docs: refresh metrics to 1,583 tests, archive handoffs, cargo clean

- Root docs (README, STATUS, WHATS_NEXT, CHANGELOG) updated to 1,583 tests,
  194 source files, 18+ entry type variants
- Wave 76 + deep debt session entries in STATUS/CHANGELOG
- entry_tests.rs smart-split (845→639L + 213L trust tests)
- DispatchOutcome::is_ok #[allow] → #[cfg_attr(not(test), expect)]
- Handoffs archived: Wave 69 FRAGO, handler evolution
- New handoff: LOAMSPINE_DEEP_DEBT_WAVE76_JUN03_2026
- sporeprint validation-summary metrics aligned
- cargo clean: 9,102 files, 6.1 GiB removed

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: BiomeOS Developer

CHANGELOG.md

@@ -9,6 +9,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.9.16] - 2026-04-08
 
+### Changed (June 3, 2026 — Deep Debt: Lint Evolution, Test Cohesion, Clone Audit)
+
+- **Lint evolution**: `#[allow(dead_code)]` on `DispatchOutcome::is_ok` evolved to `#[cfg_attr(not(test), expect(dead_code))]`.
+- **Smart-split**: `entry_tests.rs` 845→639L. Cross-gate trust tests → `entry_tests_trust.rs` (213L).
+- **Clone audit**: High-clone files confirmed test-only or O(1) Arc clones.
+
+### Added (June 3, 2026 — Wave 76 Parity Sprint: Cross-Gate Trust Entry Schema)
+
+- **`EntryType::KeyExchange`**: Ed25519 key exchange between two gates.
+- **`EntryType::TrustIssuerRegistration`**: Trust issuer registration with scope and capabilities.
+- **`EntryType::TokenVerificationCrossGate`**: Cross-gate token verification event.
+- All three in `"trust"` domain, excluded from waypoint spines.
+- 9 new tests (domain, waypoint, serde roundtrips).
+
 ### Changed (June 2, 2026 — Evolution: Readiness Diagnostics, Attribution, Auth Peer Info)
 
 - **Readiness probe**: Exercises storage read and reports spine count.

README.md

@@ -6,7 +6,7 @@
 
 [![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)]()
 [![Version](https://img.shields.io/badge/version-0.9.16-blue)]()
-[![Tests](https://img.shields.io/badge/tests-1%2C574%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-1%2C583%20passing-brightgreen)]()
 [![Coverage](https://img.shields.io/badge/coverage-90.9%25%20line-brightgreen)]()
 [![Methods](https://img.shields.io/badge/JSON--RPC-44%20methods-blue)]()
 [![JH-0](https://img.shields.io/badge/JH--0-method%20gate-green)]()
@@ -85,7 +85,7 @@ loamSpine/
 │   │       ├── config.rs          # Configuration
 │   │       ├── discovery/         # Capability registry + DynSigner/DynVerifier
 │   │       ├── discovery_client/  # HTTP discovery client + ResilientDiscoveryClient
-│   │       ├── entry/             # Entry types (15+ variants, MessagePack / rmp-serde canonical)
+│   │       ├── entry/             # Entry types (18+ variants incl. cross-gate trust, MessagePack / rmp-serde canonical)
 │   │       ├── infant_discovery/  # DNS-SRV, mDNS-SD, registry discovery
 │   │       ├── manager/           # Certificate manager
 │   │       ├── niche.rs            # Primal self-knowledge (capabilities, deps, costs)
@@ -208,13 +208,13 @@ Security invariant: `BIOMEOS_INSECURE=1` + non-default `FAMILY_ID` → refuse to
 |--------|-------|
 | **Version** | 0.9.16 |
 | **Edition** | 2024 |
-| **Tests** | 1,574 passing (all concurrent, ~3s, zero flaky) |
+| **Tests** | 1,583 passing (all concurrent, ~3s, zero flaky) |
 | **Coverage** | 90.92% line / 89.09% branch / 92.92% region (llvm-cov) |
 | **Clippy** | 0 warnings (pedantic + nursery + `missing_const_for_fn`, `-D warnings`) |
 | **Unsafe Code** | 0 (`#![forbid(unsafe_code)]`) |
 | **Lint Exceptions** | 4 `#[allow]` in production (2× tarpc `wildcard_imports`, 1× feature-conditional `unused_mut`, 1× feature-conditional `unused_async`); 4 `#[expect(dead_code)]` for pre-wired strandGate deploy entry points; tests all `#[expect(reason)]` |
-| **Max File Size** | 605 max production; 787 max test file |
-| **Source Files** | 193 `.rs` files across 3 workspace crates (+ 3 fuzz targets) |
+| **Max File Size** | 640 max production; 789 max test file |
+| **Source Files** | 194 `.rs` files across 3 workspace crates (+ 3 fuzz targets) |
 | **License** | AGPL-3.0-or-later + ORC + CC-BY-SA-4.0 (scyBorg triple) |
 | **SPDX Headers** | All source files |
 | **ecoBin** | Zero C dependencies (pure Rust) |

