BUG: Forensics module correctness

[echel0nn]

Labels: bug, forensics-module
Severity: S1.

Finding (path:line)	Issue
modules/forensics/reporting/writeup_builder.py:373-380	_load_artefacts_by_family reads getattr(r,"family"/"type"/"data") but the fields are artifact_family/artifact_type/data_json -> every row falls into "unknown" with empty payload; every writeup is generated against zero artifacts (blank Ghidra/memory/network sections)
modules/forensics/api_router.py:1080-1116	delete_project deletes 6 child tables but NOT FindingSuppressionRecord, AnalystDirectiveRecord, SolidEvidenceRecord, AnswerCandidateRecord (all reference project_id) -> FK violation crash or orphaned rows corrupting future fingerprint matches
modules/forensics/services/machine_readiness.py via api_router.py:1230-1250	check_readiness auto-enqueues run_forensics_analysis with no check for an already-queued/running task -> a double-click runs two full pipelines on the same target, racing on artifact inserts
modules/forensics/api_router.py:1356,1395,1900	list_investigations/list_findings/list_evidence return unbounded sets (no page/page_size) -> multi-MB responses, OOM under load
modules/forensics/db_models/investigation.py	InvestigationRunRecord/AgentStepRecord/WriteUpRecord/AnswerCandidateRecord have no team_id; isolation relies solely on the project join -> any query omitting the join leaks cross-tenant
modules/forensics/workflow/states/freeflow.py:61-160	_HARD_TURN_CAP=50 turns on Opus with no per-investigation cost ceiling / kill-switch and no max_cost_usd config -> runaway spend with no metric until billed

Acceptance: writeup builder reads the real field names (add a test asserting non-empty artifact families); delete_project covers every project_id child (or FK ON DELETE CASCADE); readiness enqueue is idempotent; list endpoints paginate in SQL; child tables carry team_id or a documented join contract; freeflow honors a cost ceiling.

[echel0nn]

Design decision (2026-07-19). Cost governance HARD CAPS applies here: freeflow needs a per-investigation cost ceiling / kill-switch (currently none). Checkpoint before the cap so the run is resumable. The empty-writeup and other correctness items stand as filed.

[echel0nn]

Implementation-ready design (2026-07-19). Wave 1b. Full design on disk: .run/designs/DESIGN_module_correctness.md (8-heading template: grounded problem, design with signatures+DDL+Alembic, reworked concerns, test plan, rollout).

Key moves:

• writeup_builder reads artifact_family/artifact_type/data_json (fixes every-writeup-empty) + a non-empty-artifact test.
• delete_project covers all four missing children; idempotent readiness enqueue; pagination; team_id on child tables; freeflow_max_cost_usd ceiling (decision build(deps): bump cryptography from 46.0.5 to 46.0.7 #8).