/sap-se14

name: sap-se14
description: |
  SE14 (DB Utility) for stuck DDIC tables — closes the gap /sap-se11 names but never implemented.
  check is a read-only RFC snapshot of DDIC-vs-DB consistency (DD02L active row + pending version,
  DWINACTIV inactive worklist, TBATG open conversion/DB-utility request with its state, DBDIFF
  DDIC/DB diff, QCM<T>/QCM8<T> shadow table, DDPRH log header) -> verdict CONSISTENT /
  ADJUST_NEEDED / CONVERSION_RUNNING / CONVERSION_TERMINATED / NOT_FOUND; it is safe to auto-chain
  after a failed table activation. adjust drives SE14 "Activate and adjust database" on the
  **save-data path only** — the delete-data radio is structurally unreachable (no code path selects
  it; the save-data radio is asserted by component ID before the adjust press), not merely gated.
  unlock recovers a TERMINATED conversion (continue = restart; release-lock only when a QCM-data
  guard proves no data is stranded). Both write modes are confirm-gated, GUI-driven (SAPMSGTB,
  identical on both releases), and post-verified by an authoritative RFC re-read. No TR (SE14 is a
  DB-level op, not a repository change); no new Z object; the DB-existence probes degrade to
  COULD_NOT_CHECK without the optional dev-init wrapper. Prerequisites: pinned /sap-login RFC
  profile for check; a live GUI session for adjust/unlock; NCo 3.1 (32-bit).
argument-hint: "check <TABLE> | adjust <TABLE> | unlock <TABLE> [continue]"

SAP SE14 DB Utility Skill

You diagnose a stuck table (`check`, read-only, auto-chainable) and, on request, fix it via the **save-data-only** adjust or a terminated-conversion unlock — both confirm-gated, with the delete-data path structurally refused, verified by an authoritative RFC re-read.

Task: $ARGUMENTS

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SKILL_DIR>/references/sap_se14_check_rfc.ps1` | `-Table` | RFC consistency battery + verdict (also the write-mode post-verify) | | `<SKILL_DIR>/references/sap_se14_adjust.vbs` | GUI (`%%TABLE%%`·`%%OUTPUT_FILE%%`·`%%SESSION_PATH%%`·`%%ATTACH_LIB_VBS%%`·`%%SESSION_LOCK_VBS%%`) | SAPMSGTB save-data-only adjust driver — **recorded + live-verified end-to-end on S4D (S/4HANA 1909) 2026-07-12** | | `<SKILL_DIR>/references/sap_se14_unlock.vbs` | GUI | SAPMSGTB conversion-recovery driver — `NEEDS_RECORDING` until captured (CONVERSION_TERMINATED cannot be safely manufactured) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` · `sap_connection_lib.ps1` · `sap_attach_lib.vbs` · `sap_session_lock.vbs` | libs | RFC + Tier-3 attach + session lock | | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` + `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_safety_gate.ps1` | Rule 0 | Environment guard — Step 3 runs `-Action assert` before any write mode | | `/sap-activate-object` · `/sap-run-report` (RADPROTA) · `/sap-se16n` · `/sap-dev-status` | sub-skills | Plain reactivate / full log (v1.5) / raw dumps / wrapper preflight |

---

Step 0 — Directories + Logging

Resolve `work_dir` + `{RUN_TEMP}` (canonical one-liner — `sap_connection_lib.ps1` is dot-sourced there — with `Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))` appended). `{RUN_TEMP}` = the per-run scratch dir holding the log state file; mint it once here and reuse (re-minting breaks the `-Action end` state-file lookup). Start logging (`sap_log_helper.ps1`, state `{RUN_TEMP}\sap_se14_run.json`). Pinned RFC profile for check; GUI session for write modes.

Step 1 — Parse & Dispatch

`check` | `adjust` | `unlock` (token `continue` -> unlock/continue). Uppercase `<TABLE>`. **Any wording asking for the delete-data variant -> immediate refusal `SE14_DELETE_PATH_REFUSED`** (v1 has no override), no further steps. `--background` -> "v1.5".

Step 2 — check (always runs first)

... sap_se14_check_rfc.ps1 -Table <T> -OutDir "{RUN_TEMP}\se14"

`SE14: CHECK <probe>=<state>` lines + `SE14: VERDICT <v>` + `se14_check_<T>.tsv`. Mode `check` -> stop here (report verdict + suggested `adjust`/`unlock` command). CONSISTENT + `adjust` -> nothing to do (if only DWINACTIV set, suggest `/sap-activate-object`). RFC down -> GUI SE14-check fallback.

Step 3 — write-mode guards (adjust/unlock)

**Rule 0 first** (`safety_policy.md`): `powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-se14` — `SAFETY: ALLOW` (0) proceed; `TYPED_CONFIRM_REQUIRED` (3) -> the operator types the shown `PROD <SID>/<CLIENT>` token, re-run with `-ConfirmationText '<their verbatim answer>'`, proceed only on `ALLOW_CONFIRMED`; `REFUSED class=<C>` (1) / `ERROR` (2) -> **STOP**, end `FAILED` with `-ErrorClass <C>`, relay the remediation lines — never bypass or drive SE14 manually instead (read-only `check` mode does not run the gate).

TABCLASS != TRANSP -> `SE14_UNSUPPORTED_TABCLASS`. Verdict CONVERSION_RUNNING -> refuse both write modes (`SE14_CONVERSION_RUNNING`). `unlock` requires verdict CONVERSION_TERMINATED. `unlock release-lock` additionally runs the QCM-data guard (wrapper `DD_EXISTS_DATA` on the QCM table; data found OR COULD_NOT_CHECK -> `SE14_QCM_DATA_AT_RISK`, refused in v1).

Step 4 — CONFIRM gate + drive (adjust/unlock)

**CONFIRM** (mandatory yes/no): adjust -> "I will ACTIVATE AND ADJUST table `<T>` on `<SID>/<CLIENT>` via the SAVE-DATA path (data preserved). Proceed?"; unlock/continue -> equivalent. On no -> `SKIPPED`.

**`unlock` stays `NEEDS_RECORDING`** (the conversion-recovery controls only materialize in a CONVERSION_TERMINATED state, which cannot be safely manufactured — see Scope). Running `sap_se14_unlock.vbs` echoes `SE14: NEEDS_RECORDING` and exits 3; report it and stop (never a guessed click).

**`adjust`** — substitute the 5 tokens and run the recorded save-data-only driver via **32-bit cscript**. Mirror the parallel-safe attach contract (BAKE the resolved path into `%%SESSION_PATH%%`, keep the base `{WORK_TEMP}` for `Get-SapCurrentSessionPath`, write the runtime VBS to `{RUN_