@bongos/core 1.21.174 → 1.21.176

package/scripts/bongos/coreB-carve-proof.sh

@@ -0,0 +1,725 @@
+#!/usr/bin/env bash
+# C7 core-carve proof — BV1.R74 (#1578) · ADR 0091 + ADR 0093 · criterion C7 gds-core-modularized.
+#
+# The single live demonstration C7's tranche-1+2 hinges on. ADR 0091 extended the
+# ADR 0083 strangler to the CORE itself: bound the kernel as a real artifact and
+# carve the core domains out of the ~6k-LOC src/bongos/db.js monolith into
+# modules/<key>/ — memory (R72), grading (R73), then economy (R77, ADR 0093:
+# credits + cost ledger + streaks + achievements + leaderboard behind the `reward`
+# kernel PORT) and security (R79, ADR 0093: red-team reports + bounty behind the
+# `security` kernel PORT — the FEATURE; security-the-PROPERTY stays kernel) and
+# builder-settings (R80, ADR 0093: the per-builder prefs domain — wandering /
+# skill / sound / render — + builder-needs behind the `builder-settings` kernel
+# PORT; the `GET /me` aggregator stays a thin core facade) and onboarding (R81,
+# ADR 0093: the admission · onboarding-state-machine · newcomer-restock domain
+# behind the `onboarding` kernel PORT — the core lifecycle/auth/profile readers
+# resolve it; the access-request admission routes mount in the module). Every
+# prior task asserted ITS slice; this script asserts the WHOLE claim in one
+# runnable command, so "is the core-carve pattern proven?" has a yes/no answer
+# anyone can re-run.
+#
+# It proves five things, each the done-when of the carve (ADR 0091 §1-4 + the
+# "byte-for-byte the same" discipline of ADR 0083 / 0062):
+#   1. memory + grading live as modules/ (valid manifests, loader-discovered,
+#      grading provides the `grade` port).
+#   2. db.js shrank by their slices — the kernel slice (db-kernel.js) and the
+#      memory query slice left the monolith; grading's CAPABILITY (grader.js) is
+#      module-only (its grade-ATTEMPT persistence stays lifecycle, ADR 0091 §4).
+#   3. the kernel is bounded + fitness green — KERNEL_FILES is the real roster
+#      (R70), and fitness.js has zero hard failures incl. the four C7 boundary
+#      checks.
+#   4. a capability resolves via a kernel PORT (R73) — grading registers `grade`;
+#      the lifecycle resolves it via seams.resolveOptional('grade'); NO core file
+#      requires the grader directly.
+#   5. OTB behaves byte-identically — every DB-free test that exercises a CARVED
+#      surface (the module system, grading + the grade port, memory/search/recall)
+#      passes unchanged. These are the precise behavioral evidence the carve
+#      changed structure, not behavior, and they are reproducible in ANY checkout.
+#      The comprehensive regression backstop is CI's run-unit-tests.js (the full
+#      193-file gate); FULL_SUITE=1 runs that too, but note it includes infra
+#      tests (preview/sandbox/box) that need a live preview server + git remote
+#      and so only go green in a CI-like environment, not a credential-less
+#      worktree. SKIP_SUITE=1 skips leg 5 (structure-only, legs 1-4).
+#
+# Read-only. No network, no DB, no writes. Re-runnable any time; the ONGOING
+# guard already lives in CI (fitness.js + run-unit-tests.js on every PR), so this
+# is the consolidated demonstration, not a new gate.
+#
+# Usage:
+#   bash scripts/bongos/coreB-carve-proof.sh                # legs 1-4 + carve-test leg
+#   FULL_SUITE=1 bash scripts/bongos/coreB-carve-proof.sh   # also run the full CI gate
+#   SKIP_SUITE=1 bash scripts/bongos/coreB-carve-proof.sh   # legs 1-4 only (fast)
+
+# task 1003204 (goal 1000079): the lifecycle data layer is no longer one file —
+# modules/lifecycle/db.js is a re-export facade over twelve db-*.js units. Every
+# proof below that greps "the lifecycle db" must scan the FAMILY, or it silently
+# stops covering code that merely moved between units (and can even pass off a
+# doc-comment in the facade, which is exactly what happened before this fix).
+LIFECYCLE_DB="modules/lifecycle/db.js $(ls modules/lifecycle/db-*.js 2>/dev/null | tr '\n' ' ')"
+
+set -uo pipefail
+cd "$(dirname "$0")/../.."   # repo root (consistent with portability-smoke-*.sh)
+
+PASS=0; FAIL=0
+ok()  { echo "PASS  $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL  $1"; FAIL=$((FAIL+1)); }
+# nrun SNIPPET: exit 0 iff the node snippet runs clean (process.exit(0)).
+nrun() { node -e "$1" >/dev/null 2>&1; }
+
+echo "=== C7 core-carve proof: memory + grading + economy + security as modules (ADR 0091 + 0093) ==="
+
+# --- 1. memory + grading live as modules/ ------------------------------------
+if nrun "const m=require('./modules/memory/module.json');process.exit(m.key==='memory'?0:1)"; then
+  ok "modules/memory/module.json valid (key=memory)"
+else
+  bad "modules/memory/module.json missing or key!=memory"
+fi
+if nrun "const m=require('./modules/grading/module.json');process.exit(m.key==='grading'&&(m.provides||[]).includes('grade')?0:1)"; then
+  ok "modules/grading/module.json valid (key=grading, provides the 'grade' port)"
+else
+  bad "modules/grading/module.json missing, key!=grading, or does not provide 'grade'"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('memory')&&k.includes('grading')?0:1)"; then
+  ok "the loader discovers both 'memory' and 'grading' as modules"
+else
+  bad "loader does not discover both memory + grading (discoveredModuleKeys)"
+fi
+
+# --- 2. db.js shrank by their slices -----------------------------------------
+[ -f src/bongos/db-kernel.js ] \
+  && ok "kernel db slice extracted — src/bongos/db-kernel.js (identity/audit/rank/withTx, R69)" \
+  || bad "src/bongos/db-kernel.js missing (the first slice to leave db.js)"
+
+if grep -qE "builder_memory|memory_files" src/bongos/db.js 2>/dev/null; then
+  bad "memory domain queries still present in core src/bongos/db.js (slice did not leave)"
+else
+  ok "memory domain queries absent from core src/bongos/db.js (slice left the monolith)"
+fi
+if grep -qE "builder_memory" modules/memory/memory.js 2>/dev/null; then
+  ok "memory domain queries now live in modules/memory/memory.js"
+else
+  bad "memory domain queries not found in modules/memory/memory.js"
+fi
+
+# grading's CAPABILITY (the adversarial panel) is module-only; its grade-ATTEMPT
+# persistence (applyGrade -> task_grades) correctly STAYS in core as lifecycle
+# (ADR 0091 §4 — extract the capability, keep the state machine).
