@bongos/core 1.19.238 → 1.19.240

package/tests/goal_membership_requests.mjs

@@ -1,6 +1,6 @@
 // tests/goal_membership_requests.mjs — private goals: the visibility flag + the
 // invite / join-request queue db layer (task 1951 / ADR 0112). DB-free: the
-// SQL-aware fake pool (the goal_member_roles.mjs precedent) pins each helper's
+// SQL-aware fake pool (the goal_member_kinds.mjs precedent) pins each helper's
 // SQL contract + return shaping. The route authorization gates are task 1952's
 // tests; this file pins the query layer under them.
 //
@@ -139,7 +139,7 @@ await test('resolveMembershipRequest: a lost race (nothing pending) → null', a
 // without a membership.
 await test('acceptMembershipRequestAndAddMember: one atomic CTE; returns { request, member }', async () => {
   const REQ = { ...REQUEST_ROW, status: 'accepted' };
-  const MEMBER = { goal_id: 1, builder_id: 2, role: 'member', joined_at: 'T2' };
+  const MEMBER = { goal_id: 1, builder_id: 2, membership_kind: 'member', joined_at: 'T2' };
   const pool = fakePool((s) => (/WITH resolved AS/.test(s) ? { rows: [{ request: REQ, member: MEMBER }] } : null));
   const out = await acceptMembershipRequestAndAddMember({ id: 10, resolvedBy: 5 }, { pool });
   assert.deepEqual(out, { request: REQ, member: MEMBER });
@@ -179,7 +179,7 @@ await test('listInboxFor: shapes {invitations, joinRequests, myPendingRequests}'
 await test('listInboxFor: joinRequests gates on owner (created_by) OR manager (lead)', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   await listInboxFor(95, { pool });
-  const jq = find(pool.queries, /r\.kind = 'request'.*g\.created_by = \$1.*role = 'lead'/);
+  const jq = find(pool.queries, /r\.kind = 'request'.*g\.created_by = \$1.*membership_kind = 'lead'/);
   assert.ok(jq, 'a join-request only reaches an owner or a manager of the goal');
   // and it must not leak: the same $1 builder id feeds every bucket.
   for (const q of pool.queries) assert.deepEqual(q.params, [95]);
@@ -207,30 +207,30 @@ await test('listPendingRequestsForGoal: pending both-kinds for one goal', async
 // stamped 'rejected' on someone who is in fact a member.
 // =========================================================================
 
-const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, membership_kind: 'member', joined_at: 'T0' };
 const addMemberPool = () => fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [ADD_MEMBER_ROW] } : null));
 
 // join-cancels-request: the joiner arrives under their own steam.
 await test('addGoalMember: a join cancels the joiner\'s pending ask in ONE statement', async () => {
   const pool = addMemberPool();
-  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member', resolvedBy: 42 }, { pool });
+  const out = await addGoalMember({ goalId: 7, builderId: 42, membershipKind: 'member', resolvedBy: 42 }, { pool });
   assert.deepEqual(out, ADD_MEMBER_ROW, 'still returns the member row — the route response shape is unchanged');
   assert.equal(pool.queries.length, 1, 'ONE statement: the cancel commits with the membership write or not at all');
   const q = find(pool.queries, /^WITH added AS/);
-  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/.test(norm(q.sql)),
-    'the membership upsert is the first arm, role still preserved (task 1002689)');
+  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET membership_kind = goal_members\.membership_kind/.test(norm(q.sql)),
+    'the membership upsert is the first arm, membership_kind still preserved (task 1002689)');
   assert.ok(/UPDATE goal_membership_requests[\s\S]*SET status = 'cancelled', resolved_by = \$4/.test(norm(q.sql)),
     'the second arm closes the ask as cancelled, attributed to the actor');
   assert.ok(/WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/.test(norm(q.sql)),
     'scoped to THIS goal+builder, and only a pending row');
-  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, role, resolvedBy — in that order');
+  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, membership_kind, resolvedBy — in that order');
 });
 
