### `wai.live.watermark`: forensic watermark sessions, matched and disclosed one at a time

- **The extension** ([forensic-watermark](extensions/forensic-watermark.md)) registers the
  record `wai.live.watermark`, for a room's Lane A delivery (SPEC §6.5). The edge that chooses
  each segment's A or B variant for a viewer, as ETSI TS 104 002 has an edge choose it, signs a
  **session record**, `WWS1`, when the session ends: the room and the content (a slot or a
  publisher, and its media kind), the span, the KIDs of the content keys the variants were
  encrypted under, the TS's watermark token by its SHA-256, the token's vendor and pattern
  length, how the edge had the pattern (in the clear, decrypted, or derived by the vendor's
  core), a bitmap of the positions it sequenced and the variant at each, its counts of
  sequenced and unmarked segments, a salted commitment to the session's grant and principal,
  where it keeps the record, and when it is deleted.
- **The token** is the TS's CWT, read as the TS and RFC 8392, RFC 8949 §4.2, RFC 9052 and RFC
  9053 have it: deterministically encoded CBOR, a COSE_Mac0 under HMAC 256/256 or a COSE_Sign1
  under ES256, optionally in the CWT tag, and the claims `wmver`, `wmvnd`, `wmpatlen`,
  `wmsegduration`, `wmpattern` (in the clear, or a COSE_Encrypt0 or COSE_Encrypt) or `wmid`,
  `wmopid` and `wmkeyver`, with `exp` and `iat`. A form the RFCs forbid is `token_malformed`,
  and one they allow that this revision does not read (a floating-point date, an untagged or
  nested message, another algorithm) `token_unsupported`. The record names the token by digest
  and does not carry it: a token can carry `sub` or a vendor's `wmid`, and can be presented
  again until it expires. The token's MAC or signature is the edge's to check.
- **No viewer in the record.** It names no grant: every participant holds a room's grants, and
  a grant names its principal. Only the room authority, to which the edge gives each record's
  opening, can link a session to a principal. Records, tokens and openings are kept within the
  room's region pin and its retention bound.
- **Matching.** A claimant signs the variant sequence it recovered from a copy, `WWQ1`, with
  its erasures. A session agrees when it sequenced every stated position with the stated
  variant; a match is the one agreeing session among the records given (`no_match`,
  `ambiguous_match` otherwise). The TS leaves detection's statistics to its vendors, so the
  rule has no tolerance and no threshold, and states how many positions were stated.
- **Disclosure.** For one matched session the room authority signs a `WWD1` that opens its
  commitment; a third party checks it against that record, the sequence and the grant, and
  learns nothing of other sessions.
- **Lane A only.** A record names at least one content key (`not_protected`), and a room with
  a confidentiality record has no edge that can mark it (`e2ee_room`): its objects' AEAD binds
  each to its track, group and object.
- **Refusal reasons**, from `record_invalid` to `disclosure_expired`. jwp-receipts §7.5
  registers the key-log authority `live/watermark` for an edge.
- **Reference and corpus.** `wai-rs` feature `live_watermark` (`src/live_watermark.rs`), with a
  deterministic-CBOR reader of its own and no new dependency. `live-conformance/watermark/`,
  written from fixed seeds by `wai_live_watermark_vectors`: tokens read and refused, an
  edge's records of four sessions with a token in each mode, sequences matched, unmatched and
  refused, disclosures accepted and refused, one control for each reason. Checked by
  `tests/live_watermark.rs` and by `live-conformance/live_watermark_verify.py`, a second
  implementation that shares no code with `wai-rs`, requires every mutated copy of the corpus
  to fail, and requires the corpus to catch a verifier that leaves out any one of its checks.
  The registry lists the record and the magics `WWS1`, `WWQ1` and `WWD1`.

