wai merge train E: twenty-five PRs onto main, the relay's upstream window bounded, and three fixes the merged tree needed #499

Merged

dcharlot merged 293 commits from train/wai-e into main 2026-10-26 20:23:52 -04:00

Conversation 0 Commits 293 Files changed 1183 +294043 -1124

dcharlot commented 2026-10-26 17:15:43 -04:00

Owner

Copy link

WAI merge train E: twenty-five open PRs merged onto main by git merge --no-ff, one merge commit each, every conflict resolved with both sides kept, the generated files regenerated, and the one open item settled (#475's upstream links held to #483's connection window). What the merged tree exposed is fixed in commits of their own, each with its test: two pairs of room modes the service accepted together, a race in the page's SUBSCRIBE, a test count #463 left behind, and the five failures of this PR's first CI run (CI's first run, below).

Branch train/wai-e. Base: origin/main, with main merged in seven more times as it moved: #465, #486 and #485; then #477; then #492; then #494; then #495; then #497; then #498. The head is current with main at f1a34c06.

What it holds, and the SHA merged

order	PR	head merged	what
0	#465	ad283d92	the packaging train (merged first; see Order below). It has since landed on main, so the train's second merge of main brought only its merge commit
1	#440	069b551c	wai-ops/1-npu on a neural processor (G2)
1	#445	6064a35c	scene and prior carriage (B2)
1	#446	da3c09c5	JPEG XS, MV-HEVC, the projection descriptor, IEEE 1857.11, format probes, CMSD read, LOC carriage (B3r)
1	#448	9804962c	wai.avatar.face (AVTR)
1	#453	4863036d	what exactness costs (DET1)
1	#467	986edfea	int_hyper's narrow kernels (PERF1)
2	#457	2a99c78f	ended with a receipt (EN-B)
2	#460	df8c7f49	sink energy (EN-A)
2	#463	13964c94, replayed	the energy order of dispatch, the self-metered relay (EN-C); see How #463 was merged
3	#470	4623548d	stitched presentation (RI2)
3	#473	9cea6b5c	the receipt ledger (RI3; contains #470)
3	#471	e60c7dbe	key release (RI5)
3	#474	d56916da	the audit kit (RI1)
3	#480	05fb22cc	the native sink, its C interface and the Swift package (SDK-A; contains #474)
3	#488	cf93ad7a	the native sink as a Kotlin library over the C interface (SDK-B; stacked on #480). It was added to the train after the later merges were made, so it is merged at the head, after #484; it changes nothing they change but #480's CHANGELOG entry, where its bullet sits
4	#475	43c87c8c	relay cascading
5	#479	c90c4d54	Enhanced RTMP v2 ingest and SCTE 104 (ING-B)
5	#483	b54dc94c	SRT and RIST contribution ingest (ING-A)
6	#481	54589208	remote desktop (CX2)
6	#482	6745bf6c	live worlds (CX1)
6	#484	b41b566b	AVC and HEVC through platform encoders (ENC)
6	#489	d1e8965f	remote desktop rooms in the room service (CX2b; stacked on #481), merged after #482, #484 and #488
6	#490	e8c747ec	sealed input in remote rooms (stacked on #489), merged right after #489
7	#493	01f3aac1	conversations and calls on live rooms (wai.live.message, wai.live.call), merged last
7	#480	59bfbbfd, its next head	the Swift tests on a device: the corpus read from the test bundle, and a test host application (only wai/wai-sink-swift/), merged on top after #493
7	#480	850eeefe, its head now	the simulator tests hosted in that application, on a fresh simulator, every step with a hard limit (wai/wai-sink-swift/ and wai-sink-swift.yml), merged on top of 59bfbbfd

Left out: #458 (below).

Order

• #465 first, not before #484. #463's head carries #452's original history, which #465 replaces with a squash; and #484's in-package rungs need #465. With #465 first, every later PR meets the packaging tree it meets on main, and #463 merges as the "re-merge main after pack-stack" its own notes planned. #465 then landed on main while the train was being built; the later merge of main is clean.
• #488, #489, #490 and #493 were added to the train after its other merges were made, so each is merged at the head, in that order (#493 last, as asked). #480's later heads came after #493: 59bfbbfd is merged on top of it, then 850eeefe on top of that (a fast-forward of the same branch, so the train holds #480 at 850eeefe). They touch only wai/wai-sink-swift/ and its workflow. #488 changes nothing the later merges change but #480's CHANGELOG entry; #489 and #490 come after #481 and #482, as asked. The [remote]+[world] refusal (below) was made after #489 and before #490 arrived; #490 merged over it cleanly.

How #463 was merged

#463's head contains #452's commits, and with them #438's first research note (docs/research/wai-cross-fabric.md), which names fleet hosts and their addresses. #465 replaced that history with one squash precisely so that the note never enters main's history. Merging #463's head would have brought it back.

So #463's own commits are replayed with cherry-pick -x onto the train's #465 merge (branch traine/enc-replay), and that branch is merged as #463's merge commit:

• #452's platform-decode commits, which the review's split gave to EN-C and #465 left out: 6ad92e2e8, 8695bc75f, fed8694f4;
• EN-C's fourteen: df5ea962f 11b255682 ff069acc2 244a715b3 2a8d45aa0 a203eae23 9b6e4bada 1ffceb508 6c03ba72c ce38948da 1ca593124 507f4cd9e c95337739 13964c944.

#463's three merge commits (of main, and of #452) are not replayed: their conflict resolutions (SPEC §7.1 step 2, the CHANGELOG) are what the later commits reach anyway.

Checked:

• The replay's tree equals, file for file, a three-way merge of #463's head onto the replay's platform-decode commits, with #452's head merged into main 1a465f23 as the base. The two exceptions are the files that merge conflicts on: int_kernels_vectors.rs (#465's wgsl-conformance line and EN-C's platform-decode-conformance line, both kept), and the CHANGELOG.
• Its CHANGELOG is #465's, with #463's energy-honesty entry exactly.
• No fleet address appears in any replayed commit, and docs/research/wai-cross-fabric.md is not in the tree.

Conflicts, and how each was resolved

Every conflict below kept both sides. A conflict here was almost always two additions at one place.

• The CHANGELOG (every PR). Each PR's entry goes on top as it merges, so the train's entries read newest first in merge order reversed, above main's.
  • #480's merge had a criss-cross base whose CHANGELOG held nested markers. Its result is the train's CHANGELOG with #480's one new entry on top; no other entry of #480's differs from the train's.
  • #467's entry merged cleanly above #453's, and #488's bullet sits in #480's entry.
• SPEC §5, REGISTRY.md, the registry tables (codecs/mod.rs, codecs/registry.rs, glossary_check.rs), lib.rs modules, Cargo [features], [[bin]] and [[test]], the live-conformance README, workflow paths: and steps. These are unions.
  • codecs/mod.rs: main's gain-map, ST 2094-50 and DRED strings sit beside #445's tensor-file priors, #446's projection descriptor, JPEG XS, MV-HEVC and IEEE 1857.11, and #448's face generator. This holds in every class list, the companion-only and video-companion rules, the one-file parameter sets, the ops members and the registry tests' expected lists.
  • WireKind::all() is now 17. #445 (glTF extension) and #446 (telemetry key) each raised it from 15 to 16, so neither side compiled after the merge.
  • REGISTRY.md's sentence listing the extensions with wire names names every side's extensions and kinds.
• determinism-tiers §5/§6 (#440, #448 against #465's rewrite):
  • #465's GPU paragraph;
  • #448's avatar sentence;
  • #440's NPU bullet;
  • §6 rows for the GPU, the NPU and the avatar;
  • the cross-architecture paragraph keeps #465's forge-run sentence and adds #440's.
• The room page and its e2e (#457, #481, #482 with main's co-watch and origin):
  • app.js imports and snapshot fields from both sides;
  • room.e2e.mjs keeps every scenario (ageco, cowatch, origin, termination, remote, world, privateworld) in the default list, the --only usage and the runner's table, plus both sides' imports (writeWav, rawBrowser, spawn);
  • lib.mjs keeps writeWav and rawBrowser;
  • run.sh runs all the page's module tests (cowatch, remote, markup, endpoint, termination);
  • wai-live-web's wai features are stream_termination and live_world both.
• wai-ops-gpu.yml (#448 with main's DRED and splat). #448's build line goes into the build step's run block. Placed after main's DRED step instead, it would have broken the YAML.
• wai-pack (#484 with #465):
  • Cargo.toml: #484's platform_encode and #465's optional wai-pack-gpu;
  • lib.rs: the module account;
  • packaging §7.5: #465's device and driver, then #484's encoded rendition;
  • the test-count floor: #484's --test=encode_rung 3 beside #465's counts.
• live-metering §8 and the relay's metering.rs (#463 with #475): the self-metered relay and the hop links, in one text.
• joule-code-conformance.yml (#463 with #479): #463's moq-relay-energy job, and #479's account of the ingest job.
• joule-moq-ingest (#479 with #483). Both ingests are kept whole on one set of types:
  • frame.rs:
    • one Codec with HEVC, VVC, AAC and FLAC (ALL is nine);
    • #479's WEBRTC and Option-returning to_str0m, and #483's webrtc() and aac_header;
    • one Header, whose audio rate is #479's rate (#483's samplerate is renamed at its uses);
    • unframe keeps #483's whole-ADTS check.
  • package.rs, one packager:
    • HEVC and VVC take an RTMP track's hint, and from a transport stream (no hint) the header or a default;
    • AAC's first header is its ADTS header where there is no hint, the hint's otherwise.
  • catalog.rs: #479's entry carries its layer name, and #483's contrib.rs now names one.
  • config.rs, gateway.rs (routes, fields, methods, listeners, srt_task, shutdown), rtc.rs, lib.rs, the example config, the README and live-ingest's header, status table and test account: both sides.
  • tests/common: watch_kinds → watch_layers (#479) → watch_tracks (#483), one subscriber. Watched.layer is the track name where it is a number. tests/ertmp.rs imports common::rtmp::adts by name, since common now has #483's adts too.
• #477 (landed on main mid-train). Its independent-verifiers job builds wai-rs once per feature list. The train had added fifteen steps there, each with a feature list of its own, and each switch between a list and #477's union rebuilds the library and relinks every test. They now follow #477's rule:
  • WAI_FEATURES gains the fifteen steps' features (WAI_RELEASE_FEATURES gains avatar_face).
  • None of them, nor what they imply, is tested for by its absence. The only cfg(not(feature)) gates are pq_signatures, neural_int, staged and the integer media features, already in or out of the union as before.
  • The first step builds and copies the four corpus programs those steps ran with cargo run, and builds their test targets.
  • features-alone checks each of the train's lists alone.
  • The termination step's wai-live-web tests reuse the browser sink step's int_video build.

Changes the merges forced, each its own commit

• include/wai.h, regenerated by build.rs. #467's head already left a build dirty: its new public int_kernels::Isa reaches the C surface, which adds an opaque typedef. Rebuilt with no features and with the HTTP falsify shards' features, the header stays unchanged.
• Lockfiles: check-lockfiles.sh found three stale; each was refreshed with cargo metadata (resolve only).
  • joule-moq-remote (#481) now resolves #475's relay dependencies, tokio-rustls 0.26.6 and rustls-native-certs.
  • wai-key-proxy (#471) and wai-ledger (#473) now resolve main's wai-quantum 0.6.15.
  • joule-moq-remote again after main's #492, which moved every other lock to zstd 0.14.3 for its advisories.
• Two corpora the PRs left uncovered. These tests fail on #446's and #484's own heads:
  • every_decoded_output_states_a_sha256 gains entries for format-probe-conformance (#446) and encode-conformance (#484). Neither corpus decodes a payload.
  • encode-conformance's README gains the **Provenance.** line that tests/corpus_provenance.rs requires.

The open item: #475's upstream links and #483's connection window

The relay's links to its upstreams set no receive windows:

• native QUIC built a transport configuration of its own;
• WebTransport used quinn's defaults.

On both, the connection-level window was unbounded. One transport configuration (server::transport_config) now serves the listener and both kinds of link, and webtransport::connect_draft_tls_with takes it.

tests/upstream_window.rs puts an upstream of the test's own on each transport. It opens 16 data streams before its SETUP, which the relay parks after each header, and writes until flow control stops it.

• With the fix: it stalls at the 2 MiB connection window (QUIC 2,097,152 bytes; WebTransport 2,088,960).
• Falsified, committed first (git apply -R, then targeted edits, each restored through git):

mutation	quic	webtransport
the fix reverted	FAILED, 19,988,480 bytes	FAILED, 19,988,480 bytes
QUIC link's connection window unbounded	FAILED, 16 MiB	ok
WebTransport link's connection window unbounded	ok	FAILED, 16 MiB
restored	ok	ok

• Repeated: 15 of 15 runs pass.

The late additions: #488, #489, #490, #493

• #488 merged cleanly.
• #489. Its corpus replaces #481's: six of #481's vectors move from refusal to acceptance, and three are appended. Neither PR is on main, so #489's version is taken whole. Conflicts:
  • joule-moq-room's wai features take #482's live_world and #489's remote_desktop;
  • joule-moq-web.yml's scenario account and room.e2e.mjs's usage: remote runs by default when both the host agent and the room service are given.
• #490. Its corpus is #489's 42 vectors unchanged, then 10 sealed ones, and is taken whole. Conflicts:
  • telemetry_aggregate now sits on the new hpke feature, beside #446's format_probe. Every build with telemetry_aggregate or remote_desktop gets hpke through the feature, #477's union among them;
  • the remote desktop step keeps #477's union and #490's hpke:: test filter;
  • joule-moq-room's README.
• #493, merged last. Conflicts:
  • joule-moq-room's modules, Config and Service fields, the epoch (remote::epoch) with the conversation and calls opened beside it, the refusals of #482 and #493, and the README;
  • app.js: a remote room's grant request, and #493's given grant;
  • run.sh, which runs room.e2e.mjs (with --remote) and messaging.e2e.mjs, each with its own --only;
  • the workflows: live_messaging joins #477's union and the first step's test build;
  • wai-live-web's features; lib.rs, registry.rs and REGISTRY.md;
  • capabilities.json and v2.ttl, regenerated.

Modes a room service cannot keep together

Each refusal below is its own commit, with a test, and falsified.

• [remote] with [world] (once #482 and #489 were both in): remote::service refuses the pair when the configuration is read.
  • Test: a_remote_room_is_not_also_a_world_room.
  • Rule removed: the test exits 101; restored, it passes.
• [messaging] or [call] with [world] or [remote] (#493). settings() refused a conversation beside a watch room, co-performance, admission by age, [room] e2ee or a call, and a call beside the first three. It accepted either beside a shared world or a remote desktop room. Both refusals now count those two modes.
  • Test: a_conversation_or_a_call_is_not_also_a_world_or_a_remote_room.
  • Each new term removed: the test exits 101; restored, it passes.
• features-alone checks live_messaging alone, under #477's rule.

A verifier the train's tree caught

claim-conformance/differential.py --random 2000 --seed 1 drew 31135_session_roles_companion_wai.meta.projection on the train's registry: wai-rs accepted it and claim_verify.py refused it (session_layer_not_applicable).

• Cause: #446 taught wai-rs that the projection descriptor applies to a video rendition (SPEC §7.1 rule 2, as the train's SPEC states it). It did not teach staged_verify.py's _companion_applies_to, the independent reading that claim_verify.py and http_verify.py share.
• Fix: the Python rule now names wai.meta.projection with the HDR descriptors.
• Check: the differential agrees again; it is the falsification, failing before the fix and passing after.

A race the train's Studio run caught

The full browser run on the Studio failed one check of #482's world scenario:

dave catches up after alice left: … SUBSCRIBE: no answer in 10000 ms

The other 336 checks passed.

• Cause. A page asks the relay for a 10 s rendezvous on each world and room track, and it waited 10 s for the answer.
  • With no publisher, the relay answers when the rendezvous ends (§9.20.6), so the page's timer and the relay's raced.
  • #482's own run saw the relay win, and world.js follows a departed actor on that refusal. Under the Studio's load the page's timer won, so the refusal was never read.
  • The merge did not cause it: the relay's rendezvous wait and the page's timeout are the same in #482 alone. The outcome depends on load.
• Fix (joule-moq-web: a SUBSCRIBE that asks for a rendezvous waits past it for the relay's answer). request() takes how long to wait for its answer, and subscribe() waits a step past the rendezvous it asks for. Nothing else waits on that error.
• Test. web/moq/session.test.mjs uses a transport and a codec of its own, with the clock mocked. It runs in run.sh's page-module step, so the e2e job runs it:
  • a SUBSCRIBE with a rendezvous takes the relay's refusal 10.5 s in;
  • it gives up 20 s in;
  • a SUBSCRIBE without a rendezvous gives up at 10 s.
• Falsified. With session.js's change reverted, the first two cases fail, the first with the e2e's own error. Restored, all three pass.

A count #463 left behind

wai-web-wasm.yml requires wai-web's native unit tests to report exactly 35 passed. #463 added world::tests::the_pages_figure_is_sealed_as_an_estimator and left the count at 35. #463's own run of that job was cancelled, so this never showed. On the train's tree the Studio read 36 passed and the step failed.

• Fix (its own commit): the count is 36, and the step's comment names the test.
• Check: the step passes on the head (below).

CI's first run: five failures, each fixed

The first run, on 5b79d155, had 115 checks green and 5 failed. Each failure is fixed in its own commit, tested where its job runs, and falsified:

1. wai-neural-gates, model-free refusals. several_file_capabilities_need_the_set_form met #446's wai.image.ieee1857_11 and got "no model registered" instead of form_required.
   • Both sides are right. The capability is NeuralFloat, so its set is several files. It is a candidate, which a sink treats as unsupported (SPEC §5), so it is never dispatched.
   • The test's premise was "every several-file capability the reference sink dispatches". It now says so with codecs::is_dispatchable, and checks that a several-file capability it does not dispatch is a candidate the sink refuses to decode.
   • Framework: the whole job passes. With the new branch removed, the test fails as CI did.
2. wai-ledger, service · linux. smoke.sh ends with receipt_ledger_verify.py, which imports pack_verify.py and so needs tomllib; the runner image's Python is 3.10.
   • The job now sets up Python 3.11, as wai-key-proxy's does, and the step fails first with an ::error:: if its python3 has no tomllib.
   • Run on the Framework in the runner's own image, catthehacker/ubuntu:act-22.04: with the image's Python, the early error; with 3.11 first on the path, every check holds, the independent verifier among them.
3. wai-sink-android, macos. "the AAR has no jni/arm64-v8a/libwai.so", though the native step built all three ABIs and Gradle packed them.
   • Cause: under pipefail, unzip -l | grep -q fails whenever grep stops at its first match before unzip has finished writing (SIGPIPE). On the AAR the Studio built, that pipeline fails 7 times in 300; with the listing read first, 0 in 300. The toolchain, the NDK and the targets were all found.
   • The AAR check now reads the listing once and prints it on a failure. build-native.sh now reads nm and readelf output whole: the same race there could report an export or a NEEDED entry missing, or let a misaligned LOAD segment through.
   • Studio: the whole job passes, 12 emulator tests. Each rewritten check still catches its fault, shown with crafted inputs.
4. wai-web-reach, the package of record. Every build on the record leg (shipped, L1, L2, J) failed its menu workload. The fallback path did not regress.
   • The record is built from 248846f1. The registry the workload reads is this tree's, and it gains #446's candidate wai.image.ieee1857_11, which that package does not know, so the package's isCandidate disagreed with the registry.
   • A package cannot emit or dispatch a capability it does not register. The workload now compares candidates for the capabilities the package registers, and lists the rest as newer.
   • The tree's build registers every capability of the registry it is exported from, so on the tree leg newer is empty and nothing is let through. Moving the package of record itself is the site's step, and is not made here.
   • Studio, the record leg on current Node: all 11 builds equal the manifest, and run-modern gives 40 PASS lines. With the workload as it was, it fails exactly as CI did.
5. joule-moq-web e2e, privateworld. "carol replays the world from its start: not within 120000 ms". This was a real catch-up race, not load and not a timeout.
   • A member's carry for an epoch is published once, when it applies the commit. The commit that adds a page follows its join, and the clock records the join when the page's world track appears.
   • The page published first and followed the actors' tracks after. A carry sent before its subscription was answered never reached it, and no wait would bring it.
   • Fix: in a private world, a publishing page now reads the room's log to its present end (E2ee.readToEnd), follows every actor it records, waits for each subscription's answer (WorldClient.followActors), and only then publishes.
   • live-worlds §8.2 now says a member that enters SHOULD do this. The e2e checks that carol followed both members before she published.
   • Studio: with the fix's call removed, the scenario fails at once ("bob receives alice's carry", the second member). Restored, privateworld passes twice in a row, and the whole run passes: room 342 of 342, messaging and call 17 of 17, page tests 74.

The merge of main's #498 moved wai-quantum to 0.6.16. The locks of three train crates, wai-audit (#474), wai-key-proxy (#471) and wai-ledger (#473), are refreshed by resolution only, one version line each. On the final head, joule-moq-room (33 tests), the generated files, and wai-web-wasm (engine 13, native 36) pass, with all 53 lockfiles current.

Left out: #458

#458 (delivery bindings, head aca6c347) was to come in only if its four failing checks were real failures that a small, clearly right change in the train could fix. They are not. Its job logs on the forge show:

check	what failed	whose
repository checks	the advisories step: RUSTSEC-2026-0385 and -0387 in seven lockfiles	main's at #458's base, since cleared there (the train's advisories pass). #458 changes none of those locks
macOS energy backends	jouleclaw-loader-gguf does not compile under -D warnings (a deprecated quick-xml method)	main's at the time. #458 does not touch the crate
cargo-class corpora, linux-arm64	cli_http::origin_refuses_an_oversized_head read an empty answer instead of 431	a test of the HTTP origin, which #458 does not change
joule-code-rs, linux-arm64	sealed_objects::a_changed_identity_is_refused_at_the_door_over_quic: "group 1's object is refused at the door, the others pass"	#458's own: its secure-objects change to the relay's door

The only failure that is #458's sits in the relay's door and session code, which #475 rewrites in this train. Fixing it is a change to #458's design, not a small one. Three more reasons point the same way:

• #458's body asks that it not be merged without the owner's review.
• The forge reports it unmergeable with main.
• Its CMSD reading overlaps #446's.

It stays open as it is.

Generated files

• Registry export: capabilities.json, capabilities.schema.json, v2.ttl, v2.shapes.ttl and REGISTRY.md's table.
  • Regenerated with wai registry export at every merge that touched the registry, and committed in that merge.
  • At the head, registry export --check reports it up to date.
• include/wai.h: regenerated by build.rs (see above). At the head, it is unchanged after a build with no features and after a build with the HTTP falsify shards' features.
• Lockfiles: four refreshed with cargo metadata (resolve only): joule-moq-remote twice (#475's relay dependencies; then #492's zstd), wai-key-proxy and wai-ledger. scripts/check-lockfiles.sh reports 53 lockfiles, all current.
• Corpora: none regenerated by the train.
  • No corpus file is changed by two PRs that do not contain one another.
  • The stacked ones (#473 over #470, #480 over #474, #490 over #489 over #481) take the later PR's corpus whole.
  • Every corpus regenerates byte for byte: the cargo-class corpus step checks it at the head, and each verifier step checks its own (see Checks).
• Prefix check against main, for the shared corpora the train changes (train-prefix.py, not committed):
  • live-conformance/browser/vectors.json: every list of main's is an unchanged prefix of the train's (routes 11, constraints 23, bindings 15, frame_tiers 24, frames 13, tables 10), and choices (14) is new.
  • http-conformance/cases.json: #463 edits five of main's cases in place (an explicit order, a png-only case's skips) and inserts two (select_O2_default, fetch_O2_default). Its energy order changes what select and fetch pick by default, and that corpus states no append-only rule. This is #463's own change, as reviewed in #463, not a merge's.

Checks

Hosts:

• Framework box: Linux x86_64, Zen 5 with AVX-512, and the NPU of PCI 0x1022:0x17f0.
  • Each job ran through wfrun.py, which runs a workflow job's run: steps as the runner would: env, working directory, shell, $GITHUB_PATH/$GITHUB_ENV. It skips uses: steps and the steps that install a toolchain or a system package.
  • Each workspace builds in its own target directory, as each CI checkout does. One shared directory let one workspace's wai stand in for another's and failed builds that CI never sees.
• Studio: macOS arm64, the CI host.

Each row's tree:

• H is the first CI run's head, 5b79d1550, or 3a3bbfc16. 3a3bbfc16 differs from it only by main's #497 (wai-quantum, quantum-studio and wai-web's quantum engine). The checks of the fixes since, on 8ab46dfb0 and the head f004aa4f9, are under CI's first run.
• E is de7fe1b91: before #480's last head, the test-count fix, #495 and #497.
• B is 63cf067e3: #493 and the refusals in, before main's #492.
• A is the tree before #490 and #493, which touch none of the code those jobs build.

