[kutsibalci]

Stacked on #5. Merge order: #1 → #2 → #3 → #4 → #5 → this.

The README already said HeatShield deliberately does not call SIM/Device Swap, the KYC family or Number Verification. This PR makes the code say the same thing.

Removed

• NacClient: 17 methods and their path-table entries (number recycling, call forwarding, KYC tenure, age and match, number verification, SIM swap, device swap, consent, roaming, reachability and roaming subscriptions), plus the unused congestion_subs path.
• Fixture backend: the matching responses, their helpers, and 15 profile fields nothing reads any more.
• Simulator: the matching routes and the passthrough bearer check.
• tools/verify_live.py:
  • It now probes exactly the six product APIs.
  • The broken portfolio-era table patcher is gone; it looked for heatshield/heatshield/ and a master table not in the repo.
  • The OAuth fetch is gone too.
  • The default probe number is the documented sandbox +99999000001000.

Kept on purpose

• evidence/ is untouched. The 9 Sep 2026 probe can be re-run exactly from tag v0.1-hackathon. The README and docs/api-availability.md now say so, and call the removed APIs' results in the evidence file historical.
• The shared portfolio template (_ortak/_template/nac_client) lives outside this repository and is not touched.
• Geofence and QoD get/delete/list. They are part of the product APIs' lifecycle; the probe uses them to clean up.

Also fixed

• Test numbers moved from real Turkish mobile format to the non-assignable +99999… range, as the README promises.
• docs/api-availability.md: the QoD path is v1, not v0.
• The qod_create example in DEVELOPER-GUIDE now matches the real signature.
• .env.example drops the OAuth block, since nothing reads it now.

Verification

• 197 tests pass. Three tests of the removed APIs were deleted.
  • The simulator round-trip test now covers the six product APIs over HTTP.
  • New tests/test_verify_live.py runs the probe logic offline against fixtures. It never calls main(), so it never reads .env.
• The full JSON of all six demo scenarios (7 MB) is byte-identical to before. The public demo behaves the same.

After merge to main (Render auto-deploys)

On heatshield-demo.onrender.com/demo, check Hot day, Collapse, No breach and Planner guard.

🤖 Generated with Claude Code