row 155 oracle: llm stream_upstream_cut cells and their 1.5.5 goldens (stacked on L1#2 #891 and on #861)

Cargo.toml

@@ -108,10 +108,10 @@ busbar-auth-sigv4 = { git = "https://github.com/GetBusbar/busbar-auth-sigv4", re
 busbar-hook-ranking = { git = "https://github.com/GetBusbar/busbar-hook-ranking", rev = "7e1285e2e3293627723ab2754b9ddbfddeba9c46" }
 # THE MEMORY STORE (kind: store), pulled at a pinned rev: the logic crate the root links on its store
 # axis in every build (`[package.metadata.busbar.linked] store-memory`) and the plugin loader's `store`
-# both-ways fixture. The same package at the same rev, under the role the kernel's test build gives it
-# (`fixture-store`: a kernel source names no plugin). A rev bump moves both lines.
+# both-ways fixture. The kernel names it under no name: its test build links the in-crate R-FIX3
+# double (`busbar_kernel::test_support::store_double`), and the root's `linked_store_double` tests
+# prove the double states what this door states.
 busbar-store-memory = { git = "https://github.com/GetBusbar/busbar-store-memory", rev = "848851e63ac7a454eb3d5daf9e11d739c48d738b" }
-fixture-store = { package = "busbar-store-memory", git = "https://github.com/GetBusbar/busbar-store-memory", rev = "848851e63ac7a454eb3d5daf9e11d739c48d738b" }
 # ── A2A, from the a2aproject's OWN crates ──────────────────────────────────────────────────────
 # THE OBVIOUS NAME IS THE WRONG ONE. `a2a-rs` on crates.io is `emillindfors/a2a-rs` (MIT, v0.5.0) —
 # a different author entirely. The a2aproject family is the `a2a-*-lf` / `a2a-pb` set, all

conformance/manifest.json

@@ -37,7 +37,7 @@
     },
     {
       "claim": null,
-      "plan": "plane battery + served POST /v1/systemone on a booted busbar (systemone only; GET /v1/models keeps its 1.5.5 bytes)",
+      "plan": "plane battery + served POST /v1/systemone (one model; two models with upstream_model) and POST /api/evaluate (nanojev) on booted busbars; GET /v1/models keeps its 1.5.5 bytes",
       "public": true,
       "reason": "not served: POST /v1/systemone answers 404, the absence code on this boot; the decisions plane is registered and configured but no route serves its operation (the kernel plane driver serves it)",
       "standard": "jev decision plane",

conformance/registry.toml

@@ -149,7 +149,7 @@ not_run_reason = "planned 1.6.0 — h2spec leg not yet green (MATRIX-RULING B-ti
 [[suite]]
 id = "jev"
 standard = "jev decision plane"
-plan = "plane battery + served POST /v1/systemone on a booted busbar (systemone only; GET /v1/models keeps its 1.5.5 bytes)"
+plan = "plane battery + served POST /v1/systemone (one model; two models with upstream_model) and POST /api/evaluate (nanojev) on booted busbars; GET /v1/models keeps its 1.5.5 bytes"
 tier = "spec-conformant"
 label = "jev"
 verdict = "conformance-verdict-jev"

crates/busbar-kernel/Cargo.toml

@@ -86,14 +86,13 @@ busbar-kernel-scope = { path = "../busbar-kernel-scope" }
 # dump, and only under the non-default `timing` feature. The default build does not link it.
 libc = { workspace = true, optional = true }
 busbar-plugin-loader = { path = "../plugin-loader" }
-# THE STAND-IN LINKED ROWS (test-only edges): the composition root links the build's default store
-# and ranking hooks onto the cold-kind axis (`preflight::install_linked_rows`); a test build has no
-# root, so these stand in, under `test-support` (which the dev-dependency cycle through the plane
-# crates turns on for this crate's own tests). The store is a fixture, renamed to the role it plays:
-# no source here names the plugin. The ranking row is no crate at all: it is the in-crate R-FIX3
-# double `test_support::ranking_double`, linked only, and the root proves it states what the real
-# ranking door states.
-fixture-store = { workspace = true, optional = true }
+# THE STAND-IN LINKED ROWS are no crate at all: the composition root links the build's store and
+# ranking hooks onto the cold-kind axis (`preflight::install_linked_rows`); a test build has no root,
+# so the in-crate R-FIX3 doubles stand in, linked only — `test_support::store_double` (the store row
+# and the `MemoryStore` the kernel's tests build a `GovState` over) and `test_support::ranking_double`.
+# The kernel names no store crate under any name (THE DESIGN Part 2 #2: the kernel reaches a store
+# only through the store kind's door), and the root proves each double states what the real door
+# states.
 axum = { workspace = true }
 tower = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "time", "sync", "signal", "io-util", "io-std", "process"] }
@@ -242,7 +241,7 @@ loom-model = ["dep:loom"]
 # Exposes `test_support` to a DEPENDENT crate's tests (the bin's). Never on in a normal build;
 # the bin enables it from its [dev-dependencies] edge only. The contract's test double (its warn
 # capture) is always compiled (ARCHITECT SD-3 queue (4)), so nothing forwards there.
-test-support = ["dep:reqwest", "dep:rcgen", "dep:fixture-store", "busbar-kernel-identity/stand-in", "busbar-plugin-loader/test-support"]
+test-support = ["dep:reqwest", "dep:rcgen", "busbar-kernel-identity/stand-in", "busbar-plugin-loader/test-support"]
 # The debug-only per-method micro-timing in `src/timing` (folded from busbar-timing, OWNER Q70).
 # DEFAULT OFF: with this off, `timeit!` expands to `()` and the RAII guards it produces are
 # zero-sized no-ops, so the `drop(_guard)` calls that end a timed span are compiled in ONLY under this

