diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcfd6da..d8f2aa4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,11 +47,49 @@ jobs:
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      # Runs the whole workspace, including the schema-snapshot guardrail
-      # (it picks up DATABASE_URL from the env above and the postgres
-      # service; without a DB it would skip cleanly).
-      - name: Test
-        run: cargo test --workspace
+      # `--include-ignored` is load-bearing. Every DB-backed integration test is
+      # `#[ignore = "needs DATABASE_URL..."]`, and CI omitted the flag — so CI ran
+      # 927 tests and silently skipped 237, among them ALL of authz.rs and api.rs
+      # and the entire CLI journey suite. The isolation and RBAC tests existed but
+      # never executed (AUDIT.md F-Q-014). CI does provide Postgres, so run them.
+      #
+      # `--all-targets` (not a bare `cargo test`) is deliberate: it runs the lib,
+      # bins, and integration tests but NOT doctests. `-- --include-ignored`
+      # un-ignores not just `#[ignore]` tests but also ` ```ignore ` DOCTESTS,
+      # which are illustrative pseudocode that does not compile — so a bare
+      # `cargo test ... -- --include-ignored` fails on them. Doctests run in their
+      # own step below, without the flag. (Clippy already uses `--all-targets` for
+      # the same doctest-excluding reason.)
+      #
+      # The CLI journeys are a SEPARATE step, and deliberately not part of the
+      # workspace run: they spawn a real picloud whose dispatcher/orchestrator
+      # claim loops are global by design (one instance owns one database). Run
+      # concurrently with the manager-core suites — which share this database —
+      # it would claim their outbox and workflow rows out from under them. Keeping
+      # the steps sequential keeps that live server off the shared DB while the
+      # other suites are using it.
+      - name: Test (workspace, including DB-backed tests)
+        run: cargo test --workspace --exclude picloud-cli --all-targets -- --include-ignored
+
+      # Doctests, run WITHOUT --include-ignored so ` ```ignore ` snippets stay
+      # ignored. `--all-targets` above skips these, so nothing else covers them.
+      - name: Doctests
+        run: cargo test --workspace --doc
+
+      # The journey harness execs the prebuilt target/debug/picloud and does NOT
+      # rebuild it, so a stale binary would silently test old server code.
+      - name: Build picloud (the journey harness execs this binary)
+        run: cargo build -p picloud
+
+      # The spawned server inherits this env; without a secret key it aborts at
+      # startup and every journey fails as "/healthz never returned 200".
+      # `--all-targets` for the same reason as above (the journeys are `#[ignore]`
+      # integration tests; picloud-cli's doctests, if any, run in the Doctests step).
+      - name: Test (CLI journeys)
+        env:
+          PICLOUD_DEV_MODE: "true"
+          PICLOUD_DEV_INSECURE_KEY: i-understand-this-is-insecure
+        run: cargo test -p picloud-cli --all-targets -- --include-ignored
 
   dashboard:
     name: Dashboard — check
diff --git a/crates/picloud/tests/api.rs b/crates/picloud/tests/api.rs
index b0715be..ca9afd5 100644
--- a/crates/picloud/tests/api.rs
+++ b/crates/picloud/tests/api.rs
@@ -890,14 +890,22 @@ async fn version_includes_public_base_url(pool: PgPool) {
     let v: Value = r.json();
     assert!(v["public_base_url"].is_string());
     assert_eq!(v["api"], 1);
-    // `schema` is migrations::latest_version() — the highest embedded
-    // migration number, currently 66 (…0065_group_queues, then
-    // 0066_projects wiring the §7 multi-repo ownership seam). This test is
-    // #[ignore]-gated so it doesn't run in the default `cargo test`; pinned to
-    // current reality so an unintended schema change is still caught. Bump it
-    // whenever a migration lands.
-    assert_eq!(v["schema"], 66);
-    assert_eq!(v["sdk"], "1.10");
+    // This asserts the WIRING — that `/version` actually surfaces the live
+    // constants — not the values themselves. It used to hardcode `66`, with a
+    // comment to bump it by hand on every migration. Nobody did: CI never ran
+    // this test (it is `#[ignore]`d, and CI omitted `--include-ignored`), so it
+    // sat broken from 0066 all the way to 0073 and only surfaced when the CI gap
+    // was closed. A constant that must be hand-synced with a constant is not a
+    // test, it is a chore that fails silently.
+    //
+    // Drift in the values is already caught where it belongs: the schema by
+    // `manager-core/tests/schema_snapshot.rs`, the version surfaces by
+    // `scripts/check-versioning.sh`.
+    assert_eq!(
+        v["schema"],
+        picloud_manager_core::migrations::latest_version()
+    );
+    assert_eq!(v["sdk"], picloud_shared::version::SDK_VERSION);
 }
 
 // ============================================================================
diff --git a/docker-compose.yml b/docker-compose.yml
index ffa65b3..9fe89f8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,6 +14,14 @@ name: picloud
 services:
   postgres:
     image: postgres:16-alpine
+    # The default ceiling of 100 is not enough to RUN THE TEST SUITE. libtest runs
+    # ~nproc tests concurrently, and every `#[sqlx::test]` opens its own pool
+    # against its own throwaway database — on a 16-core box that alone exceeds 100,
+    # and Postgres answers with "sorry, too many clients already". The DB-backed
+    # tests were all `#[ignore]`d and CI never passed `--include-ignored`, so this
+    # ceiling was never actually exercised; it surfaced the moment CI started
+    # running them. Serving the app needs nothing like this many.
+    command: postgres -c max_connections=500
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-picloud}
       POSTGRES_USER: ${POSTGRES_USER:-picloud}