### Staged-delivery measurement: counted bytes, integer quality, the output tree

- **The extension** [staged-measurement](extensions/staged-measurement.md): how a
  figure about staged delivery is measured and published. The counted bytes of an
  object are its envelope to the byte (`12 + man_len + P` for `WAI1`,
  `8 + man_len + 2 + 8n + Σ P` for `WAI2`), and an object is countable only where WAI
  checks the format of every payload it carries: the pinned integer formats and `WIR1`,
  by the parse a sink runs, for the capability and for a `WAI1` fallback with a pinned
  format. Any other capability, a classical codestream or an unregistered string among
  them, is not countable (`no-format-check`), and neither is a `WAI2` component whose
  `sha256` is not its payload's, nor an encrypted payload; no estimate stands in for a
  figure that is not countable. A figure carries the framing label `registered`. Quality is integers per
  presentation and per prefix, against the source and against the final prefix: SSE
  over RGB and over an integer BT.601 luma, a Q32 structural similarity over clipped
  8×8 windows at stride 4 with an edge-aligned last window on each axis, so every pixel
  is in a window (bounded in 128-bit integers), PCM SSE and reference energy,
  and tensor SSE and largest difference, each pooled over units; decibels are display
  only. First presentable, layering overhead as two rate–quality points (never a
  ratio), delivery simulation, decode time and energy (only a clean attribution verdict is a figure; a rail
  that is not live is unmetered), deduplication, dated records, what CI asserts, and a
  media-class matrix are stated. The output tree (Appendix C) commits to every
  presentation, one SHA-256 leaf per (unit, layers), under RFC 6962's tree hash, by its
  root and leaf count together, with audit paths checked as RFC 9162 checks them under
  the committed count (`output_tree::OutputCommitment`).
- **Measured titles** (Appendix D): a staged set over a staged-conformance base, read
  where it is, with only what the stage model does not carry beside it (unit duration,
  capture times, the source, single-layer references, the fixture tool's own
  reconstruction digests), and a content identity over the measured files.
- **Reference implementation.** `wai-rs` feature `stage_measure` (pure integer, no
  ONNX, wasm32-clean; CI builds it for wasm32): `measure_framing`, `output_tree`,
  `stage_measure::{title, decode, run}`, which decodes each base through the sink's own
  base decode, `staged::decode_base_pinned` (which also gives the pin it verified),
  under the cost limit, and applies the layers through `staged::StageSink`
  under the chain budget, handing each stage's output over as it is reached. The tools'
  stated limits are `staged::TOOL_DEFAULT_LIMIT` and `staged::TOOL_DEFAULT_CHAIN_BUDGET`
  (staged-measurement Appendix D states each figure and why); `wai stage` (`apply`,
  `refine`, `base`), `wai_stage_measure eval` and `wai_stage_bench` decode every base
  under them, hold every layer and chain to them, and take
  `--limit OUT,SYMBOLS,WORKING,MACS`. A title's `limits` lower a limit and never raise
  one: each figure is the lower of the title's and the tool's.
  The corpus's `refusals/` hold titles a tool must refuse, with the code: a base past its
  chain budget, the two declared-clip bound vectors (refused before anything is
  allocated for them; a counting-allocator test shows it), the 1 GiB one again under a
  title that states limits of 2^40, two inert envelopes, and a layer past its title's
  cost limit. `tests/vectors/staged_bounds/` gains a base whose up2 layer declares
  67,092,480 output bytes, which `wai stage apply` and `wai_stage_bench` refuse with no
  flag. Always on:
  `quality` and `content_dedup` (the package receipt's dedup figures now go through
  it; a map that gives one content hash two lengths no longer verifies); native only:
  `bench_env`, the machine record, which `wai_decode_bench` now prints from. The
  `wai_stage_measure` tool evaluates a title (`eval`), verifies the corpus (`verify`)
  and writes it (`gen-fixtures`, `generate-goldens`).
- **The corpus** [`staged-measure-conformance/`](staged-measure-conformance/): a
  picture, a clip, an audio clip and a splat attribute tensor, each with its figures in
  `goldens.json`; `wai_stage_measure verify` and an independent Python verifier,
  `measure_verify.py`, both reproduce every figure, and CI runs both.
- **The delivery simulator** (§10, Appendix B; `stage_measure::sim`,
  `wai_stage_measure sim`): a discrete-event model in integer microseconds of a sender
  putting a title's objects on one link (`strict-priority` or `fifo`; `datagram` or
  `subgroup` carriage with delivery timeouts that drop or reset; a layer cap; a VOD
  window or live capture) and a sink decoding and presenting them (workers, `base-first`
  or `fifo` decode, playout deadlines). Its figures are labelled simulated. Bases are
  sent, and decoded under `base-first`, in the order they became available. A
  refinement's stall of its base is then bounded by one chunk (strict priority) or a
  timeout and one chunk (`fifo`), plus one refinement decode (`base-first`): §10.4
  proves it, for every plan with no base timeout, a bounded link schedule and
  `base-first` decode. It is also checked on generated plans drawn over that whole
  range and on the corpus's plans, and for each unbounded part a counter-plan's stall
  passes the bound of the same plan with that part restored. The corpus `sim/` and an independent
  `sim_verify.py` reproduce every result.
- **Wire.** No envelope, payload, receipt, claim, pin or corpus file of an earlier
  revision changes bytes.

