C2 seam extraction — instance-free request/auth path for the live captcha wiring

[GodSpeed313]

C1 decided what things mean; C2 is making the transport structurally capable of carrying that decision, not making any new decisions.

This PR is the structural half only. No classification logic, no C1 semantics, no new governance authority.

Why

The live captcha wiring must build submit_captcha_fn before MoltbookHTTPTransport exists, because Note E's fail-closed presence check takes it as a constructor argument. It therefore cannot reach a bound method, and _real_request was trapped behind an instance it does not yet have. The factory shape was never the problem; the trapped default was.

What changed

• real_request(base_url, method, path, body, headers) at module level, containing _real_request's prior body with only the Note D comment relocated into the docstring. No logic, HTTP semantics, redirect posture, error handling, or timeout change.
• Deliberately no leading underscore: this module uses module-level underscore to mean "internal, do not import" (_collapse_letter_runs, _normalize_captcha_prompt, _word_number_value). One here would signal the opposite of why it was extracted.
• real_request is not itself a request_fn — the seam signature is (method, path, json_body, headers); callers partially apply the base_url.
• auth_headers(api_key) at module level, transport-scoped.
• _real_request() / _auth_headers() reduced to one-line delegations, each with a guard comment stating instance-specific behavior does not belong in the wrapper.

One HTTP path, not two: the write path and the live verify path now build on the same function, so retry/redirect/timeout posture cannot diverge between them (C1 §5's concern).

Tests — 613 passed, 7 xfailed

Two added. The existing two _real_request tests are deliberately untouched — they now cover the delegation, which is the regression evidence that extraction changed no behaviour.

The new module-level test pins the one property they cannot: callable with no transport instance in existence. Those two would still pass if an instance dependency were reintroduced, because they hold an instance. This one would not — which makes the "pure delegation" guard mechanical rather than a comment asking the next editor to remember.

Deliberate deferrals — recorded as decisions, now tracked in TODO.md

The second commit exists because these were tracked nowhere — only in review conversation and a commit body, which is the state where a reviewer reconstructs a deferral by noticing a mismatch (what #69 had to do for test counts).

1. Redirect posture — filed as open, deliberately not as post-GO, since GO-1 is granted and this may bear on GO-2. Verified: C1 §5 is provably not violated (POST redirects drop data on 301/302/303; 307/308 raise and fall to §4 residual). Open: classification fidelity (a followed redirect means the status reaching the classifier may not be /verify's own, and C1 §3.2 makes status authoritative), plus a documented credential dimension — moltbook_api_spec.md §1 records that a bare-domain redirect strips Authorization.
2. client.py:144 duplicates f"Bearer {api_key}", and its comment still calls itself "the ONLY place the key is touched". C2's helper is transport-scoped by decision; consolidating would reach outside C2 and ripple into test_moltbook_credential_integrity.py:196.
3. Test-count sync — deferred to the C2-complete commit, to be synced once. TODO.md's entry states the count has moved without restating a number, so it cannot itself become a stale count.

Scope

No C1 decision introduced · no submit_captcha_fn policy beyond making the live path authenticable · no TransportResult.rate_limit change · no Note E constructor invariant touched · no write-path behaviour changed · no redirect change · CLAUDE.md/README.md untouched.

🤖 Generated with Claude Code