row 155 B1b: the resolved provider carries its plane keys as one opaque table under the neutral merge

[MattJackson]

Row 155 B1b. Not a money ($) change. DRAFT, stacked on #937 (B1a) per queue rule 19: its head carries #937's commit. When #937 lands I'll merge origin/predev and ask for the undraft. Not run locally: only cargo fmt; ModernCI is the proof.

What (ARCHITECT ruling B1b, option (b))

• config::providers::ResolvedProvider is new and is not Deserialize. RootCfg::providers now holds it.
  • Typed fields: the keys the kernel owns, CORE_PROVIDER_KEYS. These are base_url, path and path_base (destination facts, per the ruling and 1.5.5 config_validate:406,430), api_key with its outbound-auth binding (auth, token_url, scope, subject; THE DESIGN §6), health and allow_metadata_hosts.
  • Every other key of the entry rides as one opaque ProviderTable.
  • Governing lines: BUSBAR-1.6.0.md ci: close the gaps the 1.5.3 release found, at the root #49 ("The kernel knows NO plane or transport STRINGS"); THE DESIGN §4 ("its dialect fields go to the planes that use the provider").
• The neutral merge (merge_tables). Where both sides hold a string map, it merges member by member and the deployment's member wins. Every other value the deployment sets replaces the catalog's. This is 1.5.5's merge (the error map unioned, every other key an override) stated without naming a key.
• ProviderCfg stays the frozen v1.5.3 parse shape.
  • No waivers. The config-schema snapshot is unchanged: the new type is not Deserialize, and the grammar types only gain a Serialize derive, which the fingerprint does not read (derive_list(..).contains("Deserialize")).
• The resolve_provider hook. merge_provider_fallback and PlaneDecl::resolve_provider return the resolved type. The legacy llm crate's hook delegates to the neutral merge; that is the smallest shim, and it goes with that crate.

Readers

• root::door_steps::kernel_sections hands the plane its table as written, plus path, path_base and the auth style. The root's per-key projection (organization, project, the lane-capability keys and their output_key mapping) is deleted. The one byte difference: an empty catalog model_capabilities now arrives as [] instead of absent. The plane reads it with #[serde(default)], so it means the same thing.
• Transitional reads. provider_routes, the kernel door's dialect facts and config_validate read the dialect word and the error map through two TRANSITIONAL accessors, ResolvedProvider::dialect and ResolvedProvider::error_map, which drain at B1c.
  • Every refusal keeps its text and its position in the per-provider sweep. B1a's pins hold them.
  • The contract key MODEL_PROTOCOL_KEYS[0] names the dialect key; the kernel spells no new one.
• Legacy lane carrier. It reads its tenant and lane-capability keys off the table (plane_host::LegacyLaneKeys, TRANSITIONAL, goes with the legacy llm crate).
• Secret walk. secret_refs walks ResolvedProvider, and ProviderCfg is inventoried NotInResolvedConfig. The inventory test now matches a type's whole name: before, IdentityProviderCfg { counted as a destructure of ProviderCfg.

RED

config::resolved_provider_tests::the_resolved_provider_carries_the_plane_keys_as_one_table_merged_by_the_neutral_rule. On base there is no table; every plane key was a typed field. Beside it: the_neutral_merge_rule_is_stated_by_shape_alone and an_unset_or_empty_deployment_leaves_the_catalog_table.

Rows

No gate row measures these fields (the "53 kernel hits" is no ledger row), and no ceiling moves:

• No plane or vendor noun is added or removed in a measured crate.
• The vendor scan does not split _-joined identifiers.

Queue rule 20 (widened by the ruling)

crates/busbar/src/root/door_steps.rs hunks are disjoint from #833, #841, #863 and #876:

• kernel_sections provider loop, l.1310-1380.
• RouteFacts inserted before provider_routes, l.1530.
• The provider_routes signature, plus one inserted .map after .iter().
• for_provider(&p).

git merge-tree of this head with origin/predev and with each of those four PR heads is clean. appbuild.rs and config_validate/mod.rs hunks are also disjoint from #876, #863 and #832.