Function open_journal_read_only 

pub fn open_journal_read_only(path: &Path) -> Result<Connection, ReplicaError>

Open a physically read-only connection for the public read surface. PRAGMA query_only is only a mutable connection setting; opening with SQLITE_OPEN_READ_ONLY is what prevents a callback from turning it off and mutating the durable database behind CDC.

The writer must have opened the database first, so a WAL-family journal mode is already persistent on the file. This opener verifies that (accepting wal or wal2 — D3) without trying to change it, then applies the same connection-local planner/read pragmas as every other engine connection.

Takes no [ForeignKeys] posture, unlike its read-write peers: PRAGMA foreign_keys governs whether a write is refused and whether a declared ON DELETE/ON UPDATE action fires, and this connection can do neither. PRAGMA foreign_key_check — the audit — reads the same answer here whatever the pragma says ([rindle_writeplane::foreign_key_check]), which is precisely why the audit is the read surface’s tool and the pragma is not.