### The route record prices per operation, ranks by measured failure, and binds a hop to its output

- **Version 2 of the route record's price book and record** ([extensions/route-record.md](extensions/route-record.md)
  §3.4): a price book that states `version` 2 prices each **operation** of an endpoint in its own entry, ordered by
  endpoint and then operation, and a job's candidates are the entries of its own operation. Within one capability an
  encode and a decode spend different energy and are priced differently, so one entry per endpoint misstated one of
  them to the estimates, the unit-price limit and the ranking. A record's version is its price book's
  (`pricebook_mismatch` at `record`, `version` otherwise). Documents and records of version 1 read, route and verify
  exactly as before, and a reader of version 1 refuses version 2 rather than misreading it.
- **Measured failure counts in the ranking** (§3.2.1, §4.2, §4.4): an entry of version 2 states its `failures`, the
  hops of its operation sent in a period, how many failed, what the provider billed them per unit and how long they
  took, or `null`. A job sent to an endpoint until it is served meets `failed / (hops − failed)` failures on average,
  each billed to the router and costing the job its time, so a candidate carries its **expected cost** and **expected
  time to first byte per successful job**, which the `price`, `ttfb` and `targets` keys read before the list figures:
  ordering by them minimises the expected spend over the attempts (an exchange argument, §4.4). A basis under 100 hops
  is too thin (the 95% interval of a rate near one half is wider than ±0.1 below 97), and thin or `null` failures are
  unknown: the expected figures are `null` and rank after every measured one, by the existing rule for `null`, never
  as no failures. The record restates every basis and expected figure. The job never pays for failures: the
  unit-price and spend limits read the list price and cost, and a line bills the billed attempt. This is the failure
  cost a product of WAI's maintainers [name removed 2026-11-03] proposed, with its physics and its basis, except that
  an unknown failure is not counted as zero.
- **A hop receipt is bound to its output** (§5.2, §6): in version 2 the attempt that served states `outputs`, the
  content hashes (jwp-receipts §2.1) of what it delivered in order, and its OER/2 receipt's `subject.output` must be
  their commitment, or the record is refused **`receipt_output_mismatch`**: a receipt cannot be moved to vouch for an
  output it did not produce. [extensions/oer-receipts.md](extensions/oer-receipts.md) §3 now defines a `job`
  receipt's `subject.output`: one object's content hash, or for several the jwp-receipts §2.2 Merkle root over their
  content hashes in order, unlabelled leaves, the objects distinct; jwp-receipts §2.4.5 points to it. No OER/2
  reason or vector changes.
- **The corpus** (`live-conformance/routes/vectors.json`) keeps every vector of version 1 byte for byte but one, and
  adds 36 of version 2: ten accepted (the expected-cost ranking with a thin, a failed and an unmeasured basis, a decode
  at its own price, the expected time to first byte as sort and as target, the ceiling on the list cost, a book with
  no failure measured, a failover, three outputs, a late hop) and a control for each new rule. `route_record_verify.py`
  reads version 2 from the text, computes the commitment with `claim-conformance/_blake3.py`, requires the new mutated
  copies to fail and drops eleven more of its checks. `wai::route_record::seal_delivered` writes a record of its
  price book's version; `seal` is unchanged.
- **Breaking:** `record:corpus:wai/live-conformance/routes/vectors.json`: the control `record_version_2` is now
  `record_version_3`, a record of version 3, since version 2 is defined, and is refused `unknown_version` as before;
  every other vector of version 1 is unchanged, and the version-2 vectors are added after them.
- **Breaking:** `api:rust:wai::route_record::Entry::operation`: the operation an entry prices, `None` in version 1. A
  struct literal adds `operation: None` and `failures: None`.
- **Breaking:** `api:rust:wai::route_record::Entry::failures`: the entry's measured failures (version 2), or `None`.
- **Breaking:** `api:rust:wai::route_record::PriceBook::version`: a price book states its version, 1 or 2.
- **Breaking:** `api:rust:wai::route_record::Candidate::expected_cost`: the expected cost per successful job
  (version 2), `None` in version 1. A struct literal adds `expected_cost: None, expected_ttfb_ms: None`.
- **Breaking:** `api:rust:wai::route_record::Candidate::expected_ttfb_ms`: the expected time to first byte per
  successful job (version 2), `None` in version 1.
- **Breaking:** `api:rust:wai::route_record::Accepted::outputs`: the served hop's outputs in a record of version 2,
  `None` in version 1.
- **Breaking:** `api:rust:wai::route_record::Reason::ReceiptOutputMismatch`: a served hop's receipt that does not name
  the outputs its attempt states (§6); a match over the reasons adds it.
- **Breaking:** `api:rust:wai::route_record::Reason::ALL`: the codes of §8, `receipt_output_mismatch` among them.