 // add-cancels-request: an owner/manager/Archon admits them directly. Same
 // statement; resolvedBy is the ADDER, so the audit trail names who admitted them.
 await test('addGoalMember: a direct member-add cancels the target\'s pending ask, attributed to the adder', async () => {
   const pool = addMemberPool();
-  await addGoalMember({ goalId: 7, builderId: 42, role: 'lead', resolvedBy: 99 }, { pool });
+  await addGoalMember({ goalId: 7, builderId: 42, membershipKind: 'lead', resolvedBy: 99 }, { pool });
   const q = find(pool.queries, /^WITH added AS/);
   assert.deepEqual(q.params, [7, 42, 'lead', 99],
     'resolved_by is the ADDER (99), not the target (42) — who admitted them is the audit fact');
@@ -425,7 +425,7 @@ await test('routes: invitation-respond declines before the goal-state gate', ()
 // authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
 const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
 const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };
-const mgr = (bid) => ({ goal_id: 5, builder_id: bid, role: 'lead' });
+const mgr = (bid) => ({ goal_id: 5, builder_id: bid, membership_kind: 'lead' });
 await test('authorizeJoinRequestResponse: non-authority actor → 403 (before any request lookup — no leak)', () => {
   const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 7, actorRank: 'metic', actorMembership: null, request: REQUEST, goalId: 5 });
   assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');

package/tests/goal_routes.mjs

@@ -42,10 +42,10 @@ const POST_GOALS_SCHEMA = {
   scope_modules: { type: 'array', maxItems: 64, itemsType: 'string' },
   succeeds_goal_id: { type: 'integer', min: 1 }, // BV1.R64 rescope carry-forward
 };
-// /members validates only `role` declaratively; builder_id is coerced in-handler
+// /members validates only `membership_kind` declaratively; builder_id is coerced in-handler
 // (accepts a number OR a numeric string — ids round-trip through JSON as strings).
 const POST_MEMBERS_SCHEMA = {
-  role: { type: 'string' },
+  membership_kind: { type: 'string' },
 };
 // POST /goals/:id/scope (BV1.R64 ask-to-widen) — `add` is the module list; the
 // empty-array, unknown-key, and protected-module checks are in-handler.
@@ -122,15 +122,15 @@ await test('POST /goals/:id/scope: a non-string add item is rejected', () => {
 // ---- POST /goals/:id/members schema ----
 // builder_id is coerced via Number() + Number.isInteger in-handler (a number or a
 // numeric string passes; a non-numeric string → 400 bad_builder_id), verified
-// live against Postgres. Here we pin the declarative half (role).
-await test('POST /members: role optional, valid when present', () => {
+// live against Postgres. Here we pin the declarative half (membership_kind).
+await test('POST /members: membership_kind optional, valid when present', () => {
   assert.equal(validate({}, POST_MEMBERS_SCHEMA), null);
-  assert.equal(validate({ role: 'lead' }, POST_MEMBERS_SCHEMA), null);
+  assert.equal(validate({ membership_kind: 'lead' }, POST_MEMBERS_SCHEMA), null);
 });
 
-await test('POST /members: non-string role → wrong_type', () => {
-  const r = validate({ role: 42 }, POST_MEMBERS_SCHEMA);
-  assert.ok(r && r.details.some((d) => d.field === 'role' && d.reason === 'wrong_type'));
+await test('POST /members: non-string membership_kind → wrong_type', () => {
+  const r = validate({ membership_kind: 42 }, POST_MEMBERS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'membership_kind' && d.reason === 'wrong_type'));
 });
 
 await test('builder_id coercion contract: Number() accepts int + numeric string, rejects junk', () => {

package/tests/goal_tier.mjs

@@ -49,7 +49,7 @@ const GOAL_ROW = {
   scope_modules: ['gds-core'], status: 'open', created_by: 42,
   succeeded_by_goal_id: null, sort_order: 0, created_at: 'T0', updated_at: 'T0',
 };
-const MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const MEMBER_ROW = { goal_id: 7, builder_id: 42, membership_kind: 'member', joined_at: 'T0' };
 
