fix: harden shadow v3 preflight and export guards

.superpowers/sdd/2026-09-03-ft546wms-shadow-v3/task-8-report.md

@@ -0,0 +1,64 @@
+# Task 8 Report
+
+## Status
+
+GREEN, pending independent review.
+
+## RED Evidence
+
+- The plan's single-module command first failed dependency resolution because sibling reactor artifacts are not installed in this clean worktree.
+- The ledger-approved reactor-aware command was then run: `mvn -pl ruoyi-admin -am -Dtest=ShadowV3OperationsPackageTest -Dsurefire.failIfNoSpecifiedTests=false test`.
+- Result before implementation: 4 tests, 1 failure and 3 errors. All failures were caused by the missing v3 CMD, SQL, and server-AI prompt files.
+
+## Implementation
+
+- Added fail-fast CMD-only preflight, install/upgrade, confirmed uninstall, and read-only export scripts.
+- Preflight verifies the exact branch/commit, clean worktree, required main ancestry, at most one WMS JVM, SQL connectivity, recognized v2/v3 manifest, and snapshot state.
+- Installer accepts only `upgrade` or `clean`; the field runbook requires `upgrade` for the current v2 site.
+- Uninstaller requires the literal `CONFIRM_UNINSTALL` and warns to export evidence and restore stable service first.
+- Exporter writes deployment, process, environment-name-only, SQL diagnostics, comparison, metrics, inventory parity, and structured warning files.
+- Export SQL contains SELECT-only diagnostics over the requested warehouse/start time and uses SQL Server 2016-compatible constructs.
+- Replaced the outdated v2 runbook with the exact v3 deployment, seven-day observation, disable/restart rollback, and optional uninstall order.
+- Added a self-contained prompt for the server AI that authorizes export only and forbids deployment/database changes.
+
+## GREEN Evidence
+
+- Reactor-aware operations command: 5 tests, 0 failures, 0 errors, `BUILD SUCCESS`.
+- Plan-mandated no-argument CMD parser checks passed for preflight and uninstall.
+- Additional no-argument checks passed for install and export.
+- Invalid-mode/confirmation/path protection checks passed for all four scripts without SQL execution.
+
+## Files Changed
+
+- `scripts/shadow-v3-preflight.cmd`
+- `scripts/shadow-v3-install.cmd`
+- `scripts/shadow-v3-uninstall.cmd`
+- `scripts/shadow-v3-export.cmd`
+- `scripts/shadow-v3-export.sql`
+- `doc/algorithm-shadow/README.md`
+- `doc/algorithm-shadow/SHADOW_V3_SERVER_AI_EXPORT_PROMPT.md`
+- `ruoyi-admin/src/test/java/com/ruoyi/algorithm/shadow/ShadowV3OperationsPackageTest.java`
+
+## Concerns
+
+- The SQL package was not executed against a live production or disposable SQL Server; production execution remains explicitly out of scope.
+- Existing unrelated Lombok superclass and JVM class-data-sharing warnings remain unchanged.
+
+## Fix Round 1
+
+### RED Evidence
+
+Independent review reproduced six gaps: v3 snapshot state was display-only; repeat exports could overwrite evidence; environment capture did not validate its output; log collection conflated no matches with source failures; tests lacked executable CMD failure coverage; and JVM matching did not explicitly handle no-match status.
+
+### Changed Behavior
+
+- Preflight preserves clean-install and v2 eligibility, while v3 requires a published warehouse `01` snapshot with positive generation, synchronization/signature, no error, and no recent heartbeat/claim.
+- Export refuses an existing non-empty output directory before writing, validates environment evidence, requires a log candidate, and treats `findstr` code 1 as an empty valid warning file while failing on code 2+.
+
+### Verification
+
+`D:/BDevTools/maven/apache-maven-3.9.11/bin/mvn.cmd -pl ruoyi-admin -am -Dtest=ShadowV3OperationsPackageTest '-Dsurefire.failIfNoSpecifiedTests=false' test` -> `BUILD SUCCESS`, 5 tests, 0 failures, 0 errors.
+
+### Concerns
+
+Executable CMD integration tests with stub SQL/JVM tools remain limited by the current Java test harness; live SQL Server 2016 validation remains out of scope.

scripts/shadow-v3-export.cmd

@@ -31,8 +31,13 @@ if errorlevel 1 (call :fail "jps is not available on PATH" & exit /b 1)
 where sqlcmd >nul 2>nul
 if errorlevel 1 (call :fail "sqlcmd is not available on PATH" & exit /b 1)
 
-if not exist "%OUTPUT_DIR%" mkdir "%OUTPUT_DIR%"
-if errorlevel 1 (call :fail "cannot create OUTPUT_DIR" & exit /b 1)
+if exist "%OUTPUT_DIR%" (
+  dir /a /b "%OUTPUT_DIR%" >nul 2>nul
+  if not errorlevel 1 (call :fail "OUTPUT_DIR already exists and is not empty" & exit /b 1)
+) else (
+  mkdir "%OUTPUT_DIR%"
+  if errorlevel 1 (call :fail "cannot create OUTPUT_DIR" & exit /b 1)
+)
 
 pushd "%REPO_ROOT%" >nul
 if errorlevel 1 (call :fail "cannot enter REPO_ROOT" & exit /b 1)
@@ -52,11 +57,18 @@ if errorlevel 1 (call :fail "cannot collect JVM process evidence" & exit /b 1)
 (
   for /f "tokens=1 delims==" %%E in ('set FORTUCKY_ 2^>nul') do echo %%E
 ) > "%OUTPUT_DIR%\environment-variable-names.txt"
+if errorlevel 1 (call :fail "cannot collect environment variable evidence" & exit /b 1)
+call :require_output "environment-variable-names.txt"
+if errorlevel 1 exit /b 1
 
 sqlcmd -S "%SQL_SERVER%" -d "%DATABASE%" -E -b -r1 -w 65535 -y 0 -Y 0 -v WarehouseId="%WAREHOUSE_ID%" StartUtc="%START_UTC%" OutputDir="%OUTPUT_DIR%" -i "%SQL_FILE%"
 if errorlevel 1 (call :fail "read-only SQL export failed" & exit /b 1)
 
