SOLIDWORKS Bridge

@@ -308,6 +308,18 @@ not a compound file. Both are accepted — an older document from an archive rea is one — and the real headers are pinned in the suite, because a check on a format this bridge does not own is only as good as its samples. +Before any of that, the sweep asks whether it **fits**. Marker and floor catch an+empty file and a foreign one; neither catches *the right file, cut short* — the+marker sits at offset 4, so every prefix of a real document carries it, and a+truncation past 16 KB clears the floor. The format offers nothing cheap that+would catch it. So the sweep estimates what the session will write (on-disk sizes+for documents it can measure, an upward estimate for the rest) and **refuses to+begin** when the recovery volume has less than twice that free:+`insufficient_headroom`, naming free bytes, needed bytes and the shortfall, with+nothing written and nothing closed. It asks again before *every* save, because+the sweep is itself one of the things filling the volume. `headroomBytesBefore`+and `estimatedWriteBytes` are reported on every run, including successful ones.+ The dialog census runs **before every save and before every close**, not once per batch. A save can raise a prompt of its own (a missing external reference, a rebuild question), and under a per-batch check a dialog raised by the first save@@ -421,7 +433,21 @@ not.  ## Roadmap -- v0.7.2 (this): **the format check, measured.** Pass 23 asked for the recovery+- v0.7.3 (this): **it refuses to start a sweep it cannot fit.** Pass 24 found the+  gap the 0.7.2 checks structurally cannot close: the container marker lives at+  offset 4, so ANY prefix of a real document carries it, and a write that reaches+  20 KB of a 500 KB assembly clears the 16 KB floor too. Marker and floor catch+  "empty" and "not a SOLIDWORKS file"; neither catches **the right file, cut+  short**, and the format has no constant tail and no length field to check+  against (measured). The remaining defence is the decision to begin: the sweep+  now estimates what the session will write, refuses to start when the recovery+  volume holds less than twice that (`insufficient_headroom`, naming free bytes,+  needed bytes and the shortfall, nothing written, nothing closed), and asks again+  before every save because it is itself one of the things filling the disk.+  `headroomBytesBefore` and `estimatedWriteBytes` are reported always. A refusal+  no longer leaves an empty recovery folder behind for `swx_recover_list` to+  present as a rescue. 329 tests.+- v0.7.2: **the format check, measured.** Pass 23 asked for the recovery   file to be verified against the OLE compound-document signature   `D0 CF 11 E0 A1 B1 1A E1` — the answer every reference gives for what a SLDPRT   is. Measured against 166 real documents from three hardware repositories on this

@@ -29,6 +29,15 @@ adom-bridge --ai-thread "<your thread>" swx_bom '{"path":"C:\\designs\\gearbox.s - **The user's own files are never written over.** A document they had saved and   then edited is copied into recovery under a new name; their file on disk is   untouched and their unsaved changes still survive.+- **It refuses to start a sweep that will not fit.** Before writing anything it+  estimates the session and compares it with free space on the recovery volume;+  if there is less than twice the estimate it answers `insufficient_headroom`+  with the numbers, having written and closed NOTHING. Free some space, or point+  `recoveryDir` at a volume with room. It re-checks before every save, so a disk+  that fills mid-sweep stops it too — what was already written stays written and+  nothing is closed. `headroomBytesBefore` and `estimatedWriteBytes` are in every+  reply. The reason is a truncation nobody can detect afterwards: a recovery file+  can be the RIGHT document CUT SHORT and nothing in the file would show it. - **"On disk" is checked structurally.** Each recovery file must LOOK like a   SOLIDWORKS document (the container marker at its head) and be at least 16 KB;   both are reported per document as `recoverySignatureOk` and `recoveryBytes`. A

