row 68: the breaker reads a plane fault at the far end (stacked on #561)

[MattJackson]

Row 68: the breaker reads a plane fault at the far end.

Stacked on #561 (p2-breaker-neutral-ts, row 66), which itself carries #502. This branch is #561's head b50da73 plus this row's commits, with origin/predev merged in. The landing order is #502, then #561, then this PR. Once #561 lands, this PR's own diff is the row-68 commits alone.

Spec:

• docs/design/BUSBAR-1.6.0.md Part 3 §12 "The route pump": far-end pieces are pushed FROM_FAR_END, the plane's answer may carry its own reading, and the breaker service classifies.
• OnPieceOut::fault (SEAM: 4l per-stream gRPC close (FinishIn final tail, SIDE_ACCEPT_STREAM, root framed streams), plane fault reading, ArriveOut ROUTE_STREAM + affinity #489): the plane's breaker fault reading of a far-end answer, in the transport kind's one FAULT_* vocabulary, which the breaker records against the destination.
• The ARCHITECT row 68 ruling (2026-10-06): a fifth shared reading, HEALTHY; a relayed non-success answer is recorded on the plane's first stated reading.

What changes

• Contract:
  • FAULT_HEALTHY = 4 (WireFault::Healthy): the destination answered and is healthy, whatever the status. It is relayed as a caller's answer is and recorded as a success.
  • Both the plane checker and the transport checker accept it.
  • FaultRow may state it.
  • The transport SDK's Piece::fault lets a framer state its own reading of a piece over its fault table. An example is a bare HTTP answer on a gRPC call, which is read by its HTTP band.
• kernel-breaker: classify_upstream records HEALTHY as Outcome::Success, labelled healthy. Every other reading keeps 1.5.5's four arms.
• Far end:
  • FarEnd::judged(token, fault) is new. After the plane answers a FROM_FAR_END piece, the pump hands its reading to the far end, before the verdict acts.
  • A relayed non-success answer (a caller fault, a hard-down, a degraded dispatch, an at-most-once operation) is held unrecorded. The plane's first stated reading of it is the one recorded.
  • When the plane reads the last piece without stating a reading, or the unit drops first, the transport's reading is recorded instead.
  • A success's head and a failure the walk fails over are recorded at once, as before.
  • A passthrough member's hard reading is still the caller's key, so nothing is recorded.
  • Health probes (ARCHITECT ruling on row 68, Part 3 §12: a probe's answer is classified as organic traffic is): a probe's success is recorded at once. Any other probe answer waits for the plane's reading, the same way a relayed organic answer does. The plane's first stated reading is recorded on every cell of the member (Breaker::probed). When the plane states none, or the probe drops first, the transport's reading is recorded.
• Root: the door's far end (DoorFar) hands the reading on to the walk.
• Integration fixes from merging predev over breaker: no protocol in kernel; the transport states its fault table, PIECE_END=128 rides the same framer lineage (row 66) #561:
  • door_clock's host tables name io: null.
  • serve_door_far's egress states stated_ceiling_secs: 0.
  • plugin-loader's conformance-only items are gated any(test, feature = "conformance"), as breaker: no protocol in kernel; the transport states its fault table, PIECE_END=128 rides the same framer lineage (row 66) #561 gates the suite. Without this, cargo test -p busbar-plugin-loader did not compile.
• Pins: the C header is regenerated from the merged ABI. busbar-transport-grpc is pinned at b6b269d99d, which is 1303273a73 (breaker: no protocol in kernel; the transport states its fault table, PIECE_END=128 rides the same framer lineage (row 66) #561's pin) plus five commits: a bare HTTP status on a call is an answer, and its fault is read by its HTTP band (401/403 hard).

Behaviour

1.5.5-identical. No plane on predev states a fault reading, so every relayed answer is still recorded with the transport's reading, which is 1.5.5's table. The only change is when the record happens: at the answer's last piece rather than its head.

Not in this PR

TAIL_REFUSED_PIECE, ROUTE_SCOPE_LOCAL, wait_member and metric_lanes stay on the a2a lane. They were introduced there, in commits that also carry a2a door changes, and are not part of the plane fault reading.

Proof (M3 prover)

Run at 6ccde92. Only the last commit moved after the main run, and it touched plugin-loader's cfg gates alone.

• Format and lint: cargo fmt --check is clean. cargo clippy --workspace --all-targets -D warnings is clean, and so is the scoped plugin-loader/connector run. cargo xtask abi-header is green.
• Tests: cargo test -p busbar-contract -p busbar-kernel-breaker -p busbar-kernel-egress -p busbar-kernel -p busbar gave 5510 passed and 7 failed.
  • The 7 failures are environmental. Six root::serve::framed_tests need the neutral_frame_door example; with cargo build --workspace --examples they pass 8/8. ledger_identity needs a GitHub clone of the oracle engine, and the VM has no credentials.
  • The row-68 cells pass:
    • far_end: 45/45, including the_planes_transient_reading_outranks_the_transports_callers_fault, the_planes_callers_reading_outranks_the_transports_hard_down, a_502_the_plane_reads_healthy_records_success, a_502_with_no_plane_reading_falls_back_to_the_status_table, an_answer_the_plane_never_reads_is_recorded_with_the_transports_reading and a_failed_over_answer_is_recorded_at_once_with_the_transports_reading.
    • door_far_tests::the_planes_fault_reading_reaches_the_breaker_through_the_doors_far_end
    • breaker_unit_tests::six_healthy_502s_in_a_row_do_not_trip_a_cell
    • port::tests::a_healthy_reading_is_a_relayed_success
• Probe ruling (c3259eb): the RED commit 36349ff alone fails a_probe_answer_the_plane_reads_healthy_records_success (a 502 read HEALTHY: success, the member recovers) and a_probe_answer_the_plane_reads_as_a_fault_records_that_fault (a 400 read TRANSIENT; a 502 read HARD). With the fix, plane_driver passes 117/117, including the existing probe cells and the new a_probe_answer_the_plane_states_no_reading_of_records_the_tables. cargo clippy -p busbar-kernel --all-targets -D warnings and cargo fmt --check are clean.
• busbar-core-connector and busbar-plugin-loader: 1021 passed and 9 failed. All 9 are artifact preconditions of a scoped run, not logic: the request/response framer door, the busbar_secret_env_plugin cdylib and a tcp plugin cdylib built twice under two feature sets in one target dir.

[MattJackson]

Marked draft: every change here is carried by #787 (verified: head/patches contained). Draft removes it from ModernCI's blocked-by set (ModernCI #292/#308) so #787 is judged on its own. It shows as merged once #787 lands.