+if [ -f modules/grading/grader.js ] && ! [ -f src/bongos/grader.js ]; then
+  ok "grading capability is module-only (modules/grading/grader.js; no core src/bongos/grader.js)"
+else
+  bad "grader.js not cleanly module-owned (expected modules/grading/grader.js, no src/bongos/grader.js)"
+fi
+
+# --- 3. the kernel is bounded + fitness green (R70) --------------------------
+if nrun "const {KERNEL_FILES:K}=require('./scripts/bongos/fitness.js');process.exit(K.length>=15&&K.includes('src/bongos/db-kernel.js')&&K.includes('src/bongos/auth.js')?0:1)"; then
+  ok "KERNEL_FILES is the real bounded roster (incl. db-kernel.js + auth.js, not the old 6)"
+else
+  bad "KERNEL_FILES is not the real roster (missing db-kernel.js/auth.js or too small)"
+fi
+if nrun "const r=require('./scripts/bongos/fitness.js').runAll();process.exit(r.filter(x=>x.hardFail).length===0?0:1)"; then
+  ok "fitness.js: zero hard failures (the CI architecture gate is green)"
+else
+  bad "fitness.js has hard failures (architecture boundary regressed)"
+fi
+if nrun "const r=require('./scripts/bongos/fitness.js').runAll();const want=['core never imports a module','modules import only the published API','core carries no module code'];const ok=want.every(n=>{const c=r.find(x=>x.name===n);return c&&!c.hardFail;});process.exit(ok?0:1)"; then
+  ok "the three ENFORCING C7 boundary checks pass (core↮module, module→API-only, no module code in core)"
+else
+  bad "one of the ENFORCING C7 boundary checks is missing or failing"
+fi
+
+# --- 4. a capability resolves via a kernel PORT (R73) ------------------------
+grep -q "registerProvider('grade'" modules/grading/routes/grade.js 2>/dev/null \
+  && ok "grading registers the 'grade' provider at boot (modules/grading/routes/grade.js)" \
+  || bad "grading does not registerProvider('grade')"
+
+# tasks.js carved to modules/lifecycle/routes/ at R86; public.js (the status read) stays core.
+if grep -q "resolveOptional('grade')" modules/lifecycle/routes/tasks.js 2>/dev/null \
+   && grep -q "resolveOptional('grade')" src/bongos/routes/public.js 2>/dev/null; then
+  ok "the lifecycle resolves grading via the kernel port (seams.resolveOptional('grade') in modules/lifecycle/routes/tasks.js + core public.js)"
+else
+  bad "the lifecycle does not resolve 'grade' via the seam in both modules/lifecycle/routes/tasks.js and core public.js"
+fi
+if grep -rnE "require\(['\"][^'\"]*grader['\"]\)" src/ server.js 2>/dev/null | grep -qv node_modules; then
+  bad "a core file still require()s the grader directly (the port is bypassed)"
+else
+  ok "no core file require()s the grader directly — the edge is severed (ADR 0091 §4)"
+fi
+
+# --- 4b. economy carved + registers the `reward` PORT (R77 / ADR 0093) --------
+if nrun "const m=require('./modules/economy/module.json');process.exit(m.key==='economy'&&(m.provides||[]).includes('reward')&&['cost','leaderboard','reward'].every(r=>(m.contributes.routes||[]).includes(r))?0:1)"; then
+  ok "modules/economy/module.json valid (key=economy, provides 'reward', routes cost+leaderboard+reward)"
+else
+  bad "modules/economy/module.json missing/invalid (key, provides 'reward', or contributes.routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('economy')?0:1)"; then
+  ok "the loader discovers 'economy' as a module"
+else
+  bad "loader does not discover 'economy' (discoveredModuleKeys)"
+fi
+
+# economy LEDGER SQL left db.js. The bare token credit_log/cost_log still appears
+# in db.js for OUT-OF-SCOPE domains the carve deliberately leaves (the rank-change
+# ceremony + deactivate/reactivate audit rows write credit_log; builderAnalytics
+# reads cost_log) AND for the lifecycle state-machine idempotency GUARDS the carve
+# keeps verbatim (applyGrade/confirmTask: `SELECT 1 FROM credit_log … task.confirmed`,
+# ADR 0093 §2). So we assert the precise ECONOMY-LEDGER signal instead: the cost_log
+# WRITER and every credit-GRANT (the economy reasons) left the monolith.
+if grep -qE "INSERT INTO cost_log" src/bongos/db.js 2>/dev/null; then
+  bad "the cost_log WRITER (logCost) still lives in core src/bongos/db.js (economy ledger did not leave)"
+else
+  ok "the cost_log writer left src/bongos/db.js (economy ledger writer is module-only)"
+fi
+if grep -qE "'task\.confirmed'|'idea_promotion_bonus'|'session\.token_reward'|'ship\.net_negative'" src/bongos/db.js 2>/dev/null | grep -qE "INSERT INTO credit_log"; then
+  bad "an economy credit-GRANT INSERT still lives in core src/bongos/db.js"
+elif grep -nE "INSERT INTO credit_log" src/bongos/db.js 2>/dev/null | grep -qE "task\.confirmed|idea_promotion_bonus|session\.token_reward|ship\.net_negative"; then
+  bad "an economy credit-GRANT INSERT still lives in core src/bongos/db.js"
+else
+  ok "every economy credit-GRANT left src/bongos/db.js (only rank-change/audit credit_log rows remain — out of scope)"
+fi
+# economy SQL now lives in the module.
+if grep -q credit_log modules/economy/credits.js 2>/dev/null; then
+  ok "economy credit ledger SQL now lives in modules/economy/credits.js"
+else
+  bad "economy credit ledger SQL not found in modules/economy/credits.js"
+fi
+if grep -q cost_log modules/economy/cost.js 2>/dev/null; then
+  ok "economy cost ledger SQL now lives in modules/economy/cost.js"
+else
+  bad "economy cost ledger SQL not found in modules/economy/cost.js"
+fi
+# the moved standalone files are gone from core.
+if [ ! -f src/bongos/cost.js ] && [ ! -f src/bongos/streak.js ] && [ ! -f src/bongos/achievements.js ] && [ ! -f src/bongos/cost-summary-shape.js ]; then
+  ok "the moved standalone economy files are gone from core (cost/streak/achievements/cost-summary-shape)"
+else
+  bad "a moved economy file still exists under src/bongos/ (cost/streak/achievements/cost-summary-shape)"
+fi
+# economy registers the `reward` port; the lifecycle resolves it.
