The core's static import closure has zero top-level node: imports and no
pngjs, enforced by the browser-surface gate. Node I/O is a lazy adapter
(io-node.js) reached only by path-based calls; loadCore({factory,
wasmBinary}) + loadMedia({bytes, systemFiles}) run the same host in a
browser/worker bundle. PNG tier split to framebuffer-png.js (index no
longer re-exports it). Byte-identity proven: path host vs {io:false}
bytes host produce identical framebuffer hash, RAM, and frame count.
Suite 1178/1178, lint clean, MCP smoke + live SDL window verified.
romdev-core-host 0.2.0, romdev-core-runner 0.1.1, romdevtools 0.100.0.