[Epic] DB Corruption Prevention — WAL-mode safety incident response

[Cho-Geer]

Epic: DB Corruption Prevention — WAL-mode safety incident response

Source: docs/review/framework-refactor/read-audit-db-migration-plan.md §12
Incident: 2026-06-21 — WAL-mode SQLite corrupted by E2E-3 raw file ops (cp/mv/rm). 97.6% data recovered.

Sub-issues

• P0-A: Prohibit E2E from operating on production DB
• P0-B: Replace checkpoint-db.ts with proper WAL checkpoint
• P0-C: Add DB safe-maintenance helper (db-maintenance.ts)
• P0-D: Hardened enforcement / CI guard for DB raw file ops
• P0-E: Documentation & comment sync (read_audit.jsonl → SQLite)

Acceptance criteria

• All 5 P0 prevention items implemented and verified
• No test script operates directly on production .opencode/state/framework-state.db*
• CI guard blocks cp/mv/rm of framework-state.db* outside allowlisted helper