 // =========================================================================
 // createGoal
@@ -76,7 +76,7 @@ await test('createGoal: the creator becomes the first lead in the same statement
   const pool = fakePool((s) => (/INSERT INTO goals/.test(s) ? { rows: [GOAL_ROW] } : null));
   await createGoal({ versionId: 'V1', title: 'g', createdBy: 42 }, { pool });
   const ins = find(pool.queries, /INSERT INTO goals/);
-  assert.match(ins.sql, /INSERT INTO goal_members \(goal_id, builder_id, role\)/,
+  assert.match(ins.sql, /INSERT INTO goal_members \(goal_id, builder_id, membership_kind\)/,
     'the member insert is part of the createGoal statement');
   assert.match(ins.sql, /'lead'/, 'the creator is inserted as lead, not member');
   assert.match(ins.sql, /WHERE \$6::bigint IS NOT NULL/,
@@ -157,19 +157,19 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // task 1002888 wrapped the bare upsert in a CTE that also cancels any pending
 // membership request, so the statement now STARTS with `WITH added AS (` — the
 // INSERT is the first arm. The pending-ask cancellation itself is pinned in
-// tests/goal_membership_requests.mjs; here we only re-anchor the role contract.
-await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
-  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
-  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
-  assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
+// tests/goal_membership_requests.mjs; here we only re-anchor the membership contract.
+await test('addGoalMember: upsert PRESERVES the existing membership_kind (re-join cannot demote a lead)', async () => {
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [{ ...MEMBER_ROW, membership_kind: 'lead' }] } : null));
+  const out = await addGoalMember({ goalId: 7, builderId: 42, membershipKind: 'member' }, { pool });
+  assert.equal(out.membership_kind, 'lead', 'an existing lead row survives a membership_kind:member re-add');
   const ins = find(pool.queries, /^WITH added AS/);
   assert.deepEqual(ins.params, [7, 42, 'member', null], 'resolvedBy defaults to null when no actor is supplied');
   assert.match(ins.sql, /INSERT INTO goal_members/, 'the membership write is the first CTE arm');
-  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
-    'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
+  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET membership_kind = goal_members\.membership_kind/,
+    'conflict keeps the stored membership_kind — changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
-await test('addGoalMember: role defaults to member', async () => {
+await test('addGoalMember: membershipKind defaults to member', async () => {
   const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [MEMBER_ROW] } : null));
   await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
   assert.equal(find(pool.queries, /^WITH added AS/).params[2], 'member');

package/tests/government_live_proof.mjs

@@ -13,6 +13,11 @@
 // resolver behind the real `governance` kernel port, no stubs, no monkeypatches.
 // The captured sandbox transcript lives in docs/governance/bongos-v1-c6-live-proof.md.
 //
+// REPAIRED 2026-08-18 (task 1003091): between ADR 0174's rename and that task this
+// file was SILENTLY DEAD — see the readiness guard below for what happened and why
+// the guard's shape, not just its table name, was the bug. tests/
+// government_live_proof_shape.mjs now pins both from the DB-free lane.
+//
 // Real-DB integration test (the needs_rebase.mjs class): SELF-SKIPS (exit 0)
 // when DATABASE_URL is unset/unreachable or the governance tables are missing,
 // and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
@@ -38,18 +43,65 @@ if (!process.env.DATABASE_URL) {
 
