### The receipt ledger bills what the work spends: bytes out, a package's work per run and its storage, every hop's energy, the output its hop delivered

- **A job's output is the object its hop delivered** ([extensions/receipt-ledger.md](extensions/receipt-ledger.md)
  §5.1): an output's object is its `codestream`, named by its content hash, and where the job's route record states
  what its served attempt delivered (route-record version 2, `outputs`), each output receipt a job source gives is of
  one of those objects, once, or the source is refused **`output_not_delivered`**, at `outputs` and its index. A line
  bills a job's subpixels from its output receipts, so a receipt of an object the hop did not deliver billed subpixels
  nobody delivered for that job, and one given twice billed them twice. The route record binds the hop's receipt to
  its outputs (#552); this binds each output receipt to the same outputs. It holds under tariff versions 3 and 4; under
  version 4 a record of version 1, which states no outputs, holds its outputs to none, and under version 3 its outputs
  are read as before.
- **Routing figures are never charges** (§5.1): a route record's `cost`, `energy`, `expected_cost`,
  `expected_ttfb_ms`, and its price book's `price` and `failures`, are the router's figures for choosing an endpoint;
  no line reads them, and a job line bills its billed attempt alone, at the tariff's price the buyer signed. Two
  controls hold it: a failed hop counted as a job, and a job line at the router's list price, neither recomputes.
- **The room-session receipt, version 2** ([extensions/live-metering.md](extensions/live-metering.md) §4.1, §4.4,
  §4.6): a sixteenth unit, `bytes_out`, the payload bytes the hops sent the session's sessions, summed from their
  ledgers' `bytes_out` (§3.4), and a fourteenth tariff price, per 10^9 of those bytes. What delivering a session costs
  scales with the bytes carried as well as with the time it ran. A grant's consumption entry states its `bytes_out`
  (206 bytes), and its funds are ⌈(1000 × *N* + `bytes_out` × the price) / 10^15⌉ minor units, the time and the bytes
  rounded up once together. The ledgers count exactly the sessions under a grant or none, so the grants' bytes out sum
  to the receipt's; a hop link's bytes, which no ledger holds, are carriage between relays and are not counted. A
  receipt of version 1 reads, verifies and prices exactly as before; a version-1 reader cannot read version 2.
- **Tariff version 4** (receipt-ledger §4.7; `WLT1`, `WLI1` with version byte 4) prices three more things by what
  spending on them scales with. A **room's bytes out**: a fourteenth room price, a room line of unit `bytes_out` from a
  receipt of version 2, and a receipt that states a tariff states all fourteen prices (one of version 1 states no
  price of bytes, read as 0, so its funds conflict with a tariff that prices bytes). A **package's work, per run**:
  packaging is deterministic, so a package made again (a customer asking for the work done and measured again) gives
  the same receipt from a run that did the work again, and every version before billed a package once per receipt and
  refused it. In version 4 a package has a job's shape: the run that made it, a routed job of `package.build` whose
  output is the package (its receipt's text the object its hop delivered, verified against its indexes), is the work,
  billed once per run at the tariff's job prices per job and per **work unit**, a new job unit, the package receipt's
  `work_units` (packaging §9.1), the work its figure is expressed against; the package receipt is the product, cited
  by each run and billed once by none; a run replayed under a new route record is refused (`record_rebilled`,
  `record_duplicate`). The run's energy is its hop's figure, and the receipt's own figure, the same work's, is not
  stated again (scope `packaging` is empty in version 4). A **package's storage by byte-time**: the tariff's one package
  price is per 10^9 byte-days; a `package` source is the product held and bills its storage alone: one the previous
  invoice lists is held through the invoice's whole period, written by its start, and is billed ⌊Σ `stored_bytes` ×
  (`end` − `start`) / 86 400 000 000⌋ byte-days and its receipt listed again; the invoice that first lists a package
  bills it no storage, since no record shows when in that period it was written. The period is read from the chain's
  own invoices, which the seller signs and the buyer holds. The invoice states a sixth unmetered count, so a version-3
  reader cannot read it.
- **Every hop's energy** (§6.6): under version 4 an invoice states the energy of every attempt of its jobs, the ones
  not billed (a failed hop, a hop that served past the deadline) in a scope of their own, `unbilled_hops`, beside the
  billed hops' and never summed with them; such a hop's figure that no row can state is `job_figure_invalid`. A failed
  hop spent energy and delivered nothing; before, no row stated it, so the jobs' energy was less than their hops
  spent. No line reads the scope: the buyer is still not billed for a failed hop.
