System Repair: Backend Integrity Audit & Migration

We ran a backend integrity audit. The kind where you check every table, every policy, every code reference — and score honestly. We scored 4 out of 10.

What 4/10 looks like

Three tables referenced in code had never been created in the database: payment_records, enrollments, digital_product_purchases. The TypeScript compiled fine. The build passed. But every query against those tables returned empty results — silently.

The dashboard metrics page showed all zeros. Not because the business had no activity, but because the dashboard queried a table name that had been renamed two migrations ago. The old name was still in the component. No error. Just zeros.

The full damage report

• 3 phantom tables — referenced in code, never migrated
• 1 ghost column reference — dashboard queried a renamed table
• RLS gaps — CMS tables missing public SELECT policies. Published content was invisible to anonymous visitors. The data existed. The frontend could not see it.
• Duplicate policies — iterative migration runs left duplicate service_role policies on 4 tables
• Empty Phase 2 tables — tables existed structurally but had zero rows

The repair

Single migration session. Created all missing tables with proper constraints. Fixed the dashboard reference. Added public SELECT policies for every CMS table with published content. Removed duplicates. Seeded Phase 2 tables with production data.

The rule we added

Backend integrity audits now run after every phase completion — not when things break. If the audit scores below 7/10, no frontend work proceeds. This is Gate 3c in our governance system. The backend must be real and verified before anyone touches a component.