@@ -111,7 +111,7 @@ templates**, alisamsam **22**. | 43 | **Import / resource lifecycle — no leaked temps, drainable, enumeration never wedges** | ✗ | **✓ 0.5.0** — enumeration degrades above a cap (`{count,truncated,sample}`, never a 30s timeout+kill); `swx_close_import_temps` drains STEP/IGES `…\Temp\swx<pid>\IC~~\…` temps in the DEFAULT posture (path is the ownership proof, survives a pid change); import asserts a net +1. Root-caused a live 1342-doc / 8 GB leak. **0.5.3**: the resolved `%TEMP%` is the WHOLE location proof (8.3-aware, no shape-test fallback), and with no resolved root the drain refuses (`temp_root_unknown`) instead of closing nothing quietly. **0.5.4**: the report says which root it compared against (`tempRoot`) and counts documents that carry the launcher's tail but sit elsewhere (`importTempsElsewhere` + a sample), so a drain that matched nothing can no longer claim it drained everything. **0.5.6**: the victim is CLOSED by the path it was chosen by (it was closed by TITLE, which `CloseDoc` resolves by name without prompting — a live session held temps sharing a saved file's title), a shared title is refused and reported, and every close is verified by path — the mismatch case is real, because ab's `%TEMP%` need not be the one SOLIDWORKS used | ✗ | ✗ | ✗ | ✗ | ✗ | | 44 | **Graceful QUIT that is measured, not assumed** (never a kill, never answers a dialog, proves the exit from the process census) | ✗ | **⚠ 0.5.3 mock-proven, UNPROVEN LIVE** — a rung ladder (a `ExitApp` → f Restart Manager *without* `RmForceShutdown`), pinned at rung (a); 7 re-measured preconditions where UNKNOWN refuses and `force` waives the UNSAVED question ONLY; every COM reference released before and after each rung, with outstanding refs named in the report; success = *this pid AND this creation time* absent from the census, never `GetActiveObject`; per-session children reaped while the documented platform daemons are left alone; a dialog stops the ladder permanently and is never answered; nothing disowned until the exit is verified. every precondition re-measured before EVERY rung (a mid-ladder refusal is a real outcome), the exit POLLED to the rung's budget rather than sampled once (a real `ExitApp` returns before the process goes), the dialog census covering the `swCefSubProc` web-view children by parentage, the count cross-checked against the enumeration, and the message rungs re-verifying window ownership before they send. `tools/quit-gate.py` proves the session was bridge-launched and has not been run | ✗ | ✗ | ✗ | ✗ | ✗ | -| 45 | **Closes its own documents without asking — and loses nothing doing it** (preserve-then-close: every open document written to a recovery folder and verified there BEFORE anything closes) | ✗ | **⚠ 0.7.2 mock-proven, NOT RUN LIVE** — `swx_shutdown {reason}` / `swx_close_all_safely {reason}` save every open document into `…\exports\recovery\<timestamp>\`, verify it, close parents before children, then quit; no write opt-in, no per-document confirmation (Drew, 2026-09-11: *"I despise every time you ask for help closing"*). The authorization is to CLOSE, not to lose anything, so the consent question is replaced by checkable rules: the recovery file is verified STRUCTURALLY — it must be a recognised SOLIDWORKS container AND at least 16 KB, published as `recoverySignatureOk` + `recoveryBytes`, and it fails CLOSED (`exists()` passes a zero-byte file and any byte floor passes a truncated one; both are what a full disk leaves). The container marker was MEASURED on 166 real documents from three hardware repositories, because the signature every reference names for a SOLIDWORKS document (OLE compound file) appears in NONE of them — verifying that, as pass 23 specified, would have refused to close every document on a modern install; a document that could not be written is left OPEN and named in `remaining`; the user's saved-then-edited file is copied to recovery under a new name and their original is asserted byte-for-byte unchanged; `SaveAs3` uses `swSaveAsOptions_Silent` ALONE so the document RE-POINTS at the recovery file and the close key is read from the document after the save; a dialog stops the sweep and is never answered, with the census taken before EVERY save and EVERY close (a save can raise a prompt of its own, which a per-batch census could not see until the closes had happened); and an UNREADABLE window