-- Phase 6F — Capstone gate review (Step 7). Decision: STRENGTHEN, do not weaken.
--
-- Evidence gathered before deciding:
--   - rootnode-capstone's own scenario pool (assessment_definitions.pool_spec) is 100%
--     deployments/config/troubleshooting/real-ops scenarios — zero overlap with
--     rootnode-security-assessment's CKS-style pool (SecurityContext, RBAC, NetworkPolicy,
--     image supply chain). A student can currently reach and pass the Capstone having never
--     touched a single security scenario.
--   - ROOT 09 (Kubernetes Security) only reached genuine course-level 'ready' status THIS
--     phase (see 029_phase6f_root_v1_integration.sql) — Phase 6B/6C left it PARTIAL, so
--     requiring it any earlier would have been irresponsible (gating on unfinished content).
--   - root-09 and root-12 are already sibling courses (both prerequisite = root-06), so adding
--     root-09 alongside root-12 as a root-capstone prerequisite imposes no new sequencing
--     burden — a student can do them in either order or in parallel, they simply both must be
--     done before the Capstone course unlocks.
--   - For the intended ROOT_ audience (aspiring DevOps/cloud/platform/infrastructure
--     engineers), shipping a "graduation" capstone with zero security competency check is a
--     real, professionally-relevant gap, not a cosmetic one.
--
-- What this changes: ONLY the course-layer `root-capstone.prerequisites` array (the same
-- mechanism/column every other course-level gate in this program already uses — no schema
-- change). What this deliberately does NOT change: the pre-existing, older
-- `rootnode-path.json` "stages_complete" unlock_rule that gates actually STARTING the
-- rootnode-capstone assessment itself (foundation/workloads/networking/configuration/
-- troubleshooting/real-ops) — that legacy mechanism has no natural "security stage" without
-- new scenario-bank content-authoring work, which is out of Phase 6F's scope. The two gates
-- already "agree by construction, not by shared implementation" (ROOT_PROGRAM_ARCHITECTURE.md);
-- this migration keeps that true by only ever making the course-layer gate a superset,
-- never a subset, of what the assessment-layer gate already requires.
--
-- Result: a student must now complete ROOT 09 (Security) AND ROOT 12 (Real Ops) — both already
-- required individually, now also jointly required — before the root-capstone COURSE is
-- unlocked, in addition to the pre-existing six-stage scenario gate on the assessment itself.
-- See docs/ROOT_V1_CURRICULUM_MANIFEST.md and platform/test/e2e-phase6f.js for verification.

UPDATE courses SET
  prerequisites = ARRAY['root-12-real-ops', 'root-09-kubernetes-security'],
  version = version + 1, updated_at = now()
  WHERE course_id = 'root-capstone';