### Ad presentations counted over a bearer with no return path

- **Impression aggregates** ([extensions/impression-aggregates.md](extensions/impression-aggregates.md)),
  the record `wai.delivery.impressions`, and telemetry-aggregation's measure 5 `impressions`: a
  receiver judges each shared stitched ad it presented by stitched-presentation's rules (steps 1
  to 10), and reports each presentation once as a Prio3Histogram report of a DAP task of that
  measure: creative × region × quartile in the vector, the hour in DAP's own batch bucket. The task
  layout, statements (`WQS1`) and receipt (`WQA1`) are telemetry-aggregation's; a reader checks
  that the result's elements, as integers, sum to the report count (age-assurance's
  `count_mismatch` otherwise) and that the batch lies in the flight, and an accepted receipt states
  telemetry-aggregation's outcome and whether its reports were checked.
- **The records**: the catalogue (`WIC1`) fixing which index is which creative, region (rung-price
  §2's codes, and `other`) and quartile, bound as the task's scope; the task file (`WIT1`), whose
  signer a receiver confirms under its pinned key log with the new pinned-only authority
  `aggregate/task` (jwp-receipts §7.5), so a task key can be revoked over the bearer; the upload
  file (`WIU1`) relays forward unchanged. The registry lists the three magics and the report
  extension, the last under a new kind of wire identifier, `dap-report-extension`.
- **One-way delivery**: a report is generated once, stored and re-sent until settled (never
  regenerated); a duplicate is discarded by its id; the leader holds each collection for the
  catalogue's `hold_s` and aggregators keep the task until its retention instant, so late reports
  count; one arriving later is lost, never a phantom. With `attest`, each report carries a Privacy
  Pass token bound to its task and id, in a private report extension (`wai_impression_token`,
  0x5749, proposed for DAP's registry).
- **What a reader derives**: the table per batch and in total, presentations and five quartile
  counts per creative and region, a row under fifty flagged, whether each receipt's reports were
  checked; a lower bound of reported presentations, never an audience, and its own class, never
  billed as presented.
- **Beside it**: telemetry-aggregation registers measure 5 (§3.1), its scope (§4.1), its rule 3
  (§4.3), its reports (§5.1) and its receipt check (§8.1) by reference to the extension, and
  measures 1 to 4 are unchanged. The reference client seals to the first configuration of DAP's
  suite in each list; the reference aggregators hold a report's extensions to a rule (none, for
  measures 1 to 4) and a collection until a batch's end and the hold have passed (a hold of 0 for
  measures 1 to 4). `aggregate/task` joins the pinned-only authorities of `key_log` and
  `signer_verify.py`. The QoE, stitched, key-log and signer corpora are unchanged.
- **The corpus** [`live-conformance/impressions/`](live-conformance/impressions/): catalogues,
  tasks and task files (key-log confirmation among them) with a control for each rule and both
  sides of every bound, contributions, end-to-end flows, uploads, plans, settlements, receipts and
  tables. `impression_aggregate_verify.py` is a second implementation.
- **Breaking:** `api:rust:wai::telemetry_aggregate::measure::MEASURES`: the measures with
  `impressions` (5) last, an array of 5.
- **Breaking:** `api:rust:wai::telemetry_aggregate::measure::Task::new`: refuses with the code of
  the rule that fails, `Result<Task, &'static str>`, as `Task::with` does, which takes the rule 3
  of a measure whose VDAF telemetry-aggregation §3.1 does not fix; `new` refuses measure 5
  `catalogue_mismatch`.
- **Breaking:** `api:rust:wai::telemetry_aggregate::receipt::Refusal`: a code and a place,
  `(&'static str, &'static str)`, so `receipt::verify_with` can refuse a task with another text's
  code.
- **Breaking:** `api:rust:wai::telemetry_aggregate::aggregator::client_report`: takes each
  aggregator's HpkeConfigList and seals to the first configuration of DAP's suite in it
  (`aggregator::choose`), and takes the report's public extensions and each input share's
  private ones.
- **Breaking:** `api:rust:wai::telemetry_aggregate::aggregator::Aggregator::rule` and
  `api:rust:wai::telemetry_aggregate::aggregator::Aggregator::reasons`: the rule an aggregator
  holds a report's extensions to (`ReportRule`; `Aggregator::new` holds telemetry-aggregation §5.1's,
  no extension) and the WAI reason it recorded beside a report error, which a struct literal of
  `Aggregator` needs.
- **Breaking:** `api:rust:wai::telemetry_aggregate::aggregator::Leader::collect`: takes the
  instant `now_s` and the hold `hold_s`, both in seconds, and returns `Ok(None)` while the job's
  batch has not ended `hold_s` seconds before; a task that holds no collection passes 0.
- **Breaking:** `api:rust:wai::codecs::registry::WireKind::DapReportExtension` and
  `api:rust:wai::codecs::registry::WireKind::all`: the kind `dap-report-extension`, which an
  exhaustive match over `WireKind` needs, and the list of kinds that holds it, an array of 18.
