D2 step 4a: the kernel's EngineHost leaves plane_host; door-plane trips are on /metrics; reclaim-on-drop proven on the plane driver

[MattJackson]

D2 step 4a, stacked on #554 (base p6-d2-step3). No predev hop runs on this base. Scope is as approved: the 4a/4b split, re-scoped so nothing is re-typed.

1. The kernel's EngineHost moves out of plane_host

• These move to crate::plane::host_impl:
  • EngineHostImpl
  • its constructors (engine_host, engine_host_value, engine_host_from_handle, live_host_factory)
  • live_standing / standing_over
  • transform_over_over
• clock_now_* now read now_ms directly, with the same arithmetic the slot used.
• The vtable-backed methods stay as thin calls into plane_host's *_over functions. Four of those are new pub(crate) wrappers: breaker_settle_over, call_log_emit_over, meter_charge_over, approval_redeem_over.
  • The methods are: breaker admit/settle, meter_charge, govern_admit_reason, approval_redeem, identity_admit, subkey_sign, call_log_emit, gate_decide, transform_over.
  • No caller outside HOT and the legacy plane crates remains.
  • switch-cold deletes them in the same commit that deletes abi/hot, together with DispatchScope, SettleAdmission, EgressFaultDetail and GovAdmit.
• Kept callers now name plane::host_impl (root, core-admin, router, auth, registry, test_support). plane_host keeps a transitional re-export for the HOT files and the legacy crates.

2. Door-plane trips show on /metrics, under 1.5.5's label convention (the condition for deleting store/planes.rs; ARCHITECT rulings 1(a)/(b)/2)

• A door plane's egress walk trips its own busbar-kernel-breaker unit. That unit rides the sealed Egress as Egress::cells, a DoorBreaker holding the unit plus the labels its cells are scraped under. The root publishes each served door plane's generation into App::door_cells, at boot and on every apply.
• Labels follow v1.5.5's convention, generalised. In v1.5.5 (metrics.rs:214-217, :903-905) pool is the configured pool name (the model name for a direct route) and lane is the member's configured name, and both are identical on the gauge and the counters so they join.
  • The plane states its scope: the section key it serves (DoorFacts::metric_scope).
  • pool = "<scope>/<pool>", or "<scope>/<entry>" for a direct route. lane = the entry name.
  • The kernel renders the stated strings and composes nothing.
  • The walk's counters carry the same pair (WalkTelemetry::with_pools): upstream attempts, failures, breaker trips, failover and queued.
  • No label carries the walk's internal "<plane>\x1f<entry>" key.
  • The plane serving pools keeps 1.5.5's bare labels, byte for byte (metric_scope is empty there).
• A config apply keeps what the breaker learned. v1.5.5 main.rs:3095-3109 restores every surviving lane's learned state "BY STABLE IDENTITY", and :1749-1752 adds that a lane-set change never "discards breaker/latency knowledge". Here, carry_breaker_cells restores the prior generation's cells into the next unit:
  • re-keyed by (pool, member name), never by entry order;
  • a removed member's cells go with it;
  • boot starts fresh.
• Tests:
  • kernel metrics::door_cells::tests (4)
  • root door_steps::tests::a_door_planes_pool_label_is_its_scope_and_its_configured_name
  • two_door_planes_naming_the_same_entry_are_two_series
  • an_apply_of_an_unchanged_section_keeps_a_tripped_member_tripped
  • an_apply_that_reorders_the_entries_keeps_the_same_member_tripped
  • serve::door_tests::a_door_planes_tripped_member_is_on_the_metrics_scrape: the decisions door's benched member reads 2 at pool="<section>/m",lane="m", and busbar_upstream_attempts_total carries the identical pair. No control byte appears in the lane_state or upstream families.
• REDs, run on Latchkey:
  • Labels as the internal key: left: Some("planea\u{1f}fs") right: Some("tools/fs"); left: ("planea\u{1f}fs","planeb\u{1f}fs") right: ("tools/fs","agents/fs"); the scrape test fails.
  • No carry: both apply tests fail.
  • Carry by destination id: the reorder test fails.

