row 155: the usage-tap fault latch leaves the contract; the door returns the fault beside its units and the kernel counts it

[MattJackson]

Row 155 (lane-p3-llm), coordinator/contract-ABI ruling. busbar-contract is the ABI's home of shapes and holds no state (BUSBAR-1.6.0.md Part 4; spec l.3701: "Services are reached only through the host tables handed at open"; l.4589: no static/OnceLock in the contract). This PR removes the usage-tap fault latch from crates/busbar-contract/src/codec.rs: USAGE_TAP_FAULT_REPORTER and USAGE_TAP_FAULT_LATCH.

Base: predev. This PR does not need #1028's CodecHost threading. It does rewrite the OperationHandler::extract_usage signature hunk that draft #1028 also edits (#1028 adds host). Rule 23 applies because #1028 is a draft: whichever of the two lands second adds the other's change to the signature.

The seam (ruling: counted kernel-side from the door's return)

• Contract: the statics are gone, along with install_usage_tap_fault_reporter, install_usage_tap_fault_latch, report_usage_tap_decode_failure, usage_tap_fault_should_warn and both fn-pointer types.
  • codec::UsageTapFault (Decode / BadJson / UnknownProtocol, each with its reason() label) is the fault as data.
  • OperationHandler::extract_usage now returns Result<Option<TokenUsage>, UsageTapFault>. The default and the chat cell return the fault and report nothing.
• Plane ABI: OnPieceOut::tap_fault: u8 (TAP_FAULT_NONE/DECODE/BAD_JSON/UNKNOWN_PROTOCOL), next to the units the answer reports.
  • It is laid in the padding after fault, the way fault itself was laid after need (pre-tag v1). Size stays 216. Only _fault_reserved moves (181 to 182, [u8;3] to [u8;2]).
  • A closed enum (coordinator condition): 0 = none, then the named reasons. check_on_piece refuses a fault only on a non-READY answer. The kernel reads any other value as reason="unknown" (UsageTapFault::reason_of): counted and warned once, never ignored and never read as none.
  • Layout change is pre-release at the unchanged plane ABI version (accepted). The golden and the header are updated in this PR.
  • check_on_piece accepts only a known code, and only on a READY answer. The layout golden and the C header are updated by hand, exactly as the generator renders them.
• Door (busbar-plane-llm): the relay's end keeps the tap's fault, and so do Piece and the door's Answer. deliver writes it with mem::take, like the breaker reading, so it goes out on ONE window of the answer however many windows the reply takes.
• Linked engine (busbar-llm, the default build's llm path): it drives the plane's Relay itself, so its stream end hands end.tap_fault to busbar_kernel::handlers::usage_tap_fault under the relay's ingress dialect. The import rides the engine's existing busbar_kernel::handlers line, so the ports-only count is unchanged.
• Kernel: the route driver reads tap_fault off each READY answer and calls the steps' new usage_tap_fault(ctx, dialect, reason) (DriverSteps/AttemptSteps). The root's DoorSteps maps the dialect index to its name and calls busbar_kernel::handlers::usage_tap_fault(protocol, reason).
  • That function makes the same busbar_billing_tap_decode_fail_total{protocol,reason} increment, one per fault, and uses the same process-wide warn-once set (usage_tap_decode_fail_should_warn). The route tests also pin an unknown byte read as unknown.
• Hot vtable: the tap_fault_latch slot stays in the layout but is retired. SERVICES no longer serves it, arm no longer installs it, and the REASON_CAP/kept interning that existed only for it is deleted.

Bytes and counts unchanged

• Wire bytes and billed units are unchanged. A tap fault still bills what it billed: the same fallback to read_response, the cut-short reported usage, or the floor.
• The counter name, labels and increments are unchanged: one per fault, under the same three reasons.
• Logs: the warn-once line is now the kernel's (USAGE_TAP_DECODE_FAILED, with protocol and reason). The codec's own coded line (USAGE_TAP_BAD_JSON / UNKNOWN_PROTOCOL / DECODE_FAILED) now logs per request at debug. The diagnostic catalog is untouched.

