Move most of the root-only logic to KernelStore; add minitest helper