[C] #514 slice 16: Platform composition, jobs, CLI and seeder conversion

[mforce]

Important

Track C is unscheduled. These slices move production code, and the 2026-08 design's own status
line still governs: "proposed architecture; no production refactor is authorized by this
document." Filed so the analysis is tracked work rather than a comment, not as a commitment to
run it.

The 2026-09-14 re-plan
recommends gating Track C on evidence from Tracks A and B: if the #842 ratchet fires repeatedly in
real pull requests, these become worth their cost; if it stays quiet, they do not. Track C is
57–95 focused engineering days and produces no user-visible change.

Read the re-plan before picking any of these up. Several assumptions in the 2026-08 plan are
corrected there.

Platform composition, jobs, CLI verbs and seeders. The slice that actually makes adding a new module
cheap — worth knowing if only part of Track C is ever run.

Why this one is different from the eight before it

Slices 7–15 clean up existing modules. This one fixes the files that get worse with every module
added, whether or not the existing ones are ever extracted:

File	Size today	Why it degrades per module
CluckworkFeatureServiceCollectionExtensions.cs	352 lines	every handler, validator and repository registered by hand
Program.cs	577 lines	composition root
SimulationDataSeeder.cs	2608 lines	must know every module's datasets
BusinessRecordModel.cs:21-34	11 types, 6 modules	#819 says it grows with every time-paged table

If a new domain is ever added — raising, processing, anything — this is the work that decides whether
that is pleasant or painful. The BusinessRecordModel item in particular is independent of the
rest of Track C and could be done standalone at any time.

Scope

1. Move idempotency, transaction, tenant, persistence and health registration into explicit Platform
   composition. Preserve middleware ordering exactly (refactor(api): make process role explicit for boot guards #347, Credential epoch: per-request revocation check, deployed inert ahead of the user-admin mutations #364).
2. Daily lock-sweep and token-purge jobs call contracts; durable worker and single-leader behaviour
   unchanged (Background worker has no single-runner guarantee — double-runs if scaled >1 instance #271).
3. Convert demo and simulation seeders to module bootstrap contracts, one dataset at a time.
   Preserve the durable anchor, the exact counts and the fail-closed validation (Extract DB seeding (Demo/Simulation) out of API startup into an explicit command entry point #280, fix(seed): seeded audit events carry "(unresolved)" as the actor, now visible on record History columns #500).
4. CLI verbs call contracts. migrate stays a direct Platform migration operation (Deploy: separate the migration/owner DB role from the runtime app role (no DDL at request-time) #263).
5. Delete the generic repository, unit of work and legacy feature registrations once a search proves
   no caller remains.
6. Tighten the ledger's declared surface and record the final graph.

Done when

Full solution green; frontend typecheck, tests and build green; tools/simulation/verify-harness.sh
passes; Playwright quick suite green. Simulation manifests should need no configuration change,
because no boot guard or config key changes — if one does, every harness file updates in the same
commit (#370), and the AppHost too (#565).

Explicitly not in this slice

The idempotency protocol itself. If MCP's #804 is ever built it extracts that, and this slice
consumes the result rather than writing a second copy — writing a second copy is how #307 gets
reopened.