修复(08-08-production-deployment-execution): 保留生产预检真实错误码

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -1553,14 +1553,16 @@ DEPLOY_SERVER=<approved-ssh-target> \
 - Local orchestrator: `deploy/trialrun/production-preflight.mjs`.
 - Remote read-only helper: `deploy/trialrun/production-preflight-remote.sh`.
 - Required process inputs: `EXPECTED_PRODUCTION_ORIGIN`,
-  `EXPECTED_PRODUCTION_DB_NAME`, and `EXPECTED_PENDING_MIGRATIONS`.
+  `EXPECTED_PRODUCTION_DB_NAME_SHA256`, `EXPECTED_PENDING_MIGRATIONS`, and the
+  exact deployment target/directory/Compose identity values.
 
 ### 3. Contracts
 
 - Production R2 is the inverse of the local migration task: the gate must prove
   the target is the expected production HTTPS origin and database identity, and
-  reject loopback, local regression, staging and trialrun identities. It must
-  never infer production from an SSH alias, Compose label or directory name.
+  reject loopback, local regression, staging, shadow and placeholder identities.
+  A legacy `trialrun` token is neutral; the gate must never infer production or
+  non-production from an SSH alias, Compose label or directory name alone.
 - The strict production-validation wrapper rejects unpublished-commit overrides;
   disaster-recovery exceptions use a separately approved recovery flow.
 - Expected target values remain process-only. The local orchestrator sends only
@@ -1583,6 +1585,12 @@ DEPLOY_SERVER=<approved-ssh-target> \
   insufficient.
 - Each preflight run removes only its two known report files before SSH; a
   reused report directory must never leave an old PASS status artifact in place.
+- After the stable remote summary and report reference are emitted, a non-zero
+  remote exit is evaluated before Prisma marker completeness. A parsed remote
+  `code=...` remains the primary stop reason; a non-zero exit without a safe
+  code becomes `PRODUCTION_PREFLIGHT_REMOTE_FAILED`. Only a zero remote exit
+  without the required marker becomes `PRISMA_STATUS_OUTPUT_MISSING`. This
+  ordering preserves both the original safety diagnosis and failure evidence.
 - When the strict wrapper invokes `deploy.sh`, it sets
   `DEPLOY_STATUS_OUTPUT_MODE=quiet`; the legacy status check must not echo raw
   datasource output. Detailed evidence comes from the controlled pre/post
@@ -1603,12 +1611,28 @@ DEPLOY_SERVER=<approved-ssh-target> \
   before `deploy.sh`.
 - Status output missing/unreadable, failed/rolled-back/diverged history or an
   unknown pending migration -> `PAUSED`; do not reset or resolve in place.
+- Non-zero remote exit with a safe `code=...`, with or without a Prisma marker
+  -> propagate that code and stop. Non-zero exit without a parseable code ->
+  `PRODUCTION_PREFLIGHT_REMOTE_FAILED`; never continue to marker validation.
+- Zero remote exit without the Prisma marker ->
+  `PRISMA_STATUS_OUTPUT_MISSING`; do not treat the transport success as a
+  complete pre-status result.
 - Pending set differs from the approved allowlist -> `PAUSED` and retain the
   status artifact for human review.
 - `terminated` count greater than zero -> record `rollbackWindow=CLOSED` and
   disallow compatibility rollback; this task never creates such a row.
 
-### 5. Tests Required
+### 5. Good/Base/Bad Cases
+
+- Good: the remote helper exits non-zero with a stable database-identity code;
+  the wrapper writes the stable evidence summary, returns that exact code and
+  stops before migration or deployment.
+- Base: the remote helper exits zero with a readable Prisma marker and the
+  wrapper continues into migration reconciliation.
+- Bad: check for a missing marker before checking the remote exit and replace
+  the real remote safety code with `PRISMA_STATUS_OUTPUT_MISSING`.
+
+### 6. Tests Required
 
 - `node --check deploy/trialrun/production-preflight.mjs`.
 - `bash -n deploy/trialrun/production-preflight-remote.sh`.
@@ -1617,6 +1641,26 @@ DEPLOY_SERVER=<approved-ssh-target> \
 - Static ordering must prove production preflight precedes `deploy.sh`, and the
   remote status marker precedes migration-history reconciliation. Fixtures must
   reject loopback/staging target identities without invoking SSH.
+- Cover all remote-result precedence combinations: non-zero with a safe code
+  and missing marker; non-zero with a safe code and present marker; non-zero
+  without a safe code; zero with a missing marker. Also assert the stable
+  summary and report reference are emitted before either failure check.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```text
+missing Prisma marker -> PRISMA_STATUS_OUTPUT_MISSING
+-> inspect remote non-zero exit afterward
+```
+
+#### Correct
+
+```text
+write stable evidence -> inspect remote non-zero exit and propagate/fallback
+-> only after remote success require the Prisma marker
+```
 
 ## Scenario: Environment Recovery Classification And Secret Custody