SOLIDWORKS Bridge

@@ -241,9 +241,20 @@ The suite is built so it cannot lie:   child's stdout, orphan cleanup, and a slow verb that must not block   `swx_progress`. -Everything the bridge writes goes under one root-(`%LOCALAPPDATA%\Adom Bridge\bridges-cache\solidworks\`, or `SWX_SCRATCH_DIR`-for tests), pruned at 48h / 300 files, and removed in full by `swx_uninstall`.+Everything the bridge writes goes under one data root,+`%LOCALAPPDATA%\Adom Bridge\solidworks-data\` (or `SWX_SCRATCH_DIR` for tests):+the recovery folders, the action ledger, the ownership registry, launch state,+verb timings and the bridge's own exports. **Never inside ab's install cache**+(`bridges-cache\solidworks\`, where the bridge itself is installed): ab's updater+re-extracts that directory, and until 0.9.0 the data lived there — the 0.8.9+auto-install of 2026-09-18 deleted every recovery folder from the day before.+The first start of 0.9.0 migrates anything still in the old location (copied,+verified byte for byte, originals left in place; see+`migrated-from-legacy.json`), and a sweep refuses outright+(`recovery_inside_install_dir`) if its recovery folder would land under an install+location. Exports are pruned at 48h / 300 files. `swx_uninstall` removes the+bridge's own bookkeeping and exports, and never the recovery folders or the+ledger — a recovery file can be the only copy of work the user had not saved.  `swx_com_eval {"expr":"$sw.RevisionNumber()","reason":"..."}` is the maintainer escape hatch: a late-bound call chain rooted at `$sw` or `$doc`, for proving out@@ -282,7 +293,7 @@ those are different permissions. What replaces the question is a sequence: **nothing closes before it is on disk.**  Every document, the user's or the bridge's, saved or not, is written to-`<bridge cache>\exports\recovery\<yyyymmdd-hhmmss>\` and verified on disk+`%LOCALAPPDATA%\Adom Bridge\solidworks-data\recovery\<yyyymmdd-hhmmss>\` and verified on disk before anything closes. A document that could not be written is *not* closed — closing a document whose only copy is in memory is the one outcome this design exists to prevent, and the response names any such document in `remaining`. A@@ -434,7 +445,340 @@ not.  ## Roadmap -- v0.7.6 (this): **ask the evidence already in hand, and tell the user how to+- v0.9.0 (this): **the user's rescued work no longer lives where an update+  deletes it — SEV-1, measured live 2026-09-30.** ab's install cache for this+  bridge, `bridges-cache\solidworks`, was found CREATED 2026-09-18 09:42 by the+  auto-install of 0.8.9: the updater re-extracts the whole directory, and that+  directory was also this bridge's data root. Every recovery folder from+  2026-09-17 went with it, with the ledger, the ownership registry and the scratch+  documents. Only test documents were in them. The recovery folder exists to hold+  the ONLY copy of work the user had not saved; it cannot live in a directory a+  routine update empties.++  So the data root is now `%LOCALAPPDATA%\Adom Bridge\solidworks-data\`, a+  sibling of the install cache. The first start MIGRATES what an older bridge left+  there — the recovery folders, the ledger, the ownership and launch registries+  (with their previous generations), timings, settings and exports — copied,+  verified byte for byte (streamed), never over an existing file, the originals+  LEFT where they were, and each file ONCE: `migrated-from-legacy.json` is+  cumulative, so a copy the user deletes stays deleted, while a copy that failed+  verification (and was removed, so no half-copied rescue ever looks whole) is+  retried at the next start. Every copy is made under a temporary name and+  renamed into place only once it verifies, so a start that dies mid-copy — a+  crash, or ab killing a bridge slow to answer `/status` — never leaves a+  truncated rescue under the real name, where never-overwrite would protect it+  forever. The migration runs BEFORE the bridge reads its own state, so the first+  start after the move already owns what the older bridge created. `swx_recover_list` still reads the old location, marks each sweep+  there `atRiskFromUpdate`, and says whether a verified copy exists (`copiedTo`)+  or that folder is the only one; in the data root, a file whose copy has not+  landed is `notCopiedYet` with its `legacyPath` — never "gone" — and a+  half-copied temporary whose original has since disappeared is a `partialCopy`:+  never a rescue, and never hidden. And a sweep REFUSES — `recovery_inside_install_dir`,+  before writing or closing anything — if its recovery folder would land under+  the install directory or ab's install cache, however the path is spelled+  (links, `..`, case, either separator). One limit, stated: the update that+  installs 0.9.0 re-extracts the old directory BEFORE 0.9.0 first runs, so on a+  machine ab updates from 0.8.9 the migration will most likely find nothing. The+  move is what protects every update after this one.++  Also: **a clean, saved document is RECORDED as closed in place.** Its own file+  is its preservation, so the sweep wrote no copy — and the manifest had no entry+  for it, so `swx_recover_list` could not say "your file was closed at its own+  path, untouched" (measured live 2026-09-30 on Drew's+  `R_0603_1608Metric_1.step-1.sldprt`). The sweep now records such a document as+  `closedInPlace` with the original's size and mtime, and each listed sweep+  carries `closedInPlace` entries that MEASURE the file: untouched, changed since,+  or no longer at its path. A pre-0.9.0 record is read too, with its close+  reported as unknown rather than the `false` it wrote.++  And the live gates now reach the bridge the way ab runs it: through+  `adom-bridge <verb>` routing to the bridge ab hosts, since ab 2.1.163 terminates+  a side-loaded dev copy on 24695 within 30 s (`SWX_BRIDGE_URL` forces the old+  loopback route); the quit gate passes `userAuthorized:true`, the standing+  authorization, instead of the write-gate pair. The full quit cycle PASSED LIVE+  2026-09-30 through the hosted bridge (docs/QUIT-INVESTIGATION.md §5.14). A+  release is now a deploy: ab hosts whatever the published manifest names.+  413 tests.+- v0.8.9: **the never-ask rule defaults to governed, like everything else+  here.** 0.8.8's per-file policy still leaked twice: a blockquoted ask in a+  `docs/` RUNBOOK slipped, because a runbook instructs even though it lives under+  docs, and `skills/**/SKILL.md` was never scanned at all. Both are the same+  shape — a rule stated as "these files are governed" is wrong by omission the+  moment somebody adds a file. So it is inverted, matching every other default in+  this bridge (unknown kind takes the strictest floor, an unreadable census is not+  permission, an unverifiable destination is not free): every `.md`, `.rs` and+  `.py` in the repo is scanned and NOTHING is stripped, with a short allowlist of+  files that DESCRIBE — the README and the named reports under `docs/` — where+  quoted and code spans are. A new file is governed until somebody says otherwise.++  Also: a sweep's manifest now records its FAILURES, with whatever structure the+  host gave. A host failure is the case where the folder holds fewer files than+  there were documents, so it is the one thing a reader most needs explained — and+  the record was being deleted precisely then, because nothing had been preserved.+  A timeout, which kills the com host before it can answer, reports its own facts+  rather than a null that cannot be told from having thrown the detail away. 402+  tests.+- v0.8.8: **the fix for the changelog blinded the file an agent follows.**+  0.8.7 taught the never-ask pin to skip quoted text, code spans and blockquotes+  in every markdown file, so a changelog could record the sentences it catches.+  Measured afterwards: in SKILL.md a blockquoted instruction and a backticked one+  both slipped, while the same sentence in plain prose was caught. SKILL.md is not+  documentation about the bridge — it is what an agent LOADS AND FOLLOWS, and+  markdown emphasis there is presentational. A model reading a blockquote does not+  conclude the sentence is an example.++  So the policy is per FILE, never per syntax: README.md and docs/** describe, and+  their quoted spans are stripped; SKILL.md strips NOTHING. Both of the adversary's+  SKILL.md sentences are pinned as must-catch, and the changelog quote above stays+  allowed.++  Three guards were also shipping unpinned, each proven by a surviving mutation:+  `write_manifest`'s `verified` hard-coded to true, `host_failure_entry` dropping+  `hostError`, and `acknowledge_only` loosened to one-or-more buttons. The first+  two are the pass-29 and pass-30 fixes — the manifest is the permanent record of+  WHY a document was not preserved — and nothing could tell, because every sweep+  test preserved everything. A refused-document sweep now pins both. 400 tests.+- v0.8.7: **the changelog broke the test that reads it.** The 0.8.6 entry+  below quotes both bypass sentences as examples of what the never-ask pin must+  catch — and the pin read them as violations, so master was RED on a clean+  checkout. I measured the suite green and then wrote that paragraph, which is+  the whole lesson: a documentation edit after the last test run is an untested+  change.++  The fix is not an exemption phrase and is certainly not editing the changelog+  until it stops saying what was fixed. The pin now understands a CATEGORY —+  quoting rather than instructing — and skips markdown blockquotes, fenced and+  inline code spans, and quoted strings, so example violations live in quotes and+  in the cases table. Both are pinned: a quoted example does not trip it, and the+  same sentence unquoted does.++  The rule also turned out to be one-directional: `"Close the documents (ask the+  user)."` slipped, because an imperative may lead with its object. It is now+  order-independent within a statement, while the rule stating itself is still+  allowed, and all five of the adversary's sentences are rows in the table. And+  the drain gate's twin opt-in — the one place that tool overrides the bridge's+  ownership answer — is now scoped to the SOLIDWORKS session recorded in the run+  manifest, not to the path alone: a twin from another session has its file+  removed but is never force-closed. 396 tests.+- v0.8.6: **the gate's cleanup can find the runs that died, and cannot be+  pointed at anything else.** 0.8.5 gave every run a unique scratch ROOT, which+  fixed "earlier runs look foreign" by making them invisible: the manifest scan+  looked inside the fresh directory, found only its own, and adopted nothing — so+  a SIGKILL, a crash or a reboot, exactly what `atexit` cannot cover, left a+  directory behind per occurrence with no run that would ever collect it. There is+  now one fixed parent with a per-run subdirectory under it, and the scan reads+  the parent.++  That made a latent hazard reachable, so both landed together: cleanup asked for+  `allowUserWrites` + `confirm` on EVERY path a manifest named, and a manifest is+  just a file on disk. Containment now gates the OPT-IN — the twin, the only+  document that needs it, must lie under the directory this gate owns — while the+  bridge-created documents are closed in the DEFAULT posture, where the bridge's+  own ownership check is the proof. Anything outside is refused, named, and raises+  the exit code.++  And the never-ask pin stopped being a pile of phrases. It had grown eight+  exemptions so it would pass over this project's own commentary, and two were+  working bypasses — *"The sweep passed. Ask the user to close the remaining+  documents."* and *"After the restart, ask the user to close the leftover+  documents."* both slipped through. The rule is now positional (the close must+  follow the ask, inside the same request) and pinned by a table of example+  sentences, carrying both bypasses as must-catch cases. 393 tests.+- v0.8.5: **a refusal that asks instead of instructing, and four smaller+  honesty fixes.** `interconnect_blocks_import` told its reader to *"Turn it off+  in SOLIDWORKS: Tools > Options > …"* — a runbook, and an agent holding a desktop+  bridge can execute a runbook. It now says to ASK the user, and a test fails if+  any text on that code becomes imperative about changing a setting. `verified`+  no longer survives a manifest entry that cannot be TIED to the bytes on disk: a+  missing or null `recoveryBytes` was read as agreement, so a verdict about one+  file was handed to another — and `verified:true` means the document was closed,+  so that file is the only copy. The manifest's VERSION is checked, not just the+  shape of `files`. A coded refusal no longer carries the generic "if a dialog is+  up, dismiss it and retry" hint, which was wrong for every one of them. The+  recovery folder is claimed with `create_dir` — the creation IS the claim, where+  check-then-create raced. `GATE PARTIAL` exits 3, not 0, because a caller reading+  the status could not tell an untested half from a pass.++  And the live measurement from the drain gate is recorded: SOLIDWORKS REFUSED a+  second open of a same-titled saved document with `errors=65536`+  (`swFileWithSameTitleAlreadyOpen`), so **a title collision is impossible for+  saved documents** — only pathless ones can collide, which is exactly the state+  identity-at-birth removes — recorded beside the guard it justifies, in+  `com.rs`, dated, with the invocation that produced it.++  The drain gate also stopped leaving its own mess behind. Cleanup ran only on+  the success path, so a refusal — which is EVERY run on that machine while the+  License Manager dialog is up — left the gate's documents open in Drew's session+  and its files on disk; and the leftover check called the gate's own copies+  foreign, which is what stopped it touching them. It now keeps a per-run+  manifest, written before each creation, runs cleanup from a `finally` AND an+  `atexit`, and uses a scratch directory unique per run. Verified locally: a+  passing run and a FAILING run both end with zero documents open and zero+  directories left. 388 tests.+- v0.8.4: **the gate stopped asking Drew to close things, and a dialog now+  says what it says.** `tools/quit-gate.py` refused a live run with *"Ask Drew to+  close them himself"* — the exact sentence Drew's standing directive exists to+  delete, still sitting in a tool a week after the sweep that makes it+  unnecessary shipped and ran. The gate now runs `swx_close_all_safely` (which+  preserves every document to a verified recovery folder before closing) and+  refuses only if the SWEEP refuses, saying which of its reasons applied. Every+  other "ask the user to close" in the tree is gone, and a test now fails if one+  comes back — a directive that lives only in the code it prompted gets violated+  by everything around it.++  And the blocking-dialog report carries the dialog's own words. Live, the sweep+  stopped correctly on `{"kind":"license","title":"License Manager"}` and that was+  all a caller got; the window actually said *"Failed to check 1 license(s) …+  Unable to connect to server. The session will end after the next 5 unsuccessful+  attempts"* with one button, OK. `stoppedByDialog` now carries `text`, `buttons`,+  `contentsReadable` and `acknowledgeOnly` — read-only, `null` when unreadable,+  and **`neverAnswer` stays true regardless**: whether this bridge may ever press+  an OK-only informational dialog is a question for Drew, not an inference from a+  control tree. The measured fact: that dialog appears when the 3DEXPERIENCE+  licence heartbeat fails (it coincided with the desktop dropping off the relay),+  and both the sweep and the quit are blocked while it is up. 376 tests.