feat: HSM main/slave certificate comparison with batch SQL generation

- compare usercert_tab by subject raw bytes + certtype
- generate single annotated CSV report
- generate merge-<timestamp>.sql in current directory for DBA execution
- preserve GBK DN bytes via ATTACH + INSERT OR REPLACE / UPDATE
- compatible with sqlite3 3.6.20 and JDK 1.8

.gitignore

@@ -0,0 +1,8 @@
+target/
+*.class
+reports/
+merge-*.sql
+*.db.bak-*
+*.tmp
+.idea/
+*.iml

README.md

@@ -0,0 +1,159 @@
+# HSM 主备数据库证书比对工具
+
+Java 8 命令行工具，用于比对 HSM 主库、从库 SQLite 数据库中的 `usercert_tab`，生成一份差异报表，并按人工标注的“合并选择”生成**在主库执行的批量 SQL 脚本**。
+
+- 身份键：`subject` 原始字节 + `certtype`
+- 三类差异：主库多、从库多、不一致
+- 报表：单份 CSV（UTF-8 + BOM），含“合并选择”列
+- 合并方式：生成 `merge-<时间戳>.sql`，由 DBA 在主库执行
+- 工具本身只读源库，不直接修改任何数据库
+- 脚本通过 `ATTACH` 从从库按原始字节复制，DN 中文（GBK 字节）不经过 Java 字符串
+- 不生成日志文件，信息只输出到控制台
+
+详细需求与设计见 `需求文档.md`、`设计文档.md`。
+
+## 构建
+
+要求：JDK 8 + Maven 3.x。
+
+```bash
+mvn clean package
+# 产物：target/cert-compare.jar（fat jar，含 sqlite-jdbc 原生库）
+```
+
+当前构建：12 个单元测试全部通过，jar 约 9.8 MB。
+
+## 配置
+
+`config.properties`（UTF-8）：
+
+```properties
+db.main=/app/cert-compare/main.db
+db.slave=/app/cert-compare/slave.db
+db.text.encoding=GB18030
+dn.match=EXACT
+sn.normalize=HEX
+report.dir=/app/cert-compare/reports
+report.csv.bom=true
+```
+
+相对路径以配置文件所在目录为基准。SQL 脚本不配置输出目录，直接写入运行时当前目录。
+
+## 使用
+
+### 交互模式
+
+```bash
+java -Dfile.encoding=UTF-8 -jar cert-compare.jar --config config.properties
+```
+
+```text
+cert-compare> set main /app/cert-compare/main.db
+cert-compare> set slave /app/cert-compare/slave.db
+cert-compare> compare
+cert-compare> sql --report /app/cert-compare/reports/compare-report-20261104-213307-annotated.csv
+```
+
+### 一次性命令
+
+```bash
+# 1. 生成报表
+java -Dfile.encoding=UTF-8 -jar cert-compare.jar compare --config config.properties
+
+# 2. 人工标注“合并选择”后生成批量 SQL
+java -Dfile.encoding=UTF-8 -jar cert-compare.jar sql \
+  --config config.properties \
+  --report /app/cert-compare/reports/compare-report-20261104-213307-annotated.csv
+
+# 3. 由 DBA 备份主库后执行脚本
+cp -p /app/cert-compare/main.db /app/cert-compare/main.db.bak-$(date +%Y%m%d-%H%M%S)
+sqlite3 /app/cert-compare/main.db < /app/cert-compare/merge-20261104-213307.sql
+```
+
+`sql` 只生成脚本，不写数据库、不需要确认参数；脚本直接写入运行时的当前目录。
+
+### 合并选择规则
+
+| 类型 | 默认值 | 允许值 |
+| --- | --- | --- |
+| 主库多 | 主 | 仅主 |
+| 从库多 | 备 | 仅备 |
+| 不一致 | 空 | 主 / 备 |
+
+`sql` 生成前会重新比对并校验报表是否过期、标注是否完整；不合法时拒绝生成脚本并提示行号（退出码 5）。
+
+## 报表
+
+文件名：`compare-report-yyyyMMdd-HHmmss.csv`。
+
+列为：`序号,类型,DN,DN_HEX,CN,CERTTYPE,主库SN,从库SN,主库生效,主库失效,从库生效,从库失效,主库状态,从库状态,差异字段,合并选择`。
+
+- `合并选择` 放在最后一列，方便直接填写“主”或“备”。
+- 报表不含“备注”列；日期非法、SN/DN 为空等异常在 `compare` 控制台“提示”中输出。
+- `DN_HEX` 带 `HEX:` 前缀，避免 Excel 把长十六进制转为科学计数法。
+- 报表可用 Excel 直接编辑，另存为 UTF-8 CSV 或 GBK CSV 均可读取。
+- `sql` 只信任“合并选择”列，证书数据始终取自当前数据库。
+
+## 生成的 SQL 脚本
+
+- 文件名：`merge-yyyyMMdd-HHmmss.sql`，写入运行时当前目录，不覆盖历史脚本。
+- `ATTACH DATABASE '<从库>' AS cert_src`，按 `hex(subject)` + `certtype` 定位。
+- 从库多、不一致选备：`INSERT OR REPLACE ... SELECT`（整行复制）。
+- `dn.match=TRIM` 且主备 DN 字节不同时：`UPDATE ... SET col = (SELECT ...)`，按主库字节定位。
+- 主库多、不一致选主：不产生语句。
+- 使用 `BEGIN IMMEDIATE` / `COMMIT` 包裹，可重复执行（幂等）。
+- 末尾输出 `SELECT 'rows'` 与 `PRAGMA integrity_check` 供执行后自检。
+- 脚本为 UTF-8 无 BOM，SQL 与字符串字面量全 ASCII，DN 只以十六进制出现。
+- 兼容服务器 sqlite3 3.6.20。
+
+## 测试数据
+
+`scripts/test-data-main.sql` 与 `scripts/test-data-slave.sql` 会在原测试库中增加 3 组“不一致”数据：
+
+| DN | CERTTYPE | 差异 | 主库 | 从库 |
+| --- | --- | --- | --- | --- |
+| `CN=diff-sn-01` | 0 | SN | `0A0B0C01` | `0A0B0C11` |
+| `CN=diff-time-02` | 2 | 失效时间 | `20301231235959` | `20311231235959` |
+| `CN=diff-stat-03` | 5 | 状态 | `0` | `1` |
+
+执行前请备份：
+
+```bash
+cp -p main.db main.db.bak-$(date +%Y%m%d-%H%M%S)
+cp -p slave.db slave.db.bak-$(date +%Y%m%d-%H%M%S)
+sqlite3 main.db < scripts/test-data-main.sql
+sqlite3 slave.db < scripts/test-data-slave.sql
+```
+
+当前测试库预期结果：
+
+```text
+主库 4 条，从库 15 条
+一致 0、主库多 1、从库多 12、不一致 3
+报表 16 条
+执行脚本后主库 16 条（2 条选主、1 条选备）
+```
+
+## 部署
+
+```bash
+scp target/cert-compare.jar root@172.1.41.139:/app/cert-compare/
+scp config.properties root@172.1.41.139:/app/cert-compare/
+scp scripts/cert-compare.sh root@172.1.41.139:/app/cert-compare/
+ssh root@172.1.41.139
+cd /app/cert-compare
+chmod +x cert-compare.sh
+./cert-compare.sh
+```
+
+`cert-compare.sh` 已设置 `-Dfile.encoding=UTF-8 -Xmx256m`。
+
+## 退出码
+
+| 码 | 含义 |
+| --- | --- |
+| 0 | 成功 |
+| 1 | 未预期内部错误 |
+| 2 | 参数/配置错误 |
+| 4 | 数据库/结构/完整性错误 |
+| 5 | 报表过期、标注非法、SQL 脚本生成/写入失败 |

config.properties

@@ -0,0 +1,20 @@
+# cert-compare 运行配置（UTF-8）
+# 主库
+db.main=/app/cert-compare/main.db
+# 从库
+db.slave=/app/cert-compare/slave.db
+
+# subject/issuer 实际为 GBK/GB18030 字节
+db.text.encoding=GB18030
+
+# DN 匹配：EXACT（按原始字节）| TRIM（去除整体首尾空白）
+dn.match=EXACT
+
+# SN 归一化：HEX（大写+去前导0）| EXACT
+sn.normalize=HEX
+
+# 报表目录
+report.dir=/app/cert-compare/reports
+report.csv.bom=true
+
+# 批量 SQL 脚本直接输出到运行时的当前目录（merge-<时间戳>.sql）

pom.xml

@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.sunyard</groupId>
+    <artifactId>cert-compare</artifactId>
+    <version>1.0.0</version>
+    <packaging>jar</packaging>
+
+    <name>cert-compare</name>
+    <description>HSM main/slave usercert comparison and annotated merge tool</description>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.xerial</groupId>
+            <artifactId>sqlite-jdbc</artifactId>
+            <version>3.36.0.3</version>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.13.2</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>cert-compare</finalName>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.11.0</version>
+                <configuration>
+                    <source>1.8</source>
+                    <target>1.8</target>
+                    <encoding>UTF-8</encoding>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-shade-plugin</artifactId>
+                <version>3.5.1</version>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>shade</goal>
+                        </goals>
+                        <configuration>
+                            <createDependencyReducedPom>false</createDependencyReducedPom>
+                            <transformers>
+                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+                                    <mainClass>com.sunyard.certcompare.CertCompareApp</mainClass>
+                                </transformer>
+                                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+                            </transformers>
+                            <filters>
+                                <filter>
+                                    <artifact>*:*</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/*.SF</exclude>
+                                        <exclude>META-INF/*.DSA</exclude>
+                                        <exclude>META-INF/*.RSA</exclude>
+                                    </excludes>
+                                </filter>
+                            </filters>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>

scripts/cert-compare.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+cd "$(dirname "$0")" || exit 1
+exec java -Dfile.encoding=UTF-8 -Xmx256m -jar cert-compare.jar "$@"

scripts/test-data-main.sql

@@ -0,0 +1,27 @@
+-- 在主库中增加 3 条用于测试“不一致”的证书。
+-- 与 slave-test-data.sql 配合：同一 DN + certtype 在两边都存在，但字段不同。
+-- 执行前请备份 main.db。
+
+-- 1) SN 不一致：main=0A0B0C01 / slave=0A0B0C11
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-sn-01', issuer, '0A0B0C01', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 0, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 2) 有效期不一致：main 失效 2030 / slave 失效 2031
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-time-02', issuer, '0A0B0C02', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 2, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 3) 状态不一致：main stat=0 / slave stat=1
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-stat-03', issuer, '0A0B0C03', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 5, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;

scripts/test-data-slave.sql

@@ -0,0 +1,27 @@
+-- 在从库中增加 3 条用于测试“不一致”的证书。
+-- 与 main-test-data.sql 配合：同一 DN + certtype 在两边都存在，但字段不同。
+-- 执行前请备份 slave.db。
+
+-- 1) SN 不一致：main=0A0B0C01 / slave=0A0B0C11
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-sn-01', issuer, '0A0B0C11', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 0, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 2) 有效期不一致：main 失效 2030 / slave 失效 2031
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-time-02', issuer, '0A0B0C02', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20311231235959', certfile, 2, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 3) 状态不一致：main stat=0 / slave stat=1
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+       not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-stat-03', issuer, '0A0B0C03', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 5, opertime, 1
+FROM usercert_tab ORDER BY rowid LIMIT 1;

src/main/java/com/sunyard/certcompare/AppConfig.java

@@ -0,0 +1,198 @@
+package com.sunyard.certcompare;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Locale;
+import java.util.Properties;
+
+/**
+ * 运行配置。属性文件使用 UTF-8，相对路径相对于属性文件所在目录解析。
+ */
+public class AppConfig {
+
+    public static final String DEFAULT_TEXT_ENCODING = "GB18030";
+
+    private String mainPath;
+    private String slavePath;
+
+    private String textEncoding = DEFAULT_TEXT_ENCODING;
+    private String dnMatch = "EXACT";
+    private String snNormalize = "HEX";
+    private String reportDir = "reports";
+    private boolean csvBom = true;
+
+    private boolean debug;
+    private File configFile;
+
+    public static AppConfig load(File file, boolean debug) throws UserException {
+        AppConfig c = new AppConfig();
+        c.debug = debug;
+        if (file != null) {
+            File abs = file.getAbsoluteFile();
+            if (!abs.isFile()) {
+                throw new UserException("配置文件不存在: " + abs, 2);
+            }
+            Properties p = new Properties();
+            try (Reader r = new InputStreamReader(new FileInputStream(abs), StandardCharsets.UTF_8)) {
+                p.load(r);
+            } catch (IOException e) {
+                throw new UserException("配置文件读取失败: " + abs + " (" + e.getMessage() + ")", 2, e);
+            }
+            c.configFile = abs;
+            c.mainPath = c.resolve(trim(p.getProperty("db.main")));
+            c.slavePath = c.resolve(trim(p.getProperty("db.slave")));
+            String enc = trim(p.getProperty("db.text.encoding"));
+            if (enc != null) {
+                c.textEncoding = enc;
+            }
+            String dm = trim(p.getProperty("dn.match"));
+            if (dm != null) {
+                c.dnMatch = dm;
+            }
+            String sn = trim(p.getProperty("sn.normalize"));
+            if (sn != null) {
+                c.snNormalize = sn;
+            }
+            String rd = trim(p.getProperty("report.dir"));
+            if (rd != null) {
+                c.reportDir = rd;
+            }
+            String bom = trim(p.getProperty("report.csv.bom"));
+            if (bom != null) {
+                c.csvBom = Boolean.parseBoolean(bom);
+            }
+        }
+        c.normalize();
+        return c;
+    }
+
+    private void normalize() throws UserException {
+        try {
+            Charset.forName(textEncoding);
+        } catch (Exception e) {
+            throw new UserException("不支持的文本编码: " + textEncoding, 2);
+        }
+        dnMatch = dnMatch == null ? "EXACT" : dnMatch.toUpperCase(Locale.ROOT);
+        snNormalize = snNormalize == null ? "HEX" : snNormalize.toUpperCase(Locale.ROOT);
+        if (!"EXACT".equals(dnMatch) && !"TRIM".equals(dnMatch)) {
+            throw new UserException("dn.match 只支持 EXACT/TRIM，当前值: " + dnMatch, 2);
+        }
+        if (!"HEX".equals(snNormalize) && !"EXACT".equals(snNormalize)) {
+            throw new UserException("sn.normalize 只支持 HEX/EXACT，当前值: " + snNormalize, 2);
+        }
+        if (reportDir == null || reportDir.trim().isEmpty()) {
+            reportDir = defaultReportDir();
+        } else {
+            reportDir = resolve(reportDir);
+        }
+    }
+
+    private String defaultReportDir() {
+        return defaultDir("reports");
+    }
+
+    private String defaultDir(String name) {
+        File base = configFile != null
+                ? configFile.getParentFile()
+                : new File(System.getProperty("user.dir"));
+        return new File(base, name).getAbsolutePath();
+    }
+
+    public String resolve(String path) {
+        if (path == null) {
+            return null;
+        }
+        String t = path.trim();
+        if (t.isEmpty()) {
+            return null;
+        }
+        Path p = Paths.get(t);
+        if (!p.isAbsolute()) {
+            if (configFile != null) {
+                p = configFile.getParentFile().toPath().resolve(p);
+            } else {
+                p = Paths.get(System.getProperty("user.dir")).resolve(p);
+            }
+        }
+        return p.normalize().toAbsolutePath().toString();
+    }
+
+    public String getMainPath() {
+        return mainPath;
+    }
+
+    public void setMainPath(String mainPath) {
+        this.mainPath = new File(mainPath).getAbsolutePath();
+    }
+
+    public String getSlavePath() {
+        return slavePath;
+    }
+
+    public void setSlavePath(String slavePath) {
+        this.slavePath = new File(slavePath).getAbsolutePath();
+    }
+
+    public String getTextEncoding() {
+        return textEncoding;
+    }
+
+    public String getDnMatch() {
+        return dnMatch;
+    }
+
+    public String getSnNormalize() {
+        return snNormalize;
+    }
+
+    public boolean isHexSn() {
+        return "HEX".equals(snNormalize);
+    }
+
+    public String getReportDir() {
+        return reportDir;
+    }
+
+    public boolean isCsvBom() {
+        return csvBom;
+    }
+
+    public boolean isDebug() {
+        return debug;
+    }
+
+    public File getConfigFile() {
+        return configFile;
+    }
+
+    public Charset charset() {
+        return Charset.forName(textEncoding);
+    }
+
+    public File mainFile() {
+        return mainPath == null ? null : new File(mainPath);
+    }
+
+    public File slaveFile() {
+        return slavePath == null ? null : new File(slavePath);
+    }
+
+    public File reportDirFile() {
+        return new File(reportDir);
+    }
+
+    private static String trim(String v) {
+        if (v == null) {
+            return null;
+        }
+        String t = v.trim();
+        return t.isEmpty() ? null : t;
+    }
+}