3. Why DispatchScope can go: the guarantee is kept by the plane driver
Spec Part 3 l.2397-2402 requires that every host-side resource a dispatch takes is reclaimed when the dispatch ends or is dropped (disconnect, cancel, panic, parked at an await), synchronously on abort. The memory-ABI driver keeps this as follows (lines are on this branch):

Resource	Where it is released
Admission	crates/busbar-kernel/src/teller.rs:1119 impl Drop for Abandoned runs terminal(.., Abort::Kernel{ClientGone}) and reaches exit: the hold leaves the cell at :1305 (run.cell.take) and the leases go back at :1306 (run.leases.release_all). The child-unit branch does the same at :1211-1212.
Egress connection	crates/busbar-kernel/src/plane_driver/far_end.rs:1572 impl Drop for EgressFarEnd calls settled (:687): conns.close at :691
Probe	release_probe at far_end.rs:694
Permit	drop(permit) at far_end.rs:710
Subprocess	A carrier need (spec l.2387), so it closes with the connection
Verify lease	Held per plane instance and key, not per dispatch (host_verify.rs); it lapses on LEAD_MS

The proof is crates/busbar-kernel/src/plane_driver/tests/reclaim_tests.rs:177, a_dispatch_dropped_mid_await_releases_its_admission_and_closes_its_egress.

• It runs the real PlaneDriver::unit, run_unit_async and EgressFarEnd.
• It parks the dispatch after the connection opens, drops it, and asserts synchronously: in-flight 0, no lease held, hold cell Taken, connection closed.
• With the lease release (teller.rs:1306) removed, it fails: "the admission's lease went back to the gauge inside the drop, left: 1 right: 0".
• With the close (far_end.rs:691) removed, it fails: "the egress connection was closed inside the drop, left: 0 right: 1".

Row 82: 19, unchanged; no file leaves plane_host in 4a.

Proof (Latchkey)

Check	Result
fmt, check (all features), check (no default features)	green
clippy (all features), clippy (default, incl. busbar-kernel-breaker)	green
busbar-kernel-breaker tests	green
cdylibs, core-admin, a2a, voice	green
root bin with cdylibs	657 passed, 0 failed
root bin, all features (serve_door, door_steps, egress_ports)	green
root tests (plane_meter_seam_reachability, plane_host_universal_purity, route_tables_on_the_shipped_binary, metrics_scrape_boot_window, hook_parity_driver)	green
metrics_scrape_boot_window, all features	green
busbar-kernel	3042 passed, 1 failed

The one kernel failure is root_key_spelling, already red on the base (the llm lane's auth/inbound.rs).

Oracle, metrics cells (base 398a7cb vs head, engine 4a7a7bba)

• replay --baseline-version 1.5.5 --strict --id-filter '^(ops\.scrape\|metrics|neutrality\|metrics|hooks\|metrics|documented\|changelog\|spend-metrics|route\.failover\||crosscut\.traps\||llm\|[^|]*\|[^|]*\|request\|upstream_down)'
• record rc 0 and replay rc 1 on both sides.
• 72 judged rows on each side: 22 PASS, 28 ACCEPTED, 22 FAIL.
• The verdict and diff-hash lists are byte-identical (sha256 61be31b0…a963 on both sides).
• The llm plane's lane_state bytes are unchanged.

Follow-up stacked PR: the busbar_bucket_tokens model 0x1F leak, plus a class-wide /metrics label guard (ARCHITECT ruling: its own PR).

[github-actions]

promote into p6-d2-step3: NO VERDICT @71c0fb3e8

The hop ended without writing a verdict (runner lost, timeout, cancel, or it died before the engine judged): preflight: failure at step Run cargo run --locked --release --no-default-features -p busbar-release-cli --bin busbar-release -- ci preflight; publish: runner lost at step Run bash "$GITHUB_WORKSPACE/busbar-release/ci/promote/fallback.sh", Post Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.

No failing-test list exists for this run. Run: https://github.com/GetBusbar/busbar/actions/runs/38023773613 . Re-run the hop, or read the job's step list in the run page.

[MattJackson]

Closed (dead, not superseded): this D2 step is not on predev, and its base DEL (p3-flip-llm-del, under #526) was deleted unmerged. By ruling, D2 lands after #464 and DEL. That sequencing now waits as task draft-546-d2-kernel-stack (After: #464), which starts from the bundles. Branch bundled at ~/Library/Caches/busbar-release/salvage/GetBusbar_busbar-p6-d2-step4-1791610783.bundle (DEL and the never-pushed ripples onto it are in GetBusbar_busbar-p6-d2-stack-local-ripples-and-del-*.bundle) and deleted.