+- v0.8.3: **the gate's own bugs, and a way to have caught them here.**+  `tools/drain-gate.py --fixture new` ran live and the registry drain PASSED —+  `swx_reset_workspace` closed exactly the two documents the bridge had made and+  left every pre-existing one open. The three reported failures were all the+  gate's: it asked for `keepUnsaved:true` and then failed the bridge for handing+  back a pathless document; it saved the twin to a path with no extension and+  reported the resulting FORMAT refusal as a write-gate bug; and it tried to close+  a twin that had never been created, printing an empty title. All four are fixed,+  and the classification rule is now explicit — **classify by errorCode, never by+  "it failed"**: a gate that cannot tell its own bug from the bridge's is worse+  than no gate.+  The real lesson is that none of it could be reproduced without the desktop, so+  the gate gained `--local URL`: it can now be run end to end against a mock+  bridge on this machine. It was, and all five claims pass. 372 tests.+- v0.8.2: **the import refuses honestly, naming the setting.** The matrix+  is measured, and the answer is that on this edition with 3D Interconnect ON+  there is no programmatic neutral-file import route at all — LoadFile4 returns+  nothing whether it is handed `Nothing` or a real `GetImportFileData` object,+  LoadFile2 returns false, OpenDoc6 answers "requires repair" for every option+  value tried. The imports that worked from 09-05 to 09-11 must have run with the+  toggle off. So `auto` makes ONE LoadFile4 attempt — a future edition that+  accepts it will simply work — and then fails with `interconnect_blocks_import`,+  naming the exact setting (Tools > Options > System Options > Import > Enable 3D+  Interconnect), the measurement date, and the fact that **this bridge does not+  change user settings, not even temporarily**. Reporting a translator failure+  instead would send the reader hunting a missing translator that is not the+  problem. `tools/drain-gate.py --fixture new` proves the same ownership and+  same-title collision properties with `swx_new_document`, since the STEP fixture+  cannot be created on that machine at all — and it states plainly that+  `swx_close_import_temps` is import-temp-BY-PATH by definition, so the registry+  drain is the right verb there. 366 tests.+- v0.8.1: **a measurement surface, because no import route is known to+  work — and two honesty fixes in the rescue record.** 0.8.0 claimed 3D+  Interconnect meant "OpenDoc6 with swDocPART"; live, that returns no document+  with `errors = 2097152` (`swFileRequiresRepairError`) on two real STEP files.+  That claim was recalled, not measured, and it is now marked as what it is. What+  IS measured: toggle 691 is TRUE, `LoadFile4` executes and returns nothing+  (`errors = 1`), `LoadFile2` returns false (still unexplained). PowerShell cannot+  try alternatives — SOLIDWORKS Connected does not expose the type info its COM+  adapter needs, so every member call fails `TYPE_E_ELEMENTNOTFOUND` — which makes+  this bridge the only instrument. So `swx_import` takes `route`, `openOptions`,+  `docType`, `withImportData` and `argString`, echoes the exact `invocation` on+  every reply, and refuses an unknown route rather than quietly measuring+  something else. It is inside the verb that already owns and registers what it+  opens, not a new escape hatch.++  Also: a manifest verdict no longer outlives the bytes it was about — if the file+  changed since the sweep, the listing says UNKNOWN instead of repeating a verdict+  about bytes that are gone. Host failures inside the sweep keep their structured+  COM detail, which since 0.7.8 is the permanent record of why a document was not+  preserved. A throwing import re-counts and TAKES OWNERSHIP of a document that+  appeared anyway, instead of leaving it open and untracked. And two sweeps in the+  same second now get separate folders: they used to share one, so the second+  sweep's manifest overwrote the first's — a real reporting defect, and the+  mechanism behind an intermittent test failure that was fixed rather than+  retried. 365 tests.+- v0.8.0: **3D Interconnect — the import had been taking the wrong road+  all along, and the user's setting decides which road exists.** With 0.7.9's+  encoding fix, `LoadFile4` finally executed on the live install and still+  returned no document, `errors = 1` (`swGenericError`). The reason was measured+  rather than guessed: `GetUserPreferenceToggle(691)`+  (`swMultiCAD_Enable3DInterconnect`) is **TRUE**. Under 3D Interconnect+  SOLIDWORKS does not translate a neutral file at all — it OPENS a STEP as a part+  holding a linked feature that points back at the source. So `swx_import` now+  reads that preference, reports it, and routes: `OpenDoc6(path, swDocPART, …)`+  when it is on, `LoadFile4` when it is off. The reply says `interconnect`,+  `linked` and `sourcePath`, because a caller told only "imported" would be wrong+  about what deleting the source file does.++  **The preference is never written** — not set, and not flipped-and-restored: a+  crash between those two halves would leave the user's SOLIDWORKS configured+  differently than they left it. `dissolve:true` is offered and REFUSED+  (`dissolve_not_measured`) until the link-breaking call is verified on this+  install, with the refusal naming what to measure and the safe way round it;+  guessing an API that writes to a document is how pass 23's format claim would+  have gone if it had been a write. Import Diagnostics auto-run is also ON+  (toggle 291), so a faulty STEP raises a modal dialog mid-import: that is now+  classified, reported as `stoppedByDialog`, and never answered — the choice it+  offers changes the geometry the user gets. 360 tests.+- v0.7.9: **"Nothing" is not "omitted", and it had never worked.** With+  0.7.8's structured failure finally reaching the caller, the live import answered+  `Type mismatch. (0x80020005) (argument index 1)`. `rgvarg` is packed reversed,+  so that argument is the THIRD parameter of+  `LoadFile4(path, "r", importData, byref errors)` — `importData` — which this+  bridge had passed as `VT_EMPTY` since v0.2.0. SOLIDWORKS wants an object there+  and will take a null one; it will not take "no value at all". The late-bound+  spelling of VBA's `Nothing` is a `VT_DISPATCH` variant with a NULL `pdispVal`,+  which is now what `LoadFile4` gets — and what `swx_com_eval`'s `null` literal+  builds, since its documented use is `SelectByID2`'s callout, an `[in]` object+  parameter of exactly the same kind. There is still exactly ONE `LoadFile4` call:+  no silent retry under the old encoding, because a guess nobody can see is worse+  than a failure somebody can read.++  The consequence worth stating plainly: **`LoadFile4` had probably never worked+  live**, and the imports of 09-05 to 09-11 went through the `LoadFile2` fallback+  — which today returns false, unexplained, and is the next thing to measure. None+  of this was findable until the HRESULT stopped being discarded one frame above+  where it was made. 353 tests.+- v0.7.8: **the sweep writes down what it decided — and the first+  autonomous close happened.** LIVE, 2026-09-17: `swx_close_all_safely` took four+  documents to a recovery folder and closed every one of them, count 4 to 0,+  nobody asked to close anything; then `swx_stop` quit SOLIDWORKS on rung (a).+  `ExitApp` is NOT declined at zero documents on this edition — the long-held+  belief was a save-prompt stall, so the blocker was never the quit, it was the+  documents. Also measured: `SaveAs3` to a neutral `.sldrecover` name answers+  "format not supported", so an unclassifiable document is now named `.SLDPRT` up+  front with `namingFallback:"unknownKindNamedAsPart"` recorded and the+  unknown-kind verification unchanged — the name is a label SOLIDWORKS forced, the+  floor is the check. The release's own work: every sweep now writes a+  `manifest.json` beside the files it wrote, rewritten atomically after each save+  and each close, carrying what no listing can re-derive — the original document's+  size, the kind `GetType` reported, and whether the extension was a guess.+  `swx_recover_list` reports the sweep's own verdicts from it (`source:"manifest"`)+  and re-verifies only where no record exists (`source:"reverified"`), where a+  file that merely looks right is now reported as UNKNOWN rather than verified: a+  weaker check does not produce false negatives, it produces false positives, and+  `verified:true` for a file the sweep refused is read by the person whose sweep+  just failed.++  Also in 0.7.8: **a failed import now shows the translator's own answer.** Live,+  every STEP import began failing with `LoadFile4` raising a COM exception, and+  the caller saw only *"SOLIDWORKS could not import … (LoadFile4 opened nothing)"*+  with the detail *"SOLIDWORKS rejected 'LoadFile4'"* — the HRESULT, the EXCEPINFO+  source and description and the failing argument index were already computed and+  then dropped. Every COM failure now carries them structured, and a failed import+  reports `hostError.loadFile4` (message, detail, code, HRESULT) plus what+  `LoadFile2` actually answered, so "refused" and "threw" are distinguishable.+  `swx_com_eval` stays read-only. 351 tests.+- v0.7.7: **the listing can tell a rescue from a husk.** Files land in a+  sweep folder whether or not the sweep vouched for them — a refused save leaves+  one, a save that returns success can write something that is not a document, a+  full disk leaves a truncation — and in every one of those cases the DOCUMENT WAS+  LEFT OPEN, so the work is still in SOLIDWORKS rather than in the folder.+  `swx_recover_list` called all of them rescues, with sizes and instructions for+  opening them, under a headline saying every document closed was written here+  first. It now re-runs the same verdict the sweep used — it is a pure function of+  the file — and reports `verified` with the sweep's own reason per file. An+  unverified file is still listed and never deleted (those bytes are the only ones+  there are) but it is never called a rescue and never offered as something to+  open; its entry says the document was left open. The hint leads with+  "files marked `verified:false` are NOT complete documents". 344 tests.+- v0.7.6: **ask the evidence already in hand, and tell the user how to   reopen what was rescued.** When `GetType` fails, the document's OWN PATH is now   consulted before its title — the path is the user's file as SOLIDWORKS named it,   while a title often has no extension at all (Explorer hides known types by

@@ -2,7 +2,7 @@   "manifest_version": 1,   "name": "solidworks",   "displayName": "SOLIDWORKS",-  "version": "0.6.9",+  "version": "0.9.0",   "description": "Bridge for SOLIDWORKS desktop CAD \u2014 create and open documents, a modeling DSL, file management (find/open/save/export/Pack and Go), custom properties, BOM generation, design analysis (mass properties, bodies, parameters, interference, rebuild health) and background window/dialog etiquette, over the SOLIDWORKS COM API. Single native binary: no interpreter, no PowerShell, ~10ms cold start.",   "author": "Adom Inc.",   "license": "MIT",@@ -20,15 +20,44 @@     "swx_"   ],   "verbs": [+    "swx_action_ledger",+    "swx_activate_document",+    "swx_add_component",     "swx_bom",+    "swx_check_recovery",+    "swx_close_all_documents",+    "swx_close_all_safely",     "swx_close_doc",+    "swx_close_import_temps",+    "swx_close_window",+    "swx_cloud_status",     "swx_com_eval",     "swx_describe",+    "swx_design_info",+    "swx_dismiss_blocking_dialogs",     "swx_docs",+    "swx_document_info",     "swx_export",+    "swx_export_3mf",+    "swx_export_dwg",+    "swx_export_dxf",+    "swx_export_glb",+    "swx_export_iges",+    "swx_export_parasolid",+    "swx_export_pdf",+    "swx_export_sat",+    "swx_export_step",+    "swx_export_stl",     "swx_find_files",+    "swx_get_app_state",+    "swx_get_parameters",+    "swx_get_preferences",+    "swx_import",+    "swx_inspect_bodies",     "swx_interference",+    "swx_kill",     "swx_mass_properties",+    "swx_new_document",     "swx_open",     "swx_pack_and_go",     "swx_progress",@@ -36,53 +65,27 @@     "swx_props_set",     "swx_readiness",     "swx_rebuild_check",+    "swx_recover_list",+    "swx_reset_workspace",+    "swx_run_macro",+    "swx_run_script",     "swx_save",+    "swx_save_as",     "swx_screenshot",+    "swx_set_driving_badge",+    "swx_set_parameter",+    "swx_set_preference",+    "swx_show_assembly",+    "swx_show_drawing",+    "swx_show_part",+    "swx_shutdown",     "swx_start",     "swx_state",     "swx_status",     "swx_stop",     "swx_uninstall",-    "swx_new_document",-    "swx_import",-    "swx_save_as",-    "swx_get_app_state",-    "swx_document_info",-    "swx_activate_document",-    "swx_close_all_documents",-    "swx_reset_workspace",-    "swx_close_import_temps",-    "swx_kill",-    "swx_window_info",-    "swx_dismiss_blocking_dialogs",-    "swx_close_window",-    "swx_check_recovery",-    "swx_action_ledger",     "swx_verb_times",-    "swx_set_driving_badge",-    "swx_design_info",-    "swx_get_parameters",-    "swx_set_parameter",-    "swx_inspect_bodies",-    "swx_run_macro",-    "swx_run_script",-    "swx_add_component",-    "swx_get_preferences",-    "swx_set_preference",-    "swx_cloud_status",-    "swx_show_part",-    "swx_show_assembly",-    "swx_show_drawing",-    "swx_export_step",-    "swx_export_iges",-    "swx_export_stl",-    "swx_export_3mf",-    "swx_export_glb",-    "swx_export_sat",-    "swx_export_parasolid",-    "swx_export_pdf",-    "swx_export_dxf",-    "swx_export_dwg"+    "swx_window_info"   ],   "statusVerb": "swx_status",   "risk": "exec",

