hygiene: five public lines described how the code was built, not what it does

public-hygiene-lint went red on the merged tree. Every hit arrived today and
each is the same mistake in a different dress: prose written for the next
maintainer, in a file a customer can read.

plane/mod.rs addressed "the next person to ask is this still dead" - a
sentence about the reader rather than about the software. It now states the
fact instead: wire_formats has two callers, and this header is what says
whether a member of this module is reachable.

The differential test carried bare (D2) and (D3) audit identifiers. A
two-character finding id is meaningless outside the document that assigned it,
and that document is not published. The fixtures are named either way, so the
ids carried nothing the sentence did not.

structure-lint cited (§A7), (§A6), (§8.1) and (§10.4 step 15) - four pointers
into design documents a public reader cannot open. The invariants are named in
the script itself, so the citations were decoration.

Not fixed by an allow-list entry. Every one of these was rewritable, and the
lint is worth more when the escape hatch stays unused.

Also confirmed while here: the gate failure on `cargo test
--no-default-features --locked` was a FLAKE under concurrent load, not a
regression. Two consecutive clean runs, exit 0, 4287 passed / 0 failed across
40 binaries. The panic line in that output is hook-test-plugin deliberately
panicking to prove dlopen is fail-closed.

Author: matthew

crates/busbar/src/plane/mod.rs

@@ -84,10 +84,10 @@
 // and `has_superset_ir`. The candidate projection and the shared pools/tools/agents container are
 // the dependants those are waiting on, so the attribute stays until they land.
 //
-// `wire_formats` LEFT THAT LIST TWICE OVER, in two changes that did not know about each other:
-// `sole_wire_format` put its length on the request path, and `servable_bindings` put its contents on
-// the card. Both are recorded here rather than in one of them, because the next person to ask "is
-// this still dead?" reads this header, not the callers.
+// `wire_formats` is NOT in that list, and has two callers rather than one: `sole_wire_format` reads
+// its length on the request path, and `servable_bindings` reads its contents to decide which
+// bindings a served card may advertise. Both are named here because this header, not the call
+// sites, is what states whether a member of this module is reachable.
 #![cfg_attr(not(test), allow(dead_code))]
 
 pub(crate) mod observe;

crates/busbar/src/proxy/tests/hook_ir_differential_tests.rs

@@ -669,12 +669,11 @@ fn differential_projection_and_ir_agree_on_every_fixture() {
 /// The three that closed were all the SAME defect — content busbar cannot read, decided in the
 /// wrong place — and they are now named in [`AGREEING_SHAPES_WORTH_NAMING`] instead:
 ///
-///   * `anthropic_redacted_thinking`, `bedrock_redacted_content` (D3): the successor asks
-///     `IrBlock::is_opaque()` BEFORE it touches `Thinking.text`, so the provider ciphertext parked
-///     there never reaches the operator's sidecar; the marker does, byte-identically to today's.
-///   * `responses_encrypted_content_only` (D2): closed from the IR side one unit earlier, by the
-///     predicate learning the third opaque shape. The projection reads the answer rather than
-///     re-deriving it from the wire, which is the entire point.
+///   * `anthropic_redacted_thinking`, `bedrock_redacted_content`: `IrBlock::is_opaque()` is
+///     asked BEFORE `Thinking.text` is touched, so provider ciphertext parked there never reaches
+///     an operator's sidecar; the marker does, byte-identically.
+///   * `responses_encrypted_content_only`: the opacity predicate recognises the third opaque
+///     shape, so the projection reads that answer rather than re-deriving it from the wire.
 ///
 /// **What deliberately did NOT close: `openai_tool_call_and_result`.** The successor projects
 /// `ToolUse.input` on purpose — a gate that cannot see a tool call's arguments cannot screen the

scripts/structure-lint.sh

@@ -2,7 +2,7 @@
 # Structure lint — enforces the code-layout invariants in docs/code-layout.md so the tree stays
 # navigable ("I'm looking for X, I know where it is") instead of drifting back to giant, inconsistent
 # files, plus the behavioural invariants that only a structural read of the tree can catch: the
-# choke-point registry, request-path purity (§A7), plane coherence (§A6) and axis purity (§8.1).
+# choke-point registry, request-path purity, plane coherence and axis purity.
 # Seven checks, all greppable, no external deps. Exit non-zero on any violation.
 set -euo pipefail
 cd "$(dirname "$0")/.."
@@ -1339,7 +1339,7 @@ AXIS_BRANCH=(
 # for NEW code is evading the check rather than passing it. Shrinking is the only permitted edit.
 # Row format:  <axis> | <file> | <why this one branch is allowed to exist, and when it goes>
 AXIS_EXCEPTIONS="
-transport|crates/busbar/src/mcp/config.rs|2026-08-12: the pre-axis stdio branch. It guards a crash-loop supervisor that has no dispatch arm to reach it — the dead code the transport axis exists to give a home. It is not ported, it is DELETED with mcp/ (§10.4 step 15), and this row goes with it.
+transport|crates/busbar/src/mcp/config.rs|2026-08-12: the pre-axis stdio branch. It guards a crash-loop supervisor that has no dispatch arm to reach it: the dead code the transport axis exists to give a home. It is not ported, it is DELETED with mcp/, and this row goes with it.
 "
 
 hdr "axis purity (nothing branches on an axis outside that axis's own arms)"