+grep -q "registerProvider('reward'" modules/economy/routes/reward.js 2>/dev/null \
+  && ok "economy registers the 'reward' provider at boot (modules/economy/routes/reward.js)" \
+  || bad "economy does not registerProvider('reward')"
+# the lifecycle db slice carved to modules/lifecycle/db.js at R86 — it resolves the reward port there.
+# task 1003204 split that slice into db.js + db-*.js, so scan the whole family: the
+# port call now lives in the unit that owns the transaction, not in the facade.
+if grep -q "resolveOptional('reward')" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in the lifecycle db family)"
+else
+  bad "the lifecycle does not resolve 'reward' via the seam in the modules/lifecycle db family"
+fi
+# no core file requires the moved economy files directly (llm-pricing stays core).
+if grep -rnE "require\(['\"][^'\"]*/(cost|streak|achievements|cost-summary-shape)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v module-api | grep -v 'modules/economy' | grep -qv llm-pricing; then
+  bad "a core file still require()s a moved economy file directly (the port is bypassed)"
+else
+  ok "no core file require()s a moved economy file directly — the edge is severed (ADR 0093 §2)"
+fi
+
+# --- 4c. security FEATURE carved + registers the `security` PORT (R79 / ADR 0093) --
+# security-the-FEATURE (red-team reports + bounty) is a module; security-the-PROPERTY
+# (permission-path/route-rank + the /security/adr+docs threat-model plane) STAYS kernel
+# (02-module-map §5). We assert both halves landed on the right side of the line.
+if nrun "const m=require('./modules/security/module.json');process.exit(m.key==='security'&&(m.provides||[]).includes('security')&&(m.contributes.routes||[]).includes('reports')?0:1)"; then
+  ok "modules/security/module.json valid (key=security, provides 'security' port, routes reports)"
+else
+  bad "modules/security/module.json missing/invalid (key, provides 'security', or contributes.routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('security')?0:1)"; then
+  ok "the loader discovers 'security' as a module"
+else
+  bad "loader does not discover 'security' (discoveredModuleKeys)"
+fi
+# the report/bounty domain file moved out of core into the module.
+if [ ! -f src/bongos/security.js ] && [ -f modules/security/security.js ]; then
+  ok "the security FEATURE domain is module-only (modules/security/security.js; no core src/bongos/security.js)"
+else
+  bad "security.js not cleanly module-owned (expected modules/security/security.js, no src/bongos/security.js)"
+fi
+if grep -qE "vulnerability_reports" modules/security/security.js 2>/dev/null; then
+  ok "the vulnerability_reports / bounty SQL now lives in modules/security/security.js"
+else
+  bad "vulnerability_reports SQL not found in modules/security/security.js"
+fi
+# security-the-PROPERTY stayed kernel: the trust matchers + the adr/docs route plane.
+if [ -f src/bongos/route-rank-check.js ] && [ -f src/bongos/permission-path-check.js ] && grep -qE "/security/(adr|docs)" src/bongos/routes/security.js 2>/dev/null; then
+  ok "security-the-PROPERTY stayed kernel (route-rank/permission-path matchers + /security/adr+docs in core routes/security.js)"
+else
+  bad "security-the-PROPERTY did not stay kernel (matchers or the adr/docs route plane went missing from core)"
+fi
+# security registers the `security` port; the public bounty-table resolves it.
+grep -q "registerProvider('security'" modules/security/routes/reports.js 2>/dev/null \
+  && ok "security registers the 'security' provider at boot (modules/security/routes/reports.js)" \
+  || bad "security does not registerProvider('security')"
+if grep -q "resolveOptional('security')" src/bongos/routes/public.js 2>/dev/null; then
+  ok "core resolves the security bounty schedule via the kernel port (resolveOptional('security') in public.js)"
+else
+  bad "core does not resolve 'security' via the seam in public.js (the bounty table import was not severed)"
+fi
+# no core file requires the moved security DOMAIN file directly. The match is
+# scoped to the old domain path (require('../security') / './security') and
+# EXCLUDES the property router core legitimately keeps: require('./routes/security')
+# (the /security/adr+docs plane that stayed kernel — 02-module-map §5).
+if grep -rnE "require\(['\"]\.\.?/security['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -q .; then
+  bad "a core file still require()s the moved security domain file directly (the port is bypassed)"
+else
+  ok "no core file require()s the moved security.js domain directly — the edge is severed (ADR 0093 §1; routes/security.js property plane stays)"
+fi
+
+# --- 4d. builder-settings carved + registers the `builder-settings` PORT (R80 / ADR 0093) --
+# The per-builder PREFS domain (wandering·skill·sound·render) + builder-needs is a
+# module; the `GET /me` aggregator stays a thin core facade resolving the port
+# (02-module-map §2). We assert the prefs libs + their db slice moved, the routes
+# split, and the edge from me.js + cascade-dispatch is severed.
+if nrun "const m=require('./modules/builder-settings/module.json');process.exit(m.key==='builder-settings'&&(m.provides||[]).includes('builder-settings')&&(m.contributes.routes||[]).includes('settings')?0:1)"; then
+  ok "modules/builder-settings/module.json valid (key=builder-settings, provides 'builder-settings' port, routes settings)"
+else
+  bad "modules/builder-settings/module.json missing/invalid (key, provides 'builder-settings', or contributes.routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('builder-settings')?0:1)"; then
+  ok "the loader discovers 'builder-settings' as a module"
+else
+  bad "loader does not discover 'builder-settings' (discoveredModuleKeys)"
+fi
+# the five pref libs + builder-needs moved out of core into the module.
+if [ ! -f src/bongos/skill-prefs.js ] && [ ! -f src/bongos/sound-prefs.js ] && [ ! -f src/bongos/wandering-prefs.js ] && [ ! -f src/bongos/render-prefs.js ] && [ ! -f src/bongos/event-sound-prefs.js ] && [ ! -f src/bongos/builder-needs.js ]; then
+  ok "the prefs libs + builder-needs are module-only (no src/bongos/{skill,sound,wandering,render,event-sound}-prefs.js / builder-needs.js)"
+else
+  bad "a moved builder-settings file still exists under src/bongos/ (a pref lib or builder-needs.js)"
+fi
+if [ -f modules/builder-settings/skill-prefs.js ] && [ -f modules/builder-settings/builder-needs.js ]; then
+  ok "the prefs libs + builder-needs now live in modules/builder-settings/"
+else
+  bad "the prefs libs / builder-needs not found in modules/builder-settings/"
+fi
+# the prefs db SLICE left core db.js (the skill_model_prefs writer is the signal).