@@ -226,6 +226,25 @@ a save prompt and the quit stalled" call for completely different ladders. §5 therefore measures rung (a) *first*, on a genuinely `Some(0)` session, and records the result in the ledger. +> ### SETTLED, LIVE, 2026-09-17 — it was the save prompt.+>+> On a bridge-launched session emptied by `swx_close_all_safely`,+> `swx_stop {userAuthorized, maxRung:"a"}` **quit SOLIDWORKS on rung (a)**:+> `UserControl=false`, `ExitApp`, every COM reference released, and the process+> verified absent from the census. `swx_shutdown` then removed a stray empty+> instance (pid 145188), after which `tasklist` showed no `sldworks.exe` at all.+>+> **`ExitApp` is NOT declined at zero documents on this edition.** The+> long-standing "declined even with 0 documents" belief was a SAVE-PROMPT STALL+> read as a refusal — exactly the alternative this section said had to be+> separated first, and exactly the reason the ladder was built pinned at rung (a)+> rather than escalating. Nothing above rung (a) has ever been needed on this+> machine.+>+> The practical consequence is the one this whole document was written to reach:+> the blocker was never the quit, it was the documents. Preserve them first+> (§5.12) and the quit is one call.+ ---  ## 1. The API semantics of quitting@@ -257,6 +276,14 @@ Three things the documentation does **not** say, and all three matter: So "declined" is not a documented state. What *is* documented, repeatedly, is that the surrounding COM ownership decides whether the process actually goes away. +**Measured live, 2026-09-17, on SOLIDWORKS Connected:** with zero documents open+and `UserControl` set false, `ExitApp` returned without an HRESULT failure and the+process was gone from the census — the first rung, on the first attempt. The+"declined" state this section declined to assume was never real; what had been+observed under that name was a save prompt on a session that still had documents+open. Ownership was the whole story, as the documentation implies and as §1.2+argues.+ ### 1.2 `ISldWorks::UserControl` — the flag that decides who owns the lifetime  Official help (`…ISldWorks~UserControl.html`, via snippet):@@ -1275,7 +1302,7 @@ Neither is about quitting, both belong to the same posture:    `verbs.rs` only clears on the success arm). **Clear the host registry after a    census-confirmed exit, never before the verification.** -### 5.11 As built — `swx_stop` v2, shipped in 0.5.2, hardened in 0.5.3 (mock-proven, **live-unproven**)+### 5.11 As built — `swx_stop` v2, shipped in 0.5.2, hardened in 0.5.3 (**LIVE-PROVEN on rung (a), 2026-09-17; the full gate cycle again 2026-09-30 through the hosted bridge — §5.14**)  Written after the code, from the code. Where the build deviates from §5.1–§5.10 the deviation is named here rather than quietly absorbed, and the doc above is@@ -1740,6 +1767,37 @@ attribution — the user may quit a session this bridge did not start — and th window-message rungs become available, which matters when COM is wedged behind a licence dialog. It still never kills anything. +### 5.13 The licence dialog blocks everything, measured 2026-09-17++The safe-close sweep stopped on a dialog and refused to go further, which is+correct. Read afterwards with UI Automation (read-only), the window was:++```text+title:   License Manager+text:    Failed to check 1 license(s): 3DEXPERIENCE SOLIDWORKS Professional:+         Unable to connect to server. The session will end after the next 5+         unsuccessful attempts.+buttons: OK+```++It appeared when the **3DEXPERIENCE licence heartbeat failed** — it coincided+with the desktop dropping off the relay — and while it is up **both the sweep and+the quit are blocked**, because every one of this bridge's rules stops at a+dialog and never answers one.++Two consequences worth stating plainly. First, a licence-server outage makes the+session unclosable by this bridge until a person dismisses the dialog; the work is+not at risk (the sweep preserves before it closes, and it had not closed anything)+but the session cannot be ended. Second, the message is a COUNTDOWN — five more+failed checks and the session ends by itself — which is exactly the kind of thing+a caller must be shown rather than told "a dialog is up". Since 0.8.4 the report+carries the dialog's text and buttons for that reason.++This bridge still does not press OK. Whether it ever may, for a dialog whose only+control is an acknowledgement, is a policy question for Drew — `acknowledgeOnly`+reports the fact so that decision can be made on evidence, and `neverAnswer`+remains true until it is.+ **In this repo:** `docs/LAUNCH-RESILIENCE.md` (the attribution law, the kill allowlist, the launch state machine) · `docs/FUSION-PARITY-BRIEF.md` §"The gate was closed in the wrong direction" (the only ledger-backed decline we have) ·@@ -1755,3 +1813,57 @@ closed in the wrong direction" (the only ledger-backed decline we have) · `%APPDATA%\SOLIDWORKS\SOLIDWORKS 2026\{swxJRNL.swj,swxJRNL.BAK,3dexperience-log.json,SWStdSessionsData.xml}`, `%LOCALAPPDATA%\Adom Bridge\bridges-cache\solidworks\ledger.jsonl`, `%TEMP%\swx*`, `HKCU\Software\SolidWorks\*`.++### 5.14 LIVE-PROVEN 2026-09-30 — the full gate cycle, through the bridge ab hosts++`tools/quit-gate.py` ran its whole cycle on Drew's machine against the RELEASED+bridge: adom-bridge 2.1.163 had auto-installed 0.8.9 into+`bridges-cache\solidworks` and routes `swx_*` verbs to it. Every claim below came+from the machine, not from the bridge's own report.++| Claim | Measured |+|---|---|+| The session was bridge-launched (the gate's precondition) | yes — attribution intact |+| The quit succeeded on rung (a) | yes: `UserControl=false` → `ExitApp` → every COM reference released |+| The process is gone (pid AND creation time absent from the census) | 29.5 s after the rung |+| Per-session children reaped, platform daemons left alone | yes |+| Nothing on screen afterwards, no crash reporter | yes, both |+| Every rung attempted is reported | yes |+| The bridge can launch again after a graceful quit | SOLIDWORKS relaunched by the bridge 54.7 s later |++The same day: the launch gate passed every launch claim, the drain gate passed 5+of 5, and the ownership measurement passed both halves (a pathless `Part2`+preserved by ownership, 25,959 bytes verified, listed from the manifest; Drew's+saved `R_0603_1608Metric_1.step-1.sldprt` closed with its original untouched —+same 32,311 bytes and the same mtime after the sweep). See+`docs/LAUNCH-RESILIENCE.md` "Live proof 2".++**Two things the gate had to change to run at all, both measured:**++1. **The route.** The gate used to reach the bridge through `shell_execute` ++   `curl.exe` to a side-loaded dev copy on `127.0.0.1:24695`. adom-bridge 2.1.163+   terminates a second `swx-bridge.exe` within 30 s, so that route is dead. Every+   gate (`tools/{launch,drain,quit}-gate.py`, and `tools/swx-live.py`) now calls+   `adom-bridge --target adom_drew2 --ai-thread <thread> <verb> <json>`, and+   unwraps the routed reply (`result`, when present — ab merges top-level fields+   and adds an `output` string). `SWX_BRIDGE_URL` forces the old loopback route.+   A fast `shell_execute` failure with no output at all (exit 1, under 5 s) is a+   measured transient — the same command ran 5/5 clean in isolation — so it is+   retried ONCE, and the retry is printed.+2. **The grant.** The gate passed `allowUserWrites` + `confirm`, and was refused+   `user_writes_disabled` with attribution intact: the bridge ab hosts never+   carries `SWX_ALLOW_USER_WRITES`, and it should not — the write gate is not what+   authorizes a quit. It now passes `userAuthorized:true` with a reason, which is+   Drew's standing authorization (2026-09-11) as `swx_stop` reads it.++**How this bridge is tested on the machine now.** The dev deploy pattern — a+`deployN.py` side-load of a dev build onto port 24695 next to the released one —+is RETIRED, for the reason in (1). Dev testing is either a PRERELEASE install+through ab, or a renamed exe reached with `SWX_BRIDGE_URL`. **Which of those ab+tolerates is NOT MEASURED yet**: 2.1.163 was seen terminating a second+`swx-bridge.exe`; whether it also terminates a copy under another name on+another port has not been tried, and until it is, that route is a candidate, not+a method. And the fact that decides how carefully a release is made: **the+version ab hosts is whatever the published manifest says, so a release IS a+deploy to every machine** that runs the bridge — there is no separate step at+which a bad build can still be stopped.

@@ -10,8 +10,16 @@ //!     out-params — an unattended bridge must never park SOLIDWORKS on a dialog //!     nobody will answer. Fall back to legacy `OpenDoc` if the late-bound byref //!     call comes back empty.-//!   * `Save3(1, ...)` / `SaveAs3(path, 0, 1)` — silent, copy-mode; SaveAs3-//!     keys the format off the destination extension.+//!   * `Save3(1, ...)` / `SaveAs3(path, 0, options)` — SaveAs3 keys the format+//!     off the destination extension. The OPTIONS BIT IS LOAD-BEARING and is not+//!     a detail: `swSaveAsOptions_Silent` (1) ALONE RE-POINTS the open document+//!     at the new file, while adding `swSaveAsOptions_Copy` (2) writes the file+//!     and leaves the document attached to where it was. The export verbs want+//!     Copy — the user keeps working on their own file. The safe-close sweep+//!     wants Silent ALONE, because the close that follows it closes the document+//!     by the path the document has AT THAT MOMENT, and that path must be the+//!     recovery file. Passing the wrong one there would close a document whose+//!     content is on disk under a name nothing points at. //!   * Suppressed components (`GetSuppression() == 0`) are excluded from BOMs. //!   * `InterferenceDetectionManager` is always closed with `Done()`, on every //!     path — leaving it open leaves SOLIDWORKS in a modal-ish state.@@ -635,6 +643,21 @@ impl ComBackend {         //      1. CLOSE BY THE PATH THE VICTIM WAS CHOSEN BY.         //      2. REFUSE any victim whose title another open document shares —         //         and say which paths, so the user can act on it.+        //    WHAT THIS GUARD ACTUALLY PROTECTS, measured live 2026-09-17.+        //+        //    `tools/drain-gate.py --fixture new` copied a bridge-created+        //    document's own file to a second directory under the SAME basename+        //    and called `swx_open` on the copy. SOLIDWORKS REFUSED it:+        //    `errors = 65536` (`swFileWithSameTitleAlreadyOpen`).+        //+        //    So on this edition two SAVED documents CANNOT share a title, and+        //    this guard can only ever fire for PATHLESS ones — which is exactly+        //    the state identity-at-birth removes by giving every bridge-created+        //    document a file the moment it exists. That is not a reason to delete+        //    the guard: a document the bridge did not create can still be+        //    pathless, and an older bridge's leftovers still are. It is a reason+        //    to know which case it is for, so nobody "simplifies" it on the+        //    assumption that saved collisions are the common case.         let mut collisions: Vec<Value> = Vec::new();         let victims: Vec<(String, String)> = victims             .into_iter()@@ -807,6 +830,389 @@ impl ComBackend {         }))     } +    /// PRESERVE EVERY OPEN DOCUMENT, THEN CLOSE IT. Drew's standing+    /// authorization, 2026-09-11: *"I despise every time you ask for help+    /// closing. You MUST find/build a way to safely close the docs/program."*+    ///+    /// The authorization is to CLOSE. It is not an authorization to LOSE+    /// anything, and those are different permissions — so the safety property+    /// here is not ownership (irrelevant: the user said yes) but a sequence:+    ///+    ///   **nothing is closed until it is on disk.**+    ///+    /// Every document, saved or not, bridge-created or the user's, is made CLEAN+    /// AND PATHED before anything closes. A dirty document is SAVED TO RECOVERY:+    /// `SaveAs3` with Silent ALONE (never Copy), so the OPEN DOCUMENT NOW POINTS+    /// AT THE RECOVERY FILE — which is exactly what makes the close key right,+    /// because the close is by the path the document has at that moment. The+    /// user's original file on disk is never written to; it is simply no longer+    /// what this in-memory document is attached to. A pathless document gets a+    /// file of its own for the first time. Only then does the close happen, by+    /// that path, and a save prompt cannot appear because there is nothing left+    /// unsaved to prompt about.+    ///+    /// ONE DOCUMENT PER CALL, because the server must look for a dialog between+    /// every save and every close.+    ///+    /// 0.7.1 did a whole batch inside one host call and the server censused once+    /// per batch. That was wrong for a reason the design itself implies: a SAVE+    /// can raise a prompt (a missing external reference, a rebuild question), and+    /// a dialog raised by the first save was invisible until every other document+    /// in the batch had already been closed. So `phase` splits the work into the+    /// two steps the server interleaves its census with, and `max`/`batch` go+    /// back to being what they always should have been — a bound on round trips+    /// and wall time, not the unit of safety.+    fn cmd_preserve_and_close(&mut self, args: &Value) -> Result<Value, HostError> {+        match args.get("phase").and_then(|v| v.as_str()).unwrap_or("preserve") {+            "preserve" => self.preserve_one(args),+            "close" => self.close_one(args),+            other => Err(HostError::msg(format!(+                "unknown preserve_and_close phase {other:?} — expected \"preserve\" or \"close\""+            ))),+        }+    }++    /// PRESERVE ONE DOCUMENT. Drew's standing authorization, 2026-09-11: *"I+    /// despise every time you ask for help closing. You MUST find/build a way to+    /// safely close the docs/program."*+    ///+    /// The authorization is to CLOSE. It is not an authorization to LOSE+    /// anything, and those are different permissions — so the safety property+    /// here is not ownership (irrelevant: the user said yes) but a sequence:+    ///+    ///   **nothing is closed until it is on disk.**+    ///+    /// The document at `index` in the walk is made CLEAN AND PATHED. A dirty one+    /// is SAVED TO RECOVERY: `SaveAs3` with Silent ALONE (never Copy), so the+    /// OPEN DOCUMENT NOW POINTS AT THE RECOVERY FILE — which is what makes the+    /// close key right, because the close is by the path the document has at that+    /// moment. The user's original file on disk is never written to; it is simply+    /// no longer what this in-memory document is attached to. A pathless document+    /// gets a file of its own for the first time.+    ///+    /// The index is a position in the walk, not an identity, and that is safe+    /// only because NOTHING CLOSES during this phase: the walk order is stable+    /// while the server steps through it.+    fn preserve_one(&mut self, args: &Value) -> Result<Value, HostError> {+        let sw = self.app(false, true)?;+        let recovery = args+            .get("recoveryDir")+            .and_then(|v| v.as_str())+            .filter(|s| !s.is_empty())+            .ok_or_else(|| HostError::msg("recoveryDir is required"))?+            .to_string();+        let index = args.get("index").and_then(|v| v.as_u64()).unwrap_or(0) as usize;+        let count = Self::document_count(&sw);+        // Walk live pointers, never a title. Only as far as the document asked+        // for — the walk is bounded and the server pays for each step.+        let (walked, _stop) = Self::walk_documents(+            &sw,+            index + 1,+            std::time::Duration::from_secs(super::host::DRAIN_WALK_BUDGET_SECS),+        )?;+        let Some(doc) = walked.get(index) else {+            // THE WALK IS EXHAUSTED. Not an error: it is how the server learns+            // there is nothing further to preserve.+            return Ok(json!({+                "phase": "preserve", "index": index, "walked": 0,+                "documentCount": count, "record": Value::Null, "ready": Value::Null,+            }));+        };+        let title = doc.string("GetTitle", &[]).unwrap_or_default();+        let path = doc.string("GetPathName", &[]).unwrap_or_default();+        let dirty = doc.flag("GetSaveFlag", &[]).unwrap_or(true);+        // GETTYPE CAN FAIL, AND AN UNREADABLE TYPE IS NOT A PART. 0.7.4 wrote+        // `.unwrap_or(1)`, which turned every failed COM read into "part" — the+        // LOWEST recovery floor of the three — and then named the recovery file+        // `.SLDPRT`, from which the verdict read the kind back. One failed read+        // therefore closed a truncated assembly against a part-sized floor. This+        // is a COM call on a document being closed under memory pressure, which+        // is the condition this sweep exists for.