[santoshkumarradha]

Plan inspection and worker CLI calls could fail with SQLITE_BUSY while another writer held the database. Filenames containing URI characters could also open a different database than requested.

Current plans now check their existing schema and load their committed state through a read-only connection. Creation and migration retain the serialized writer path, and writes retain the established bounded retry budget with actionable exhaustion guidance. All seven remaining plan/ledger SQLite openers encode literal paths, including relative inputs.

End-to-end evidence

All data is fictional and isolated.

Check	Observed result
Actual codeaf plandb under contention	A fresh read returned in 26.39 ms while an independent writer still held its transaction beyond six seconds. A completion write waited, succeeded after release, and reopened with its exact result.
Actual CLI filename lifecycle	Eight absolute/relative cases created, claimed, completed and reopened the exact requested file; no decoded or truncated sibling database appeared.
Live terminal workflow	Inspected a project whose path contains URI characters, delegated a two-file Python task, and independently reran seven passing tests from the task branch. All 32 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash.

The isolated CLI acceptance passed in 8.672 seconds. The live workflow passed in 20.841 seconds. Focused regressions reproduce both bugs before the fix and pass afterward; migration, concurrent-open, crash, relative-path, no-create and read-only controls pass. Focused race checks pass across the four changed packages. make pr-ready passed, including all eight session shards; every selected test passed on its first run.

Closes #1462.
Closes #1883.