STATUS.md

@@ -3,7 +3,7 @@
 # Implementation Status
 
 **Current Version**: 0.9.16  
-**Last Updated**: June 2, 2026
+**Last Updated**: June 3, 2026
 
 ---
 
@@ -19,7 +19,7 @@ This document tracks implementation progress against the specification suite in
 |------|--------|-------|
 | [LOAMSPINE_SPECIFICATION.md](specs/LOAMSPINE_SPECIFICATION.md) | COMPLETE | Master spec implemented |
 | [ARCHITECTURE.md](specs/ARCHITECTURE.md) | COMPLETE | Component layout matches spec |
-| [DATA_MODEL.md](specs/DATA_MODEL.md) | COMPLETE | Entry, Spine, Chain, SpineConfig, EntryType (15+ variants) |
+| [DATA_MODEL.md](specs/DATA_MODEL.md) | COMPLETE | Entry, Spine, Chain, SpineConfig, EntryType (18+ variants incl. cross-gate trust) |
 | [PURE_RUST_RPC.md](specs/PURE_RUST_RPC.md) | COMPLETE | tarpc + pure JSON-RPC (hand-rolled), no gRPC/protobuf/jsonrpsee. Semantic naming. Protocol escalation (`IpcProtocol` negotiation). |
 | [WAYPOINT_SEMANTICS.md](specs/WAYPOINT_SEMANTICS.md) | COMPLETE | `anchor_slice`, `checkout_slice`, `depart_slice`, `record_operation` implemented. `WaypointConfig` with `AttestationRequirement` (None/BoundaryOnly/AllOperations/Selective). `AttestationResult` for capability-discovered attestation providers. `PropagationPolicy`, `SliceTerms`, `SliceOperationType`, `WaypointSummary` types defined. `RelendingChain` with multi-hop sublend/return. `ExpirySweeper` for auto-return. |
 | [CERTIFICATE_LAYER.md](specs/CERTIFICATE_LAYER.md) | COMPLETE | Core CRUD + loan/return + sublend + `verify_certificate` + `generate_provenance_proof` + escrow + `UsageSummary` integrated into `CertificateReturn` and `LoanRecord`. `WaypointSummary` re-used from waypoint module. Scyborg license schema. Certificate module: types, lifecycle, metadata, provenance, escrow, usage, tests. |
@@ -46,14 +46,14 @@ This document tracks implementation progress against the specification suite in
 
 | Metric | Target | Current |
 |--------|--------|---------|
-| Tests | — | 1,574 (193 source files) |
+| Tests | — | 1,583 (194 source files) |
 | Concurrent testing | — | All tests concurrent (zero `#[serial]`), zero flaky storage tests |
 | Coverage (llvm-cov) | 90%+ | 90.92% line / 89.09% branch / 92.92% region |
 | `unsafe` in production | 0 | 0 (`#![forbid(unsafe_code)]`) |
 | Clippy pedantic+nursery | 0 | 0 (including `missing_const_for_fn` at warn level) |
 | Doc warnings | 0 | 0 |
-| Max file size | < 800 lines | 605 max production (discovery_client/mod.rs); 787 max test file (service_tests.rs) |
-| Source files | — | 193 `.rs` files (+ 3 fuzz targets) |
+| Max file size | < 800 lines | 640 max production (entry/mod.rs); 789 max test file (service_tests.rs) |
+| Source files | — | 194 `.rs` files (+ 3 fuzz targets) |
 | Edition | 2024 | 2024 |
 | `#[allow]` in production | 4 | 2× `clippy::wildcard_imports` (tarpc macro; `#[expect]` unfulfilled in test target) + 2× `clippy::unused_async` (feature-conditional for dns-srv/mdns; `#[expect]` unfulfilled with `--all-features`) |
 | `#[allow]` in tests | 0 | 0 (all migrated to `#[expect(reason)]` or removed as unfulfilled) |
@@ -148,6 +148,24 @@ Gap to A++: `seed_fingerprint` (build-time BLAKE3 hash of the released binary).
 