+        let kind = match doc.int("GetType", &[]) {+            Some(2) => Some(crate::disk::DocKind::Assembly),+            Some(3) => Some(crate::disk::DocKind::Drawing),+            Some(1) => Some(crate::disk::DocKind::Part),+            // Unreadable, or a type this bridge does not know: UNKNOWN, carried+            // as such all the way to the verdict.+            _ => None,+        };+        // WHEN GETTYPE FAILS, ASK THE EVIDENCE ALREADY IN HAND.+        //+        // The document's OWN PATH is the strongest of it: the user's file, named+        // by SOLIDWORKS, on disk, read from this same document a moment ago. Its+        // title comes next, and is weaker than it looks — SOLIDWORKS returns the+        // title as the shell shows it, so with Explorer's default "hide+        // extensions for known file types" a saved assembly's title is `bracket`,+        // not `bracket.SLDASM`.+        //+        // THIS IS NOT THE CIRCULARITY 0.7.5 REMOVED, and the difference is+        // provenance: `path` and `title` come from SOLIDWORKS and describe the+        // document. The recovery file's name is chosen BY THIS SWEEP from the+        // kind, so reading a kind back out of THAT can only repeat whatever it+        // already assumed.+        let kind = kind+            .or_else(|| crate::disk::DocKind::from_extension(&path))+            .or_else(|| crate::disk::DocKind::from_extension(&title));+        let kind_name = kind.map(|k| json!(k.type_name())).unwrap_or(Value::Null);+        let pathless = path.trim().is_empty();+        let mut ready = Value::Null;+        let record = if !dirty && !pathless {+            // Already on disk and unchanged: nothing to preserve.+            ready = json!({+                "path": path, "docType": kind_name, "writtenHere": false,+                "originalBytes": Value::Null,+            });+            // CLOSED IN PLACE. The user's own file is this document's+            // preservation, so its size and modification time are measured here —+            // read-only — and recorded: that is what lets swx_recover_list later+            // say "closed at its own path, untouched" and mean it, or say that+            // something has written to it since. Measured live 2026-09-30: the+            // record had nothing for such a document at all.+            let original_bytes = std::fs::metadata(&path).ok().map(|m| m.len());+            let original_modified_ms = crate::scratch::modified_ms(&path);+            json!({+                "title": title, "path": path, "recoveryPath": Value::Null,+                // Nothing was written for this one: it was already its own file+                // on disk and unchanged, so there is no size and no signature of+                // ours to report.+                "recoveryBytes": Value::Null, "recoverySignatureOk": Value::Null,+                "docKind": kind_name, "originalBytes": original_bytes,+                "originalModifiedMs": original_modified_ms,+                "wasDirty": false, "wasPathless": false, "preserved": true,+            })+        } else {+            // UNIQUE BY CONSTRUCTION, and never an overwrite: if the name is+            // taken, take the next one.+            let stem = if title.trim().is_empty() { "document".to_string() } else { title.clone() };+            // THE ORIGINAL'S SIZE, read before anything is written: when the kind+            // cannot be established this is the other half of the floor — a+            // rescue of a document that had a 4 MB file must not be 30 KB.+            let original_bytes = if pathless {+                None+            } else {+                std::fs::metadata(&path).ok().map(|m| m.len())+            };+            let out = Self::unique_recovery_path(&recovery, &stem, kind);+            // A NAME SOLIDWORKS MAY REFUSE TO WRITE.+            //+            // `SaveAs3` dispatches its output format on the extension, and+            // `.sldrecover` matches no writer. Whether it fails or silently falls+            // back to some default is not something this bridge knows, and+            // guessing it from memory is how a format claim went wrong two passes+            // ago. So it is not guessed: the save is ATTEMPTED, and if it fails+            // the document is re-saved under `.SLDPRT` and the reason recorded.+            //+            // A guessed NAME is tolerable now in a way it was not in 0.7.4,+            // because nothing downstream reads the kind back out of it: the+            // verification still applies the UNKNOWN-kind rules (the strictest+            // floor, and at least the original file's size). The name is a label;+            // the floor is the check.+            let mut out = out;+            // The name is a guess whenever the kind is unknown — whether it was+            // guessed up front (this install) or after a refused neutral name.+            let mut named_as_part = kind.is_none() && !Self::NEUTRAL_EXTENSION_ACCEPTED;+            let first = Self::save_as3(doc, &out, false);+            let failed = match &first {+                Err(_) => true,+                Ok(code) => *code != 0,+            };+            let attempt = if failed && kind.is_none() && out.to_lowercase().ends_with(".sldrecover")+            {+                named_as_part = true;+                out = Self::unique_recovery_path(+                    &recovery,+                    &stem,+                    Some(crate::disk::DocKind::Part),+                );+                Self::save_as3(doc, &out, false)+            } else {+                first+            };+            match attempt {+                Err(e) => json!({+                    "title": title, "path": path, "recoveryPath": Value::Null,+                    "recoveryBytes": 0, "recoverySignatureOk": false,+                    "docKind": kind_name, "originalBytes": original_bytes,+                    "namingFallback": if named_as_part { json!("unknownKindNamedAsPart") } else { Value::Null },+                    "wasDirty": dirty, "wasPathless": pathless, "preserved": false,+                    "why": format!("could not be saved, so it was NOT closed: {}", e.message),+                }),+                Ok(code) => {+                    // ── VERIFY THE FILE STRUCTURALLY, NOT STATISTICALLY. A file+                    //    can EXIST and hold nothing, and it can hold plenty and+                    //    still be a fragment: a partial write on a full disk+                    //    stops wherever it stops. This laptop's host disk has+                    //    been at 100% during this very release series, so it is+                    //    not hypothetical — and the cost of getting it wrong is+                    //    the document being closed against a file with none, or+                    //    half, of its content in it. `recovery_file_verdict`+                    //    reads the OLE compound-document signature and the size,+                    //    and fails closed on anything it cannot vouch for.+                    let now_path = doc.string("GetPathName", &[]).unwrap_or_default();+                    let v = super::host::recovery_file_verdict(&now_path, kind, original_bytes);+                    if code != 0 || now_path.trim().is_empty() || !v.ok {+                        json!({+                            "title": title, "path": path, "recoveryPath": out,+                            "recoveryBytes": v.bytes, "recoverySignatureOk": v.signature_ok,+                            "docKind": kind_name, "originalBytes": original_bytes,+                            "wasDirty": dirty, "wasPathless": pathless, "preserved": false,+                            "why": format!(+                                "SaveAs3 returned {code} and {} — closing this document would have \+                                 discarded the only copy",+                                v.why.unwrap_or_else(|| "the recovery file could not be verified".into())+                            ),+                        })+                    } else if !crate::verbs::same_path(&now_path, &out) {+                        // THE OPEN DOCUMENT MUST NOW BE THE RECOVERY FILE.+                        // SaveAs3 is called with Silent ALONE (no Copy), so it+                        // RE-POINTS the document — and that is what makes the+                        // close key correct. If anyone ever passes Copy here the+                        // document would still be dirty and pathless while this+                        // code closed a file, so the mismatch is checked rather+                        // than assumed.+                        json!({+                            "title": title, "path": path, "recoveryPath": out,+                            "recoveryBytes": v.bytes, "recoverySignatureOk": v.signature_ok,+                            "docKind": kind_name, "originalBytes": original_bytes,+                            "wasDirty": dirty, "wasPathless": pathless, "preserved": false,+                            "why": format!(+                                "the file was written but the open document still reports \+                                 {now_path:?} — it did not re-point to the recovery file, so \+                                 closing by that path would close something else, or nothing. \+                                 (SaveAs3 must be Silent ALONE here, never Copy.)"+                            ),+                        })+                    } else {+                        ready = json!({+                            "path": now_path, "docType": kind_name, "writtenHere": true,+                            "originalBytes": original_bytes,+                        });+                        json!({+                            "title": title, "path": path, "recoveryPath": now_path,+                            "recoveryBytes": v.bytes, "recoverySignatureOk": true,+                            "docKind": kind_name, "originalBytes": original_bytes,+                            // The kind is still UNKNOWN: only the NAME fell back,+                            // and the verification above used the unknown rules.+                            "namingFallback": if named_as_part { json!("unknownKindNamedAsPart") } else { Value::Null },+                            "wasDirty": dirty, "wasPathless": pathless, "preserved": true,+                        })+                    }+                }+            }+        };+        Ok(json!({+            "phase": "preserve", "index": index, "walked": 1,+            "documentCount": count, "record": record, "ready": ready,+        }))+    }++    /// CLOSE ONE DOCUMENT, by the path it reports NOW.+    ///+    /// Reached only after the server has re-censused for a dialog since the save+    /// that made this path, and only for a document `preserve_one` vouched for.+    /// A document this bridge wrote is re-verified here as well: the file must+    /// still be a real document at the moment of the close, not merely at the+    /// moment of the save.+    fn close_one(&mut self, args: &Value) -> Result<Value, HostError> {+        let sw = self.app(false, true)?;+        let path = args+            .get("path")+            .and_then(|v| v.as_str())+            .filter(|s| !s.trim().is_empty())+            .ok_or_else(|| HostError::msg("path is required"))?+            .to_string();+        let written_here = args.get("writtenHere").and_then(|v| v.as_bool()).unwrap_or(false);+        if written_here {+            // THE KIND TRAVELS WITH THE DOCUMENT. Re-deriving it from the file+            // name here would re-introduce exactly the circularity this release+            // removed: the name came from the kind.+            let kind = args+                .get("docKind")+                .and_then(|v| v.as_str())+                .and_then(|t| crate::disk::DocKind::from_type_name(t));+            let original_bytes = args.get("originalBytes").and_then(|v| v.as_u64());+            let v = super::host::recovery_file_verdict(&path, kind, original_bytes);+            if !v.ok {+                return Ok(json!({+                    "phase": "close", "path": path, "closed": false,+                    "documentCount": Self::document_count(&sw),+                    "why": v.why.unwrap_or_else(|| "the recovery file could not be verified".into()),+                }));+            }+        }+        let _ = sw.call("CloseDoc", &[&Var::bstr(&path)]);+        let still_open = Self::open_document_by_name(&sw, &path).is_some();+        if !still_open {+            self.created.retain(|(_, p)| p.as_deref() != Some(path.as_str()));+        }+        Ok(json!({+            "phase": "close", "path": path, "closed": !still_open,+            "documentCount": Self::document_count(&sw),+            "why": if still_open { json!("still open after CloseDoc") } else { Value::Null },+        }))+    }++    /// `<recovery>\<stem>[-n].<ext>`, never overwriting. Several open documents+    /// can share one title (that is half of what makes this bridge's life hard),+    /// so the name is made unique against the FILESYSTEM.+    /// DOES THIS INSTALL ACCEPT A NEUTRAL EXTENSION? **Measured, 2026-09-17, on+    /// the live SOLIDWORKS Connected install: NO.**+    ///+    /// A scripted `SaveAs3` to `.sldrecover` on a throwaway document returned+    /// *"format not supported for …"* and wrote nothing. So the first attempt was+    /// not merely likely to fail — it was certain to, and a certain failure is not+    /// something to spend a COM round trip and a user's wait on during a close.+    ///+    /// The unknown-kind document therefore goes straight to `.SLDPRT`, with+    /// `namingFallback: "unknownKindNamedAsPart"` recorded so nothing downstream+    /// reads that extension as a statement of fact, and with the UNKNOWN-kind+    /// verification unchanged (the strictest floor, and at least the original+    /// file's size). The name is a label; the floor is the check.+    ///+    /// The runtime retry is deliberately KEPT rather than deleted: flip this to+    /// `true` if a future version accepts the neutral name, and the honest name+    /// comes back with the retry already covering the other outcome. What is not+    /// kept is an attempt this bridge has measured to be futile.+    const NEUTRAL_EXTENSION_ACCEPTED: bool = false;++    fn unique_recovery_path(dir: &str, title: &str, kind: Option<crate::disk::DocKind>) -> String {+        // AN UNKNOWN KIND IS NOT GIVEN A GUESSED EXTENSION. Naming a document+        // `.SLDPRT` because its type could not be read states something this+        // bridge does not know, in the one place downstream code was reading it+        // back from. The title's own extension is real evidence — the user or+        // SOLIDWORKS wrote it — so it is used when present; otherwise the file+        // gets a neutral name that claims nothing.+        let ext = match kind {+            Some(k) => k.extension(),+            // NOTHING ANYWHERE SAID WHAT THIS IS — no type, no path extension, no+            // title extension: a pathless document whose type could not be read.+            // A neutral name would be the honest label, and this install refuses+            // to write one (see NEUTRAL_EXTENSION_ACCEPTED), so the file is named+            // as a part and the RECORD carries the fact that the name is a guess.