 const { Pool } = require('pg');
 const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+// ── THE READINESS GUARD, AND WHY ITS SHAPE MATTERS (task 1003091) ────────────
+//
+// This guard used to be one `SELECT 1 FROM governance_roles LIMIT 1` inside a
+// catch-all that skipped on ANY error. When ADR 0174's rename landed
+// (government_001), that table became `government_ranks` — so on a HEALTHY,
+// fully migrated database the probe raised 42P01 (undefined_table), the catch
+// read it as "no migrated Postgres", and the proof exited 0 having asserted
+// NOTHING. It stayed that way silently, because a fail-OPEN guard cannot fail
+// and this file lives in run-unit-tests' INTEGRATION set, where nobody reads the
+// skip line.
+//
+// So the two cases are now separated, and only one of them is a skip:
+//   • the server is unreachable (no DATABASE_URL, refused, no such DB) → SKIP.
+//     That is the "this lane has no Postgres" case the skip exists for.
+//   • the server IS reachable but an expected table is MISSING → FAIL, naming
+//     the tables. A schema this file cannot recognise is exactly the condition
+//     it must shout about: either the proof is stale (as it was) or the database
+//     is not what it claims to be.
+const REQUIRED_TABLES = [
+  'builders', 'builder_sessions', 'idea_inbox',
+  'government_ranks', 'government_builder_ranks', 'government_rank_permissions',
+];
 try {
-  await pool.query('SELECT 1 FROM governance_roles LIMIT 1');
+  await pool.query('SELECT 1');
 } catch (e) {
-  console.log(`government_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
+  console.log(`government_live_proof.mjs SKIPPED — Postgres unreachable (${e.code || e.message}).`);
   await pool.end().catch(() => {});
   process.exit(0);
 }
+{
+  const { rows } = await pool.query(
+    `SELECT table_name FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = ANY($1::text[])`,
+    [REQUIRED_TABLES],
+  );
+  const present = new Set(rows.map((r) => r.table_name));
+  const missing = REQUIRED_TABLES.filter((t) => !present.has(t));
+  if (missing.length === REQUIRED_TABLES.length) {
+    // Nothing at all: an empty database, not a stale proof. Still a legitimate
+    // skip — this is the "reachable server, no instance schema" case.
+    console.log('government_live_proof.mjs SKIPPED — reachable Postgres with no instance schema (run scripts/migrate.sh).');
+    await pool.end().catch(() => {});
+    process.exit(0);
+  }
+  if (missing.length) {
+    await pool.end().catch(() => {});
+    throw new Error(
+      `government_live_proof.mjs CANNOT RUN: this database is migrated but is missing ${missing.join(', ')}. `
+      + 'Either the schema was renamed under this proof (the task-1003091 failure — fix the names HERE, do not widen the guard) '
+      + 'or the target is not a Cloud Bongos instance database.'
+    );
+  }
+}
 
 // ── fixtures (high-ID range; cleaned before AND after so reruns are safe) ────
 const ARCHON = 90000701;
 const THETES = 90000702;
-const ROLE_KEY = 'glp-demo-triager';
+const RANK_KEY = 'glp-demo-triager';
 const OPERATIONAL_KEY = 'idea.triage';      // system:false, floor metic — above thetes
 const SYSTEM_KEY = 'deploy.push_main';      // system:true — substrate-enforced
 const tok = () => 'glp' + crypto.randomBytes(24).toString('hex');
@@ -59,8 +111,8 @@ const THETES_TOKEN = tok();
 const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
 
 async function cleanup() {
-  await q(`DELETE FROM governance_roles WHERE role_key=$1`, [ROLE_KEY]); // grants+assignments cascade
-  await q(`DELETE FROM governance_builder_roles WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM government_ranks WHERE rank_key=$1`, [RANK_KEY]); // grants+assignments cascade
+  await q(`DELETE FROM government_builder_ranks WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM builder_sessions WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM idea_inbox WHERE captured_by IN ($1,$2)`, [ARCHON, THETES]);
   // The audit middleware records the demo's own writes; those rows FK the
@@ -80,7 +132,7 @@ async function seed() {
   // builder mirrors its effect here (one seeded rank-role each, fail-closed
   // otherwise — the archon would resolve ZERO permissions and deny itself).
   await q(
-    `INSERT INTO governance_builder_roles (builder_id, role_key)
+    `INSERT INTO government_builder_ranks (builder_id, rank_key)
      VALUES ($1,'archon'), ($2,'thetes')`,
     [ARCHON, THETES]
   );
@@ -143,35 +195,35 @@ try {
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
   r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
-    { role_key: ROLE_KEY, label: 'GLP demo triage role' });
-  ok(r.status === 201, 'the Archon creates a custom role (201)');
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
+    { rank_key: RANK_KEY, label: 'GLP demo triage rank' });
+  ok(r.status === 201, 'the Archon creates a custom rank (201)');
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${OPERATIONAL_KEY}`);
   ok(r.status === 200 && r.body.ok === true,
-    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom role (200)`);
+    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom rank (200)`);
 
   // Act 3 — the locked wall: a system permission is refused through the same API.
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
   r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
-    { builder_id: THETES, role_key: ROLE_KEY });
-  ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
+    { builder_id: THETES, rank_key: RANK_KEY });
+  ok(r.status === 201, 'the Archon assigns the custom rank to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
-  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom role works');
+  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom rank works');
 
