### Prior carriage and derived-track operations — registered with their limits

- New [`extensions/prior-carriage.md`]: a `Prior` MAY declare the wire form of
  the artifact its digest covers (`prior.form`, additive on the wire; manifests
  without it round-trip byte for byte). When declared, the digest covers the coded
  bitstream, and a sink that cannot read the form refuses the prior rather than
  substitute another packaging. `wai.prior.nnc` (ISO/IEC 15938-17:2024) is the
  registered form. It is optional, not recommended: royalty status is not
  established, and whether conforming decoders reconstruct identical tensors is
  not established, so a `replicate` cannot rest on a prior read out of a form not
  listed as exact (none is). As a payload, NNC takes the replicate class of a
  standard whose decoder conformance the registry has not checked, as MPEG-I
  Haptics does; its own conformance clauses were not read. `wai.tensor.nnc` is
  registered as a candidate for general tensors; its coding is in an unpublished
  amendment, which
  is tracked, not pinned. The extension also fixes the precedence of in-band
  data-unit signatures: WAI's digest covers every byte, and an in-band verdict is
  recorded beside it, never instead of it.
- New [`extensions/derived-tracks.md`]: the ten derivation operations of
  ISO/IEC 23001-16:2021 are registered as `wai.derive.*` strings, each with a
  per-operation determinism tier. Dissolve and Scaling are untiered. No operation
  is exact unconditionally, Identity included. An executed instance is exact only
  when no sample value is converted into another representation or computed, its
  output does not change over the span the claim covers, and its operation's own
  conditions hold; the sink lists each condition it checked. A derived sample
  holds the tier of its weakest step. A claim over it names the operations
  actually executed, the parameter values each applied, the span it covers and
  its inputs, visual and parameter. These are not payload capabilities, and WAI
  does not composite. Clause 8 of the standard, which defines each operation, was
  not read. Every tier rests on conditions checked on the executed instance; the
  geometric conditions listed per operation come from the operation's title, as
  does whether it reads a visual input, and reading clause 8 may show a list to be
  incomplete. Clause 4 crops or fills an input of another size implicitly for
  every operation, and no list carries a condition on where such an input is
  placed.
- `wai-rs`: `codecs::derivation` (registry, `Condition`, `derived_sample_tier`),
  `codecs::DeterminismTier` (the two tiers as values, re-exported by
  `codecs::derivation`), `codecs::prior_form`, `Prior::{new, with_form, form,
  check_form, form_preserves_exactness}`, and `container::replicate_prior_refusal`,
  which states why a `replicate` is refused, including over a declared form.
- **Behaviour change:** `Prior::is_cross_hardware_exact` now also requires the
  declared form, if any, to be established exact (`form_preserves_exactness`), so
  a prior that declares a form is not cross-hardware exact whatever its contract
  says; `determinism_class` still reads the contract alone. A prior without a form,
  which is every prior written before `form` existed, gets the same answer as
  before. The rule sits in that predicate because every `replicate` check reads
  it, `container::replicate_is_sound` and `Wai::replicate_is_sound` included.
- Each `ExecutedOp` names the visual inputs its instance read (`reads`, as an
  entry of `inputs` or the output of an earlier executed operation), because
  clause 4 of ISO/IEC 23001-16 lets an operation that is not first read the
  output of any previous operation, only new inputs, or both, so its position
  does not say what it read. An instance of an operation that reads a visual
  input and names nothing gives no tier, wherever it sits: it read an input that
  nothing names, whether a track, item, track group or preceding output the file
  lists or, where nothing lists one, the default fill picture (clause 5.1). When
  at least one operation executed, a call that contradicts itself (a reference to
  an unlisted input or to an operation that does not precede the reader, or a
  listed input no instance names) is a `DerivedSampleError`; an empty executed
  list gives no tier before those checks. `neural::ModelRegistry::resolve_checked`
  refuses a declared form the sink cannot read, and the reference sink reads
  none. A new CI workflow, `wai-neural-gates`, is configured to run the two
  model-free tests of those neural-sink refusals, which no workflow ran before,
  in an Ubuntu 24.04 container image; it has not yet run on a runner.
- **Rust API, source-breaking.** `container::Prior` gained a public field,
  `form`. Its fields are all public and it is not `#[non_exhaustive]`, so Rust
  code outside the crate that builds a `Prior` with a struct literal, or
  destructures one without `..`, stops compiling. The fix is to add
  `form: None`, or to build it with the new `Prior::new(id, sha256,
  determinism)` (and `.with_form(form)`), which names no optional field and so
  is unaffected by the next optional field added. Reading fields, serde, and
  functional update (`Prior { form, ..other }`) are unaffected. SPEC §8 versions
  the wire format, not this API. On the wire, `form` is an optional key, added
  as `prior` itself was, and absent it the manifest's bytes are unchanged. SPEC §8
  also says the manifest schema is frozen for all of 1.x; how an optional key is
  added under that freeze is not settled here, for `form` or for `prior`. For the
  crate, Cargo's semver rules treat a source-breaking change in a 0.x crate as
  needing a new minor version: the release that carries this must be 0.4.0 or
  later (`wai-rs/Cargo.toml` still says 0.3.0). `#[non_exhaustive]` was not
  added. It would break the same literals now and, in addition, rule out the
  `form: None` fix and functional update from outside the crate, which the
  crate's own integration tests use. It would also make `Prior` the only
  manifest struct that code outside the crate cannot build with a literal; the
  others are `Manifest`, `ModelRequirement`, `Conditioning`, `ManifestV2` and
  `RenditionMeta`. Whether they should all become `#[non_exhaustive]`, so that
  adding an optional key never breaks Rust callers, is a decision for all of them
  together.
- Open: the operations' four-character codes are not recorded (clause 8 of
  ISO/IEC 23001-16 was not read); the `wai` CLI does not list derivation
  operations; there is no NNC reader.