 ---
 
+## v0.9.16 Deep Debt — Lint Evolution, Test Cohesion, Clone Audit (June 3, 2026)
+
+- **Lint evolution**: Last `#[allow(dead_code)]` on `DispatchOutcome::is_ok` evolved to `#[cfg_attr(not(test), expect(dead_code))]`.
+- **Smart-split `entry_tests.rs`**: 845L → 639L. 9 cross-gate trust tests extracted to dedicated `entry_tests_trust.rs` (213L). All source files under 800L.
+- **Clone audit**: High-clone files (`expiry_sweeper` 20, `certificate_loan` 16) audited — all test-only or O(1) Arc clones. Zero optimizable clones.
+- **10-dimension audit clean**: Zero files >800L, zero unsafe, zero TODO/FIXME, zero hardcoded paths in prod, zero mocks in prod. 8 `#[expect(dead_code)]` documented with deployment context.
+- **Test count**: 1,583 (unchanged). 194 source files (up from 193).
+
+---
+
+## v0.9.16 Cross-Gate Trust Entry Schema — Wave 76 Parity Sprint (June 3, 2026)
+
+- **3 new `EntryType` variants**: `KeyExchange`, `TrustIssuerRegistration`, `TokenVerificationCrossGate` for cross-gate trust establishment. All in `"trust"` domain, excluded from waypoint spines.
+- **9 new tests**: Domain classification, waypoint exclusion, JSON serde roundtrips (optional fields, canonical bytes, full Entry roundtrip).
+- **Test count**: 1,583 (up from 1,574). FRAGO ACK: `wave76-parity-sprint-provenance`.
+
+---
+
 ## v0.9.16 Evolution — Readiness Diagnostics, Attribution, Auth Peer Info (June 2, 2026)
 
 - **Readiness probe**: Now exercises storage read path and reports spine count in reason field, not just lock acquisition.

WHATS_NEXT.md

@@ -3,12 +3,14 @@
 # Development Roadmap
 
 **Current Version**: 0.9.16  
-**Last Updated**: June 2, 2026
+**Last Updated**: June 3, 2026
 
 ---
 
 ## Documentation changelog
 
+- **June 3, 2026** — **Deep Debt + Wave 76 Parity Sprint**: Cross-gate trust entry schema (3 new `EntryType` variants: `KeyExchange`, `TrustIssuerRegistration`, `TokenVerificationCrossGate`). FRAGO ACK for `wave76-parity-sprint-provenance`. Smart-split `entry_tests.rs` (845→639L). Last `#[allow(dead_code)]` evolved to `#[cfg_attr(not(test), expect(dead_code))]`. 10-dimension audit clean. 1,583 tests, 194 source files.
+
 - **June 2, 2026** — **Handler Evolution — Fidelity, Transport, Diagnostics**: 17 thin/stub handlers evolved to real implementations across 4 commits. `health.check` real uptime, error transparency in get ops, `braid.commit` real index, `InclusionProof::verify` Merkle path validation. Discovery `tower-atomic` + `discovery-http` features enabled on service binary. `lifecycle.status` shared state handle. `slice.checkout` correct hash, `permanence.verify_commit` entry type check. `spine.seal` reason field, `all_required_available()` enforcement, `permanence.health_check` structured diagnostics. Readiness storage verification, `get_attribution` contributor collection, `auth.peer_info` auth mode. 1,574 tests (44 new from unlocked features + capability test).
 