+if grep -qE "SET skill_model_prefs" src/bongos/db.js 2>/dev/null; then
+  bad "the prefs db slice (setBuilderSkillPrefs) still lives in core src/bongos/db.js (slice did not leave)"
+else
+  ok "the prefs db slice left src/bongos/db.js (skill_model_prefs/sound_prefs/behavior_prefs writers are module-only)"
+fi
+if grep -qE "skill_model_prefs" modules/builder-settings/db.js 2>/dev/null; then
+  ok "the prefs db slice now lives in modules/builder-settings/db.js"
+else
+  bad "the prefs db slice not found in modules/builder-settings/db.js"
+fi
+# builder-settings registers the `builder-settings` port; me.js resolves it.
+grep -q "registerProvider('builder-settings'" modules/builder-settings/routes/settings.js 2>/dev/null \
+  && ok "builder-settings registers the 'builder-settings' provider at boot (modules/builder-settings/routes/settings.js)" \
+  || bad "builder-settings does not registerProvider('builder-settings')"
+if grep -q "resolveOptional('builder-settings')" src/bongos/routes/me.js 2>/dev/null \
+   && grep -q "resolveOptional('builder-settings')" src/bongos/cascade-dispatch.js 2>/dev/null; then
+  ok "core resolves builder-settings via the kernel port (resolveOptional('builder-settings') in me.js + cascade-dispatch.js)"
+else
+  bad "core does not resolve 'builder-settings' via the seam in both me.js and cascade-dispatch.js"
+fi
+# no core file requires a moved prefs lib directly.
+if grep -rnE "require\(['\"][^'\"]*/(skill-prefs|sound-prefs|wandering-prefs|render-prefs|event-sound-prefs|builder-needs)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v 'modules/builder-settings' | grep -q .; then
+  bad "a core file still require()s a moved prefs lib directly (the port is bypassed)"
+else
+  ok "no core file require()s a moved prefs lib directly — the edge is severed (ADR 0093 §1)"
+fi
+
+# --- 4e. onboarding carved + registers the `onboarding` PORT (R81 / ADR 0093) --
+# The admission · onboarding-state-machine · newcomer-restock domain is a module;
+# the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders
+# profile readers resolve the `onboarding` kernel port (the FIRST core→module
+# port direction db.js drives alongside `reward`). The access-request admission
+# routes mount in the module. We assert the domain files + their db slice moved,
+# the port is registered + resolved in db.js, and the edge is severed.
+if nrun "const m=require('./modules/onboarding/module.json');process.exit(m.key==='onboarding'&&(m.provides||[]).includes('onboarding')&&(m.contributes.routes||[]).includes('onboarding')?0:1)"; then
+  ok "modules/onboarding/module.json valid (key=onboarding, provides 'onboarding' port, routes onboarding)"
+else
+  bad "modules/onboarding/module.json missing/invalid (key, provides 'onboarding', or contributes.routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('onboarding')?0:1)"; then
+  ok "the loader discovers 'onboarding' as a module"
+else
+  bad "loader does not discover 'onboarding' (discoveredModuleKeys)"
+fi
+# the onboarding domain files moved out of core into the module.
+if [ ! -f src/bongos/onboarding.js ] && [ ! -f src/bongos/onboarding-state.js ] && [ ! -f src/bongos/newcomer-restock.js ] && [ ! -f src/bongos/approval-broadcast.js ] && [ ! -f src/bongos/routes/access-requests.js ]; then
+  ok "the onboarding domain files are module-only (no src/bongos/{onboarding,onboarding-state,newcomer-restock,approval-broadcast}.js / routes/access-requests.js)"
+else
+  bad "a moved onboarding file still exists under src/bongos/ (onboarding/onboarding-state/newcomer-restock/approval-broadcast/access-requests)"
+fi
+if [ -f modules/onboarding/onboarding-state.js ] && [ -f modules/onboarding/routes/access-requests.js ]; then
+  ok "the onboarding domain + admission routes now live in modules/onboarding/"
+else
+  bad "the onboarding state machine / access-request routes not found in modules/onboarding/"
+fi
+# the onboarding db SLICE left core db.js (the newcomerInstanceStats query is the signal).
+if grep -qE "async function newcomerInstanceStats" src/bongos/db.js 2>/dev/null; then
+  bad "the onboarding db slice (newcomerInstanceStats) still lives in core src/bongos/db.js (slice did not leave)"
+else
+  ok "the onboarding db slice left src/bongos/db.js (newcomerInstanceStats is module-only)"
+fi
+if grep -qE "newcomerInstanceStats" modules/onboarding/db.js 2>/dev/null; then
+  ok "the onboarding db slice now lives in modules/onboarding/db.js"
+else
+  bad "the onboarding db slice not found in modules/onboarding/db.js"
+fi
+# onboarding registers the `onboarding` port; the lifecycle (db.js) resolves it.
+grep -q "registerProvider('onboarding'" modules/onboarding/routes/onboarding.js 2>/dev/null \
+  && ok "onboarding registers the 'onboarding' provider at boot (modules/onboarding/routes/onboarding.js)" \
+  || bad "onboarding does not registerProvider('onboarding')"
+# the lifecycle's claim/ship carved to modules/lifecycle/db.js at R86 (it ticks the
+# onboarding stage there); core auth.js (the auth callbacks) stays and resolves it too.
+if grep -q "resolveOptional('onboarding')" $LIFECYCLE_DB 2>/dev/null \
+   && grep -q "resolveOptional('onboarding')" src/bongos/auth.js 2>/dev/null; then
+  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in the lifecycle db family + core auth.js)"
+else
+  bad "the lifecycle or core does not resolve 'onboarding' via the seam (lifecycle db family + auth.js)"
+fi
+# no core file requires a moved onboarding domain file directly. The match is
+# scoped to the moved domain basenames; the onboarding CLIs (setup/onboarding-
+# config/onboarding-analyze/newcomer-floor) stay under scripts/, outside this scan.
+if grep -rnE "require\(['\"][^'\"]*/(onboarding-state|newcomer-restock|approval-broadcast)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v 'modules/onboarding' | grep -q .; then
+  bad "a core file still require()s a moved onboarding file directly (the port is bypassed)"
+else
+  ok "no core file require()s a moved onboarding file directly — the edge is severed (ADR 0093 §1)"
+fi
+
+# --- 4f. sessions/BFG carved — like memory, registers NO port (R82 / ADR 0093) --
+# The session-records corpus + its data plane + the BFG cross-builder scorer +
+# the session-pulse helpers carved to modules/sessions/. Unlike economy/security/
+# onboarding, sessions registers NO kernel port (provides: []) — exactly like
+# memory: CORE never calls back into it (the ship-time digest write is an HTTP POST
+# to the module's own /sessions route). The ONE outward edge is the economy
+# `reward` port the module resolves (token reward + sumCreditsForTasks) — a
+# module↔module seam, never a sibling require. We assert the domain files + the
+# session_records db slice moved, the route mounts via the loader, and the BFG
+# reaches the kernel only through the doorway.