+            None if Self::NEUTRAL_EXTENSION_ACCEPTED => "sldrecover",+            None => crate::disk::DocKind::Part.extension(),+        };+        let stem_raw = title.rsplit_once('.').map(|(a, _)| a).unwrap_or(title);+        let stem: String = stem_raw+            .chars()+            .map(|c| if c.is_ascii_alphanumeric() || c == '-' || c == '_' { c } else { '_' })+            .collect();+        let stem = stem.trim_matches('_');+        let stem = if stem.is_empty() { "document" } else { stem };+        let sep = if dir.ends_with('\\') || dir.ends_with('/') { "" } else { "\\" };+        let first = format!("{dir}{sep}{stem}.{ext}");+        if !std::path::Path::new(&first).exists() {+            return first;+        }+        for n in 1..10_000 {+            let p = format!("{dir}{sep}{stem}-{n}.{ext}");+            if !std::path::Path::new(&p).exists() {+                return p;+            }+        }+        format!("{dir}{sep}{stem}-{}.{ext}", crate::launchos::epoch_ms())+    }+     /// ONE RUNG of the quit ladder (docs/QUIT-INVESTIGATION.md §5.3).     ///     /// Every rung ENDS with every COM reference released, and rungs (b)-(f)@@ -1146,7 +1552,14 @@ impl ComBackend {                 let _ = std::fs::create_dir_all(parent);             }         }-        // swSaveAsOptions_Silent = 1, swSaveAsOptions_Copy = 2+        // swSaveAsOptions_Silent = 1, swSaveAsOptions_Copy = 2.+        //+        // `copy: false` is SILENT ALONE, and that RE-POINTS the open document at+        // `out`. The safe-close sweep depends on exactly that (see+        // `cmd_preserve_and_close`): it reads the close key back off the document+        // after this call, and the key must be the recovery file. The export+        // verbs pass `copy: true` for the opposite reason — the user must keep+        // working on the document they had.         let options = if copy { 1 | 2 } else { 1 };         let r = doc.call("SaveAs3", &[&Var::bstr(out), &Var::i4(0), &Var::i4(options)])?;         // Belt and braces: a build that ever DOES return a bool here still reads@@ -1551,7 +1964,11 @@ fn literal_var(l: &Literal) -> Var {         Literal::Bool(b) => Var::boolean(*b),         // VT_EMPTY is how "argument omitted" reaches a late-bound optional         // [in] object parameter — SelectByID2's callout, LoadFile4's import data.-        Literal::Null => Var::empty(),+        // NOTHING, not "omitted" — see `Var::null_dispatch`. SelectByID2's+        // callout parameter is the documented use of this literal, and it is an+        // `[in]` object like LoadFile4's importData, which answered+        // `Type mismatch. (0x80020005)` to VT_EMPTY on the live install.+        Literal::Null => Var::null_dispatch(),     } } @@ -1785,6 +2202,22 @@ impl ComBackend {         // property, it is a bug — Drew authorized closing his own documents and         // the bridge told him no.         let env_on = crate::writes::user_writes_enabled();+        // DREW'S STANDING AUTHORIZATION for ENDING THE SESSION, honoured by the+        // host's own veto so the two layers agree. `userAuthorized:true` with a+        // reason grants the quit and nothing else — see writes::authorize. The+        // host still checks it for itself rather than trusting the server's word,+        // which is the point of being an independent veto.+        let authorized_quit = always+            && args.get("userAuthorized").and_then(|v| v.as_bool()).unwrap_or(false)+            && args+                .get("reason")+                .and_then(|v| v.as_str())+                .map(|r| r.trim().len() >= 8)+                .unwrap_or(false);+        if authorized_quit {+            return Ok(());+        }+         let missing = crate::writes::missing_opt_in(args);         if env_on && missing.is_empty() {             return Ok(());@@ -2158,6 +2591,7 @@ impl Backend for ComBackend {             "import" => self.cmd_import(args),              "close_import_temps" => self.cmd_close_import_temps(args),+            "preserve_and_close" => self.cmd_preserve_and_close(args),              // THE QUIT LADDER. One rung per call; the SERVER orchestrates and             // measures, because the measurement must not be a COM call.@@ -2911,12 +3345,422 @@ impl ComBackend {         }))     } +    /// OPEN A NEUTRAL FILE AS A LINKED PART — the 3D Interconnect route.+    ///+    /// `OpenDoc6(path, swDocPART, options, "", byref errors, byref warnings)`.+    /// The options value is `swOpenDocOptions_Silent` (1), the same one every+    /// other open in this bridge uses and for the same reason: an unattended+    /// bridge must never park SOLIDWORKS on a dialog nobody will answer. **That+    /// choice is not yet measured for THIS route** — the live run that proved the+    /// route exists did not vary the options — so it is reported in the reply+    /// rather than assumed silently.+    ///+    /// The result is a NEW PART holding a linked 3D Interconnect feature that+    /// points back at the source file. It is `linked: true`, and the reply says+    /// so: a caller who thinks it has a self-contained part would be wrong about+    /// what moving or deleting the source file does to it.+    fn import_via_opendoc6(+        &mut self,+        sw: &Disp,+        path: &str,+        before: i32,+        interconnect: Option<bool>,+        diagnostics: Option<bool>,+        args: &Value,+    ) -> Result<Value, HostError> {+        // (`dissolve` is refused in `cmd_import`, above the route choice, so it+        // fails closed on every route rather than only on this one.)+        let mut errors = 0i32;+        let mut warnings = 0i32;+        // MEASURED ENUM VALUES, for whoever runs the matrix next.+        //+        // `swOpenDocOptions_e`: Silent=1, ReadOnly=2, ViewOnly=4, RapidDraft=8,+        // LoadModel=16, AutoMissingConfig=32, OverrideDefaultLoadLightweight=64,+        // LoadLightweight=128, DontLoadHiddenComponents=256,+        // LoadExternalReferencesInMemory=512, OpenDetailingMode=1024,+        // LDR_EditAssembly=2048, SpeedPak=4096, AdvancedConfig=8192.+        //+        // `swFileLoadError_e`: swGenericError=1, swFileNotFoundError=2,+        // swInvalidFileTypeError=1024, swFileRequiresRepairError=2097152,+        // swApplicationBusy=8388608, swConnectedIsOffline=16777216.+        //+        // Live 2026-09-17 with options=1 and docType=1 on two real STEP files:+        // no document, errors=2097152 (swFileRequiresRepairError), warnings=0.+        // So this invocation is MEASURED WRONG, not measured right — the+        // defaults stay only until the matrix says what to change them to.+        let options = args.get("openOptions").and_then(|v| v.as_i64()).unwrap_or(1) as i32;+        let doc_type =+            args.get("docType").and_then(|v| v.as_i64()).unwrap_or(Self::DOC_TYPE_PART as i64) as i32;+        let invocation = json!({+            "method": "OpenDoc6",+            "args": {+                "path": path,+                "docType": doc_type,+                "options": options,+                "configuration": "",+                "errors": "byref i4",+                "warnings": "byref i4",+            },+        });+        let opened_call = sw+            .call(+                "OpenDoc6",+                &[+                    &Var::bstr(path),+                    &Var::i4(doc_type),+                    &Var::i4(options),+                    &Var::bstr(""),+                    &Var::byref_i4(&mut errors as *mut i32),+                    &Var::byref_i4(&mut warnings as *mut i32),+                ],+            )+            .map_err(|e| {+                let detail = e.detail.clone();+                let data = e.data.clone();+                let mut err = HostError::detailed(+                    format!(+                        "SOLIDWORKS could not open {path} as a 3D Interconnect part \+                         (errors={errors} warnings={warnings}). 3D Interconnect is ON, so a \+                         neutral file is opened rather than translated."+                    ),+                    detail.unwrap_or_else(|| e.message.clone()),+                );+                err.data = Some(json!({+                    "route": "OpenDoc6",+                    "invocation": invocation.clone(),+                    "interconnect": interconnect,+                    "importDiagnosticsAutoRun": diagnostics,+                    "openDoc6": data,+                    "errors": errors,+                    "warnings": warnings,+                    "path": path,+                }));+                err+            });+        // A CALL THAT THREW MAY STILL HAVE OPENED SOMETHING. Ask, before+        // reporting a failure that would leave it open and untracked.+        let opened = match opened_call {+            Ok(v) => v.as_dispatch().map(Disp),+            Err(mut err) => {+                let recount = self.claim_document_born_from_a_failure(sw, before, &mut err);+                if let Some(Value::Object(m)) = err.data.as_mut().map(|d| d) {+                    m.insert("afterFailure".into(), recount);+                }+                return Err(err);+            }+        };+        // OWN IT THE MOMENT IT EXISTS — the same rule the translator route+        // learned the hard way. The document this produces is PATHLESS (its title+        // comes from the source file), so without registration at birth the drain+        // could not identify it as the bridge's own.+        let born = opened.as_ref().map(Self::doc_info);+        if let Some(doc) = born.clone() {+            self.register_created(&doc);+        }+        let after = match Self::document_count(sw) {+            Some(c) => c,+            None => {+                let mut e = HostError::detailed(+                    "the import may or may not have completed: SOLIDWORKS stopped reporting how \+                     many documents are open. Check swx_docs before retrying — retrying blind \+                     could import the file twice."+                        .to_string(),+                    "GetDocumentCount returned nothing".to_string(),+                );+                e.created = born;+                return Err(e);+            }+        };+        let net = after - before;+        let Some(doc) = opened else {+            // F4 — NET > 0 WITH NO HANDLE. `OpenDoc6` returned nothing, and the+            // count says a document appeared anyway. The translator route has+            // recovered the handle from `ActiveDoc` since 0.5.x for exactly this+            // shape; this route returned an error and owned nothing, so whatever+            // had opened was unowned, uncounted and unmentioned — the leak+            // `register_created` exists to prevent, one route later.+            if after > before {+                if let Some(recovered) = sw.obj("ActiveDoc", &[]).ok().flatten() {+                    let info = Self::doc_info(&recovered);+                    self.register_created(&info);+                    return Ok(json!({+                        "imported": info,+                        "via": "OpenDoc6 (handle recovered from ActiveDoc)",+                        "invocation": invocation,+                        "interconnect": interconnect,+                        "interconnectSettingReadable": interconnect.is_some(),+                        "linked": true,+                        "sourcePath": path,+                        "errors": errors,+                        "warnings": warnings,+                        "documentsOpened": after - before,+                        "netCountOk": after - before == 1,+                        "documentCount": after,+                        "_hint": format!(+                            "OpenDoc6 returned no handle but a document appeared, so the handle was \+                             recovered from ActiveDoc and the document is OWNED by this bridge — \+                             it can be closed and drained. {}",+                            import_open_hint(after - before)+                        ),+                    }));+                }+            }+            return Err(HostError::detailed(+                format!(+                    "SOLIDWORKS opened nothing for {path} (errors={errors} warnings={warnings}). \+                     3D Interconnect is ON, so this file was opened as a part rather than \+                     translated."+                ),+                format!("OpenDoc6 returned no document; open-document count went {before} -> {after}"),+            )+            .with_data(json!({+                "route": "OpenDoc6",+                "invocation": invocation.clone(),+                "interconnect": interconnect,+                "importDiagnosticsAutoRun": diagnostics,+                "errors": errors,+                "warnings": warnings,+                "path": path,+            })));+        };+        Ok(json!({+            "imported": Self::doc_info(&doc),+            "via": "OpenDoc6 (3D Interconnect)",+            "invocation": invocation,+            // WHAT THE USER'S SETTING DECIDED, reported rather than implied.+            "interconnect": interconnect,+            "interconnectSettingReadable": interconnect.is_some(),+            // AND WHAT THAT MEANS FOR THE DOCUMENT: it is not self-contained.+            "linked": true,+            "sourcePath": path,+            "openOptions": options,+            "docType": doc_type,+            "openOptionsMeasured": false,+            "importDiagnosticsAutoRun": diagnostics,+            "errors": errors,+            "warnings": warnings,+            "documentsOpened": net,+            "netCountOk": net == 1,+            "documentCount": after,+            "_hint": format!(+                "{}3D Interconnect is ON in this user's SOLIDWORKS, so {path} was OPENED as a part \+                 holding a LINKED feature rather than translated — the part is NOT self-contained, \+                 and moving or deleting the source file changes it. This bridge never alters that \+                 preference. `dissolve:true` is refused until the breaking API is measured on this \+                 install.",+                import_open_hint(net)+            ),+        }))+    }++    /// A CALL THREW — DID IT LEAVE A DOCUMENT BEHIND ANYWAY?+    ///+    /// The import counts ONCE, before it starts, and every success path re-counts+    /// afterwards. The THROWING paths did not: a `LoadFile4` or `OpenDoc6` that+    /// raised a COM exception went straight to an error without asking whether a+    /// document had appeared regardless. If one had, it was open, untracked, and+    /// this host would later refuse to close it — because its own record said it+    /// had never made one, which is the exact leak `register_created` exists to+    /// prevent.+    ///+    /// So the error path re-counts, and if the session grew it takes ownership of+    /// the active document and reports it. Ownership at birth is not a+    /// happy-path rule.+    fn claim_document_born_from_a_failure(+        &mut self,+        sw: &Disp,+        before: i32,+        err: &mut HostError,+    ) -> Value {+        let after = match Self::document_count(sw) {+            Some(c) => c,+            None => return Value::Null,+        };+        if after <= before {+            return json!