test(server): port core's UO suite onto the ctx harness

22 test files moved from core, plus the two that were split out of files core
keeps. 351 tests pass.

One change runs through every moved test, and it is the boundary rather than a
chore: core internals can no longer be stubbed by requiring them, because there
are none to require. `../utils/db` and `../model/settings` do not exist here.
What a test controls instead is the ctx core would have handed over, installed
once by test/_setup.js -- which is a better seam anyway, since it is exactly the
surface the contract promises and nothing wider.

The ctx _setup installs is deliberately unfrozen. Core freezes what it hands a
module and entry.test.js still asserts against a frozen one; but a test that
needs settings.get to return a path has to be able to say so.

Two tests changed SHAPE, and that is the boundary too. fromShardEvent used to
assert through publish() into pushDevices and a captured fetch -- which
endpoints were hit, how many requests went out. None of that is this module's
any more: publish is ctx.push.publish, and the device registry and the relay are
behind it. Reaching for them from here would be reaching past ctx. What remains
is what the module owns and is the part worth guarding: a game account resolves
to a website user, a personal target that resolves to nobody is dropped rather
than published, and a sensitive kind never reaches publish at all.

Co-Authored-By: Claude <noreply@anthropic.com>

server/test/entry.test.js

@@ -30,14 +30,59 @@ test('touches no database at registration time', () => {
   assert.deepStrictEqual(ctx.db.query.calls, [], 'register() queried the database')
 })
 
-test('registers nothing in slice 0', () => {
+test('registers exactly what module.json declares', () => {
+  // The loader compares these two in BOTH directions and rejects a mismatch
+  // either way, so a prefix registered without being declared and a prefix
+  // declared without being registered are both module-breaking. Asserting
+  // against the manifest rather than a literal list means the test cannot drift
+  // from the file core actually reads.
   const api = fakeApi()
   register(fakeCtx(), api)
-  assert.strictEqual(api.record.routes, null)
-  assert.strictEqual(api.record.streams, null)
-  assert.deepStrictEqual(api.record.extensions, [])
-  assert.deepStrictEqual(api.record.legs, [])
-  assert.deepStrictEqual(api.record.hooks, {})
+
+  const manifest = require('../../module.json')
+  for (const tier of ['public', 'admin', 'player']) {
+    assert.deepStrictEqual(
+      Object.keys(api.record.routes[tier]).sort(),
+      [...manifest.mounts[tier]].sort(),
+      `${tier} mounts disagree with module.json`,
+    )
+    for (const router of Object.values(api.record.routes[tier])) {
+      assert.strictEqual(typeof router, 'function', `${tier} router is not a router`)
+    }
+  }
+
+  assert.deepStrictEqual(api.record.extensions.map((e) => e.slot), manifest.extensions)
+  assert.deepStrictEqual(api.record.legs.map((l) => l.leg), ['towncrier'])
+  assert.ok(api.record.streams.length > 0)
+  assert.strictEqual(typeof api.record.hooks.onBoot, 'function')
+  assert.strictEqual(typeof api.record.hooks.onShutdown, 'function')
+})
+
+test('every registered stream is namespaced or grandfathered', () => {
+  // Core rejects a stream id that carries neither this module's prefix nor a
+  // §6.5 grandfathered name. The seven legacy ids are stored in
+  // `notification_subs` and read by a shipped Android client, so they are
+  // allowlisted rather than renamed — but a NEW id must be namespaced, and this
+  // is where that is caught before an install refuses to load the module.
+  // Copied from core's loader (LEGACY_STREAM_IDS), deliberately rather than
+  // imported — this repo has no dependency on core's source, and a copy that
+  // drifts is caught by the module failing to load, which is the failure this
+  // test exists to move earlier.
+  const GRANDFATHERED = new Set([
+    'server.status', 'idoc.warning', 'champ.start', 'governor.election',
+    'vendor.sale', 'house.idoc', 'account.login',
+  ])
+  const api = fakeApi()
+  register(fakeCtx(), api)
+  for (const s of api.record.streams) {
+    assert.ok(
+      s.id.startsWith('uo.') || GRANDFATHERED.has(s.id),
+      `stream "${s.id}" is neither namespaced "uo." nor grandfathered`,
+    )
+    assert.ok(s.label && s.description, `stream "${s.id}" is missing its wire shape`)
+    assert.strictEqual(typeof s.personal, 'boolean')
+    assert.strictEqual(typeof s.requiresLinkedAccount, 'boolean')
+  }
 })
 
 test('takes a frozen ctx and does not try to write to it', () => {