+if nrun "const m=require('./modules/sessions/module.json');process.exit(m.key==='sessions'&&(m.provides||[]).length===0&&(m.contributes.routes||[]).includes('sessions')?0:1)"; then
+  ok "modules/sessions/module.json valid (key=sessions, registers NO port like memory, routes sessions)"
+else
+  bad "modules/sessions/module.json missing/invalid (key, should provide no port, or contributes.routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('sessions')?0:1)"; then
+  ok "the loader discovers 'sessions' as a module"
+else
+  bad "loader does not discover 'sessions' (discoveredModuleKeys)"
+fi
+# the session domain files (bfg + pulse + the route) moved out of core into the module.
+if [ ! -f src/bongos/bfg.js ] && [ ! -f src/bongos/pulse.js ] && [ ! -f src/bongos/routes/sessions.js ] \
+   && [ -f modules/sessions/bfg.js ] && [ -f modules/sessions/pulse.js ] && [ -f modules/sessions/routes/sessions.js ]; then
+  ok "the session domain files are module-only (no src/bongos/{bfg,pulse}.js / routes/sessions.js; all in modules/sessions/)"
+else
+  bad "a session domain file did not move cleanly (expected modules/sessions/{bfg,pulse,routes/sessions}.js, none in src/bongos/)"
+fi
+# the session_records db SLICE left core db.js (the upsert writer is the signal).
+if grep -qE "INSERT INTO session_records" src/bongos/db.js 2>/dev/null; then
+  bad "the session_records writer (upsertSessionRecordTx) still lives in core src/bongos/db.js (slice did not leave)"
+else
+  ok "the session_records db slice left src/bongos/db.js (upsert/search/fetch are module-only)"
+fi
+if grep -qE "INSERT INTO session_records" modules/sessions/db.js 2>/dev/null; then
+  ok "the session_records db slice now lives in modules/sessions/db.js"
+else
+  bad "the session_records db slice not found in modules/sessions/db.js"
+fi
+# sessions resolves the economy `reward` port (the module↔module seam) and the
+# core route mount left routes.js (mountModuleRoutes mounts it now).
+if grep -q "resolveOptional('reward')" modules/sessions/db.js 2>/dev/null \
+   && grep -q "resolveOptional('reward')" modules/sessions/routes/sessions.js 2>/dev/null; then
+  ok "sessions resolves the economy 'reward' port (resolveOptional('reward') in db.js + routes/sessions.js — module↔module seam)"
+else
+  bad "sessions does not resolve the 'reward' port via the seam in both db.js and routes/sessions.js"
+fi
+if grep -q "require('./routes/sessions')" src/bongos/routes.js 2>/dev/null; then
+  bad "core routes.js still require()s ./routes/sessions directly (the route mount was not severed)"
+else
+  ok "no core file require()s the moved sessions route directly — mountModuleRoutes mounts it (ADR 0093 §1)"
+fi
+
+# --- 4g. autonomy/MAS carved — NO port; OBSERVES lifecycle (R83 / ADR 0093) ----
+# The Multi-Agent System (ADR 0024): the autonomy gate, the conductor/architect/
+# run-routine CLIs, and the in-process routine timers carved to modules/autonomy/.
+# The cross-cutting domain — it OBSERVES lifecycle. Two inbound core→autonomy edges
+# inverted: the routine timer (was routineTimers.start() in server.js) is now a
+# loader-started POLLER (contributes.pollers), and the precheck route (was mounted
+# in routes.js) a module route. Like sessions/memory it registers NO kernel port;
+# its ONE outward edge is the lifecycle `tallyPeerVotes` capability it resolves
+# through the DOORWAY (api.tallyPeerVotes — a tracked lifecycle leak), never a core
+# require. We assert the manifest, the loader discovery, the moved files, the
+# autonomy_runs db slice, the poller seam, the doorway capability, and that both
+# severed edges (the timer start + the route mount) left core.
+if nrun "const m=require('./modules/autonomy/module.json');process.exit(m.key==='autonomy'&&(m.provides||[]).length===0&&(m.contributes.routes||[]).includes('autonomy')&&(m.contributes.pollers||[]).includes('routine-timers')?0:1)"; then
+  ok "modules/autonomy/module.json valid (key=autonomy, NO port like sessions, routes autonomy + pollers routine-timers)"
+else
+  bad "modules/autonomy/module.json missing/invalid (key, should provide no port, contributes.routes/pollers)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('autonomy')?0:1)"; then
+  ok "the loader discovers 'autonomy' as a module"
+else
+  bad "loader does not discover 'autonomy' (discoveredModuleKeys)"
+fi
+# the carved domain files (the routine-timers poller + the precheck route) moved
+# out of core into the module.
+if [ ! -f src/bongos/routine-timers.js ] && [ ! -f src/bongos/routes/autonomy.js ] \
+   && [ -f modules/autonomy/pollers/routine-timers.js ] && [ -f modules/autonomy/routes/autonomy.js ]; then
+  ok "the autonomy domain files are module-only (no src/bongos/routine-timers.js / routes/autonomy.js; all in modules/autonomy/)"
+else
+  bad "an autonomy domain file did not move cleanly (expected modules/autonomy/{pollers/routine-timers,routes/autonomy}.js, none in src/bongos/)"
+fi
+# the autonomy_runs db SLICE left core db.js (the INSERT writer is the signal).
+if grep -qE "INSERT INTO autonomy_runs" src/bongos/db.js 2>/dev/null; then
+  bad "the autonomy_runs writer (recordAutonomyRun) still lives in core src/bongos/db.js (slice did not leave)"
+else
+  ok "the autonomy_runs db slice left src/bongos/db.js (recordAutonomyRun/lastAutonomyHead are module-only)"
+fi
+if grep -qE "INSERT INTO autonomy_runs" modules/autonomy/db.js 2>/dev/null; then
+  ok "the autonomy_runs db slice now lives in modules/autonomy/db.js"
+else
+  bad "the autonomy_runs db slice not found in modules/autonomy/db.js"
+fi
+# the routine timer reaches the lifecycle tallyPeerVotes capability through the
+# `lifecycle` kernel PORT (the doorway leak retired at BV1.R86), not a core require.