({"documentCountBefore": before, "documentCountAfter": after, "appeared": false});+        }+        let born = sw.obj("ActiveDoc", &[]).ok().flatten().map(|d| Self::doc_info(&d));+        if let Some(info) = born.clone() {+            self.register_created(&info);+            err.created = Some(info);+        }+        json!({+            "documentCountBefore": before,+            "documentCountAfter": after,+            // A DOCUMENT APPEARED DESPITE THE FAILURE, and it is now owned — so+            // the drain and the safe close can both reach it.+            "appeared": true,+            "claimed": born,+        })+    }++    /// `LoadFile2(path, "")` ALONE — for the matrix.+    ///+    /// In `auto` this only ever runs as a fallback after `LoadFile4`, so its+    /// answer has always been entangled with whatever the first call did to the+    /// session. Asked for by name it runs first and by itself, which is the only+    /// way its `false` — unexplained since 2026-09-17 — can be attributed to+    /// anything.+    fn import_via_loadfile2(+        &mut self,+        sw: &Disp,+        path: &str,+        before: i32,+        interconnect: Option<bool>,+        diagnostics: Option<bool>,+    ) -> Result<Value, HostError> {+        let invocation = json!({+            "method": "LoadFile2",+            "args": {"path": path, "arg": ""},+        });+        let call = sw.call("LoadFile2", &[&Var::bstr(path), &Var::bstr("")]);+        let failure = call.as_ref().err().map(|e| {+            json!({"message": e.message, "detail": e.detail, "code": e.code})+        });+        let returned = call.as_ref().ok().and_then(|v| v.as_bool());+        if returned != Some(true) {+            return Err(HostError::detailed(+                format!(+                    "SOLIDWORKS could not import {path} by LoadFile2 alone (returned {returned:?})"+                ),+                failure+                    .as_ref()+                    .and_then(|f| f.get("detail").and_then(|d| d.as_str()).map(|s| s.to_string()))+                    .unwrap_or_else(|| "LoadFile2 returned false".into()),+            )+            .with_data(json!({+                "route": "LoadFile2",+                "invocation": invocation,+                "interconnect": interconnect,+                "importDiagnosticsAutoRun": diagnostics,+                "loadFile2": {"returned": returned, "failure": failure},+                "path": path,+            })));+        }+        let doc = sw+            .obj("ActiveDoc", &[])?+            .ok_or_else(|| HostError::msg("LoadFile2 reported success but no document became active"))?;+        let info = Self::doc_info(&doc);+        // OWN IT THE MOMENT IT EXISTS, exactly as the other routes do.+        self.register_created(&info);+        let after = Self::document_count(sw);+        let net = after.map(|a| a - before);+        Ok(json!({+            "imported": info,+            "via": "LoadFile2",+            "invocation": invocation,+            "interconnect": interconnect,+            "interconnectSettingReadable": interconnect.is_some(),+            "importDiagnosticsAutoRun": diagnostics,+            "linked": false,+            "errors": 0,+            "documentsOpened": net,+            "netCountOk": net == Some(1),+            "documentCount": after,+            "_hint": "Imported by LoadFile2 asked for BY NAME — a measurement route, not the \+                      default. It left one new open, unsaved document.",+        }))+    }++    /// WHY `dissolve:true` IS REFUSED RATHER THAN GUESSED.    /// WHY `dissolve:true` IS REFUSED RATHER THAN GUESSED.+    ///+    /// Breaking a 3D Interconnect link is a WRITE to the user's document, and the+    /// call that does it has not been measured on this install. This project has+    /// already shipped one confident claim about somebody else's format from+    /// memory — the OLE compound-file signature of pass 23, which was wrong for+    /// every modern SOLIDWORKS file — and that one only cost a refusal. A wrong+    /// guess here modifies a document.+    ///+    /// So the refusal names exactly what has to be measured, and the safe route+    /// that needs no new API at all.+    fn dissolve_refusal() -> HostError {+        let mut e = HostError::coded(+            "dissolve_not_measured",+            "this bridge will not break a 3D Interconnect link with an API it has not verified on \+             this install. The import itself went ahead as a LINKED part (that is what 3D \+             Interconnect does); nothing was changed.",+        );+        e.detail = Some(+            "To settle it, measure which call actually breaks the link on this edition — the \+             candidates are ModelDocExtension::BreakAllExternalFileReferences2 and the 3D \+             Interconnect feature's own Dissolve — and verify the EFFECT (the linked feature is \+             gone and the body survives), not the return value. Until then: import linked, then \+             dissolve in the SOLIDWORKS UI, or turn 3D Interconnect off in Options and import \+             again, which this bridge will route through LoadFile4."+                .into(),+        );+        e+    }++    /// `swMultiCAD_Enable3DInterconnect` — **measured live, 2026-09-17: TRUE.**+    ///+    /// The id and the neighbouring diagnostics toggles were read from the+    /// installed `SolidWorks.Interop.swconst.dll` at+    /// `C:\Program Files\Dassault Systemes\SOLIDWORKS 3DEXPERIENCE R2026x\SOLIDWORKS\`+    /// and then read back off the running application with+    /// `GetUserPreferenceToggle`:+    ///+    /// ```text+    /// 691  swMultiCAD_Enable3DInterconnect        TRUE+    /// 291  swImportAutoRunImportDiagnostics       TRUE+    /// 690  swImportNeutralRunDiagnostics          TRUE+    /// 639  swForceEnableImportDiagnosis           FALSE+    /// ```+    const PREF_3D_INTERCONNECT: i32 = 691;+    /// `swImportAutoRunImportDiagnostics` — TRUE on this install, which is why a+    /// STEP with faulty faces raises a MODAL Import Diagnostics dialog.+    const PREF_AUTO_IMPORT_DIAGNOSTICS: i32 = 291;+    /// `swDocPART` — the document type an interconnect open produces.+    const DOC_TYPE_PART: i32 = 1;++    /// Read a user preference toggle. `None` when SOLIDWORKS would not answer —+    /// an unreadable preference is UNKNOWN, and the import reports it as such+    /// rather than assuming the default.+    fn pref_toggle(sw: &Disp, id: i32) -> Option<bool> {+        sw.call("GetUserPreferenceToggle", &[&Var::i4(id)]).ok().and_then(|v| v.as_bool())+    }+     /// `swx_import` — bring a neutral CAD file in as a new document.     ///-    /// `LoadFile4(path, "r", importData, byref errors)` is the modern route; the-    /// `importData` argument is the optional object our `null` VARIANT covers.-    /// NOT proven live (SOLIDWORKS Connected was down when this was written), so-    /// it falls back to `LoadFile2(path, "")`, which at least reports honestly.+    /// **WHAT IS MEASURED, AND WHAT IS NOT.** This distinction is the whole+    /// state of this verb, and two releases in a row have gone wrong by blurring+    /// it.+    ///+    /// MEASURED on this install (2026-09-17):+    ///+    /// * `swMultiCAD_Enable3DInterconnect` (691) is **TRUE**.+    /// * `LoadFile4` with the correct variant encoding EXECUTES and returns no+    ///   document, `errors = 1` (`swGenericError`).+    /// * `LoadFile2` returns **false**. Still unexplained.+    /// * `OpenDoc6(path, swDocPART, 1, "", …)` on a real `.step` returns no+    ///   document, `errors = 2097152` (`swFileRequiresRepairError`), warnings 0,+    ///   open-document count unchanged — for a 25 KB McMaster AP203 file and a+    ///   4.6 MB one alike.+    ///+    /// **NOT MEASURED:** what the 691 toggle actually implies about the route. I+    /// wrote in 0.8.0 that it meant "OpenDoc6 with swDocPART", from recollection,+    /// and the live run says that is wrong. No route is known to work on this+    /// edition today.+    ///+    /// So this verb carries a MEASUREMENT SURFACE (`route`, `openOptions`,+    /// `docType`, `withImportData`, `argString`) and echoes the exact+    /// `invocation` it made. `route:"auto"` keeps the shipped behaviour; the rest+    /// exist so the matrix can be run against the real application, which is the+    /// only thing that can answer this — PowerShell cannot drive SOLIDWORKS+    /// Connected at all (every member call fails `TYPE_E_ELEMENTNOTFOUND`+    /// 0x8002802B, because Connected does not expose the type info the COM+    /// adapter needs), so raw IDispatch through this bridge is the only+    /// instrument there is.+    ///+    /// **THE TOGGLE IS NEVER CHANGED.** Not set, and not flipped-and-restored: a+    /// crash between the two halves would leave the user's SOLIDWORKS configured+    /// differently than they left it, and a CAD setting silently altered by a+    /// tool is exactly the kind of harm this bridge exists not to do. The+    /// preference is READ, reported, and obeyed.+    ///+    /// `LoadFile2` returning `false` on this install is still UNEXPLAINED. It is+    /// not the interconnect story — it was the route that appeared to work from+    /// 09-05 to 09-11 — and it has not been diagnosed.     fn cmd_import(&mut self, args: &Value) -> Result<Value, HostError> {         let path = args             .get("filePath")@@ -2928,6 +3772,36 @@ impl ComBackend {             return Err(HostError::msg(format!("file not found: {path}")));         }         let sw = self.app(false, true)?;+        // THE USER'S SETTING, READ AND OBEYED — never written. `None` means+        // SOLIDWORKS would not answer, and an unreadable preference is UNKNOWN:+        // the translator route is attempted and the reply says the toggle could+        // not be read, rather than a default being assumed.+        let interconnect = Self::pref_toggle(&sw, Self::PREF_3D_INTERCONNECT);+        let diagnostics = Self::pref_toggle(&sw, Self::PREF_AUTO_IMPORT_DIAGNOSTICS);+        // ── THE MEASUREMENT SURFACE. Named routes and exact arguments, so the+        //    matrix can be run against the live application instead of recalled.+        //    `auto` is the shipped behaviour and the default; an unknown route is+        //    REFUSED rather than silently treated as auto, because a typo that+        //    quietly measures something else is worse than no measurement.+        let route = args.get("route").and_then(|v| v.as_str()).unwrap_or("auto").to_ascii_lowercase();+        if !matches!(route.as_str(), "auto" | "loadfile4" | "loadfile2" | "opendoc6") {+            return Err(HostError::coded(+                "unknown_import_route",+                format!(+                    "unknown import route {route:?} — expected \"auto\", \"loadfile4\", \+                     \"loadfile2\" or \"opendoc6\""+                ),+            ));+        }+        // F2 — DISSOLVE IS REFUSED BEFORE ANY ROUTE IS CHOSEN. It used to live+        // inside the interconnect route only, so asking for it while the toggle+        // was off (or unreadable) SILENTLY DROPPED it: the caller asked for an+        // unlinked import, got a linked-or-not import with no answer either way,+        // and nothing said so. A request this bridge will not honour must fail+        // closed on every route.+        if args.get("dissolve").and_then(|v| v.as_bool()).unwrap_or(false) {+            return Err(Self::dissolve_refusal());+        }         let mut errors = 0i32;         // Count first. LoadFile4 can IMPORT SUCCESSFULLY and still hand back         // something that is not an IDispatch we can use — and the first version@@ -2953,16 +3827,110 @@ impl ComBackend {                 ))             }         };+        // ── OPENDOC6 ONLY WHEN ASKED FOR BY NAME. `auto` no longer prefers it+        //    under 3D Interconnect: the matrix measured that route returning+        //    `errors=2097152` (swFileRequiresRepairError) on every option value+        //    tried, so preferring it would be preferring a known failure.+        if route == "opendoc6" {+            return self.import_via_opendoc6(&sw, path, before, interconnect, diagnostics, args);+        }+        // ── LOADFILE2 ALONE, for the matrix: no LoadFile4 first, so its answer+        //    is its own rather than a fallback's.+        if route == "loadfile2" {+            return self.import_via_loadfile2(&sw, path, before, interconnect, diagnostics);+        }++        // ── THE TRANSLATOR ROUTE.+        // ONE CALL, WITH THE ENCODING THE LIVE FAILURE NAMED. `importData` is an+        // `[in]` OBJECT parameter, and "no import data" is a NULL DISPATCH, not+        // VT_EMPTY — measured 2026-09-17 as+        // `Type mismatch. (0x80020005) (argument index 1)`, which with the+        // reversed `rgvarg` packing is this third parameter exactly.+        //+        // Deliberately NOT retried with the old encoding on failure: a silent+        // second attempt would make the next live run ambiguous about which+        // spelling SOLIDWORKS accepted, and this bridge has spent two releases+        // learning that a guess nobody can see is worse than a failure somebody+        // can read.+        // THE SECOND ARGUMENT, overridable for the matrix. "r" is what every+        // published example passes and what this bridge has always used; nothing+        // has measured whether it is right on this edition.+        let arg_string = args.get("argString").and_then(|v| v.as_str()).unwrap_or("r").to_string();+        // AND THE IMPORT DATA. `null_dispatch` is Nothing — correct as of 0.7.9,+        // and still not enough to make the call work here. `withImportData:true`+        // asks SOLIDWORKS for a real `ImportFileData` object with+        // `GetImportFileData(path)` and passes THAT, which is the other thing the+        // signature will take. What that call returns is reported rather than+        // assumed: an object, nothing, or a failure.+        let want_data = args.get("withImportData").and_then(|v| v.as_bool()).unwrap_or(false);+        let mut import_data_report = Value::Null;+        let import_data = if want_data {+            match sw.call("GetImportFileData", &[&Var::bstr(path)]) {+                Ok(v) => {+                    let d = v.as_dispatch().map(Disp);+                    import_data_report = json!({+                        "returnedObject": d.is_some(),+                        // The type name where SOLIDWORKS will give one. It is a+                        // read, so a failure here is reported as null rather than+                        // failing the import.+                        "typeName": d.as_ref().and_then(|o| o.string("GetType", &[]))+                            .map(Value::from).unwrap_or(Value::Null),+                    });+                    d+                }+                Err(e) => {+                    import_data_report = json!({+                        "returnedObject": false,+                        "failure": {"message": e.message, "detail": e.detail},+                    });+                    None+                }+            }+        } else {+            None+        };+        let data_arg = match &import_data {+            Some(d) => Var::dispatch(&d.0),+            None => Var::null_dispatch(),+        };         let load4 = sw.call(             "LoadFile4",             &[                 &Var::bstr(path),-                &Var::bstr("r"),-                &Var::empty(),+                &Var::bstr(&arg_string),+                &data_arg,                 &Var::byref_i4(&mut errors as *mut i32),             ],         );-        let load4_err = load4.as_ref().err().map(|e| e.message.clone());+        // THE EXACT CALL THAT WAS MADE, echoed on every reply. A matrix of+        // results is only readable if each row states its own invocation.