### `wai.media.takedown`: takedown across every rendition and cache, against the regime's clock

- **The extension** ([takedown](extensions/takedown.md)) registers the record
  `wai.media.takedown`. A service signs a **takedown** (`wai-takedown`) of a source (an object
  by its content hash, a group, a track or a take) in answer to a signed **notice** or order
  (`wai-takedown-notice`), or of its own initiative, under a **policy**
  (`wai-takedown-policy`) that names its stores and the clocks it runs under.
- **Regime clocks are data.** A registry (`wai-takedown-clocks`) holds each clock by
  identifier, type (`deadline`, `reply_window`, `unfixed`), duration and start, citing its
  instrument and provision; a policy pins it by link hash. WAI publishes one at
  [`registry/takedown-clocks.json`](registry/takedown-clocks.json): Public Law 119-12, section
  3(a)(3); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code)
  Rules, 2021, rules 3(1)(d) and 3(2)(b), as amended by G.S.R. 120(E); Regulation (EU)
  2024/1083, Article 18(4); and Regulation (EU) 2022/2065, Article 16(6).
- **The derivation closure**, computed exactly from deriving-edge records and synthesis origin
  claims, transitively, with each group it reaches expanded from its delivery receipts
  (`group_unexpanded` otherwise). A takedown's stated set that leaves a derivative out is
  `closure_incomplete`; one that claims what no record derives is `closure_unsupported`; a
  perceptual match (`wai-takedown-match`) listed as exact is `match_as_exact`. Copies made
  outside every WAI derivation are out of reach, and the text says so.
- **Purges and the clock.** Each holder (a store of the policy, an edge that derived from a
  covered object, a party that claimed to, a publisher of a covered group, and a party that a
  `wai.delivery.settlement` acknowledgement, signed by its receiver, shows served it or, as a
  hop, received it) signs a purge (`wai-takedown-purge`). The verifier computes the time to
  removal from the clock's start to the last purge required: `purge_missing` past the deadline,
  `deadline_missed`, and `window_not_observed` for a removal inside a reply window. A purge by a
  party that never held what it names counts for nothing.
- **Counts** (`wai-takedown-counts`), per clock, ground, category and source, with the lower
  median time to removal, recompute from the cases (`counts_mismatch`); a service gives each
  takedown's statement-of-reasons record its link hash as `puid`.
- **Live moderation** is unchanged: its records are versioned, and a takedown beyond a room is a
  sibling record.
- **The reference relay's DVR store** (`joule-moq-relay`) honours a signed takedown on the track
  `[key, takedown]`: it forgets every covered object and track in every room, never stores an
  identical copy again, withholds them from every FETCH, keeps its takedowns across a restart,
  and signs a purge with the relay's key. It does not check the live fan-out.
- `wai-rs` module `takedown` (feature `takedown`); corpus
  [`live-conformance/takedown/`](live-conformance/takedown/) (`wai_takedown_vectors`), and its
  second implementation, `live-conformance/takedown_verify.py`.

