Mirrors stack pfs reaction's Ruling A13 discipline: every --family key
is resolved and validated up front (an unknown key fails before any
write), then build_guidance runs per family against a plain _read()
connection, and the _batch() block only ever calls write_guidance and
_publish() — it no longer holds the DuckDB single-writer lock while
FR/CPT text is scanned (#508-#514).