[MattJackson]

Executes delete batch E3-root (busbar root crate, request path first). Re-verified against dev 8accfe3. No behaviour change.

Deleted (20 of 23)

Hot path:

• crates/busbar/src/root/durability/mod.rs: the journal_settlement → _as → _counted → _refusing forwarder chain (4 fns, ~50 lines). settle, settle_posted, settle_counted_refusing and boot hold recovery now call journal_settlement_kind directly. That removes three call frames per settlement.
• crates/busbar/src/root/serve_lines.rs: the line-terminate logic was duplicated in LineCaller::write and the carrier sink closure. Both now use one terminated(bytes), which allocates once with capacity len+1, so a push never reallocates.

Off the hot path:

• root/adapters.rs: dead LaneMap (46 lines) and its 3 self-tests.
• root/doors.rs: Dispatched::refresh is now #[cfg(test)]. Its only caller is a test, and the stale doc link is dropped. It is gated rather than deleted because that caller, tests/doors_refresh.rs, is in C7 (loader): the conformance suite and test doubles move to busbar-test-kit #1660.
• root/keyset.rs: bind_ephemeral is now #[cfg(test)].
• root/tests/adapters.rs: the boot-seal test's source-text half (an include_str! grep of registry.rs for check_label_banks() inside seal) is replaced by a behaviour test that guards the same bug, item 248: the label-bank check existed but the boot seal never ran it. The new test is the_boot_seal_refuses_a_planted_label_drift. A test-only thread_local (PLANTED_PAIR, #[cfg(test)], so no production effect) adds one drifted pair to what check_label_banks compares. The test then requires registry::seal to refuse with BootRefusal::LabelDrift { breaker: "transient_upstream", egress: "transient-upstream" }. The existing behavioural test (a_label_drift_refuses_the_boot_and_todays_banks_seal) is unchanged.
  • Red (scratch commit, not pushed: the check_label_banks() call removed from seal): FAIL root::adapters::tests::the_boot_seal_refuses_a_planted_label_drift, panicking with "the boot seal sealed over a label drift: it does not run the check". In the same run, the kept test a_label_drift_refuses_the_boot_and_todays_banks_seal PASSED, which shows it does not catch the bug by itself.
  • Green (a1e3c02): both tests pass. cargo clippy -p busbar --all-targets -D warnings passes with default features and with --no-default-features, and cargo fmt --check is clean.
• root/tests/admin_plugin_admission.rs: 12 inline temp-dir blocks now call tmp_plugins_dir(tag).
• root/tests/durability_amend.rs: 3 inline scratch dirs now use the shared Scratch.
• root/tests/durability_boot_reads.rs and durability_reads_unlocked.rs: their two audit_inputs copies are gone. Both files now use durability_audit::inputs.
• root/tests/keyset.rs: the Dir RAII copy is gone; it uses the shared Scratch. Scratch (from durability_audit.rs) is re-exported under cfg(test) from durability.
• root/tests/linked_secret_sources.rs: deleted the duplicate ..._genuinely_unset_still_reports_unset. Merged ..._missing_path_still_reports_cannot_resolve into ..._missing_file_is_an_error, keeping its "not regular file" assertion.
• root/tests/plane_node_money.rs: history_of now delegates to fee_history_of, and rerank_report to rerank_report_on. 5 copied memory-book and node setups now use swept_node().
• root/units_admin/adjust.rs: refused is gone; its callers use error_answer_with_message(400, "invalid_request", …). That function's root-admin gate is lifted because adjust is ungated.
• root/units_admin/tests/admin_path_without_plane_face.rs:
  • 5 mount-and-book blocks now share one mounted_over(inner, cap, door, rows, tweak).
  • over, over_as and over_with_key now share one send(...).
  • The empty THE_UNBOUND_VERBS const is gone. The generic check now asserts the unbound set is empty.

Skipped (3)

• root/transports.rs PlaneDispatch trait and DrivenOnce (2 items, hot path): removing them requires editing root/plane_node.rs, which open PRs kernel: delete proxy/mod.rs; the door shapes its own dialect refusal (status row 82) #1372 and D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485 change. Do after those land.
• units_admin/tests/admin_path_without_plane_face.rs shared operator-fixture module (ADirectoryThatMintedIt and others): sharing it needs units_admin/tests/units_admin.rs, which C5: delete the legacy dual paths; keep the 1.5.5 migrate and read-back paths #1658, C13 + C10: TODO/transitional markers out of the code; delete dead qa/field-inventory.json #1650 and Step 5: core depends on no plugin; in-tree llm plane deleted; dist/default is the distribution #1659 change. Do after Step 5: core depends on no plugin; in-tree llm plane deleted; dist/default is the distribution #1659.

Verification

• cargo build, cargo check --workspace --all-targets and cargo clippy -p busbar --all-targets -D warnings pass, with default features and with --no-default-features.
• cargo nextest run -p busbar: 1702 run, 1702 passed, 4 skipped.

production LOC (loc-tool): 251675 → 251599 (busbar crate 28525 → 28449)