Check	Host	Tree	Result
wai-conformance cargo-classes (linux leg), all 20 steps	Framework	H	pass: 2,422 tests
wai-conformance features-alone (every list, live_messaging among them; wai-live-web without int_video)	Framework	H	pass
wai-conformance int-kernels-amd (every x86_64 kernel set, both profiles)	Framework	H	pass: 1,182 tests
registry export --check; include/wai.h after builds; check-lockfiles.sh	Framework	H	pass; unchanged; 53 current
joule-moq-room, every target (messaging_room, call_room, remote_room, world_room among them)	Framework	H	pass: 33 tests
the two refusals' falsification: each new term removed, then restored	Framework	H	101 with each removed; 0 restored
joule-moq-remote, every target, and clippy -D warnings (linux leg)	Framework	H	pass: 20 tests
joule-code-conformance moq-ingest (with and without rist, the corpora) and moq-relay	Framework	H	pass: 221 and 131 tests
standards-build joule-code-rs: cargo check --workspace --all-targets, cargo test --workspace	Framework	H	pass: 673 tests on the second run. The first stopped at age_rising, a flake main has too (below)
joule-code-conformance conformance	Framework	H	pass but for joule-code-remediate's two formal-tier tests. The job installs z3 with sudo apt-get, which this shared box does not run, so they fail with "JOULE_FIX_EXPECT_Z3=1, but there is no working z3". The workspace run above passes them, since it does not require z3
wai-pack legs (linux: clippy, release tests, the test-count floors, the corpus recomputed)	Framework	H	pass: 107 tests
wai-conformance independent verifiers (#477's union with the train's features), all 67 steps	Framework	B	63 pass: 720 cargo tests, every Python verifier and mutation, both differential builds, 0 differ. The four steps that end in a page module's node --test ran on the Studio (next row)
the same job's build step and its four node steps (28, 29, 54, 55)	Studio	E	pass: the union build, then 5, 6, 7 and 16 page tests and the Rust and Python halves
wai-conformance vocab-shapes (RDF tools at the workflow's versions, in a venv)	Framework	B	pass
wai-conformance byte-exact (linux), c2pa-emitter, quantum and avatar-face under wasip2; wai-ops native, wasip2, checker; wai-http cache-conformance; wai-ops-gpu checks; wai-ops-npu checks	Framework	A	pass
wai-ops-npu npu-hw, on the device, required	Framework	A	pass: 14 tests, and every report line the step requires (devices as declared, requantisation, corpus mismatches=0 errors=0, 12 of 12 mutants killed, width)
wai-audit collector-linux, wai-key-proxy proxy-linux, wai-ledger service-linux (with their clippy lines); wai-pack independent, licences	Framework	A	pass (independent's pip step aside)
joule-moq-web browser e2e: the whole run.sh, every room scenario and messaging.e2e.mjs	Studio	E	pass: room 341 of 341 checks (remote 34, service 29, co 29, e2ee 23, world 14, privateworld 8, termination 16, origin 15, cowatch 12, age 14, ageco 9 among them), messaging and call 17 of 17. The page modules' 74 tests, session.test.mjs among them
the same, before the rendezvous fix	Studio	d2ae29c52	336 of 337: world's "dave catches up after alice left" (see A race the train's Studio run caught)
wai-sink-swift package-macos: every slice, desktop tests, both simulators hosted in TestHost, device slices	Studio	H (#480 at 850eeefe)	pass: 8 tests on the desktop, 8 on the phone simulator, 8 on the television simulator; device builds succeed
wai-conformance codec-wrappers (the VideoToolbox platform encode among them)	Studio	E	pass: platform encode 5 tests
joule-moq-remote macos leg; wai-ledger service-macos; wai-audit kit-macos; joule-code-conformance moq-relay-energy	Studio	E	pass (relay energy: 3 tests)
wai-ops-gpu metal (the probe, the corpus at both widths, the mutants, on the GPU)	Studio	E	pass
wai-sink-android android-macos: the ABIs, the AAR, instrumented tests in a headless emulator	Studio	E	pass: 12 run, 0 failed
wai-sink-android JVM unit tests (the jvm-linux-arm64 job, run on macOS here)	Studio	E	15 run, 0 failed. Its build step's export check reads ELF symbols (nm -D), which a macOS dylib does not have. nm -gU shows all 16 Java_wai_sink_WaiNative_* symbols and JNI_OnLoad exported. CI runs the job on linux-arm64
wai-conformance delivery telemetry differential	Studio	E	pass: 21 observations, 16 reports, 3 CMSD fields
wai-web-wasm wasm32, every step	Studio	5b79d1550, and again at f004aa4f9	pass: native 36, engine 11; then engine 13
wai-quantum studio · browser (studio.test.mjs)	Studio	H	110 of 111. The same job on main (ea2a6defd), run there, is also 110 of 111, with a different check failing. The train changes nothing the failing check exercises. CI runs this job on linux, where main passes
advisories: self-test, then every lockfile (check-advisories.py)	Studio	d2ae29c52	pass. No lockfile changed after it
repo checks (tests in CI, workflow concurrency, spec refs, section refs, vanity, public-text self-test, comparative prose, orphan sources, lockfiles)	local	head	all exit 0
public names: the 519 changed text files under wai/, the 286 commit messages, this body	local	head	clean
wfsteps.py HEAD origin/main <every merged head> and a YAML parse of every workflow	local	head	every workflow parses; 20 step bodies differ from every source, each intended (below)

Flakes that main has too

joule-moq-relay's age_rising::a_rating_that_rises_ends_what_waits_at_the_relay fails now and then with "groups that waited at the relay when the rise was held were sent no more: [0, …, 9]". The train does not change that test.

• Train's head: 18 of 20 runs pass on the Framework.
• main: 17 of 20 runs pass, with the same message.

The workflow steps that match no single source

wfsteps.py HEAD origin/main <every merged head> reports 22 steps whose bodies match no source's. Each one is a union or a fix the train made on purpose:

• wai-conformance.yml independent-verifiers, 16 steps. The first step builds #477's union once, and now also the four corpus programs and test targets the train's steps need. Fifteen train steps run on $WAI_FEATURES and those built tools instead of feature lists of their own: determinism cost, sink energy, key release, stitched presentation, prior forms, scene carriage, faces from keypoints, receipt ledger, stream audit, native sink, platform-encode, remote desktop, stream termination, live worlds and header probes.
• wai-conformance.yml features-alone, 1 step: main's lists and every train PR's lists, live_messaging among them.
• wai-ops-gpu.yml checks, 1 step: main's splat_exact line and #448's avatar_face line in one run block.
• wai-pack.yml legs, 1 step: #465's test-count floors and #484's --test=encode_rung 3.
• wai-web-wasm.yml wasm32, 1 step: wai-web's native test count, 36 (see A count #463 left behind).
• wai-ledger.yml service-linux, 1 step: the smoke checks, which first require the Python 3.11 the job now sets up (CI's first run, 2).
• wai-sink-android.yml android-macos, 1 step: the AAR check, reading the listing whole (CI's first run, 3).

No step is duplicated or lacks a run/uses, and every workflow parses (ruby YAML).

Open items

• #458 stays out (above).
• #460's follow-ups, not made here:
  • its hop table belongs in energy-measurement;
  • §9.1 should cite §6.3, now that #438's section is on main.
• #484's rungs inside the package. #484 keeps its AVC and HEVC rendition beside the package, because listing those rungs in the stage index, catalogs and CMAF belongs on the several-floor packer of #465. With #465 now on main, moving them in is a follow-up.
• The reach package of record is still 248846f1's. Moving it to a commit with this train's registry is the site's step (build-wasm-pkg.sh, then WAI_REACH_RECORD=1). Until then the record leg lists the newer capabilities instead of holding them against the package.
• age_rising flakes on main and here alike (above).
• The quantum studio's browser test is one check short on the Studio's macOS on main and here alike. CI runs it on linux.
• Framework-only gaps:
  • no z3, for joule-code-remediate's formal tier;
  • no pip for independent's Ed25519 step;
  • no Node, so those steps ran on the Studio.
• The public-name check's scope. 18 lines in joule-moq-ingest (whip.rs, whep.rs, tests/common/mod.rs) and joule-moq-web.yml match the denylist. They are the same lines on main, and they sit outside the check's wai/ scope.

🤖 Generated with Claude Code

WAI merge train E: twenty-five open PRs merged onto `main` by `git merge --no-ff`, one merge commit each, every conflict resolved with both sides kept, the generated files regenerated, and the one open item settled (#475's upstream links held to #483's connection window). What the merged tree exposed is fixed in commits of their own, each with its test: two pairs of room modes the service accepted together, a race in the page's SUBSCRIBE, a test count #463 left behind, and the five failures of this PR's first CI run (*CI's first run*, below). Branch `train/wai-e`. Base: `origin/main`, with `main` merged in seven more times as it moved: #465, #486 and #485; then #477; then #492; then #494; then #495; then #497; then #498. The head is current with `main` at `f1a34c06`. ## What it holds, and the SHA merged | order | PR | head merged | what | |---|---|---|---| | 0 | #465 | `ad283d92` | the packaging train (merged first; see *Order* below). It has since landed on `main`, so the train's second merge of `main` brought only its merge commit | | 1 | #440 | `069b551c` | `wai-ops/1-npu` on a neural processor (G2) | | 1 | #445 | `6064a35c` | scene and prior carriage (B2) | | 1 | #446 | `da3c09c5` | JPEG XS, MV-HEVC, the projection descriptor, IEEE 1857.11, format probes, CMSD read, LOC carriage (B3r) | | 1 | #448 | `9804962c` | `wai.avatar.face` (AVTR) | | 1 | #453 | `4863036d` | what exactness costs (DET1) | | 1 | #467 | `986edfea` | int_hyper's narrow kernels (PERF1) | | 2 | #457 | `2a99c78f` | ended with a receipt (EN-B) | | 2 | #460 | `df8c7f49` | sink energy (EN-A) | | 2 | #463 | `13964c94`, **replayed** | the energy order of dispatch, the self-metered relay (EN-C); see *How #463 was merged* | | 3 | #470 | `4623548d` | stitched presentation (RI2) | | 3 | #473 | `9cea6b5c` | the receipt ledger (RI3; contains #470) | | 3 | #471 | `e60c7dbe` | key release (RI5) | | 3 | #474 | `d56916da` | the audit kit (RI1) | | 3 | #480 | `05fb22cc` | the native sink, its C interface and the Swift package (SDK-A; contains #474) | | 3 | #488 | `cf93ad7a` | the native sink as a Kotlin library over the C interface (SDK-B; stacked on #480). It was added to the train after the later merges were made, so it is merged at the head, after #484; it changes nothing they change but #480's CHANGELOG entry, where its bullet sits | | 4 | #475 | `43c87c8c` | relay cascading | | 5 | #479 | `c90c4d54` | Enhanced RTMP v2 ingest and SCTE 104 (ING-B) | | 5 | #483 | `b54dc94c` | SRT and RIST contribution ingest (ING-A) | | 6 | #481 | `54589208` | remote desktop (CX2) | | 6 | #482 | `6745bf6c` | live worlds (CX1) | | 6 | #484 | `b41b566b` | AVC and HEVC through platform encoders (ENC) | | 6 | #489 | `d1e8965f` | remote desktop rooms in the room service (CX2b; stacked on #481), merged after #482, #484 and #488 | | 6 | #490 | `e8c747ec` | sealed input in remote rooms (stacked on #489), merged right after #489 | | 7 | #493 | `01f3aac1` | conversations and calls on live rooms (`wai.live.message`, `wai.live.call`), merged last | | 7 | #480 | `59bfbbfd`, its next head | the Swift tests on a device: the corpus read from the test bundle, and a test host application (only `wai/wai-sink-swift/`), merged on top after #493 | | 7 | #480 | **`850eeefe`, its head now** | the simulator tests hosted in that application, on a fresh simulator, every step with a hard limit (`wai/wai-sink-swift/` and `wai-sink-swift.yml`), merged on top of `59bfbbfd` | Left out: **#458** (below). ## Order - **#465 first, not before #484.** #463's head carries #452's original history, which #465 replaces with a squash; and #484's in-package rungs need #465. With #465 first, every later PR meets the packaging tree it meets on `main`, and #463 merges as the "re-merge main after pack-stack" its own notes planned. #465 then landed on `main` while the train was being built; the later merge of `main` is clean. - **#488, #489, #490 and #493** were added to the train after its other merges were made, so each is merged at the head, in that order (#493 last, as asked). #480's later heads came after #493: `59bfbbfd` is merged on top of it, then `850eeefe` on top of that (a fast-forward of the same branch, so the train holds #480 at `850eeefe`). They touch only `wai/wai-sink-swift/` and its workflow. #488 changes nothing the later merges change but #480's CHANGELOG entry; #489 and #490 come after #481 and #482, as asked. The [remote]+[world] refusal (below) was made after #489 and before #490 arrived; #490 merged over it cleanly. ## How #463 was merged #463's head contains #452's commits, and with them #438's first research note (`docs/research/wai-cross-fabric.md`), which names fleet hosts and their addresses. #465 replaced that history with one squash precisely so that the note never enters `main`'s history. Merging #463's head would have brought it back. So #463's own commits are replayed with `cherry-pick -x` onto the train's #465 merge (branch `traine/enc-replay`), and that branch is merged as #463's merge commit: - #452's platform-decode commits, which the review's split gave to EN-C and #465 left out: `6ad92e2e8`, `8695bc75f`, `fed8694f4`; - EN-C's fourteen: `df5ea962f` `11b255682` `ff069acc2` `244a715b3` `2a8d45aa0` `a203eae23` `9b6e4bada` `1ffceb508` `6c03ba72c` `ce38948da` `1ca593124` `507f4cd9e` `c95337739` `13964c944`. #463's three merge commits (of `main`, and of #452) are not replayed: their conflict resolutions (SPEC §7.1 step 2, the CHANGELOG) are what the later commits reach anyway. **Checked:** - The replay's tree equals, file for file, a three-way merge of #463's head onto the replay's platform-decode commits, with #452's head merged into `main` `1a465f23` as the base. The two exceptions are the files that merge conflicts on: `int_kernels_vectors.rs` (#465's `wgsl-conformance` line and EN-C's `platform-decode-conformance` line, both kept), and the CHANGELOG. - Its CHANGELOG is #465's, with #463's energy-honesty entry exactly. - No fleet address appears in any replayed commit, and `docs/research/wai-cross-fabric.md` is not in the tree. ## Conflicts, and how each was resolved Every conflict below kept both sides. A conflict here was almost always two additions at one place. - **The CHANGELOG** (every PR). Each PR's entry goes on top as it merges, so the train's entries read newest first in merge order reversed, above `main`'s. - #480's merge had a criss-cross base whose CHANGELOG held nested markers. Its result is the train's CHANGELOG with #480's one new entry on top; no other entry of #480's differs from the train's. - #467's entry merged cleanly above #453's, and #488's bullet sits in #480's entry. - **SPEC §5, REGISTRY.md, the registry tables** (`codecs/mod.rs`, `codecs/registry.rs`, `glossary_check.rs`), **`lib.rs` modules, Cargo `[features]`, `[[bin]]` and `[[test]]`, the live-conformance README, workflow `paths:` and steps.** These are unions. - `codecs/mod.rs`: `main`'s gain-map, ST 2094-50 and DRED strings sit beside #445's tensor-file priors, #446's projection descriptor, JPEG XS, MV-HEVC and IEEE 1857.11, and #448's face generator. This holds in every class list, the companion-only and video-companion rules, the one-file parameter sets, the ops members and the registry tests' expected lists. - `WireKind::all()` is now **17**. #445 (glTF extension) and #446 (telemetry key) each raised it from 15 to 16, so neither side compiled after the merge. - REGISTRY.md's sentence listing the extensions with wire names names every side's extensions and kinds. - **determinism-tiers §5/§6** (#440, #448 against #465's rewrite): - #465's GPU paragraph; - #448's avatar sentence; - #440's NPU bullet; - §6 rows for the GPU, the NPU and the avatar; - the cross-architecture paragraph keeps #465's forge-run sentence and adds #440's. - **The room page and its e2e** (#457, #481, #482 with `main`'s co-watch and origin): - `app.js` imports and snapshot fields from both sides; - `room.e2e.mjs` keeps every scenario (`ageco`, `cowatch`, `origin`, `termination`, `remote`, `world`, `privateworld`) in the default list, the `--only` usage and the runner's table, plus both sides' imports (`writeWav`, `rawBrowser`, `spawn`); - `lib.mjs` keeps `writeWav` and `rawBrowser`; - `run.sh` runs all the page's module tests (`cowatch`, `remote`, `markup`, `endpoint`, `termination`); - wai-live-web's `wai` features are `stream_termination` and `live_world` both. - **wai-ops-gpu.yml** (#448 with `main`'s DRED and splat). #448's build line goes into the build step's run block. Placed after `main`'s DRED step instead, it would have broken the YAML. - **wai-pack** (#484 with #465): - Cargo.toml: #484's `platform_encode` and #465's optional `wai-pack-gpu`; - `lib.rs`: the module account; - packaging §7.5: #465's device and driver, then #484's encoded rendition; - the test-count floor: #484's `--test=encode_rung 3` beside #465's counts. - **live-metering §8 and the relay's `metering.rs`** (#463 with #475): the self-metered relay and the hop links, in one text. - **joule-code-conformance.yml** (#463 with #479): #463's `moq-relay-energy` job, and #479's account of the ingest job. - **joule-moq-ingest** (#479 with #483). Both ingests are kept whole on one set of types: - `frame.rs`: - one `Codec` with HEVC, VVC, AAC and FLAC (`ALL` is nine); - #479's `WEBRTC` and `Option`-returning `to_str0m`, and #483's `webrtc()` and `aac_header`; - one `Header`, whose audio rate is #479's `rate` (#483's `samplerate` is renamed at its uses); - `unframe` keeps #483's whole-ADTS check. - `package.rs`, one packager: - HEVC and VVC take an RTMP track's hint, and from a transport stream (no hint) the header or a default; - AAC's first header is its ADTS header where there is no hint, the hint's otherwise. - `catalog.rs`: #479's entry carries its layer name, and #483's `contrib.rs` now names one. - `config.rs`, `gateway.rs` (routes, fields, methods, listeners, `srt_task`, shutdown), `rtc.rs`, `lib.rs`, the example config, the README and live-ingest's header, status table and test account: both sides. - `tests/common`: `watch_kinds` → `watch_layers` (#479) → `watch_tracks` (#483), one subscriber. `Watched.layer` is the track name where it is a number. `tests/ertmp.rs` imports `common::rtmp::adts` by name, since `common` now has #483's `adts` too. - **#477** (landed on `main` mid-train). Its independent-verifiers job builds wai-rs once per feature list. The train had added fifteen steps there, each with a feature list of its own, and each switch between a list and #477's union rebuilds the library and relinks every test. They now follow #477's rule: - `WAI_FEATURES` gains the fifteen steps' features (`WAI_RELEASE_FEATURES` gains `avatar_face`). - None of them, nor what they imply, is tested for by its absence. The only `cfg(not(feature))` gates are `pq_signatures`, `neural_int`, `staged` and the integer media features, already in or out of the union as before. - The first step builds and copies the four corpus programs those steps ran with `cargo run`, and builds their test targets. - `features-alone` checks each of the train's lists alone. - The termination step's wai-live-web tests reuse the browser sink step's `int_video` build. ## Changes the merges forced, each its own commit - **`include/wai.h`**, regenerated by `build.rs`. #467's head already left a build dirty: its new public `int_kernels::Isa` reaches the C surface, which adds an opaque typedef. Rebuilt with no features and with the HTTP falsify shards' features, the header stays unchanged. - **Lockfiles**: `check-lockfiles.sh` found three stale; each was refreshed with `cargo metadata` (resolve only). - `joule-moq-remote` (#481) now resolves #475's relay dependencies, `tokio-rustls` 0.26.6 and `rustls-native-certs`. - `wai-key-proxy` (#471) and `wai-ledger` (#473) now resolve `main`'s `wai-quantum` 0.6.15. - `joule-moq-remote` again after `main`'s #492, which moved every other lock to zstd 0.14.3 for its advisories. - **Two corpora the PRs left uncovered.** These tests fail on #446's and #484's own heads: - `every_decoded_output_states_a_sha256` gains entries for `format-probe-conformance` (#446) and `encode-conformance` (#484). Neither corpus decodes a payload. - `encode-conformance`'s README gains the `**Provenance.**` line that `tests/corpus_provenance.rs` requires. ## The open item: #475's upstream links and #483's connection window The relay's links to its upstreams set no receive windows: - native QUIC built a transport configuration of its own; - WebTransport used quinn's defaults. On both, the connection-level window was unbounded. One transport configuration (`server::transport_config`) now serves the listener and both kinds of link, and `webtransport::connect_draft_tls_with` takes it. `tests/upstream_window.rs` puts an upstream of the test's own on each transport. It opens 16 data streams before its SETUP, which the relay parks after each header, and writes until flow control stops it. - **With the fix:** it stalls at the 2 MiB connection window (QUIC 2,097,152 bytes; WebTransport 2,088,960). - **Falsified, committed first** (`git apply -R`, then targeted edits, each restored through git): | mutation | quic | webtransport | |---|---|---| | the fix reverted | FAILED, 19,988,480 bytes | FAILED, 19,988,480 bytes | | QUIC link's connection window unbounded | FAILED, 16 MiB | ok | | WebTransport link's connection window unbounded | ok | FAILED, 16 MiB | | restored | ok | ok | - **Repeated:** 15 of 15 runs pass. ## The late additions: #488, #489, #490, #493 - **#488** merged cleanly. - **#489.** Its corpus replaces #481's: six of #481's vectors move from refusal to acceptance, and three are appended. Neither PR is on `main`, so #489's version is taken whole. Conflicts: - joule-moq-room's `wai` features take #482's `live_world` and #489's `remote_desktop`; - joule-moq-web.yml's scenario account and `room.e2e.mjs`'s usage: `remote` runs by default when both the host agent and the room service are given. - **#490.** Its corpus is #489's 42 vectors unchanged, then 10 sealed ones, and is taken whole. Conflicts: - `telemetry_aggregate` now sits on the new `hpke` feature, beside #446's `format_probe`. Every build with `telemetry_aggregate` or `remote_desktop` gets `hpke` through the feature, #477's union among them; - the remote desktop step keeps #477's union and #490's `hpke::` test filter; - joule-moq-room's README. - **#493**, merged last. Conflicts: - joule-moq-room's modules, `Config` and `Service` fields, the epoch (`remote::epoch`) with the conversation and calls opened beside it, the refusals of #482 and #493, and the README; - `app.js`: a remote room's grant request, and #493's given grant; - `run.sh`, which runs `room.e2e.mjs` (with `--remote`) and `messaging.e2e.mjs`, each with its own `--only`; - the workflows: `live_messaging` joins #477's union and the first step's test build; - wai-live-web's features; `lib.rs`, `registry.rs` and REGISTRY.md; - `capabilities.json` and `v2.ttl`, regenerated. ### Modes a room service cannot keep together Each refusal below is its own commit, with a test, and falsified. - **`[remote]` with `[world]`** (once #482 and #489 were both in): `remote::service` refuses the pair when the configuration is read. - Test: `a_remote_room_is_not_also_a_world_room`. - Rule removed: the test exits 101; restored, it passes. - **`[messaging]` or `[call]` with `[world]` or `[remote]`** (#493). `settings()` refused a conversation beside a watch room, co-performance, admission by age, `[room] e2ee` or a call, and a call beside the first three. It accepted either beside a shared world or a remote desktop room. Both refusals now count those two modes. - Test: `a_conversation_or_a_call_is_not_also_a_world_or_a_remote_room`. - Each new term removed: the test exits 101; restored, it passes. - **features-alone** checks `live_messaging` alone, under #477's rule. ### A verifier the train's tree caught `claim-conformance/differential.py --random 2000 --seed 1` drew `31135_session_roles_companion_wai.meta.projection` on the train's registry: wai-rs accepted it and `claim_verify.py` refused it (`session_layer_not_applicable`). - **Cause:** #446 taught wai-rs that the projection descriptor applies to a video rendition (SPEC §7.1 rule 2, as the train's SPEC states it). It did not teach `staged_verify.py`'s `_companion_applies_to`, the independent reading that `claim_verify.py` and `http_verify.py` share. - **Fix:** the Python rule now names `wai.meta.projection` with the HDR descriptors. - **Check:** the differential agrees again; it is the falsification, failing before the fix and passing after. ### A race the train's Studio run caught The full browser run on the Studio failed one check of #482's `world` scenario: > dave catches up after alice left: … SUBSCRIBE: no answer in 10000 ms The other 336 checks passed. - **Cause.** A page asks the relay for a 10 s rendezvous on each world and room track, and it waited 10 s for the answer. - With no publisher, the relay answers when the rendezvous ends (§9.20.6), so the page's timer and the relay's raced. - #482's own run saw the relay win, and `world.js` follows a departed actor on that refusal. Under the Studio's load the page's timer won, so the refusal was never read. - The merge did not cause it: the relay's rendezvous wait and the page's timeout are the same in #482 alone. The outcome depends on load. - **Fix** (`joule-moq-web: a SUBSCRIBE that asks for a rendezvous waits past it for the relay's answer`). `request()` takes how long to wait for its answer, and `subscribe()` waits a step past the rendezvous it asks for. Nothing else waits on that error. - **Test.** `web/moq/session.test.mjs` uses a transport and a codec of its own, with the clock mocked. It runs in `run.sh`'s page-module step, so the e2e job runs it: - a SUBSCRIBE with a rendezvous takes the relay's refusal 10.5 s in; - it gives up 20 s in; - a SUBSCRIBE without a rendezvous gives up at 10 s. - **Falsified.** With `session.js`'s change reverted, the first two cases fail, the first with the e2e's own error. Restored, all three pass. ### A count #463 left behind `wai-web-wasm.yml` requires wai-web's native unit tests to report exactly `35 passed`. #463 added `world::tests::the_pages_figure_is_sealed_as_an_estimator` and left the count at 35. #463's own run of that job was cancelled, so this never showed. On the train's tree the Studio read `36 passed` and the step failed. - **Fix** (its own commit): the count is 36, and the step's comment names the test. - **Check:** the step passes on the head (below). ## CI's first run: five failures, each fixed The first run, on `5b79d155`, had 115 checks green and 5 failed. Each failure is fixed in its own commit, tested where its job runs, and falsified: 1. **`wai-neural-gates`, model-free refusals.** `several_file_capabilities_need_the_set_form` met #446's `wai.image.ieee1857_11` and got "no model registered" instead of `form_required`. - Both sides are right. The capability is NeuralFloat, so its set is several files. It is a candidate, which a sink treats as unsupported (SPEC §5), so it is never dispatched. - The test's premise was "every several-file capability the reference sink dispatches". It now says so with `codecs::is_dispatchable`, and checks that a several-file capability it does not dispatch is a candidate the sink refuses to decode. - Framework: the whole job passes. With the new branch removed, the test fails as CI did. 2. **`wai-ledger`, service · linux.** `smoke.sh` ends with `receipt_ledger_verify.py`, which imports `pack_verify.py` and so needs `tomllib`; the runner image's Python is 3.10. - The job now sets up Python 3.11, as `wai-key-proxy`'s does, and the step fails first with an `::error::` if its `python3` has no `tomllib`. - Run on the Framework in the runner's own image, `catthehacker/ubuntu:act-22.04`: with the image's Python, the early error; with 3.11 first on the path, every check holds, the independent verifier among them. 3. **`wai-sink-android`, macos.** "the AAR has no jni/arm64-v8a/libwai.so", though the native step built all three ABIs and Gradle packed them. - Cause: under `pipefail`, `unzip -l | grep -q` fails whenever `grep` stops at its first match before `unzip` has finished writing (SIGPIPE). On the AAR the Studio built, that pipeline fails 7 times in 300; with the listing read first, 0 in 300. The toolchain, the NDK and the targets were all found. - The AAR check now reads the listing once and prints it on a failure. `build-native.sh` now reads `nm` and `readelf` output whole: the same race there could report an export or a `NEEDED` entry missing, or let a misaligned LOAD segment through. - Studio: the whole job passes, 12 emulator tests. Each rewritten check still catches its fault, shown with crafted inputs. 4. **`wai-web-reach`, the package of record.** Every build on the record leg (shipped, L1, L2, J) failed its `menu` workload. The fallback path did not regress. - The record is built from `248846f1`. The registry the workload reads is this tree's, and it gains #446's candidate `wai.image.ieee1857_11`, which that package does not know, so the package's `isCandidate` disagreed with the registry. - A package cannot emit or dispatch a capability it does not register. The workload now compares candidates for the capabilities the package registers, and lists the rest as `newer`. - The tree's build registers every capability of the registry it is exported from, so on the tree leg `newer` is empty and nothing is let through. Moving the package of record itself is the site's step, and is not made here. - Studio, the record leg on current Node: all 11 builds equal the manifest, and run-modern gives 40 PASS lines. With the workload as it was, it fails exactly as CI did. 5. **`joule-moq-web` e2e, privateworld.** "carol replays the world from its start: not within 120000 ms". This was a real catch-up race, not load and not a timeout. - A member's carry for an epoch is published once, when it applies the commit. The commit that adds a page follows its join, and the clock records the join when the page's world track appears. - The page published first and followed the actors' tracks after. A carry sent before its subscription was answered never reached it, and no wait would bring it. - Fix: in a private world, a publishing page now reads the room's log to its present end (`E2ee.readToEnd`), follows every actor it records, waits for each subscription's answer (`WorldClient.followActors`), and only then publishes. - live-worlds §8.2 now says a member that enters SHOULD do this. The e2e checks that carol followed both members before she published. - Studio: with the fix's call removed, the scenario fails at once ("bob receives alice's carry", the second member). Restored, `privateworld` passes twice in a row, and the whole run passes: room 342 of 342, messaging and call 17 of 17, page tests 74. The merge of `main`'s #498 moved `wai-quantum` to 0.6.16. The locks of three train crates, `wai-audit` (#474), `wai-key-proxy` (#471) and `wai-ledger` (#473), are refreshed by resolution only, one version line each. On the final head, `joule-moq-room` (33 tests), the generated files, and `wai-web-wasm` (engine 13, native 36) pass, with all 53 lockfiles current. ## Left out: #458 #458 (delivery bindings, head `aca6c347`) was to come in only if its four failing checks were real failures that a small, clearly right change in the train could fix. They are not. Its job logs on the forge show: | check | what failed | whose | |---|---|---| | repository checks | the advisories step: RUSTSEC-2026-0385 and -0387 in seven lockfiles | `main`'s at #458's base, since cleared there (the train's advisories pass). #458 changes none of those locks | | macOS energy backends | `jouleclaw-loader-gguf` does not compile under `-D warnings` (a deprecated quick-xml method) | `main`'s at the time. #458 does not touch the crate | | cargo-class corpora, linux-arm64 | `cli_http::origin_refuses_an_oversized_head` read an empty answer instead of 431 | a test of the HTTP origin, which #458 does not change | | joule-code-rs, linux-arm64 | `sealed_objects::a_changed_identity_is_refused_at_the_door_over_quic`: "group 1's object is refused at the door, the others pass" | #458's own: its secure-objects change to the relay's door | The only failure that is #458's sits in the relay's door and session code, which #475 rewrites in this train. Fixing it is a change to #458's design, not a small one. Three more reasons point the same way: - #458's body asks that it not be merged without the owner's review. - The forge reports it unmergeable with `main`. - Its CMSD reading overlaps #446's. It stays open as it is. ## Generated files - **Registry export:** `capabilities.json`, `capabilities.schema.json`, `v2.ttl`, `v2.shapes.ttl` and REGISTRY.md's table. - Regenerated with `wai registry export` at every merge that touched the registry, and committed in that merge. - At the head, `registry export --check` reports it up to date. - **`include/wai.h`:** regenerated by `build.rs` (see above). At the head, it is unchanged after a build with no features and after a build with the HTTP falsify shards' features. - **Lockfiles:** four refreshed with `cargo metadata` (resolve only): `joule-moq-remote` twice (#475's relay dependencies; then #492's zstd), `wai-key-proxy` and `wai-ledger`. `scripts/check-lockfiles.sh` reports 53 lockfiles, all current. - **Corpora:** none regenerated by the train. - No corpus file is changed by two PRs that do not contain one another. - The stacked ones (#473 over #470, #480 over #474, #490 over #489 over #481) take the later PR's corpus whole. - Every corpus regenerates byte for byte: the cargo-class corpus step checks it at the head, and each verifier step checks its own (see *Checks*). - **Prefix check** against `main`, for the shared corpora the train changes (`train-prefix.py`, not committed): - `live-conformance/browser/vectors.json`: every list of `main`'s is an unchanged prefix of the train's (routes 11, constraints 23, bindings 15, frame_tiers 24, frames 13, tables 10), and `choices` (14) is new. - `http-conformance/cases.json`: #463 edits five of `main`'s cases in place (an explicit `order`, a png-only case's skips) and inserts two (`select_O2_default`, `fetch_O2_default`). Its energy order changes what `select` and `fetch` pick by default, and that corpus states no append-only rule. This is #463's own change, as reviewed in #463, not a merge's. ## Checks Hosts: - **Framework box:** Linux x86_64, Zen 5 with AVX-512, and the NPU of PCI 0x1022:0x17f0. - Each job ran through `wfrun.py`, which runs a workflow job's `run:` steps as the runner would: env, working directory, shell, `$GITHUB_PATH`/`$GITHUB_ENV`. It skips `uses:` steps and the steps that install a toolchain or a system package. - Each workspace builds in its own target directory, as each CI checkout does. One shared directory let one workspace's `wai` stand in for another's and failed builds that CI never sees. - **Studio:** macOS arm64, the CI host. Each row's tree: - **H** is the first CI run's head, `5b79d1550`, or `3a3bbfc16`. `3a3bbfc16` differs from it only by `main`'s #497 (wai-quantum, quantum-studio and wai-web's quantum engine). The checks of the fixes since, on `8ab46dfb0` and the head `f004aa4f9`, are under *CI's first run*. - **E** is `de7fe1b91`: before #480's last head, the test-count fix, #495 and #497. - **B** is `63cf067e3`: #493 and the refusals in, before `main`'s #492. - **A** is the tree before #490 and #493, which touch none of the code those jobs build. | Check | Host | Tree | Result | |---|---|---|---| | `wai-conformance` cargo-classes (linux leg), all 20 steps | Framework | H | pass: 2,422 tests | | `wai-conformance` features-alone (every list, `live_messaging` among them; wai-live-web without `int_video`) | Framework | H | pass | | `wai-conformance` int-kernels-amd (every x86_64 kernel set, both profiles) | Framework | H | pass: 1,182 tests | | registry export `--check`; `include/wai.h` after builds; `check-lockfiles.sh` | Framework | H | pass; unchanged; 53 current | | `joule-moq-room`, every target (`messaging_room`, `call_room`, `remote_room`, `world_room` among them) | Framework | H | pass: 33 tests | | the two refusals' falsification: each new term removed, then restored | Framework | H | 101 with each removed; 0 restored | | `joule-moq-remote`, every target, and clippy `-D warnings` (linux leg) | Framework | H | pass: 20 tests | | `joule-code-conformance` moq-ingest (with and without `rist`, the corpora) and moq-relay | Framework | H | pass: 221 and 131 tests | | `standards-build` joule-code-rs: `cargo check --workspace --all-targets`, `cargo test --workspace` | Framework | H | pass: 673 tests on the second run. The first stopped at `age_rising`, a flake `main` has too (below) | | `joule-code-conformance` conformance | Framework | H | pass but for `joule-code-remediate`'s two formal-tier tests. The job installs z3 with `sudo apt-get`, which this shared box does not run, so they fail with "JOULE_FIX_EXPECT_Z3=1, but there is no working z3". The workspace run above passes them, since it does not require z3 | | `wai-pack` legs (linux: clippy, release tests, the test-count floors, the corpus recomputed) | Framework | H | pass: 107 tests | | `wai-conformance` independent verifiers (#477's union with the train's features), all 67 steps | Framework | B | 63 pass: 720 cargo tests, every Python verifier and mutation, both differential builds, 0 differ. The four steps that end in a page module's `node --test` ran on the Studio (next row) | | the same job's build step and its four `node` steps (28, 29, 54, 55) | Studio | E | pass: the union build, then 5, 6, 7 and 16 page tests and the Rust and Python halves | | `wai-conformance` vocab-shapes (RDF tools at the workflow's versions, in a venv) | Framework | B | pass | | `wai-conformance` byte-exact (linux), c2pa-emitter, quantum and avatar-face under wasip2; `wai-ops` native, wasip2, checker; `wai-http` cache-conformance; `wai-ops-gpu` checks; `wai-ops-npu` checks | Framework | A | pass | | `wai-ops-npu` npu-hw, on the device, required | Framework | A | pass: 14 tests, and every report line the step requires (devices as declared, requantisation, corpus `mismatches=0 errors=0`, 12 of 12 mutants killed, width) | | `wai-audit` collector-linux, `wai-key-proxy` proxy-linux, `wai-ledger` service-linux (with their clippy lines); `wai-pack` independent, licences | Framework | A | pass (`independent`'s pip step aside) | | `joule-moq-web` browser e2e: the whole `run.sh`, every room scenario and `messaging.e2e.mjs` | Studio | E | pass: room 341 of 341 checks (remote 34, service 29, co 29, e2ee 23, world 14, privateworld 8, termination 16, origin 15, cowatch 12, age 14, ageco 9 among them), messaging and call 17 of 17. The page modules' 74 tests, `session.test.mjs` among them | | the same, before the rendezvous fix | Studio | `d2ae29c52` | 336 of 337: world's "dave catches up after alice left" (see *A race the train's Studio run caught*) | | `wai-sink-swift` package-macos: every slice, desktop tests, both simulators hosted in TestHost, device slices | Studio | H (#480 at `850eeefe`) | pass: 8 tests on the desktop, 8 on the phone simulator, 8 on the television simulator; device builds succeed | | `wai-conformance` codec-wrappers (the VideoToolbox platform encode among them) | Studio | E | pass: platform encode 5 tests | | `joule-moq-remote` macos leg; `wai-ledger` service-macos; `wai-audit` kit-macos; `joule-code-conformance` moq-relay-energy | Studio | E | pass (relay energy: 3 tests) | | `wai-ops-gpu` metal (the probe, the corpus at both widths, the mutants, on the GPU) | Studio | E | pass | | `wai-sink-android` android-macos: the ABIs, the AAR, instrumented tests in a headless emulator | Studio | E | pass: 12 run, 0 failed | | `wai-sink-android` JVM unit tests (the `jvm-linux-arm64` job, run on macOS here) | Studio | E | 15 run, 0 failed. Its build step's export check reads ELF symbols (`nm -D`), which a macOS dylib does not have. `nm -gU` shows all 16 `Java_wai_sink_WaiNative_*` symbols and `JNI_OnLoad` exported. CI runs the job on linux-arm64 | | `wai-conformance` delivery telemetry differential | Studio | E | pass: 21 observations, 16 reports, 3 CMSD fields | | `wai-web-wasm` wasm32, every step | Studio | `5b79d1550`, and again at `f004aa4f9` | pass: native 36, engine 11; then engine 13 | | `wai-quantum` studio · browser (`studio.test.mjs`) | Studio | H | 110 of 111. The same job on `main` (`ea2a6defd`), run there, is also 110 of 111, with a different check failing. The train changes nothing the failing check exercises. CI runs this job on `linux`, where `main` passes | | advisories: self-test, then every lockfile (`check-advisories.py`) | Studio | `d2ae29c52` | pass. No lockfile changed after it | | repo checks (tests in CI, workflow concurrency, spec refs, section refs, vanity, public-text self-test, comparative prose, orphan sources, lockfiles) | local | head | all exit 0 | | public names: the 519 changed text files under `wai/`, the 286 commit messages, this body | local | head | clean | | `wfsteps.py HEAD origin/main <every merged head>` and a YAML parse of every workflow | local | head | every workflow parses; 20 step bodies differ from every source, each intended (below) | ### Flakes that `main` has too `joule-moq-relay`'s `age_rising::a_rating_that_rises_ends_what_waits_at_the_relay` fails now and then with "groups that waited at the relay when the rise was held were sent no more: [0, …, 9]". The train does not change that test. - **Train's head:** 18 of 20 runs pass on the Framework. - **`main`:** 17 of 20 runs pass, with the same message. ### The workflow steps that match no single source `wfsteps.py HEAD origin/main <every merged head>` reports 22 steps whose bodies match no source's. Each one is a union or a fix the train made on purpose: - **`wai-conformance.yml` independent-verifiers, 16 steps.** The first step builds #477's union once, and now also the four corpus programs and test targets the train's steps need. Fifteen train steps run on `$WAI_FEATURES` and those built tools instead of feature lists of their own: determinism cost, sink energy, key release, stitched presentation, prior forms, scene carriage, faces from keypoints, receipt ledger, stream audit, native sink, platform-encode, remote desktop, stream termination, live worlds and header probes. - **`wai-conformance.yml` features-alone, 1 step:** `main`'s lists and every train PR's lists, `live_messaging` among them. - **`wai-ops-gpu.yml` checks, 1 step:** `main`'s `splat_exact` line and #448's `avatar_face` line in one run block. - **`wai-pack.yml` legs, 1 step:** #465's test-count floors and #484's `--test=encode_rung 3`. - **`wai-web-wasm.yml` wasm32, 1 step:** wai-web's native test count, 36 (see *A count #463 left behind*). - **`wai-ledger.yml` service-linux, 1 step:** the smoke checks, which first require the Python 3.11 the job now sets up (*CI's first run*, 2). - **`wai-sink-android.yml` android-macos, 1 step:** the AAR check, reading the listing whole (*CI's first run*, 3). No step is duplicated or lacks a `run`/`uses`, and every workflow parses (ruby YAML). ## Open items - **#458** stays out (above). - **#460's follow-ups**, not made here: - its hop table belongs in energy-measurement; - §9.1 should cite §6.3, now that #438's section is on `main`. - **#484's rungs inside the package.** #484 keeps its AVC and HEVC rendition beside the package, because listing those rungs in the stage index, catalogs and CMAF belongs on the several-floor packer of #465. With #465 now on `main`, moving them in is a follow-up. - **The reach package of record** is still `248846f1`'s. Moving it to a commit with this train's registry is the site's step (`build-wasm-pkg.sh`, then `WAI_REACH_RECORD=1`). Until then the record leg lists the newer capabilities instead of holding them against the package. - **`age_rising`** flakes on `main` and here alike (above). - **The quantum studio's browser test** is one check short on the Studio's macOS on `main` and here alike. CI runs it on `linux`. - **Framework-only gaps:** - no z3, for `joule-code-remediate`'s formal tier; - no pip for `independent`'s Ed25519 step; - no Node, so those steps ran on the Studio. - **The public-name check's scope.** 18 lines in `joule-moq-ingest` (`whip.rs`, `whep.rs`, `tests/common/mod.rs`) and `joule-moq-web.yml` match the denylist. They are the same lines on `main`, and they sit outside the check's `wai/` scope. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 286 commits 2026-10-26 17:15:44 -04:00

