[aq1018]

• Cargo feature experiment (core, forwarded by servo-ch32 and the app; scripts/build-image.sh --experiment): the notebooks' capture image. OpenLoop alone at the goal as written, the window measurement and the overcurrent trip kept; loops, limiter, limits fold, estimators, detectors and the stall permit lease compile out. capability_flags bit 1 names it.
• New bus_deadman_ticks (CONTROL 0x192, RW, RAM): on the experiment image a countdown in kernel ticks that every dispatched instruction reloads and a TEL burst holds; at zero the kernel latches deadman (bit 7, code 9) and coasts until the torque-enable ack. The production image accepts and ignores it.
• osc/ident: the pump's lease is the dead-man on the experiment image (fed after every torque enable and at the permit's cadence, no stream length refused); identity read once at connect.
• Docs: kernel sec 2.7, protocol sec 5.4 / 5.8 and the fault table; descriptor regenerated; CI builds and gates the image and runs the core tests under the feature.
• Production image unchanged in every section (one access-map byte for the new field); kernel trace golden untouched.