RED

1. codec::UsageTapFault's compile_fail doctests: report_usage_tap_decode_failure(..) and usage_tap_fault_should_warn(..) no longer exist, so the contract holds no such port or static.
2. crates/busbar-plane-llm/tests/conformance.rs::a_usage_tap_fault_rides_one_window_of_the_doors_answer: the linked AND the dropped-in door relay a non-JSON same-dialect 2xx through a 16-byte reply window. Exactly ONE window carries tap_fault=TAP_FAULT_BAD_JSON, so the kernel, which counts each answer's fault, counts it once. The transcript line now prints tap_fault=.
3. Door to kernel counter: busbar-kernel/tests/support/plane_driver_cases.rs::a_usage_tap_fault_the_door_returns_reaches_the_kernel_counter. It drives the kernel double and the LINKED and DROPPED test plane through the one loop. A door answering a bad_json fault, and one answering a byte outside the vocabulary, each reach busbar_billing_tap_decode_fail_total once per unit, under bad_json and unknown. An answer carrying none counts none.
4. busbar-kernel/src/plane_driver/tests/route_tests.rs::an_answers_usage_tap_fault_reads_as_the_reason_the_kernel_counts and proto/tests/installed_tests.rs::a_usage_tap_fault_counts_one_increment_under_its_reason: one fault is one increment, under its reason, warned once.
5. abi/tests/plane_check_tests.rs::a_usage_tap_fault_rides_only_a_ready_answer: a fault on a non-READY answer is refused, and a code past the vocabulary is admitted (counted as unknown).
6. codec/tests/usage_tap_count_tests.rs: each tap path returns its own fault. The test host arms no latch.
7. The contract-stateless gate: a static put back is a NEW finding.

Ledger (before → after)

• qa/contract-stateless.toml: 44 → 39 rows. Struck:
  • static codec.rs USAGE_TAP_FAULT_LATCH and USAGE_TAP_FAULT_REPORTER
  • static abi/hot/services.rs KEPT and FILLING (the latch's reason interner)
  • once-cell abi/hot/services.rs OnceLock (KEPT was its only one)
  • The codec.rs once-cell OnceLock row stays: TRANSLATE_CAP_READER (its own PR), ENTROPY_SOURCE and WALL_CLOCK (row 155: the codec's entropy and wall clock leave the contract; a codec is handed a CodecHost (stacked on #974) #1028) still hold it.
• qa/abi-freeze.toml: crates/busbar-contract/src/abi/hot 6224 → 6100 lines. The latch slot's host and plane halves and their test are deleted.

Overlap (rule 20)

• The extract_usage hunk is the same as draft row 155: the codec's entropy and wall clock leave the contract; a codec is handed a CodecHost (stacked on #974) #1028's (same lane; rule 23).
• qa/contract-stateless.toml has rows adjacent to contract-stateless: the plugin-logging capture is the one sanctioned per-thread slot; a second stays red #944's. Whoever lands second settles them by hand (rule 13).
• Test merges are clean against contract, connector: a listener's protocol offer is the entry's offer for its accepting side (INBOUND-LISTEN) #1019, contract: an emit carries the answer's status on an accepted stream's head (INBOUND-LISTEN, l.4913) #1012, #74 ABI half: HostCtx is a kernel-tagged handle verified before use (no host pointer crosses) #1007 (header/golden), kernel: the word interner (Registration) moves out of busbar-contract #994, Law 0 root (PR1): the root's prod source names no plane, transport or auth instance #993 (door_steps.rs), loader: Plugin<K> is !Clone; shared holders hold Arc<Plugin<K>> #986, row 155 B1c-1: the plane states its provider keys as a neutral descriptor in its Statement (dormant seam) #981 (plane_door.rs), layout golden: refuse a re-seed that is not append-only unless named (TODO l.1829-1831) #980, row 155 B2: the protocol seam names no http type; head fields and u16 statuses, the kernel converts at its edges (TODO 34c (a)) #974 (installed.rs), row 155 F25 REHOME (kernel): auth at the served door gate, egress, config, telemetry and plane-driver rows, 35 legacy tests #900 and row 155 (L1#1): the llm door keeps a retried unit for the kernel's next attempt, and ends a final one #890.
  • row 155 (L1#1): the llm door keeps a retried unit for the kernel's next attempt, and ends a final one #890 shared two hunks with this PR: the door's abi::plane import, and the end of route_tests.rs. They were moved off: the door names TAP_FAULT_NONE by path, and the kernel test sits mid-file.
• contract: the cold lane's SDK side is deleted; abi/cold 272 -> 43 (row 84) #904 and row 84: memory-ABI connection shapes move out of abi/hot into abi/shared.rs (hot 6224 -> 5965) #898 also move the abi/hot freeze row (one count line). Whoever lands second settles it by hand (rule 13).

Nothing was run locally (cargo fmt only); ModernCI is the proof.