row 130 E1+E7: the hyper serve loop leaves busbar-kernel; the kernel's no-socket pin

[MattJackson]

/status row 130 (E1 + E7): the hyper serve loop leaves busbar-kernel, and a test holds the kernel to the sockets it still has.

Plan: E1-E7 are the row's five items plus "every dial and listener", in order: E1 hyper serve, E2 net_guard, E3 duplex_ws dial, E4 hostless seam, E5 engine pool, E6 the kernel's own dials, E7 the proof.

E1: the serve loop moves to the root. The connector already binds the data and admin listeners (Listening::bind_stream) and hands each admitted stream up. Serving that stream is now the root's job, in crates/busbar/src/root/listener.rs. It covers the hyper-util auto builder, graceful shutdown, the body-read bounds, the accept backoff and the connection-placement balancer. Sources:

• BUSBAR-1.6.0.md l.475-483, INBOUND-LISTEN: the root's stream hand-up.
• The ARCHITECT ruling on Move the listener serve loop out of busbar-kernel into the root #710 (2026-10-10).

This is #741's change, redone on current predev. It supersedes #741, which went stale and conflicting. The details:

• busbar-kernel/src/tls.rs had not changed since #710: rebalance the law0 ceilings for the verbatim listener move (architect ruling) #741's base, so listener.rs is the moved code with only crate:: changed to busbar_kernel:: and the docs updated.
• The accept-source trait (Admits, Admitted) moves to busbar-core-connector/src/listen.rs, next to the Listening that implements it.
• tls.rs keeps only read_pem, which outbound callers still use.
• The kernel drops tokio-util.
• Tests move with the code. The kernel's tls_tests.rs and busbar/tests/tls_listener_h2.rs become root/tests/listener_tests.rs and listener_h2_tests.rs. The connector's TLS-listener rows join them and keep predev's unique scratch-PEM names.

Ledgers:

• law0 busbar-kernel x transport goes 285 -> 268 and busbar x transport goes 208 -> 225. The total stays flat, as the Move the listener serve loop out of busbar-kernel into the root #710 ruling requires.
• The population floor goes 947 -> 948, because root/listener.rs is a new file.

E7: the proof. New test crates/busbar-kernel/tests/no_socket.rs. It scans busbar-kernel's production source for TcpStream, TcpListener, UdpSocket, lookup_host, hyper_util::{client,server}, serve_connection, tokio_tungstenite, reqwest::, socket2 and axum::serve. It also scans the [dependencies] asks: hyper-util, tokio-tungstenite, reqwest and tokio's net.

• The pin holds today's offenders and is drain-only (Law 9).
• A new offender is RED. A pin the tree no longer has is also RED, so each drain strikes its own line.
• The RED arm plants a dial, a resolver and a server stack, and checks that each one is seen. It also checks that a comment and a test file are not counted.
• Row 130 is done when the pin is empty.

What the pin holds after this PR:

• E2: net_guard.rs lookup_host. The next PR, stacked on this one, drains it.
• E3: egress/duplex_ws.rs. Its one consumer is busbar-voice, deleted by FLIP-STREAMING: the streaming plane served through its door; busbar-voice deleted #503.
• E5: the engine pool (egress/engine/*, egress/mod.rs, secure.rs) and its manifest asks.

Not touched: #780's connector files, and rows 104 and 105.

Proof on the M3 prover:

• cargo test -p busbar-kernel --test no_socket: 3 passed. The RED arm sees a planted dial, a resolver and a server stack.
• cargo test -p busbar --bin busbar root::listener: 17 passed. This covers the moved listener and h2 suites.
• cargo test -p busbar-core-connector --lib listen: 9 passed.

Gates, clippy and the full suite are left to ModernCI.

[github-actions]

promote into predev: all green @161a88323

Already red on predev, not this PR's: 10

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:law0	5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	8 finding(s) over 32 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c
kind-isolation-ship	kind-isolation:law0	5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 24707, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38313302598 . Artifact verdict-161a883231742c462ee2adc93accf7f80fbc942d (failures.json, junit.xml, raw.log; 90 days).

[MattJackson]

Marked draft: #800 carries this branch's head (verified ancestor). Draft removes it from ModernCI's stack/blocked-by set (ModernCI #292/#308) so #800 is judged on its own. It shows as merged once #800 lands.