census is its own outcome — saves proceed, nothing closes, `stoppedBy:"dialogCensusUnknown"`. Ordering is proven from a journal, not from the end state. Every rule is mutation-verified (disable it and exactly one test fails). **No live run yet** — first live use is `swx_close_all_safely` alone | ✗ | ✗ | ✗ | ✗ | ✗ |+| 45 | **Closes its own documents without asking — and loses nothing doing it** (preserve-then-close: every open document written to a recovery folder and verified there BEFORE anything closes) | ✗ | **⚠ 0.7.3 mock-proven, first live close PENDING** — `swx_shutdown {reason}` / `swx_close_all_safely {reason}` save every open document into `…\exports\recovery\<timestamp>\`, verify it, close parents before children, then quit; no write opt-in, no per-document confirmation (Drew, 2026-09-11: *"I despise every time you ask for help closing"*). The authorization is to CLOSE, not to lose anything, so the consent question is replaced by checkable rules: the sweep REFUSES TO START when the recovery volume cannot hold the session it is about to write (`insufficient_headroom` with free/needed/shortfall, nothing written, nothing closed), re-checked before every save, with `headroomBytesBefore` and `estimatedWriteBytes` always reported — because a recovery file can be the RIGHT document CUT SHORT and no check on the file can tell (the marker is at offset 4, so every prefix carries it); the recovery file is verified STRUCTURALLY — it must be a recognised SOLIDWORKS container AND at least 16 KB, published as `recoverySignatureOk` + `recoveryBytes`, and it fails CLOSED (`exists()` passes a zero-byte file and any byte floor passes a truncated one; both are what a full disk leaves). The container marker was MEASURED on 166 real documents from three hardware repositories, because the signature every reference names for a SOLIDWORKS document (OLE compound file) appears in NONE of them — verifying that, as pass 23 specified, would have refused to close every document on a modern install; a document that could not be written is left OPEN and named in `remaining`; the user's saved-then-edited file is copied to recovery under a new name and their original is asserted byte-for-byte unchanged; `SaveAs3` uses `swSaveAsOptions_Silent` ALONE so the document RE-POINTS at the recovery file and the close key is read from the document after the save; a dialog stops the sweep and is never answered, with the census taken before EVERY save and EVERY close (a save can raise a prompt of its own, which a per-batch census could not see until the closes had happened); and an UNREADABLE window census is its own outcome — saves proceed, nothing closes, `stoppedBy:"dialogCensusUnknown"`. Ordering is proven from a journal, not from the end state. Every rule is mutation-verified (disable it and exactly one test fails). **No live run yet** — first live use is `swx_close_all_safely` alone | ✗ | ✗ | ✗ | ✗ | ✗ |  *(45 numbered rows; rows 29–31 are the N/A block that accounts for most of the Fusion verb-count gap. Rows 36–42 added 2026-09-08 from the crate build and the launch-resilience rounds; rows 43–45 from the import-leak, quit and safe-close work — the bar is "significantly more powerful than the MCP servers", so every robustness capability gets a row with its evidence level, not a slogan.)* 

@@ -1697,6 +1697,12 @@ zero documents open and every precondition satisfied honestly rather than waived The consent question moves; the data-safety guarantees do not. The new sequence carries its own rules, each one checkable and each one mutation-verified: +- **A sweep that will not fit does not start.** The session's write size is+  estimated and compared with free space on the recovery volume before anything+  is written, and again before every save. A recovery file can be the RIGHT+  document CUT SHORT — the container marker is at offset 4, so every prefix+  carries it, and a truncation past 16 KB clears the floor — so a truncation this+  bridge could not detect afterwards is one it declines to cause. - **Nothing closes before it is on disk**, verified per document, and "on disk" is   a STRUCTURAL question: the recovery file must be a recognised SOLIDWORKS   container and at least 16 KB (`recoverySignatureOk` and `recoveryBytes` in the