src/main/java/com/sunyard/certcompare/CertCompareApp.java

@@ -0,0 +1,117 @@
+package com.sunyard.certcompare;
+
+import com.sunyard.certcompare.cli.Shell;
+
+import java.io.File;
+import java.io.PrintStream;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * 程序入口：交互模式与一次性命令模式。
+ */
+public class CertCompareApp {
+
+    public static void main(String[] args) {
+        int code = new CertCompareApp().run(args);
+        System.exit(code);
+    }
+
+    int run(String[] args) {
+        File config = null;
+        boolean debug = false;
+        List<String> rest = new ArrayList<>();
+
+        try {
+            for (int i = 0; i < args.length; i++) {
+                String arg = args[i];
+                if ("--config".equals(arg)) {
+                    if (++i >= args.length) {
+                        throw new UserException("--config 需要配置文件路径", 2);
+                    }
+                    config = new File(args[i]);
+                } else if ("--debug".equals(arg)) {
+                    debug = true;
+                } else if ("--help".equals(arg) || "-h".equals(arg)) {
+                    usage(System.out);
+                    return 0;
+                } else if ("--version".equals(arg)) {
+                    System.out.println("cert-compare 1.0.0");
+                    return 0;
+                } else {
+                    rest.add(arg);
+                }
+            }
+
+            if (config == null) {
+                File def = new File("config.properties");
+                if (def.isFile()) {
+                    config = def;
+                }
+            }
+
+            AppConfig cfg = AppConfig.load(config, debug);
+
+            if (rest.isEmpty()) {
+                return new Shell(cfg).run();
+            }
+
+            String command = rest.get(0).toLowerCase(Locale.ROOT);
+            if ("compare".equals(command)) {
+                if (rest.size() > 1) {
+                    throw new UserException("compare 不接受参数；所有差异都会写入同一份报表", 2);
+                }
+                Operations.runCompare(cfg, System.out);
+                return 0;
+            }
+            if ("sql".equals(command)) {
+                return runSql(cfg, rest);
+            }
+            usage(System.err);
+            return 2;
+        } catch (UserException e) {
+            System.err.println("[错误] " + e.getMessage());
+            if (debug) {
+                e.printStackTrace();
+            }
+            return e.getExitCode();
+        } catch (Exception e) {
+            System.err.println("[内部错误] " + e.getMessage());
+            if (debug) {
+                e.printStackTrace();
+            }
+            return 1;
+        }
+    }
+
+    private int runSql(AppConfig cfg, List<String> rest) throws UserException {
+        File report = null;
+        for (int i = 1; i < rest.size(); i++) {
+            String arg = rest.get(i);
+            if ("--report".equals(arg)) {
+                if (++i >= rest.size()) {
+                    throw new UserException("--report 需要报表路径", 2);
+                }
+                report = new File(rest.get(i));
+            } else {
+                throw new UserException("未知参数: " + arg, 2);
+            }
+        }
+
+        File resolved = Operations.resolveReport(cfg, report, null);
+        Operations.runSql(cfg, resolved, System.out);
+        return 0;
+    }
+
+    private static void usage(PrintStream out) {
+        out.println("用法:");
+        out.println("  java -jar cert-compare.jar [--config <file>] [--debug]");
+        out.println("  java -jar cert-compare.jar compare [--config <file>]");
+        out.println("  java -jar cert-compare.jar sql [--config <file>] [--report <csv>]");
+        out.println();
+        out.println("交互命令: set main|slave <path> / status / compare / sql / help / quit");
+        out.println("说明: compare 生成一份 CSV 报表；人工填写“合并选择”（主/备）后执行 sql，");
+        out.println("      在当前目录生成批量 SQL 脚本，由 DBA 在主库执行完成合并。");
+    }
+}

src/main/java/com/sunyard/certcompare/Operations.java

@@ -0,0 +1,128 @@
+package com.sunyard.certcompare;
+
+import com.sunyard.certcompare.compare.CompareService;
+import com.sunyard.certcompare.model.CertKey;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.MergeChoice;
+import com.sunyard.certcompare.report.ReportData;
+import com.sunyard.certcompare.report.ReportReader;
+import com.sunyard.certcompare.report.ReportValidator;
+import com.sunyard.certcompare.report.ReportWriter;
+import com.sunyard.certcompare.sql.SqlPlan;
+import com.sunyard.certcompare.sql.SqlScriptService;
+
+import java.io.File;
+import java.io.PrintStream;
+import java.util.Map;
+
+/**
+ * compare / sql 的共用流程，交互模式与一次性模式都调用这里。
+ */
+public final class Operations {
+
+    private Operations() {
+    }
+
+    public static void requireMainSlave(AppConfig cfg) throws UserException {
+        if (cfg.getMainPath() == null) {
+            throw new UserException("未设置主库路径（set main 或 db.main）", 2);
+        }
+        if (cfg.getSlavePath() == null) {
+            throw new UserException("未设置从库路径（set slave 或 db.slave）", 2);
+        }
+        if (!cfg.mainFile().isFile()) {
+            throw new UserException("主库文件不存在: " + cfg.getMainPath(), 2);
+        }
+        if (!cfg.slaveFile().isFile()) {
+            throw new UserException("从库文件不存在: " + cfg.getSlavePath(), 2);
+        }
+    }
+
+    public static File runCompare(AppConfig cfg, PrintStream out) throws UserException {
+        requireMainSlave(cfg);
+        CompareResult result = new CompareService().compare(cfg);
+        File report = new ReportWriter().write(cfg, result);
+        printCompare(cfg, result, report, out);
+        return report;
+    }
+
+    public static SqlPlan runSql(AppConfig cfg, File report, PrintStream out) throws UserException {
+        requireMainSlave(cfg);
+        if (report == null || !report.isFile()) {
+            throw new UserException("报表不存在: " + (report == null ? "" : report.getAbsolutePath()), 5);
+        }
+        CompareResult result = new CompareService().compare(cfg);
+        ReportData data = new ReportReader().read(report);
+        Map<CertKey, MergeChoice> choices = ReportValidator.validate(result, data);
+        SqlPlan plan = new SqlScriptService(cfg).generate(result, choices);
+        out.println();
+        plan.print(out);
+        printSqlInstructions(plan, out);
+        return plan;
+    }
+
+    public static File resolveReport(AppConfig cfg, File explicit, File last) throws UserException {
+        if (explicit != null) {
+            if (!explicit.isFile()) {
+                throw new UserException("报表不存在: " + explicit.getAbsolutePath(), 5);
+            }
+            return explicit.getAbsoluteFile();
+        }
+        if (last != null && last.isFile()) {
+            return last;
+        }
+        File dir = cfg.reportDirFile();
+        File newest = null;
+        File[] files = dir.listFiles();
+        if (files != null) {
+            for (File f : files) {
+                String name = f.getName();
+                if (f.isFile() && name.startsWith("compare-report-") && name.endsWith(".csv")) {
+                    if (newest == null || f.lastModified() > newest.lastModified()) {
+                        newest = f;
+                    }
+                }
+            }
+        }
+        if (newest == null) {
+            throw new UserException("未找到报表，请先执行 compare 或使用 --report 指定", 5);
+        }
+        return newest;
+    }
+
+    public static void printCompare(AppConfig cfg, CompareResult result, File report, PrintStream out) {
+        out.println();
+        out.printf("主库: %s    证书数: %d%n", cfg.getMainPath(), result.mainCount);
+        out.printf("从库: %s    证书数: %d%n", cfg.getSlavePath(), result.slaveCount);
+        out.println();
+        out.println("汇总:");
+        out.printf("  一致        %d%n", result.equalCount);
+        out.printf("  主库多      %d%n", result.onlyMain.size());
+        out.printf("  从库多      %d%n", result.onlySlave.size());
+        out.printf("  不一致      %d%n", result.diff.size());
+        out.printf("  差异合计    %d%n", result.differenceCount());
+        if (!result.warnings.isEmpty()) {
+            out.println();
+            out.println("提示:");
+            for (String warning : result.warnings) {
+                out.println("  " + warning);
+            }
+        }
+        out.println();
+        out.println("报表:");
+        out.println("  " + report.getAbsolutePath());
+        out.println();
+        out.println("请按“合并选择”列标注：主 或 备，然后执行 sql 生成批量脚本。");
+    }
+
+    private static void printSqlInstructions(SqlPlan plan, PrintStream out) {
+        String main = plan.mainFile.getAbsolutePath();
+        out.println();
+        out.println("请在主库上执行（执行前先备份）：");
+        out.printf("  cp -p %s %s.bak-$(date +%%Y%%m%%d-%%H%%M%%S)%n", main, main);
+        out.printf("  sqlite3 %s < %s%n", main, plan.sqlFile.getAbsolutePath());
+        out.println();
+        out.printf("执行后主库记录数应为 %d 条；脚本末尾会输出 rows 与 integrity_check 结果。%n",
+                plan.expectedCount);
+    }
+}

src/main/java/com/sunyard/certcompare/UserException.java

@@ -0,0 +1,28 @@
+package com.sunyard.certcompare;
+
+/**
+ * 可预期的用户错误。携带进程退出码，CLI 直接使用。
+ */
+public class UserException extends Exception {
+    private static final long serialVersionUID = 1L;
+
+    private final int exitCode;
+
+    public UserException(String message) {
+        this(message, 1);
+    }
+
+    public UserException(String message, int exitCode) {
+        super(message);
+        this.exitCode = exitCode;
+    }
+
+    public UserException(String message, int exitCode, Throwable cause) {
+        super(message, cause);
+        this.exitCode = exitCode;
+    }
+
+    public int getExitCode() {
+        return exitCode;
+    }
+}

src/main/java/com/sunyard/certcompare/cli/CommandTokenizer.java

@@ -0,0 +1,70 @@
+package com.sunyard.certcompare.cli;
+
+import com.sunyard.certcompare.UserException;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * 引号感知的命令行分词。
+ */
+public final class CommandTokenizer {
+
+    private CommandTokenizer() {
+    }
+
+    public static List<String> tokenize(String line) throws UserException {
+        List<String> tokens = new ArrayList<>();
+        if (line == null) {
+            return tokens;
+        }
+        StringBuilder cur = null;
+        boolean inSingle = false;
+        boolean inDouble = false;
+        for (int i = 0; i < line.length(); i++) {
+            char c = line.charAt(i);
+            if (inSingle) {
+                if (c == '\'') {
+                    inSingle = false;
+                } else {
+                    cur.append(c);
+                }
+            } else if (inDouble) {
+                if (c == '"') {
+                    inDouble = false;
+                } else if (c == '\\' && i + 1 < line.length()) {
+                    cur.append(line.charAt(++i));
+                } else {
+                    cur.append(c);
+                }
+            } else if (c == '\'') {
+                if (cur == null) {
+                    cur = new StringBuilder();
+                }
+                inSingle = true;
+            } else if (c == '"') {
+                if (cur == null) {
+                    cur = new StringBuilder();
+                }
+                inDouble = true;
+            } else if (Character.isWhitespace(c)) {
+                if (cur != null) {
+                    tokens.add(cur.toString());
+                    cur = null;
+                }
+            } else {
+                if (cur == null) {
+                    cur = new StringBuilder();
+                }
+                cur.append(c);
+            }
+        }
+        if (inSingle || inDouble) {
+            throw new UserException("引号未闭合", 2);
+        }
+        if (cur != null) {
+            tokens.add(cur.toString());
+        }
+        return tokens;
+    }
+}

src/main/java/com/sunyard/certcompare/cli/Shell.java

@@ -0,0 +1,282 @@
+package com.sunyard.certcompare.cli;
+
+import com.sunyard.certcompare.AppConfig;
+import com.sunyard.certcompare.Operations;
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.db.DbManager;
+import com.sunyard.certcompare.sql.SqlPlan;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * 交互式 Shell。
+ */
+public class Shell {
+
+    private final AppConfig cfg;
+    private final BufferedReader reader;
+    private final PrintStream out;
+    private final PrintStream err;
+
+    private File lastReport;
+    private SqlPlan lastSql;
+
+    public Shell(AppConfig cfg) {
+        this(cfg, System.in, System.out, System.err);
+    }
+
+    public Shell(AppConfig cfg, InputStream in, PrintStream out, PrintStream err) {
+        this.cfg = cfg;
+        this.reader = new BufferedReader(new InputStreamReader(in, StandardCharsets.UTF_8));
+        this.out = out;
+        this.err = err;
+    }
+
+    public int run() {
+        boolean tty = System.console() != null;
+        if (tty) {
+            out.println("HSM 主备证书比对工具（cert-compare 1.0.0）");
+            out.println("输入 help 查看命令，quit 退出。");
+        }
+        while (true) {
+            if (tty) {
+                out.print("cert-compare> ");
+                out.flush();
+            }
+            String line;
+            try {
+                line = reader.readLine();
+            } catch (IOException e) {
+                err.println("[错误] 读取输入失败: " + e.getMessage());
+                return 1;
+            }
+            if (line == null) {
+                break;
+            }
+            if (line.trim().isEmpty()) {
+                continue;
+            }
+            boolean keepGoing;
+            try {
+                keepGoing = handle(line);
+            } catch (UserException e) {
+                err.println("[错误] " + e.getMessage());
+                if (cfg.isDebug()) {
+                    e.printStackTrace(err);
+                }
+                keepGoing = true;
+            } catch (Exception e) {
+                err.println("[内部错误] " + e.getMessage());
+                if (cfg.isDebug()) {
+                    e.printStackTrace(err);
+                }
+                keepGoing = true;
+            }
+            if (!keepGoing) {
+                break;
+            }
+        }
+        return 0;
+    }
+
+    private boolean handle(String line) throws UserException {
+        List<String> tokens = CommandTokenizer.tokenize(line);
+        if (tokens.isEmpty()) {
+            return true;
+        }
+        String cmd = tokens.get(0).toLowerCase(Locale.ROOT);
+        switch (cmd) {
+            case "quit":
+            case "exit":
+                return false;
+            case "help":
+                help(tokens.size() > 1 ? tokens.get(1).toLowerCase(Locale.ROOT) : null);
+                return true;
+            case "set":
+                set(tokens);
+                return true;
+            case "status":
+                status();
+                return true;
+            case "compare":
+                doCompare(tokens);
+                return true;
+            case "sql":
+                doSql(tokens);
+                return true;
+            default:
+                err.println("[错误] 未知命令: " + cmd + "，输入 help 查看可用命令。");
+                return true;
+        }
+    }
+
+    private void set(List<String> tokens) throws UserException {
+        if (tokens.size() < 2) {
+            throw new UserException("用法: set main|slave [path]", 2);
+        }
+        String what = tokens.get(1).toLowerCase(Locale.ROOT);
+        if (!"main".equals(what) && !"slave".equals(what)) {
+            throw new UserException("set 只支持 main / slave", 2);
+        }
+        if (tokens.size() == 2) {
+            showSetting(what);
+            return;
+        }
+        String path = String.join(" ", tokens.subList(2, tokens.size()));
+        setDb(what, new File(path).getAbsoluteFile());
+    }
+
+    private void showSetting(String what) {
+        if ("main".equals(what)) {
+            printDb("主库", cfg.mainFile());
+        } else {
+            printDb("从库", cfg.slaveFile());
+        }
+    }
+
+    private void setDb(String what, File file) throws UserException {
+        long count = DbManager.validateAndCount(file);
+        String label;
+        if ("main".equals(what)) {
+            cfg.setMainPath(file.getPath());
+            label = "主库";
+        } else {
+            cfg.setSlavePath(file.getPath());
+            label = "从库";
+        }
+        out.printf("[OK] %s: %s (%,d 字节, %d 张证书)%n",
+                label, file.getAbsolutePath(), file.length(), count);
+    }
+
+    private void doCompare(List<String> tokens) throws UserException {
+        if (tokens.size() > 1) {
+            throw new UserException("compare 不接受参数；所有差异都会写入同一份报表", 2);
+        }
+        lastReport = Operations.runCompare(cfg, out);
+    }
+
+    private void doSql(List<String> tokens) throws UserException {
+        File explicit = null;
+        for (int i = 1; i < tokens.size(); i++) {
+            String arg = tokens.get(i);
+            if ("--report".equals(arg)) {
+                if (i + 1 >= tokens.size()) {
+                    throw new UserException("--report 需要报表路径", 2);
+                }
+                explicit = new File(tokens.get(++i));
+            } else {
+                throw new UserException("未知参数: " + arg, 2);
+            }
+        }
+        File report = Operations.resolveReport(cfg, explicit, lastReport);
+        lastSql = Operations.runSql(cfg, report, out);
+    }
+
+    private void status() {
+        out.println("当前状态:");
+        printDb("主库", cfg.mainFile());
+        printDb("从库", cfg.slaveFile());
+        out.println("SQL 输出: " + System.getProperty("user.dir"));
+        out.printf("编码: %s    DN 匹配: %s    SN 归一化: %s%n",
+                cfg.getTextEncoding(), cfg.getDnMatch(), cfg.getSnNormalize());
+        out.println("主从表结构: " + schemaCompatibility());
+        out.println("最近报表: " + (lastReport == null ? "无" : lastReport.getAbsolutePath()));
+        if (lastSql == null) {
+            out.println("最近 SQL: 无");
+        } else {
+            out.println("最近 SQL: " + lastSql.sqlFile.getAbsolutePath());
+        }
+    }
+
+    private void printDb(String label, File file) {
+        if (file == null) {
+            out.printf("  %-6s 未设置%n", label);
+            return;
+        }
+        String path = file.getAbsolutePath();
+        if (!file.exists()) {
+            out.printf("  %-6s %s（不存在）%n", label, path);
+            return;
+        }
+        long count = -1;
+        try (Connection c = DbManager.open(file.getPath(), true)) {
+            if (DbManager.tableExists(c, "usercert_tab")) {
+                count = DbManager.count(c);
+            }
+        } catch (SQLException ignored) {
+            // 仅展示大小
+        }
+        out.printf("  %-6s %s（%,d 字节%s）%n", label, path, file.length(),
+                count >= 0 ? ", " + count + " 张证书" : "");
+    }
+
+    private String schemaCompatibility() {
+        if (cfg.getMainPath() == null || cfg.getSlavePath() == null) {
+            return "未设置";
+        }
+        try (Connection main = DbManager.open(cfg.getMainPath(), true);
+             Connection slave = DbManager.open(cfg.getSlavePath(), true)) {
+            if (!DbManager.tableExists(main, "usercert_tab")
+                    || !DbManager.tableExists(slave, "usercert_tab")) {
+                return "缺少 usercert_tab";
+            }
+            return DbManager.columns(main).equals(DbManager.columns(slave)) ? "一致" : "不一致";
+        } catch (SQLException e) {
+            return "检查失败: " + e.getMessage();
+        }
+    }
+
+    private void help(String command) {
+        if (command == null) {
+            out.println("可用命令:");
+            out.println("  set main|slave [path]     设置/查看主库、从库");
+            out.println("  status                    查看当前状态");
+            out.println("  compare                   生成差异报表（主库多 / 从库多 / 不一致）");
+            out.println("  sql [--report <path>]     读取标注后的报表，生成批量 SQL 脚本");
+            out.println("  help [command]            帮助");
+            out.println("  quit | exit               退出");
+            out.println();
+            out.println("示例:");
+            out.println("  set main /app/cert-compare/main.db");
+            out.println("  set slave /app/cert-compare/slave.db");
+            out.println("  compare");
+            out.println("  sql --report /app/cert-compare/reports/compare-report-20261103-205500.csv");
+            out.println("  然后在主库上执行当前目录下生成的 merge-<时间戳>.sql");
+            return;
+        }
+        switch (command) {
+            case "set":
+                out.println("set main <path>    设置主库");
+                out.println("set slave <path>   设置从库");
+                out.println("无参数时显示当前设置。");
+                break;
+            case "compare":
+                out.println("compare");
+                out.println("  比对主库和从库，生成一份 CSV 报表，只打印汇总统计。");
+                out.println("  报表中“合并选择”列由人工填写：主 或 备。");
+                break;
+            case "sql":
+                out.println("sql [--report <path>]");
+                out.println("  读取已标注报表，校验后生成在主库上执行的批量 SQL 脚本。");
+                out.println("  --report   指定报表；缺省使用最近一次 compare 的报表");
+                out.println("  脚本生成到当前目录：merge-<时间戳>.sql。");
+                break;
+            case "status":
+                out.println("status");
+                out.println("  显示主库、从库、当前工作目录、表结构兼容性。");
+                break;
+            default:
+                out.println("未知命令: " + command + "，输入 help 查看可用命令。");
+        }
+    }
+}