- **Jobs routed under the route record's version 2 in the ledger corpus**: an encode, a failover whose failed hop was
  metered, a decode, a hop past the deadline, three hops that failed and a failover whose failed hop's figure states no
  class, routed by the route corpus's router under its price book of version 2, per operation with measured failures,
  each served hop stating its outputs; and two runs of `package.build` making one package, under a price book of
  version 2 of their own, and a replay of the first. `routes/vectors.json` is unchanged (`route_record::corpus` adds
  the helpers that route them for the ledger).
- **The corpora.** `live-conformance/metering/vectors.json` adds five vectors (a receipt of version 2 with its bytes
  priced; bytes out restated, bytes left out of the consumption, bytes priced with no tariff, a receipt of version 3)
  and keeps every other byte for byte; `live_metering_verify.py` reads version 2 and requires its new mutated copies to
  fail. `live-conformance/ledger/vectors.json` adds twenty vectors (version-2-routed jobs under version 3 and
  their two controls; version 4's chain of two invoices and its controls); `receipt_ledger_verify.py` reads version 4,
  holds outputs to their content hashes with `claim-conformance/_blake3.py`, requires the new mutated copies to fail,
  and drops seven more of its checks (`output-delivered`, `unbilled-hops`, `storage-held`, `package-again`,
  `run-work`, `bytes-out`, `conflict-bytes`). The ledger service (`wai/wai-ledger`) reads a source by its tariff's
  version and, under version 4, bills each package the last invoice holds again for its storage, and a package made
  again by a new run.
- **Breaking:** `api:rust:wai::live_metering::SessionReceipt::version`: a receipt states its version, 1 or 2. A struct
  literal adds `version: live_metering::RECORD_VERSION`.
- **Breaking:** `api:rust:wai::live_metering::Units::bytes_out`: version 2's bytes out, 0 in version 1.
- **Breaking:** `api:rust:wai::live_metering::Tariff::bytes`: version 2's price per 10^9 bytes out, 0 in version 1.
- **Breaking:** `api:rust:wai::live_metering::Consumption::version`: an entry states its receipt's version.
- **Breaking:** `api:rust:wai::live_metering::Consumption::bytes_out`: version 2's bytes out of a grant.
- **Breaking:** `api:rust:wai::live_metering::Consumption::encode`: returns a `Vec<u8>`, 198 bytes in version 1 and
  206 in version 2.
- **Breaking:** `api:rust:wai::live_metering::Computed::version`: the version of the receipt it was computed for.
- **Breaking:** `api:rust:wai::live_metering::SessionPlan::version`: the version of the receipt a plan aggregates into.
- **Breaking:** `api:rust:wai::receipt_ledger::ROOM_PRICES`: 14, a tariff's room prices with version 4's price of bytes
  out; `ROOM_PRICES_1` is the 13 of versions 1 to 3.
- **Breaking:** `api:rust:wai::receipt_ledger::Tariff::room`: fourteen prices, the fourteenth written in version 4 and
  read as 0 in versions 1 to 3.
- **Breaking:** `api:rust:wai::receipt_ledger::Invoice::unmetered`: six counts, scope 6 (`unbilled_hops`) last; an
  invoice writes and reads its version's.
- **Breaking:** `api:rust:wai::receipt_ledger::Computed::unmetered`: the same six.
- **Breaking:** `api:rust:wai::receipt_ledger::JobFacts::packages`: under version 4, a job's output packages, each its
  receipt hash and work units.
- **Breaking:** `api:rust:wai::receipt_ledger::JOB_UNITS`: three names, `work_units` the third (version 4).
- **Breaking:** `api:rust:wai::receipt_ledger::Tariff::package`: in version 4 only the third, per 10^9 byte-days, is
  written and read; the first two are 0.
- **Breaking:** `api:rust:wai::receipt_ledger::PackageFacts::held_us`: under version 4, the period a package is held
  through, `None` when first billed.
- **Breaking:** `api:rust:wai::receipt_ledger::JobFacts::unbilled`: under version 4, the figures of a job's attempts
  that are not billed.
- **Breaking:** `api:rust:wai::receipt_ledger::Reason::OutputNotDelivered`: a job's output receipt of an object its
  served hop did not deliver, or given twice (§5.1); a match over the reasons adds it.
- **Breaking:** `api:rust:wai::receipt_ledger::Reason::ALL`: the codes of §10, `output_not_delivered` among them.
- **Breaking:** `record:corpus:wai/live-conformance/ledger/vectors.json`: the control `invoice_version` gives an
  invoice of version 5, since version 4 is now defined, and is refused `unknown_version` as before; every other vector
  keeps its outcome, and the new vectors are added.