wai-ops-npu: wai-ops/1-npu on a neural processor's compute core, exact on every subset vector ... e1da73a18c

A new crate, wai/wai-ops-npu, with no dependency but wai-ops. Its kernel runs
on one compute core of a tile array, built at run time with the array's open
toolchain; its host side is compiled against the device runtime and loaded.
The interpreter runs each graph through wai_ops::run_with and asks the core for
every arithmetic operator's outputs: conv and conv_transpose as multiply-
accumulate lines (8- and 16-bit operands into 32-bit accumulator lanes, 32-bit
operands into 64-bit lanes, the width the certificate's mac record allows),
rescale, chscale and mul through the unit's shift-round step under the mode
that is the operator's rounding, the elementwise operators, and lut16 a table
block at a time. Movement, policies, checks and state stay the interpreter's.

The unit's shift-round step is exact for shifts 0..59 only: it takes 60..63 as
a left shift by 64 - s (measured), so those shifts go through the core's scalar
unit in 64-bit arithmetic.

Tests: the corpus (every graph vector in the subset, against the committed
results and the interpreter), the rounding, saturation, lane and
requantisation probes, twelve kernel edits the corpus must catch, and the
graphs outside the subset by acc32 alone, which are not exact here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ops-conformance: npu.jsonl, each graph vector's place in wai-ops/1-npu ... cb1515d96d

One line per graph vector of vectors/ and graphs/ whose graph loads, with the
npu, npu_flags and npu_reasons of its graph's own verdict (§8.5): the vectors an
operator implementation of the accelerator subset must reproduce, and the
features each exercises. The generator (wai-verify vectors gen) writes it, so
vectors verify requires its bytes; the independent checker computes it from
its own bounds pass and requires the same bytes. 733 of the 1635 graph vectors
that load are in the subset.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops-npu: the bench, CI, and the corpus held to npu.jsonl ... d7425f89a2

- ops-npu-bench: time and energy of the corpus and of an int_synth graph on
  the device and on the CPU, every device result compared with the
  interpreter's first; the package's energy counter (a vendor counter) and the
  device runtime's own estimate (a model), each named as what it is.
- wai-ops-npu.yml: on the linux-amd runner, the probes, the corpus, the twelve
  kernel edits and the width test on the device, with the device declared and
  required; on linux-arm64, the crate builds and an absent device is SKIPPED
  without WAI_OPS_NPU_REQUIRE and a failure with it.
- The corpus test requires the vectors it runs to be exactly those npu.jsonl
  lists in the subset.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

integer-operators §9.5 and §14.5: wai-ops/1-npu on a neural processor, measured ... de9a6a10d2

- §9.5: how wai/wai-ops-npu runs the subset; the unit's arithmetic as
  measured (which of its rounding modes is which rounding of §2 and at which
  shifts, its shifts of 60 to 63, its saturation and its accumulator lanes);
  the results by neural processor; time and energy with each reading's class;
  and, per operator, what the Web Neural Network API's Candidate
  Recommendation Draft of 21 October 2026 allows exactly, and why not
  through its convolution, matrix and quantize operators.
- §14.5: npu.jsonl, the subset's vectors.
- determinism-tiers §5 and §6: the device run; no decoder runs its graphs on
  a neural processor yet, so the tier is not claimed for a decode there.
- SPEC, CHANGELOG, the corpus README with the command that runs it by hand.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-verify vectors verify: recompute only the files of vectors/, stage/ and graphs/ ... af8479a7c8

npu.jsonl is a .jsonl file that is not a vector file; step 4 already checks it
as the generator writes it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops-npu: clippy's notes ... 6265e74262

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: tensor files as prior forms — safetensors, GGUF and the NNC subset, the integer-quantised profile, and their corpus (work in progress) ... 89e14b949e

prior-carriage §9 to §14 and Appendix A: wai.prior.safetensors and
wai.prior.gguf registered as prior forms and listed as established exact;
the integer-quantised profile wai-int/1 with the bindings wsr1/1 and
whm1/1; the digest rule (a canonical file per form); the NNC reader and
writer for the subset an open implementation of the 2024 edition reads
(integer tensors under the context-adaptive arithmetic coding, raw
floats), with where it stops. wai-rs: prior_wire (feature prior_wire),
the corpus generator wai_prior_forms_vectors and tests/prior_wire.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

integer-operators §9.5: the CR's sections cited as such, and the work counted in the core's units ... 08f4d23146

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: prior-forms corpus — README, independent Python verifier, and the NNC subset measured against an open implementation ... d7037c7c7b

prior_forms_verify.py implements prior-carriage §9 to §12 and Appendix A
from the text (strict readers, canonical writers, the arithmetic coder both
ways, both bindings) and agrees with wai-rs on every vector; it also flips
bytes of every accepted file and requires each copy to be caught.

§12.4 records the measurement: an open implementation of ISO/IEC 15938-17
reads our NNC files to the same integers, its encoder writes byte-identical
data units, and our reader reads its bitstreams. tools/nnc_interop_check.py
is the check; it runs that implementation's code and is not a CI step.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: scene carriage — WAI worlds, audio scenes and timed media onto ISO/IEC 23090-14 scene description and a USD layer, both ways (work in progress) ... 6daafc502c

wai-rs scene_map (feature scene_map): a bundle (a WWLD world, a WSCN audio
scene, timed media items by content hash) exported as a glTF 2.0 document
with MPEG_media, MPEG_buffer_circular, MPEG_accessor_timed,
MPEG_audio_spatial and MPEG_texture_video, and as a USDA layer of the USD
Core Specification v1.0.1 (prims, translate ops, time samples, asset
references by urn:wai:asset), each carrying the bundle's bytes exactly;
imports read a WAI-written document back to the same bundle (refused
unless re-exporting gives the same bytes) and a foreign one to new WAI
bytes, refused where a value would not carry exactly. Corpus generator
wai_scene_vectors and tests/scene_map.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: scene-carriage text, corpus README and independent Python verifier ... a1ecded5a2

extensions/scene-carriage.md: the bundle, the numbers that cross the
mapping, the glTF document (MPEG_media, MPEG_buffer_circular,
MPEG_accessor_timed, MPEG_audio_spatial, MPEG_texture_video) and the USD
layer each direction writes and reads, the refusals and the corpus.
scene_verify.py implements it from the text and agrees with wai-rs on
every vector; it also flips bytes of every exported document and
requires each copy to be caught.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: format_probe — header probes for JPEG XS, H.265 with MV-HEVC, H.266, LCEVC, MHAS, AVS3, the IEEE 1857.11 header and the projection descriptor ... 1f5cfe4068

Each probe identifies a payload as its capability's format and reads the
parameters its headers state, or refuses it with one of thirteen codes
(extensions/format-probes.md §12). Pure integer code over bytes, feature
format_probe, no new dependency. The corpus module generates and checks
format-probe-conformance/; wai_format_probe probes a file, generates the
corpus and verifies it, with the fetched LCEVC streams.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.image.jxs, wai.video.jxs, wai.video.mvhevc, wai.meta.projection and the candidate wai.image.ieee1857_11 ... f2a44c6570

JPEG XS (image and video, StandardDefined on ISO/IEC 21122-4's strict
conformance point, which the registration requires of a sink), MV-HEVC
(StandardDefined on H.265 (V11) §F.13.5.1), the WPJ1 projection
descriptor (a companion, as the HDR descriptors are) and IEEE 1857.11
(a candidate: its text is not openly readable and its reference software
writes no start code). SPEC §5 and §7, the registry export, the glossary
links and the research registry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: extensions format-probes and projection; the corpus format-probe-conformance with its second implementation ... 7d61c2f8f1

External vectors written by permissively licensed encoders at pinned
revisions from synthetic pictures (tools/make_external.sh, provenance.json),
generated vectors and negative controls, the facts each encoder was asked
for, the LCEVC streams fetch.sh fetches by digest, and
format_probe_verify.py, written from the two texts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register the tensor-file prior forms and the mapping identifiers; SPEC §5, CHANGELOG and CI steps ... 4845a3eb6a

wai.prior.safetensors and wai.prior.gguf join SPEC §5's prior-artifact
table (lossless, royalty-free, StandardDefined, established exact); the
NNC row says what the reference now reads. Wire identifiers wai-int/1,
wsr1/1, whm1/1 (prior-carriage §10), wai-scene/1 and urn:wai:asset:
(scene-carriage §2). A §5 paragraph states scene carriage. The registry
export is regenerated. wai-conformance.yml runs both modules' tests and
both independent verifiers, and fires on edits of the two extension
texts. Clippy notes on the new code fixed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: CMSD — a reader for CMSD-Static and CMSD-Dynamic, the custom keys registered as wire identifiers ... 51fda19882

delivery-telemetry §6.6 reads a CMSD field back into the description
§6.1 to §6.3 write, passing over other senders' keys, and refuses with
cmsd_malformed, cmsd_type or cmsd_version; §10 lists the extension's
CMCD and CMSD custom keys in full, and the registry lists each as a wire
identifier of the new kind telemetry-key (and WPJ1, the projection
descriptor's magic). telemetry-conformance/cmsd-read/ holds the fields
and their outcomes; cmsd_read_verify.py is the second implementation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scene corpus: a world at the edges of §3's numbers ... 6ccdecd8db

Positions where JSON and USD switch to exponent form, binary32 and
binary64 ties in both directions, the least step and the largest value,
so a verifier that spells or rounds one of them otherwise fails.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scene corpus: a transform operation the layer's order does not list is refused too ... 6064a35c82