src/main/java/com/sunyard/certcompare/compare/CompareService.java

@@ -0,0 +1,206 @@
+package com.sunyard.certcompare.compare;
+
+import com.sunyard.certcompare.AppConfig;
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.db.DbManager;
+import com.sunyard.certcompare.model.CertKey;
+import com.sunyard.certcompare.model.CertRecord;
+import com.sunyard.certcompare.model.CompareCategory;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.CompareRow;
+import com.sunyard.certcompare.model.FieldDiff;
+import com.sunyard.certcompare.model.MergeChoice;
+import com.sunyard.certcompare.util.DateUtil;
+import com.sunyard.certcompare.util.SnNormalizer;
+import com.sunyard.certcompare.util.Text;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+
+/**
+ * 主备库比对引擎。以 (subject 原始字节, certtype) 为身份键。
+ */
+public class CompareService {
+
+    public CompareResult compare(AppConfig cfg) throws UserException {
+        File main = cfg.mainFile();
+        File slave = cfg.slaveFile();
+        if (main == null || slave == null) {
+            throw new UserException("请先设置主库和从库路径（set main / set slave）", 2);
+        }
+        DbManager.validateFile(main);
+        DbManager.validateFile(slave);
+
+        try (Connection cm = DbManager.open(main.getPath(), true);
+             Connection cs = DbManager.open(slave.getPath(), true)) {
+            DbManager.validateSchema(cm);
+            DbManager.validateSchema(cs);
+            List<CertRecord> mainRecords = DbManager.readAll(cm);
+            List<CertRecord> slaveRecords = DbManager.readAll(cs);
+            return compareRecords(cfg, mainRecords, slaveRecords);
+        } catch (SQLException e) {
+            throw new UserException("读取数据库失败: " + e.getMessage(), 4, e);
+        }
+    }
+
+    private CompareResult compareRecords(AppConfig cfg, List<CertRecord> mainRecords,
+                                         List<CertRecord> slaveRecords) throws UserException {
+        boolean trim = "TRIM".equals(cfg.getDnMatch());
+        List<String> warnings = new ArrayList<>();
+
+        Map<CertKey, CertRecord> mainMap = index(mainRecords, trim, "主库", warnings);
+        Map<CertKey, CertRecord> slaveMap = index(slaveRecords, trim, "从库", warnings);
+
+        Map<CertKey, List<String>> notes = new HashMap<>();
+        collectDataIssues(mainRecords, trim, "主库", cfg.isHexSn(), notes, warnings);
+        collectDataIssues(slaveRecords, trim, "从库", cfg.isHexSn(), notes, warnings);
+
+        Set<CertKey> keys = new TreeSet<>();
+        keys.addAll(mainMap.keySet());
+        keys.addAll(slaveMap.keySet());
+
+        Charset charset = cfg.charset();
+        List<CompareRow> onlyMain = new ArrayList<>();
+        List<CompareRow> onlySlave = new ArrayList<>();
+        List<CompareRow> diff = new ArrayList<>();
+        int equalCount = 0;
+
+        for (CertKey key : keys) {
+            CertRecord m = mainMap.get(key);
+            CertRecord s = slaveMap.get(key);
+            if (m != null && s == null) {
+                List<String> rowNotes = new ArrayList<>(notesOf(notes, key));
+                rowNotes.add("仅主库存在");
+                onlyMain.add(new CompareRow(CompareCategory.ONLY_MAIN, key, m, null,
+                        Collections.<FieldDiff>emptyList(), rowNotes, MergeChoice.MAIN.label, decodeDn(m.subjectHex, charset)));
+            } else if (m == null && s != null) {
+                List<String> rowNotes = new ArrayList<>(notesOf(notes, key));
+                rowNotes.add("仅从库存在");
+                onlySlave.add(new CompareRow(CompareCategory.ONLY_SLAVE, key, null, s,
+                        Collections.<FieldDiff>emptyList(), rowNotes, MergeChoice.SLAVE.label, decodeDn(s.subjectHex, charset)));
+            } else {
+                List<FieldDiff> diffs = diffFields(cfg, m, s);
+                if (diffs.isEmpty()) {
+                    equalCount++;
+                } else {
+                    List<String> rowNotes = new ArrayList<>(notesOf(notes, key));
+                    rowNotes.add("需人工选择");
+                    diff.add(new CompareRow(CompareCategory.DIFF, key, m, s, diffs, rowNotes, "",
+                            decodeDn(m.subjectHex, charset)));
+                }
+            }
+        }
+
+        return new CompareResult(mainRecords.size(), slaveRecords.size(), equalCount,
+                onlyMain, onlySlave, diff, warnings);
+    }
+
+    private Map<CertKey, CertRecord> index(List<CertRecord> records, boolean trim,
+                                           String side, List<String> warnings) throws UserException {
+        Map<CertKey, CertRecord> map = new LinkedHashMap<>();
+        for (CertRecord record : records) {
+            CertKey key = new CertKey(CertKey.normalizeSubjectHex(record.subjectHex, trim), record.certtype);
+            CertRecord previous = map.put(key, record);
+            if (previous != null) {
+                throw new UserException(side + "存在重复身份键（规范化后）: " + key
+                        + "，请将 dn.match 设置为 EXACT 后重试", 4);
+            }
+        }
+        return map;
+    }
+
+    private void collectDataIssues(List<CertRecord> records, boolean trim, String side,
+                                   boolean hexSn, Map<CertKey, List<String>> notes,
+                                   List<String> warnings) {
+        Map<String, Integer> snCounts = new LinkedHashMap<>();
+        for (CertRecord r : records) {
+            String sn = SnNormalizer.normalize(r.sn, hexSn);
+            if (!sn.isEmpty()) {
+                snCounts.put(sn, snCounts.getOrDefault(sn, 0) + 1);
+            }
+        }
+        for (Map.Entry<String, Integer> e : snCounts.entrySet()) {
+            if (e.getValue() > 1) {
+                warnings.add(side + "存在重复 SN: " + e.getKey() + "（" + e.getValue() + " 条）");
+            }
+        }
+
+        for (CertRecord r : records) {
+            CertKey key = new CertKey(CertKey.normalizeSubjectHex(r.subjectHex, trim), r.certtype);
+            List<String> rowNotes = notes.computeIfAbsent(key, k -> new ArrayList<>());
+            String where = side + " HEX:" + key.subjectHex + " CERTTYPE=" + key.certtype + " ";
+            if (!DateUtil.isValid(r.notBefore) || !DateUtil.isValid(r.notAfter)) {
+                addOnce(rowNotes, side + "日期格式非法");
+                addOnce(warnings, where + "日期格式非法");
+            } else if (!DateUtil.beforeOrEqual(r.notBefore, r.notAfter)) {
+                addOnce(rowNotes, side + "有效期倒置");
+                addOnce(warnings, where + "有效期倒置");
+            }
+            String sn = SnNormalizer.normalize(r.sn, hexSn);
+            if (snCounts.getOrDefault(sn, 0) > 1) {
+                addOnce(rowNotes, side + "SN重复:" + sn);
+            }
+            if (sn.isEmpty()) {
+                addOnce(rowNotes, side + "SN为空");
+                addOnce(warnings, where + "SN为空");
+            }
+            if (r.subjectHex.isEmpty()) {
+                addOnce(rowNotes, side + "DN为空");
+                addOnce(warnings, where + "DN为空");
+            }
+        }
+    }
+
+    private List<FieldDiff> diffFields(AppConfig cfg, CertRecord m, CertRecord s) {
+        List<FieldDiff> diffs = new ArrayList<>();
+        String mainSn = SnNormalizer.normalize(m.sn, cfg.isHexSn());
+        String slaveSn = SnNormalizer.normalize(s.sn, cfg.isHexSn());
+        if (!Objects.equals(mainSn, slaveSn)) {
+            diffs.add(new FieldDiff("sn", m.sn, s.sn));
+        }
+        if (!Objects.equals(m.issuerHex, s.issuerHex)) {
+            diffs.add(new FieldDiff("issuer", m.issuerHex, s.issuerHex));
+        }
+        if (!Objects.equals(m.notBefore, s.notBefore)) {
+            diffs.add(new FieldDiff("not_before", m.notBefore, s.notBefore));
+        }
+        if (!Objects.equals(m.notAfter, s.notAfter)) {
+            diffs.add(new FieldDiff("not_after", m.notAfter, s.notAfter));
+        }
+        if (m.stat != s.stat) {
+            diffs.add(new FieldDiff("stat", String.valueOf(m.stat), String.valueOf(s.stat)));
+        }
+        return diffs;
+    }
+
+    private static List<String> notesOf(Map<CertKey, List<String>> notes, CertKey key) {
+        List<String> list = notes.get(key);
+        return list == null ? Collections.<String>emptyList() : list;
+    }
+
+    private static void addOnce(List<String> list, String value) {
+        if (!list.contains(value)) {
+            list.add(value);
+        }
+    }
+
+    private static String decodeDn(String hex, Charset charset) {
+        try {
+            return Text.decode(Text.hexToBytes(hex), charset);
+        } catch (RuntimeException e) {
+            return "HEX:" + hex;
+        }
+    }
+}

src/main/java/com/sunyard/certcompare/db/DbManager.java

@@ -0,0 +1,190 @@
+package com.sunyard.certcompare.db;
+
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.model.CertRecord;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * SQLite 连接、结构校验、投影读取与 SQL 字面量工具。
+ */
+public final class DbManager {
+
+    public static final List<String> REQUIRED_COLUMNS = Collections.unmodifiableList(Arrays.asList(
+            "organid", "subject", "issuer", "sn", "pubkey_alg", "pubkey", "sign_alg", "signinfo",
+            "not_before", "not_after", "certfile", "certtype", "opertime", "stat"));
+
+    public static final List<String> COPY_COLUMNS = Collections.unmodifiableList(Arrays.asList(
+            "organid", "subject", "issuer", "sn", "pubkey_alg", "pubkey", "sign_alg", "signinfo",
+            "not_before", "not_after", "certfile", "certtype", "opertime", "stat"));
+
+    private static final byte[] SQLITE_HEADER =
+            "SQLite format 3\u0000".getBytes(StandardCharsets.US_ASCII);
+
+    private DbManager() {
+    }
+
+    static {
+        try {
+            Class.forName("org.sqlite.JDBC");
+        } catch (ClassNotFoundException ignored) {
+            // sqlite-jdbc 通过 ServiceLoader 注册时也成立
+        }
+    }
+
+    public static Connection open(String path, boolean queryOnly) throws SQLException {
+        File file = new File(path).getAbsoluteFile();
+        Connection c = DriverManager.getConnection("jdbc:sqlite:" + file.getPath());
+        try (Statement st = c.createStatement()) {
+            st.execute("PRAGMA busy_timeout = 5000");
+            if (queryOnly) {
+                st.execute("PRAGMA query_only = ON");
+            }
+        }
+        return c;
+    }
+
+    public static void validateFile(File file) throws UserException {
+        if (file == null) {
+            throw new UserException("路径未设置", 2);
+        }
+        if (!file.exists()) {
+            throw new UserException("文件不存在: " + file.getAbsolutePath(), 2);
+        }
+        if (!file.isFile()) {
+            throw new UserException("不是普通文件: " + file.getAbsolutePath(), 2);
+        }
+        if (!file.canRead()) {
+            throw new UserException("文件不可读: " + file.getAbsolutePath(), 2);
+        }
+        if (file.length() < 16) {
+            throw new UserException("不是有效的 SQLite 文件: " + file.getAbsolutePath(), 4);
+        }
+        byte[] head = new byte[16];
+        try (InputStream in = new FileInputStream(file)) {
+            int n = in.read(head);
+            if (n < 16) {
+                throw new UserException("不是有效的 SQLite 文件: " + file.getAbsolutePath(), 4);
+            }
+        } catch (IOException e) {
+            throw new UserException("文件读取失败: " + file.getAbsolutePath() + " (" + e.getMessage() + ")", 2, e);
+        }
+        if (!Arrays.equals(head, SQLITE_HEADER)) {
+            throw new UserException("不是有效的 SQLite 文件: " + file.getAbsolutePath(), 4);
+        }
+    }
+
+    public static long validateAndCount(File file) throws UserException {
+        validateFile(file);
+        try (Connection c = open(file.getPath(), true)) {
+            validateSchema(c);
+            return count(c);
+        } catch (SQLException e) {
+            throw new UserException("数据库打开失败: " + file.getAbsolutePath() + " (" + e.getMessage() + ")", 4, e);
+        }
+    }
+
+    public static boolean tableExists(Connection c, String table) throws SQLException {
+        String sql = "SELECT name FROM sqlite_master WHERE type='table' AND name=?";
+        try (PreparedStatement ps = c.prepareStatement(sql)) {
+            ps.setString(1, table);
+            try (ResultSet rs = ps.executeQuery()) {
+                return rs.next();
+            }
+        }
+    }
+
+    public static List<String> columns(Connection c) throws SQLException {
+        List<String> cols = new ArrayList<>();
+        try (Statement st = c.createStatement();
+             ResultSet rs = st.executeQuery("PRAGMA table_info(usercert_tab)")) {
+            while (rs.next()) {
+                cols.add(rs.getString("name").toLowerCase(Locale.ROOT));
+            }
+        }
+        return cols;
+    }
+
+    public static void validateSchema(Connection c) throws SQLException, UserException {
+        if (!tableExists(c, "usercert_tab")) {
+            throw new UserException("数据库缺少表 usercert_tab", 4);
+        }
+        List<String> cols = columns(c);
+        List<String> missing = new ArrayList<>();
+        for (String required : REQUIRED_COLUMNS) {
+            if (!cols.contains(required)) {
+                missing.add(required);
+            }
+        }
+        if (!missing.isEmpty()) {
+            throw new UserException("usercert_tab 缺少必需字段: " + missing, 4);
+        }
+    }
+
+    public static long count(Connection c) throws SQLException {
+        try (Statement st = c.createStatement();
+             ResultSet rs = st.executeQuery("SELECT count(*) FROM usercert_tab")) {
+            return rs.next() ? rs.getLong(1) : 0L;
+        }
+    }
+
+    /**
+     * 只读取比较所需字段，subject/issuer 使用 hex() 获取原始字节，绝不使用 getString()。
+     */
+    public static List<CertRecord> readAll(Connection c) throws SQLException {
+        String sql = "SELECT hex(subject) AS subject_hex, hex(issuer) AS issuer_hex, "
+                + "sn, not_before, not_after, certtype, stat FROM usercert_tab";
+        List<CertRecord> list = new ArrayList<>();
+        try (Statement st = c.createStatement();
+             ResultSet rs = st.executeQuery(sql)) {
+            while (rs.next()) {
+                list.add(new CertRecord(
+                        nullToEmpty(rs.getString("subject_hex")),
+                        nullToEmpty(rs.getString("issuer_hex")),
+                        nullToEmpty(rs.getString("sn")),
+                        nullToEmpty(rs.getString("not_before")),
+                        nullToEmpty(rs.getString("not_after")),
+                        rs.getInt("certtype"),
+                        rs.getInt("stat")));
+            }
+        }
+        return list;
+    }
+
+    public static String sqlString(String value) {
+        return "'" + value.replace("'", "''") + "'";
+    }
+
+    public static String joinCopyColumns(String alias) {
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < COPY_COLUMNS.size(); i++) {
+            if (i > 0) {
+                sb.append(", ");
+            }
+            if (alias != null && !alias.isEmpty()) {
+                sb.append(alias).append('.');
+            }
+            sb.append(COPY_COLUMNS.get(i));
+        }
+        return sb.toString();
+    }
+
+    private static String nullToEmpty(String v) {
+        return v == null ? "" : v;
+    }
+}