 - **June 1, 2026** — **Wave 67 — strandGate provenance gate ack**: loamSpine assigned to strandGate (provenance trio: rhizoCrypt + loamSpine + sweetGrass). Hardware ready (Dual EPYC 7452, 256GB ECC), deployment blocked on Phase 1 mesh validation. Lint evolution: 6 `#[allow(dead_code)]` → 4 `#[expect(dead_code)]` for pre-wired strandGate deploy entry points + 2 cleaned of unnecessary annotation. Mountain status: all 10 deep-debt dimensions clean. May 29 handoff archived, Wave 67 ack created.

crates/loam-spine-core/src/entry/entry_tests.rs

@@ -557,212 +557,6 @@ fn public_chain_anchor_not_allowed_in_waypoint() {
     assert!(!ty.allowed_in_waypoint());
 }
 
-#[test]
-fn entry_type_domain_cross_gate_trust() {
-    let local = Did::new("did:key:z6MkLocalGate");
-    let remote = Did::new("did:key:z6MkRemoteGate");
-
-    assert_eq!(
-        EntryType::KeyExchange {
-            local_gate: local.clone(),
-            remote_gate: remote.clone(),
-            public_key_hash: [1u8; 32],
-            direction: "initiated".into(),
-            family_id: Some("family-alpha".into()),
-        }
-        .domain(),
-        "trust"
-    );
-
-    assert_eq!(
-        EntryType::TrustIssuerRegistration {
-            issuer_did: remote.clone(),
-            registering_gate: local.clone(),
-            trust_scope: "cross-gate".into(),
-            capabilities: vec!["signing".into(), "verification".into()],
-            expires_at: None,
-        }
-        .domain(),
-        "trust"
-    );
-
-    assert_eq!(
-        EntryType::TokenVerificationCrossGate {
-            issuer_gate: remote,
-            verifier_gate: local,
-            token_hash: [2u8; 32],
-            verified: true,
-            failure_reason: None,
-        }
-        .domain(),
-        "trust"
-    );
-}
-
-#[test]
-fn cross_gate_trust_not_allowed_in_waypoint() {
-    let gate = Did::new("did:key:z6MkGate");
-    assert!(!EntryType::KeyExchange {
-        local_gate: gate.clone(),
-        remote_gate: gate.clone(),
-        public_key_hash: [0u8; 32],
-        direction: "initiated".into(),
-        family_id: None,
-    }
-    .allowed_in_waypoint());
-
-    assert!(!EntryType::TrustIssuerRegistration {
-        issuer_did: gate.clone(),
-        registering_gate: gate.clone(),
-        trust_scope: "family".into(),
-        capabilities: vec![],
-        expires_at: None,
-    }
-    .allowed_in_waypoint());
-
-    assert!(!EntryType::TokenVerificationCrossGate {
-        issuer_gate: gate.clone(),
-        verifier_gate: gate,
-        token_hash: [0u8; 32],
-        verified: false,
-        failure_reason: Some("expired".into()),
-    }
-    .allowed_in_waypoint());
-}
-
-#[test]
-fn entry_type_serde_roundtrip_key_exchange() {
-    let ty = EntryType::KeyExchange {
-        local_gate: Did::new("did:key:z6MkStrandGate"),
-        remote_gate: Did::new("did:key:z6MkBiomeGate"),
-        public_key_hash: [0xab; 32],
-        direction: "initiated".into(),
-        family_id: Some("family-alpha".into()),
-    };
-    let json = serde_json::to_vec(&ty).expect("serialize");
-    let restored: EntryType = serde_json::from_slice(&json).expect("deserialize");
-    assert!(matches!(
-        restored,
-        EntryType::KeyExchange { direction, .. } if direction == "initiated"
-    ));
-}
-
-#[test]
-fn entry_type_serde_roundtrip_trust_issuer_registration() {
-    let ty = EntryType::TrustIssuerRegistration {
-        issuer_did: Did::new("did:key:z6MkIssuer"),
-        registering_gate: Did::new("did:key:z6MkStrandGate"),
-        trust_scope: "cross-gate".into(),
-        capabilities: vec!["signing".into(), "verification".into()],
-        expires_at: Some(Timestamp::now()),
-    };
-    let json = serde_json::to_vec(&ty).expect("serialize");
-    let restored: EntryType = serde_json::from_slice(&json).expect("deserialize");
