K1-10 / Q-STEP9-a: pools is reserved; the strip runs at exact depths; an entry named after a reserved key is refused

[MattJackson]

K1-10 / Q-STEP9-a, carried onto predev from the orphaned #599 (it sat on #559 → #554 → #546 → p6-d2-kernel, whose #526 closed unmerged). Supersedes #599, minus #670 (P1b), which predev cannot take as written; that is its own task.

Authority. BUSBAR-1.6.0.md Part 0 §4 (predev 9c0a394):

• l.552-554: the reserved core-owned sub-keys are read by the kernel and stripped before the section reaches the plane;
• l.566: "a plane entry named after any reserved key is refused at validation with a clear message (a generic check)";
• l.244 / l.538: tool and agent pools sit under the plane verb as a reserved pools sub-key.

ARCHITECT Q-STEP9-a, 2026-10-07. On predev docs/design/1.6.0-QUESTIONS.md still says pools is not reserved: under a declared verb, <verb>.pools.<p>.breaker/tier and members[i].tier reached the plane's validate.

Changes

• config_validate::deal::strip takes the reserved keys at EXACT depths, and nowhere else:
  • the section's own level;
  • each registration;
  • each pool (pools.<p>);
  • each pool member (pools.<p>.members[i]).
• Under a declared verb, pools is reserved and leaves whole. Under the root pools: section every depth-1 key is a pool, as in 1.5.5, so a pool named tier, work or breaker is a pool and crosses.
• The generic check: a depth-1 entry named after a reserved key whose value is plainly not that knob is refused at load (--validate and boot), at the entry's own path and position, in section::reserved_name_refusal's sentence (1.5.5's bytes for the two section words).
• The shape judge reads the hooks word off RESERVED_SECTION_KEYS (root_key_spelling).
• The maps-of-maps limit is stated with an example of what slips through.

Merge with predev. Predev's entry timeout (4757514, R2-G) stays a reserved sub-key beside pools, so there are nine. The shape judge reads timeout as a scalar. So an entry named timeout is refused like every other reserved name instead of being silently stripped; the cells are in red_a_value_plainly_not_its_knob_names_an_entry.

REDs (kept from #599)

• deal: red_each_exact_depth_is_stripped_and_recorded_at_its_path, red_root_pools_named_after_a_knob_are_pools_and_cross, red_a_value_plainly_not_its_knob_names_an_entry;
• root boot: red_3g_deals_a_root_pool_named_after_a_knob_as_a_pool;
• the cli_validate refusal cell.

Proof (Latchkey, this tree)

Check	Job	Result
cargo check --workspace --all-targets	cli-6ab466bb	0
clippy -p busbar-contract --all-targets -D warnings	cli-5563a967	0
clippy -p busbar-kernel --all-targets -D warnings	cli-764718a3	0
clippy -p busbar --all-targets -D warnings	cli-7a03fb42	0
test -p busbar-contract	cli-246525c8	1284 passed, 0 failed
test -p busbar-kernel	cli-190e3ae6	2885 passed, 0 failed
test -p busbar-plane-mcp	cli-ffbcb34e	453 passed, 0 failed
test -p busbar-plane-a2a	cli-07815130	162 passed, 0 failed
test -p busbar-plane-decisions	cli-5c97202c	108 passed, 0 failed
test -p busbar-plane-llm	cli-b74b19b1	2281 passed, 0 failed
test -p busbar-plane-streaming	cli-cd320d5f	207 passed, 0 failed
test -p busbar	cli-19e81f5e	654 passed; 22 failed, the identical set predev 9c0a394 fails on this runner (job cli-e6de4be3: the neutral frame door cdylib is not built there, and a leaked serve-framed-wild publication under one-process cargo test; CI's test:workspace runs under nextest)

[github-actions]

promote into predev: BOARD @d29f33cdd: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base bd3947661: 0 new red, 0 worse, 5 standing (excused).

tests passed: 24304, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38054211991 . Artifact verdict-d29f33cdd3b6d823aa0adb05383b82b077d40d4a (failures.json, junit.xml, raw.log; 90 days).