   // Act 5 — the wall behind the wall: force the grant row no API path can create,
-  // so the role now "has" a system permission in the DB…
+  // so the rank now "has" a system permission in the DB…
   await q(
-    `INSERT INTO governance_role_permissions (role_key, permission_key) VALUES ($1,$2)`,
-    [ROLE_KEY, SYSTEM_KEY]
+    `INSERT INTO government_rank_permissions (rank_key, permission_key) VALUES ($1,$2)`,
+    [RANK_KEY, SYSTEM_KEY]
   );
-  console.log(`  (forced INTO the DB: grant ${ROLE_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
+  console.log(`  (forced INTO the DB: grant ${RANK_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
 
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
@@ -193,7 +245,7 @@ try {
   ok(sub.hardFail === true && sub.findings.length === 2,
     'the substrate checker still BLOCKS the protected-path attempt (deploy/migration machinery), forced grant and all');
 
-  console.log(`\ngovernance_live_proof: ${pass} assertions passed`);
+  console.log(`\ngovernment_live_proof: ${pass} assertions passed`);
 } finally {
   await cleanup().catch((e) => console.error('cleanup failed', e.message));
   if (server) await new Promise((resolve) => server.close(resolve));

package/tests/government_live_proof_shape.mjs

@@ -0,0 +1,124 @@
+// tests/government_live_proof_shape.mjs — the DB-free guard on the C6 live proof
+// (task 1003091). ADR 0151's C6 proof (tests/government_live_proof.mjs) is a
+// REAL-DB integration test, so the DB-free lane never runs it — which is how it
+// came to be silently dead for days.
+//
+// WHAT HAPPENED: its readiness probe was `SELECT 1 FROM governance_roles LIMIT 1`
+// inside a catch-all that skipped on ANY error. ADR 0174's rename
+// (government_001) turned that table into `government_ranks`, so on a healthy,
+// fully migrated database the probe raised 42P01 and the catch reported "no
+// migrated Postgres". The proof exited 0 having asserted nothing, and no signal
+// anywhere said so — a fail-OPEN guard cannot fail.
+//
+// So this file pins the two properties that make that irrecoverable-by-silence
+// state impossible, from the lane that DOES run every PR:
+//   1. the proof names the CURRENT schema + routes, not the pre-rename ones;
+//   2. its guard SEPARATES "unreachable" (skip) from "reachable but missing an
+//      expected table" (throw) — and no OTHER integration test reintroduces the
+//      old shape by probing a specific table inside its skip guard.
+//
+// Run:  node --test tests/government_live_proof_shape.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PROOF_REL = 'tests/government_live_proof.mjs';
+const proof = fs.readFileSync(path.join(ROOT, PROOF_REL), 'utf8');
+
+// A line that CITES the incident has to be able to name the old spellings —
+// otherwise the file cannot explain its own history. Same principle as
+// fitness.js's VOCAB_HISTORICAL_REF.
+const CITATION = /task[- ]?1003091|used to be|pre-rename|ADR 0174/i;
+const PRE_RENAME = [
+  'governance_roles',
+  'governance_builder_roles',
+  'governance_role_permissions',
+  '/governance/roles',
+];
+
+test('the C6 proof names the CURRENT government schema and routes', () => {
+  const offenders = [];
+  proof.split('\n').forEach((line, i) => {
+    if (CITATION.test(line)) return;
+    for (const old of PRE_RENAME) {
+      if (line.includes(old)) offenders.push(`${PROOF_REL}:${i + 1}: ${old} → ${line.trim().slice(0, 80)}`);
+    }
+  });
+  assert.deepEqual(offenders, [],
+    'the proof still names pre-rename objects; ADR 0174 renamed them (government_001) and task 1003084 removed the /governance/* alias');
+  for (const t of ['government_ranks', 'government_builder_ranks', 'government_rank_permissions']) {
+    assert.ok(proof.includes(t), `the proof must exercise ${t}`);
+  }
+  assert.match(proof, /\/government\/ranks\/\$\{RANK_KEY\}\/permissions\//,
+    'the grant route is /government/ranks/:rankKey/permissions/:permissionKey');