src/main/java/com/sunyard/certcompare/model/CertKey.java

@@ -0,0 +1,76 @@
+package com.sunyard.certcompare.model;
+
+import java.util.Locale;
+
+/**
+ * 证书身份键：subject 原始字节十六进制 + certtype。
+ */
+public final class CertKey implements Comparable<CertKey> {
+
+    public final String subjectHex;
+    public final int certtype;
+
+    public CertKey(String subjectHex, int certtype) {
+        this.subjectHex = subjectHex == null ? "" : subjectHex.trim().toUpperCase(Locale.ROOT);
+        this.certtype = certtype;
+    }
+
+    /**
+     * 计算身份键使用的 subject 十六进制。TRIM 模式仅去除整体首尾的 ASCII 空白字节。
+     */
+    public static String normalizeSubjectHex(String rawHex, boolean trim) {
+        if (rawHex == null) {
+            return "";
+        }
+        String s = rawHex.trim().toUpperCase(Locale.ROOT);
+        if (!trim) {
+            return s;
+        }
+        int start = 0;
+        int end = s.length();
+        while (start + 2 <= end && isAsciiWhitespaceHex(s, start)) {
+            start += 2;
+        }
+        while (end - 2 >= start && isAsciiWhitespaceHex(s, end - 2)) {
+            end -= 2;
+        }
+        return s.substring(start, end);
+    }
+
+    private static boolean isAsciiWhitespaceHex(String s, int offset) {
+        String b = s.substring(offset, offset + 2);
+        return "20".equals(b) || "09".equals(b) || "0A".equals(b)
+                || "0D".equals(b) || "0B".equals(b) || "0C".equals(b);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof CertKey)) {
+            return false;
+        }
+        CertKey other = (CertKey) o;
+        return certtype == other.certtype && subjectHex.equals(other.subjectHex);
+    }
+
+    @Override
+    public int hashCode() {
+        return 31 * subjectHex.hashCode() + certtype;
+    }
+
+    @Override
+    public int compareTo(CertKey o) {
+        int c = subjectHex.compareTo(o.subjectHex);
+        if (c != 0) {
+            return c;
+        }
+        return Integer.compare(certtype, o.certtype);
+    }
+
+    @Override
+    public String toString() {
+        return "HEX:" + subjectHex + "|" + certtype;
+    }
+}

src/main/java/com/sunyard/certcompare/model/CertRecord.java

@@ -0,0 +1,30 @@
+package com.sunyard.certcompare.model;
+
+/**
+ * 从 usercert_tab 读取的一条投影记录。DN/issuer 只保留十六进制原始字节。
+ */
+public class CertRecord {
+
+    public final String subjectHex;
+    public final String issuerHex;
+    public final String sn;
+    public final String notBefore;
+    public final String notAfter;
+    public final int certtype;
+    public final int stat;
+
+    public CertRecord(String subjectHex, String issuerHex, String sn,
+                      String notBefore, String notAfter, int certtype, int stat) {
+        this.subjectHex = subjectHex == null ? "" : subjectHex;
+        this.issuerHex = issuerHex == null ? "" : issuerHex;
+        this.sn = sn == null ? "" : sn;
+        this.notBefore = notBefore == null ? "" : notBefore;
+        this.notAfter = notAfter == null ? "" : notAfter;
+        this.certtype = certtype;
+        this.stat = stat;
+    }
+
+    public CertKey key() {
+        return new CertKey(subjectHex, certtype);
+    }
+}

src/main/java/com/sunyard/certcompare/model/CompareCategory.java

@@ -0,0 +1,30 @@
+package com.sunyard.certcompare.model;
+
+/**
+ * 比对分类。EQUAL 只计数，不进入报表。
+ */
+public enum CompareCategory {
+    ONLY_MAIN("主库多"),
+    ONLY_SLAVE("从库多"),
+    DIFF("不一致"),
+    EQUAL("一致");
+
+    public final String label;
+
+    CompareCategory(String label) {
+        this.label = label;
+    }
+
+    public static CompareCategory fromLabel(String label) {
+        if (label == null) {
+            return null;
+        }
+        String t = label.trim();
+        for (CompareCategory c : values()) {
+            if (c.label.equals(t) || c.name().equalsIgnoreCase(t)) {
+                return c;
+            }
+        }
+        return null;
+    }
+}

src/main/java/com/sunyard/certcompare/model/CompareResult.java

@@ -0,0 +1,42 @@
+package com.sunyard.certcompare.model;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * 一次完整比对的结果。
+ */
+public class CompareResult {
+
+    public final int mainCount;
+    public final int slaveCount;
+    public final int equalCount;
+    public final List<CompareRow> onlyMain;
+    public final List<CompareRow> onlySlave;
+    public final List<CompareRow> diff;
+    public final List<String> warnings;
+
+    public CompareResult(int mainCount, int slaveCount, int equalCount,
+                         List<CompareRow> onlyMain, List<CompareRow> onlySlave,
+                         List<CompareRow> diff, List<String> warnings) {
+        this.mainCount = mainCount;
+        this.slaveCount = slaveCount;
+        this.equalCount = equalCount;
+        this.onlyMain = onlyMain;
+        this.onlySlave = onlySlave;
+        this.diff = diff;
+        this.warnings = warnings;
+    }
+
+    public List<CompareRow> differenceRows() {
+        List<CompareRow> rows = new ArrayList<>(onlyMain.size() + onlySlave.size() + diff.size());
+        rows.addAll(onlyMain);
+        rows.addAll(onlySlave);
+        rows.addAll(diff);
+        return rows;
+    }
+
+    public int differenceCount() {
+        return onlyMain.size() + onlySlave.size() + diff.size();
+    }
+}

src/main/java/com/sunyard/certcompare/model/CompareRow.java

@@ -0,0 +1,36 @@
+package com.sunyard.certcompare.model;
+
+import com.sunyard.certcompare.util.Text;
+
+import java.util.List;
+
+/**
+ * 报表中的一行差异记录。
+ */
+public class CompareRow {
+
+    public final CompareCategory category;
+    public final CertKey key;
+    public final CertRecord main;
+    public final CertRecord slave;
+    public final List<FieldDiff> diffs;
+    public final List<String> notes;
+    public final String defaultChoice;
+    public final String dnText;
+
+    public CompareRow(CompareCategory category, CertKey key, CertRecord main, CertRecord slave,
+                      List<FieldDiff> diffs, List<String> notes, String defaultChoice, String dnText) {
+        this.category = category;
+        this.key = key;
+        this.main = main;
+        this.slave = slave;
+        this.diffs = diffs;
+        this.notes = notes;
+        this.defaultChoice = defaultChoice;
+        this.dnText = dnText == null ? "" : dnText;
+    }
+
+    public String cn() {
+        return Text.cnFromDn(dnText);
+    }
+}

src/main/java/com/sunyard/certcompare/model/FieldDiff.java

@@ -0,0 +1,17 @@
+package com.sunyard.certcompare.model;
+
+/**
+ * 单个比较字段的差异。
+ */
+public class FieldDiff {
+
+    public final String name;
+    public final String mainValue;
+    public final String slaveValue;
+
+    public FieldDiff(String name, String mainValue, String slaveValue) {
+        this.name = name;
+        this.mainValue = mainValue == null ? "" : mainValue;
+        this.slaveValue = slaveValue == null ? "" : slaveValue;
+    }
+}

src/main/java/com/sunyard/certcompare/model/MergeChoice.java

@@ -0,0 +1,28 @@
+package com.sunyard.certcompare.model;
+
+/**
+ * 人工合并选择。报表中显示为“主”/“备”，内部使用枚举，SQL 中只出现 MAIN/SLAVE。
+ */
+public enum MergeChoice {
+    MAIN("主"),
+    SLAVE("备");
+
+    public final String label;
+
+    MergeChoice(String label) {
+        this.label = label;
+    }
+
+    public static MergeChoice fromText(String text) {
+        if (text == null) {
+            return null;
+        }
+        String t = text.trim();
+        for (MergeChoice c : values()) {
+            if (c.label.equals(t) || c.name().equalsIgnoreCase(t)) {
+                return c;
+            }
+        }
+        return null;
+    }
+}

src/main/java/com/sunyard/certcompare/report/Csv.java

@@ -0,0 +1,113 @@
+package com.sunyard.certcompare.report;
+
+import com.sunyard.certcompare.UserException;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * RFC4180 风格 CSV 转义与解析。
+ */
+public final class Csv {
+
+    private Csv() {
+    }
+
+    public static String escape(String value) {
+        if (value == null) {
+            return "";
+        }
+        boolean need = false;
+        for (int i = 0; i < value.length(); i++) {
+            char c = value.charAt(i);
+            if (c == ',' || c == '"' || c == '\n' || c == '\r') {
+                need = true;
+                break;
+            }
+        }
+        if (!need && !value.isEmpty()) {
+            char first = value.charAt(0);
+            char last = value.charAt(value.length() - 1);
+            if (first == ' ' || last == ' ' || first == '\t' || last == '\t') {
+                need = true;
+            }
+        }
+        if (!need) {
+            return value;
+        }
+        return '"' + value.replace("\"", "\"\"") + '"';
+    }
+
+    public static List<CsvRecord> parse(String text) throws UserException {
+        List<CsvRecord> rows = new ArrayList<>();
+        if (text == null || text.isEmpty()) {
+            return rows;
+        }
+        List<String> fields = new ArrayList<>();
+        StringBuilder cur = new StringBuilder();
+        boolean inQuotes = false;
+        boolean fieldStarted = false;
+        int line = 1;
+        int recordLine = 1;
+        int len = text.length();
+
+        for (int i = 0; i < len; i++) {
+            char c = text.charAt(i);
+            if (inQuotes) {
+                if (c == '"') {
+                    if (i + 1 < len && text.charAt(i + 1) == '"') {
+                        cur.append('"');
+                        i++;
+                    } else {
+                        inQuotes = false;
+                    }
+                } else {
+                    if (c == '\n') {
+                        line++;
+                    }
+                    cur.append(c);
+                }
+            } else {
+                if (c == '"') {
+                    inQuotes = true;
+                    fieldStarted = true;
+                } else if (c == ',') {
+                    fields.add(cur.toString());
+                    cur.setLength(0);
+                    fieldStarted = true;
+                } else if (c == '\r') {
+                    // 忽略 CR，换行统一按 LF 处理
+                } else if (c == '\n') {
+                    fields.add(cur.toString());
+                    cur.setLength(0);
+                    rows.add(new CsvRecord(new ArrayList<>(fields), recordLine));
+                    fields.clear();
+                    line++;
+                    recordLine = line;
+                    fieldStarted = false;
+                } else {
+                    cur.append(c);
+                    fieldStarted = true;
+                }
+            }
+        }
+        if (inQuotes) {
+            throw new UserException("报表 CSV 引号未闭合", 5);
+        }
+        if (fieldStarted || cur.length() > 0 || !fields.isEmpty()) {
+            fields.add(cur.toString());
+            rows.add(new CsvRecord(new ArrayList<>(fields), recordLine));
+        }
+        return rows;
+    }
+
+    public static class CsvRecord {
+        public final List<String> fields;
+        public final int line;
+
+        public CsvRecord(List<String> fields, int line) {
+            this.fields = fields;
+            this.line = line;
+        }
+    }
+}

src/main/java/com/sunyard/certcompare/report/ReportData.java

@@ -0,0 +1,20 @@
+package com.sunyard.certcompare.report;
+
+import java.io.File;
+import java.util.List;
+
+/**
+ * 报表读取结果。
+ */
+public class ReportData {
+
+    public final File file;
+    public final int headerLine;
+    public final List<ReportRow> rows;
+
+    public ReportData(File file, int headerLine, List<ReportRow> rows) {
+        this.file = file;
+        this.headerLine = headerLine;
+        this.rows = rows;
+    }
+}

src/main/java/com/sunyard/certcompare/report/ReportReader.java

@@ -0,0 +1,176 @@
+package com.sunyard.certcompare.report;
+
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.util.Text;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.charset.CharacterCodingException;
+import java.nio.charset.Charset;
+import java.nio.charset.CharsetDecoder;
+import java.nio.charset.CodingErrorAction;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+/**
+ * 报表读取器：兼容 UTF-8 BOM、UTF-8、GBK/GB18030。
+ */
+public class ReportReader {
+
+    public ReportData read(File file) throws UserException {
+        if (file == null || !file.isFile()) {
+            throw new UserException("报表不存在: " + (file == null ? "" : file.getAbsolutePath()), 5);
+        }
+        byte[] bytes;
+        try {
+            bytes = Files.readAllBytes(file.toPath());
+        } catch (IOException e) {
+            throw new UserException("报表读取失败: " + file.getAbsolutePath() + " (" + e.getMessage() + ")", 5, e);
+        }
+        if (bytes.length == 0) {
+            throw new UserException("报表为空: " + file.getAbsolutePath(), 5);
+        }
+
+        boolean bom = bytes.length >= 3
+                && (bytes[0] & 0xFF) == 0xEF
+                && (bytes[1] & 0xFF) == 0xBB
+                && (bytes[2] & 0xFF) == 0xBF;
+        int offset = bom ? 3 : 0;
+        Charset charset;
+        if (bom) {
+            charset = StandardCharsets.UTF_8;
+        } else {
+            charset = isStrictUtf8(bytes) ? StandardCharsets.UTF_8 : Text.GB18030;
+        }
+        String text = new String(bytes, offset, bytes.length - offset, charset);
+        if (!text.isEmpty() && text.charAt(0) == '\uFEFF') {
+            text = text.substring(1);
+        }
+
+        List<Csv.CsvRecord> records = Csv.parse(text);
+        int headerIndex = -1;
+        for (int i = 0; i < records.size(); i++) {
+            List<String> f = records.get(i).fields;
+            if (f.contains("合并选择") && f.contains("DN_HEX")) {
+                headerIndex = i;
+                break;
+            }
+        }
+        if (headerIndex < 0) {
+            throw new UserException("报表缺少表头（需包含“合并选择”“DN_HEX”列）: " + file.getAbsolutePath(), 5);
+        }
+
+        List<String> header = new ArrayList<>();
+        for (String h : records.get(headerIndex).fields) {
+            header.add(h == null ? "" : h.trim());
+        }
+        Map<String, Integer> index = new HashMap<>();
+        for (int i = 0; i < header.size(); i++) {
+            String h = header.get(i);
+            if (h.isEmpty()) {
+                continue;
+            }
+            if (index.put(h, i) != null) {
+                throw new UserException("报表表头存在重复列: " + h, 5);
+            }
+        }
+        List<String> missing = new ArrayList<>();
+        for (String required : ReportWriter.HEADER) {
+            if (!index.containsKey(required)) {
+                missing.add(required);
+            }
+        }
+        if (!missing.isEmpty()) {
+            throw new UserException("报表缺少必需列: " + missing, 5);
+        }
+
+        List<ReportRow> rows = new ArrayList<>();
+        for (int i = headerIndex + 1; i < records.size(); i++) {
+            Csv.CsvRecord record = records.get(i);
+            List<String> fields = record.fields;
+            if (isBlank(fields)) {
+                continue;
+            }
+            if (fields.size() > header.size()) {
+                throw new UserException("报表第 " + record.line + " 行列数多于表头（" + fields.size()
+                        + " > " + header.size() + "）", 5);
+            }
+            while (fields.size() < header.size()) {
+                fields.add("");
+            }
+
+            String dnHexRaw = get(fields, index, "DN_HEX").trim();
+            String hex = dnHexRaw.regionMatches(true, 0, "HEX:", 0, 4)
+                    ? dnHexRaw.substring(4) : dnHexRaw;
+            hex = hex.replaceAll("\\s+", "").toUpperCase(Locale.ROOT);
+            if (!Text.isHex(hex)) {
+                throw new UserException("报表第 " + record.line + " 行 DN_HEX 非法: " + dnHexRaw, 5);
+            }
+
+            int certtype;
+            String certtypeText = get(fields, index, "CERTTYPE").trim();
+            try {
+                certtype = Integer.parseInt(certtypeText);
+            } catch (NumberFormatException e) {
+                throw new UserException("报表第 " + record.line + " 行 CERTTYPE 非法: " + certtypeText, 5);
+            }
+
+            rows.add(new ReportRow(
+                    record.line,
+                    get(fields, index, "序号"),
+                    get(fields, index, "类型"),
+                    get(fields, index, "合并选择"),
+                    get(fields, index, "DN"),
+                    hex,
+                    get(fields, index, "CN"),
+                    certtype,
+                    get(fields, index, "主库SN"),
+                    get(fields, index, "从库SN"),
+                    get(fields, index, "主库生效"),
+                    get(fields, index, "主库失效"),
+                    get(fields, index, "从库生效"),
+                    get(fields, index, "从库失效"),
+                    get(fields, index, "主库状态"),
+                    get(fields, index, "从库状态"),
+                    get(fields, index, "差异字段")));
+        }
+
+        return new ReportData(file, records.get(headerIndex).line, rows);
+    }
+
+    private static String get(List<String> fields, Map<String, Integer> index, String name) {
+        Integer i = index.get(name);
+        if (i == null || i < 0 || i >= fields.size()) {
+            return "";
+        }
+        String v = fields.get(i);
+        return v == null ? "" : v;
+    }
+
+    private static boolean isBlank(List<String> fields) {
+        for (String f : fields) {
+            if (f != null && !f.trim().isEmpty()) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private static boolean isStrictUtf8(byte[] bytes) {
+        CharsetDecoder decoder = StandardCharsets.UTF_8.newDecoder()
+                .onMalformedInput(CodingErrorAction.REPORT)
+                .onUnmappableCharacter(CodingErrorAction.REPORT);
+        try {
+            decoder.decode(ByteBuffer.wrap(bytes));
+            return true;
+        } catch (CharacterCodingException e) {
+            return false;
+        }
+    }
+}