crates/busbar-kernel/src/audit/tests/journal_tests.rs

@@ -755,10 +755,10 @@ fn an_evicted_neutral_scopes_tampered_tail_surfaces_a_break_on_resume() {
 /// AUDIT-INTEGRITY FIX: `append_scoped` hardcoded every row's `PlaneRecord::ts` to `0`, which defeats
 /// retention entirely — `purge_plane_records_before` drops any row with `r.ts < before`, so a `ts` of
 /// 0 makes every row look infinitely old and the FIRST retention sweep deletes the whole class
-/// regardless of how recently it was written. Proven over the REAL `busbar-store-memory` backend
-/// (not this file's in-RAM `MockStore`, whose `purge_plane_records_before` is a stub that always
-/// answers 0 and so cannot exercise this): a record appended just now must SURVIVE a retention sweep
-/// whose cutoff is safely in the past.
+/// regardless of how recently it was written. Proven over the kernel's store double, which carries
+/// the shipped RAM store's retention (not this file's in-RAM `MockStore`, whose
+/// `purge_plane_records_before` is a stub that always answers 0 and so cannot exercise this): a
+/// record appended just now must SURVIVE a retention sweep whose cutoff is safely in the past.
 #[test]
 fn append_scoped_stamps_a_real_instant_so_a_fresh_row_survives_retention() {
     let store: Arc<dyn busbar_contract::records::RecordStore> =

crates/busbar-kernel/src/governance/mod.rs

@@ -1508,10 +1508,10 @@ impl<T> IntoStoreResult<T> for Result<T, getrandom::Error> {
     }
 }
 
-// The universal test double: the build's default store, which the composition root links onto the
-// store axis (the kernel names no store); a test build links it as its store fixture.
+// The universal test double: the in-crate R-FIX3 store double (`test_support::store_double`), which a
+// test build also links as its stand-in store row. The kernel names no store crate.
 #[cfg(any(test, feature = "test-support"))]
-pub use fixture_store::MemoryStore;
+pub use crate::test_support::store_double::MemoryStore;
 
 /// The write-behind flusher: on a fixed cadence (and once more on graceful shutdown) pushes the
 /// dirty in-memory budget cells and the accumulated `pending_metering` rows to the durable store off

crates/busbar-kernel/src/governance/state.rs

@@ -480,17 +480,16 @@ impl GovState {
     /// is read.
     ///
     /// Deliberately returns the secret rather than a ready-made HMAC, so this module keeps knowing
-    /// nothing about what any consumer seals: a plane's ask-state codec
-    /// ([`crate::plane::approvals::Sealer::derive`]) does its own domain-separated derivation, which is
-    /// what keeps its blobs and this module's virtual-key tokens unable to verify as one another.
-    /// Secret-equivalent: never log it, never put it in a `Debug`.
+    /// nothing about what any consumer seals: a consumer does its own domain-separated derivation,
+    /// which is what keeps its blobs and this module's virtual-key tokens unable to verify as one
+    /// another. Secret-equivalent: never log it, never put it in a `Debug`.
     ///
     /// The FLEET-SHARED property is the reason this is usable for a state seal at all. One logical
     /// caller-facing exchange spans several independent requests, which different nodes may serve;
     /// a per-process key would make the second request fail on whichever node did not mint the first.
-    // Its consumer is the ask-state sealer (`crate::plane::approvals::Sealer`), driven by whichever
-    // plane seals caller-facing state; with no such plane installed it has no caller. Unconditional
-    // allow — the neutral seam names no plane feature.
+    // No in-core consumer: a plane seals its caller-facing state over the host's `sign` (ARCHITECT
+    // Q-L3B-ASK; the in-core ask-state sealer is deleted, audit K2-H3). Unconditional allow — the
+    // neutral seam names no plane feature.
     #[allow(dead_code)]
     pub fn signing_secret(&self) -> Option<[u8; 32]> {
         self.signing_material().map(|m| m.signer.secret_bytes())