### Live L10b: end-to-end encrypted rooms in the browser

Additive. No record, code point, reason or corpus vector changes.

- **confidentiality §15, a member in a browser.** A page is a member as any other: the
  reference's member, sealed objects and codec built for WebAssembly as one module a page loads
  for such a room alone, every key in the page's memory and nowhere else. It seals each encoded
  frame before its receipt is signed over the sealed bytes, and opens each object through §6
  before a decoder sees it; an object of an epoch not yet reached waits (§5.8).
- **§15.2, a room service as the carrier** of a room's MLS messages (§5.1): one log, in the
  order the clock took them, of the clock's lifecycle records, its proposals, and every
  GroupInfo, commit and Welcome a member posts; the clock checks each post as a member does and
  does not carry what it refuses. A member reached through such a log **MUST** apply a
  GroupInfo or commit it made only when the log returns it, and drop it when another's commit
  for the epoch comes first: §5.5 names the committer from the commit's own proposals, so two
  members with different views of the pending proposals can each commit. Before its Welcome a
  member follows the group from its handshake messages, as the clock does.
- **§15.3** states what a browser member does not do in this revision: watch without being a
  member, ingest by WHIP or WebRTC into such a room, seek back. §1's scope says so.
- **wai-live-web**: `roomDescriptor` gives the descriptor's `recording_mode`, which a page
  checks a room's confidentiality record against (§3.3 step 5).