src/main/java/com/sunyard/certcompare/report/ReportRow.java

@@ -0,0 +1,52 @@
+package com.sunyard.certcompare.report;
+
+import com.sunyard.certcompare.model.CertKey;
+
+/**
+ * 报表中的一条已标注记录。
+ */
+public class ReportRow {
+
+    public final int line;
+    public final String seq;
+    public final String typeText;
+    public final String choiceText;
+    public final String dn;
+    public final String dnHex;
+    public final String cn;
+    public final int certtype;
+    public final String mainSn;
+    public final String slaveSn;
+    public final String mainNotBefore;
+    public final String mainNotAfter;
+    public final String slaveNotBefore;
+    public final String slaveNotAfter;
+    public final String mainStat;
+    public final String slaveStat;
+    public final String diffFields;
+    public final CertKey key;
+
+    public ReportRow(int line, String seq, String typeText, String choiceText, String dn, String dnHex,
+                     String cn, int certtype, String mainSn, String slaveSn,
+                     String mainNotBefore, String mainNotAfter, String slaveNotBefore, String slaveNotAfter,
+                     String mainStat, String slaveStat, String diffFields) {
+        this.line = line;
+        this.seq = seq;
+        this.typeText = typeText;
+        this.choiceText = choiceText;
+        this.dn = dn;
+        this.dnHex = dnHex;
+        this.cn = cn;
+        this.certtype = certtype;
+        this.mainSn = mainSn;
+        this.slaveSn = slaveSn;
+        this.mainNotBefore = mainNotBefore;
+        this.mainNotAfter = mainNotAfter;
+        this.slaveNotBefore = slaveNotBefore;
+        this.slaveNotAfter = slaveNotAfter;
+        this.mainStat = mainStat;
+        this.slaveStat = slaveStat;
+        this.diffFields = diffFields;
+        this.key = new CertKey(dnHex, certtype);
+    }
+}

src/main/java/com/sunyard/certcompare/report/ReportValidator.java

@@ -0,0 +1,98 @@
+package com.sunyard.certcompare.report;
+
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.model.CertKey;
+import com.sunyard.certcompare.model.CompareCategory;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.CompareRow;
+import com.sunyard.certcompare.model.MergeChoice;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 校验报表与当前库比对结果一致，并解析人工标注。
+ */
+public final class ReportValidator {
+
+    private ReportValidator() {
+    }
+
+    public static Map<CertKey, MergeChoice> validate(CompareResult result, ReportData report)
+            throws UserException {
+        Map<CertKey, CompareRow> expected = new LinkedHashMap<>();
+        for (CompareRow row : result.differenceRows()) {
+            expected.put(row.key, row);
+        }
+
+        Map<CertKey, ReportRow> actual = new LinkedHashMap<>();
+        List<String> errors = new ArrayList<>();
+        for (ReportRow row : report.rows) {
+            if (actual.put(row.key, row) != null) {
+                errors.add("报表第 " + row.line + " 行身份键重复: " + row.key);
+            }
+        }
+
+        for (Map.Entry<CertKey, CompareRow> entry : expected.entrySet()) {
+            ReportRow row = actual.get(entry.getKey());
+            if (row == null) {
+                errors.add("报表缺少记录: " + entry.getKey());
+                continue;
+            }
+            CompareCategory actualCategory = CompareCategory.fromLabel(row.typeText);
+            if (actualCategory != entry.getValue().category) {
+                errors.add("报表第 " + row.line + " 行类型为“" + row.typeText.trim()
+                        + "”，当前应为“" + entry.getValue().category.label + "”: " + row.key);
+            }
+        }
+        for (CertKey key : actual.keySet()) {
+            if (!expected.containsKey(key)) {
+                errors.add("报表包含当前比对中不存在的记录: " + key);
+            }
+        }
+        if (!errors.isEmpty()) {
+            throw new UserException("报表已过期或与当前数据库不一致，请重新执行 compare：\n  "
+                    + String.join("\n  ", errors), 5);
+        }
+
+        Map<CertKey, MergeChoice> choices = new LinkedHashMap<>();
+        List<String> choiceErrors = new ArrayList<>();
+        for (Map.Entry<CertKey, CompareRow> entry : expected.entrySet()) {
+            CompareRow expectedRow = entry.getValue();
+            ReportRow row = actual.get(entry.getKey());
+            String text = row.choiceText == null ? "" : row.choiceText.trim();
+            MergeChoice choice = MergeChoice.fromText(text);
+            String where = "报表第 " + row.line + " 行（" + expectedRow.category.label
+                    + "，" + describe(entry.getKey()) + "）";
+
+            if (expectedRow.category == CompareCategory.ONLY_MAIN) {
+                if (choice != MergeChoice.MAIN) {
+                    choiceErrors.add(where + "合并选择为“" + text + "”，主库多只允许填“主”");
+                }
+                choices.put(entry.getKey(), MergeChoice.MAIN);
+            } else if (expectedRow.category == CompareCategory.ONLY_SLAVE) {
+                if (choice != MergeChoice.SLAVE) {
+                    choiceErrors.add(where + "合并选择为“" + text + "”，从库多只允许填“备”");
+                }
+                choices.put(entry.getKey(), MergeChoice.SLAVE);
+            } else {
+                if (choice == null) {
+                    choiceErrors.add(where + "合并选择为“" + text + "”，不一致记录必须填写“主”或“备”");
+                } else {
+                    choices.put(entry.getKey(), choice);
+                }
+            }
+        }
+        if (!choiceErrors.isEmpty()) {
+            throw new UserException("合并选择标注校验失败：\n  "
+                    + String.join("\n  ", choiceErrors), 5);
+        }
+        return choices;
+    }
+
+    private static String describe(CertKey key) {
+        return "CERTTYPE=" + key.certtype + ", DN_HEX=HEX:" + key.subjectHex;
+    }
+}

src/main/java/com/sunyard/certcompare/report/ReportWriter.java

@@ -0,0 +1,118 @@
+package com.sunyard.certcompare.report;
+
+import com.sunyard.certcompare.AppConfig;
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.CompareRow;
+import com.sunyard.certcompare.model.FieldDiff;
+
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStreamWriter;
+import java.io.Writer;
+import java.nio.charset.StandardCharsets;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.List;
+
+/**
+ * 生成唯一的比较报表（UTF-8 + BOM）。
+ */
+public class ReportWriter {
+
+    public static final String[] HEADER = new String[]{
+            "序号", "类型", "DN", "DN_HEX", "CN", "CERTTYPE",
+            "主库SN", "从库SN", "主库生效", "主库失效", "从库生效", "从库失效",
+            "主库状态", "从库状态", "差异字段", "合并选择"
+    };
+
+    public File write(AppConfig cfg, CompareResult result) throws UserException {
+        File dir = cfg.reportDirFile();
+        if (!dir.exists() && !dir.mkdirs()) {
+            throw new UserException("报表目录创建失败: " + dir.getAbsolutePath(), 2);
+        }
+        if (!dir.isDirectory()) {
+            throw new UserException("报表路径不是目录: " + dir.getAbsolutePath(), 2);
+        }
+        File out = nextFile(dir);
+
+        try (Writer writer = new BufferedWriter(new OutputStreamWriter(
+                new FileOutputStream(out), StandardCharsets.UTF_8))) {
+            if (cfg.isCsvBom()) {
+                writer.write('\uFEFF');
+            }
+            writeRow(writer, HEADER);
+            int seq = 1;
+            for (CompareRow row : result.differenceRows()) {
+                writeRow(writer, toFields(seq++, row));
+            }
+        } catch (IOException e) {
+            throw new UserException("报表写入失败: " + out.getAbsolutePath() + " (" + e.getMessage() + ")", 2, e);
+        }
+        return out;
+    }
+
+    private File nextFile(File dir) throws UserException {
+        String base = "compare-report-" + new SimpleDateFormat("yyyyMMdd-HHmmss").format(new Date());
+        File file = new File(dir, base + ".csv");
+        int i = 2;
+        while (file.exists()) {
+            if (i > 999) {
+                throw new UserException("报表目录中同名文件过多: " + base, 2);
+            }
+            file = new File(dir, base + "-" + i + ".csv");
+            i++;
+        }
+        return file;
+    }
+
+    private String[] toFields(int seq, CompareRow row) {
+        String mainSn = row.main == null ? "" : row.main.sn;
+        String slaveSn = row.slave == null ? "" : row.slave.sn;
+        String mainBefore = row.main == null ? "" : row.main.notBefore;
+        String mainAfter = row.main == null ? "" : row.main.notAfter;
+        String slaveBefore = row.slave == null ? "" : row.slave.notBefore;
+        String slaveAfter = row.slave == null ? "" : row.slave.notAfter;
+        String mainStat = row.main == null ? "" : String.valueOf(row.main.stat);
+        String slaveStat = row.slave == null ? "" : String.valueOf(row.slave.stat);
+
+        StringBuilder diffNames = new StringBuilder();
+        for (FieldDiff d : row.diffs) {
+            if (diffNames.length() > 0) {
+                diffNames.append(';');
+            }
+            diffNames.append(d.name);
+        }
+
+        return new String[]{
+                String.valueOf(seq),
+                row.category.label,
+                row.dnText,
+                "HEX:" + row.key.subjectHex,
+                row.cn(),
+                String.valueOf(row.key.certtype),
+                mainSn,
+                slaveSn,
+                mainBefore,
+                mainAfter,
+                slaveBefore,
+                slaveAfter,
+                mainStat,
+                slaveStat,
+                diffNames.toString(),
+                row.defaultChoice
+        };
+    }
+
+    private void writeRow(Writer writer, String[] fields) throws IOException {
+        for (int i = 0; i < fields.length; i++) {
+            if (i > 0) {
+                writer.write(',');
+            }
+            writer.write(Csv.escape(fields[i]));
+        }
+        writer.write('\n');
+    }
+}

src/main/java/com/sunyard/certcompare/sql/SqlPlan.java

@@ -0,0 +1,64 @@
+package com.sunyard.certcompare.sql;
+
+import com.sunyard.certcompare.model.CompareResult;
+
+import java.io.File;
+import java.io.PrintStream;
+
+/**
+ * 批量 SQL 生成计划（只读统计，不执行任何写操作）。
+ */
+public class SqlPlan {
+
+    public final int mainCount;
+    public final int slaveCount;
+    public final int equalCount;
+    public final int onlyMainCount;
+    public final int onlySlaveCount;
+    public final int diffCount;
+    public final int insertCount;
+    public final int diffMainCount;
+    public final int diffSlaveCount;
+    public final int updateCount;
+    public final int expectedCount;
+    public final File mainFile;
+    public final File slaveFile;
+    public final File sqlFile;
+
+    public SqlPlan(CompareResult result, int diffMainCount, int diffSlaveCount,
+                   int insertCount, int updateCount, File mainFile, File slaveFile, File sqlFile) {
+        this.mainCount = result.mainCount;
+        this.slaveCount = result.slaveCount;
+        this.equalCount = result.equalCount;
+        this.onlyMainCount = result.onlyMain.size();
+        this.onlySlaveCount = result.onlySlave.size();
+        this.diffCount = result.diff.size();
+        this.insertCount = insertCount;
+        this.diffMainCount = diffMainCount;
+        this.diffSlaveCount = diffSlaveCount;
+        this.updateCount = updateCount;
+        this.expectedCount = result.mainCount + result.onlySlave.size();
+        this.mainFile = mainFile;
+        this.slaveFile = slaveFile;
+        this.sqlFile = sqlFile;
+    }
+
+    public void print(PrintStream out) {
+        out.println("SQL 生成计划:");
+        out.printf("  %-20s %d%n", "主库证书数", mainCount);
+        out.printf("  %-20s %d%n", "从库证书数", slaveCount);
+        out.printf("  %-20s %d%n", "一致", equalCount);
+        out.printf("  %-20s %d%n", "主库多", onlyMainCount);
+        out.printf("  %-20s %d%n", "从库多", onlySlaveCount);
+        out.printf("  %-20s %d%n", "不一致", diffCount);
+        out.printf("  %-20s %d%n", "写入(从库多+选备)", insertCount);
+        out.printf("  %-20s %d%n", "不一致选主", diffMainCount);
+        out.printf("  %-20s %d%n", "不一致选备", diffSlaveCount);
+        out.printf("  %-20s %d%n", "执行后主库记录数", expectedCount);
+        out.printf("  %-20s %s%n", "从库(只读引用)", slaveFile.getAbsolutePath());
+        out.printf("  %-20s %s%n", "SQL 文件", sqlFile.getAbsolutePath());
+        if (updateCount > 0) {
+            out.printf("  %-20s %d%n", "按主库字节替换", updateCount);
+        }
+    }
+}