-    assert!(matches!(
-        restored,
-        EntryType::TrustIssuerRegistration { trust_scope, .. } if trust_scope == "cross-gate"
-    ));
-}
-
-#[test]
-fn entry_type_serde_roundtrip_token_verification_cross_gate() {
-    let ty = EntryType::TokenVerificationCrossGate {
-        issuer_gate: Did::new("did:key:z6MkIssuerGate"),
-        verifier_gate: Did::new("did:key:z6MkVerifierGate"),
-        token_hash: [0xcd; 32],
-        verified: true,
-        failure_reason: None,
-    };
-    let json = serde_json::to_vec(&ty).expect("serialize");
-    let restored: EntryType = serde_json::from_slice(&json).expect("deserialize");
-    assert!(matches!(
-        restored,
-        EntryType::TokenVerificationCrossGate { verified: true, .. }
-    ));
-}
-
-#[test]
-fn entry_type_serde_roundtrip_token_verification_failed() {
-    let ty = EntryType::TokenVerificationCrossGate {
-        issuer_gate: Did::new("did:key:z6MkIssuerGate"),
-        verifier_gate: Did::new("did:key:z6MkVerifierGate"),
-        token_hash: [0xef; 32],
-        verified: false,
-        failure_reason: Some("signature mismatch".into()),
-    };
-    let json = serde_json::to_vec(&ty).expect("serialize");
-    let restored: EntryType = serde_json::from_slice(&json).expect("deserialize");
-    assert!(matches!(
-        &restored,
-        EntryType::TokenVerificationCrossGate { verified: false, failure_reason: Some(reason), .. }
-            if reason == "signature mismatch"
-    ));
-}
-
-#[test]
-fn entry_type_serde_key_exchange_no_family() {
-    let ty = EntryType::KeyExchange {
-        local_gate: Did::new("did:key:z6MkLocal"),
-        remote_gate: Did::new("did:key:z6MkRemote"),
-        public_key_hash: [0xff; 32],
-        direction: "accepted".into(),
-        family_id: None,
-    };
-    let json = serde_json::to_string(&ty).expect("serialize");
-    assert!(!json.contains("family_id"));
-    let restored: EntryType = serde_json::from_str(&json).expect("deserialize");
-    assert!(matches!(
-        restored,
-        EntryType::KeyExchange { family_id: None, direction, .. } if direction == "accepted"
-    ));
-}
-
-#[test]
-fn entry_type_serde_trust_issuer_no_expiry() {
-    let ty = EntryType::TrustIssuerRegistration {
-        issuer_did: Did::new("did:key:z6MkIssuer"),
-        registering_gate: Did::new("did:key:z6MkGate"),
-        trust_scope: "global".into(),
-        capabilities: vec!["signing".into()],
-        expires_at: None,
-    };
-    let json = serde_json::to_string(&ty).expect("serialize");
-    assert!(!json.contains("expires_at"));
-    let restored: EntryType = serde_json::from_str(&json).expect("deserialize");
-    assert!(matches!(
-        restored,
-        EntryType::TrustIssuerRegistration { expires_at: None, .. }
-    ));
-}
-
-#[test]
-fn cross_gate_entry_full_roundtrip() {
-    let did = Did::new("did:key:z6MkCommitter");
-    let entry = Entry::new(
-        5,
-        Some([0xaa; 32]),
-        did,
-        EntryType::KeyExchange {
-            local_gate: Did::new("did:key:z6MkStrandGate"),
-            remote_gate: Did::new("did:key:z6MkBiomeGate"),
-            public_key_hash: [0xbb; 32],
-            direction: "initiated".into(),
-            family_id: Some("family-alpha".into()),
-        },
-    )
-    .with_spine_id(SpineId::now_v7())
-    .with_metadata("wave", "76");
-
-    let bytes = entry.to_canonical_bytes().expect("canonical");
-    assert!(!bytes.is_empty());
-
-    let json = serde_json::to_vec(&entry).expect("serialize");
-    let restored: Entry = serde_json::from_slice(&json).expect("deserialize");
-    assert_eq!(restored.index, 5);
-    assert_eq!(restored.domain(), "trust");
-    assert_eq!(restored.metadata.get("wave"), Some(&"76".to_string()));
-}
-
 fn arb_did() -> impl Strategy<Value = Did> {
     "[a-z]{3,8}".prop_map(|s| Did::new(format!("did:key:z6Mk{s}")))
 }