+if grep -q "require('../../../src/module-api')" modules/autonomy/pollers/routine-timers.js 2>/dev/null \
+   && grep -q "resolveOptional('lifecycle')" modules/autonomy/pollers/routine-timers.js 2>/dev/null; then
+  ok "the routine-timers poller resolves 'tallyPeerVotes' via the lifecycle PORT (resolveOptional('lifecycle') — never a core require; the doorway leak retired at R86)"
+else
+  bad "the routine-timers poller does not reach tallyPeerVotes through the lifecycle port"
+fi
+# both severed edges left core: the timer start (server.js) and the route mount (routes.js).
+if grep -q "require('./bongos/routine-timers')" server.js 2>/dev/null || grep -q "routineTimers.start" server.js 2>/dev/null; then
+  bad "server.js still starts routineTimers directly (the poller seam did not replace the hardcoded start)"
+elif grep -q "require('./routes/autonomy')" src/bongos/routes.js 2>/dev/null; then
+  bad "core routes.js still require()s ./routes/autonomy directly (the route mount was not severed)"
+else
+  ok "no core file starts the timer or mounts the autonomy route directly — the loader (startModulePollers + mountModuleRoutes) wires both (ADR 0093 §1)"
+fi
+
+# --- 4h. status-UI carved — the FIRST web-surface module (R84 / ADR 0093) ------
+# The public status dashboard (public-status/, ~3k LOC) became a first-class
+# WEB-SURFACE module (02-module-map §6). Unlike every backend carve it has NO db
+# slice, NO kernel port, and NO routes — it is pure static assets + a
+# contributes.webSurfaces manifest declaration the loader hands serve-internal,
+# which serves the module's public/ dir on the status. host. We assert the
+# manifest, the loader discovery, the moved static surface, the generalized serving
+# seam (serve-internal resolves moduleWebSurfaces, no hardcoded public-status), and
+# that the old repo-root path is gone from core.
+if nrun "const m=require('./modules/status-ui/module.json');const ws=(m.contributes&&m.contributes.webSurfaces)||[];process.exit(m.key==='status-ui'&&(m.provides||[]).length===0&&!(m.contributes.routes||[]).length&&ws.length===1&&ws[0].host==='status.'&&ws[0].dir==='public'?0:1)"; then
+  ok "modules/status-ui/module.json valid (key=status-ui, NO port + NO routes, webSurfaces=[{host:status.,dir:public}])"
+else
+  bad "modules/status-ui/module.json missing/invalid (key, should declare webSurfaces with no port/routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('status-ui')?0:1)"; then
+  ok "the loader discovers 'status-ui' as a module"
+else
+  bad "loader does not discover 'status-ui' (discoveredModuleKeys)"
+fi
+# the static surface moved out of the repo root into the module.
+if [ ! -d public-status ] && [ -f modules/status-ui/public/index.html ] && [ -f modules/status-ui/public/status.js ]; then
+  ok "the status surface is module-only (no repo-root public-status/; modules/status-ui/public/{index.html,status.js} present)"
+else
+  bad "the status surface did not move cleanly (expected modules/status-ui/public/, no repo-root public-status/)"
+fi
+# the loader exposes the web-surface seam, and the live status-ui surface resolves through it.
+if nrun "const l=require('./src/module-loader/loader.js');const {isModuleEnabled}=require('./src/modules.js');const s=l.moduleWebSurfaces({isEnabled:isModuleEnabled}).find(x=>x.key==='status-ui');process.exit(s&&s.host==='status.'&&require('node:fs').existsSync(require('node:path').join(s.dir,'index.html'))?0:1)"; then
+  ok "loader.moduleWebSurfaces resolves the live status-ui surface (host status., serves its index.html)"
+else
+  bad "loader.moduleWebSurfaces does not resolve the status-ui surface"
+fi
+# serve-internal serves via the GENERALIZED seam (moduleWebSurfaces), with no hardcoded public-status path.
+if grep -q "moduleWebSurfaces" src/bongos/serve-internal.js 2>/dev/null && ! grep -q "public-status" src/bongos/serve-internal.js 2>/dev/null; then
+  ok "serve-internal serves web surfaces via the loader seam (moduleWebSurfaces) — no hardcoded public-status path (ADR 0083 §Decision #4)"
+else
+  bad "serve-internal still hardcodes public-status or does not use the moduleWebSurfaces seam"
+fi
+
+# --- 4i. hall-UI carved — the LARGEST web-surface module (R85 / ADR 0093) ------
+# The authenticated builders' hall (public-builders/, ~13k LOC) became a first-class
+# WEB-SURFACE module (02-module-map §6) — the largest of the two web surfaces. Like
+# status-UI it has NO db slice, NO kernel port, and NO routes; it declares
+# contributes.webSurfaces:[{host:"builders.",dir:"public"}] so the loader DISCOVERS
+# it (feeding the scope map, fitness keys, docs, window.__MODULES__). UNLIKE the
+# generic status surface, the hall keeps its DEDICATED serving block in serve-internal
+# (the apex /builders/* shim, canonical redirects, the citizen/Archon page gates,
+# per-page asset-stamping, and the module hall-widget injection) — it is partitioned
+# OUT of the generic web-surface loop and served from BUILDERS_DIR = modules/hall-ui/
+# public/. We assert the manifest, the loader discovery, the moved static surface, the
+# resolved web-surface descriptor, and that no repo-root public-builders/ path remains
+# in core serve-internal.
+if nrun "const m=require('./modules/hall-ui/module.json');const ws=(m.contributes&&m.contributes.webSurfaces)||[];process.exit(m.key==='hall-ui'&&(m.provides||[]).length===0&&!(m.contributes.routes||[]).length&&ws.length===1&&ws[0].host==='builders.'&&ws[0].dir==='public'?0:1)"; then
+  ok "modules/hall-ui/module.json valid (key=hall-ui, NO port + NO routes, webSurfaces=[{host:builders.,dir:public}])"
+else
+  bad "modules/hall-ui/module.json missing/invalid (key, should declare webSurfaces with no port/routes)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('hall-ui')?0:1)"; then
+  ok "the loader discovers 'hall-ui' as a module"
+else
+  bad "loader does not discover 'hall-ui' (discoveredModuleKeys)"
+fi
+# the static surface moved out of the repo root into the module.
+if [ ! -d public-builders ] && [ -f modules/hall-ui/public/index.html ] && [ -f modules/hall-ui/public/builders.js ]; then
+  ok "the hall surface is module-only (no repo-root public-builders/; modules/hall-ui/public/{index.html,builders.js} present)"
+else
+  bad "the hall surface did not move cleanly (expected modules/hall-ui/public/, no repo-root public-builders/)"
+fi
+# the loader exposes the web-surface seam, and the live hall-ui surface resolves through it.