src/main/java/com/sunyard/certcompare/sql/SqlScriptService.java

@@ -0,0 +1,256 @@
+package com.sunyard.certcompare.sql;
+
+import com.sunyard.certcompare.AppConfig;
+import com.sunyard.certcompare.UserException;
+import com.sunyard.certcompare.db.DbManager;
+import com.sunyard.certcompare.model.CertKey;
+import com.sunyard.certcompare.model.CertRecord;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.CompareRow;
+import com.sunyard.certcompare.model.MergeChoice;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+/**
+ * 生成在主库上执行的批量 SQL 脚本。
+ *
+ * <p>脚本不把 DN/证书内容带进 SQL 文本，而是 ATTACH 从库后按身份键
+ * （subject 原始字节 + certtype）复制，因此 GBK 中文 DN 的字节不会被解码或重编码。</p>
+ */
+public class SqlScriptService {
+
+    /** 单条 INSERT 包含的身份键上限，避免 SQL 文本过长。 */
+    static final int KEYS_PER_STATEMENT = 2000;
+
+    static final String SOURCE_ALIAS = "cert_src";
+
+    private final AppConfig cfg;
+
+    public SqlScriptService(AppConfig cfg) {
+        this.cfg = cfg;
+    }
+
+    public SqlPlan generate(CompareResult result, Map<CertKey, MergeChoice> choices)
+            throws UserException {
+        // 脚本直接写入进程当前工作目录
+        File dir = new File(System.getProperty("user.dir")).getAbsoluteFile();
+        Script script = build(cfg, result, choices);
+        File file = nextFile(dir);
+        try {
+            Files.write(file.toPath(), script.text.getBytes(StandardCharsets.UTF_8));
+        } catch (IOException e) {
+            throw new UserException("SQL 文件写入失败: " + file.getAbsolutePath()
+                    + " (" + e.getMessage() + ")", 5, e);
+        }
+        return new SqlPlan(result, script.diffMainCount, script.diffSlaveCount,
+                script.insertCount, script.updateCount,
+                cfg.mainFile(), cfg.slaveFile(), file);
+    }
+
+    private File nextFile(File dir) throws UserException {
+        String base = "merge-" + new SimpleDateFormat("yyyyMMdd-HHmmss").format(new Date());
+        File file = new File(dir, base + ".sql");
+        int i = 2;
+        while (file.exists()) {
+            if (i > 999) {
+                throw new UserException("当前目录中同名脚本文件过多: " + base, 2);
+            }
+            file = new File(dir, base + "-" + i + ".sql");
+            i++;
+        }
+        return file;
+    }
+
+    /**
+     * 生成脚本内容。纯函数，便于单元测试。
+     */
+    public static Script build(AppConfig cfg, CompareResult result, Map<CertKey, MergeChoice> choices)
+            throws UserException {
+        List<CertRecord> insertRecords = new ArrayList<>();
+        List<CompareRow> updateRows = new ArrayList<>();
+        int diffMain = 0;
+        int diffSlave = 0;
+
+        for (CompareRow row : result.onlySlave) {
+            if (row.slave == null) {
+                throw new UserException("内部错误：从库多记录缺少从库数据: " + row.key, 5);
+            }
+            insertRecords.add(row.slave);
+        }
+
+        for (CompareRow row : result.diff) {
+            MergeChoice choice = choices.get(row.key);
+            if (choice == MergeChoice.MAIN) {
+                diffMain++;
+                continue;
+            }
+            if (choice != MergeChoice.SLAVE) {
+                throw new UserException("内部错误：不一致记录缺少合并选择: " + row.key, 5);
+            }
+            diffSlave++;
+            if (row.main == null || row.slave == null) {
+                throw new UserException("内部错误：不一致记录缺少数据: " + row.key, 5);
+            }
+            if (sameSubjectBytes(row.main, row.slave)) {
+                insertRecords.add(row.slave);
+            } else {
+                // dn.match=TRIM 时主备 DN 原始字节可能不同，需按主库字节定位后整行字段替换
+                updateRows.add(row);
+            }
+        }
+
+        Script script = new Script();
+        script.diffMainCount = diffMain;
+        script.diffSlaveCount = diffSlave;
+        script.insertCount = insertRecords.size();
+        script.updateCount = updateRows.size();
+        script.text = render(cfg, result, script, insertRecords, updateRows);
+        return script;
+    }
+
+    private static boolean sameSubjectBytes(CertRecord a, CertRecord b) {
+        return a.subjectHex.equalsIgnoreCase(b.subjectHex) && a.certtype == b.certtype;
+    }
+
+    private static String render(AppConfig cfg, CompareResult result, Script stats,
+                                 List<CertRecord> insertRecords, List<CompareRow> updateRows) {
+        String mainPath = cfg.mainFile().getAbsolutePath();
+        String slavePath = cfg.slaveFile().getAbsolutePath();
+        String now = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date());
+        List<String> columns = DbManager.COPY_COLUMNS;
+
+        StringBuilder sb = new StringBuilder(4096);
+        sb.append("-- =============================================================\n");
+        sb.append("-- HSM 主备证书合并脚本（由 cert-compare 生成）\n");
+        sb.append("-- 生成时间: ").append(now).append('\n');
+        sb.append("-- 主库: ").append(mainPath).append('\n');
+        sb.append("-- 从库: ").append(slavePath).append('\n');
+        sb.append("--\n");
+        sb.append("-- 执行方式:\n");
+        sb.append("--   1) 备份主库: cp -p ").append(mainPath)
+                .append(" ").append(mainPath).append(".bak-$(date +%Y%m%d-%H%M%S)\n");
+        sb.append("--   2) 执行脚本: sqlite3 ").append(mainPath).append(" < <本文件>\n");
+        sb.append("--\n");
+        sb.append("-- 说明:\n");
+        sb.append("--   * 只写主库 usercert_tab；从库以 ATTACH 方式只读引用；\n");
+        sb.append("--   * subject/issuer 在 SQLite 内部按原始字节复制，不经过任何字符集转换，\n");
+        sb.append("--     DN 中的 GBK 中文按原字节写入，不会被重新编码；\n");
+        sb.append("--   * 所有语句按身份键（subject 原始字节 + certtype）定位，不依赖 DN 文本；\n");
+        sb.append("--   * 脚本可重复执行，重复执行结果一致；\n");
+        sb.append("--   * 若执行中报错，请先恢复备份，再排查后重跑，不要跳过错误继续执行；\n");
+        sb.append("--   * 需要回滚时，直接用备份文件覆盖主库。\n");
+        sb.append("--\n");
+        sb.append("-- 统计: 主库 ").append(result.mainCount).append(" 条，从库 ")
+                .append(result.slaveCount).append(" 条；")
+                .append("主库多 ").append(result.onlyMain.size()).append("，")
+                .append("从库多 ").append(result.onlySlave.size()).append("，")
+                .append("不一致 ").append(result.diff.size())
+                .append("（选主 ").append(stats.diffMainCount)
+                .append("、选备 ").append(stats.diffSlaveCount).append("）；\n");
+        sb.append("--       写入 ").append(stats.insertCount).append(" 条");
+        if (stats.updateCount > 0) {
+            sb.append("，按主库原字节替换 ").append(stats.updateCount).append(" 条");
+        }
+        sb.append("；执行后主库应为 ")
+                .append(result.mainCount + result.onlySlave.size()).append(" 条。\n");
+        sb.append("-- =============================================================\n");
+        sb.append('\n');
+        sb.append("PRAGMA foreign_keys = OFF;\n");
+        sb.append('\n');
+        sb.append("ATTACH DATABASE ").append(DbManager.sqlString(slavePath))
+                .append(" AS ").append(SOURCE_ALIAS).append(";\n");
+        sb.append('\n');
+        sb.append("BEGIN IMMEDIATE;\n");
+
+        if (!insertRecords.isEmpty()) {
+            sb.append('\n');
+            sb.append("-- 从库多 / 不一致选备（主备 DN 字节相同）：按主键插入或整行替换\n");
+            for (int from = 0; from < insertRecords.size(); from += KEYS_PER_STATEMENT) {
+                int to = Math.min(from + KEYS_PER_STATEMENT, insertRecords.size());
+                appendInsert(sb, columns, insertRecords.subList(from, to));
+            }
+        }
+
+        for (CompareRow row : updateRows) {
+            sb.append('\n');
+            sb.append("-- 不一致选备（主备 DN 原始字节不同，dn.match=TRIM）：按主库字节定位，整行字段替换为从库值\n");
+            appendUpdate(sb, columns, row);
+        }
+
+        if (insertRecords.isEmpty() && updateRows.isEmpty()) {
+            sb.append('\n');
+            sb.append("-- 没有需要写入的记录（主库已包含全部证书）。\n");
+        }
+
+        sb.append('\n');
+        sb.append("COMMIT;\n");
+        sb.append('\n');
+        sb.append("DETACH DATABASE ").append(SOURCE_ALIAS).append(";\n");
+        sb.append('\n');
+        sb.append("-- 执行后自检：正常应输出 rows = ")
+                .append(result.mainCount + result.onlySlave.size())
+                .append(" 以及 ok\n");
+        sb.append("SELECT 'rows' AS item, count(*) AS value FROM usercert_tab;\n");
+        sb.append("PRAGMA integrity_check;\n");
+        return sb.toString();
+    }
+
+    private static void appendInsert(StringBuilder sb, List<String> columns, List<CertRecord> records) {
+        String columnList = DbManager.joinCopyColumns(null);
+        sb.append("INSERT OR REPLACE INTO usercert_tab\n");
+        sb.append("       (").append(columnList).append(")\n");
+        sb.append("SELECT ").append(columnList).append('\n');
+        sb.append("  FROM ").append(SOURCE_ALIAS).append(".usercert_tab\n");
+        sb.append(" WHERE ");
+        for (int i = 0; i < records.size(); i++) {
+            CertRecord r = records.get(i);
+            if (i > 0) {
+                sb.append("\n    OR ");
+            }
+            sb.append("(hex(subject) = ").append(hexLiteral(r.subjectHex))
+                    .append(" AND certtype = ").append(r.certtype).append(')');
+        }
+        sb.append(";\n");
+    }
+
+    private static void appendUpdate(StringBuilder sb, List<String> columns, CompareRow row) {
+        CertRecord main = row.main;
+        CertRecord slave = row.slave;
+        String where = " WHERE hex(subject) = " + hexLiteral(slave.subjectHex)
+                + " AND certtype = " + slave.certtype;
+        sb.append("UPDATE usercert_tab SET\n");
+        for (int i = 0; i < columns.size(); i++) {
+            sb.append("       ").append(columns.get(i)).append(" = (SELECT ").append(columns.get(i))
+                    .append(" FROM ").append(SOURCE_ALIAS).append(".usercert_tab")
+                    .append(where).append(')');
+            sb.append(i + 1 < columns.size() ? ",\n" : "\n");
+        }
+        sb.append(" WHERE hex(subject) = ").append(hexLiteral(main.subjectHex))
+                .append(" AND certtype = ").append(main.certtype).append(";\n");
+    }
+
+    private static String hexLiteral(String hex) {
+        String h = hex == null ? "" : hex.trim().toUpperCase(Locale.ROOT);
+        return DbManager.sqlString(h);
+    }
+
+    /**
+     * 生成结果：脚本文本 + 统计。
+     */
+    public static class Script {
+        public String text = "";
+        public int insertCount;
+        public int updateCount;
+        public int diffMainCount;
+        public int diffSlaveCount;
+    }
+}

src/main/java/com/sunyard/certcompare/util/DateUtil.java

@@ -0,0 +1,40 @@
+package com.sunyard.certcompare.util;
+
+import java.time.DateTimeException;
+import java.time.LocalDate;
+
+/**
+ * 14 位 yyyyMMddHHmmss 时间校验。
+ */
+public final class DateUtil {
+
+    private DateUtil() {
+    }
+
+    public static boolean isValid(String value) {
+        if (value == null || value.length() != 14) {
+            return false;
+        }
+        for (int i = 0; i < 14; i++) {
+            if (!Character.isDigit(value.charAt(i))) {
+                return false;
+            }
+        }
+        int year = Integer.parseInt(value.substring(0, 4));
+        int month = Integer.parseInt(value.substring(4, 6));
+        int day = Integer.parseInt(value.substring(6, 8));
+        int hour = Integer.parseInt(value.substring(8, 10));
+        int minute = Integer.parseInt(value.substring(10, 12));
+        int second = Integer.parseInt(value.substring(12, 14));
+        try {
+            LocalDate.of(year, month, day);
+        } catch (DateTimeException e) {
+            return false;
+        }
+        return hour < 24 && minute < 60 && second < 60;
+    }
+
+    public static boolean beforeOrEqual(String a, String b) {
+        return a != null && b != null && a.compareTo(b) <= 0;
+    }
+}

src/main/java/com/sunyard/certcompare/util/SnNormalizer.java

@@ -0,0 +1,36 @@
+package com.sunyard.certcompare.util;
+
+import java.util.Locale;
+
+/**
+ * SN 归一化。仅用于比较，展示和写回始终使用原始值。
+ */
+public final class SnNormalizer {
+
+    private SnNormalizer() {
+    }
+
+    public static String normalize(String sn, boolean hexMode) {
+        if (sn == null) {
+            return "";
+        }
+        String trimmed = sn.trim();
+        if (!hexMode) {
+            return trimmed;
+        }
+        String upper = trimmed.toUpperCase(Locale.ROOT);
+        if (upper.isEmpty()) {
+            return upper;
+        }
+        for (int i = 0; i < upper.length(); i++) {
+            if (Character.digit(upper.charAt(i), 16) < 0) {
+                return upper;
+            }
+        }
+        int i = 0;
+        while (i < upper.length() - 1 && upper.charAt(i) == '0') {
+            i++;
+        }
+        return upper.substring(i);
+    }
+}

src/main/java/com/sunyard/certcompare/util/Text.java

@@ -0,0 +1,102 @@
+package com.sunyard.certcompare.util;
+
+import java.nio.charset.Charset;
+import java.util.Locale;
+
+/**
+ * GB18030 与十六进制工具。DN/issuer 全程按原始字节处理。
+ */
+public final class Text {
+
+    public static final Charset GB18030 = Charset.forName("GB18030");
+
+    private Text() {
+    }
+
+    public static String decode(byte[] raw) {
+        return decode(raw, GB18030);
+    }
+
+    public static String decode(byte[] raw, Charset charset) {
+        if (raw == null || raw.length == 0) {
+            return "";
+        }
+        return new String(raw, charset);
+    }
+
+    public static byte[] hexToBytes(String hex) {
+        if (hex == null) {
+            return new byte[0];
+        }
+        String s = hex.trim();
+        if (s.regionMatches(true, 0, "HEX:", 0, 4)) {
+            s = s.substring(4);
+        }
+        s = s.replaceAll("\\s+", "");
+        if ((s.length() & 1) != 0) {
+            throw new IllegalArgumentException("十六进制长度必须为偶数: " + hex);
+        }
+        byte[] out = new byte[s.length() / 2];
+        for (int i = 0; i < out.length; i++) {
+            int hi = Character.digit(s.charAt(i * 2), 16);
+            int lo = Character.digit(s.charAt(i * 2 + 1), 16);
+            if (hi < 0 || lo < 0) {
+                throw new IllegalArgumentException("非法十六进制字符: " + hex);
+            }
+            out[i] = (byte) ((hi << 4) | lo);
+        }
+        return out;
+    }
+
+    public static String bytesToHex(byte[] raw) {
+        if (raw == null) {
+            return "";
+        }
+        StringBuilder sb = new StringBuilder(raw.length * 2);
+        for (byte b : raw) {
+            sb.append(Character.toUpperCase(Character.forDigit((b >> 4) & 0x0F, 16)));
+            sb.append(Character.toUpperCase(Character.forDigit(b & 0x0F, 16)));
+        }
+        return sb.toString();
+    }
+
+    public static boolean isHex(String value) {
+        if (value == null) {
+            return false;
+        }
+        if (value.isEmpty()) {
+            return true;
+        }
+        if ((value.length() & 1) != 0) {
+            return false;
+        }
+        for (int i = 0; i < value.length(); i++) {
+            if (Character.digit(value.charAt(i), 16) < 0) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * 从 DN 中提取 CN，仅用于展示。
+     */
+    public static String cnFromDn(String dn) {
+        if (dn == null || dn.isEmpty()) {
+            return "";
+        }
+        for (String part : dn.split(",")) {
+            String p = part.trim();
+            if (p.regionMatches(true, 0, "CN=", 0, 3)) {
+                return p.substring(3).trim();
+            }
+        }
+        int idx = dn.toUpperCase(Locale.ROOT).indexOf("CN=");
+        if (idx >= 0) {
+            String rest = dn.substring(idx + 3);
+            int comma = rest.indexOf(',');
+            return (comma >= 0 ? rest.substring(0, comma) : rest).trim();
+        }
+        return "";
+    }
+}

src/test/java/com/sunyard/certcompare/CsvTest.java

@@ -0,0 +1,74 @@
+package com.sunyard.certcompare;
+
+import com.sunyard.certcompare.model.CertKey;
+import com.sunyard.certcompare.report.Csv;
+import com.sunyard.certcompare.report.ReportWriter;
+import org.junit.Test;
+
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertTrue;
+
+public class CsvTest {
+
+    @Test
+    public void escapeHandlesCommaQuoteAndNewline() {
+        assertEquals("abc", Csv.escape("abc"));
+        assertEquals("\"a,b\"", Csv.escape("a,b"));
+        assertEquals("\"a\"\"b\"", Csv.escape("a\"b"));
+        assertEquals("\"a\nb\"", Csv.escape("a\nb"));
+        assertEquals("\" a \"", Csv.escape(" a "));
+    }
+
+    @Test
+    public void parseRoundTrip() throws Exception {
+        String line = "1,\"C=CN,CN=a,b\",\"say \"\"hi\"\"\"\n";
+        List<Csv.CsvRecord> records = Csv.parse(line);
+        assertEquals(1, records.size());
+        assertEquals(3, records.get(0).fields.size());
+        assertEquals("C=CN,CN=a,b", records.get(0).fields.get(1));
+        assertEquals("say \"hi\"", records.get(0).fields.get(2));
+    }
+
+    @Test
+    public void parseMultilineQuotedField() throws Exception {
+        String text = "a,\"line1\nline2\",c\nx,y,z\n";
+        List<Csv.CsvRecord> records = Csv.parse(text);
+        assertEquals(2, records.size());
+        assertEquals("line1\nline2", records.get(0).fields.get(1));
+        assertEquals(1, records.get(0).line);
+        assertEquals(3, records.get(1).line);
+    }
+
+    @Test
+    public void certKeyIsCaseInsensitiveOnHex() {
+        CertKey a = new CertKey("B3C2", 1);
+        CertKey b = new CertKey("b3c2", 1);
+        assertEquals(a, b);
+        assertEquals(a.hashCode(), b.hashCode());
+        assertNotEquals(a, new CertKey("B3C2", 2));
+        assertTrue(a.compareTo(new CertKey("B3C3", 0)) < 0);
+    }
+
+    @Test
+    public void trimSubjectHexOnlyRemovesWhitespaceBytes() {
+        assertEquals("B3C2", CertKey.normalizeSubjectHex("20B3C220", true));
+        assertEquals("20B3C220", CertKey.normalizeSubjectHex("20B3C220", false));
+    }
+
+    @Test
+    public void headerEndsWithChoiceAndHasNoNoteColumn() {
+        String[] header = ReportWriter.HEADER;
+        assertEquals("合并选择", header[header.length - 1]);
+        int choiceCount = 0;
+        for (String h : header) {
+            assertNotEquals("备注", h);
+            if ("合并选择".equals(h)) {
+                choiceCount++;
+            }
+        }
+        assertEquals(1, choiceCount);
+    }
+}

src/test/java/com/sunyard/certcompare/SqlScriptTest.java

@@ -0,0 +1,103 @@
+package com.sunyard.certcompare;
+
+import com.sunyard.certcompare.model.CertRecord;
+import com.sunyard.certcompare.model.CompareCategory;
+import com.sunyard.certcompare.model.CompareResult;
+import com.sunyard.certcompare.model.CompareRow;
+import com.sunyard.certcompare.model.MergeChoice;
+import com.sunyard.certcompare.sql.SqlScriptService;
+import org.junit.Test;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class SqlScriptTest {
+
+    private static CompareRow row(CompareCategory category, CertRecord main, CertRecord slave) {
+        CertRecord any = main != null ? main : slave;
+        return new CompareRow(category, any.key(), main, slave,
+                new ArrayList<com.sunyard.certcompare.model.FieldDiff>(),
+                new ArrayList<String>(), "", "");
+    }
+
+    private static CertRecord rec(String hex, int certtype) {
+        return new CertRecord(hex, "4F3D4341", "0A0B0C01",
+                "20260101000000", "20301231235959", certtype, 0);
+    }
+
+    private static AppConfig config() throws Exception {
+        AppConfig cfg = AppConfig.load(null, false);
+        cfg.setMainPath("/app/cert-compare/main.db");
+        cfg.setSlavePath("/app/cert-compare/slave.db");
+        return cfg;
+    }
+
+    @Test
+    public void insertAndUpdateStatementsAreByteBased() throws Exception {
+        CompareRow onlySlave = row(CompareCategory.ONLY_SLAVE, null, rec("B3C2", 0));
+        CompareRow sameBytes = row(CompareCategory.DIFF, rec("434445", 2), rec("434445", 2));
+        CompareRow mainChosen = row(CompareCategory.DIFF, rec("464748", 5), rec("464748", 5));
+        CompareRow trimCase = row(CompareCategory.DIFF, rec("20B3C220", 1), rec("B3C2", 1));
+        CompareRow onlyMain = row(CompareCategory.ONLY_MAIN, rec("494A", 4), null);
+
+        List<CompareRow> onlyMainRows = new ArrayList<>();
+        onlyMainRows.add(onlyMain);
+        List<CompareRow> onlySlaveRows = new ArrayList<>();
+        onlySlaveRows.add(onlySlave);
+        List<CompareRow> diffRows = new ArrayList<>();
+        diffRows.add(sameBytes);
+        diffRows.add(mainChosen);
+        diffRows.add(trimCase);
+        CompareResult result = new CompareResult(2, 2, 0, onlyMainRows, onlySlaveRows, diffRows,
+                new ArrayList<String>());
+
+        Map<com.sunyard.certcompare.model.CertKey, MergeChoice> choices = new HashMap<>();
+        choices.put(sameBytes.key, MergeChoice.SLAVE);
+        choices.put(mainChosen.key, MergeChoice.MAIN);
+        choices.put(trimCase.key, MergeChoice.SLAVE);
+
+        SqlScriptService.Script script = SqlScriptService.build(config(), result, choices);
+
+        assertEquals(1, script.diffMainCount);
+        assertEquals(2, script.diffSlaveCount);
+        assertEquals(2, script.insertCount);
+        assertEquals(1, script.updateCount);
+
+        String slavePath = config().slaveFile().getAbsolutePath();
+        assertTrue(script.text.contains("ATTACH DATABASE '" + slavePath + "' AS cert_src;"));
+        assertTrue(script.text.contains("INSERT OR REPLACE INTO usercert_tab"));
+        assertTrue(script.text.contains("(hex(subject) = 'B3C2' AND certtype = 0)"));
+        assertTrue(script.text.contains("(hex(subject) = '434445' AND certtype = 2)"));
+        assertTrue(script.text.contains("UPDATE usercert_tab SET"));
+        assertTrue(script.text.contains("hex(subject) = '20B3C220'"));
+        assertTrue(script.text.contains("BEGIN IMMEDIATE;"));
+        assertTrue(script.text.contains("COMMIT;"));
+        assertTrue(script.text.contains("DETACH DATABASE cert_src;"));
+        assertTrue(script.text.contains("PRAGMA integrity_check;"));
+
+        // 选主的记录不应产生任何语句
+        assertFalse(script.text.contains("'464748'"));
+        // DN 只以十六进制出现，脚本正文不包含解码后的中文
+        assertFalse(script.text.contains("陈超"));
+    }
+
+    @Test
+    public void emptyDifferencesStillProduceValidScript() throws Exception {
+        CompareResult result = new CompareResult(1, 1, 1,
+                new ArrayList<CompareRow>(), new ArrayList<CompareRow>(),
+                new ArrayList<CompareRow>(), new ArrayList<String>());
+        SqlScriptService.Script script = SqlScriptService.build(config(), result,
+                new HashMap<com.sunyard.certcompare.model.CertKey, MergeChoice>());
+        assertTrue(script.text.contains("没有需要写入的记录"));
+        assertEquals(0, script.insertCount);
+        assertEquals(0, script.updateCount);
+        assertTrue(script.text.contains("BEGIN IMMEDIATE;"));
+        assertTrue(script.text.contains("COMMIT;"));
+    }
+}