+set "LOG_CANDIDATE="
+for /f "delims=" %%L in ('dir /s /b "%LOG_DIR%\*.log" "%LOG_DIR%\*.txt" 2^>nul') do set "LOG_CANDIDATE=%%L"
+if not defined LOG_CANDIDATE (call :fail "LOG_DIR has no readable .log or .txt candidate" & exit /b 1)
 findstr /S /I /N /C:"shadow_failure" "%LOG_DIR%\*.log" "%LOG_DIR%\*.txt" > "%OUTPUT_DIR%\shadow-warnings.txt" 2>nul
+if errorlevel 2 (call :fail "cannot read log sources" & exit /b 1)
 
 call :require_output "sql-diagnostics.txt"
 if errorlevel 1 exit /b 1

scripts/shadow-v3-preflight.cmd

@@ -47,7 +47,7 @@ set "WMS_PROCESS_COUNT=0"
 for /f %%I in ('jps -lv 2^>nul ^| findstr /I /C:"com.ruoyi.RuoYiApplication" /C:"FT546WMS" ^| find /C /V ""') do set "WMS_PROCESS_COUNT=%%I"
 if %WMS_PROCESS_COUNT% GTR 1 (call :fail "more than one FT546WMS JVM is running" & exit /b 1)
 
-set "PREFLIGHT_SQL=SET NOCOUNT ON; IF SCHEMA_ID(N'alg') IS NULL SELECT N'CLEAN_INSTALL_ELIGIBLE' AS package_state; ELSE BEGIN IF OBJECT_ID(N'alg.shadow_package_manifest', N'U') IS NULL BEGIN; THROW 51050, 'shadow manifest is missing', 1; END; IF NOT EXISTS (SELECT 1 FROM alg.shadow_package_manifest WHERE package_id='FT546WMS_SHADOW_ONLY' AND package_version IN ('2026-08-12-1','2026-09-03-3')) BEGIN; THROW 51051, 'shadow manifest is not a supported version', 1; END; SELECT package_id, package_version, installed_at FROM alg.shadow_package_manifest; IF OBJECT_ID(N'alg.shadow_snapshot_state', N'U') IS NOT NULL SELECT warehouse_id, snapshot_generation, snapshot_status, synchronized_at, CONVERT(varchar(64), source_signature, 2) AS source_signature FROM alg.shadow_snapshot_state; END"
+set "PREFLIGHT_SQL=SET NOCOUNT ON; IF SCHEMA_ID(N'alg') IS NULL SELECT N'CLEAN_INSTALL_ELIGIBLE' AS package_state; ELSE BEGIN IF OBJECT_ID(N'alg.shadow_package_manifest', N'U') IS NULL THROW 51050, 'shadow manifest is missing', 1; IF NOT EXISTS (SELECT 1 FROM alg.shadow_package_manifest WHERE package_id='FT546WMS_SHADOW_ONLY' AND package_version IN ('2026-08-12-1','2026-09-03-3')) THROW 51051, 'shadow manifest is not a supported version', 1; IF EXISTS (SELECT 1 FROM alg.shadow_package_manifest WHERE package_id='FT546WMS_SHADOW_ONLY' AND package_version='2026-09-03-3') BEGIN IF OBJECT_ID(N'alg.shadow_snapshot_state', N'U') IS NULL THROW 51052, 'snapshot state is missing', 1; IF NOT EXISTS (SELECT 1 FROM alg.shadow_snapshot_state WHERE warehouse_id='01' AND snapshot_generation>0 AND snapshot_status='PUBLISHED' AND synchronized_at IS NOT NULL AND source_signature IS NOT NULL AND last_error IS NULL) THROW 51053, 'published warehouse 01 snapshot is unusable', 1; IF OBJECT_ID(N'alg.shadow_instance_heartbeat', N'U') IS NOT NULL AND EXISTS (SELECT 1 FROM alg.shadow_instance_heartbeat WHERE warehouse_id='01' AND ((last_seen_at IS NOT NULL AND DATEDIFF(SECOND,last_seen_at,SYSUTCDATETIME()) BETWEEN 0 AND 60) OR (claimed_at IS NOT NULL AND DATEDIFF(SECOND,claimed_at,SYSUTCDATETIME()) BETWEEN 0 AND 60))) THROW 51054, 'a recent shadow instance heartbeat or claim exists', 1; END SELECT package_id, package_version, installed_at FROM alg.shadow_package_manifest; END"
 sqlcmd -S "%SQL_SERVER%" -d "%DATABASE%" -E -b -r1 -Q "%PREFLIGHT_SQL%"
 if errorlevel 1 (call :fail "SQL connectivity or shadow package validation failed" & exit /b 1)