Collapse remaining same-owner infrastructure helper forks

[forkwright]

Finding

A small remainder of production helpers is duplicated inside subsystems that already have an obvious canonical owner. None is large enough to justify an independent issue, but together they preserve several one-fix-misses-one-copy seams:

• vault terminal-secret acquisition;
• Kerykeion framed connection state transitions and reconnect backoff; and
• Tekmerion rotated-segment discovery.

This umbrella is intentionally local. It does not propose a generic fleet utility crate, and it excludes same-shaped operations whose semantic identity genuinely differs.

Verified against main c8e671845adca3e5b57a205d08aca31eadbc6000.

Evidence

Vault hidden input

• crates/akroasis/src/vault/mod.rs:134-138 (read_passphrase) and :186-190 (read_secret) are byte-equivalent: both call rpassword::prompt_password, wrap the result in Zeroizing, and map the same input error.
• The semantic difference is only the caller's prompt/validation after reading; terminal acquisition and zeroization are one mechanism.

Kerykeion framed connection lifecycle

• crates/kerykeion/src/transport/serial.rs:98-153 and tcp.rs:92-149 independently implement the same MeshConnection state machine over Framed<_, MeshCodec>.
• send is byte-identical: send the packet, mark connected = false on error, return the result.
• recv has the same success/error/EOF transitions and differs only in endpoint text.
• reconnect independently owns initial delay, capped exponential backoff, sleep/retry, framed-stream replacement, connected-state transition, and success/failure logging. Opening the transport is the legitimate adapter-specific part.

Tekmerion rotation inventory

• crates/tekmerion/src/tamper_log_rotation.rs:32-60 scans the log directory, parses {stem}.N.log, and computes the next rotation number.
• crates/tekmerion/src/tamper_log_segments.rs:102-132 independently scans the same directory and parses/sorts/deduplicates the same sibling number set before verifying continuity. Its comment explicitly says the fail-closed directory policy mirrors next_rotation_number.
• log_stem, rotation_path, and parse_rotation_number are already shared; sibling enumeration is the remaining duplicated layer immediately above them.

No current issue owns these local helper forks.

Why this matters

These helpers carry more policy than their size suggests:

• hidden-input code must preserve no-echo acquisition, immediate zeroization, and error mapping;
• transport code must keep connection health and reconnect behavior consistent across serial and TCP; and
• tamper-log rotation discovery must fail closed on unreadable directories and agree about which segments exist.

A correction to only one copy can produce transport-dependent liveness behavior, inconsistent evidence inventory, or a credential path that loses zeroization/error handling.

Desired correction

Move each mechanism to the narrowest existing owner:

• one vault read_hidden(prompt) primitive, with passphrase confirmation/emptiness remaining at the caller;
• a small Kerykeion framed-connection helper for common send/receive state transitions and capped reconnect scheduling, parameterized by the transport-specific open operation and endpoint description; and
• one Tekmerion rotation_numbers(path) / segment-inventory helper consumed by both rotation and whole-chain verification.

Do not erase legitimate differences such as TCP connect timeout, serial control-line setup, transport-specific errors, or the verifier's gap checks.

Done when:

• vault terminal-secret acquisition has one implementation;
• serial and TCP common framed lifecycle/backoff mechanics have one owner while open/connect stays adapter-specific;
• rotation sibling enumeration and fail-closed directory handling have one implementation;
• behavior tests cover the shared primitives plus transport/verifier-specific deltas; and
• a local duplicate scan no longer reports these production helper families.