### `wai.live.ads`: a room's cues as server-guided ad breaks, and the break form of `wai.video.ssai`

- **The extension** ([live-ads](extensions/live-ads.md)) registers the record `wai.live.ads`.
  The room authority signs an **ad policy**, `WAP1`: the grant the ad decider runs under, whose
  funds ceiling is the room's ad budget; the slots of a break; the avail of a break opened with
  no planned duration; a preload window; skip and jump restrictions, a skip control and
  snapping; and the bases of the asset-list and creative URIs.
- **Breaks from cues.** A room's breaks are its signed `cue` events of `wai.live.events`,
  unchanged: an out and its in, or a break of known duration; a chapter opens nothing. A
  post-roll is a break its author annotates with a `WAB1` `meta` event right after it, and ends
  the program. A verifier refuses an out or a break inside another break, an in with no open
  out of its `cue_id` and author, a break of no duration, an out with no planned duration when
  the policy has no open avail, an in whose stated duration is not the one that passed, an
  annotation that does not read or that follows anything but a break, and any cue after the
  post-roll; the room refuses a cue by a principal whose grant does not permit `cue`.
- **Shared manifests.** Each break is one Interstitial `EXT-X-DATERANGE`
  (`draft-pantos-hls-rfc8216bis-22` Appendix D) with `CUE`, its duration or planned duration,
  `X-ASSET-LIST`, `X-RESUME-OFFSET`, `X-PLAYOUT-LIMIT`, `X-SNAP`, `X-RESTRICT` and
  `X-SKIP-CONTROL-OFFSET`, a closing tag at its in, and a Preload date range (Appendix F); and
  one DASH alternative-presentation event of ISO/IEC 23009-1:2026, a replacement for a mid-roll
  and an insertion for a post-roll, read from the sixth edition's schema and its examples, with
  the attributes whose meaning that revision could not state left unwritten. Every value is a
  function of the signed cue, its annotation, the policy and `t0`, and the `ID` is derived from
  the cue's digest, so every edge writes the same bytes.
- **Asset lists.** The one URI a break names is where each viewer is decided: an HLS asset list
  or a DASH list MPD, written exactly, each creative's URI naming it by its hash, filled by
  `wai.video.ssai`'s decision over the viewer's pod; a viewer who joins a break running is
  filled from what remains of it. An empty fill is `{"ASSETS":[]}` in HLS and no list MPD in
  DASH.
- **`wai.video.ssai` gains form 2, the break form.** A receipt names the room, the break by its
  cue's digest, the session, the viewer's offset, the asset list's SHA-256 and format, the
  avail, the slots and the funds the decision ran with, beside the stitched form's pod hash,
  impressions, Merkle root, billable spend and energy figure. It is carried as JSON, signs
  under its own domain (`wai:video-ssai-break-receipt`) and shares the identity domain, so the
  figure profile `wai:video-ssai-receipt-id` names either form. Every stitched receipt keeps
  its bytes, and its legacy pin is unchanged.
- **Verification end to end**: the room, the policy, the schedule, the renderings, then each
  receipt: its own rules, the decider's key and grant reference, the break, the decider grant's
  window and revocation, the pod hash, the decision recomputed, the asset list's digest, one
  receipt per session and break, and the spend of every receipt together within the decider
  grant's ceiling (prices in millionths of a minor unit of its currency).
- **Twenty refusal reasons**, from `ad_policy_malformed` to `funds_exceeded`.
- **Reference and corpus.** `wai-rs` feature `live_ads` (`src/live_ads.rs`), and
  `SsaiBreakReceipt` in `src/wai_video_ssai.rs`. `live-conformance/ads/`, written from fixed
  seeds by `wai_live_ads_vectors`: a live break with a viewer at its start and one who joins it
  running, a mid-roll under restrictions with an empty fill, a program closed by a post-roll,
  chapters with a planned out, a gap, and one refused room per reason; each accepted room's
  HLS tags a file of its own. Checked by `tests/live_ads.rs` and by
  `live-conformance/live_ads_verify.py`, a second implementation that shares no code with
  `wai-rs`, verifies each room with `live_rooms_verify.py`, writes every tag, event and asset
  list itself, and requires every mutated copy of the corpus to fail. The registry lists the
  record and the magics `WAP1` and `WAB1`.

