### `wai.live.coperformance` in the live room: the clock signs, the relay refuses, the page performs

- **The room clock signs what only it knows** (`joule-moq-room`, `[co]`, co-performance §8). It
  records each audience member joining when its events track appears, follows every member's
  events and each publisher's media, and holds the room as a verifier does. It logs each object
  it takes with its arrival and its due instant (the object's timestamp, which a page states on
  the room clock) and serves the log (`GET /co/objects`), signs a mark for each object out of
  turn under a schedule that marks or later than its publisher's budget, commits to each window
  once it has closed and the inputs in flight have arrived and signs its selection under its
  rule with its credits (a draw from a seed it drew when the window opened), and states each
  participant's fidelity, every `fidelity_every_s` and when a lead asks. A page asks it for a
  turn schedule, a handover or a window over HTTP, its grant presented with a proof of
  possession over a challenge the service issued (live-rooms §10.5.3), and its powers decide:
  the room's first publisher holds the direct power (`lead`), the turn's holder may hand its
  turn over. A publisher may ask for a grant that marks it an AI participant.
- **What the clock signs is what the verifier recomputes.** `wai-rs`'s `co_performance::replay`
  replays a room through §9.2 step 4, and a clock reads from it the commitment, the selection,
  the fidelity statement and the marks the verifier will recompute (`Replay::commitment`,
  `selection`, `fidelity`, `marks_for`) and the floor (`FloorBook`). `tests/co_performance.rs`
  recomputes every commitment, selection and fidelity statement of the corpus's accepted rooms
  from the room as it stood just before each, byte for byte, and every object's marks.
- **The relay refuses invalid audience inputs** (§7.3): without the audience-input power of the
  grant its author's session proved, to a window it does not hold or one already committed, of
  a type the window does not take, past its author's power or its policy's rate, that does not
  read, or whose signature fails. Each is withheld from every object that carries it and counted
  by reason in the session's summary (`co_refused`), as is each object held back out of turn
  (`refused_out_of_turn`). A grant head (`joule-moq`) now reads a grant's attributes and its
  policy's rate window.
- **The room page performs** (`joule-moq-web/web/room/co.js`). It shows the turn schedule and
  who holds the floor, each participant's intents as upcoming lines and what became of them, the
  window open now with an input box for a viewer whose grant allows it, each selection with its
  credits, and the clock's fidelity statement; a lead's controls ask for turns, a handover, a
  vote, prompts and a fidelity statement. A performer's page sends media only while it holds the
  floor, a guard inside each turn, and states its media's timestamps on the room clock. With
  `ai=scripted` the page is a demo AI participant: a drawn picture and a tone, and a scripted
  line announced ahead of each it says. `wai-live-web` reads every statement, signs a page's
  intents and inputs, and verifies the room as a page holds it (`Room.coVerify`;
  `wai_live_web co-verify` on the host).
- **The extension's text** now says what a relay does with an input naming a committed window,
  what it counts, how a room clock that is a session of its own on the relay takes arrivals and
  signs marks, when it commits and states fidelity, how a room key states a statement a
  participant asks for, and that a performer states an object's due instant as its timestamp
  on the room clock.

