fix: align WAL multi-surface DB safety

- align app and standalone MCP busy-timeout and retry behavior
- guard live DB dev and restore flows
- document WAL maintenance boundaries

scripts/database/rah-db-owners.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DB_PATH="${1:-}"
+if [ -z "$DB_PATH" ]; then
+  echo "Usage: $0 <path-to-rah.sqlite>" >&2
+  exit 2
+fi
+
+if ! command -v lsof >/dev/null 2>&1; then
+  echo "lsof is required to inspect live RA-H database owners." >&2
+  exit 3
+fi
+
+paths=("$DB_PATH" "${DB_PATH}-wal" "${DB_PATH}-shm")
+existing=()
+for candidate in "${paths[@]}"; do
+  if [ -e "$candidate" ]; then
+    existing+=("$candidate")
+  fi
+done
+
+if [ "${#existing[@]}" -eq 0 ]; then
+  exit 0
+fi
+
+lsof -FnPc -- "${existing[@]}" 2>/dev/null | awk '
+  /^p/ { pid=substr($0, 2); next }
+  /^c/ { cmd=substr($0, 2); if (pid != "") print pid "\t" cmd }
+' | sort -u

scripts/database/sqlite-backup.sh

@@ -26,6 +26,13 @@ fi
 
 echo "Resolved DB path: $DB_PATH"
 
+OWNERS="$(bash "$(dirname "$0")/rah-db-owners.sh" "$DB_PATH" || true)"
+if [ -n "$OWNERS" ]; then
+  echo "⚠️  Live RA-H DB owners detected while creating a VACUUM INTO backup:"
+  echo "$OWNERS" | sed 's/^/  /'
+  echo "   Continuing because this backup path does not replace/delete DB, WAL, or SHM files."
+fi
+
 BACKUP_DIR="$(dirname "$0")/../backups"
 mkdir -p "$BACKUP_DIR"
 

scripts/database/sqlite-restore.sh

@@ -32,6 +32,14 @@ mkdir -p "$DB_DIR"
 echo "Source backup: $SRC"
 echo "Target DB:     $DB_PATH"
 
+OWNERS="$(bash "$(dirname "$0")/rah-db-owners.sh" "$DB_PATH" || true)"
+if [ -n "$OWNERS" ] && [ "${RAH_ALLOW_LIVE_DB_RESTORE:-}" != "true" ]; then
+  echo "❌ Refusing restore while RA-H DB owners are live:" >&2
+  echo "$OWNERS" | sed 's/^/  /' >&2
+  echo "Close RA-H/MCP/dev processes first, or set RAH_ALLOW_LIVE_DB_RESTORE=true if you have deliberately quiesced them." >&2
+  exit 4
+fi
+
 echo "Verifying backup integrity before restore..."
 ICHECK=$(sqlite3 "$SRC" "PRAGMA integrity_check;")
 echo "  $ICHECK"

scripts/dev/guard-live-db-dev.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+DEFAULT_DB="$HOME/Library/Application Support/RA-H/db/rah.sqlite"
+
+DB_PATH="${SQLITE_DB_PATH:-}"
+if [ -z "$DB_PATH" ] && [ -f "${ROOT_DIR}/.env.local" ]; then
+  DB_PATH=$(grep -E '^SQLITE_DB_PATH=' "${ROOT_DIR}/.env.local" | sed 's/^SQLITE_DB_PATH=//' | sed 's/^"\(.*\)"$/\1/') || true
+fi
+if [ -z "$DB_PATH" ]; then
+  DB_PATH="$DEFAULT_DB"
+fi
+
+if [ "$DB_PATH" != "$DEFAULT_DB" ]; then
+  exit 0
+fi
+
+echo "⚠️  dev:mac is using the packaged live RA-H DB:"
+echo "   $DB_PATH"
+echo "   Prefer SQLITE_DB_PATH=<dev-db> for isolated development when possible."
+
+owners="$("${ROOT_DIR}/scripts/database/rah-db-owners.sh" "$DB_PATH" || true)"
+if [ -z "$owners" ]; then
+  exit 0
+fi
+
+if [ "${RAH_ALLOW_LIVE_DB_DEV:-}" = "true" ]; then
+  echo "RAH_ALLOW_LIVE_DB_DEV=true set; continuing despite live DB owners:"
+  echo "$owners" | sed 's/^/  /'
+  exit 0
+fi
+
+echo "❌ Refusing to start dev server against the live DB while these processes have it open:"
+echo "$owners" | sed 's/^/  /'
+echo "Close RA-H/MCP owners first, set SQLITE_DB_PATH to a dev DB, or override with RAH_ALLOW_LIVE_DB_DEV=true."
+exit 1

scripts/dev/run-tauri-dev.sh

@@ -9,6 +9,8 @@ NEXT_LOG="${REPO_DIR}/logs/next-dev.log"
 
 mkdir -p "${REPO_DIR}/logs"
 
+"${REPO_DIR}/scripts/dev/guard-live-db-dev.sh"
+
 cleanup() {
   if [[ -n "${NEXT_PID:-}" ]]; then
     echo "Shutting down Next.js dev server (pid ${NEXT_PID})"