+});
+
+test('the readiness guard skips on UNREACHABLE and THROWS on a migrated-but-missing schema', () => {
+  // Connectivity is probed with a table-free query: a `SELECT 1 FROM <table>`
+  // here is precisely the bug — it conflates "no database" with "schema I do not
+  // recognise", and the second one must never be silent.
+  const guard = proof.slice(proof.indexOf('const REQUIRED_TABLES'), proof.indexOf('// ── fixtures'));
+  assert.ok(guard.includes("pool.query('SELECT 1')"),
+    'connectivity must be probed WITHOUT naming a table');
+  assert.ok(!/pool\.query\('SELECT 1 FROM/.test(guard),
+    'no table-named readiness probe may return: that is the task-1003091 failure mode');
+  assert.match(guard, /information_schema\.tables/, 'the expected tables are checked explicitly');
+  assert.match(guard, /throw new Error\(/, 'a migrated database missing an expected table must THROW');
+  assert.match(guard, /CANNOT RUN/, 'and say so loudly enough to read in CI output');
+  // The skip branches stay, but only for the two honest cases.
+  const skips = guard.match(/SKIPPED/g) || [];
+  assert.equal(skips.length, 2,
+    'exactly two skip cases: unreachable server, and a reachable server with NO instance schema');
+});
+
+test('no other integration test probes a specific table inside its skip guard', () => {
+  // The sibling real-DB tests (needs_rebase, handle_machinery, …) already probe
+  // `SELECT 1`. This asserts the whole class, so the old shape cannot reappear
+  // in a NEW file and rot there unseen.
+  const offenders = [];
+  const SELF = path.basename(fileURLToPath(import.meta.url)); // the rule is not one of its own subjects
+  for (const name of fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs') && n !== SELF)) {
+    const src = fs.readFileSync(path.join(ROOT, 'tests', name), 'utf8');
+    if (!src.includes('SKIPPED')) continue;
+    src.split('\n').forEach((line, i) => {
+      if (CITATION.test(line)) return;
+      // A readiness probe is a LIVE query: `await pool.query('SELECT 1 FROM x')`.
+      // Assertions ABOUT sql strings (fakePool matchers, /SELECT 1 FROM …/ regexes)
+      // are not queries and are left alone.
+      if (/(await\s+)?pool\.query\(\s*['"`]SELECT 1 FROM /.test(line)) {
+        offenders.push(`tests/${name}:${i + 1}: ${line.trim().slice(0, 80)}`);
+      }
+    });
+  }
+  assert.deepEqual(offenders, [],
+    'a skip guard that probes a named table skips silently the day that table is renamed (task 1003091)');
+});
+
+test('every curated INTEGRATION / KNOWN_FAILING entry names a real test file', () => {
+  // The SAME rename miss, one layer out: run-unit-tests.js's curated sets are keyed
+  // by filename STEM, and the INTEGRATION set still said `governance_live_proof`
+  // after ADR 0174 renamed the file. A stem that matches nothing does not error —
+  // the entry just stops applying, so the file quietly moved into the DB-free lane
+  // (where it "passed" by self-skipping). Curated lists must point at real files.
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const setEntries = (name) => {
+    const start = runner.indexOf(`const ${name} = new Set([`);
+    assert.ok(start > -1, `${name} must exist in run-unit-tests.js`);
+    const block = runner.slice(start, runner.indexOf(']);', start));
+    return [...block.matchAll(/'([a-z0-9_.-]+)'/gi)].map((m) => m[1]).filter((k) => k !== name);
+  };
+  const stems = new Set(
+    fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs')).map((n) => n.replace(/\.mjs$/, ''))
+  );
+  const missing = [];
+  for (const setName of ['INTEGRATION', 'KNOWN_FAILING']) {
+    for (const stem of setEntries(setName)) {
+      if (!stems.has(stem)) missing.push(`${setName}: '${stem}' matches no tests/*.mjs`);
+    }
+  }
+  assert.deepEqual(missing, [],
+    'a curated entry whose file was renamed silently stops applying (task 1003091)');
+});