diff --git a/tools/binary_extensions.py b/tools/binary_extensions.py
index f15f1708a4..d3b159714e 100644
--- a/tools/binary_extensions.py
+++ b/tools/binary_extensions.py
@@ -38,7 +38,14 @@ _SQLITE_SIDECAR_MARKERS = ("-wal", "-shm", "-journal")
 
 # Only these suffixes take a sidecar marker; ``report.docx-wal`` is not a
 # document and must not be treated as one.
-_SQLITE_EXTENSIONS = frozenset({".db", ".sqlite", ".sqlite3", ".db3"}) & BINARY_EXTENSIONS
+_SQLITE_EXTENSIONS = frozenset({".db", ".sqlite", ".sqlite3"})
+assert _SQLITE_EXTENSIONS <= BINARY_EXTENSIONS
+
+
+def _lower_suffix(path: str) -> str:
+    """Lower-cased final ``.suffix`` of ``path`` ("" when there is no dot)."""
+    dot = path.rfind(".")
+    return "" if dot == -1 else path[dot:].lower()
 
 
 def _strip_sidecar_marker(suffix: str) -> str | None:
@@ -56,24 +63,15 @@ def _has_extension_in(path: str, extensions: frozenset) -> bool:
     """Case-insensitive check on the final ``.suffix``; pure string, no I/O.
     A SQLite sidecar counts as its database's extension (only SQLite suffixes
     are stripped, so ``x.docx-wal`` stays unrecognised)."""
-    dot = path.rfind(".")
-    if dot == -1:
-        return False
-    suffix = path[dot:].lower()
-    base = _strip_sidecar_marker(suffix)
-    if base is not None:
-        suffix = base
-    return suffix in extensions
+    suffix = _lower_suffix(path)
+    return (_strip_sidecar_marker(suffix) or suffix) in extensions
 
 
 def is_sqlite_sidecar(path: str) -> bool:
     """True for ``x.db-wal`` / ``x.sqlite3-shm`` / ``x.db-journal`` paths.
     Pure string, no I/O — a sidecar path is never a legitimate text target
     even when no sidecar exists on disk (a checkpointed db has none)."""
-    dot = path.rfind(".")
-    if dot == -1:
-        return False
-    return _strip_sidecar_marker(path[dot:].lower()) is not None
+    return _strip_sidecar_marker(_lower_suffix(path)) is not None
 
 
 def has_binary_extension(path: str) -> bool:
diff --git a/tools/file_tools_write_guards.py b/tools/file_tools_write_guards.py
index df40d2905b..d8b3adb4de 100644
--- a/tools/file_tools_write_guards.py
+++ b/tools/file_tools_write_guards.py
@@ -431,7 +431,7 @@ def _check_binary_document_write(filepath: str, task_id: str = "default") -> str
     silently destroys the document (port of nearai/ironclaw#7109).
     """
     if has_opaque_document_extension(filepath):
-        ext = filepath[filepath.rfind("."):].lower()
+        ext = os.path.splitext(filepath)[1].lower()
         return (
             f"Refusing to write plain text to binary document '{filepath}' ({ext}). "
             "A text write cannot produce a valid document container and would "
@@ -443,7 +443,7 @@ def _check_binary_document_write(filepath: str, task_id: str = "default") -> str
     # no sidecar exists yet: a checkpointed db has none on disk, and a garbage
     # WAL dropped next to a live database is picked up on the next open.
     if is_sqlite_sidecar(filepath):
-        ext = filepath[filepath.rfind("."):].lower()
+        ext = os.path.splitext(filepath)[1].lower()
         return (
             f"Refusing to write plain text to binary SQLite sidecar '{filepath}' ({ext}). "
             "A -wal/-shm/-journal file holds raw database pages that SQLite "