+if nrun "const l=require('./src/module-loader/loader.js');const {isModuleEnabled}=require('./src/modules.js');const s=l.moduleWebSurfaces({isEnabled:isModuleEnabled}).find(x=>x.key==='hall-ui');process.exit(s&&s.host==='builders.'&&require('node:fs').existsSync(require('node:path').join(s.dir,'index.html'))?0:1)"; then
+  ok "loader.moduleWebSurfaces resolves the live hall-ui surface (host builders., serves its index.html)"
+else
+  bad "loader.moduleWebSurfaces does not resolve the hall-ui surface"
+fi
+# serve-internal serves the hall from the MODULE dir (BUILDERS_DIR), with no hardcoded
+# repo-root public-builders path. The dedicated block stays (it is NOT the generic loop).
+if grep -q "modules', 'hall-ui', 'public'" src/bongos/serve-internal.js 2>/dev/null && ! grep -qE "'public-builders'|\"public-builders\"" src/bongos/serve-internal.js 2>/dev/null; then
+  ok "serve-internal serves the hall from modules/hall-ui/public (BUILDERS_DIR) — no hardcoded repo-root public-builders path (BV1.R85)"
+else
+  bad "serve-internal still hardcodes a repo-root public-builders path or does not point BUILDERS_DIR at modules/hall-ui/public"
+fi
+
+# --- 4j. lifecycle carved — the LAST core domain + the `lifecycle` PORT (R86) ---
+# The build state machine (tasks·claims·versions·done-when·goals·dependencies·
+# ship orchestration) — the most-coupled core domain — carved to modules/lifecycle/.
+# It registers the `lifecycle` kernel PORT and RETIRES the three ADR-0091 §3 doorway
+# leaks (createTask / VOTABLE_TASK_STATUSES / tallyPeerVotes), so the db.js residue
+# is now exactly the kernel identity/auth/twin slice + db-kernel.js (ADR 0093 §3).
+# We assert the manifest, the loader discovery, the moved domain files + db slice,
+# the port registration + resolution, the retired leaks, and the inverted poller.
+if nrun "const m=require('./modules/lifecycle/module.json');process.exit(m.key==='lifecycle'&&(m.provides||[]).includes('lifecycle')&&['tasks','claims','versions','done-when','goals','dependencies','gate-approvals','analytics'].every(r=>(m.contributes.routes||[]).includes(r))&&(m.contributes.pollers||[]).includes('publish-reconciler')?0:1)"; then
+  ok "modules/lifecycle/module.json valid (key=lifecycle, provides 'lifecycle' port, the lifecycle routes + the publish-reconciler poller)"
+else
+  bad "modules/lifecycle/module.json missing/invalid (key, provides 'lifecycle', contributes.routes/pollers)"
+fi
+if nrun "const k=require('./scripts/bongos/fitness.js').discoveredModuleKeys();process.exit(k.includes('lifecycle')?0:1)"; then
+  ok "the loader discovers 'lifecycle' as a module"
+else
+  bad "loader does not discover 'lifecycle' (discoveredModuleKeys)"
+fi
+# the lifecycle domain libs + routes moved out of core into the module.
+if [ ! -f src/bongos/task-classifier.js ] && [ ! -f src/bongos/done-when.js ] && [ ! -f src/bongos/hierarchy.js ] \
+   && [ ! -f src/bongos/github-push.js ] && [ ! -f src/bongos/merge-lock.js ] && [ ! -f src/bongos/routes/tasks.js ] \
+   && [ -f modules/lifecycle/task-classifier.js ] && [ -f modules/lifecycle/routes/tasks.js ] && [ -f modules/lifecycle/db.js ]; then
+  ok "the lifecycle domain is module-only (no src/bongos/{task-classifier,done-when,hierarchy,github-push,merge-lock}.js or routes/tasks.js; all in modules/lifecycle/)"
+else
+  bad "a moved lifecycle file still exists under src/bongos/ (a lib or a route)"
+fi
+# the lifecycle state-machine SQL SLICE left core db.js (claimTask/shipTask/createTask are the signal).
+if grep -qE "^async function (claimTask|shipTask|createTask|resolveClaim)\b" src/bongos/db.js 2>/dev/null; then
+  bad "the lifecycle state-machine functions still live in core src/bongos/db.js (slice did not leave)"
+else
+  ok "the lifecycle state-machine SQL left src/bongos/db.js — the residue is the kernel identity/auth/twin slice (ADR 0093 §3)"
+fi
+if grep -qE "async function (claimTask|shipTask|createTask)\b" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle state-machine SQL now lives in the modules/lifecycle db family (claim/ship/createTask/…)"
+else
+  bad "the lifecycle state-machine SQL not found in the modules/lifecycle db family"
+fi
+# lifecycle registers the `lifecycle` port; core read routes + cascade-dispatch resolve it.
+grep -q "registerProvider('lifecycle'" modules/lifecycle/routes/lifecycle.js 2>/dev/null \
+  && ok "lifecycle registers the 'lifecycle' provider at boot (modules/lifecycle/routes/lifecycle.js)" \
+  || bad "lifecycle does not registerProvider('lifecycle')"
+if grep -q "resolveOptional('lifecycle')" src/bongos/routes/public.js 2>/dev/null \
+   && grep -q "resolveOptional('lifecycle')" src/bongos/cascade-dispatch.js 2>/dev/null; then
+  ok "core resolves the lifecycle port (resolveOptional('lifecycle') in public.js + cascade-dispatch.js)"
+else
+  bad "core does not resolve 'lifecycle' via the seam in both public.js and cascade-dispatch.js"
+fi
+# the three ADR-0091 §3 doorway leaks retired (off the doorway, behind the port).
+if grep -qE "^  createTask:|^  get VOTABLE_TASK_STATUSES|^  tallyPeerVotes:" src/module-api.js 2>/dev/null; then
+  bad "a retired lifecycle leak (createTask/VOTABLE_TASK_STATUSES/tallyPeerVotes) is still on the doorway (src/module-api.js)"
+else
+  ok "the three lifecycle doorway leaks retired (createTask/VOTABLE_TASK_STATUSES/tallyPeerVotes off src/module-api.js — the last leak deletion, ADR 0093 §3)"
+fi
+# the consumers of the retired leaks resolve the lifecycle port instead.