src/test/java/com/sunyard/certcompare/UtilTest.java

@@ -0,0 +1,46 @@
+package com.sunyard.certcompare;
+
+import com.sunyard.certcompare.util.DateUtil;
+import com.sunyard.certcompare.util.SnNormalizer;
+import com.sunyard.certcompare.util.Text;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class UtilTest {
+
+    @Test
+    public void hexRoundTripPreservesGbkBytes() {
+        byte[] gbk = new byte[]{(byte) 0xB3, (byte) 0xC2, (byte) 0xB3, (byte) 0xAC};
+        String hex = Text.bytesToHex(gbk);
+        assertEquals("B3C2B3AC", hex);
+        assertEquals("陈超", Text.decode(Text.hexToBytes(hex)));
+        assertEquals("B3C2B3AC", Text.bytesToHex(Text.hexToBytes("HEX:b3c2b3ac")));
+    }
+
+    @Test
+    public void snNormalizationRemovesLeadingZerosAndUppercases() {
+        assertEquals("1971EE53B08", SnNormalizer.normalize(" 01971ee53b08 ", true));
+        assertEquals("0", SnNormalizer.normalize("000", true));
+        assertEquals("abc", SnNormalizer.normalize("abc", false));
+    }
+
+    @Test
+    public void dateValidation() {
+        assertTrue(DateUtil.isValid("20260101000000"));
+        assertFalse(DateUtil.isValid("20261301000000"));
+        assertFalse(DateUtil.isValid("2026010100000"));
+        assertFalse(DateUtil.isValid("20260101240000"));
+        assertTrue(DateUtil.beforeOrEqual("20260101000000", "20270101000000"));
+        assertFalse(DateUtil.beforeOrEqual("20270101000000", "20260101000000"));
+    }
+
+    @Test
+    public void cnExtraction() {
+        assertEquals("172.1.40.188", Text.cnFromDn("C=CN,ST=北京,L=北京,O=信雅达,OU=双证,CN=172.1.40.188"));
+        assertEquals("041@x@陈超@y", Text.cnFromDn("C=cn,O=CFCA,CN=041@x@陈超@y"));
+        assertEquals("", Text.cnFromDn("C=CN,O=none"));
+    }
+}

