Harden challenge-progress SQLite storage and legacy migration for 3.5.0

[minoneer]

Pre-release hardening of #137, fixing the confirmed findings from a deep adversarial review of the SQLite challenge-progress feature.

Release blocker fixed

• Islands with a completed no-cooldown challenge could not be loaded at all. sqlite-jdbc's getObject(column, Long.class) throws Bad value for type Long on SQL NULL instead of returning null, so any island with a stored completion without an active cooldown (e.g. any completed one-time challenge) made load() throw on every challenge command, GUI open, and member join. Now read via getLong + wasNull, with a regression test that fails on master.

Legacy migration made faithful to the old sharing semantics

The one-shot YAML→SQLite import now reproduces exactly what the pre-SQLite runtime read, per the server's configured challengeSharing (per-island is the only model going forward):

• challengeSharing: player servers no longer lose non-leader progress. Per-player completion files were live data; they're resolved through the player's own recorded island coordinates (deterministic, the source the old runtime keyed by), with island membership (party.members) as fallback, and max-merged into the island.
• challengeSharing: island (default) servers no longer resurrect stale data. Only island-named files and the leader's file (the old loader promoted it when no island file existed — and only then) are imported; other per-player files are residue from a former player-sharing era and stay in place.
• players/*.yml fallback gating matches the old loader: per player under player sharing, per island under island sharing, never when superseded by a completion file.
• Scan failures now abort the migration (and plugin enable) instead of writing the one-shot marker with data unread; per-file YAML corruption still skips gracefully. The migration logs summary counts for unmapped and stale sources.

Robustness fixes

• The completion cache's graceful-degradation catch could never fire: Guava wraps runtime failures in UncheckedExecutionException, not ExecutionException. DB read failures now degrade to an empty map with a WARNING instead of uncaught player-facing errors.
• Member-join permission re-grant no longer throws NoSuchElementException (aborting all grants) when stored progress references a challenge removed from challenges.yml.
• SQLite repository now gets the plugin logger via @PluginLog (was Guice's JIT JUL logger) and logs store/pragma failures at WARNING instead of FINE.
• Removed the dead startup re-creation of the legacy completion/ directory that undid the migration's cleanup every boot.
• Admin docs: new "Progress storage" section (DB path + backup guidance), challengeSharing documented as ignored — with the explicit warning to leave the key in place for the first start after upgrading, since the importer reads it to interpret legacy data.

Verification

• 9 new tests; 7 fail against master's sources (NULL-cooldown round-trip ×2, member-file import, per-player/per-island yml gating ×2, leader-file precedence, repository-failure fallback). The member-join guard is verified by inspection (constructing ChallengeLogic in a test is impractical); the island-sharing residue test pins the no-import invariant.
• The migration changes were themselves adversarially reviewed against the actual pre-SQLite loader (3599595e); all confirmed findings from that second pass are fixed in the last commit.
• Full multi-module build green.

Consciously deferred to 4.0 (where the catalog rework replaces the completion runtime): write-behind cache crash window, PRAGMA synchronous connection scope, sqlite-jdbc version shadowing by Paper's bundled driver, IslandKey strictness. Tracking issue to follow.

🤖 Generated with Claude Code