row 155: the codec's entropy and wall clock leave the contract; a codec is handed a CodecHost (stacked on #974)

[MattJackson]

Row 155 (lane-p3-llm), coordinator/contract-ABI ruling. busbar-contract is the ABI's single home of shapes and holds no state (BUSBAR-1.6.0.md Part 4; spec l.3701: "Services are reached only through the host tables handed at open"; l.4589: no static/OnceLock in the contract). This PR removes two of the codec host-service statics from crates/busbar-contract/src/codec.rs: ENTROPY_SOURCE and WALL_CLOCK.

STACKED ON #974 (DRAFT until #974 lands, rule 19). #974 rewrites the same DialectCodec error-head hunk this PR threads the host through (attach_error_response_headers → error_response_fields), so this branch carries #974's head. After #974 lands: retarget is already predev; merge origin/predev, push once, undraft.

What

• The contract keeps only the shape: codec::CodecHost (fill_entropy, wall_clock_now). The free ports (install_entropy_source, fill_entropy, install_wall_clock, wall_clock_now) and their two statics are deleted.
• Every codec entry point that mints an id or stamps a time now takes a borrowed &dyn CodecHost, passed down the codec call graph:
  • OperationHandler: read_response, read_response_value, extract_usage
  • IrHandle: write_egress_request, write_ingress_response(_bytes), wrap_buffered_as_stream
  • DialectCodec: probe_body, write_error, write_response_exception, write_error_frame, error_response_fields, ingress_response_request_id
  • StreamTranslator: feed, finish, terminal_error_frame
  • the plane's ProtocolReader/ProtocolWriter and the exchange layer (refuse, reply, relay, whole, attempt, probe)
  • synth_rng::fill_entropy
• Who hands which host:
  • Linked engine (busbar-llm) and the kernel's error path: busbar_kernel::proto::CodecHostServices, which is the OS CSPRNG and store::now. These are exactly the sources the kernel armed before.
  • The llm door: DoorHost, built over the instance's own Services handed at open (random.fill, chunked at MAX_RANDOM_FILL, and clock.now). There is no global.
  • The Plane-trait surface (plane.rs): the context's clock and no random source. A plane holds none, and nothing drives this surface in production.
• Hot ABI: the entropy_fill/wall_clock slots are now served by the kernel's vtable. The contract's SERVICES no longer answers them, and arm no longer installs them. The latch and cap slots are unchanged.
• a2a/voice test clocks read the system clock directly. That is the same reading store::now gives, and it adds no busbar_kernel:: line (ports-only ceilings unchanged).

Bytes unchanged

The values and the draws are the same. Each draw is one host call (synth_rng holds no pool since #869). Ids keep their prefix, shape and alphabet. created falls back to the host clock as before. The kernel's entropy and clock are the same functions it armed before.

RED

1. CodecHost's compile_fail doctests: busbar_contract::codec::fill_entropy(..) / wall_clock_now() no longer compile, so a codec cannot reach the host without the handle.
2. qa/contract-stateless.toml: struck the codec.rs contract-stateless:static rows ENTROPY_SOURCE and WALL_CLOCK, 44 → 42 rows. A static put back is a NEW finding (Law 9: the ceiling only falls).
3. crates/busbar-plane-llm/src/codec/tests/codec_host_tests.rs has two tests:
   • A minted id and a stamped created come only from the handed host (fixed bytes give a uniform token, and a fixed clock gives that second).
   • A host with nothing to give mints from nothing (an all-0 token, created: 0).

Ledger

• qa/contract-stateless.toml: struck 2 rows (static ENTROPY_SOURCE, static WALL_CLOCK), 44 → 42. The codec.rs once-cell OnceLock row stays: USAGE_TAP_FAULT_* and TRANSLATE_CAP_READER remain until their own change.

Next in this row (own PRs, per the coordinator's rulings)

• USAGE_TAP_FAULT_REPORTER/LATCH: the kernel keeps busbar_billing_tap_decode_fail_total and the process-wide warn-once; the door reports the fault as data on its existing return.
• TRANSLATE_CAP_READER: the cap reaches the plane as settings at open/refresh.

Overlap (rule 20)

• Same hunk as row 155 B2: the protocol seam names no http type; head fields and u16 statuses, the kernel converts at its edges (TODO 34c (a)) #974, so this PR is stacked on it.
• Disjoint hunks in files also edited by Law 0 root (PR2a): the root's unit tests name no plane, transport or auth instance #1017, kernel: the word interner (Registration) moves out of busbar-contract #994, row 155 B1c-1: the plane states its provider keys as a neutral descriptor in its Statement (dormant seam) #981, llm anthropic: translated stream's in-stream error event carries request_id (ErrorResponse requires it) #967, contract-stateless: the plugin-logging capture is the one sanctioned per-thread slot; a second stays red #944, row 155 F25 REHOME: misc non-money rows (plane door, egress ports, auth, metrics) #910, contract: the cold lane's SDK side is deleted; abi/cold 272 -> 43 (row 84) #904. Test merges with row 155 B1c-1: the plane states its provider keys as a neutral descriptor in its Statement (dormant seam) #981/llm anthropic: translated stream's in-stream error event carries request_id (ErrorResponse requires it) #967/contract-stateless: the plugin-logging capture is the one sanctioned per-thread slot; a second stays red #944/row 155 F25 REHOME: misc non-money rows (plane door, egress ports, auth, metrics) #910/contract: the cold lane's SDK side is deleted; abi/cold 272 -> 43 (row 84) #904 are clean. kernel: the word interner (Registration) moves out of busbar-contract #994 and the contract-stateless.toml drafts conflict only as adjacent ledger rows; whoever lands second settles them by hand (rule 13). Law 0 root (PR2a): the root's unit tests name no plane, transport or auth instance #1017's synth_rng.rs conflict is against predev's llm codec: no per-thread or process-global state in the entropy seam and the transcription boundary (row-159 L1#4, L2#6, L3#1) #869 itself.