Co-Authored-By: Claude Opus 5.5 <[email protected]>

LOC carriage: WAI envelopes on LOC objects, a writer and reader in joule-moq, the corpus live-conformance/loc ... cbf58297e2

extensions/loc-carriage.md maps an envelope whose payload is one WebCodecs
chunk (an Opus packet, an AVC or HEVC access unit in Annex B, an ADTS
frame) onto one object of a track of packaging loc (draft-ietf-moq-loc-04):
the payload as the LOC Payload, the manifest as the Immutable Property
WAI_MANIFEST (0x3A61), the receipt commitment as WAI_RECEIPT. A reader
rebuilds the envelope byte for byte and checks the receipt against it,
refusing with the extension's codes. joule-moq's loc module writes and
reads; its example writes the corpus and tests/loc_vectors.rs checks it;
loc_verify.py is the second implementation. WAI_MANIFEST is registered as
a wire identifier; moq-streaming-format §6 points to the carriage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

format-probes: cite moq-streaming-format §6 for WAI defining no transport ... 0457436807

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CI: the header probes, CMSD reading and LOC carriage; the changelog ... 3ee1318540

wai-conformance: the probe unit tests on every leg and the feature built
alone and for wasm32; a step running tests/format_probe.rs, the fetched
LCEVC streams under wai_format_probe and format_probe_verify.py; steps for
cmsd_read_verify.py and loc_verify.py; the new extensions in its paths.
joule-code-conformance: the LOC corpus and the H.265 vector it reads in
its paths. SPEC cites format-probes by its headed section.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

format_probe: clippy-clean (iterators over the VPS extension's loops, no long argument list) ... d4c8634b4f

Co-Authored-By: Claude Opus 5.5 <[email protected]>

LOC corpus: the second-layer vector appends an SPS of layer 1, so only the base-layer rule refuses it ... 278f3e166d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge train/wai-2026-10-22 (the age, direction and takedown steps' bodies) into wai/registrations-b3r ... 1dc408c0fb

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.avatar.face: an integer talking-head generator, its records and its verification (avatar_face) ... 46e081ab8f

Registers wai.avatar.face (GenerativeDeterministic, ops face-int/1, one-file parameter set):
the WFG1 generator, WFI1 identity prior and WFK1 keypoint segment readers and writers; the
driver's integer warp and keypoint maps; the lowering face-int/1 to one wai-ops/1-i32 graph,
with the same arithmetic written out loop by loop for the tests; the identity and track
records; verification over them and synthesis's claims, log and label policy; the corpus
generator (bin wai_avatar_face_vectors) and the corpus and GPU tests. Registry export
regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

avatar-face corpus, its second implementation, and the tool that trained its generator ... 66054c9486

live-conformance/avatar-face: the generator trained on faces the tool draws, two held-out
identity priors and their tracks, the training report, the seeded generator and identity, and
vectors.json (forms, frames, cases). avatar_face_verify.py runs the driver and the generator's
arithmetic in Python's integers, verifies records and synthesis, and mutates the corpus.
tools/wai_avatar_face_train.py renders the faces, trains, quantises and measures.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

avatars §6 to §13: faces from keypoints, its profile, records, verification, measurement and mappings ... f6755b7e97

The extension text of wai.avatar.face, its SPEC §3.1, §5 and §7 entries, the determinism-tiers
fabric and evidence rows, and the changelog.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CI: the face generator's corpus, its second implementation, wasm32-wasip2 and Metal legs ... be3f8427f5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

format-probe-conformance: README with the corpus's provenance, licences and what was measured ... da3c09c5a1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops-npu: the package energy counter is an OnChipCounter, not HwShunt ... 069b551c85

The powercap package-0 counter is an on-chip vendor counter, so its class is
OnChipCounter (energy-measurement §2), with the whole package as its scope.
HwShunt is the legacy class, accepted when read and never emitted (§2.6).
Corrected in integer-operators §9.5, the CHANGELOG entry and the bench's
documentation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

avatar-face corpus: the mask's table pinned by its digest and entries ... 950ae477d1

A frame rarely reads the table at 0, so the frames alone did not catch a table without §7.6's
clamp (the second implementation passed with it). The corpus now states the table's SHA-256 and
its entries at nine values, and both implementations check them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/avatar-telepresence 9804962c0b

wai: stream termination and the display match — spec, wai-rs module, corpus ... 678ff66720

stream-termination.md registers wai.live.termination: a sink's signed
stream log (WSL1) with an open record (autoplay setting, termination
policy, display declaration, ladder), a receipt per segment (the
rendition's match against the panel, each hop's joules with its class),
observations (visibility, occlusion, display power, interaction) and a
termination with its reason, media time and totals per hop and class.
capability-constraints §4 adds the display declaration, the match and
the admissible renditions, and wai:transfer to the register.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the stream-termination verifier in Python; the register gains wai:transfer ... 12fad91a8b

stream_termination_verify.py is the corpus's second implementation,
written from the two extensions' text; it agrees with wai-rs on every
match and log and requires every mutated copy to fail. The browser
sink's register follows capability-constraints §3.1, and a test holds
the two to each other.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: tools to measure what exactness costs int_hyper against its float model ... 26136c0324

wai_determinism_cost.py selects the pinned reference set's self-test
pictures, exports mbt2018_mean at all eight published qualities to integer
sets (each checkpoint pinned by SHA-256), codes every picture with both
codecs, decodes the float streams on any device, and computes distortion,
BD-rate and the record's summary. wai_det_energy.py times a decoder child
in rounds and reads its counters around them (per-task CPU energy and the
GPU rail on macOS, package energy on Linux), with idle brackets.
wai_det_cost (wai-rs bin, neural_int; ops_gpu for a GPU) decodes WIH1
payloads through int_payload::decode_int, and serves timed rounds.
wai_determinism_cost_verify.py recomputes the record's summary from its
readings and checks every figure the text quotes from it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stream termination in the page and wai-live-web; the e2e scenario ... d4215a6670

wai-live-web gains StreamLog (records written by wai-rs's writer), the
panel match, the log verifier and the corpus check for a page, and
wai_live_web termination-verify for the host. The room page keeps a
stream log for each track it receives (web/room/termination.js): the
panel it declares, segment receipts with the match, the observations of
visibility, occlusion and interaction, and a signed termination when a
video stream has been unseen for its grace; the subscription is then
ended and the audio kept, and a new log opens when the page is seen.
The e2e scenario drives the receiving page over the DevTools protocol
so its tab really goes to the background.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/energy-waste ... 390fd11d50

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: its lock names wai-quantum 0.6.14, the version in the tree ... 9534f01735

The lock still named 0.6.12 after wai-quantum moved to 0.6.14, so every
--locked build of the room service refused to start (its CI job, and
joule-moq-web's end-to-end run, which builds it). Resolve-only refresh.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a stream's records begin with its open record ... 46664e6ea1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the determinism-cost runs, and the record's summary of divergent float decodes ... 89cc4bfdfe

The per-host scripts that took the readings (build host, two x86_64
hosts) go beside the record, with how each platform is tagged. The
summary gains the integer decodes' total across platforms and the PSNR
change of float decodes whose entropy decode diverged, in both the tool
and its independent verifier; per-decode energy is stated in joules.
wai_det_energy reads each accelerator client's GPU time per registry
node. The conformance workflow's independent-verifiers job checks the
record, the texts quoting it, and the decoder bin.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wip: sink-energy spec, module, readers, table procedure, corpus generator ... 1962f2020d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wip: corpus generated ... 821a72aec0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: termination corpus — display records both ways, a repeated observation, a rendition kept above a shrunk panel ... ea745e32f3

Two mutations of the reference survived the corpus: ignoring a display
record's declaration, and restarting a signal's grace at a repeated
observation. Each now changes a log's outcome.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: what exactness costs int_hyper, measured; determinism-tiers §7 states what WAI claims ... ed33fbbaf7

research/determinism-cost.md and its record (record.json): mbt2018_mean at
all eight published qualities, integer export against the model's own
float codec, on the pinned reference set's 24 self-test pictures. BD-rate
by PSNR and MS-SSIM per picture; each codec's decodes repeated across nine
integer and seven float platforms and compared byte for byte, the float
ones placed in or after the entropy decode; decode time and energy with
counter, scope, idle brackets, liveness and ratio over seven rounds.

determinism-tiers §7.1 quotes the record, each figure tied to its place in
it by a marker the verifier checks; §7.2 says what WAI claims and does not,
and makes normative that a record figure is never stated beyond what the
record names, that no receipt takes its energy from it, and that a cost
figure in the spec names its measurement. SPEC §5's int_hyper row points
to §7. CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai_determinism_cost_verify: a round's energy is used only where its brackets were live ... bd0cc305a4

energy-measurement §3.1's liveness rule (two advances in a row, five or
more, four in five, over 300 ms) for the busy bracket and both idle
brackets, recomputed from the bracket facts the record keeps, as the tool
that writes the record applies it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the termination verifier remembers each signature it checked ... c2a73e791f

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a test that no segment starts before the last one ends ... bce5e01a9c

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.live.termination and its magic WSL1; the export regenerated ... 7e5cab3079

cbindgen skips the module, whose record constants are not part of the C
surface, so include/wai.h is unchanged by a build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stream termination — SPEC §5, CHANGELOG, conformance READMEs, CI steps ... b7b1aee791

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai_det_cost: no unreachable code without ops_gpu, and one name for a decode's outcome ... f58c5bf8f5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai_determinism_cost_verify: integrate each knot interval exactly, and hold the record to 1e-9 ... f39da2f860

Two-point Gauss-Legendre on each knot interval's share of the common
range is exact for the cubic the interpolant carries there, so the
verifier's BD-rates agree with the tool's analytic integral to float
precision, and a one-unit change in one picture's SSE no longer falls
inside the tolerance.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wip: registry, SPEC, CHANGELOG, CI jobs, reader tests, settle and generic machine description ... f68b4025ee

Co-Authored-By: Claude Opus 5.5 <[email protected]>

det_cost_bin: a refusal line must carry its code exactly ... 4863036d8a

The test compared a refusal line by prefix, so a decoder reporting
`bad_magicx` for `bad_magic` passed; found by falsifying it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: stream_termination clippy-clean ... 68977d1f28

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a segment ends at a gap; a stream ended as idle reopens on the viewer's return ... 56ef56f133

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink_meter: no dead-code notes off macOS ... 4dc3b43040

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the refresh rate a page measures, stated exactly; wording ... f7d55b28a5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai_sink_table: 2 s clips, so completions outnumber the workers in a window ... 1a2d52c533

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: registry export, corpus cases for the rules no vector reached ... 938f16a1f3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (b1681667) into wai/energy-waste ... 2a99c78fd5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: the measured decode tables of the macOS and the 32-core Linux reference sinks ... 761876d385

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/energy-sink-metering a286780d8b

sink-energy: one vocabulary with the per-fabric record; a hop is restated only for its sole user ... f4bfb5dd3b

The sink profiles name the fabrics a reading covers (cpu, gpu, media, neural) and how it is
the sink's: task, the operating system's account of the sink's own processes, or bracket,
the marginal over an idle bracket on a shared counter. No counter is divided among its users
by their busy time; a hop's figure is restated in a session's split only where the session
was its sole user, at least 99% of its busy time, and is otherwise absent as hop_shared.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: corpus regenerated under the sole-user hop rule ... c596ecd14d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: the 32-core Linux sink's table re-taken under the fabric vocabulary; fabrics a shape rule ... dba2c13b93

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: the session's split is the stream log's hop table ... fe7038d956

The session receipt carries hop entries by the roles a stream log's hop entries use
(1 origin, 2 relay, 3 sink decode, 4 display): a figure with its own class, the unmetered
marker with its reason where the sink knows the hop took place and has no figure, and no
entry where the sink states nothing. A segment receipt is the sink-decode hop's figure for
its segment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: a display declaration is held to its ranges with or without a display entry ... 54488c9db8

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: clippy notes in the new files resolved ... 9a88ae45c1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: npu, and no bracket attribution: a shared counter's figure is the whole decode's ... 4e1644725d

Settled with the per-fabric record: the fabric term is npu; task is the operating system's
account of the sink's own processes; rail is a sole user's whole rail. A counter every user
shares gives the sink no attribution: its figure is the bracket over the whole decode, not a
fabric's share, and like a Partial figure it carries no division by fabric.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink_energy_verify.py: the measured tables are required ... 3d79462a09

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy corpus: another key's table sealed ModelBased is refused ... b4da2ed71d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: corpus regenerated with the case ... 85e7363577

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai_sink_table: the bracket reader as functions (no behaviour change) ... 56ee1469d2

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy §5: a segment receipt is the sink-decode hop's figure for its segment ... b3f4b48fb7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: narrow integer kernels on NEON, AVX2 and AVX-512, the same integers ... 5f7ca8ca8d

The integer decoders' convolutions spent their time in 32x32->64-bit
multiply-accumulates, portable Rust on x86_64. A kernel set (Isa) now
selects narrow kernels where the processor runs them: 16-bit operands
(an input past 2^15 - 1 split into two 15-bit limbs), 32-bit partial sums
over blocks of taps sized so no partial sum leaves i32, then 64-bit sums
(vpmaddwd / vpdpwssd on x86_64 with two channels per word, smlal on
aarch64). The inverse GDN's norms run in 64-bit SIMD lanes on x86_64
(vpmuldq, an exact product, then the floor shift), the NEON ones fuse the
shift and the add at gf = 16, and each integer root is seeded from the
IEEE-754 square root and corrected in integers. The wide kernels stay, as
Isa::Wide, and run wherever a narrow plan does not apply.

int_ops lends the interpreter rescale, clamp, relu and leaky on the
workers, and requantises in i64 where every value fits (else in the
interpreter's i128). max|x| is read in parallel, once per inverse GDN.

The equivalence tests run every kernel set the processor runs: random
geometry against the exact sums written out, the block edges, the limb
edges, the seeded root, the i64 requantisation and the element-wise
operators against the interpreter.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the decoder tests run every kernel set, and the ops corpus runs through the fast kernels ... 67ac8c544b

Each decoder-level equivalence test now runs int_kernels::equivalence_policies:
the reference, the fast kernels on every tiling, and each kernel set the
processor runs. tests/int_ops_conformance.rs decodes every graph vector of
ops-conformance/ (vectors/ and graphs/) through the interpreter with the
fast kernels behind it, under each of those policies, and holds every
decode to the integers or refusal the vector states.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the NEON narrow kernel's one safe-looking intrinsic call is in an unsafe block ... 97b725d02e

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: narrow passes keep their taps cache-resident, and AVX-512 forms the inverse GDN's outputs in lanes ... d74fcc6559

The narrow kernels now take a block of at most 128 taps outermost and sweep
the whole row under it, so one block's weights and the input lines its
taps read stay in the first-level cache. On AVX-512 (now F, BW and DQ) the
inverse GDN's roots are seeded from the IEEE-754 square root, corrected
and held to s^2 <= n < (s+1)^2 in lanes, and (x * s) >> frac is vpmullq,
exact for |x| < 2^31; a step that fails the check is left to the scalar
form. The weights' largest magnitude is read in parallel too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sink-energy: the measured decode table of the 20-core Linux reference sink ... bdf83bf5a2

Taken by wai_sink_table on the host once it had been idle for a minute: the package
counter live, every row a figure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/energy-sink-metering ... df8c7f493f

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: the fast-kernel tests run the ops corpus, and every x86_64 kernel set on the AVX-512 host ... 2bce0addaa

The kernel steps of wai-conformance run tests/int_ops_conformance.rs on
each leg. A new job on the linux-amd host runs the same tests in both
profiles there, whose processor runs every x86_64 kernel set, AVX-512
among them, which no other leg's does; the host declares its sets, and
the_kernel_sets_found_are_the_declared_ones fails where the sets found
differ, so a missing set is a failure and not a skip.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the int_hyper decode on the narrow kernel sets, measured; determinism-tiers §7 quotes it ... 61759c51b5

research/determinism-cost.md §4.6, in the same record and by the same
procedure: the 192 payloads decoded again on every platform with every
kernel set it runs (15 new runs, 0 decodes differing from the record's),
and the record's time and energy runs repeated in one session per host
beside the record's own build and the float decoder. On x86_64 host A the
integer decode on the narrow kernels took 144.8 ms and 12.43 J of marginal
package energy at quality 6 against 210.7 ms and 14.03 J for the float
decode beside it (the record's build: 728.0 ms, 92.14 J). On the build
host its own CPU energy fell from 11.01 J to 6.43 J at quality 6 and is
still above the float decode's 1.28 J by that count. Host B's integer
decode was measured before and after, without a float decode beside it.
The scripts that took the readings are in runs/; decode-throughput.md
notes the new sets; the changelog records the change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the seeded root's correction is tested from seeds a correct square root never gives ... c061fbb0f4

A correctly rounded square root seeds every u64 within one of its root, so
the correction steps that undo a wrong seed ran in no test; removing the
upward one passed them all. The root is now formed from any seed by
isqrt_from, and the test seeds it up to a thousand below and above the
root, and with the largest seed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the SIMD inverse-GDN norms are tested norm by norm, and the random tests stay in Rng's range ... 777dd239f4

Falsifying the NEON fused-shift kernel (one lane's ssra made a rounding
shift) passed every test: a norm a unit off seldom moves its integer root,
so the output tests could not see it. the_simd_norms_are_the_scalar_norms
holds each SIMD form of the norms (NEON at any gf and fused at 16, AVX2
with non-negative and signed gamma, AVX-512) to the scalar sum before any
root is taken. The requantisation and element-wise tests drew magnitudes
past Rng::signed's 2^62, which overflowed with overflow checks on; they
now draw within it and list the ends of i64 instead.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the narrow kernels' own clippy notes, cleared ... aa7a8aca33

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the narrow kernels' files are named by path, and the model checker runs the wide kernels ... 986edfea33

wai-verify and byte-exact-conformance include int_kernels.rs by `path`,
and a file included that way resolves its own `mod narrow;` beside it, so
wai-verify's native build failed (file not found for module `narrow`).
Both submodules now carry their `path`, relative to int_kernels.rs, which
holds in either build. Under `cfg(kani)` the narrow sets are left out:
no processor-feature probe, no SIMD, the wide kernels and the integer
root, as the IGDN harness checked them before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stream audit, wai.delivery.audit (spec, reference, corpus) ... 519c968e84

A content owner's evidence from the players of a stream another service
delivers over HTTP. settlement §14 acknowledges such objects by plain
SHA-256 from an upstream named by its origin. stream-audit defines the
session key and channel, the acknowledgement windows and chains, the
WAS1 session record (spans presented, start time and stalls recomputed
from the delivery-telemetry log, energy per role with its class, how the
session ended), WPC1 claims for marked ads under the channel, the bundle
a collector verifies, and the channel report it signs and any holder of
the bundles recomputes. No price, tariff or amount.

wai-rs module stream_audit (feature stream_audit), the generator
wai_stream_audit_vectors, tests/stream_audit.rs, and the corpus
live-conformance/audit/.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: receipt ledger — the tariff, the invoice and its verifier (wai.delivery.ledger) ... a0a5e0e605

extensions/receipt-ledger.md: a tariff (WLT1) a seller and a buyer both sign,
pricing every unit WAI's records state in one currency (a room session's units,
acknowledged bytes by object class, a package's packages, entries and stored
bytes, counted ad impressions) with the scope of rooms, parties, packagers and
deciders it bills; sources verified by their own extensions; an invoice (WLI1)
whose lines cite their records, whose energy is per scope and per class with
its largest declared uncertainty, chained so no record is billed twice; and the
ad and delivery reports.

wai-rs: the receipt_ledger module (feature receipt_ledger), its corpus
generator and wai_receipt_ledger_vectors; live-conformance/ledger/ and
receipt_ledger_verify.py, the second implementation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: key release, the proxy form of wai.video.keys (extensions/key-release.md) ... eec5d8dfa0

The scheme (cenc, cbc1, cens, cbcs; the HLS methods AES-128, SAMPLE-AES,
AES-256-GCM) and the key delivery (HLS key URI, Clear Key, a content protection
system by its system ID) of each released key; the commitment list WKL1 derived
from a CPIX document, so the proxy copies each key_commit and holds no key; the
entitlement WKE1 bound to a device key and the device's proof over each request;
the release decision as a pure function of signed inputs (freshness, replay, key
periods, offline licences and renewals); the release ticket WKT1 for a clear
delivery, so the proxy never relays a key; verification of a proxy's log.

The key_release module of wai-rs (feature key_release), its unit tests, and the
corpus live-conformance/keys/, generated from fixed seeds by
wai_key_release_vectors and checked by tests/key_release.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stream audit's independent verifier, and three more controls ... 9030200054

live-conformance/stream_audit_verify.py, written from the extension's
text: it reads acknowledgements with settlement_verify.py, claims with
ad_presentation_verify.py and logs and energy classes with
live_metering_verify.py, recomputes every report, gives every vector the
corpus's outcome, requires 15 mutated copies to fail and catches each of
its 31 checks dropped. Dropping three of them first went uncaught (an
item that is not a whole object, a chain's first acknowledgement naming
a prev, notes that are not the bound ones); the corpus gains a control
for each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: key_release_verify.py, the key-release corpus's second implementation ... 27d76115e0

Written from extensions/key-release.md, sharing no code with wai-rs: it reads the
scheme, delivery, decision and reason tables from the extension, derives each list
from its CPIX document with the standard library's XML parser, recomputes every
decision of every log, and requires every mutated copy of the corpus to fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stitched presentation — player-signed claims of stitched and interstitial ads, the signed pod-input record, ad frames in live-compose ... c70aedef60

wai.video.stitched_presentation (extensions/stitched-presentation.md): a WPS1 claim names an ad
by the marker the stream carries for it (an EXT-X-DATERANGE tag, an interstitial's asset, a DASH
event) in the manifest it states the SHA-256 of; a WPI1 pod-input record, signed by the
stitcher or a proxy in front of the ad server, binds the response digest, the chosen ads, their
creatives and prices, the avail, the frame and the measurement terms; a verifier recomputes
each ad's presentations, quartiles and the spend that counts by currency. A form-1
wai.video.ssai receipt gains a JSON carriage (its signed bytes unchanged) so it can be a
record's response. live-compose gains the squeeze and double-box ad frames (§5.9). Corpus
live-conformance/stitched/, its independent verifier stitched_presentation_verify.py, and the
browser producer web/ads/stitched.js with tests against the corpus.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ledger: the receipt ledger as a service; registry, SPEC §5, CHANGELOG and CI ... cc087bde44

wai/wai-ledger: tariffs, sources and invoices kept in a directory the service
owns (one process holds its lock; every file written whole; the state read back
and verified again on start); POST /v1/tariffs, /v1/sources, /v1/invoices and
/v1/verify, GET /v1/invoices/{digest} with the invoice's verification document.
Its tests issue the corpus's invoices byte for byte and recover the chain after
a restart; smoke.sh checks it over HTTP, the document checked by
receipt_ledger_verify.py --document.

wai.delivery.ledger registered with WLT1 and WLI1 (registry export
regenerated); unit tests of the module; the CI step beside settlement's and
.github/workflows/wai-ledger.yml.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/receipt-ledger 9af71db3e6

wai-key-proxy: the signing proxy and key server of extensions/key-release.md ... 8428bd120d

A proxy in front of any licence server: it decides each licence request from signed
inputs, appends its signed receipt to a durable single-writer log before it
answers, refuses without forwarding, forwards a granted content protection
system's request and returns the licence unchanged, and answers a clear key with a
307 and a release ticket instead of relaying it. A replay sent while the first
request is still being forwarded waits and is refused after it, so the log stays in
decision order. The key server, run by the key holder, redeems each ticket once.

CLI: serve, keyserver, keygen, pubkey, list (a commitment list from a CPIX
document), entitle, sign-request, verify. tests/end_to_end.rs runs everything on
loopback against a fixture licence server; smoke.sh runs the release binary.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit: the stream audit collector and the player integration ... e04d96eba2

wai/wai-audit is the reference collector of stream-audit §12: it
verifies each bundle a player posts (wai-rs stream_audit), stores the
accepted ones one file per session (a different record of a stored
session is refused audit_session_duplicate), takes Event-mode CMCD
batches as advisory telemetry, and serves each channel's report signed
with its key. Limits per client (an IPv4 address or an IPv6 /64), per
route body limits, CORS for the configured page origins. The CLI also
verifies a bundle, recomputes a report from a data directory, and
checks a served report against its bundles. Its tests post every corpus
session and require the corpus's outcome, and require the stored
sessions to report exactly the corpus's served reports.

web/audit.js is the player integration: it hashes each object with
WebCrypto, signs the acknowledgements, claims and session record with
WebCrypto's Ed25519, computes the settlement tree root with a one-chunk
BLAKE3 of its own, records spans, ads, the log and its CMCD batch. Its
Node tests drive it with the corpus's inputs and require the corpus's
records byte for byte. adapter-tap.js wraps fetch and XMLHttpRequest for
any player; adapter-hlsjs.js wraps a player's loader class.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.video.stitched_presentation; its records take the magics WSI1 and WSC1 ... 9151295ff6

The pod-input record and the claim were first written as WPI1 and WPS1, which co-performance
already defines (§5.1, §7.7); the registry's wire-identifier table showed the collision. They
are WSI1 and WSC1 now, the corpus regenerated. The capability is registered in
codecs/registry.rs with its two wire identifiers, the registry export regenerated, SPEC §5
gains its paragraph, the CHANGELOG its entries, and wai-conformance a step that runs the
module's tests, the corpus through the tool, the independent verifier and the browser
producer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register key release, its CI steps, SPEC §5 and the changelog ... 45d564ace8

The wire identifiers of extensions/key-release.md (WKL1, WKE1, WKT1 and the WAI-Key-*
header fields) in the registry table, and the export regenerated; the wai.video.keys
row of SPEC §5 names its proxy form, and a §5 paragraph describes it; §6.2 states
how a request missing a field is read. CI: the key-release step in the independent
verifiers job (the module's tests, form 1's, tests/key_release.rs and
key_release_verify.py), the extension under the workflow's paths, and the
wai-key-proxy workflow (tests, clippy, the release binary end to end).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stitched presentation — the three clippy notes the slice added ... cc93f4b385

An ad frame's function takes the descriptor's fields it reads (allowed too_many_arguments,
with the reason); the verifier keeps each ad's own claims by index alone; the XML subset's
name reader takes its stop characters as an array.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/ssai-stitched bec0dbd9a0

wai: key release corpus, a grant of a licence never forwarded ... e60c7dbee5

A negative control for §8.4 rule 8's first clause on its own: a granted request of a
content protection system whose receipt records no answer from the licence server.
Falsifying that clause alone had let the corpus pass, the other clauses of the rule
catching each earlier control.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stitched presentation — a verification states each record's ad region and share ... 428d1601dd

A falsification moved a squeeze's side band onto the window's side and the corpus still
verified: the share is the same area, and no fact stated the rectangles. Each accepted record
now states its frame's share and its ad region's rectangles (live-compose §5.9), so wai-rs and
stitched_presentation_verify.py must agree on the region, not only its area; the Python
verifier gains the matching mutation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit: the browser end to end, and what it found ... 4627e02e04

e2e/run.sh builds the collector, installs the automation package and an
open-source web player from e2e/package-lock.json (npm ci, no install
scripts), runs the player integration's unit tests, then
e2e/audit.e2e.mjs: an HLS stream made with the host's media tool (H.264
and AAC in 2 s CMAF segments, a program time, a marked ad over two
segments) served from another origin with CMSD-Static exposed, played in
a real browser twice, once through the loader adapter and once through
the network tap, each session sent to a collector on loopback. It checks
the outcome, the acknowledged objects against the origin's own SHA-256
of what it served, the ad's claim, the CMSD notes, the unmetered energy,
the CMCD batches, the report, its recomputation by `wai-audit check`, a
replay stored once and a tampered record refused.

