RFC 0001 wave 2: action-addressed feedback (0.9.0)

[BitmapAsset]

RFC 0001 Design B, on top of the senses branch (base rfc1-wave1-senses, so the diff shows Design B only). Draft for CI on Linux, macOS and Windows.

What it adds

An optional learning.credit block (docs/persona.md §2.8, docs/rfcs/0001-senses-and-reward.md §B):

• Event keys await (the host will report this decision's outcome), for (T, or {turn: T, stance: "sha256:..."} bound to the paid stance's digest) and cancel (from env or a person). Read, echoed in inputs, never compiled.
• The credit step, after the drive step: open decisions expire after 4 half-lives, cancels close theirs, feedback pays the named decision (or the previous stance when that is unambiguous) with its own credit, scaled by an eligibility 0.5^((t − n − 1) / half_life_events); beyond max_open the oldest is evicted. At e = 1 the step is 0.8's.
• Refusals B-R1 to B-R6 (ambiguous, not open, for without feedback, bad cancel, malformed, digest mismatch), each refused whole at its path. The RFC copy records question 2 as decided (B-R6).
• Surfaces: stance credit, state open_credit / prev_stance / control_closed; control lines close open decisions; live verify adds open, and live verify --actions FILE compares a host's action log with the released levels; monitor draws the open decisions with their eligibility; fuzz adds late, reordered, duplicated, cancelled and unknown payments; the MCP turn tools refuse cancel; examples/agent-harness/addressed.json with late.py and a cross-OS golden.

A persona without the block is unchanged: the P0 corpus (653 outputs of the released 0.8.2 binary) gives 0 differing outputs.

Tests

• Unit: eligibility at ages 0, 3, 10, 32 and 127 (1, 0.937084, 0.805245, 0.5, 0.063869) with the step scaled by it; expiry at age 128; eviction; every refusal row at its path; absorbed; the strict credit state; e = 1 equals 0.8 (Δ and learned_from after every turn) on every shipped learning persona.
• Live: P3c, 40 individuals × 300 random events with random payments, where a separate model of the bookkeeping predicts every acceptance and refusal (0 disagreements) and each run equals the run without its refused events, byte for byte; each refusal row byte for byte; control lines; probbit check on a credit persona.
• A fuzz fix found on the way: re-running a shrunk counterexample with its payments resolved no longer counts as searched turns (the 0.5.0 tutor golden's count is back).

Benchmark (bench/individuality, BENCHMARKS.md §11)

• Metric c, frozen before it was ever run: c1 100 % of the applied step equal to an independent Python learner's (8,393 payments), c2 100 % of 15,000 events with its Δ, c3 100 % of 3,802 outcomes whose decision was open, c4 100 % of 2,793 duplicate, cancelled, unknown and ambiguous payments refused, 50 of 50 runs byte-identical without their refused events. The stream turned out busier than designed: 67 % of the addressed decisions were evicted before their outcome arrived (reported, not gated; the fixture is not changed).
• Metric a re-measured with Design B on the frozen fixture and bars (twins_addressed.py): a1 0.1725 (interval 0.1175 to 0.235) and a2 0.1223 against 0.1366, still below the bars; a plain-inputs control gives 0.155 and 0.0295.
• Wall time: on a heavily loaded machine run.py --only c,d,e took 422 s (44.5 s of CPU), over its 60 s bar; c, d and e pass.

Not in this PR: receipts and the lineage drift budget (Design C).