Local-first runtime cleanup and recovery hardening

bible-local/07-dev.md

@@ -60,6 +60,11 @@ The following components were **intentionally removed** and must not be brought
 
 - Any sync changes must preserve local-first behavior
 - Local CRUD must not be blocked when MariaDB is unavailable
+- Runtime business code must not query MariaDB directly; all normal reads/writes go through SQLite snapshots
+- Direct MariaDB access is allowed only in `internal/services/sync/*` and dedicated setup/migration tools under `cmd/`
+- `connMgr.GetDB()` in handlers/services outside sync is a code review failure unless the code is strictly setup or operator tooling
+- Local SQLite migrations must be implemented in code; do not add a server-side registry of client SQLite SQL patches
+- Read-only local cache tables may be reset during startup recovery if migration fails; do not apply that strategy to user-authored tables like configurations, projects, pending changes, or connection settings
 
 ### Formats and UI
 
@@ -108,7 +113,7 @@ if found && price > 0 {
 
 1. **`CurrentPrice` removed from components** — any code using it will fail to compile
 2. **`HasPrice` filter removed** — `component.go ListComponents` no longer supports this filter
-3. **Quote calculation:** always offline-first (SQLite); online path is separate
+3. **Quote calculation:** always SQLite-only; do not add a live MariaDB fallback
 4. **Items JSON:** prices are stored in the `items` field of the configuration, not fetched from components
 5. **Migrations are additive:** already-applied migrations are skipped (checked by `id` in `local_schema_migrations`)
 6. **`SyncedAt` removed:** last component sync time is now in `app_settings` (key=`last_component_sync`)