Three defects it found, fixed here:
- the player hands fragment buffers on (to a worker), emptying them
  after the loader's callback: the session now copies the bytes at once,
  and keeps each object in the order it was given;
- the tap read XMLHttpRequest responses after the player had moved them:
  it now listens from the request's construction, so it reads first;
- a stitched ad is entered between two observations, so its claim began
  past media time 0 and reached quartile 1: play that enters an ad
  continuously now starts its first span at 0 (stream-audit §6.3), as
  leaving it already ran the last span to the ad's end.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: receipt ledger — a scope, price and period control for each source kind ... 76dca14fa5

Falsifying the reference found that no vector refused a package outside the
tariff's scope: a reference that skipped that rule wrote a corpus the second
implementation accepted. The corpus now refuses a delivering party, a packager
and an ad decider outside the scope, a room receipt under other prices, and a
delivering party's statement and an ad break outside the invoice's period.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: stitched-presentation §7.2 step 5 states its refusal plainly ... 4623548d63

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.delivery.audit, its CI, SPEC §5 and the changelog ... 63684391be

The record wai.delivery.audit and the magic WAS1 in REGISTRY.md and the
code registry, the export regenerated; a SPEC §5 paragraph for the
audit, and a sentence on settlement §14 in settlement's; the changelog
entry; the corpus in live-conformance's index; a step in
wai-conformance.yml (the module's tests, tests/stream_audit.rs and
stream_audit_verify.py) with the extension in its paths; and
wai-audit.yml for the collector on Linux and macOS and the player
integration with the browser end to end on the macOS host; the
collector's README.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit: two player-integration tests the falsifications asked for ... 780b0c129f

Of twelve rules of web/audit.js and its adapters broken one at a time,
two first went uncaught by the Node tests: an ad entered between two
observations (the corpus's observations fall on the ad's start, so only
the browser end to end caught it), and a stall begun before the first
presentation counted. A test for each; all twelve now fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit.yml: mark the runner's browser path as a functional identifier ... b7e241ec50

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (96117c570) into wai/audit-kit ... 2a33aaa7e0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs platform_encode: the module's shape, the Annex B reader, the y4m reader and resampler (WIP) ... dadf9eca39

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: an unnamed acknowledgement refused, the collector's port, the stitched form ... f2acb11dd4

- The falsifications found the check that refuses an acknowledgement the
  record does not name guarded by no vector in either implementation:
  the corpus gains ack_not_named (audit_bundle_invalid), and the Python
  verifier can drop that check too, which the corpus now catches.
- The collector's default port moves to 9694: 9690 is the stitched
  presentation tool's.
- stream-audit §6.3 states that this revision claims every marked ad
  with WPC1, and that a stitched ad is claimed with the stitched
  presentation record where a deployment holds it, its bundle then
  carrying the manifests its claims name.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/wai/ssai-stitched' into wai/receipt-ledger ... 38117b4ac4

# Conflicts:
#	wai/CHANGELOG.md

wai: receipt ledger — streams stitched by others, from stitched-presentation's records ... ccaca14181

A stitched source (extensions/stitched-presentation.md, PR #470, which this
branch merges): the stitcher's pod-input records (WSI1) and the players'
claims (WSC1), verified by that extension with the tariff's ad scope as its
signers. Its presentations bill as presented impressions, each line citing the
accepted records and the presented own claims; its report is that extension's
§7.5 statement unchanged, a form-1 receipt's own quartiles and spend beside the
presented ones. The corpus bills two vectors of live-conformance/stitched/ and
refuses a stitched source given twice and a stitcher outside the scope.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: the receipt ledger step reads the stitched corpus too ... 6e973f0dfa

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the native sink core and its C ABI (wai_sink_*) ... c525493213

native_sink (feature native_sink): what a native host's player integration runs for
one playback session. It verifies a media playlist against its playlist receipt and
the chain of its live revisions (http-delivery §8.6), holds a WAI object to the content
hash its name or fragment states and a fragment named by its SHA-256 to that name
(packaging §7.6), and answers per object whether the host may hand it to its decoder.
It signs what stream-audit has a player sign, under a fresh session key: settlement
acknowledgements by plain SHA-256, presentation claims for marked ads, the session
record, and the bundle. And it ends a session nobody can see, or whose viewer has gone
idle.

ffi_sink: the C ABI over it, an opaque wai_sink_t with JSON in and JSON or bytes out,
include/wai.h regenerated. The corpus live-conformance/native-sink/ is written from
fixed seeds over the reference package's floor fragments.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: native-sink, the extension text, its corpus README, and the page's replay ... ebbd647fa1

extensions/native-sink.md: what a native host's sink does for a stream it plays through
its platform's player. Verification (§4): a media playlist against its playlist receipt
and the chain of its live revisions, an object against the content hash its URL states,
the host told per object whether it may hand the bytes to the player. Observations and
the log (§5), the rule that ends a session nobody can see or attends to (§6), the energy
a native host states (§7: the platform's decoder is outside every counter an application
reads, so the sink decode is the unmetered marker there), the reasons (§8), and the C
interface every native integration shares (§9).

The corpus gains a live revision that rebinds an alias, a parent served under another
name, and page-parity: wai-audit/web/native-sink.test.mjs replays it through the page's
integration of stream-audit, which signs the same bundle byte for byte.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: receipt ledger — a stitched shared break whose own claims are not all presented ... 9cea6b5c71

Falsifying the stitched source found that a reference billing every own claim,
presented or not, wrote a corpus both implementations accepted: every own claim
of the billed records was presented. The squeezeback vector's shared break,
three of whose six sessions' claims are presented, is now among the stitched
sources.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit e2e: the collector ends with the run, however it ends ... d56916dac5

A run that failed left the collector it started running, holding the
output of whatever started the script open (the falsification harness
waited on it). It is now killed on the process's exit.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: Enhanced RTMP ingest and SCTE 104 injection, first cut ... 66b7127689

The RTMP handshake and chunk stream, AMF0, FLV legacy and enhanced tag bodies
(ModEx, multitrack), configuration records and the payload of each frame; a
stream key issued under a room grant; SCTE 104 messages translated to SCTE 35
sections and cues, signed with an injection record before each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: native-sink's second implementation, native_sink_verify.py ... f04322095a

A second native sink, from the extension's text: it opens each case's session from its
configuration and seed (the session key derived as RFC 8032 §5.1.5 derives it), reaches
every call's answer by §3 to §7, and holds the bundle the corpus states to what its own
session holds, field by field (acknowledgements and their item lists, claims, the
record, the log and the notes byte for byte), and to the collector's outcome through
stream_audit_verify.py. Playlist receipts and their chain are http_verify.py's. It
catches every one of 17 mutations of the corpus and every one of 17 checks dropped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: Enhanced RTMP end-to-end tests with a publisher of our own ... 28b0449522

Legacy AVC and AAC; enhanced HEVC with composition offsets and Opus; AV1 with FLAC,
VP9 with enhanced AAC, a ModEx nanosecond offset; multitrack layers bound by the
grant's publish profile; stream-key refusals; RTMPS and the reconnect request.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-contrib: SRT and RIST contribution over UDP with retransmission ... aec7d15147

SRT (draft-sharabayko-srt-01): a listener that serves many callers on one
UDP port by socket ID and a caller; the HSv5 caller-listener handshake with
its SYN cookie, HSREQ/HSRSP, the stream ID, key material; live mode with
TSBPD over the negotiated latency, too-late packet drop, ACK/ACKACK and the
RTT estimate, immediate and periodic NAKs, retransmission, and AES-CTR with
the SEK wrapped (RFC 3394) under a PBKDF2-HMAC-SHA1 key.

RIST (VSF TR-06-1:2020, TR-06-2:2024), feature rist: the Simple Profile's RTP
on P and RTCP on P+1, SR/RR/SDES CNAME, range and bitmask requests, SSRC
low-bit retransmissions, the RTT echo; the Main Profile's GRE-over-UDP tunnel
in reduced overhead mode with the VSF EtherType and the legacy one,
keep-alives, and PSK (PBKDF2-HMAC-SHA256 over the nonce, AES-CTR on the GRE
sequence number).

An MPEG-TS demultiplexer and multiplexer, a PCR pacer, an account of every
sequence number's delivery, recovery or drop, an impairing UDP proxy, and
send, receive and bench tools.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: an RTMP publish's tracks, sans IO ... 8001296940

The binding rules, sequence starts and frames of one publish move to rtmp::Tracks,
which the connection feeds and the conformance corpus is generated through.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: SCTE 104 injection end to end ... 41ac1b0ebd

An automation system of our own initialises the injector, keeps it alive, and sends
splice and time-signal requests; each cue is signed when its splice comes, after its
injection record, and reaches a relay subscriber on the principal's events track,
published from the injector's start.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: relay-to-relay cascading (work in progress) ... 8e46e256c5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: cascading tests pass; a loop refused relay_loop at the relay whose links lead back ... 7508e65fd6

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/live-conformance: the injection and E-RTMP corpora, generated through joule-moq-ingest ... c090454438

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs platform_encode: the video acceleration API adapter and the GPU driver's encode interface adapter (WIP) ... f20f8678c4

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: cue-injection, SCTE 104 to SCTE 35 to signed cues, and injection_verify.py ... d694f5356b

The extension text; the corpus's scenarios state the breaks live-ads §4.3 makes,
written by hand; the second implementation, from the text, agrees on every vector.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: SRT and RIST contribution into room tracks, with a signed link record ... fb21a29aa4

A publisher POSTs /srt or /rist under its room grant and proof and gets a
one-time session: for SRT the stream ID and passphrase the gateway's listener
admits (live-ingest §13's mapping, its rejection codes), or the gateway calls
the publisher's listener where call_allow lets it; for RIST a port of its own,
the CNAME its RTCP must give and, in the Main Profile, a PSK passphrase.

The link's transport stream is demultiplexed: the first H.264 or HEVC stream
and the first AAC stream go to the same packagers, groups, catalog and first-hop
receipts as a WHIP session's, one access unit or one ADTS frame an object, the
PTS mapped onto the room clock. WAI capabilities wai.video.hevc and
wai.audio.aac join the gateway's codecs; WHIP and WHEP keep WebRTC's.

Every record interval and at the end, the gateway signs a part of the link's
WCL1 record: each sequence number delivered at the first try, recovered,
dropped or outstanding, its loss runs, requests, retransmissions, RTT and
recovery times, chained part to part and naming the head of each media track's
receipt chain; published with receipts on the owner's link track.

The corpus wai/live-conformance/links/ comes from joule-moq-ingest-link-vectors,
from fixed seeds; tests/link_corpus.rs holds the reader to it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: a room across relays (live-rooms §10.7, jwp-receipts §4.1, live-metering §3.10, co-performance §8, live-recording §8.3); the relay's README, example and changelogs ... d91f040763

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-ingest §12, Enhanced RTMP v2 implemented; ertmp_verify.py ... bc8e80c75e

The stream key, the connection, the binding of tracks to layers, the FourCCs and
their payloads, time, groups, bounds and the reconnect request; §6's cto member; the
reasons. The corpus's second implementation agrees on every object.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: clippy notes of the cascading code and tests ... c80f2d0468

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the Swift package of the native sink, and a log that keeps its order ... 643f86f8d7

wai/wai-sink-swift: the native sink for the platforms whose native player is reached
from Swift. WaiSink wraps the C interface (every call JSON in, JSON out); WaiRelay is the
loopback server the player is given in place of the origin: it fetches each object,
gives the sink a playlist with its receipt and the chain's parents, and answers the
player only with bytes the sink presents (502 otherwise), every URI of a playlist
rewritten to it; WaiPlayerSession drives the platform's player through it, observes it
every 200 ms, logs its first frame, stalls and end, ends a session nobody can see, and
posts the bundle to the owner's collector; WaiViewAttention reads the platform's signals
of who can see the player. scripts/build-xcframework.sh builds WaiFFI.xcframework from
wai-rs. Tests: the corpus through the wrapper, the relay over the reference floor, and
the player end to end over a presentation made with the platform's own encoder.

A native host's player and its requests run on threads of their own, so an object can
reach the sink with a time before the log's last entry. delivery-telemetry §7.1 has a
log's times never decrease and nothing after end or abandon: the sink logs such an entry
at the last entry's time, and takes no entry after end or abandon, while an object
received then is still verified and acknowledged (native-sink §5.2). The corpus gains
log-order, and the second implementation checks both rules.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs platform_encode: the media framework adapter (encode, and its decoder for measurement), the runtime-loaded software AVC adapter, and the encode record (WIP) ... 9fdf325c1b

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a relay path checked where it arrives (relay_loop, relay_hops_exceeded, an unproved relay id, RELAY_PATH not negotiated) ... b1e9dd80d0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: a local encoder as the test client; STREAMINFO-only FLAC; empty coded frames ... 3888cfff74

tests/ertmp_ffmpeg.rs (ignored unless an encoder is present) publishes from a local
encoder through a proxy that holds Publish.Start until the subscriber is in place,
and decodes each track's frames in a conformant decoder: AVC with B-frames and AAC,
HEVC and AVC on the platform's media engine, HEVC with Opus, AV1 with FLAC, VP9 with
Opus. The encoder sends a FLAC sequence start as STREAMINFO alone, and a coded-frames
packet of no bytes at the end: both now read, the latter not carried. The corpus
gains a session for each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a route back to the requester is no loop; the loop test names the relay that refuses ... a7026c3de7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: cascade tests wait for every summary: a session leaves the table before its summary is signed ... 560e5c07ed

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.live.injection; SPEC §5, CHANGELOG, the crate's README; CI ... 1eabee8f24

The registry row and its export; the verifiers' mutation self-tests; a step for both
verifiers in wai-conformance, and joule-code-conformance's path filters for the
corpora and texts its tests read.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs platform_encode: energy counters around rounds of an encode, the wai encode avc|hevc, encoders and encode-record commands, and the measurement tool (WIP) ... 8945d34dac

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.world: the extension text, the wai-rs module and its corpus ... 7d156f67e2

live-worlds.md registers the record wai.live.world: the room authority's
world statement (WLW1), the world track each actor publishes in a room
([room, principal, world], op batches one per group, receipted as a media
track is, receipt alias 4), the grant attribute world = act and the scope
it maps onto at a relay, the clock's lifecycle for an actor, catching up
by FETCH from group 0, private worlds sealed as confidentiality seals a
media track with carries into each epoch, verification and the session
hash, and metering under the room's other tracks.

wai-rs gains the live_world module (feature live_world): the statement,
a participant's incremental copy of the world, the carry, the session
hash and the verifier of section 9; and the corpus
live-conformance/worlds/ written from fixed seeds by
wai_live_world_vectors gen, every refusal of section 9.2 and 3.4 among
its negative controls.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: its lockfile gains tokio-rustls and two edges, nothing else re-resolved ... 43c87c8c07

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: clippy notes cleared ... d3deeefa9a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-contribution: the extension text, its independent verifier, and the reference tools' interop ... 3b8dadc058

wai/extensions/live-contribution.md profiles SRT and RIST onto a room's tracks
through the ingest gateway: the one-time session resource, the listener's
checks and codes, the gateway calling, RIST's port, CNAME and PSK; the
transports as the gateway runs them; the transport stream onto the tracks;
and the link record WCL1, its account, parts and chain, how a part and a
series are verified, the size bound, the refusals, and the RIST texts' patent
notices.

live-conformance/live_contribution_verify.py is written from that text alone,
standard library only, with mutation runs and dropped-check runs. The corpus
gains vectors that isolate each check the verifier found uncovered.

Interop with the reference tools, run locally as test peers (ignored unless
named by environment variables): their SRT caller and listener and RIST sender
and receiver of both profiles against joule-contrib, and their SRT caller and
RIST sender into the gateway with an encoder's H.264, HEVC and AAC, through
lossy paths. Two fixes they found: an SRT recovery margin is held to the
window, and no part is cut before the first sequence number resolves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: a remote desktop in a room — screen statements, input under the control power, the host's outcomes recomputed, the floor, latency records ... bdd4d7d2ae

The extension text (wai/extensions/remote-desktop.md); the remote_desktop module of wai-rs behind
its own feature: the statements WDS1, WDI1, WDO1, WDF1 and WDL1, the grant attributes
remote_host and remote_control, the host's rules of §5.3 (decide), the floor in effect, latency
legs, and the verifier over a room the live-rooms verifier replays. The corpus
live-conformance/remote/ written by wai_remote_desktop_vectors from fixed seeds: a floor session,
an open session whose control passes by grant exchange, a gap, and refused vectors giving every
reason of both tables of §12. Its second implementation, remote_desktop_verify.py, written from
the text and sharing no code with wai-rs, agrees on every vector, fails every mutated copy and
catches each of its 32 checks dropped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: registry entry and export, SPEC §5, CHANGELOG, corpus index and CI step ... 680b3b57d1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.world: the independent verifier, and the text made exact where it read two ways ... 376668c58b

live_worlds_verify.py is the corpus's second implementation, written from
the extension's text and the sections it cites, sharing no code with
wai-rs; it agrees with the reference on every vector.

Writing it found readings the text left open, now closed: a CausalOp's
integers are little-endian and its signature is over the domain then the
preceding bytes (interactive-worlds 5.1); a world track's receipts are a
track's, not interactive-worlds 8's session receipts; the order of the
descriptor, grant and statement checks; the group total is checked; a
private world's first opened object above group 0 starts its chain; the
session hash chains each op with its signature; the outcome lists the
actors whose ops were admitted. The corpus gains a group-total refusal,
and section 12 states which codes it covers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: native sink in CI, the changelog and SPEC §5, the package README and simulator runner ... 77cdcf7f93

wai-conformance.yml runs the native sink's module tests, tests/native_sink.rs and
native_sink_verify.py; wai-audit.yml has the page replay the native sink corpus's
page-parity case; wai-sink-swift.yml builds every slice of the package's binary target
and runs the package's tests on the desktop and in the phone and television simulators,
and builds the device slices. scripts/test-simulator.sh builds the test bundle for a
simulator and runs it there through simctl; on a host whose simulator service is older
than its Xcode's, it says so and fails, since a run that did not happen is not a pass.
The simulator slice of the phone SDK holds both architectures. packaging is cited by its
section heading. The corpus is listed in live-conformance/README.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room, joule-moq-relay: rooms that keep a shared world ... a5c2b0a981

The room service's [world] configuration: each room's authority signs its
world statement, served with the room; a publisher's grant is an actor's
(the attribute world = act, no media); the clock watches each actor's
world track and signs its join when it appears and its leave when it
ends, with no publish; with e2ee the world is private, every actor a
member of the room's group. relay-lines prints the world door and the
window that keeps the room's world tracks, commented. A world room is not
also a watch room, a room with co-performance or one admitted by age.

The relay maps a grant whose attribute world is act onto PUBLISH of
[R, P, world] (live-worlds 5.2): its own world track and nothing else. A
three-line change in auth.rs, with a unit test.

joule-moq-web's signer can sign objects that are not WAI envelopes
(setEnvelope(false)): a world track's op batches carry no envelope flag.

tests/world_room.rs: two actors publish through a relay that holds world
tracks to their owners' keys, the clock records them, a late actor
fetches both tracks from group 0 and its copy, every receipt and op
checked by wai-rs, holds the actors' session hash; a viewer publishes no
world track, an actor no other's and no media; the door drops a group
receipted by another key; a departed actor's track is still fetched; and
a private world room keys its actors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: a latency record's source 3, a viewer with no display ... cb5389c3fb

An agent that reads the screen, or a test harness, states the instant it held the frame verified
against its receipt; no photon is involved, and the record measures the path to the viewer alone.
wai-rs and remote_desktop_verify.py read source 1 to 3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: examples/ingest_energy, a relay and a gateway as two processes ... feff9d71b2

What a per-process energy reader (energy-measurement §9.2, macos-task) reads one hop
of: fixed seeds, loopback listeners, a stream key per line of input.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/wai/audit-kit (d56916dac) into wai/sdk-native-apple ... 78a05d9ccd

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-live-web: a room's world for a page ... 0134e422ce

worldStatement checks a room's world statement against its descriptor;
worldAction signs an action of wai.world.model; World is a participant's
copy of the world (wai-rs live_world), to which a page offers each object
its transport client verified against its receipt: each op's signature,
owner, kind, Lamport rule and equivocation, the session hash, the merged
log and a private world's carry. A host test runs the corpus's accepted
world through the page's path.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (cd35b8ff9) into wai/sdk-native-apple ... 3836144637

CHANGELOG: the native sink's and stream audit's entries above main's new ones under v0.4.0.
Cargo.toml: getrandom beside main's new optional dependencies. Cargo.lock: main's, with wai's
getrandom added by cargo metadata.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/ingest-ertmp-scte104 ... c90c4d5479

Conflicts in wai/CHANGELOG.md, wai/SPEC.md and wai-rs's registry table, each two
additions at one place: both kept (main's registrations and §5 paragraphs before
wai.live.injection; this branch's changelog entry first, as the newest).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-contrib, joule-moq-ingest: clippy clean; benches of a link and of the gateway path ... 09e96fe23b

joule-contrib-bench measures one link on loopback, both ends in one process,
and contrib_bench (ignored) the gateway path with the sender in a process of
its own: the payload rate, CPU time, and energy by the counter's profile,
class and scope: macos-task (the process's own account), or linux-rapl as a
bracket, the run's package reading less an idle reading of the same length,
across a wrap of the counter. The transport tests send a tail past what they
count: a receiver cannot know of a packet lost after the last it receives.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs native_sink: clippy clean (an observation's response as one argument, the acknowledged tuple named, the corpus's loops over its fragments) ... 7e928a45b3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a page in a room's shared world, and its browser tests ... de63d7d3bc

web/world/world.js is a participant in a room's shared world (WAI
live-worlds): it checks the room's world statement, takes an actor's grant
for a key it makes, publishes its world track (op batches, each group
signed into its receipt chain under receipt alias 4, no envelope flag),
follows the clock's lifecycle, subscribes to every actor's world track and
in a public world fetches each from group 0, verifies every object against
its receipt with the relay door's verifier, and offers it in group order
to wai-live-web's World. In a private world it is a member of the room's
group: it seals before it signs, opens before it offers, and carries what
it holds into each epoch it reaches. web/world/index.html is its page.

room.e2e.mjs gains the world and privateworld scenarios: two pages
converge through the relay, a late page catches up, a viewer acts in
nothing, the relay refuses what a grant does not allow, the door drops a
group receipted by another key, a departed actor's track is still fetched;
and in a private world, carries bring later members the world, a page
outside the group opens nothing, and a member removed opens nothing after.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit: its lockfile follows wai-quantum 0.6.15 from main ... 05fb22cc17

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: platform-encode extension text, the encode corpus (fixture streams from each interface, generated records and negative controls), the stream checks in the text's order ... 7cadb65328

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-remote: a host agent for WAI remote desktop rooms, and a viewer with no display ... d4810f32ee

The host is its room's clock and its screen's publisher: it makes a room (descriptor and grants,
the host marked remote_host, each participant's control classes in remote_control) and the lines
a relay's configuration takes for it; signs each participant's join when its events track
appears; publishes the screen as the room's screen track, one frame a group with its receipts,
and a screen statement naming the encoder; decides every input by wai-rs's rules at its place in
room-clock order (gate.rs) and injects what they accept on a thread that captures after it
injects, so the outcome it signs names the first frame that can show the input; and passes the
floor on request or when told.

