement.md)'s output tree;
  the bytes it counted and received, and the objects it could not count; the classical
  rendition it did not need, by its `WAI2` table length; the `stage` claims it signed
  about the stage sets it observed; and, where metered, the decode figure of one
  completion with its acquisition class (`null` when unmetered, never 0). Its rules at
  §3.1 step 4, and step 6 against the presentations (the tree, first-use order of the
  decoder entries, paths, units, missed presentations, and re-decodes through decoders
  whose replicate class makes them byte-exact), the objects received (its entry object
  and every decoder entry's object among them), the envelopes received and the `stage`
  claims it names. Each rule
  and check has its reason in §3.1's table. Its capped lists are exact: the switches and
  the missed presentations are each listed in full up to the list's cap, and counted in
  full.
- **It restates no `stage` claim.** A `stage` claim states one set's layer objects, its
  units at each stage on time and its delivered stage; the session names it by link hash
  with the title's unit that is the set's unit 0, and commits to every output across the
  title, late ones included. A sink signs one for each epoch of a set — before it forgets
  the set's base, and at the end — and names them all. Step 6 binds the two both ways:
  each set's units were presented; the session presented, at each stage, no fewer units
  than a `stage` claim counts; no unit at a stage beyond the layers that the claims whose
  sets hold it — every epoch's, and every base's over the unit — list as `applied` or
  `partial` (a `late` or `refused` layer applied to no unit); and each claim's base and
  arrived objects are among the objects the session received. Nothing binds a `stage`
  claim to a session beyond its base and key: one an earlier session of the title signed
  can be named.
- **A decoder entry names the object it decoded**, and the envelope binds it. Its
  `object` is the content hash of the `WAI2` envelope whose rendition it decoded, or of
  the `WAI1` envelope; it is among the objects received (`session_source_not_received`).
  The envelopes a verifier holds — every `WAI2` envelope received, and any `WAI1` one —
  are among the objects received, read as plaintext envelopes
  (`session_envelope_unreadable`), and an entry whose object is one of them names what it
  gives: a rendition and that rendition's capability, or the `WAI1` manifest's capability
  or fallback (`session_source_mismatch`). A signer cannot relabel an entry whose envelope
  the verifier holds out of the re-decode check, by any route; which object an output came
  from remains its statement. An entry decodes one object, so a title's output-tree
  entries are (capability, pin, object) as well (staged-measurement Appendix C), and a
  session over a title still commits to the title's tree.
- **The classical rendition.** An envelope's classical rendition is the first selectable
  one whose capability the codec glossary links from an entry of era `classical` and
  whose media is the envelope's; WAI's own formats, neural codecs, records, parameter sets
  and text never qualify.
- **Authorities** (§7.5): a session needs `reconstruct-session`, not pinned-only. Its
  energy figure is a second item for confirmation, needing `reconstruct-session` and the
  energy authority of its class; a verifier reports the two side by side, so an origin
  can stand behind a session and not behind its figure. A session's subject's origin is
  not expected for it: a relying party names the origin it expects, if any.
- **Figure profiles** ([energy-measurement](extensions/energy-measurement.md) §6.1): the
  `moq-jwp:claim-link` row widens to a session whose `energy` is not `null`, so a
  `measurement` claim publishes the bracket behind a session's figure.
- **Delivery telemetry**'s `claim` member names a registered class now
  ([delivery-telemetry](extensions/delivery-telemetry.md) §2.1).
- **staged-measurement §8.6–§8.7**: a tool probes a power reader's rail at rest before it
  brackets a decode — absent, stale or live by energy-measurement §3.1's rule — and reads
  an energy counter as power by its successive differences across its wrap, ending the
  samples at an interval that cannot be a reading — one implying more power than a
  processor rail draws, one longer than ten sampling intervals, or a difference of more
  than half the counter's range (a counter reset); a tool that signs a session claim
  seals a figure only where its verdict is clean, beside the `measurement` claim on it,
  its burst run on a power of two of workers, which the session's host states as its
  `threads`, so the claim names no more of the machine than the session
  (jwp-receipts §6.7).
- **Reference implementation.** `claim_receipt::session` (the class),
  `session_recorder` (a sink's tally, each decoder named with the object it decodes; it
  verifies each `stage` claim as it records it — one for each epoch of a set — requires
  it signed by the key that finishes the session, and checks the sealed session against
  what it recorded and against those claims before it is returned),
  `key_log::Item::figure_of_claim`, `energy_report::rail_liveness`,
  `energy_burst::counter_power_samples` and `rapl_power_reader`,
  `energy_burst::{measure_on, power_of_two_workers}`, `stage_measure::run::completion`,
  `stage_measure::decode::{steps, prepare}` and `stage_measure::session`, and
  `wai_stage_measure bench`, which times each case of a title — one base's pinned decode
  or one layer's offer, its checks and hashing after the clock — over rotating rounds,
  compares every run's outputs with the evaluation's and aborts on a difference, records
  each run and the operator's statement of whether the machine was idle, meters the
  decode where a live rail allows, and with `--sign` seals the title's session and the
  report on its figure. A lib test replays every `staged-conformance/` case as a sink and
  requires the session it records, naming each epoch's `stage` claim, to seal. The
  output tree builds under `receipt_claims`; the switch reasons live in the ungated
  `delivery_terms`, which `telemetry` re-exports, so `receipt_claims` does not take
  `telemetry`.
- **Corpora.** `claim-conformance/` gains the session vectors (§5.11) — every reason the
  class adds, output trees of 1 to 33 leaves, every context, the classical rule across
  the registry's kinds of capability, the caps at their edges, a base forgotten and
  decoded again (`staged-conformance/`'s `record_budget`, its envelopes and each epoch's
  `stage` claim) and every route by which an entry could be relabelled — and
  `signer-conformance/` the session's authority and its figure's; `claim_verify.py`,
  `signer_verify.py` and `differential.py` read the class. `claim_verify.py` reads
  envelopes with `staged-conformance`'s strict readers, and `differential.py` compares the
  two implementations across both stage bounds and many epochs, the caps, malformed and
  encrypted `WAI1` and `WAI2` envelopes, entries naming their objects or not, and every
  registered capability as a classical candidate. Every vector already in both corpora is
  unchanged, and the claim corpus pins the vectors before the class by a digest computed
  before it was added. `staged-measure-conformance/goldens.json` restates each title's
  decoder entries with the envelope each decoded, and so its output root.
- **Wire.** No existing receipt, claim, pin or corpus vector changes bytes; a verifier of
  an earlier revision refuses the new class as `unknown_class`. A title's output root
  under staged-measurement Appendix C changes, its entries now naming their envelopes.

