fix: align WAL multi-surface DB safety

- align app and standalone MCP busy-timeout and retry behavior
- guard live DB dev and restore flows
- document WAL maintenance boundaries

scripts/database/rah-db-owners.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DB_PATH="${1:-}"
+if [ -z "$DB_PATH" ]; then
+  echo "Usage: $0 <path-to-rah.sqlite>" >&2
+  exit 2
+fi
+
+if ! command -v lsof >/dev/null 2>&1; then
+  echo "lsof is required to inspect live RA-H database owners." >&2
+  exit 3
+fi
+
+paths=("$DB_PATH" "${DB_PATH}-wal" "${DB_PATH}-shm")
+existing=()
+for candidate in "${paths[@]}"; do
+  if [ -e "$candidate" ]; then
+    existing+=("$candidate")
+  fi
+done
+
+if [ "${#existing[@]}" -eq 0 ]; then
+  exit 0
+fi
+
+lsof -FnPc -- "${existing[@]}" 2>/dev/null | awk '
+  /^p/ { pid=substr($0, 2); next }
+  /^c/ { cmd=substr($0, 2); if (pid != "") print pid "\t" cmd }
+' | sort -u

scripts/database/sqlite-backup.sh

@@ -26,6 +26,13 @@ fi
 
 echo "Resolved DB path: $DB_PATH"
 
+OWNERS="$(bash "$(dirname "$0")/rah-db-owners.sh" "$DB_PATH" || true)"
+if [ -n "$OWNERS" ]; then
+  echo "⚠️  Live RA-H DB owners detected while creating a VACUUM INTO backup:"
+  echo "$OWNERS" | sed 's/^/  /'
+  echo "   Continuing because this backup path does not replace/delete DB, WAL, or SHM files."
+fi
+
 BACKUP_DIR="$(dirname "$0")/../backups"
 mkdir -p "$BACKUP_DIR"
 

scripts/database/sqlite-restore.sh

@@ -32,6 +32,14 @@ mkdir -p "$DB_DIR"
 echo "Source backup: $SRC"
 echo "Target DB:     $DB_PATH"
 
+OWNERS="$(bash "$(dirname "$0")/rah-db-owners.sh" "$DB_PATH" || true)"
+if [ -n "$OWNERS" ] && [ "${RAH_ALLOW_LIVE_DB_RESTORE:-}" != "true" ]; then
+  echo "❌ Refusing restore while RA-H DB owners are live:" >&2
+  echo "$OWNERS" | sed 's/^/  /' >&2
+  echo "Close RA-H/MCP/dev processes first, or set RAH_ALLOW_LIVE_DB_RESTORE=true if you have deliberately quiesced them." >&2
+  exit 4
+fi
+
 echo "Verifying backup integrity before restore..."
 ICHECK=$(sqlite3 "$SRC" "PRAGMA integrity_check;")
 echo "  $ICHECK"