feat: add native module realtime transport

docs/development/testing.md

@@ -247,6 +247,34 @@ cannot appear unnoticed. See
 [ADR 0030](../architecture/decisions/0030-host-provided-module-object-storage.md) and
 [ADR 0031](../architecture/decisions/0031-direct-object-delivery.md).
 
+Phase 7A pass 5 adds realtime evidence at every boundary
+([ADR 0032](../architecture/decisions/0032-native-module-realtime-transport.md)). Contract and Core
+unit suites prove channel grammar, module/permission scoping, staged registration, mandatory initial
+snapshots, atomic snapshot-plus-subscribe, sequence ordering, payload/container limits, latest-state
+coalescing, subscriber limits, exact shutdown behavior, per-module publisher deactivation, sanitized
+errors, and that modules declaring no realtime continue unchanged. Browser SDK/shell suites prove
+that the public contract has no server dependency or transport vocabulary, descriptors and local
+channels are strictly contained, credentials are host-owned, reconnect requires a fresh snapshot,
+terminal EventSource failure cleans up listeners, and explicit unmount is idempotent.
+
+`apps/api/tests/module-realtime-routes.test.ts` exercises permission-before-allocation, the
+snapshot/update wire envelope, lack of replay ids, stream headers, comment keepalives, forced
+five-minute reauthorization through a short test-only override, shutdown closure, sanitized
+subscriber failures, and the explicit `HEAD` refusal that prevents an infinite discarded body from
+retaining a subscriber. `apps/api/tests/module-realtime-live.test.ts` binds an actual Node
+HTTP server on an OS-assigned loopback port and drives an Announcements-shaped module through real
+discovery, registration, startup, two live SSE clients, fanout, disconnect cleanup, reconnect with a
+fresh latest snapshot, and shutdown. Every bind, fetch, stream read, cancellation, cleanup poll, and
+listener close is bounded; the test also pins an opaque signed delivery URL byte-for-byte. It uses no
+PostgreSQL or object-store double because neither belongs in realtime transport.
+
+The live PostgreSQL API suite adds lifecycle composition evidence: an enabled module's realtime route
+is live while disabled and dependency-blocked modules have no route, just like their HTTP/UI
+surfaces. Its real SSE fetch/read/cancel path is bounded and migrations remain independent of runtime
+enablement. During realtime development, run the focused live Node suite repeatedly as well as
+`pnpm verify` and `pnpm test:migrations:integration`; consecutive runs are specifically intended to
+catch retained timers, listeners, subscribers, or loopback servers.
+
 ### Which kind of timing proof lives where
 
 Pass 4 introduced several deadlines, and their tests deliberately differ in kind: