kernel-audit: the record names its sealing node; resume rebuilds the heads; one canonicaliser; dead surface struck (Q128)

[MattJackson]

kernel-audit (Q128): the audit record names the node that sealed it, a resume rebuilds the head history, one canonicaliser serves both chains, and dead surface is struck. HIGH 1 is not in this PR; see below.

What changed (audit and money records)

• HIGH 2. AuditRecord carries node, the node half of every op_id the kernel mints (busbar_kernel::door::node). THE DESIGN section 1: "when (wall + monotonic, node)".
  • It is digested in v4 right after mono, journalled in audit.v4, and published in the range read.
  • v4 had not shipped, so it is edited in place. The frozen v4 hex, the worked example in docs/audit-chain-digest-v4.md (489-byte preimage, new hash and signature) and the xtask verifier table are regenerated.
  • No 1.5.5 byte moves. 1.5.5 served only GET /audit off the admin chain; the fixed chain and its head, range and keys reads are 1.6.0-additive.
• MEDIUM. AuditChain::resume takes the sealed records and rebuilds the head history. After a restart the head read answers with the tip (never a null head beside next_seq > 1), and every window keeps its anchor. The root's resume_audit uses it.
• LOWs.
  • The amendment journal's on-demand verify covers the corrections copy that the money read uses.
  • The journal decodes subjects through the one round-tripping decoder.
  • The kernel's duplicate Digest/Framing is now a re-export of the audit unit's canonicaliser.
  • Struck: heads_body, prune_records_before, AuditChain::verify_to_head (with its record_tests tail-truncation cell; the amendment chain keeps its own head check), sampling_heads_every, AuditKeySet::insert_signer, amend::amends, Recipe::V3.
• HIGH 1 is not in this PR. It turns the NODE/SINK statics into an owned NodeJournal, and it waits on the D2 stack (D2 step 2: the kernel's proxy splits by concern; failover is the kernel's route #546, D2 step 3: route input, host vocabulary and DispatchScope leave plane_host; TLS is the connector's #554, D2 step 4a: the kernel's EngineHost leaves plane_host; door-plane trips are on /metrics; reclaim-on-drop proven on the plane driver #559). The hook_read call sites it threads through (plane_host l.707, l.1404, l.2549) are moved verbatim by D2 step 3: route input, host vocabulary and DispatchScope leave plane_host; TLS is the connector's #554 and D2 step 4a: the kernel's EngineHost leaves plane_host; door-plane trips are on /metrics; reclaim-on-drop proven on the plane driver #559. Until it lands, the door-only.toml SINK row stays. It follows as its own PR after D2 step 4a: the kernel's EngineHost leaves plane_host; door-plane trips are on /metrics; reclaim-on-drop proven on the plane driver #559.

How it was proven

Latchkey cli-0e13af0e-dba1-417d-985b-50d86d7a407d ran on this head (447bac5, predev 76e1fd0 merged):

• fmt passed, and clippy -p busbar-kernel-audit -p busbar-kernel -p busbar -p xtask --all-targets -D warnings passed.
• Tests, 0 failed in each crate:
  • busbar-kernel-audit: 7 passed
  • busbar-kernel: 2861 passed
  • busbar (bin and every integration target except ledger_identity, which CI runs with the oracle clone): 1037 passed
• RED: each fix's production line was put back to predev's behaviour (window-only verify, the journal's lax subject decoder, a tail-only resume, no node digested or stamped). These cells FAIL:
  • amend_journal_tests (2)
  • a_record_names_the_node_that_sealed_it_in_its_digest_and_its_range_read
  • a_subject_value_that_does_not_re_render_is_refused_in_a_sealed_body
  • a_signed_record_round_trips_through_its_journal_body
  • head_history_survives_a_restart_rebuilt_from_its_records
  • every_record_the_book_seals_names_this_node
  • after_a_restart_the_head_read_answers_with_the_tip_and_the_anchors_survive
• xtask: 859 passed, 1 failed. The failure is cli::selftest_runs_every_registered_gates_red_proof, which reports "unproven gate(s): plane-purity, config-schema". This PR touches neither gate; its xtask change is the audit_verify table only. The same cell is red on FLIP-STREAMING: the streaming plane served through its door; busbar-voice deleted #503's board, and diagnostic job cli-8d9dde57-b2be-4323-8e19-942b5a2537f8 reproduced it on this head. It is left to CI's own run.

Oracle verdict

Strict replay against golden/1.5.5 over the money, ledger, usage, billing and admin audit/verify cells, base predev 76e1fd0 against this head:

• head: 68 PASS, 20 UNBASELINED, 0 FAIL
• base: 68 PASS, 20 UNBASELINED, 0 FAIL
• No cell moved, and no unsigned 1.5.5 cell moved.

[github-actions]

promote into predev: BOARD @447bac519: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 96 shipped edge instance(s) over 32 class(es), 96 declaration(s); 59 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	4 finding(s), 43 test edge instance(s) over 26 class(es), 43 declaration(s); 27 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	18 finding(s) over 14 neutral crate(s): law0-rise busbar × auth 49 hit(s) against a ceiling of 42: this landing grew a neutral crate's instance vocabulary. Ceilings only fall (measured on predev f830f
kind-isolation-ship	kind-isolation:deps	13 finding(s) over 96 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	18 finding(s) over 43 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	18 finding(s) over 14 neutral crate(s): law0-rise busbar × auth 49 hit(s) against a ceiling of 42: this landing grew a neutral crate's instance vocabulary. Ceilings only fall (measured on predev f830f
kind-isolation-ship	kind-isolation:faces	3 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base dc83ff155: 0 new red, 0 worse, 5 standing (excused).

tests passed: 24468, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/37718054596 . Artifact verdict-447bac519f9dfa0e4f43d462848bdaf30f102586 (failures.json, junit.xml, raw.log; 90 days).