sqlite: dead-watcher subscribe fails closed + initial-stat identity-unknown baseline (review 004 items 2+3) — the poll loop sets a dead sign before the watcher-fatal exit and subscribe() fails closed on it (and the taken watcher slot) atomically with enrollment; listen/stream subscribe map it to Error::Database, never park on a dead feed; the identity baseline is Option-tracked so a failed startup stat no longer seeds the (0,0) false identity that a transient recovery would trip into death; engine-sqlite.md posture covers both arms; PROVENANCE D-39; task -> completed

docs/architecture/engine-sqlite.md

@@ -97,7 +97,16 @@ per-contract obligations live in the core spec and are not restated here.
 - Watcher failure handling is inherited: on watcher death, every
   subscriber's receiver closes (`WatcherDeathGuard` behavior) —
   consumers see the close, never a silent hang
-  ([ADR-006](decisions/006-wake-and-delivery-contract.md)).
+  ([ADR-006](decisions/006-wake-and-delivery-contract.md)). New
+  subscriptions issued *after* a watcher death (a `listen()` or a
+  stream `subscribe()`) fail closed with the opaque `Error::Database`
+  fallback — they never enroll onto a dead feed to park forever
+  (review 004 item 2); recovery is a fresh store open. The watcher
+  also treats the db file's identity as unknown until its first
+  successful stat: a failed startup stat does not seed a false
+  identity that the first later stat would spuriously trip into the
+  death path (review 004 item 3 — a transient stat hiccup at start
+  closes nothing).
 - Wake coalescing: bursts inside one poll tick produce one wake;
   correctness is preserved by the re-read contract
   (POC-pinned: missed-wake stress with correct post-burst re-reads).