Behind small traits: capture (a pattern source; the macOS display stream; X11 on Linux), encode
(an H.264 encoder with every macroblock I_PCM, a pure function every decoder decodes; the macOS
media framework's hardware encoder, AVC or HEVC, read back as Annex B), and input (a recorder;
the macOS event services; the Linux kernel's input device). Platform API names are in the
adapter files, each line marked for the public-name check.

tests/loopback.rs: a session over a relay that requires grants with their proofs, three viewers,
floor handover, refusals for no control power, no floor and a paused screen, latency records,
and the session's chains verified whole by wai-rs; run with the pure-function encoder, and on
macOS again with the hardware encoder. A workflow runs it on linux-arm64 and macos.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-pack: an encoded AVC or HEVC rendition over a package's pieces (encode-rung, verify-rung), and its corpus over the base golden ... c56155aadb

Co-Authored-By: Claude Opus 5.5 <[email protected]>

world e2e: the page's log reaches the console, and a failed convergence states each page's world ... 8acd29dcdb

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a stream's flow-control window of 16 MiB, configurable ... 650ed33653

A door holds each object of a group until the group's receipts arrive, and
it holds the object while reading its stream; the receipts follow the
group's last object. A group larger than the stream's receive window (QUIC's
default, about 1.25 MB) therefore stops its stream: the publisher cannot
finish the group, its receipts never come, and the door refuses it after its
hold. Contribution at 20 Mbit/s with a one-second GOP sends groups of 2.5 MB.
limits.quic_stream_window_bytes sets the window, 16 MiB by default (64 Mbit/s
for two seconds). contrib_srt's test of a 4.5 MB group shows it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

world.js: the next group crosses the wasm boundary as a BigInt; read it as a number ... 5b09cab4d9

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the room page shows a host's screen and controls it under its grant (WAI remote-desktop) ... 7234c82352

web/room/remote.js: input statements, floor statements and latency records written byte for byte,
every statement read, the host's rules and the floor replayed over a room's records, the table
from keyboard codes to HID usages; and RemoteViewer, which draws the host's screen (the page's
WebCodecs decoder, AVC or HEVC in Annex B, every frame verified against its receipt first), shows
what the host captures and who holds the floor, batches pointer, keys, composed text and pasted
text into input statements under the grant's classes, asks for and gives back the floor, and signs
a latency record of each applied input's frame at the display refresh that showed it.
remote.test.mjs checks it against wai/live-conformance/remote/, the host agent's key table among
it. The page draws a room with no composition descriptor, and names a screen track by its
namespace.

e2e: the remote scenario runs wai-remote-host with a pattern source (the platform's hardware
encoder on macOS), two pages, the floor asked for and given, a click and a key applied with their
latency records, an input with no control power refused, and the session the host records
verified by remote_desktop_verify.py.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-remote: every role may seek back; a page file for each participant; a session record ... 9183fe9035

A participant that joins late fetches what the clock and the host said before it came (live-rooms
§10.6), the host's screen statement among it. `room` writes participant-<name>.page.json, the room
page's test-room file; `run --record` writes the session as a verifier takes it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Revert the relay's stream window change; keep contribution at 20 Mbit/s as a test ... 81273dfc53

The change to joule-moq-relay's stream window (650ed3365) is reverted: its
test passed with QUIC's default window as well, and the gateway bench's
refusals that prompted it came back neither with nor without it once the
shared host was quiet. contrib_srt keeps two regressions: four seconds at
20 Mbit/s with 2.6 MB video groups through the relay's door, with a
subscriber and with none, every group released.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/remote-desktop ... fa78f9fd4b

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.world: the registry entry, SPEC section 5, the changelog, the CI step, and a late page that follows a departed actor ... 87c4621556

wai.live.world is registered (codecs/registry.rs, and the export of
REGISTRY.md, registry/capabilities.json and vocab/v2.ttl); SPEC 5 gains its
paragraph and the changelog its entry; live-rooms 4.4, 6.1 and 10.2 and
confidentiality 1 name the world track. wai-conformance.yml runs the
module, its corpus test and live_worlds_verify.py; joule-moq-web.yml reads
the worlds corpus its wai-live-web test uses.

world.js: an actor that has left has no live track, so a page entering
after it fetches the track without a live subscription. The privateworld
scenario lets something be sealed after the viewer enters before it looks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live_world: name the op keys' types ... 8b4791b0cd

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: restore a stream's flow-control window of 16 MiB ... d184e9b56e

81273dfc5 reverted 650ed3365 on a falsification that did not remove the
change: the build host's run checks out a snapshot commit whose parent is
the branch's head, so "HEAD~1" there was 650ed3365 itself, and both runs
"with QUIC's default window" ran with the window in place. Run again with
the change taken out (git apply -R), contrib_srt's two tests at 20 Mbit/s
fail (no PUBLISH_DONE, no session record: the door refuses each 2.6 MB
group after its hold), and the gateway bench refuses at the door at 4, 6
and 10 seconds; with the window both pass.

The door holds each object while its stream goes unread, and a group's
receipts follow its last object, so the whole group must fit the stream's
window. limits.quic_stream_window_bytes, 16 MiB by default; the relay's
README says so beside the door.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-contribution: registry, CI, READMEs, RIST's rate bound ... 3e47636436

- wai.live.contribution registered (registry.rs; REGISTRY.md, capabilities.json and
  v2.ttl regenerated); SPEC §5, CHANGELOG and live-ingest point to the extension.
- joule-code-conformance runs joule-contrib with and without rist, joule-moq-ingest
  with rist, and checks the link corpus regenerates; wai-conformance runs
  live_contribution_verify.py over live-conformance/links and fires on the extension.
- A RIST link's rate is bounded by its 16-bit sequence space: fewer than 32 768
  packets within the buffer (§8), refused as bitrate_exceeded above it.
- READMEs for joule-contrib and the link corpus.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/world-on-moq ... 31cf96550c

Five files both sides appended to: wai-conformance.yml (main's QoE
aggregation, exact tone mapping and exact splats steps kept whole, then the
live worlds step), the changelog (this entry on top), the corpus index,
the registry tables and lib.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: a corpus member's type named, for clippy's type_complexity ... 5458920846

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live_world corpus: a group receipt's new hybrid half, none ... 6745bf6cdb

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai platform-encode: settle the second implementation's questions (check order, held source, layered AVC, sizes, calendar), and corpus cases for each rule it found unisolated ... 5367aed5ea

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs, wai-pack: the encode corpus and rendition tests, and the platform encoder end to end on a host with a media engine ... 4dab9d02fc

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: RIST's rate bound as a function, with its unit test ... 64481f0d55

rate_bound_kbps gives a session's bound: the configured one, and for RIST at
most what keeps its buffer under 32 768 packets of 1 316 bytes
(live-contribution §8: 344 981 kbit/s with a buffer of 1 000 ms).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.video.encode, its SPEC §5 paragraph, the packaging §7.5 cross-reference, the CHANGELOG entry, the corpus README, and the CI steps (the verifiers on linux-arm64, the hardware encoder on macos) ... 5649518d33

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (cd35b8ff9: train C, wai-quantum 0.6.15) into wai/encode-avc-hevc ... 6d35ddf5c9

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/ingest-srt-rist ... 0431dce714

Conflicts in wai/CHANGELOG.md and wai/live-conformance/README.md, each
resolved by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai platform-encode: the source's frame rate as its header writes it, and corpus cases for a trailing access unit, a second SPS, the source's rate and range, and a misnamed object ... f5140db4c6

Co-Authored-By: Claude Opus 5.5 <[email protected]>

encode_verify.py: the source's rate as its header writes it; record.rs: is_multiple_of ... ea5c212fe3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-ingest: interop states the link's account before comparing frames ... 27a666cff5

A frame missing at the subscriber is either a packet the link dropped or a
loss outside the link (the datagrams into the reference tool). The check now
reads the link record's series first, prints its account (delivered, at the
first try, dropped, outstanding, bytes against the input's) and requires
nothing dropped, before it compares the frames.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

encode corpus: a stream with no picture parameter set, which only the every-parameter-set rule refuses ... b41b566be1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: bound a session's unread bytes by a connection window ... b54dc94c1d

transport_config set each stream's receive window but not the connection's,
and QUIC's default connection window is unbounded. A session could therefore
leave max_uni_streams (1024) streams each a stream window full unread: about
1.25 GiB with QUIC's default stream window, 16 GiB with 16 MiB. One publisher
that opens streams and finishes no group could push the relay past
max_resident_mb, and the relay exits for every room on it.

limits.quic_connection_window_bytes sets the session's window over all its
streams. The default is 64 MiB, the budget websocket_buffer_bytes gives a
WebSocket session and four stream windows: a group a door holds whole, the
next group's start, its receipts and the session's other tracks. The relay
never sets it below the stream window. The doc comment, the example and the
README say that this window bounds a session's unread bytes, not the
stream's.

tests/connection_window.rs: a publisher with a 1 MiB stream window and a
4 MiB connection window opens 32 streams, each a group whose first object
waits at the door and whose stream is then not read. It stalls having sent
4 190 208 bytes, and the streams it opens after that carry nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #465 (train/pack-stack @ad283d92): the packaging train, before the PRs that build on it ... 767d2aa7a6

#484's in-package rungs need it, and #463 carries #452's original history,
which #465 replaces with one squash. Merged first so every later PR meets the
packaging train it will meet on main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #440 (wai/ops-npu @069b551c): wai-ops/1-npu on a neural processor ... 4afeaefe34

Conflicts, both sides kept:
- determinism-tiers §5: #465's GPU paragraph and #440's NPU bullet; §6: #465's
  GPU row and #440's NPU row; the cross-architecture paragraph keeps #465's
  forge-run sentence and adds #440's neural-processor sentence.
- CHANGELOG: #440's entry above #465's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #445 (wai/scene-priors @6064a35c): scene and prior carriage ... 65cc9f5ead

Conflicts, both sides kept:
- wai-conformance.yml: main's robustness-evidence step, then #445's prior-forms
  and scene-carriage steps.
- wai-rs Cargo.toml features, registry.rs document constants, REGISTRY.md's
  wire-identifier rows and its list of extensions: both sides' entries.
- codecs/mod.rs: the lossless arm holds main's gain-map and ST 2094-50
  companions and #445's tensor-file prior forms.
- CHANGELOG: #445's entry above the train's earlier ones.
- registry/capabilities.json: regenerated (wai registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #446 (wai/registrations-b3r @da3c09c5): JPEG XS, MV-HEVC, the projection descriptor, IEEE 1857.11, format probes, CMSD read, LOC carriage ... 084bfda783

Conflicts, both sides kept:
- codecs/mod.rs: main's gain-map and ST 2094-50 companions and DRED strings with
  #446's projection descriptor, JPEG XS, MV-HEVC and IEEE 1857.11 in every list
  (companion-only, video companions, lossless, lossy, patent pool, unclassified,
  the registered list and the tests).
- codecs/registry.rs: both sides' registrations, wire kinds (glTF extension and
  telemetry key; WireKind::all() is now 17, which neither side's 16 compiled
  with), document constants and wire identifiers.
- SPEC §5: main's HDR rows and paragraph, then #446's projection row; the
  companion-only paragraph names both sides' strings.
- REGISTRY.md's list of extensions and kinds of wire names; delivery-telemetry
  keeps main's §9.4 and adds #446's §10; Cargo.toml features and [[test]]s,
  glossary_check, the live-conformance README rows and wai-conformance.yml's
  paths: both sides.
- CHANGELOG: #446's entry on top.
- capabilities.json, capabilities.schema.json, v2.ttl, v2.shapes.ttl and
  REGISTRY.md's table: regenerated (wai registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #448 (wai/avatar-telepresence @9804962c): wai.avatar.face ... 70c3b2fca3

Conflicts, both sides kept:
- codecs/mod.rs and registry.rs: main's DRED feature decoder (dred-int/1) and
  #448's face generator (face-int/1) in the ops members, the one-file
  parameter sets, the class match (with #445's tensor-file priors) and the
  registry tests' expected lists.
- lib.rs: main's robustness module and #448's avatar_face module.
- determinism-tiers §5: #448's avatar sentence after the GPU paragraph, before
  #440's NPU bullet; §6: #448's row after the GPU and NPU rows.
- wai-ops-gpu.yml: main's DRED and splat paths, build line and steps, and
  #448's avatar paths, build line and GPU step (the build line goes into the
  build step's run block, not after the DRED step).
- wai-conformance.yml, Cargo.toml, live-conformance README: both sides.
- CHANGELOG: #448's entry on top. The registry export is unchanged by the
  merge (export --check up to date).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #453 (wai/determinism-cost @4863036d): DET1, what exactness costs int_hyper ... 6fe1521524

Conflicts, both sides kept: wai-conformance.yml's paths (#453's
determinism-cost record and verifier after the train's); CHANGELOG, #453's
entry on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #467 (wai/int-decode-fast @986edfea): PERF1, int_hyper's integer decode on NEON, AVX2 and AVX-512 narrow kernels ... add759840d

No conflicts (stacked on #453).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #457 (wai/energy-waste @2a99c78f): EN-B, what nobody watches is ended with a receipt ... 372b51534e

Conflicts, both sides kept:
- the room page (app.js): main's endpoint check and co-watch snapshot with
  #457's termination module and snapshot.
- e2e: room.e2e.mjs keeps main's ageco, cowatch and origin scenarios and adds
  #457's termination scenario (in the default list, the --only list and the
  runner's table); lib.mjs keeps main's writeWav and adds #457's rawBrowser;
  run.sh's module tests run main's cowatch, markup and endpoint tests and
  #457's termination test.
- joule-moq-web.yml's scenario list, the crate README, wai-conformance.yml's
  paths and steps, Cargo.toml's [[bin]]s and [[test]]s, registry.rs, the
  live-conformance README, REGISTRY.md's list of extensions: both sides.
- CHANGELOG: #457's entry on top. capabilities.json regenerated (registry
  export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #460 (wai/energy-sink-metering @df8c7f49): EN-A, sink energy ... 73a1a0c954

Conflicts, both sides kept: SPEC §5 (#457's termination paragraph, then #460's
sink-energy paragraph), Cargo.toml features, registry.rs capabilities; CHANGELOG,
#460's entry on top. The registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: platform decode capabilities in dispatch (platform-decode) ... 501c1f8547

wai::platform_decode: the query a sink makes of Media Capabilities and
WebCodecs for an entry, read from its payload (AV1: the AV1-ISOBMFF codec
string from the sequence header, full where the stream is not 4:2:0
BT.709 studio range; HEVC: the Annex E.3 string, cropped and coded sizes
and bit depth from the SPS); the answers; the energy budget as read from
energy-measurement (OnChipCounter, measured, on a reference sink); and the
default order, a SPEC §7.1 deployer policy: power-efficient classical
decode and budgeted learned decode first, then smooth, then other
classical, then learned without a budget, manifest order within a rank.
select() runs §7.1 in that order; advertise_for_envelope() is the WAI1
rule. Pure logic, no feature, no dependency.

platform-decode-conformance: order.json (every rule, and the WAI1 cases)
and queries.json (packaging-corpus floors, and an SPS a hardware encoder
wrote whose level is not the one it declared). The tests also derive
every corpus floor to its HLS master's codec string and size, reproduce
the AV1-ISOBMFF examples, read SPSs with sub-layers and emulation
prevention, and catch each rule turned off.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 6ad92e2e85)

platform-decode: Media Capabilities and WebCodecs in dispatch ... 44af5d5d07

A new extension, from Media Capabilities (WD 18 October 2026), WebCodecs
(WD 19 October 2026) and its AV1 and HEVC registrations: the query a sink
forms from the payload, never from what an encoder declared; supported:
false making the capability unsupported for that object; smooth and
powerEfficient ordering only, never written as energy; prefer-hardware a
hint, not evidence of hardware; the default order and the WAI1 advertising
rule; the energy budget read from energy-measurement. SPEC §4 and §7.1
point to it. §6 records a browser run on an arm64 desktop.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 8695bc75f5)

wai-web: the platform_decode bundle, and a page that runs it against the platform ... e9e9e8cdb2

platformQuery and platformOrder bind wai::platform_decode behind the
platform_decode feature, built as its own bundle, so the main bundle is
unchanged. demo/platform_decode.html queries and decodes every AV1 floor
object of the packaging corpus through WebCodecs with the derived
configuration, asks about the same family at 1920x1080, encodes HEVC with
the platform's own encoder and decodes it back with the codec string read
from the stream, and orders a learned entry and an AV1 entry from the
answers; verify_platform_decode.mjs drives it in a headless browser.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit fed8694f43)

wai: HwShunt closed to every profile defined after the hardware class was refined ... a6624adaac

energy-measurement §2.6, New profiles: the profiles that could have sealed
HwShunt keep their acceptance, listed by name; a profile, record, claim,
table or registration member defined since refuses it from every producer
and reads it as no other class. A RAPL or system-management-unit package
counter is OnChipCounter. wai-rs: energy_class::check_new_profile
(AcquisitionError::LegacyInNewProfile), with its test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit df5ea962f9)

wai: the energy order of dispatch, and the energy budget that lifts a learned capability ... b73d691ed4

SPEC §4, §7.1 step 2: a sink tries an envelope's capabilities in the energy
order unless its deployer configures another: a decode the platform answers
supported and power-efficient first, a learned capability (NeuralIntegerExact,
NeuralEntropyExact, NeuralFloat, Behavioral) with no energy budget after every
other, the envelope's order within each. The order changes which capability
decodes, never a reason. An energy budget is a decode figure measured on a
named reference sink under OnChipCounter or CalibratedInstrument, in a record
named by its digest; no registration states one yet (REGISTRY, Energy budgets;
the export's optional energy_budget, schema only).

wai-rs: energy_order (DispatchPolicy, Budgets, EnergyBudget, is_learned);
Wai::dispatch_verified and WaiMulti::pick apply it, dispatch_with and pick_with
take another order, the HTTP client's default order and the C ABI's
wai_envelope_select follow it. Tests that are about pins state the manifest
order they run in.

browser-sink §4.7: objects sharing a choice are alternatives; the page decodes
the first in the energy order that routes (no_alternative otherwise).
browser_sink::choose_report, the page's chooseReport (wai-live-web, binding.js),
a choices section in live-conformance/browser (existing sections unchanged),
checked by wai-rs, the page's corpus run and browser_sink_verify.py (34 of 34
mutations caught).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 11b2556827)

joule-moq-relay: meter the relay's own energy for real, or sign the unmetered marker ... 6046196d3a

A sampler reads a counter every 100 ms while the relay runs: on macOS the
relay process's own CPU energy (ri_energy_nj, unprivileged; scope task), on a
Linux host the operator states runs the relay alone the CPU packages' RAPL
energy (scope package). A room's WMH1 record carries the advance over its span
as OnChipCounter (tag 4, filtering Unknown, window the span, a declared
uncertainty: interpolation and counter lag at each end, the vendor's filtering
noise for a package counter, the rounding) where the counter was live across
the span (energy-measurement §3.1) and the relay served that room alone; the
unmetered marker otherwise, logged with why. A session summary stays
unmetered: sessions share one process. [metering] energy = auto|off and
dedicated_host. The corpus test's record keeps its bytes with the meter off.

Tests: src/energy.rs (arithmetic, liveness, uncertainty, a made powercap tree),
metering's tag-4 round trip and refusals, tests/relay_energy.rs (a measured
record on a host with a counter, the marker beside another room's session and
with the meter off; SKIPPED where the host has no counter, failing under
JOULE_MOQ_RELAY_ENERGY_REQUIRE). CI: a macos job requires the measured figure.
live-metering §8 and §4.6 say what the relay signs, and that the allocation of a
hop's joules by bytes is an accounting convention. joule-moq: the mock relay's
figure is documented as carrying no class.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit ff069acc24)

wai: the energy order keeps non-selectable entries in place; the HTTP and pin corpora state their order ... 9f42a4a447

energy_order reorders only the entries SPEC §7.1 step 2 may pick, each into one
of their table places; a companion or refinement keeps its own, so where
nothing selectable moves the walk is table order. SPEC §7.1 says so.

HTTP (http-delivery §7 step 4): the client's select and fetch default to the
energy order. O2's pin cases walk the table's order, stated in each case as a
deployer policy; select_O2_default and fetch_O2_default are the default, which
picks AVIF before the learned int_mlicpp. http_verify.py's default order is the
energy order too (1057 of 1057 cases; the mutation shard 79 of 79).

The pin corpus's selection cases are about pins, so its runner walks the table's
order, a deployer policy (pin-conformance/README.md). wai-web's pick tests
follow the default order.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 244a715b35)

wai: no modelled or zero figure shown as a measurement ... 1f5bfbd1e0

- The C settlement kernel graded every receipt measured, from hardware, by
  hardware_meter, whatever its meter; it now writes the grade and device the
  meter states. Its host harness's figures are constants: projected, from a
  simulation, by model_estimated (oer-receipts §2: an Estimator figure is
  projected). The Zephyr skeleton states projected and no longer seals a
  compute figure of 0. firmware_vectors.json is regenerated; both verifiers
  pass it.
- wai-web: the world demo seals the page's estimate labelled Estimator and says
  so on screen (label_page_figure, tested); the quantum demos seal the unmetered
  marker instead of invented constants, and their getters say a 0 is unmetered.
- The quantum studio shows a figure with its class, coverage and uncertainty;
  the quantum CLI prints the unmetered marker as unmetered (tested); the
  metering tools head a bracket as a bracket and print the marker on stdout when
  they seal it; a provenance total names the class it reads at (tested).
- energy-measurement §2.8 and §6 record which demos still seal an illustrative
  figure the page passes in.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 2a8d45aa0d)

joule-moq-relay: a unit test's microjoule, and the CI grep for a measured line ... a789f2811b

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit a203eae233)

wai: say what fewer bytes do not save, and the changelog ... 447e637ed9

energy-steering §5.5: the steering figure is the hops' own energy averaged over
their delivery, not the network's, which is largely flat against traffic.
live-rooms' joules_ceiling is held against an attribution by bytes. The
research taxonomy's compression lever claims cost and a mobile radio's draw,
not network energy. CHANGELOG: the slice's entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 9b6e4badab)

platform-decode §4.3: a WAI1's fallback first whenever it ranks above a learned capability without a budget ... 5bbbcd2230

#452's rule demoted a learned capability without a budget only for a
power-efficient fallback, so a smooth or a software classical fallback stayed
below it, while §4.2 ranks every classical decode the sink can make above it
in a WAI2. §4.3 now applies §4.2's order to the two capabilities: step 5 first
when the fallback ranks above, step 3 only if step 5 does not decode, so the
rule never leaves inert an envelope the capability could decode.
advertise_for_envelope follows; the vector learned-capability-fallback-not-
power-efficient now decodes the fallback, and learned-capability-classical-
fallback-no-platform is added. The extension also says SPEC now applies its
order by default.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 1ffceb5081)

wai: the energy order is platform-decode's, by default; the budget record in energy-measurement §2.10 ... 9e11261e8a

Built on #452 instead of beside it: energy_order ranks with
platform_decode::rank (first, smooth, classical, learned-without-budget) and
reads platform answers as platform_decode::Answers; its own mapping and ranks
are gone. SPEC §4's energy order is platform-decode §4's order applied by
default to cap and fb; §7.1 step 2's default walk is the same over the entries
that may be picked, the others keeping their places.

energy-measurement §2.10 defines the budget record platform-decode §5 reads
(class OnChipCounter, joules_micro, per frame|picture|second, relative_ppm,
window_us, reference_sink) with filtering, resolution and the record's digest,
and its refusals; energy_order::BudgetRecord reads and checks it and gives
platform-decode its view. The registry schema and REGISTRY follow.

browser-sink §4.7 ranks alternatives by platform-decode §4.2 from the user
agent's answer (a route of none last, with no rank); the choice table states
each rank. The corpus's choices are regenerated (one order changes: an
alternative routed none now comes last; one case added), and
browser_sink_verify.py ranks the same way (37 of 37 mutations caught).
http_verify.py ranks learned capabilities as platform-decode §4.1 does. The C
header is regenerated over the merged tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 6c03ba72c4)

platform-decode: keep the query, move the order into browser-sink's routing, drop the budget ... 4c1f640588

The review of #452 (M4–M9) found its platform-decode part at odds with
browser-sink on main. Reworked inside EN-C:

- Kept: the query read from the payload (AV1-ISOBMFF codec string from the
  sequence header, Annex E.3 from an HEVC SPS) with queries.json; the rule that
  powerEfficient and prefer-hardware are hints, never energy and never evidence
  of hardware.
- Reworked: the answers enter browser-sink §3's report, one shape
  (report_answer): supported from isConfigSupported() alone, smooth and
  power_efficient from decodingInfo() only once WebCodecs said supported, so a
  Media Capabilities supported:false overrides nothing (http-delivery §12.2).
  The extension defines no order and no second meaning of advertising: the order
  is SPEC §4's energy order inside browser-sink §4.7, where an answer counts only
  for an object routed ua (AV1's user-agent tier is none; a decode-equivalence
  need with no probe run routes elsewhere).
- Dropped: rank/order/select, advertise_for_envelope (a second advertising
  definition that could make a decodable WAI1 inert), the EnergyBudget and its
  ceiling, and order.json. A learned entry's measurement is browser-sink §6's
  energy entry.
- wai-web: the platform bundle binds platformQuery, platformAnswer and
  platformChoose (browser-sink §4.7) on the browser_sink feature; the demo builds
  every query from a payload (the hand-written 1920x1080 query is gone), asks
  Media Capabilities after WebCodecs, and marks its one figure synthetic. The
  wording calls the HEVC source the platform's encoder configured with
  prefer-hardware. wai-web-wasm.yml builds the bundle.
- int_kernels_vectors: the two new corpora's sidecar exclusions (review M1).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit ce38948dad)

wai: the energy order inside browser-sink's routing, gated on a sink-metered figure; no parallel budget ... ba0b31a928

SPEC §4's energy order is an order over what a sink advertises, never a reason
to advertise: first (classical decode the platform answers supported, smooth
and power-efficient; in a page only for an object routed ua), smooth,
classical (any other classical decode, and a learned capability whose decode
the sink holds a qualifying measurement of), learned-without-budget. The
measurement is a sink-metered figure in browser-sink §6's shape; it qualifies
with OnChipCounter or CalibratedInstrument and coverage Whole, and its value is
never read, so a figure still changes no route (§6). A deployer may compare it
with a ceiling per decode as its own policy. The module-authorisation sentence
naming a second place advertising is decided is gone.

energy_order owns the ranks and browser-sink §6's measurement reader, which the
page's energy entry now shares. browser-sink §4.7 ranks alternatives inside the
routing, a WAI1's capability and fallback among them; the corpus adds a host-
routed decode the user agent called power-efficient, and learned alternatives
with counter, calibrated, partial and modelled figures, all marked synthetic
(39 of 39 mutations caught by browser_sink_verify.py). energy-measurement §2.10,
REGISTRY's energy budgets, the registry's energy_budget and BudgetRecord are
removed. http_verify.py and the container's tests follow; the C header is
regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 1ca5931244)

wai: the reference meters seal what their reader is — ModelBased from a reported power, never OnChipCounter ... 2baae4269b

The meters sampled the processor power a non-privileged reader reports and
sealed it OnChipCounter, but they never read the channel it comes from: on
macOS 27 the processor channels of IOReport's Energy Model group read zero for
an unprivileged reader, and the reader takes its power from another report it
selects. The liveness rule (energy-measurement §3.1) passed on the reported
samples, which move, while no counter was ever put to it.

energy_burst::PowerSource says what a reader's samples are. A Counter's
differences can seal OnChipCounter under §3.1, §4 and §2.3; a Reported power
is refused as OnChipCounter whatever its brackets show (Bracket::on_chip_figure,
on_chip_refusal) and seals ModelBased under the same bracket rules
(Bracket::figure). wai_meter, wai_video_meter, wai_world_meter,
wai_quantum_meter, wai_prov and wai_stage_measure --energy macmon now seal
ModelBased, naming the reader as the method; rapl:<domain> stays a counter.

energy-measurement §3.1 (the test is run on the counter), §2.9 and §7 say so,
and the extensions that described the meters' figures as on-chip readings are
corrected. No committed record changes class: the provenance vector's figures
are unlabelled and keep their bytes.

