[MattJackson]

Batch E2-kernel-collapse: busbar-kernel duplicates and overbuilt code, collapsed onto one surviving implementation. Behaviour is unchanged: no production logic moved, and no assertion was weakened or skipped.

Deleted / collapsed (35 items)

Production

• hooks/taps.rs: the private ADMISSION_DENIED_TOTAL copy is gone; the tap gate now uses crate::snapshot::ADMISSION_DENIED_TOTAL (same string). The tap-dropped name stays in taps.rs, because snapshot/mod.rs records that it moved there on purpose.
• host_services.rs trust_sight: the inline Sight → TRUST_* match is now sight_code(sight).

Test fixtures and harness

• audit/tests/auditlog_tests.rs: the frozen AD_1/AD_2 and LEGACY_1/LEGACY_2 bytes now come from boot_verify_golden's AD_1/AD_2 (byte-identical; the consts became pub(in crate::audit)).
• audit/tests/auditlog_tests.rs and journal_tests.rs: the duplicated DiagCapture layer is now one test_support::warn_capture::DiagCapture.
• auth/tests/dpop_tests.rs: stats_on and exchanged are now one served(method, path, headers, authorization_server) harness.
• config/tests/config_consolidation_tests.rs: c_mutable_with_the_overlay_explicitly_disabled_refuses is deleted. overlay_read_only_tests::e_…_is_still_a_boot_refusal asserts the same thing, more strictly.
• config/tests/linked_secret_hardening_tests.rs: resolve_linked_env_genuinely_unset_still_reports_unset is deleted; it had the same assertions as resolve_linked_env_unset_variable_is_an_error.
• config/tests/secret_tests.rs: env_module_resolves_and_fails_closed, file_module_resolves_and_fails_closed, unknown_module_fails_closed and malformed_builtin_refs_error_precisely are deleted. linked_secret_hardening_tests and resolver_tests already cover them.
• host_work/tests/handle_engine_tests.rs: an_idle_active_handle_stays_active_through_the_next_sweep is deleted, because a_sweep_never_transitions_an_active_handle_however_long_it_idles covers all of it.
• test_support/ranking_double.rs: RankingAxis::open and Open::open now share one strategy_of parse.
• tests/host_services_tests.rs: verdict_now, Mem and caller are now the one copy, shared with host_stage_tests, host_chains_tests, host_verify_tests and host_work_tests.
• tests/members/audit/{amend,digest_framing,journal,record,sign,subject_decoder}_tests.rs: the six token() helpers are replaced by test_support::tokens::pass::<AuditStep>(). break_reporting_tests uses it too.
• tests/members/audit/record_tests.rs: the UnwrapErrOrElse trait is gone; the call is now .err().unwrap_or_else(|| panic!(..)).
• route_token in breaker/breaker_unit_tests.rs, egress/breaker_adapter_tests.rs and egress/route/harness.rs: replaced by test_support::tokens::pass::<Route>().
• egress/route/walk_tests.rs: route_async, which repeated the attempt loop of Node::route_with, is gone. That loop is now Node::route_on(egress, pool, before); route_with and route_over both call it.
• ledger/cost/fixtures.rs: usage and estimated_usage now build their lines with lines().
• ledger/cost/identity_tests.rs: the Seq LCG is replaced by ledger::fixtures::Rng (the same constants, and the seed is already odd).
• wal/poison_tests.rs: a_store_that_refuses_an_on_disk_batch_does_not_fail_the_commit is deleted, because an_on_disk_batch_the_store_refused_is_offered_again… covers it. The Refuses stubs and journal_chain_tests::RefusingShipper are now one wal::fixtures::RefusingShipper.
• tests/support/plane_driver_close_cases.rs: the Nobody stub is deleted; this file now uses hook_cases::Nobody.
• tests/support/plane_driver_hook_cases.rs: GatedRewrites and GatedGates are now one GatedBinder { gates, rewrites }.

Skipped (24 items)

• store/in_memory reset_swrr_for: the forced edits touch store/tests/tests.rs (C12: delete tests that prove internal seams, status rows or censuses #1657) and store/vocab.rs (D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485). Waits for those PRs.
• audit/stream_registry Decode enum: it is constructed in audit/auditlog.rs, which C5: delete the legacy dual paths; keep the 1.5.5 migrate and read-back paths #1658 changes. Waits for C5: delete the legacy dual paths; keep the 1.5.5 migrate and read-back paths #1658.
• breaker::status_class_from_str: the forced edits are in config/mod.rs and config_validate/mod.rs (D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485).
• config/auth.rs operator_module: its re-export is in config/mod.rs (D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485).
• cost.rs resolve_model_alias: its only caller is busbar-core-admin/src/v1/service.rs (D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485).
• tests/members/audit/sign_tests.rs rich_inputs: one caller is published_recipe_tests.rs (C12: delete tests that prove internal seams, status rows or censuses #1657).
• config/migrate.rs uniq_def_name and the nested export_mut: both are on the 1.4.x/1.5.x config migration path, which is a hard no-touch.
• auth/tests/acceptance_1_5_5_tests.rs Buf/capture: the suite asserts on fmt-rendered lines (level text " WARN ", diag=BUSBAR-…). WarnCapture records fields without levels, so moving to it would change assertions.
• governance/tests HungDenylistStore, BrokenDenylistStore, MeteringDownStore, FlakyStore, RecordingBarrierStore, BlockingDenylistStore, FailGetUsage, ReadOnlyStore, CountingStore, FailDeleteStore, FailListKeysAfterDeleteStore, PanicOnPutKeyStore and RefreshBlipStore (13 items): the replacement is a new generic DelegatingStore abstraction, and its proposed home test_support/mod.rs is changed by C2: delete the kernel egress engine; the connector is the one outbound path (supersedes #1230) #1656 and D2: drain plane_driver/serve.rs::TABLES — the generation carries its admin table (stacked on #1482) #1485.
• ledger/checkpoint_tests.rs the_head_order_does_not_change_the_body: not subsumed. It is the only test covering the no-snapshot Checkpoint::seal encoding (the legacy read-back path); the other test covers only seal_as_of.
• ledger/cost/history_tests.rs card_at/overlapping_history: the other copy is in the busbar-kernel-ledger crate's private tests. Sharing it would need a new test-support surface in that crate.
• tests/plane_driver.rs Way/ways(): not single-variant. plane_driver_cases.rs is also included by crates/busbar/tests/plane_driver.rs, where Way is {Linked, Dropped}.

Within this batch, the LCG item covered only the in-kernel copy. The busbar-kernel-ledger and crates/busbar/tests copies are in other crates.

Verification

cargo build, cargo clippy -p busbar-kernel --all-targets -- -D warnings, cargo check --workspace --all-targets and cargo test -p busbar-kernel --no-fail-fast were all green locally, with one exception. seal_tests::a_second_definition_of_the_kernels_root_symbol_does_not_link fails locally on macOS: it asserts how the system linker behaves, and its code is untouched here. sign_tests::the_signature_costs_the_same_whatever_the_record_holds failed once under parallel load (it is a timing test) and passed when rerun.

production LOC (loc-tool): 251675 → 251670