### The route record states what a hop delivered by its count and root, so a hop may deliver any number of objects

- **Route record version 3** ([extensions/route-record.md](extensions/route-record.md) §3.4, §5.2, §6, §6.1), on a
  price book of version 2: the attempt that served states `delivered`, the count of the objects it delivered and their
  commitment (the root its hop's receipt already names), not their list; a failed attempt, `0` and zeros. Version 2's
  list states at most 1024 outputs and grows with them, and a package of a long title holds an object per piece and
  rung, thousands; a record of version 3 is the same size whatever was delivered, and nothing a hop signs changes. The
  served hop's receipt is held to the root (`receipt_output_mismatch`). A record of version 1 rests on a price book of
  version 1, and one of version 2 or 3 on one of version 2 (`pricebook_mismatch`). Records of versions 1 and 2 read and
  verify exactly as before.
- **An output's inclusion proof** (§6.1): `index` and `siblings` from the leaf up, held as jwp-receipts §3 step 5
  holds an object's: the index below the count, exactly ⌈log₂ count⌉ siblings, the walk ending at the root, so the last
  node of an odd level is proved at its own index only. `route_record::output_proof` makes one and
  `route_record::verify_output_proof` checks it; `route_record::seal_committed` writes a record of version 3.
- **The receipt ledger** ([extensions/receipt-ledger.md](extensions/receipt-ledger.md) §5.1, §4.8): a job source whose
  route record is of version 3 gives each output `proof`, and an output is one its hop delivered when its proof holds
  its object to the served attempt's count and root (`output_not_delivered` otherwise; a missing or misshapen proof,
  or one under a record of version 1 or 2, `malformed`); a decode of version 5 is held to its places and its count. The
  count is the router's statement, which only the objects check; a count stated larger lets one object be proved at a
  second place, and no source bills one object twice. Every tariff version that reads job sources reads them.
- **The corpora.** Routes 109 → 126 vectors: six accepted of version 3 (one output, three, 5,000, a failover, a late
  hop, receipts not checked) and eleven controls, the unknown-version control now of version 4.
  `route_record_verify.py` reads version 3 and has the proof check (`inclusion_proof`); two more checks dropped
  (`delivered-form`, `receipt-root`). Ledger 108 → 120 vectors: one accepted (an encode, a decode of version 5 and a
  package's run of 1,501 objects, each output proved) and eleven controls; `receipt_ledger_verify.py` checks every proof
  with the route verifier's `inclusion_proof`, one more check dropped (`output-proof`), three more mutated copies.
- **Breaking:** `record:corpus:wai/live-conformance/routes/vectors.json`: the control `record_version_3` is now
  `record_version_4`, a record of version 4 refused `unknown_version` as before; every other vector keeps its outcome,
  and the new vectors are added.
- **Breaking:** `api:rust:wai::route_record::Accepted::delivered`: an accepted record of version 3 states what its
  served hop delivered by its count and root, which `Accepted` carries in this new field (`None` for records of
  versions 1 and 2, as `outputs` is `None` for version 3). A struct literal or an exhaustive pattern of `Accepted`
  outside the crate adds the field, or matches with `..`.

