### Pin by default: an encoder pins the set a payload was coded against, and a verifier reports an envelope that does not

- **SPEC §3.1, *Pin by default*.** An encoder SHOULD pin the parameter set a payload was coded against wherever a
  capability that decodes it is registered as decoding against one, whatever the intent. Only `replicate` over a
  `NeuralIntegerExact` capability required a pin, so every other unpinned decode ran against whatever set the sink
  held, and a set other than the payload's gave plausible output, not an error. An envelope that pins nothing there
  still conforms in `1.x`, and a sink decodes it as before; a verifier reports it (`prior_unpinned`), informatively.
- **The report.** `Wai::check_unpinned`, `WaiMulti::check_unpinned` and `codecs::pin_by_default` make it. `wai
  verify` now reads the envelopes (`*.wai`) under each path: it refuses one whose pin a verifier can tell is wrong
  without holding a set (SPEC §3.1, §7), and notes `prior_unpinned`, which refuses nothing. `wai inspect` notes it,
  and so does `wai wrap`, which pins no prior. `pin-conformance/unpinned.json` holds its vectors, reached by
  `wai_pin_vectors verify` and by `pin_verify.py`, which reads the classes from the published registry export.
- **A record of a decode names the set it read.** A `reconstruct-session` decoder entry's `pin` (jwp-receipts
  §2.4.12) now names the set an unpinned decode read, by the digest a pin over those bytes names, with the tier
  `none`; it was `null`. The reference sink's base decode gives it (`staged::BaseDecode::set`, from
  `int_payload::IntParams::read_pin`), and the sessions `stage_measure` seals carry it. The page's recorder writes the
  same: `wai-web`'s `SessionHandle.decoderFor` takes the set the decode read (`StageBase.paramSet`) beside whether
  it verified a pin (`StageBase.pinned`), and `measure_verify.py` names the set as the text does. The fixture
  `staged-measure-conformance/fixtures/unpinned`, over the staged corpus's unpinned `wai.neural.int_hyper` base, holds
  both recorders and both verifiers to it; every other committed session and golden pins its bases, so none of them
  changes. A decoder entry sealed by a sink of the earlier text may carry `null` for an unpinned decode that read a
  set, and a verifier cannot tell it from a decode that read none (jwp-receipts §2.4.12). `claim-conformance/`'s
  vectors of an unpinned `wai.neural.int_hyper` decode name the set it read, and one more, appended, writes the base
  in the earlier text's form: a stage hash over either is refused (`session_stage_hash_over_an_unpinned_base`,
  `session_stage_hash_over_an_unpinned_base_earlier_text`).
- **SPEC §3.1 rule 2** says that an unpinned envelope conforms unless §7 requires the pin (`replicate_unpinned`).

- **Breaking:** `api:rust:wai::staged::BaseDecode::set`: a new member of a public struct, the set the decode read; a
  struct literal or a pattern that lists every member adds it.
- **Breaking:** `wire:corpus:wai/staged-measure-conformance/goldens.json`: it gains the `unpinned` fixture's
  evaluation, and its `dedup` record, taken over the objects of every fixture, now counts that fixture's too, so its
  totals move; no other fixture's evaluation changes. A verifier reads the goldens of the corpus it checks.

