Function mysql_shadow_invocation 

pub fn mysql_shadow_invocation(
    conn: &MysqlConnection,
    shadow_db: &str,
) -> SqlInvocation

Build the mysql invocation that applies the attacker-crafted tables-only dump into a pre-created SHADOW database by NAME (inc2 Stage D) — the UNTRUSTED side of the atomic-shadow split. Meant to run as the TARGET PROJECT’S own NON-SUPERUSER role (the driver resolves that credential) so a crafted statement needing elevated privileges (LOAD DATA INFILE, INTO OUTFILE, creating a LANGUAGE-escalating routine) fails at apply. The dump (which carries NO USE) is fed on stdin and lands in shadow_db because it is named as the default database positionally. Host/port/user explicit; password in MYSQL_PWD; shadow_db is a driver-derived identifier (not a credential), so argv is correct.

Used for BOTH the inc2 tables-only base restore AND the binlog true-delta member replay (both apply attacker-crafted SQL as the least-privilege shadow user). --local-infile=0 is belt-and-suspenders: it disables client-side LOAD DATA LOCAL INFILE, so a crafted dump/member cannot read a file off the ephemeral client container (the apply user already lacks FILE, which blocks server-side LOAD DATA INFILE/INTO OUTFILE).