Also: the relay's powercap tests module after its impl, and platform-decode's
test helper uses is_multiple_of.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 507f4cd9e1)

wai: WaiMulti::pick walks the energy order through pick_where, as the neural path does ... 9c0958a0fe

pick reached the energy order through pick_with, which left pick_where used
only under the neural feature and dead in every other build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit c953377397)

wai: include/wai.h as build.rs regenerates it (energy_burst's MACMON_SOURCE) ... 1ba4a7621f

cbindgen sees the public constant and writes PowerSource as an opaque type.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 13964c9448)

Merge #463 (wai/energy-honesty @13964c94, replayed): EN-C, the energy order of dispatch, a self-metered relay, HwShunt closed to new profiles ... bfa44f4c1d

#463's head carries #452's original history, and with it #438's first
research note (docs/research/wai-cross-fabric.md), which names fleet hosts and
addresses; #465 replaces that history with one squash so the note never enters
main's. So #463 is not merged by its head: its own commits are replayed with
cherry-pick -x onto the train's #465 merge (767d2aa7a), the second parent here:

- #452's platform-decode commits, which the review's split gave to EN-C and
  #465 left out: 6ad92e2e8, 8695bc75f, fed8694f4;
- EN-C's fourteen: df5ea962f 11b255682 ff069acc2 244a715b3 2a8d45aa0 a203eae23
  9b6e4bada 1ffceb508 6c03ba72c ce38948da 1ca593124 507f4cd9e c95337739
  13964c944.

#463's merges of main and of #452 are not replayed; their conflict
resolutions (SPEC §7.1 step 2, the CHANGELOG) are reached by the later commits.
Checked: the replay's tree equals a three-way merge of #463's head onto the
replay's platform-decode commits with #452's head merged into main 1a465f23 as
the base, file for file, except the two files that merge conflicts on
(int_kernels_vectors.rs: #465's wgsl line and EN-C's platform-decode line, both
kept), and its CHANGELOG is #465's with #463's energy-honesty entry exactly.
No address of the fleet appears in the replayed commits.

Merging the replay here: CHANGELOG only, #463's entry on top. The registry
export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #470 (wai/ssai-stitched @4623548d): stitched presentation ... 9dc78f9dee

Conflicts: CHANGELOG only, #470's entry on top. The registry export is up to
date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #473 (wai/receipt-ledger @9cea6b5c): the receipt ledger ... 9bc2cc9611

No conflicts (it contains #470, merged just before).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #471 (wai/key-release @e60c7dbe): key release, the proxy form of wai.video.keys ... 9a39b479ab

Conflicts, both sides kept: SPEC §5 (the train's paragraphs, then #471's
key-release paragraph), REGISTRY.md's wire rows (in name order), registry.rs
document constants and wire identifiers, the live-conformance README; CHANGELOG,
#471's entry on top. capabilities.json and REGISTRY.md's table regenerated
(registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #474 (wai/audit-kit @d56916da): stream audit, an audit kit for streams another service delivers ... 7c63539111

Conflicts, both sides kept: #473's receipt ledger and #474's stream audit side
by side in Cargo.toml (feature, [[bin]], [[test]]), lib.rs, registry.rs, SPEC
§5, REGISTRY.md and wai-conformance.yml (paths and steps); CHANGELOG, #474's
entry on top. capabilities.json, v2.ttl and REGISTRY.md's table regenerated
(registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #480 (wai/sdk-native-apple @05fb22cc): the native sink, its C interface and the Swift package ... 601b3cfe41

It contains #474, merged just before, and main's cd35b8ff9; the CHANGELOG's
recursive base produced nested markers, so it is #474's train CHANGELOG with
#480's one new entry on top (no other entry of #480's differs from the train's).
include/wai.h: #463's PowerSource and #480's wai_sink_t, both; the header is
regenerated from build.rs at the train's head.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #475 (wai/relay-cascade @43c87c8c): relay-to-relay cascading ... e56cad3047

Conflicts, both sides kept:
- joule-moq-relay metering.rs's module text and live-metering §8: #463's
  self-metered relay (its counter, OnChipCounter or the unmetered marker) and
  #475's hop links (counted in the track entries, neither subscriber sessions
  nor in the ledger), and both tests' account of the corpus record.
- joule-code and wai CHANGELOGs: #475's entries on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #479 (wai/ingest-ertmp-scte104 @c90c4d54): Enhanced RTMP v2 ingest and SCTE 104 into signed cues ... a0e8a27b93

Conflicts, both sides kept: joule-code-conformance.yml keeps #463's
moq-relay-energy job and takes #479's account of the ingest job; registry.rs's
capabilities; CHANGELOG, #479's entry on top. The registry export is up to date
after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: remote desktop rooms ([remote]); joule-moq-remote: a host in a room a service keeps ... c7bc6f637c

The room service keeps every room as one host's screen shared into it (WAI
remote-desktop): it grants the host (remote_host), a controller (the control
power, by the allow rule) and a viewer, takes the host by its key or by an
invitation its authority signed, hands control over by the host's grant
exchange (its grant and a proof over the service's challenge), watches the
host's screen track and every principal's events, and takes each record in its
chain's order, removing a principal whose record is out of it.

The host agent runs in a room a service keeps (run --room): it asks for its
grant, follows the service's clock, and orders participants' records by the
same rules. The desk (wai-remote-host room) stays, without page files that
carry keys.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #483 (wai/ingest-srt-rist @b54dc94c): SRT and RIST contribution ingest, with a signed link record ... 29594e8ea9

#479 (Enhanced RTMP, SCTE 104) and #483 (SRT, RIST) both extend
joule-moq-ingest; both ingests are kept whole, on one set of types:
- frame.rs: one Codec with both sides' codecs (HEVC, VVC, AAC, FLAC; ALL is
  nine), #479's WEBRTC constant and Option-returning to_str0m, #483's webrtc()
  and aac_header; one Header whose audio rate is #479's `rate` (#483 called it
  `samplerate`; its uses are renamed); unframe keeps #483's whole-ADTS check
  for AAC; the module text names both ingests' codecs.
- package.rs: one packager. HEVC and VVC take an Enhanced RTMP track's hint, and
  from a transport stream (no hint) the header or a default, as #483 did; AAC's
  first header is its ADTS header where there is no hint (#483) and the hint's
  otherwise (#479).
- catalog.rs: #479's (name per entry; the rate as above); contrib.rs's catalog
  entry now names its layer, as #479 made every entry do.
- config.rs, gateway.rs (routes, the Gateway's fields and methods, the server's
  listeners, srt_task and shutdown), rtc.rs, lib.rs, gateway.example.toml, the
  README and live-ingest's status, header and test account: both sides.
- tests/common: watch_kinds -> watch_layers (#479) -> watch_tracks (#483),
  one subscriber; Watched.layer is the track name where it is a number.
  tests/ertmp.rs imports common::rtmp::adts by name, since common now has
  #483's adts too.
- joule-code-conformance.yml's paths, the live-conformance README; CHANGELOG,
  #483's entry on top.
cargo check --locked --all-targets of joule-moq-ingest (with rist),
joule-contrib (with rist), joule-moq-relay and joule-moq passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: a remote room's session through the service, host agent and viewers on loopback ... 1b007d1d73

tests/remote_room.rs: the host agent enters by an invitation (a second key
refused), two viewers make their keys, the host hands control over by a grant
exchange with its grant and proof (no proof, another key's proof, and a non-host
refused), a click under the floor applied, a viewer refused input_not_permitted,
the floor handed to a second controller, a record out of its chain's order cut
and its author removed by the clock and by the host, and the session verified by
wai-rs as the clock holds it and as the host holds it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #481 (wai/remote-desktop @54589208): wai.live.remote, remote desktop in a WAI room ... d87432e39c

Conflicts, both sides kept: the room e2e (#457's termination scenario and
rawBrowser import with #481's remote scenario, its spawn import and its
--remote argument: remote runs by default when the host agent is given),
run.sh's scenario list and the page's module tests (cowatch, remote, markup,
endpoint, termination), joule-moq-web.yml's scenario account, Cargo.toml's
[[test]]s, the live-conformance README; CHANGELOG, #481's entry on top. The
registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #482 (wai/world-on-moq @6745bf6c): wai.live.world, a shared world in a live room ... 20a37c22fb

Conflicts, both sides kept: the room e2e (termination and remote with #482's
world and privateworld scenarios: the default list, the runner's table, the
usage), run.sh, joule-moq-web.yml (scenario account and paths),
wai-conformance.yml's steps, SPEC §5, wai-live-web's wai features
(stream_termination and live_world), wai-rs Cargo.toml's [[bin]]s and
[[test]]s, registry.rs, lib.rs (remote_desktop and live_world), the
live-conformance README; CHANGELOG, #482's entry on top. The registry export is
up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #484 (wai/encode-avc-hevc @b41b566b): wai.video.encode, AVC and HEVC through the encoders a device already has ... 43bd5e66e1

#465 is in the train (merged first), so #484 meets the packaging train here.
Conflicts, both sides kept: wai-pack's Cargo.toml (#484's platform_encode
feature and its account, #465's optional wai-pack-gpu), its lib.rs module
account (fabric, files and rendition), wai-pack.yml's test-count floors
(#484's encode_rung with #465's counts), packaging §7.5 (#465's hardware
device and driver, then #484's encoded rendition); CHANGELOG, #484's entry on
top. The registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the remote page makes its key and asks the room service for its grant ... a70795d740

remote.js no longer reads a key file: RemoteViewer takes the grant the room
service issued for the key the page made, reads its control power from that
grant and from each exchange of it the clock signs, and sends nothing without a
grant, before the clock records it joining, or of a class its grant in effect
does not give. app.js enters a remote room through the service (#join asks to
control, #watch to view) and reads the room's grants again on an exchange. The
browser scenario runs against the room service: the host agent by invitation, a
controller's page and a viewer's, and the sessions the host and the clock hold
verified by remote_desktop_verify.py.

Also the room service's README, example and workflows for [remote].

Co-Authored-By: Claude Opus 5.5 <[email protected]>

lockfiles: three the merged tree had left stale, resolved and nothing else ... 77345965d4

scripts/check-lockfiles.sh on the train found three:
- joule-code/joule-code-rs/crates/joule-moq-remote (#481), a workspace of its
  own on joule-moq-relay: the merged relay (#475's cascading) depends on
  tokio-rustls 0.26.6 and rustls-native-certs, which the joule-code workspace's
  lock already holds. Resolving it also moves a few platform-only edges onto
  windows-sys 0.61.2 and getrandom 0.4.3, which the lock already held. No other
  package version changes.
- wai/wai-key-proxy (#471) and wai/wai-ledger (#473): main's wai-quantum is
  0.6.15 (#478), which both branches predate.

Each refreshed with `cargo metadata --format-version 1` (resolve only), then
check-lockfiles.sh on all three: current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: name the remote module's compound types ... 6dc0df2aa9

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: an upstream link is held to the listener's receive windows ... 04dcfcfd40

The relay's own links to its upstreams (#475's cascading) dialed native QUIC
with a transport configuration of their own that set no receive windows, and
WebTransport with quinn's defaults: on both, the connection's receive window
was unbounded, so an upstream could leave the relay holding up to the stream
windows of every stream it opened. #483 bounded the sessions the relay
accepts with limits.quic_stream_window_bytes and
limits.quic_connection_window_bytes; now one transport configuration
(server::transport_config) serves the listener and both kinds of upstream
link, and webtransport::connect_draft_tls_with takes it.

tests/upstream_window.rs: an upstream of the test's own (native QUIC, and
WebTransport) opens data streams before its SETUP, which the relay parks after
reading each one's header, and writes until flow control stops it: it stalls at
the link's connection window (2 MiB here, with 1 MiB stream windows over 16
streams).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: the receive windows' text names the upstream links ... 1fb61be966

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (34df55a5e): #465 landed, #486, #485 ... b1964e0844

#465 is the train's first merge, so it brings only its merge commit. #486
(check-advisories.py) and #485 (Quantum Studio) merge cleanly.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: include/wai.h as build.rs regenerates it on the train ... 9406c5ae9f

#467 (PERF1) made int_kernels::Isa a public type the C surface reaches, and the
header its branch carried predates it, so a build rewrote the header and left
the tree dirty (the HTTP falsify shards require a clean tree). This is the
header build.rs writes at the train's head: the opaque Isa typedef and two
blank lines of cbindgen's cfg handling. A second build, with no features and
with the falsify shards' (http, video_manifest, key_discovery), leaves it
unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-swift: the tests read the corpus from their bundle, so they run on a device ... f981a8a7ec

The native sink corpus is staged into the test target's resources by
scripts/build-xcframework.sh (not committed), and the tests read it from Bundle.module,
else from the repository. Each test prints a summary line (WAI-SINK …): the corpus's cases
and calls through the C interface, the relay's verdicts per fragment, the refused
requests of a fragment changed at the origin and their statuses, and the end-to-end and
hidden sessions' outcomes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-android: the native sink's Kotlin library over the C interface ... b72652887d

An AAR for phones, tablets and televisions whose applications are written in
Kotlin (extensions/native-sink.md): a JNI layer over wai_sink_* (every status
carried to Kotlin with libwai's message, strings passed as UTF-8 bytes, a NUL
inside one refused); libwai and that layer built by cargo and the pinned NDK
(29.0.14206865) for arm64-v8a, armeabi-v7a and x86_64, linked for 16 KiB pages
and checked for it and for every exported method; the wrapper, the loopback
relay (128-bit path token, 502 for anything refused, ranges from what verified,
content codings removed), the observation loop, the collector client; the player
session over the platform's media player library and the attention signals from
the activity's lifecycle, the window's and display's state, the view's place in
its window and the window's input.

The platform-free half also compiles for the host JVM, so its unit tests drive
the JNI layer over a host build of libwai: the corpus live-conformance/native-sink
(every case, every refused configuration, the page-parity bundle byte for byte),
the relay over the reference floor, and the loop's hidden and idle endings. The
instrumented tests run in a headless emulator: the corpus and the relay on the
device, the floor played through the sink to its end, a changed fragment refused
on every retry, a session nobody can see ended hidden, and the attention signals
from a real activity. Pinned: AGP 8.13.0, Gradle 8.13 (by SHA-256), Kotlin
2.3.21, JDK 17, compileSdk 36, minSdk 24, the media player library 1.11.1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: wai-sink-android, the JVM tests on linux-arm64 and the AAR and emulator tests on macos ... 4708f7a65c

linux-arm64 builds libwai and the JNI layer for the runner and runs the unit
tests on the host JVM, requiring every test class to have run and none to fail
or skip; no Android SDK is used there. macos, where the platform SDK, its NDK
and its emulator are installed, builds every ABI and the AAR, checks the AAR
holds both libraries for each ABI, and runs the instrumented tests in a
headless emulator, failing unless at least one ran and all passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

native-sink: an unfocused window that is shown is shown; loopback alone for cleartext ... be91f8744b

Two statements the Kotlin integration needed. §6.2: a window the platform shows
without the input focus (a split screen, a picture-in-picture window, one under
a translucent window) is shown, so a host does not end as hidden a session the
viewer watches. §11: where the platform refuses unencrypted HTTP by default, the
host's exception for its loopback server covers 127.0.0.1 alone. The header
names the Kotlin library; CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the remote page sends only under a grant that is good now ... e4da7efaee

The viewer's control power is its grant in effect's while that grant is good,
from its nbf to before its exp (live-rooms §4.3): a page whose grant has ended
holds none and sends nothing. readGrant reads the grant's window.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: the remote room's field beside the room's own state, apart from the other modes' ... fa1c278dd7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (cd708e120): #477, the independent verifiers build wai-rs once per profile ... 22df0336c3

One conflict, at the end of the independent verifiers job: #477's last step runs
each differential against both builds, and the train's three steps that follow
it (header probes, cmsd_read_verify.py, loc_verify.py) come after it; #477's
new features-alone job follows the job.

The train's fifteen wai-rs steps in that job (#453's determinism cost, #460,
#471, #470, #445's two, #448, #473, #474, #480, #484, #481, #457, #482, #446)
still built with feature lists of their own, and each switch between a list and
#477's union rebuilds the library and relinks every test built before it. They
now follow #477's rule:
- WAI_FEATURES gains sink_energy, key_release, stitched_presentation,
  prior_wire, scene_map, avatar_face, receipt_ledger, stream_audit,
  native_sink, platform_encode, remote_desktop, stream_termination, live_world
  and format_probe (neural_int was in it); WAI_RELEASE_FEATURES gains
  avatar_face, whose corpus test runs optimised. None of them, nor what they
  imply (audio_scene, ffi, video_keys, video_package, world_model), is a
  feature any code tests for by its absence (the only cfg(not(feature)) gates
  are pq_signatures, neural_int, staged and the int media features, already
  in or out of the union as before).
- The first step builds the four corpus programs those steps ran with cargo
  run (wai_sink_energy_vectors, wai_stitched_presentation,
  wai_stream_termination_vectors, wai_format_probe) with the union's tools and
  the steps run the copies; its test build names the fifteen steps' test
  targets, and the release build avatar_face's.
- Each step selects the same tests as before; only the feature list changed.
  The termination step's wai-live-web tests run with int_video, the one build
  of wai-live-web the browser sink step makes.
- features-alone checks each of the train's feature lists alone.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-android: a missing refusal fails the status test by name ... cf93ad7a3a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs tests: format-probe-conformance (#446) and encode-conformance (#484) in the sidecar exclusions ... d28830f583

every_decoded_output_states_a_sha256 holds every *-conformance directory to a
sha256.json of its decoded outputs, or to an entry naming why it has none. #446
and #484 each added a corpus with neither, so the test failed on each branch's
own head (the conformance workflow's fast-kernel steps run it); neither corpus
decodes a payload. Each now has its entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

encode-conformance (#484): the README's provenance line ... 52ce41504b

tests/corpus_provenance.rs requires every corpus README to state its provenance
on a **Provenance.** line; encode-conformance's said it in its table only. The
line restates the table: what is generated, what an encoder made once and is
kept, and which generator writes the rest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #488 (wai/sdk-native-android @cf93ad7a): the native sink as a Kotlin library over the C interface ... 8089acf226

Stacked on #480 (which this train merged earlier, with #474); it arrived after
the train's later merges, so it is merged here, at the head. No conflicts: a new
directory (wai/wai-sink-android), a new workflow (wai-sink-android.yml), two
statements in native-sink §6.2 and §11, and a bullet in #480's CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: GET /remote/room bounded per client, as /remote/state is ... 74cab2ccac

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: a floor statement §7.2 refuses changes nothing; session records for the room alone ... 662dc9d6d0

remote-desktop §7.2/§7.3: a floor statement its rules refuse is recorded, stated
with its reason and changes nothing; a verifier computes the floor without it and
a host gives it no effect, so a release crossing the host's take leaves a room
that verifies. §12 moves floor_not_permitted, floor_not_eligible and
floor_not_holder to a third table of stated reasons; §11.3 states each refused
floor statement.

wai-rs: FloorRefusal and the shared rule remote_desktop::floor_rule; the verifier
states floor_refused. The corpus regenerated: 33 of the 39 earlier vectors are
byte for byte as they were; the six refused-floor vectors keep their rooms and
are now accepted with floor_refused; three whole floor sessions are appended (a
give by a non-holder, a release by a non-holder, a late release).
remote_desktop_verify.py follows the text: states and does not apply a refused
floor statement, reads §12's three tables. remote.js's replay applies §7.2.

joule-moq-room: the clock computes the floor by floor_rule and cuts no one for a
floor statement; GET /remote/room and /remote/state answer only a grant this room
issued with its proof (401 otherwise, 403 for another room's grant). The host's
gate uses floor_rule. The browser scenario reads the session with the host's
grant and proof.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: name the floor replay's types; the reader check's refusal boxed ... d1e8965f70

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #489 (wai/room-remote @d1e8965f): remote desktop rooms in the room service ... 63d4042224

Stacked on #481; merged at the head, after #482 and #488. #489 changes #481's
corpus (live-conformance/remote/: six vectors move from refusal to acceptance,
three are appended), and the merge takes #489's, as neither is on main.

Conflicts, both sides kept:
- joule-moq-room's wai features: #482's live_world and #489's remote_desktop.
- joule-moq-web.yml's scenario account and room.e2e.mjs's usage: #457's
  termination, #489's account of the remote scenario, #482's world and
  privateworld; the default list runs remote when both the host agent and the
  room service are given (#489), beside #482's world scenarios.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: a remote desktop room is not also a world room ... 5cb44c8664

With #482 and #489 in one tree, the room service could be configured with both
[remote] and [world]. The two modes do not combine: a world room's actors join
with no media and the clock watches their world tracks, where a remote room's
host publishes a screen and the clock watches events. remote::service now
refuses the combination when the configuration is read, as it refuses a remote
room beside the other modes it does not keep; the README and the example
configuration say so for both modes.

a_remote_room_is_not_also_a_world_room: each mode alone is read, both together
are refused with the reason named.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-swift: TestHost, an application the tests run inside on a phone or tablet ... aa607a60a5

A device runs no tool-hosted test bundle, so the package's tests run on one hosted in
TestHost/: a minimal application (an empty window) and an Xcode project whose unit-test
target compiles the same test files against this package by its path, with the corpus in
its resources and local networking allowed for the loopback origin and relay. The package
itself is unchanged for consumers. The tests import WaiSink plainly (they use only its
public interface) and read the corpus from Bundle.module in the package, from their own
bundle in the host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.message and wai.live.call: the extension, the wai-rs module and its corpus ... 3889071abf

extensions/live-messaging.md: a conversation is an end-to-end encrypted room
with a conversation statement (WMC1); each member's messages track carries
sealed message records (WMG1: text, reply in a thread, reaction, edit,
retraction, each target named by its link hash) signed into the member's
receipt chain; the clock's epoch statements (WME1) name each epoch's roster;
acknowledgements (WMA1); a history store's contract; calls (WCT1, WCI1, WCA1).

wai-rs feature live_messaging: every record, sealing and opening per
confidentiality §4, the conversation verifier a store uses for its checks,
what a principal is owed, the call verifier, and the corpus generator
(live-conformance/messaging/vectors.json).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.live.remote: key, text and clipboard actions sealed to the host; the commitment level and the opened level ... 5452b60cca

A host states a sealing key (an X25519 public key) as its screen statement's last field. A
controller seals every key, text and clipboard action to it: a sealed action (type 8) keeps in the
clear the type it seals, its dt_us, a clipboard text's length and a salted commitment binding its
fields, its order and its author; the statement ends with one HPKE seal (RFC 9180 base mode,
DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM) of the actions' openings. Pointer, wheel and
touch actions stay in the clear. §5.3 gains rule 8 (input_unsealed) and rule 9 (input_bad_seal),
§12 a fourth table (seal_no_key, seal_not_opened, seal_unreadable, seal_commitment), §11.4 the two
verification levels.

wai-rs: Input::seal, Input::open, commitment, decide_opened, verify_opened; HPKE moves to a crate
module behind its own feature (hpke), which telemetry_aggregate and remote_desktop both use. The
corpus keeps its 42 vectors byte for byte and appends ten sealed ones, each stating the opened
level; remote_desktop_verify.py checks both levels.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the remote page seals keys, text and clipboard text to the host, and shows a viewer who is typing, never what ... 6e9f36ef27

remote.js writes and reads sealed actions and seals (remote-desktop §5.5) with WebCrypto's X25519,
HMAC and AES-GCM: HPKE base mode (checked against RFC 9180 A.1.1), the openings and their
commitments. The viewer seals every key, text and clipboard action to the sealing key of the
host's screen in effect and sends none in the clear: to a host that states no sealing key it
sends no key, text or clipboard action. A composed text longer than a text action carries goes as
several. In a remote room the page follows every present principal's events, and shows that a
controller is typing or pasting, never what. Its tests seal every corpus input that opens again,
byte for byte, from what the corpus's opened level states.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-remote: a sealing key a session, sealed inputs opened before they are injected; TLS to the room service and the relay ... 91271ef917

The host makes an X25519 sealing key for each session and states it in its screen statement; the
gate decides every input by all nine rules of remote-desktop §5.3 (wai-rs's decide_opened),
opening a sealed input with the session's opening key, and the host injects what it seals. The
opening key stays in the session unless --opening-key writes it (mode 0600, never over a file)
for a verifier. The headless viewer seals its key, text and clipboard actions to the screen's
sealing key, keeps the records it receives, and follows another principal's events when told.

