### `wai.age.assurance`: the room's own service under the serving rule

- **The rule** ([age-assurance](extensions/age-assurance.md) §5.5): a session that proves
  possession of a room key, the authority's or the clock's, is the room's own service, and a
  relay serves it every object of the room's tracks whatever their age. A room that admits by
  age and keeps co-performance needs it: the clock follows and logs every performer's objects
  over a session of its own (co-performance §8), which holds no grant and no token. The proof
  is a `GRANT_PROOF` naming no grant (32 bytes of zero) over the session's challenge, checked as
  live-rooms §10.5.4 checks a proof; one that does not pass refuses the session with that
  section's reason, and one by a key the relay does not hold as a room key gives nothing. No
  name, token or flag a client sets makes a session the room's.
- **The relay** (`joule-moq-relay`) checks such proofs in SETUP and exempts the session in the
  rooms of each room key it proved: an authority it honours for the room, or a room key its
  `[floor]` or `[dvr]` names. Its client presents them (`ClientOptions::room_keys`), and the
  room service's clock proves both room keys it holds. `tests/age_room_service.rs`: in a room
  rated 18 with the floor held, sessions proving the clock's key and the authority's receive
  every group; the clock's token with no proof, and a proof by a key that is no room key, are
  refused `below_threshold`; a proof naming the clock's key under another key's signature, and
  the clock's proof over another session's challenge, close the session `UNAUTHORIZED`.
- **The corpus** gains the serving case `room_service` (the two room keys served at threshold
  0; sessions with no proof or a non-room key served by their thresholds; a forged signature,
  another session's challenge, another relay, a named grant and a cut proof refused with
  live-rooms §10.5.4's reasons at any threshold). `wai-rs` (`age_assurance::room_service`) and
  `age_assurance_verify.py` agree on every request; the verifier drops each of its three new
  checks in turn and four new mutated copies of the corpus, all caught.

