守住 migration blocker 修補

docs/memory/claude_inventory_validation_20260513.md

@@ -43,6 +43,7 @@
 - `services/ai_automation_smoke_service.py` 不是死 service：`run_scheduler.py` 每日 09:10 掛 `run_ai_smoke_daily_summary_task()`，該 task 會呼叫 `send_smoke_daily_summary()`；`tests/test_ai_automation_smoke_service.py` 與 `tests/test_ai_automation_metrics.py` 已覆蓋。
 - `mcp_calls.status` CHECK 已接受 `ok/error/timeout/rate_limited/cache_only`，與 `services/mcp_router.py` 的細分狀態一致。
 - DB migration / ORM 覆蓋已有 `tests/test_migration_metadata_coverage.py` 守門，`Base.metadata.tables - migrations CREATE TABLE` 必須為空；`tests/test_ai_observability_models.py` 也鎖住 v5 observability ORM stub。
+- V2 BLOCKED migration 守門已補：`031-037` 必須存在且 group/world-readable，`database/momo.db` / `momo_data.db` / `momo_database.db` 迷惑檔不得回來。
 - `incidents` 雙欄相容與 `action_plans` source/status guardrails 已在 migration 036/037 與 `tests/test_auto_heal_safety.py` 覆蓋。
 - `services/agent_actions.py` 不是死碼：`services/event_router.py` 透過 `SAFE_ACTIONS` registry 動態執行 ADR-012 L2 actions，`tests/test_agent_actions.py` 與 `tests/test_event_router.py` 已覆蓋並通過。
 
@@ -92,3 +93,4 @@
 - `497c376` 記錄 AI smoke service 入口驗證
 - `b22cbb2` 守住 scheduler 失敗告警覆蓋
 - `8026b93` 守住 scheduler 早晨排程錯開
+- `eb6886e` 同步 scheduler 排程摘要

tests/test_migration_metadata_coverage.py

@@ -1,4 +1,5 @@
 import re
+import stat
 from pathlib import Path
 
 from database.manager import Base
@@ -25,3 +26,27 @@ def test_all_orm_metadata_tables_have_create_table_migration():
     migration_tables = _migration_created_tables()
 
     assert metadata_tables - migration_tables == set()
+
+
+def test_v2_blocker_migrations_exist_and_are_runner_readable():
+    required = [
+        "031_fix_incidents_autoheal_schema.sql",
+        "032_market_intel_core_schema.sql",
+        "033_fix_host_health_probe_labels.sql",
+        "034_add_embedding_signature_to_rag_tables.sql",
+        "035_core_business_tables_baseline.sql",
+        "036_normalize_incidents_dual_columns.sql",
+        "037_add_action_plans_guardrails.sql",
+    ]
+
+    for filename in required:
+        path = ROOT / "migrations" / filename
+        assert path.exists(), f"missing migration: {filename}"
+        mode = stat.S_IMODE(path.stat().st_mode)
+        assert mode & stat.S_IRGRP, f"{filename} is not group-readable"
+        assert mode & stat.S_IROTH, f"{filename} is not world-readable"
+
+
+def test_legacy_zero_byte_database_decoys_do_not_return():
+    for filename in ["momo.db", "momo_data.db", "momo_database.db"]:
+        assert not (ROOT / "database" / filename).exists()