The agent reaches the room service over https:// and the relay over wss://: rustls with ring,
the system's roots and any certificate a PEM file names (--ca), every chain and name verified.
tls::front is a TLS front for a plain backend. Lock files gain tokio-rustls and the new edges
alone.

tests/tls.rs: the service and the relay through a TLS front, trusted by a PEM file; refused under
the system's roots alone, and for a certificate that names another host. tests/loopback.rs:
alice's typing sealed, injected as typed, absent from what bob receives; her text in the clear
refused input_unsealed; the session verified at the opened level.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: a bound on the clock's record store of a remote session, which ends the session ... 7433aebb90

[remote] max_records (100000 by default, 16 to 10000000): the clock holds at most that many of
a session's principals' records. When a record would pass the bound it holds none past it and
ends the session: every present principal's leave (reason 2) signed after its last record taken,
the host's last; GET /room's remote states ended "max_records", the records held and those over
the bound; the session it holds stays whole and verifies, and the next host starts a new room.
Ending rather than refusing inputs past the bound: a record the clock did not hold would leave a
hole in its author's chain, the host would decide inputs the clock never held, and an input's
refusal is the host's to state. The host agent stops at its own leave.

tests/remote_room.rs: the host reaches the service and the relay through TLS fronts; alice's
typing goes sealed, is injected as typed, and is absent from what bob receives and from the
session the service serves to a viewer's grant; the session verifies at the commitment and the
opened levels; and a session at a bound of 40 records ends, whole and verified.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web e2e: the remote scenario types, composes and pastes, sealed; a viewer receives no trace; both levels verified ... 5adfd42599

Alice's page types a string, composes a text and pastes one; each goes sealed to the host's
sealing key. Bob's page, a viewer's that follows her events, shows that she is typing and holds
no trace of what in the records it received, which a positive control finds for a text alice's
page is made to send in the clear, which the host refuses input_unsealed. The host writes its
opening key (--opening-key) and, from its recorder, digests of what it injected
(--record-injected): the keys, the text and the clipboard text alice typed. The sessions the host
and the clock hold verify by remote_desktop_verify.py as a viewer verifies them and under the
opening key, every seal opened to what alice typed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-messaging: the independent verifier, written from the extension's text ... d07295fdc3

live_messaging_verify.py reads descriptors with live_rooms_verify.py, Key IDs,
keys, AES-GCM and plaintexts with e2ee_verify.py, and implements the rest:
every record, the receipts-track object of jwp-receipts' binary form, a
conversation entry by entry, what a principal is owed, and calls. It agrees
with wai-rs on every vector, fails every mutated copy of the corpus, and
catches each of its own checks dropped. The corpus gains receipt-level and
plaintext-level controls, a conversation under AES_256_GCM_SHA512_128, and
history requests that state whether the requester is admitted (§9.3).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-mls: a conversation's commit rule, any member the commit does not remove ... 5db2f879b4

CommitRule::AnyMember (WAI live-messaging §7.2) beside the room's lowest-leaf
rule (confidentiality §5.5, the default): RoomMember and Clock check commits by
the rule their model holds, and a page's E2eeMember opts in with
anyMemberCommits(). A model test holds both rules.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: conversations with a durable history store, and calls with inboxes ... 6c4b48b5a7

[messaging]: the service keeps one conversation, an end-to-end encrypted room,
in a history store on disk (conversation.json and an append-only journal, each
append on stable storage before the answer, a torn tail dropped). Members join
by a proof of their key, key through the service's log with any member
committing, post sealed messages and acknowledgements that wai-rs's
Conversation checks before they are taken, and read the log as live-messaging
§9.3 owes it. A restart replays the journal and checks every regenerated
proposal and epoch statement against it.

[call]: a call descriptor the authority signs, invitations the caller signs held
in each callee's inbox, answers checked by wai-rs's Call, the clock's missed
call at each deadline, and grants for the caller and each callee that accepts.

tests/messaging_room.rs and tests/call_room.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-conformance/remote: the sealed vectors, the opened level and the seal seeds, described ... 69d93f59ae

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the remote page's sends run in the order they were asked for ... ebab8e16cd

A seal takes WebCrypto's time, so a send that seals could finish after a later one that does not:
a key's release could reach the host before its press. The viewer's sends now run one after
another; what arrives while one is sent goes at the next refresh with its actions' instants as
they were (the batch is no longer re-stamped). A test holds the order while a slow seal is made.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web e2e: the remote canvas scrolled into view before alice clicks it ... 7ade5fc002

Bob now enters before alice types, and what alice's page shows above the canvas grows when he
joins: the click is made where the canvas is on screen.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-remote: the opening key in a type no Debug writes out ... f96389a387

Config and Report derive Debug; the session's opening key is held as OpeningKey, whose Debug is
OpeningKey(..).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a messaging view and a call flow beside the room page ... 02622a7fd1

web/room/messages.html: a member of a conversation in a page. It joins with a
proof of its own key, keys through the service's log with joule_moq_web_e2ee's
member (any member commits), seals each message before it is signed into its
receipt chain and posted, opens and verifies every message (wai_live_web's
Messages, live-messaging §11), shows threads, reactions, edits and
retractions, and acknowledges what it read.

web/room/call.html: a page's inbox, each invitation checked with its call
before it rings (callCheck); placing a call, ringing, accepting, declining and
cancelling; the call's media through the room page in a frame, which now takes
a grant handed to it (enter(role, { seed, answer })).

wai-live-web: the messaging records, receipts, acknowledgements, invitations
and answers a page signs, and Messages, verified against the corpus in its
tests. joule-moq-web: keyProofHttp, a proof naming no grant.

e2e/messaging.e2e.mjs (run by e2e/run.sh): the messaging scenario and the call
scenario.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-messaging: registry, SPEC §5, CHANGELOG, CI and the services' documentation ... 286f5af7ca

wai.live.message and wai.live.call registered as records, their seven magics as
wire identifiers, and the export regenerated. SPEC §5 says what each is;
confidentiality §5.5 names the conversation's commit rule. wai-conformance runs
tests/live_messaging.rs and live_messaging_verify.py; joule-moq-web's job
requires the messaging and call scenarios to pass. joule-moq-room's README and
example configuration describe [messaging] and [call].

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: a record bound per principal, which cuts and removes the principal that reaches it ... 0116674570

[remote] max_records_per_principal (100000 by default): the clock holds the records of seq 0 up to
the bound of each principal but the host. When a record past it comes, the clock takes the
principal's records up to the bound, cuts it there (max_records_per_principal, by the cut path a
record out of order takes) and removes it (leave reason 2); the session goes on for everyone
else and verifies. The host agent reads the bound from GET /room and its gate cuts the principal
at the same record, so the two hold the same records. The host has no bound of its own: its
outcomes answer the others' inputs.

max_records stays as the safety net on the whole session and rises to 1000000, ten times the
bound per principal: a host and four controllers each at its bound hold 800000. The default per
principal: a two-hour session at ten input statements a second is 72000 records; a flood at the
policy's 120 events a second reaches the bound in about 14 minutes. remote-desktop §10 says a
service bounds per principal first, which bites first and why; the configuration docs say the
same.

tests/remote_room.rs: bob, a viewer, floods input statements the host refuses past a bound of
24; he is cut at seq 24 and removed by the clock and by the host, alice's input after the cut is
applied, the session's total is not reached, and the sessions the clock and the host hold verify
at both levels. gate::tests: a participant cut at its bound.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room tests: the flood test states whether the session ended when bob is not cut ... e8c747ec83

Co-Authored-By: Claude Opus 5.5 <[email protected]>

staged_verify.py: the projection descriptor applies to a video rendition (#446) ... e2f9e8832b

SPEC §7.1 rule 2, as the train's SPEC states it: an HDR descriptor or a
projection descriptor applies to a rendition whose payload is video. #446 taught
wai-rs (codecs::companion_applies) and not the independent Python reading that
claim_verify.py and http_verify.py share, so a WAI2 with a projection companion
over a video base was a conforming table to wai-rs and a broken one to Python.
On the train, claim-conformance/differential.py --random 2000 --seed 1 drew such
a table (31135_session_roles_companion_wai.meta.projection): wai-rs accepted it
and claim_verify.py refused it, session_layer_not_applicable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #490 (wai/remote-input-seal @e8c747ec): sealed input in remote rooms ... 8e8e067f6a

Stacked on #489; merged at the head. Its corpus (live-conformance/remote/: #489's
42 vectors unchanged, then 10 sealed vectors) is taken whole. The train's
[remote]+[world] refusal, made before #490 arrived, is kept.

Conflicts, both sides kept:
- wai-rs Cargo.toml: #490's telemetry_aggregate on the new hpke feature, and
  hpke itself, beside #446's format_probe. Every build with telemetry_aggregate
  or remote_desktop gets hpke through the feature, the independent verifiers'
  union among them.
- wai-conformance.yml's remote desktop step: #477's union feature list with
  #490's test filter (remote_desktop:: and hpke::).
- joule-moq-room's README: #490's account of the record bounds and of sealed
  input, ending with the train's list of the modes a remote room is not also
  (now with the world room).
- room.e2e.mjs's account of the remote scenario (#490's) beside #482's world
  scenarios; CHANGELOG, #490's entry on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live messaging: regenerate the corpus, a removed member's held-back message ... 01f3aac11f

The corpus is regenerated from its seeds since history entries name whether
the principal was admitted. The room test now has a removed member post a
message it sealed before its removal: the service refuses it (not_a_member)
and a verifier refuses it (sender_not_member). The crate README names the
messages and call pages and their e2e scenarios. Clippy notes in the slice's
files are resolved.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #493 (wai/messaging-calls @01f3aac1): wai.live.message and wai.live.call, conversations and calls on live rooms ... beb4679dc6

Merged last, as asked. Conflicts, all adjacent additions, both sides kept:
- joule-moq-room: Cargo.toml's wai features (live_world, remote_desktop and
  live_messaging); lib.rs's modules (messaging, msgstore, remote), Config's
  remote, messaging and call, Service's remote, messaging and calls, the epoch
  through remote::epoch with the conversation and calls opened beside it, and
  settings()'s refusals (#482's world room, #493's conversation and call); the
  README's world, conversation and call sections.
- joule-moq-web: app.js asks a remote room's grant as #489 does and takes a
  given grant as #493 does (a remote page's fallback to viewer only when it
  asked); run.sh runs room.e2e.mjs (now with --remote) and messaging.e2e.mjs,
  each its own --only scenarios; the usage names every scenario.
- workflows: joule-moq-room.yml's and joule-moq-web.yml's accounts;
  wai-conformance.yml's WAI_FEATURES gains live_messaging (#477's union) and
  the first step's test build names live_messaging beside the train's targets.
- wai-live-web's wai features (stream_termination, live_world, live_messaging),
  wai-rs lib.rs's modules, registry.rs's capability list, REGISTRY.md's rows;
  CHANGELOG, #493's entry on top.
- capabilities.json and v2.ttl regenerated (registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: a conversation or a call is not also a world room or a remote desktop room ... 0c69071b38

With #482, #489 and #493 in one tree, settings() refused a conversation beside a
watch room, co-performance, admission by age, [room] e2ee or a call, and a call
beside the first three, but took either beside [world] or [remote]: a
conversation is the service's whole room, a call room's grants come with its
call, and a world room's and a remote desktop room's grants, tracks and clocks
are their own. Both refusals now count the shared world and the remote desktop
room among the modes they do not share a service with (remote::service already
refuses [remote] with [world]). The README and the example configuration say so.

a_conversation_or_a_call_is_not_also_a_world_or_a_remote_room: each of the four
modes alone is read and its settings made; each of the four pairs is refused
with its reason named.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-conformance: features-alone checks live_messaging alone (#493) ... 63cf067e38

#493's independent-verifier step builds with #477's union; under #477's rule its
feature list is still checked alone in features-alone.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (0855f00d1): #492, zstd 0.14.3 and the avx2 leg on the framework runner ... d3be3fec5a

No conflicts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-remote (#481): its lock on zstd 0.14.3, as #492 moved every other ... d2ae29c527

joule-moq-remote is a workspace of its own, which #492 (on main) could not see;
through joule-moq it reaches the zstd crates #492 moved for RUSTSEC-2026-0391,
-0398, -0403 and -0410. Resolved with cargo metadata (resolve only): zstd
0.14.3, zstd-safe 8.2.0, zstd-sys 2.1.2, and nothing else. check-lockfiles.sh:
53 lockfiles, all current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-swift TestHost: adopt the scene life cycle ... 59bfbbfd9b

The platform now refuses to launch an application without the scene life cycle ("UIScene
life cycle is required"), so the test host quit before its tests connected. It is a
scene-based application now: an App with one WindowGroup, and the generated Info.plist
carries its scene manifest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #480's new head (wai/sdk-native-apple @59bfbbfd): the Swift tests on a device ... 7933772adb

Three commits on top of 05fb22cc, which the train merged earlier: the tests read
the corpus from their own bundle, a TestHost app they run inside on a phone or
tablet, and its scene life cycle. They touch only wai/wai-sink-swift/; no
conflict.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: a SUBSCRIBE that asks for a rendezvous waits past it for the relay's answer ... 6690e26684

The page asked the relay for a 10 s rendezvous on each world and room track
and waited 10 s for the answer. With no publisher, the relay answers when the
rendezvous ends, so the two timers raced: on a loaded host the page gave up
("SUBSCRIBE: no answer in 10000 ms") as the refusal was sent, and world.js,
which follows a departed actor's track on that refusal, never saw it. The
world scenario's "dave catches up after alice left" failed so on the train's
Studio run.

request() takes how long to wait for its answer; subscribe() waits a step
past the rendezvous it asks for. session.test.mjs holds the three cases with
the clock mocked; without the change its first case fails with the e2e's
error.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (99fd7d1e3): #494, the person's rules for wai-quantum proposals ... de7fe1b91b

Clean: wai-web-wasm.yml (main's engine test count beside #463's platform
bundle step), the CHANGELOG (main's entry in main's quantum section) and
quantum-studio's main.js (#463's measured-figure rule beside main's rules).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-swift: simulator tests hosted in TestHost, in a fresh simulator, every step bounded ... 850eeefe64

scripts/test-simulator.sh no longer spawns the XCTest agent through simctl, which hangs
once the host's simulator service is current. It runs the tests the way a device does:
it creates a fresh simulator (the newest installed runtime of the platform, the first
device type of its family), boots it, builds the test host for it (build-for-testing)
and runs the tests hosted in it (test-without-building), then shuts the simulator down
and deletes it however the run ends. Each step has a hard limit (boot 300 s, build 900 s,
tests 600 s by default) and fails, naming the step, when it passes it. TestHost now
builds for phones, tablets and televisions, so the television simulator runs the same
tests. wai-sink-swift.yml bounds each step as well.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge #480's newest head (wai/sdk-native-apple @850eeefe): simulator tests hosted in TestHost, every step bounded ... 7086a59a5f

One commit on 59bfbbfd, merged above: test-simulator.sh runs the tests in
TestHost through xcodebuild on a fresh simulator it creates and deletes, with
a hard limit on every step, and the workflow's simulator steps have a
30-minute timeout. Clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (ea2a6defd): #495, what is new in a wai-quantum proposal ... 8cbbea2b69

Clean: wai-web-wasm.yml (main's engine test count beside #463's platform
bundle step), the CHANGELOG (main's entry in main's quantum section) and
quantum-studio's main.js.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-web-wasm: the native unit tests are 36, with the world's estimate label test (#463) ... 3a3bbfc16e

#463 added world::tests::the_pages_figure_is_sealed_as_an_estimator to
wai-web's library and left the step's count at 35, so the step fails on the
train's tree ("36 passed" read where "35 passed" is required; seen on the
Studio). #463's own run of this job was cancelled, so it never showed. The
count is now 36, and the comment names the test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (907c46889): #497, a person's taste in wai-quantum ... 5b79d1550d

Clean: wai-web-wasm.yml (main's engine test count, 11, beside the train's
platform bundle step and native count), the CHANGELOG (main's entry in main's
quantum section) and quantum-studio's main.js.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request 2026-10-26 18:24:43 -04:00

WAI for coding agents: wai mcp, the room service's API in OpenAPI 3.1 held to the code, wai setup-agent #500

dcharlot referenced this pull request 2026-10-26 18:54:18 -04:00

joule-ui: the line language (§11), and Create: describe a WAI app, watch it build, export it (wai-ui) #501

dcharlot referenced this pull request 2026-10-26 19:26:22 -04:00

wai: the developer's path (hello, create, dev, verify), the floor with no system library, nine examples, and the quickstart archive #502

dcharlot added 7 commits 2026-10-26 19:26:45 -04:00

neural sink: a several-file candidate is not dispatched, so the set-form test passes it by (#446) ... a89d1e93da

several_file_capabilities_need_the_set_form walks every capability whose
parameter set is several files and expects form_required. #446 registers
wai.image.ieee1857_11 as a candidate, and a NeuralFloat capability, so several
files: the shape is right, and so is the sink, which treats a candidate as
unsupported (SPEC 5) and finds nothing to decode ("no model registered"). The
test's premise was every such capability the reference sink dispatches; it
now says so with codecs::is_dispatchable, and checks that a several-file
capability it does not dispatch is a candidate the sink refuses to decode.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ledger CI: the linux job's smoke checks run on Python 3.11 (#473) ... ca55cbfafc

smoke.sh ends with receipt_ledger_verify.py, which imports pack_verify.py,
which reads TOML with the standard library's tomllib (3.11). The linux
runner's image has Python 3.10, so the step failed on the import. The job
now sets up Python 3.11 as wai-key-proxy's does, and the step says so first
if the python3 it finds has no tomllib.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-sink-android: read a tool's output whole before searching it (#488) ... c6abab6581

The AAR check failed in CI with "the AAR has no jni/arm64-v8a/libwai.so"
although the libraries were built and packed: under pipefail,
`unzip -l | grep -q` fails whenever grep stops at its first match before
unzip has written the rest (SIGPIPE). On the AAR the Studio built, that
pipeline fails 7 times in 300, and the listing read first 0 in 300. The
workflow's AAR check reads the listing once and prints it on a failure;
build-native.sh reads nm's and readelf's output whole too, where the same
race could report an export or a NEEDED entry missing, or let a LOAD
segment's misalignment through.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-web reach: the menu workload holds a package to the capabilities it registers ... b518ffcf32

The record leg's builds failed the menu workload: the package of record is
built from 248846f1, and the tree's registry now has a candidate that
package does not know, #446's wai.image.ieee1857_11, so the package's
isCandidate disagreed with the registry. A package cannot emit or dispatch a
capability it knows nothing of; the workload now compares candidates for the
capabilities the package registers and lists the rest as `newer`. The tree's
build registers every capability of the registry it is exported from, so on
the tree leg `newer` is empty and nothing is passed by.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

private world: a page follows the actors' tracks before it publishes its own (#482) ... 8ab46dfb02

privateworld failed in CI on "carol replays the world from its start". A
member's carry for an epoch is published once, when it applies the commit;
the commit that adds a page follows its join, and the clock records the join
when the page's world track appears. The page published first and followed
the clock and the actors' tracks after, so on a loaded host the carries
could go out before its subscriptions, and no wait would bring them.

A publishing page in a private world now reads the room's log to its present
end, follows every actor it records and waits for each subscription's answer,
and publishes after (E2ee.readToEnd, WorldClient.followActors). live-worlds
8.2 says a member that enters SHOULD; the e2e checks that carol followed both
members before she published.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (f1a34c068): #498, wai-quantum 0.6.16 and wai-quantum-cli 0.1.4 ... 27c38a8b08

Clean: wai-web-wasm.yml (main's engine test count, 13, beside the train's
platform bundle step and native count), the CHANGELOG (main's entry in main's
quantum section), quantum-studio's main.js, and the wai-rs and joule-moq-room
locks (main's wai-quantum 0.6.16).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-audit, wai-key-proxy, wai-ledger: their locks on wai-quantum 0.6.16, as #498 moved it (#474, #471, #473) ... f004aa4f9c

Each lock resolves its path dependency's new version and nothing else (cargo
metadata, resolve only).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit bf39ec9a63 into main 2026-10-26 20:23:52 -04:00

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

Merge pull request 'wai merge train E: twenty-five PRs onto main, the relay's upstream window bounded, and three fixes the merged tree needed' (#499) from train/wai-e into main

dcharlot referenced this pull request from a commit 2026-10-26 20:55:59 -04:00

joule-contrib: count what an SRT sender holds unacknowledged; the SRT ingest test closes after the drain

dcharlot referenced this pull request from a commit 2026-10-26 20:55:59 -04:00

joule-contrib: an SRT sender probes a stalled tail; live-contribution §4.1 says so

dcharlot referenced this pull request 2026-10-26 20:56:10 -04:00

joule-contrib: an SRT sender probes a stalled tail, so a lost newest packet is recovered #503

dcharlot referenced this pull request 2026-10-26 20:57:18 -04:00

wai-ops/1-npu on a neural processor: exact on every subset vector, and where the unit is not (G2) #440

dcharlot referenced this pull request 2026-10-26 20:57:24 -04:00

wai: scene and prior carriage — MPEG-I scene description and USD both ways, priors in safetensors, GGUF and NNC under an integer-quantised profile #445

dcharlot referenced this pull request 2026-10-26 20:57:31 -04:00

B3r: register JPEG XS, MV-HEVC, a projection descriptor and IEEE 1857.11 (candidate); header probes for them and for VVC, LCEVC, MPEG-H, AVS3; CMSD reading; LOC carriage #446

dcharlot referenced this pull request 2026-10-26 20:57:37 -04:00

wai.avatar.face: a talking head generated the same bytes on every sink from a signed keypoint track and an identity prior (AVTR) #448

dcharlot referenced this pull request 2026-10-26 20:57:44 -04:00

DET1: what exactness costs int_hyper, measured on the reference set, and what WAI claims from it (determinism-tiers §7) #453

dcharlot referenced this pull request 2026-10-26 20:57:50 -04:00

PERF1: int_hyper's integer decode on NEON, AVX2 and AVX-512 narrow kernels — the same bytes, re-measured (stacked on #453) #467

dcharlot referenced this pull request 2026-10-26 20:58:00 -04:00

wai: what nobody watches is ended with a receipt, and no bits above the panel (EN-B) #457

dcharlot referenced this pull request 2026-10-26 20:58:06 -04:00

wai: sink energy — sink profiles, a measured decode table, segment receipts and the per-hop split #460

dcharlot referenced this pull request 2026-10-26 20:58:13 -04:00

wai: the energy order of dispatch, a self-metered relay, HwShunt closed to new profiles, meters that seal what they read, and what fewer bytes do not save (EN-C) #463

dcharlot referenced this pull request 2026-10-26 20:58:20 -04:00

wai: stitched presentation — player-signed claims of stitched and interstitial ads, the signed pod-input record, ad frames in live-compose #470

dcharlot referenced this pull request 2026-10-26 20:58:26 -04:00

wai: receipt ledger — a signed tariff, invoices that cite their records, ad and delivery reports, and the wai-ledger service #473

dcharlot referenced this pull request 2026-10-26 20:58:33 -04:00

wai: key release — the proxy form of wai.video.keys and a signing proxy in front of any licence server #471

dcharlot referenced this pull request 2026-10-26 20:58:39 -04:00

wai: stream audit, an audit kit for streams another service delivers (RI1) #474

dcharlot referenced this pull request 2026-10-26 20:58:45 -04:00

wai: the native sink — its C interface (wai_sink_*), and the Swift package for the platform player (SDK-A) #480

dcharlot referenced this pull request 2026-10-26 20:58:51 -04:00

joule-moq-relay: relay-to-relay cascading, one live room across relays, the WAI evidence at every hop #475

dcharlot referenced this pull request 2026-10-26 20:58:57 -04:00

joule-moq-ingest: Enhanced RTMP v2 ingest, and SCTE 104 automation into signed cues (wai.live.injection) #479

dcharlot referenced this pull request 2026-10-26 20:59:03 -04:00

live-contribution: SRT and RIST contribution ingest, with a signed link record #483

dcharlot referenced this pull request 2026-10-26 20:59:10 -04:00

wai.live.remote: remote desktop in a WAI room — screen statements, input under the control power, outcomes recomputed, the floor, latency records; host agent and browser viewer #481

dcharlot referenced this pull request 2026-10-26 20:59:16 -04:00

wai.live.world: a shared world in a live room, on the room stack #482

dcharlot referenced this pull request 2026-10-26 20:59:22 -04:00

wai.video.encode: AVC and HEVC through the encoders a device already has, in the CLI and the packager, each encode's maker in a signed record (ENC) #484

dcharlot referenced this pull request 2026-10-26 20:59:28 -04:00

wai-sink-android: the native sink as a Kotlin library (AAR) over the C interface #488

dcharlot referenced this pull request 2026-10-26 20:59:34 -04:00

Room service: remote desktop rooms ([remote]); the host agent and the page join them (CX2b, stacked on #481) #489

dcharlot referenced this pull request 2026-10-26 20:59:40 -04:00

wai.live.remote: what a controller types is sealed to the host; TLS in the host agent; a bound on the clock's record store (CX2c, stacked on #489 and #481) #490

dcharlot referenced this pull request 2026-10-26 20:59:47 -04:00

wai.live.message and wai.live.call: conversations and calls on live rooms #493

dcharlot referenced this pull request 2026-10-26 23:00:08 -04:00

wai: the developer's path (hello, create, dev, verify), the floor with no system library, nine examples, and the quickstart archive #504

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!499

No description provided.