需求文档.md

@@ -0,0 +1,577 @@
+# HSM 主备数据库证书比对工具 需求文档
+
+| 项目 | 内容 |
+| --- | --- |
+| 文档版本 | v0.4 |
+| 编写日期 | 2026-11-04 |
+| 状态 | 已更新（批量 SQL 方案） |
+| 关联文档 | `设计文档.md` |
+| 测试环境 | 172.1.41.139（CentOS 6.5 / JDK 1.8 / SQLite） |
+| 测试数据 | `/app/cert-compare/main.db`（4 条）、`/app/cert-compare/slave.db`（15 条） |
+
+---
+
+## 1. 背景
+
+HSM 系统使用 SQLite3 数据库保存用户证书，证书保存在 `usercert_tab` 表中，生产规模约 3000 张。主、备两套系统各自维护一份数据库，长期运行后可能出现：
+
+- 主库中存在、从库中不存在的证书（主库多）；
+- 从库中存在、主库中不存在的证书（从库多）；
+- 两边都存在同一张证书（同一 DN + 证书类型），但 SN、有效期、状态等字段不一致；
+- 同一 DN 下存在多张证书（例如双证），不能简单地按 DN 去重。
+
+主备库中的证书都是业务需要的，不存在“多余证书”的概念。比对的目的不是删除数据，而是：
+
+1. 找出主库多、从库多、字段不一致三类差异；
+2. 由业务人员在报表中逐条确认合并后采用“主”还是“备”；
+3. 以主库为基础，把从库多出的证书补进来，并按人工标注处理冲突，最终形成完整可用的主库数据。
+
+目前依赖人工执行 `sqlite3` 命令核对，存在以下问题：
+
+- 表中 `subject`/`issuer` 实际存储的是 **GBK/GB18030 字节**，而 SQLite 头部声明为 UTF-8，直接用 UTF-8 工具读取会出现乱码甚至错误合并；
+- 证书身份不是单纯的 DN，表主键为 `(subject, certtype)`；
+- 3000 条数据人工比对不可行，且容易遗漏；
+- 合并时如果经过 Java `String` 转换，会破坏原始 GBK 字节，导致写回的数据无法被原系统正确查询。
+
+因此需要一个可在生产环境直接运行的 Java CLI 工具，支持交互式操作和脚本化调用，完成主备库证书比对，并依据人工标注生成在主库执行的批量 SQL 脚本。
+
+---
+
+## 2. 建设目标
+
+1. 通过配置文件同时加载主库、从库两个 SQLite3 数据库。
+2. 以主库为基准，准确识别三类差异：
+   - **主库多**：仅主库存在；
+   - **从库多**：仅从库存在；
+   - **不一致**：两边都有，但比较字段不同。
+3. 提供 `set main/slave`、`compare`、`sql` 等交互命令。
+4. `compare` 只输出**一份报表**，包含三类差异；汇总统计直接打印在控制台。
+5. 报表预留“合并选择”字段，人工填写“主”或“备”。
+6. `sql` 基于人工标注生成**在主库上执行的批量 SQL 脚本**：
+   - 以主库为基准；
+   - 从库多的证书全部补入；
+   - 不一致的证书按人工标注选择主库版本或从库版本；
+   - 脚本由 DBA 在主库执行，工具本身不直接写数据库；
+   - 从库仅以 `ATTACH` 只读引用，DN 中文按原始字节复制。
+7. 不输出日志文件；运行信息、错误信息只打印到控制台。
+8. 兼容生产环境：CentOS 6.5、glibc 2.12、JDK 1.8、无外网、无 Maven。
+
+---
+
+## 3. 范围
+
+### 3.1 本期范围（In Scope）
+
+- 仅处理 `usercert_tab` 表；
+- 主库、从库两个数据库路径，以及 SQL 脚本输出目录的配置与切换；
+- 证书比对与三类差异统计；
+- 单份 CSV 报表（含人工合并选择列）；
+- 依据报表标注生成批量 SQL 脚本，由 DBA 在主库执行完成合并；
+- 控制台汇总、错误提示、退出码；
+- 交互式 Shell 与一次性命令两种使用方式；
+- 在测试库上完成验收。
+
+### 3.2 不在本期范围（Out of Scope）
+
+- HSM 硬件、密钥、私钥的读取或操作；
+- 证书签发、吊销、CRL、信任列表维护；
+- `trustlist_tab`、`apetcert_tab`、`sym_key` 等其他表的合并（SQL 脚本只操作 `usercert_tab`）；
+- 修改现有数据库表结构或索引；
+- Web UI、服务端常驻进程、定时任务；
+- 日志文件、审计日志；
+- 证书密码学有效性验证（签名链、私钥匹配等）；
+- 报表中除“主/备”之外的其他合并策略。
+
+---
+
+## 4. 术语
+
+| 术语 | 说明 |
+| --- | --- |
+| 主库（main） | 基础数据库，合并时以它为基础 |
+| 从库（slave） | 参与比对、提供差异证书的数据库 |
+| 批量 SQL 脚本 | `sql` 生成的 `merge-<时间戳>.sql`，由 DBA 在主库执行完成合并 |
+| DN / subject | 证书主体名称，表中为 `C=...,O=...,OU=...,CN=...` 形式的自定义顺序字符串，实际为 GBK 字节 |
+| SN | 证书序列号，表中为十六进制字符串，可能带前导 0，逻辑上唯一 |
+| certtype | 证书类型，表主键的一部分；同一 DN 可有多张不同 certtype 的证书（如双证） |
+| 身份键 | 判断“同一张证书”的键：`subject 原始字节 + certtype` |
+| 主库多 | 主库存在、从库不存在的证书 |
+| 从库多 | 从库存在、主库不存在的证书 |
+| 不一致 | 身份键相同，但 SN、有效期、状态等比较字段不同 |
+| 一致 | 身份键相同且比较字段全部相同；只在汇总统计中计数，不进入报表 |
+| 合并选择 | 报表中的人工标注列，取值“主”或“备” |
+
+---
+
+## 5. 用户与使用场景
+
+| 角色 | 场景 |
+| --- | --- |
+| 运维人员 | 例行核对主备证书差异，导出报表 |
+| 实施人员 | 数据迁移、容灾切换后核对并生成批量 SQL 脚本，交 DBA 在主库执行 |
+| 研发/测试 | 定位双证、续期、状态差异问题 |
+| 业务人员 | 在报表中逐条标注不一致证书采用主库还是从库版本 |
+| 自动化脚本 | 执行 `compare` 生成报表，标注后执行 `sql` 生成批量脚本 |
+
+---
+
+## 6. 数据规则（已按测试库验证）
+
+### 6.1 表结构
+
+`usercert_tab` 主要字段：
+
+| 字段 | 类型 | 说明 | 比对角色 |
+| --- | --- | --- | --- |
+| `organid` | varchar(32) | 机构标识 | 扩展字段 |
+| `subject` | varchar(256) | DN，GBK/GB18030 字节 | **身份键**、展示字段 |
+| `issuer` | varchar(256) | 颁发者，GBK/GB18030 字节 | 默认比较字段 |
+| `sn` | varchar(64) | 证书序列号，十六进制字符串 | **唯一编号**、默认比较字段 |
+| `pubkey_alg` | int | 公钥算法 | 扩展字段 |
+| `pubkey` | varchar(1032) | 公钥 | 扩展字段（比较哈希） |
+| `sign_alg` | int | 签名算法 | 扩展字段 |
+| `signinfo` | varchar(512) | 签名信息 | 扩展字段（比较哈希） |
+| `not_before` | varchar(14) | 生效时间 `yyyyMMddHHmmss` | 默认比较字段 |
+| `not_after` | varchar(14) | 失效时间 `yyyyMMddHHmmss` | 默认比较字段 |
+| `certfile` | varchar(2048) | PEM 证书内容 | 扩展字段（比较哈希） |
+| `certtype` | smallint | 证书类型 | **身份键** |
+| `opertime` | varchar(14) | 操作时间 | 扩展字段 |
+| `stat` | smallint | 状态 | 默认比较字段 |
+
+主键：`PRIMARY KEY (subject, certtype)`。
+
+> 重要：不能只用 DN 判断同一张证书。测试库中 `sge` 机构同一 DN 存在 `certtype=0` 和 `certtype=2` 两张证书，若按 DN 去重会误判。
+
+### 6.2 编码规则
+
+- SQLite `PRAGMA encoding` 返回 `UTF-8`，但 `subject`、`issuer` 等字段实际写入的是 **GBK/GB18030 字节**；
+- 使用 JDBC `getString()` 读取会把非法 UTF-8 字节替换为 `U+FFFD`，**严禁用于比对和回写**；
+- 必须通过 `hex(col)` 或 `CAST(col AS BLOB)` 获取原始字节；
+- 展示时按 GB18030 解码；解码失败时显示十六进制和转义字符；
+- 合并写入必须使用 SQLite 内部 `ATTACH + INSERT ... SELECT`，避免 Java 字符串编码转换。
+
+### 6.3 SN 规则
+
+- 测试库中 SN 均为十六进制字符串，且与证书 DER 序列号一致；
+- 存在前导 0，例如表中 `01971EE53B08`，DER 序列号为 `1971EE53B08`；
+- 比对时默认归一化：去首尾空白、转大写、去前导 0；展示和写回保留原始值；
+- SN 在单个库内逻辑唯一；跨库同 SN 视为同一序列号，但仍以身份键定位证书。
+
+### 6.4 时间规则
+
+- `not_before`、`not_after` 为 14 位 `yyyyMMddHHmmss` 本地时间字符串；
+- 测试库全部记录与证书 DER 有效期一致；
+- 比对按原始字符串比较，同时校验格式与 `not_before <= not_after`；
+- 可选出报告：已过期、未生效、有效，按当前系统时间计算。
+
+### 6.5 certtype 说明
+
+测试库中观察到 `certtype` 取值 `0/1/2/4/5`，同一 DN 可出现多个值。本期不硬编码业务含义，报表按数值展示；后续可通过配置映射为中文名称。
+
+---
+
+## 7. 功能需求
+
+### FR-01 配置加载
+
+- 支持 UTF-8 编码的 `config.properties`；
+- 至少包含：主库路径、从库路径、文本编码、DN 匹配方式、SN 归一化方式、报表目录；
+- 命令行参数优先于配置文件；
+- 配置文件不存在时使用内置默认值，但执行 `compare`/`sql` 前必须已有有效配置；
+- 配置错误时给出明确中文提示。
+
+**验收**：无参数启动进入交互模式；配置中的路径正确显示；路径错误时提示“文件不存在/不可读”，且不覆盖原配置。
+
+### FR-02 交互式 Shell
+
+- 启动后显示 `cert-compare>` 提示符；
+- 支持命令：`set`、`status`、`compare`、`sql`、`help`、`quit`/`exit`；
+- 命令大小写不敏感；
+- 支持单引号/双引号包裹含空格的参数；
+- 空行忽略；`Ctrl-D` 等同于 `quit`；
+- `TERM=dumb` 或非 TTY 时不输出 ANSI 颜色控制字符；
+- 单条命令失败不退出 Shell，仅打印错误。
+
+**验收**：连续执行多条命令，错误后仍可继续；`quit` 正常退出并返回退出码 0。
+
+### FR-03 set main
+
+```text
+set main <path>
+```
+
+- 校验文件存在、可读、是合法 SQLite 文件、包含 `usercert_tab` 表、必需字段齐全；
+- 成功时输出：绝对路径、文件大小、证书总数；
+- 仅保存路径，不长期持有数据库连接，避免锁库；
+- 无参数执行 `set main` 时显示当前主库路径与状态。
+
+### FR-04 set slave
+
+同 FR-03，用于设置从库路径。
+
+### FR-05 SQL 脚本输出位置
+
+- 不提供单独的输出目录设置命令；
+- `sql` 生成的脚本直接写入**运行时的当前工作目录**；
+- 脚本文件名固定为 `merge-<yyyyMMdd-HHmmss>.sql`，每次生成新文件，不覆盖历史脚本；
+- 启动脚本 `cert-compare.sh` 会先 `cd` 到程序目录，因此在服务器上脚本默认落在 `/app/cert-compare/`。
+
+### FR-06 status
+
+显示当前会话状态：
+
+- 主库、从库的绝对路径、是否存在、文件大小、证书数量；
+- 当前工作目录（即 SQL 脚本输出位置）；
+- 当前编码、DN 匹配方式、SN 归一化方式；
+- 主库与从库表结构是否一致；
+- 最近一次 `compare` 生成的报表路径；
+- 最近一次 `sql` 生成的脚本路径。
+
+### FR-07 compare 分类
+
+对两库全部证书按身份键分类：
+
+| 分类 | 判定 | 是否进入报表 |
+| --- | --- | --- |
+| 主库多（ONLY_MAIN） | 主库有、从库无 | 是 |
+| 从库多（ONLY_SLAVE） | 从库有、主库无 | 是 |
+| 不一致（DIFF） | 两边都有，至少一个默认比较字段不同 | 是 |
+| 一致（EQUAL） | 两边都有，默认比较字段全部相同 | 否，仅汇总计数 |
+
+默认比较字段：`sn`（归一化后）、`issuer`（原始字节）、`not_before`、`not_after`、`stat`。
+
+`compare` 不做过滤、不做查询、不接收业务筛选参数；所有差异一次性写入同一份报表，由使用者在报表中自行过滤。
+
+**验收**：测试库 `main.db`（4 条）与 `slave.db`（15 条）比对结果为：一致 0、主库多 1、从库多 12、不一致 3；报表共 16 条差异记录。
+
+### FR-08 compare 报表
+
+- 只生成**一份 CSV 报表**，不再拆分为多个文件；
+- 文件名：`compare-report-<yyyyMMdd-HHmmss>.csv`；
+- 控制台只打印汇总统计和报表路径，不打印逐条明细；
+- CSV 使用 UTF-8 + BOM，保证 Excel 打开中文不乱码；
+- 报表只包含主库多、从库多、不一致三类记录，不包含一致记录；
+- 报表至少包含以下列：
+
+| 列 | 说明 |
+| --- | --- |
+| 序号 | 报表内序号，便于人工沟通 |
+| 类型 | 主库多 / 从库多 / 不一致 |
+| DN | GB18030 解码后的 DN，便于阅读 |
+| DN_HEX | 原始 DN 字节十六进制，带 `HEX:` 前缀，用于精确匹配 |
+| CN | 从 DN 提取的 CN，仅展示 |
+| CERTTYPE | 证书类型 |
+| 主库SN / 从库SN | 两边 SN，不存在的一侧留空 |
+| 主库生效 / 主库失效 | 主库有效期，不存在的一侧留空 |
+| 从库生效 / 从库失效 | 从库有效期，不存在的一侧留空 |
+| 主库状态 / 从库状态 | 两边 `stat`，不存在的一侧留空 |
+| 差异字段 | 不一致时列出差异字段，如 `sn;not_after` |
+| 合并选择 | **最后一列，人工填写：主 / 备** |
+
+- `合并选择` 固定放在最后一列，便于 Excel 中直接拉到最右侧填写；
+- 报表不再包含“备注”列，数据异常信息改由 `compare` 在控制台“提示”中输出；
+- `DN_HEX` 统一加 `HEX:` 前缀，避免 Excel 把长十六进制转换成科学计数法；`sql` 读取时自动去掉前缀；
+- 默认不输出 `certfile`、`pubkey`、`signinfo` 等大字段；
+- 报表生成后，控制台打印报表绝对路径和汇总统计。
+
+### FR-09 人工标注规则
+
+- **主库多**：只有主库记录，`合并选择` 默认填 `主`，且只允许 `主`；
+- **从库多**：只有从库记录，`合并选择` 默认填 `备`，且只允许 `备`；
+- **不一致**：`合并选择` 默认留空，必须人工填写 `主` 或 `备`；
+- 空白或非法值（非“主/备”）在 `sql` 时视为错误，拒绝生成脚本并提示具体行号；
+- 人工只能修改 `合并选择` 列，不应修改 DN、DN_HEX、CERTTYPE 等定位列；
+- 报表保存为 UTF-8 或 GBK/GB18030 均可，`sql` 读取时自动识别。
+
+### FR-10 sql 生成计划
+
+`sql` 读取已人工标注的报表，校验后生成批量 SQL 脚本，并先打印计划：
+
+- 主库证书数、从库证书数；
+- 一致、主库多、从库多、不一致数量；
+- 写入记录数（从库多 + 不一致选备）；
+- 不一致中选择“主”的数量、选择“备”的数量；
+- 执行后主库应有的记录数；
+- 从库路径（脚本以 `ATTACH` 只读引用）与脚本输出路径；
+- 控制台给出“备份主库 + `sqlite3 主库 < 脚本`”的执行命令。
+
+`sql` 只写脚本文件，不连接主库执行、不修改任何数据库。
+
+### FR-11 批量 SQL 脚本内容
+
+- 脚本输出到运行时的当前工作目录，文件名 `merge-<yyyyMMdd-HHmmss>.sql`；
+- 脚本本身不携带证书数据，而是 `ATTACH DATABASE '<从库>' AS cert_src` 后按身份键复制；
+- **从库多**的证书：`INSERT OR REPLACE ... SELECT ... FROM cert_src.usercert_tab WHERE ...`；
+- **不一致 + 选择主**：不产生语句，主库版本自然保留；
+- **不一致 + 选择备**：用从库版本整行替换主库版本；
+- **主库多**：不产生语句，主库版本自然保留；
+- 所有语句按身份键（`hex(subject)` + `certtype`）定位，**不出现 DN 文本**，从库记录由 SQLite 内部按原始字节复制，DN 中的 GBK 中文不会被解码或重新编码；
+- 脚本使用 `BEGIN IMMEDIATE` / `COMMIT` 包裹，可重复执行且结果一致（幂等）；
+- 脚本末尾输出 `select 'rows', count(*)` 与 `PRAGMA integrity_check` 供执行后自检；
+- 脚本为 UTF-8（无 BOM），SQL 语句与字符串字面量全部为 ASCII，仅注释包含中文。
+
+### FR-12 sql 报表校验
+
+生成脚本前必须校验：
+
+1. 报表存在、可解析、列头完整；
+2. 报表中的差异记录与当前两库重新比对的结果一致（差异数量、身份键、类型）；报表中的 SN/有效期等字段仅供人工阅读，脚本数据始终取自当前数据库；
+3. 每条记录都有合法的“合并选择”；
+4. 报表中的差异键集合、类型与当前比对一致；差异集合发生变化时视为报表过期，必须重新 `compare`。
+
+校验失败时拒绝生成脚本，提示“报表已过期或标注不完整，请重新执行 compare 并标注”，不产生任何脚本。
+
+### FR-13 脚本执行与结果校验
+
+脚本由 DBA 在主库上执行：
+
+```bash
+cp -p /app/cert-compare/main.db /app/cert-compare/main.db.bak-$(date +%Y%m%d-%H%M%S)
+sqlite3 /app/cert-compare/main.db < /app/cert-compare/merge-20261104-213307.sql
+```
+
+执行后应满足：
+
+1. 脚本输出 `rows` 等于“主库数量 + 从库多数量”；
+2. `PRAGMA integrity_check` 返回 `ok`；
+3. 选择“主”的不一致记录保持主库版本；
+4. 选择“备”的不一致记录等于从库版本；
+5. 从库多记录全部存在，DN/SN/时间等字段与从库一致；
+6. 从库文件不被修改（脚本只读引用）；
+7. 主库 DN 中文按原始字节写入，`hex(subject)` 与来源库一致。
+
+### FR-14 错误与退出码
+
+- 不生成任何日志文件；
+- 运行信息、警告、错误只输出到控制台；
+- `--debug` 时可在控制台输出详细堆栈；
+- 退出码：
+
+| 退出码 | 含义 |
+| --- | --- |
+| 0 | 成功（交互模式正常退出） |
+| 1 | 未预期内部错误 |
+| 2 | 参数/配置错误 |
+| 4 | 数据库打开失败、表结构不兼容、完整性校验失败 |
+| 5 | 报表过期、标注非法、SQL 脚本生成/写入失败 |
+
+### FR-15 一次性命令模式
+
+支持不进入交互 Shell，直接执行：
+
+```bash
+# 生成报表
+java -Dfile.encoding=UTF-8 -jar cert-compare.jar compare \
+  --config /app/cert-compare/config.properties
+
+# 人工标注报表后生成批量 SQL
+java -Dfile.encoding=UTF-8 -jar cert-compare.jar sql \
+  --config /app/cert-compare/config.properties \
+  --report /app/cert-compare/reports/compare-report-20261104-213307-annotated.csv
+
+# 由 DBA 在主库执行生成的脚本
+sqlite3 /app/cert-compare/main.db < /app/cert-compare/merge-20261104-213307.sql
+```
+
+一次性模式与交互模式共用同一套比对、报表、SQL 生成引擎，结果必须一致。
+
+### FR-16 help
+
+- `help` 输出命令列表与示例；
+- `help compare`、`help sql` 输出用法说明；
+- 未知命令给出提示，不退出 Shell。
+
+---
+
+## 8. 非功能需求
+
+| 编号 | 需求 |
+| --- | --- |
+| NFR-01 兼容性 | 可在 CentOS 6.5 / glibc 2.12 / JDK 1.8 上运行；无外网依赖；不要求服务器安装 Maven |
+| NFR-02 性能 | 3000 张证书：`compare` ≤ 3 秒，`sql` ≤ 3 秒；生成的脚本可在 sqlite3 3.6.20 上执行；JVM 内存 ≤ 256MB |
+| NFR-03 编码正确性 | DN/issuer 原始字节零损失；合并前后十六进制一致；脚本中不出现 DN 文本；禁止 `U+FFFD` 参与比较 |
+| NFR-04 数据安全 | 工具默认只读源库；不直接修改任何数据库，只生成 SQL 脚本；不生成日志文件 |
+| NFR-05 可靠性 | 脚本使用事务包裹且可重复执行；执行失败可按备份回滚；从库 SHA-256 不变 |
+| NFR-06 易用性 | 中文提示；报表可直接用 Excel 标注；错误信息包含原因与处理建议 |
+| NFR-07 可维护性 | 分层设计；核心逻辑有单元测试；不修改现有表结构 |
+| NFR-08 可部署性 | 单个可执行 fat jar + 配置文件 + 启动脚本即可部署 |
+| NFR-09 报表兼容性 | 报表读取兼容 UTF-8 BOM、UTF-8、GBK/GB18030 三种保存方式 |
+
+---
+
+## 9. 交互与输出示例
+
+### 9.1 设置数据库
+
+```text
+cert-compare> set main /app/cert-compare/main.db
+[OK] 主库: /app/cert-compare/main.db (459,776 字节, 4 张证书)
+
+cert-compare> set slave /app/cert-compare/slave.db
+[OK] 从库: /app/cert-compare/slave.db (459,776 字节, 15 张证书)
+```
+
+### 9.2 比对
+
+```text
+cert-compare> compare
+
+主库: /app/cert-compare/main.db    证书数: 4
+从库: /app/cert-compare/slave.db   证书数: 15
+
+汇总:
+  一致        0
+  主库多      1
+  从库多     12
+  不一致      3
+  差异合计   16
+
+报表:
+  /app/cert-compare/reports/compare-report-20261103-205500.csv
+
+请按“合并选择”列标注：主 或 备，然后执行 sql 生成批量脚本。
+```
+
+### 9.3 报表示例（CSV）
+
+```csv
+序号,类型,DN,DN_HEX,CN,CERTTYPE,主库SN,从库SN,主库生效,主库失效,从库生效,从库失效,主库状态,从库状态,差异字段,合并选择
+1,从库多,"C=CN,ST=北京,L=北京,O=信雅达,OU=双证,CN=172.1.40.188","HEX:433D434E2C...",172.1.40.188,0,,01971EE53B08,,,20250529160000,20260529160000,,0,,备
+2,主库多,"C=cn,O=CFCA OCA1 SM2,OU=Local RA OCA1,OU=Business Customers,CN=041@...@陈超@...","HEX:433D636E2C...",041@...@陈超@...,1,1177482454,,20260806025132,20270806025132,,,,0,,主
+14,不一致,CN=diff-sn-01,"HEX:434E3D646966662D736E2D3031",diff-sn-01,0,0A0B0C01,0A0B0C11,20260101000000,20301231235959,20260101000000,20301231235959,0,0,sn,主
+15,不一致,CN=diff-stat-03,"HEX:434E3D646966662D737461742D3033",diff-stat-03,5,0A0B0C03,0A0B0C03,20260101000000,20301231235959,20260101000000,20301231235959,0,1,stat,主
+16,不一致,CN=diff-time-02,"HEX:434E3D646966662D74696D652D3032",diff-time-02,2,0A0B0C02,0A0B0C02,20260101000000,20301231235959,20260101000000,20311231235959,0,0,not_after,备
+```
+
+### 9.4 生成批量 SQL
+
+```text
+cert-compare> sql --report /app/cert-compare/reports/compare-report-20261104-213307-annotated.csv
+
+SQL 生成计划:
+  主库证书数                4
+  从库证书数               15
+  一致                   0
+  主库多                  1
+  从库多                 12
+  不一致                  3
+  写入(从库多+选备)           13
+  不一致选主                2
+  不一致选备                1
+  执行后主库记录数             16
+  从库(只读引用)             /app/cert-compare/slave.db
+  SQL 文件               /app/cert-compare/merge-20261104-213307.sql
+
+请在主库上执行（执行前先备份）：
+  cp -p /app/cert-compare/main.db /app/cert-compare/main.db.bak-$(date +%Y%m%d-%H%M%S)
+  sqlite3 /app/cert-compare/main.db < /app/cert-compare/merge-20261104-213307.sql
+
+执行后主库记录数应为 16 条；脚本末尾会输出 rows 与 integrity_check 结果。
+```
+
+执行脚本后：
+
+```text
+rows|16
+ok
+```
+
+---
+
+## 10. 验收标准
+
+| 编号 | 场景 | 期望结果 |
+| --- | --- | --- |
+| AC-01 | `set main/slave` | 路径正确显示；主库 4 条、从库 15 条；当前目录可写 |
+| AC-02 | `compare` | 一致 0、主库多 1、从库多 12、不一致 3；控制台只打印汇总 |
+| AC-03 | 报表 | 只生成一份 CSV，含 16 条差异记录；“合并选择”为最后一列，无“备注”列 |
+| AC-04 | 默认标注 | 主库多默认“主”，从库多默认“备”，不一致留空 |
+| AC-05 | 标注后 sql | 生成 1 个 SQL 脚本；1 条 INSERT OR REPLACE（13 个身份键）；无 UPDATE 语句 |
+| AC-06 | 不一致选主 | 执行脚本后该身份键字段与主库一致 |
+| AC-07 | 不一致选备 | 执行脚本后该身份键字段与从库一致 |
+| AC-08 | 报表编码 | UTF-8 BOM 报表 Excel 打开中文正常；GBK 保存后 sql 仍可读取 |
+| AC-09 | 报表过期 | 数据库变化后使用旧报表生成脚本，拒绝执行并提示重新 compare |
+| AC-10 | 标注非法 | 不一致记录留空或填“其他”，生成脚本被拒绝并提示行号 |
+| AC-11 | 同一 DN 不同 certtype | `sge` 的 certtype=0 与 2 均保留，不互相覆盖 |
+| AC-12 | 字节保持 | 执行脚本后每条 `hex(subject)` 与来源库一致，`typeof(subject)='text'` |
+| AC-13 | 源库只读 | 生成脚本前后两源文件 SHA-256 不变；执行后从库 SHA-256 不变 |
+| AC-14 | 无日志文件 | 运行过程不生成 `*.log`，信息仅输出到控制台 |
+| AC-15 | 3000 条模拟数据 | compare ≤ 3s，sql ≤ 3s，内存 ≤ 256MB |
+| AC-16 | 脚本兼容性 | 脚本可在服务器 sqlite3 3.6.20 上一次执行成功，重复执行结果一致 |
+
+---
+
+## 11. 假设、约束与待确认事项
+
+### 11.1 已确认
+
+- `set main` / `set slave` 设置主库、从库路径；
+- `sql` 生成的脚本直接写入运行时的当前工作目录；
+- `sql` 只生成脚本，不直接修改任何数据库；脚本由 DBA 在主库执行；
+- 脚本通过 `ATTACH` 从从库按原始字节复制，DN 中文不经过字符集转换；
+- 证书身份键为 **DN + certtype**，SN 作为唯一编号参与比较；
+- 主库多、从库多、不一致三类差异均进入同一份报表；
+- 合并选择只有“主”“备”两种；
+- 不生成日志文件。
+
+### 11.2 假设
+
+- `usercert_tab` 结构在生产与测试环境一致；
+- 证书数量约 3000，单库文件规模在数十 MB 以内；
+- 生产比对可在业务低峰或维护窗口执行，避免与 HSM 应用并发写冲突；
+- 服务器 `/tmp` 可写且允许执行（sqlite-jdbc 需解压本地库）；
+- 业务人员使用 Excel 或文本编辑器修改报表的“合并选择”列。
+
+### 11.3 待确认
+
+1. `certtype` 各数值的业务含义（0/1/2/4/5），是否需要报表中文映射；
+2. 生产环境是否允许停应用/只读挂载，或必须在线比对；
+3. 是否需要同时核对 `trustlist_tab`、`apetcert_tab`（本期不做）；
+4. SQL 脚本文件命名与保留策略（当前为 `merge-<时间戳>.sql`，不覆盖历史脚本）；
+5. SN 前导 0 归一化是否与现网查询逻辑一致；
+6. DN 是否需要忽略属性大小写/顺序的“近似匹配”（本期默认严格字节匹配）；
+7. 主库多/从库多的“合并选择”是否允许改成其他值（本期固定为主/备，确保不丢证书）。
+
+---
+
+## 12. 里程碑
+
+| 阶段 | 内容 | 交付物 |
+| --- | --- | --- |
+| M1 | 环境验证、需求与设计 | 本文件、`设计文档.md` |
+| M2 | 工程骨架、配置、set/status | 可启动的 CLI、配置加载、库校验 |
+| M3 | compare 引擎与单份报表 | 三类差异、控制台汇总、CSV |
+| M4 | 报表读取、标注校验、批量 SQL 生成 | SQL 脚本、脚本执行验证 |
+| M5 | 测试与部署 | 单元/集成测试、3000 条压测、部署脚本、验收记录 |
+
+---
+
+## 13. 附：测试库现状摘要
+
+| 项目 | main.db | slave.db |
+| --- | --- | --- |
+| 文件大小 | 459,776 字节 | 459,776 字节 |
+| `usercert_tab` 记录数 | 4 | 15 |
+| certtype 分布 | 0:1、1:1、2:1、5:1 | 0:5、2:3、4:1、5:6 |
+| 重复身份键 | 无 | 无 |
+| 同一 DN 多证书 | 无 | 有（`sge`，certtype 0/2） |
+| 重复 SN | 无 | 无 |
+| 日期格式异常 | 无 | 无 |
+| 完整性检查 | ok | ok |
+
+其中 3 条为专门构造的“不一致”测试数据（主备同 DN + certtype，SN/有效期/状态不同）：
+
+| DN | CERTTYPE | 差异 | 主库 | 从库 |
+| --- | --- | --- | --- | --- |
+| `CN=diff-sn-01` | 0 | SN | `0A0B0C01` | `0A0B0C11` |
+| `CN=diff-time-02` | 2 | 失效时间 | `20301231235959` | `20311231235959` |
+| `CN=diff-stat-03` | 5 | 状态 | `0` | `1` |
+
+按本期规则，测试库的预期比对结论为：
+
+- 主库多：**1 张**；
+- 从库多：**12 张**；
+- 不一致：**3 张**；
+- 一致：0 张；
+- 报表差异记录：16 条；
+- 执行 SQL 后（示例标注：2 条选主、1 条选备）：**16 张**。