Shadow runs in-cycle; guarded share path

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -131,6 +131,29 @@ try {
     if ($ShadowMode -and $ShareManifestPath) {
         # Shadow: install from the share exactly as today (no payload resolve,
         # no common merge - the share already carries its own common scope).
+        #
+        # GUARDED, because the share is a TRANSIENT mount. GE-Enforce.ps1 maps it
+        # for the length of its cycle and unmounts at the end, so a caller that
+        # runs on its own schedule finds the drive gone. Handing the engine a
+        # path on a dead drive returned nothing usable and the summary zero-filled
+        # to 0 installed / 0 skipped / 0 failed - a silent nothing that reads
+        # exactly like a healthy no-op. Shadow must run INSIDE the enforce cycle;
+        # this makes the alternative loud instead of invisible.
+        if (-not (Test-Path -LiteralPath $ShareManifestPath)) {
+            $reason = "share manifest not reachable at $ShareManifestPath " +
+                      '(is the share still mounted? shadow must run inside the ' +
+                      'enforce cycle)'
+            Write-Log $reason 'WARN'
+            Write-ShopdbEventLog -Message ("GE-Enforce shadow could not reach the share manifest for scope '$Scope': $reason") -EntryType 'Error' -EventId 1002
+            try {
+                $failReport = New-ShopdbReport -Scope $Scope -AppliedVersion 0 -Summary @{
+                    Installed = 0; Skipped = 0; Failed = 1; Filtered = 0; EnforcerVersion = '2.6'
+                    Results = @(@{ Name = '(share-manifest)'; Action = 'failed'; Message = $reason })
+                }
+                Send-ShopdbReport -Config $config -Report $failReport | Out-Null
+            } catch {}
+            exit 0
+        }
         $manifestToRun = $ShareManifestPath
     } else {
         # Optional common-scope inheritance (OFF by default; displays are