### `wai.live.moderation`: review policies, signed decisions, and statements of reasons

- **The extension** ([live-moderation](extensions/live-moderation.md)) registers the record
  `wai.live.moderation`. The room authority signs a **review policy**, `WMP1`, chained to the
  one it replaces and in effect from a room-clock instant: which event kinds and media are held
  for review before delivery (pre) or reviewed after it (post), the reviewers, each one's
  deadline and fallback (allow, deny or hold), the trusted flaggers it recognises, the reason
  codes with their ground, provision or clause and database category, the territory, and the
  redress text. Every policy keeps the room descriptor's review field (live-rooms §3.6).
- **Decisions.** A moderator's verdict is a `decision` event of `wai.live.events`, unchanged,
  followed in its chain by a `meta` event carrying the **statement**, `WMS1`: its target (an
  event, or a media object such as a recorded chunk named by its leaf), the target's `prev`,
  the decision it supersedes, its basis (own initiative, a notice, a complaint, the policy's
  fallback), its use of automated means in detection and in the decision, and its ground,
  explanation and facts. Decisions on one target form a line by digest; an appeal's outcome
  supersedes the decision complained of. The room's clock signs each fallback the policy
  applies, at or after the deadline. A decision by a principal without the moderate power is
  refused by the room verifier (`kind_not_permitted`).
- **Notices and complaints**, `WMN1`, are signed by whoever submits them: a notice names an
  item, its ground and the submitter's statement and contact (Article 16(2)); a complaint
  names a decision (Article 20). The contact is never exported.
- **Review and redaction.** Each item's state over time (held, pending, allowed, denied,
  redacted, or the fallback at its deadline), what a relay holds and delivers, and what a sink
  shows. A restricted item is withheld, never replaced: a gap it leaves in its author's chain
  is explained by the moderators' signed statements, walking the chain back through each
  withheld event's `prev`; a clip over a redacted chunk keeps its range proof, withholds the
  chunk's bytes (`redaction_not_applied` when they are given), and presents the chunk again
  once a later decision restores it. A recording package under moderation is specified only.
- **The statement-of-reasons export.** Each restricting decision maps onto one record of the
  DSA Transparency Database's statement-of-reasons format (the schema in force from
  1 July 2025, which its documentation calls API v2), written byte for byte: every member,
  its source in the WAI records, closed lists and length limits, the sixteen categories, the
  content types, and every Article 17 element with WAI's field for it. It carries no
  principal key, notice contact or content; `source_identity` is never written. A record that
  cannot be written is refused `sor_incomplete`, naming the member.
- **Twenty refusal reasons**, from `policy_malformed` to `redaction_not_applied`.
- **Reference and corpus.** `wai-rs` feature `live_moderation` (`src/live_moderation.rs`);
  live-recording's clip verifier gains `verify_clip_exempting`, which `verify_clip` calls
  exempting nothing, so its corpus is unchanged. `live-conformance/moderation/`, written from
  fixed seeds by `wai_live_moderation_vectors`: a pre-moderated chat room whole and as a
  subscriber receives it, a notice and a trusted flagger's notice with their decisions, an
  appeal that reverses a decision, live-recording's lesson session with a chunk redacted and
  then restored, one refused room per reason, an export refused, and clips of the redacted
  take; each export a file of its own. Checked by `tests/live_moderation.rs` and by
  `live-conformance/live_moderation_verify.py`, a second implementation that shares no code
  with `wai-rs`, verifies each room and clip with its corpora's second implementations, writes
  every export itself, and requires every mutated copy of the corpus to fail. The registry
  lists the record and the magics `WMP1`, `WMS1` and `WMN1`.

