Why: the first pin allowed adopt to recreate a missing database and could write the guard record through a lock symlink. The spec now matches the refusal rules from review. Evidence: Backend 1f7bcac; SELF tests named in that commit. Impact: Dev gitlink moves from 89acd16 to 1f7bcac. Operators still see the same migrate command. Refs: docs/recovery/u8-sqlite-instance-guard.md Co-authored-by: Cursor <cursoragent@cursor.com>