+if grep -q "resolveOptional('lifecycle')" modules/onboarding/db.js 2>/dev/null \
+   && grep -q "resolveOptional('lifecycle')" modules/discord/discord-reaction.js 2>/dev/null \
+   && grep -q "resolveOptional('lifecycle')" modules/autonomy/pollers/routine-timers.js 2>/dev/null; then
+  ok "the leak consumers resolve the lifecycle port (onboarding createTask · discord VOTABLE · autonomy tallyPeerVotes)"
+else
+  bad "a retired-leak consumer (onboarding/discord/autonomy) does not resolve the lifecycle port"
+fi
+# the publish-reconciler poller inverted: server.js no longer starts it directly.
+if grep -q "publishReconciler.start" server.js 2>/dev/null || grep -q "require('./src/bongos/publish-reconciler')" server.js 2>/dev/null; then
+  bad "server.js still starts the publish reconciler directly (the poller seam did not replace the hardcoded start)"
+else
+  ok "no core file starts the publish reconciler directly — the loader (startModulePollers) wires the lifecycle poller (ADR 0093 §1)"
+fi
+
+# --- 5. OTB behaves byte-identically -----------------------------------------
+# The DB-free tests that exercise the CARVED surfaces. If the carve changed only
+# structure (not behavior), every one passes unchanged. Curated like the sets in
+# run-unit-tests.js — a new module/grading/memory test is opted in deliberately.
+CARVE_TESTS=(
+  # module system (the kernel machinery the carve rides on) — module_loader +
+  # module_manifest also cover the R84/R85 web-surface seam (moduleWebSurfaces +
+  # the webSurfaces manifest key, incl. the live status-ui + hall-ui surfaces);
+  # fitness/modules cover status-ui + hall-ui membership; module_contributions
+  # exercises the hall's dom-utils settings-panel seam (now read from
+  # modules/hall-ui/public/); atlas pins the hall's Repo Atlas renderer contract.
+  fitness module_api module_seams module_loader modules module_manifest
+  module_cli module_route_rank module_contributions module-scope-map atlas
+  # grading — R73: carved capability + the `grade` kernel port
+  grader grader_panel grader_prompt_fencing grader_bypass
+  grade_attempts grade_attribution grade_server_authoritative
+  grade_unavailable_display regrade_eligibility
+  # memory + search + recall — R72: carved domain
+  memory_map search_route search_chunker search_ingest search_ingest_db
+  search_isolation recall_cli recall_hints
+  # economy — R77 / ADR 0093: carved domain + the `reward` kernel port
+  credit_grant cost cost_audit cost_budget_status cost_summary_shape streak
+  grade_attribution confirm_attribution diff_derived_signals
+  # security — R79 / ADR 0093: FEATURE carved (reports+bounty); PROPERTY stays
+  # kernel. These DB-free tests exercise the property plane that stayed in core
+  # routes/security.js + its rank pins (byte-identical after the route split).
+  security_route security_docs
+  # builder-settings — R80 / ADR 0093: the prefs domain carved + the
+  # `builder-settings` kernel port. The pure shapers (byte-identical after the move).
+  skill_prefs sound_prefs wandering_prefs render_prefs builder_needs cascade-dispatch
+  # onboarding — R81 / ADR 0093: the admission · state-machine · newcomer-restock
+  # domain carved + the `onboarding` kernel port. The state-machine engine + the
+  # gate middleware + the restock stamper + the route-signal pass-through (the
+  # route now resolves the port — registered in the test) — byte-identical.
+  onboarding_state onboarding_gate newcomer_restock onboarding_route_signals
+  # sessions/BFG — R82 / ADR 0093: the session-records corpus + data plane + BFG
+  # scorer + session-pulse carved (NO port, like memory). The search ORDER-BY/clamp
+  # guards (module db), the SR-17 disk-fill bounds (module route + module db,
+  # reward port registered in the test), the 6D evaluator + #506 regression, the
+  # ship-time digest builder, and the backfill scope-parser — byte-identical.
+  session_search session_caps session_eval session_506_regression session_digest
+  session_records backfill_sessions
+  # autonomy/MAS — R83 / ADR 0093: the autonomy gate + conductor/architect CLIs +
+  # the routine timers carved (NO port, like sessions; OBSERVES lifecycle via the
+  # poller seam + the `lifecycle` port for tallyPeerVotes). The pure gate decision
+  # (inert until armed), the peer-vote timer's run function (pure w.r.t. injected
+  # deps), and the conductor/architect/run-routine CLI logic — byte-identical.
+  autonomy_gate routine_timers conductor architect run_routine
+  # lifecycle — R86 / ADR 0093 §3: the build state machine carved (the LAST + most-
+  # coupled domain) + the `lifecycle` kernel port + the three retired doorway leaks.
+  # The pure DB-free surfaces: the task-kind/votable classifier, the done-when
+  # criterion progress shaper, github-push ancestry/land-proof/merge-driver, the
+  # ship-card + ship-preflight pure guards, merge-lock, conflict-resolve, the
+  # publish-reconciler's pure run, the goal-achievement rollup, and the context-pack
+  # bounds (which read the classifier) — all byte-identical after the move.
+  task_classifier_vocab criterion_progress github_push_ancestry github_push_land_proof
+  github_push_merge_driver ship_card ship_preflight merge_lock conflict_resolve
+  publish_reconciler goal_achievement context_pack
+)
+if [ "${SKIP_SUITE:-0}" = "1" ]; then
+  echo "  (byte-identical leg skipped — SKIP_SUITE=1; run without it to exercise carved surfaces)"
+else
+  echo "--- running ${#CARVE_TESTS[@]} DB-free tests that exercise the carved surfaces ---"
+  carve_fail=0
+  for t in "${CARVE_TESTS[@]}"; do
+    if NODE_ENV=test node "tests/$t.mjs" >/dev/null 2>&1; then
+      echo "  ok    $t"
+    else
+      echo "  FAIL  $t"; carve_fail=$((carve_fail+1))
+    fi
+  done
+  [ "$carve_fail" -eq 0 ] \
+    && ok "all ${#CARVE_TESTS[@]} carved-surface tests pass unchanged — behavior is byte-identical post-carve" \
+    || bad "$carve_fail carved-surface test(s) failed — behavior is NOT byte-identical"
+
+  if [ "${FULL_SUITE:-0}" = "1" ]; then
+    echo "--- FULL_SUITE=1: also running the full CI 'unit' gate (run-unit-tests.js) ---"
+    if node scripts/bongos/run-unit-tests.js; then
+      ok "full DB-free unit gate passes (run-unit-tests.js)"
+    else
+      bad "full DB-free unit gate has failures — inspect (infra tests need a CI-like env: preview server + git remote)"
+    fi
+  fi
+fi
+
+# --- summary -----------------------------------------------------------------
+echo "=== C7 core-carve proof: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]