feat: add ledger backup safety workflow

confirm dcy-002 and add REQ/BAT evidence

add ledger backup/status metadata workflow

document restore as runbook/script-only guarded operation

add synthetic DB backup/restore smoke tests

docs/runtime-flows.md

@@ -4,7 +4,7 @@
 - Baseline Seed: `.stage-pilot/bootstrap/baseline.yaml`
 - Status: draft
 - Owner: Jarca / project maintainer
-- Last Updated (KST): 2026-06-26 22:24
+- Last Updated (KST): 2026-06-27 10:17
 - Source Discovery / Batch: bootstrap-baseline
 - Primary Runtime: mixed
 
@@ -63,11 +63,21 @@
 3. Matched self-transfers become `이체 / 본인계좌이동`; investment movements become `이체 / 투자이동`; ambiguous rows remain `확인필요`.
 4. Cancel/refund rows can be linked to original expense rows; memo tags preserve manual link evidence.
 
+## Flow: `Operational backup, validation DB, and restore smoke`
+1. Operator captures non-sensitive DB status evidence with `get_ledger_db_status`: path, size, mtime, sha256, integrity check, major table row counts, and aggregate totals.
+2. Operator creates a timestamped backup in `/root/.local/share/jarca/backups/ledger/` with `create_ledger_backup`; retention keeps the most recent 30 days or newest 20 files.
+3. Risky import, rollback, categorization apply, reconciliation, or migration work is tested first against a synthetic fixture DB or repo-external validation DB copy selected through `JARCA_LEDGER_DB_PATH`.
+4. Backup list/status/hash checks use `list_ledger_backups` and `get_ledger_backup_status`.
+5. Restore execution is not an MCP flow. Restore smoke uses `scripts/ledger_restore_smoke.py` or the runbook and requires explicit approval before overwriting an existing target DB.
+6. Verification evidence must not include full transaction dumps, full merchant/counterparty dumps, account identifiers, raw_payload, original financial file contents, or passwords.
+
 ## Flow Constraints
 - Preview before broad import or categorization mutation where supported.
 - Do not include `transfer`, `investment`, `exclude`, or unresolved rows in actual household spending totals unless a report explicitly asks for account movement.
 - Preserve raw import evidence for audit and future reclassification.
 - Avoid destructive migrations without a backup/approval plan.
+- Before broad DB mutation, capture DB status evidence and create or confirm a recent backup.
+- Restore execution is script/runbook only and must not be exposed as an MCP tool.
 - Sensitive passwords are runtime inputs and must not be committed.
 
 ## Current Gaps / Planned Changes
@@ -82,3 +92,4 @@
 
 ## Change Log
 - 2026-06-26 22:24 KST: Created by `bootstrap-baseline` from repository observation.
+- 2026-06-27 10:17 KST: BAT-002/REQ-002 기준으로 운영 backup/status/list/hash 및 restore 제한 flow 추가.