### OER receipts — graded, chained energy receipts with three implementations

- New [`extensions/oer-receipts.md`]: ingests OER/2 draft 0.1. A receipt records one
  unit of work, its joule cost, the cost's **evidential grade** (`projected`,
  `simulated`, `derived`, `measured` — orthogonal to the acquisition class, mapping
  stated), and what it rests on; canonical, content-addressed, hash-chained and
  Ed25519-signed. Conformance is reason-set-equivalence plus a canonical-form fixture
  the vectors cannot check themselves.
- New `oer-conformance/`: the upstream 9 vectors, 1 from the portable C kernel
  (`settle/`, Apache-2.0), 99 hand-declared edge vectors — every reason the upstream
  nine never exercise, each number shape and decimal-string defect and each limit
  from the accepting side, each bound, each of the four tolerances at and past its
  edge on both sides and past 34 digits, each step of the order of the reasons
  reported alone, each member judged on its value, each claim an abstention cannot
  make, each key a signature cannot rest on, and the extremes a document may hold —
  and `unreadable/`, the documents every verifier must refuse whole.
  They found five defects in the reference verifier (a mis-quoted
  `missing_capability`, three crashes on missing members, a repeated receipt id
  hiding reasons), and a class of inputs on which the reference and `wai-rs`
  reported different reason sets or crashed (parser-dependent numbers and versions,
  lenient decimals, members of the wrong type, rounding past the 28th digit,
  documents at the edge of what a parser can read); all fixed in both.
- `wai-rs --features oer` (`crate::oer`, `wai_oer_vectors`): a third, independent
  verifier; CI runs it on the four-platform matrix and rebuilds the C kernel,
  requiring its output byte-identical to the pinned corpus.
- `oer-conformance/fuzz_differential.py` with `wai_oer_diff`: seeded differential
  fuzzing of the reference verifier against `wai-rs` over mutated corpus documents;
  any divergence in reasons or refusal, or any crash, fails it.
- Departures from draft 0.1, each in the extension's §9: decisions are named
  `oer.decision.*`, not `wai.settle.*` (WAI's namespace is for payload formats); the
  stage list behind `bundle.provenance_root` is serialised exactly as the body is,
  pinned by a non-ASCII fixture; the number profile is a MUST (I-JSON integers,
  decimal strings in JSON's number grammar, anything else `malformed`); every
  composition check is exact, with `ln 2` pinned as a decimal, and every tolerance
  scales by the figure's magnitude; a document outside the document profile is
  refused whole, a repeated member name included; every mistyped member has one
  named reason; published keys are decoded strictly, so a small-order key cannot
  verify every message; `oer` is a string;
  and a decision that was not earned is receipted as `abstain` — no answer, no
  record — which a new reason, `abstention_settled`, holds to that. `escalate` is a
  verdict returned from upstream, as the corpus always had it.