+        let invocation = json!({+            "method": "LoadFile4",+            "args": {+                "path": path,+                "argString": arg_string,+                "importData": if import_data.is_some() { "GetImportFileData(path)" } else { "Nothing (null VT_DISPATCH)" },+                "errors": "byref i4",+            },+            "importFileData": import_data_report,+        });+        // KEEP THE WHOLE FAILURE, not its first sentence. `variant.rs` puts the+        // HRESULT, the EXCEPINFO source and description and the failing argument+        // index onto `detail`; 0.7.7 kept only `message`, so a live run where+        // EVERY STEP import began failing reported "SOLIDWORKS rejected+        // 'LoadFile4'" and nothing a person could act on. The translator's own+        // number is the entire diagnosis.+        let load4_fail: Option<Value> = load4.as_ref().err().map(|e| {+            json!({+                "message": e.message,+                "detail": e.detail,+                "code": e.code,+            })+        });+        let load4_err = load4.as_ref().err().map(|e| match &e.detail {+            Some(d) if !d.trim().is_empty() => format!("{}: {}", e.message, d),+            _ => e.message.clone(),+        });         let imported = load4.ok().and_then(|v| v.as_dispatch()).map(Disp);         // OWN IT THE MOMENT IT EXISTS. Registration used to happen in the         // dispatcher, on the way out — so any failure AFTER the document was@@ -2996,6 +3964,10 @@ impl ComBackend {             return Ok(json!({                 "imported": Self::doc_info(&doc),                 "via": "LoadFile4",+                "invocation": invocation.clone(),+                "interconnect": interconnect,+                "interconnectSettingReadable": interconnect.is_some(),+                "linked": false,                 "errors": errors,                 "documentsOpened": net,                 "netCountOk": net == 1,@@ -3021,6 +3993,7 @@ impl ComBackend {             return Ok(json!({                 "imported": Self::doc_info(&doc),                 "via": "LoadFile4 (handle recovered from ActiveDoc)",+                "invocation": invocation.clone(),                 "titleMayBeAnotherConcurrentImport": true,                 "errors": errors,                 "documentsOpened": net,@@ -3029,22 +4002,160 @@ impl ComBackend {                 "_hint": format!("{}{}", import_open_hint(net), RECOVERED_HANDLE_CAVEAT),             }));         }-        let ok = sw.call("LoadFile2", &[&Var::bstr(path), &Var::bstr("")])?.as_bool().unwrap_or(false);+        // THE SECOND ROUTE'S OWN ANSWER IS ALSO REPORTED. "LoadFile2 refused" and+        // "LoadFile2 threw" are different failures, and the reply used to show+        // neither.+        let load2 = sw.call("LoadFile2", &[&Var::bstr(path), &Var::bstr("")]);+        let load2_fail: Option<Value> = load2.as_ref().err().map(|e| {+            json!({"message": e.message, "detail": e.detail, "code": e.code})+        });+        let ok = load2.as_ref().ok().and_then(|v| v.as_bool()).unwrap_or(false);+        // ── THE MEASURED DEAD END. On SOLIDWORKS Connected 2026 with+        //    `swMultiCAD_Enable3DInterconnect` TRUE there is NO programmatic+        //    neutral-file import route: the matrix of 2026-09-17 tried LoadFile4+        //    with Nothing and with a real ImportFileData object (errors=1 both),+        //    LoadFile2 (false), and OpenDoc6 across four option values and two+        //    document types (2097152 = requires repair, 1024 = invalid file+        //    type). The imports that worked from 09-05 to 09-11 must have run+        //    with the toggle OFF.+        //+        //    So `auto` still makes ONE LoadFile4 attempt — a future edition that+        //    accepts it will simply work — and then says what is actually wrong,+        //    naming the setting, rather than reporting a translator failure that+        //    would send the reader looking for a missing translator.+        //+        //    THE SETTING IS THE USER'S. This bridge does not change it and will+        //    not offer to.+        // F3 — AN UNREADABLE SETTING IS NOT "OFF". `None` means SOLIDWORKS would+        // not answer; `Some(false)` means the user turned it off. They take the+        // same route and mean opposite things about how much to trust the result,+        // so a failure under an unreadable toggle is reported as ITS OWN+        // outcome rather than as a translator that is missing.+        if !ok && route == "auto" && interconnect.is_none() {+            let mut e = HostError::coded(+                "interconnect_setting_unreadable",+                format!(+                    "SOLIDWORKS could not import {path}, and this bridge could not read whether 3D \+                     Interconnect is on — `GetUserPreferenceToggle(691)` gave no answer. With that \+                     setting ON, no programmatic import route works on this edition (measured \+                     2026-09-17), so the most likely cause of this failure cannot be confirmed or \+                     ruled out. Nothing was opened and nothing was changed."+                ),+            );+            e.detail = Some(+                "Check Tools > Options > System Options > Import > \"Enable 3D Interconnect\". If \+                 it is on, turn it off and import again. This bridge does not change user \+                 settings. swx_status shows whether COM is answering at all."+                    .into(),+            );+            e.data = Some(json!({+                "interconnect": Value::Null,+                "interconnectSettingReadable": false,+                "invocation": invocation.clone(),+                "loadFile4": load4_fail,+                "loadFile2": {"returned": load2.as_ref().ok().and_then(|v| v.as_bool()), "failure": load2_fail},+                "errors": errors,+                // WHAT THE COUNT DID: whether a document was left behind is the+                // fact ownership turns on. Named as the SUCCESS reply names them,+                // so a caller reads one vocabulary either way.+                "documentCountBefore": before,+                "documentCount": Self::document_count(&sw),+                "documentsOpened": Self::document_count(&sw).map(|a| a - before),+                "path": path,+            }));+            return Err(e);+        }+        if !ok && route == "auto" && interconnect == Some(true) {+            // "NOTHING WAS OPENED" MUST BE MEASURED AFTER THE LAST CALL THAT+            // COULD OPEN SOMETHING. The count behind this claim was taken before+            // LoadFile2 ran, so a LoadFile2 that returned false while still+            // leaving a document behind would be reported as a no-op — and the+            // document would be open, unowned and unmentioned.+            // Measured FIRST, so the sentence can be true either way.+            let mut e = HostError::coded("interconnect_blocks_import", String::new());+            let appeared = self.claim_document_born_from_a_failure(&sw, before, &mut e);+            let opened_anyway = appeared.get("appeared").and_then(|v| v.as_bool()).unwrap_or(false);+            e.message = format!(+                "SOLIDWORKS cannot import {path} while 3D Interconnect is on. Measured on this \+                 edition 2026-09-17: with `swMultiCAD_Enable3DInterconnect` TRUE, no programmatic \+                 route imports a neutral file — LoadFile4 returns nothing (errors=1) with or \+                 without ImportFileData, LoadFile2 returns false, and OpenDoc6 answers \+                 swFileRequiresRepairError. {}",+                if opened_anyway {+                    "A document appeared ANYWAY and this bridge has taken ownership of it — see \+                     `afterFailure.claimed`; it can be closed and drained."+                } else {+                    "Nothing was opened and nothing was changed."+                }+            );+            // ASK, DO NOT INSTRUCT. This used to read "Turn it off in+            // SOLIDWORKS: Tools > Options > …", which is a runbook — and an agent+            // holding a desktop bridge can execute a runbook. The setting belongs+            // to the user; the bridge's job is to say what would unblock the+            // import and let them decide, not to describe the keystrokes as+            // though somebody should perform them.+            e.detail = Some(format!(+                "ASK THE USER to turn 3D Interconnect off if they want this import (it lives at \+                 Tools > Options > System Options > Import > \"Enable 3D Interconnect\"), then \+                 try again — this bridge will route through LoadFile4 and say so. THIS BRIDGE \+                 DOES NOT CHANGE USER SETTINGS, not even temporarily: a crash between changing \+                 and restoring would leave SOLIDWORKS configured differently than they left it. \+                 (To measure the matrix again, swx_import takes \+                 route/openOptions/docType/withImportData/argString and echoes the exact \+                 invocation.)"+            ));+            e.data = Some(json!({+                "interconnect": true,+                "importDiagnosticsAutoRun": diagnostics,+                "afterFailure": appeared,+                "invocation": invocation.clone(),+                "loadFile4": load4_fail,+                "loadFile2": {"returned": load2.as_ref().ok().and_then(|v| v.as_bool()), "failure": load2_fail},+                "errors": errors,+                // WHAT THE COUNT DID: whether a document was left behind is the+                // fact ownership turns on. Named as the SUCCESS reply names them,+                // so a caller reads one vocabulary either way.+                "documentCountBefore": before,+                "documentCount": Self::document_count(&sw),+                "documentsOpened": Self::document_count(&sw).map(|a| a - before),+                "path": path,+                "measured": "2026-09-17: LoadFile4 errors=1 (Nothing and ImportFileData),                              LoadFile2 false, OpenDoc6 docType 1 options 0/1/2/16 errors=2097152,                              docType 0 options 1 errors=1024",+                "userSettingPath": "Tools > Options > System Options > Import > Enable 3D Interconnect",+            }));+            return Err(e);+        }         if !ok {             return Err(HostError::detailed(                 format!(                     "SOLIDWORKS could not import {path} (LoadFile4 opened nothing, errors={errors}; \-                     LoadFile2 refused). Importable formats depend on the installed translators."+                     LoadFile2 {}). Importable formats depend on the installed translators.",+                    if load2_fail.is_some() { "failed" } else { "refused" }                 ),                 load4_err.unwrap_or_else(|| "LoadFile4 returned no document".into()),-            ));+            )+            .with_data(json!({+                "invocation": invocation.clone(),+                "interconnect": interconnect,+                "importDiagnosticsAutoRun": diagnostics,+                "loadFile4": load4_fail,+                "loadFile2": {+                    "returned": load2.as_ref().ok().and_then(|v| v.as_bool()),+                    "failure": load2_fail,+                },+                "errors": errors,+                "path": path,+            })));         }         let doc = sw             .obj("ActiveDoc", &[])?             .ok_or_else(|| HostError::msg("import reported success but no document became active"))?;         Ok(json!({             "imported": Self::doc_info(&doc),-            "via": "LoadFile2",+            "via": "LoadFile2 (after LoadFile4)",+            "invocation": invocation.clone(),+            "interconnect": interconnect,+            "interconnectSettingReadable": interconnect.is_some(),+            "linked": false,             "errors": errors,             "documentsOpened": 1,         }))

@@ -30,6 +30,19 @@ pub struct HostError {     /// server's. Carried over the wire so the server's `hung` verdict never has     /// to guess a timeout from the wording of a message.     pub timed_out: bool,+    /// WHAT THE FAILING CALL ACTUALLY SAID, structured.+    ///+    /// Live, 2026-09-17: every STEP import began failing with `LoadFile4` raising+    /// a COM exception, and the reply the caller saw was+    /// *"SOLIDWORKS could not import … (LoadFile4 opened nothing, errors=0;+    /// LoadFile2 refused)"* with the detail *"SOLIDWORKS rejected 'LoadFile4'"*.+    /// The HRESULT, the EXCEPINFO source and description and the argument index+    /// — all of which `variant.rs` had already put on the inner error — were+    /// dropped on the floor, because the import kept only `e.message`. A caller+    /// cannot diagnose a translator from prose that omits the one number the+    /// translator returned. This field carries the structured remains of the+    /// inner failure through to the reply.+    pub data: Option<serde_json::Value>,     /// A DOCUMENT THIS CALL CREATED BEFORE IT FAILED.     ///     /// Live, 2026-09-11: an import whose com host timed out AFTER `LoadFile4`@@ -51,19 +64,25 @@ impl HostError {     }      pub fn msg(message: impl Into<String>) -> Self {-        Self { message: message.into(), detail: None, code: None, timed_out: false, created: None }+        Self { message: message.into(), detail: None, code: None, timed_out: false, created: None, data: None }     }      /// A call the HOST abandoned. One half of `host_app_hung`.     pub fn timeout(message: impl Into<String>) -> Self {-        Self { message: message.into(), detail: None, code: None, timed_out: true, created: None }+        Self { message: message.into(), detail: None, code: None, timed_out: true, created: None, data: None }     }     pub fn detailed(message: impl Into<String>, detail: impl Into<String>) -> Self {-        Self { message: message.into(), detail: Some(detail.into()), code: None, timed_out: false, created: None }+        Self { message: message.into(), detail: Some(detail.into()), code: None, timed_out: false, created: None, data: None }+    }++    /// Attach the structured remains of an inner failure.+    pub fn with_data(mut self, data: serde_json::Value) -> Self {+        self.data = Some(data);+        self     }     /// A failure a caller can branch on.     pub fn coded(code: &str, message: impl Into<String>) -> Self {-        Self { message: message.into(), detail: None, code: Some(code.to_string()), timed_out: false, created: None }+        Self { message: message.into(), detail: None, code: Some(code.to_string()), timed_out: false, created: None, data: None }     } } @@ -164,6 +183,20 @@ pub const READ_ONLY_COMMANDS: &[&str] = &[     //                        version closed a user's saved file with `CloseDoc`     //                        (no save prompt). See `is_import_temp`.     "close_import_temps",+    //   `preserve_and_close`  CLOSES EVERY OPEN DOCUMENT, including the user's,+    //                        and is on this list deliberately. Drew's standing+    //                        authorization of 2026-09-11 — "you MUST find/build a+    //                        way to safely close the docs/program" — makes the+    //                        CLOSE authorized. It does not make losing anything+    //                        authorized, and those are different permissions, so+    //                        the guard that replaces the opt-in is a SEQUENCE+    //                        rather than a question: every document is saved to+    //                        the recovery folder and verified on disk BEFORE+    //                        anything closes, and a document that could not be+    //                        saved is not closed. The user's own files are never+    //                        written over — a dirty document with a path is saved+    //                        into recovery, not over its original.+    "preserve_and_close",     //   `release_com` / `com_refs`  Drop or count the IDispatch pointers THIS     //                        HOST holds. They change nothing in SOLIDWORKS — a     //                        client releasing its own reference is not a write —@@ -260,6 +293,186 @@ pub const DOC_SAMPLE_BUDGET_SECS: u64 = 5; /// where they are rare it stops and reports what it scanned. pub const DRAIN_WALK_BUDGET_SECS: u64 = 20; +/// The smallest a RECOVERY FILE may be and still count as written.+///+/// 0.7.1 used 1 KB, and the comment above the check said why that was wrong: if+/// the smallest real SOLIDWORKS document is TENS of kilobytes, a 1 KB floor does+/// not separate a written file from a TRUNCATED one — only from an empty one. A+/// partial write on a full disk does not usually stop at zero bytes; it stops+/// somewhere in the middle, at 2 KB or 8 KB or 30 KB, and every one of those+/// passed a 1 KB floor and authorised a close.+///+/// 16 KB is MEASURED to be safe in the direction that matters. Across the 166+/// real documents in this container (see `SWDOC_FORMAT_MARKER`) the smallest of+/// any kind is a 29,130-byte part; the smallest assembly is 95,492 and the+/// smallest drawing 319,803. The floor must never reject a real document, so it+/// sits below the smallest one observed — with room for an empty new part, which+/// is smaller than anything in a repository of finished work.+///+/// This is the floor for a PART, and the weakest of the three: an assembly and a+/// drawing are held to more (`DocKind::min_recovery_bytes`), because the smallest+/// real one of each measured here is 95,492 and 319,803 bytes. It is the value a+/// file of unrecognised kind is held to, since it is the one that cannot reject a+/// genuine document of any kind.+///+/// It is deliberately not the whole check. The decisive test is structural — see+/// `recovery_file_verdict` — because a fragment can be any size.+pub const MIN_RECOVERY_BYTES: u64 = 24 * 1024;++/// The OLE Compound File (CFBF) magic. **Legacy SOLIDWORKS only.**+///+/// Pass 23 proposed this as THE structural check: "SOLIDWORKS documents are OLE+/// compound files, so a real one begins with D0 CF 11 E0 A1 B1 1A E1". That was+/// true of older SOLIDWORKS and is the answer the whole internet still gives, and+/// it is WRONG for the files this bridge will actually be handed — see+/// `SWDOC_FORMAT_MARKER`. It is kept because an older document opened from an+/// archive genuinely is a compound file, and accepting one costs nothing.+pub const OLE_COMPOUND_FILE_SIGNATURE: [u8; 8] = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];++/// Bytes 4..8 of a modern SOLIDWORKS document. **Measured, not assumed.**+///+/// 2026-09-11, on 166 real `.SLDPRT` / `.SLDASM` / `.SLDDRW` files from three+/// independent hardware repositories in this container (`cosmiic-pg4-hardware`,+/// `cosmiic-bp2-hardware`, `cosmiic-pm-hardware`):+///+///   * **0 of 166** begin with the OLE compound-document signature. It does not+///     appear anywhere in the first 4 MB of any of them. Modern SOLIDWORKS does+///     not use CFBF.+///   * **166 of 166** carry `00 00 00 04` at offset 4. Bytes 0..4 differ per+///     file (they look like a per-document identifier); bytes 4..8 do not vary+///     across parts, assemblies, drawings, repositories or file sizes from 29 KB+///     to 37 MB.+///+/// Had the CFBF check shipped as specified, `recovery_file_verdict` would have+/// rejected EVERY document on a modern install — failing closed, so nothing would+/// have been lost, but the sweep would have preserved everything and closed+/// nothing, for ever. The verb Drew asked for would have been inert.+pub const SWDOC_FORMAT_MARKER: [u8; 4] = [0x00, 0x00, 0x00, 0x04];++/// Which container a recovery file turned out to be, if this bridge knows it.+pub fn recognised_container(head: &[u8]) -> Option<&'static str> {+    if head.len() >= 8 && head[..8] == OLE_COMPOUND_FILE_SIGNATURE {+        return Some("ole-compound");+    }+    if head.len() >= 8 && head[4..8] == SWDOC_FORMAT_MARKER {+        return Some("swdoc");+    }+    None+}++/// What a recovery file is, as far as this bridge can tell from the outside.+#[derive(Debug, Clone)]+pub struct RecoveryVerdict {+    /// Size on disk. `0` also covers "could not be measured" — see `why`.+    pub bytes: u64,+    /// Whether the head of the file identifies a container this bridge knows.+    pub signature_ok: bool,+    /// Which one, when it does: `"swdoc"` or `"ole-compound"`.+    pub container: Option<&'static str>,+    /// True only when this file may be closed against.+    pub ok: bool,+    /// Why not, in terms of the harm, when `ok` is false.+    pub why: Option<String>,+}++/// IS THIS FILE REALLY THE DOCUMENT? Asked before the document is closed, which+/// is the last moment anybody can ask.+///+/// It **fails closed** on purpose. Anything this cannot read, cannot measure, or+/// does not recognise is NOT preserved, and the document stays open. If a future+/// SOLIDWORKS changed container format, this check would start refusing to close+/// documents — visibly, with the signature it actually found in the message —+/// rather than closing them against files it cannot vouch for. Refusing to close+/// is a nuisance; closing wrongly loses the user's work, and those are not the+/// same size of mistake.+pub fn recovery_file_verdict(+    path: &str,+    kind: Option<crate::disk::DocKind>,+    original_bytes: Option<u64>,+) -> RecoveryVerdict {+    use std::io::Read;+    let refuse = |bytes: u64, why: String| RecoveryVerdict {+        bytes,+        signature_ok: false,+        container: None,+        ok: false,+        why: Some(why),+    };+    if path.trim().is_empty() {+        return refuse(0, "no recovery path to check".into());+    }+    let bytes = match std::fs::metadata(path) {+        Ok(m) => m.len(),+        Err(e) => return refuse(0, format!("the recovery file could not be measured: {e}")),+    };+    let mut head = [0u8; 8];+    let read = std::fs::File::open(path).and_then(|mut f| f.read_exact(&mut head).map(|_| ()));+    if read.is_err() {+        return refuse(+            bytes,+            format!(+                "the first 8 bytes of the recovery file could not be read, so this bridge cannot \+                 tell whether it is a document at all — it was NOT closed"+            ),+        );+    }+    let Some(container) = recognised_container(&head) else {+        let found = head.iter().map(|b| format!("{b:02X}")).collect::<Vec<_>>().join(" ");+        return refuse(+            bytes,+            format!(+                "the recovery file does not begin like a SOLIDWORKS document (found {found}; \+                 expected 00 00 00 04 at offset 4, or the legacy OLE compound-document signature \+                 D0 CF 11 E0 A1 B1 1A E1 at offset 0), so it is not something this bridge can \+                 vouch for — the document was NOT closed"+            ),+        );+    };+    // PER KIND, because the three kinds are not the same size: the smallest real+    // part measured here is 29,130 bytes, the smallest assembly 95,492 and the+    // smallest drawing 319,803. One floor for all three would have to be the+    // lowest of them, which would let an assembly stop at a third of its size and+    // still pass.+    //+    // THE KIND IS PASSED IN, NOT READ OFF THE NAME. 0.7.4 called+    // `from_hint(path)` here, and the path is the one this sweep chose FROM THE+    // TYPE — so a single unreadable `GetType` named the file `.SLDPRT` and this+    // function then read "part" back out of it. The verification was asking the+    // question to its own answer, and a 30 KB truncated assembly cleared the+    // 24 KB part floor. A derived value cannot check the thing it was derived+    // from.+    let floor = match kind {+        Some(k) => k.min_recovery_bytes(),+        // UNKNOWN KIND TAKES THE HIGHEST FLOOR, and, when the document had a file+        // of its own, at least what that file weighed. Refusing to close is the+        // safe error: it is loud, it names the file and the number, and nothing+        // is lost. Closing against a file nobody could classify is not.+        None => crate::disk::DocKind::unknown_kind_floor().max(original_bytes.unwrap_or(0)),+    };+    if bytes < floor {+        return RecoveryVerdict {+            bytes,+            signature_ok: true,+            container: Some(container),+            ok: false,+            why: Some(match kind {+                Some(k) => format!(+                    "the recovery file holds {bytes} byte(s), below the {floor} this bridge \+                     requires of a real {k:?} — a truncated write is what a full disk produces, \+                     so the document was NOT closed"+                ),+                None => format!(+                    "the recovery file holds {bytes} byte(s) and this bridge could not establish \+                     what KIND of document it is, so it is held to the strictest floor it has \+                     ({floor}) — an unclassifiable document is not closed against an unchecked \+                     file"+                ),+            }),+        };+    }+    RecoveryVerdict { bytes, signature_ok: true, container: Some(container), ok: true, why: None }+}+ /// The resolved `%TEMP%` this process would use, lowercased with `\` separators /// and no trailing slash. `None` when the environment does not say. ///@@ -618,6 +831,7 @@ pub const COMMANDS: &[&str] = &[     "inspect_bodies",     "import",     "close_import_temps",+    "preserve_and_close",     // The quit ladder: one rung per call, plus the two reference-discipline     // commands the ladder's invariant depends on.     "quit_rung",@@ -804,7 +1018,7 @@ pub fn run() {             match verdict {                 Ok(Ok(())) => {}                 Ok(Err(e)) => {-                    send(&json!({"id": id, "ok": false, "error": e.message, "detail": e.detail, "errorCode": e.code, "timedOut": e.timed_out}));+                    send(&json!({"id": id, "ok": false, "error": e.message, "detail": e.detail, "errorCode": e.code, "timedOut": e.timed_out, "errorData": e.data}));                     continue;                 }                 Err(_) => {@@ -847,7 +1061,7 @@ pub fn run() {                 }                 send(                 &json!({"id": id, "ok": false, "error": e.message, "detail": e.detail,-                        "errorCode": e.code, "timedOut": e.timed_out,+                        "errorCode": e.code, "timedOut": e.timed_out, "errorData": e.data,                         "createdBeforeFailing": e.created}),                 )             }

@@ -80,6 +80,12 @@ struct MockDoc {     doc_type: &'static str,     config: String,     dirty: bool,+    /// A COMPONENT AN ASSEMBLY HOLDS OPEN. SOLIDWORKS keeps a referenced part+    /// open while its parent is, and lets it go when the parent closes — so a+    /// close loop that only counts the documents it named would leave the count+    /// wrong in both directions. Modelled because the safety claim is "the count+    /// reaches zero".+    held_open_by_assembly: bool,     props: Map<String, Value>,     material: Option<String>,     /// name -> value in METRES, mirroring IDimension::SystemValue.@@ -137,6 +143,10 @@ impl MockDoc {             doc_type,             config: v.get("config").and_then(|x| x.as_str()).unwrap_or("Default").to_string(),             dirty: v.get("dirty").and_then(|x| x.as_bool()).unwrap_or(false),+            held_open_by_assembly: v+                .get("heldOpenByAssembly")+                .and_then(|x| x.as_bool())+                .unwrap_or(false),             props: v.get("props").and_then(|x| x.as_object()).cloned().unwrap_or_default(),             material: v.get("material").and_then(|x| x.as_str()).map(String::from),             dimensions: v.get("dimensions").and_then(|x| x.as_object()).cloned().unwrap_or_default(),@@ -166,6 +176,7 @@ impl MockDoc {             doc_type,             config,             dirty: false,+            held_open_by_assembly: false,             props: Map::new(),             material: None,             dimensions: Map::new(),@@ -234,6 +245,22 @@ fn fault(name: &str) -> bool {     crate::scratch::root().join(name).exists() } +/// THE ORDER OF EVENTS, WRITTEN DOWN.+///+/// The safety property of the close sweep is not a fact about the final state —+/// a session can end with every document on disk and still have closed one of+/// them before it was written. It is a fact about ORDER, and order is only+/// checkable if it is recorded. Every recovery write and every close appends a+/// line here, so a test can assert what happened WHEN rather than what was true+/// at the end.+fn journal(event: &str, path: &str) {+    use std::io::Write;+    let f = crate::scratch::root().join("mock-close-order.log");+    if let Ok(mut h) = std::fs::OpenOptions::new().create(true).append(true).open(f) {+        let _ = writeln!(h, "{event}\t{path}");+    }+}+ const MOCK_VERSION: &str = "mock 33.0.0 (2025 SP0)";  /// The `%TEMP%` the SIMULATED launcher writes under.@@ -429,7 +456,40 @@ impl MockBackend {             return true;         }         let Some(pos) = self.find_by_name(name) else { return false };+        // A COMPONENT CANNOT CLOSE WHILE ITS ASSEMBLY HOLDS IT OPEN. This is why+        // the sweep closes parents before children at all; modelling it as a+        // REFUSAL rather than a silent success is what makes the ordering+        // testable — reverse the sort and this returns false, the document is+        // reported as a close failure, and `done` goes false.+        if self.docs[pos].held_open_by_assembly+            && self.docs.iter().any(|x| x.doc_type == "assembly")+        {+            // ON THE RECORD. A refusal that left no trace made the ordering+            // untestable: close the children first and the sweep still finishes,+            // because it retries and the parent eventually goes. "It got there in+            // the end" is not the property — asking in an order SOLIDWORKS can+            // answer is, and only a written-down refusal can show it was violated.+            journal("refused", &self.docs[pos].path);+            return false;+        }         let d = self.docs.remove(pos);+        // THIS document closes FIRST, then whatever it was holding: the parent is+        // what the sweep asked to close, and the children go out with it.+        journal("closed", &d.path);+        // CLOSING AN ASSEMBLY RELEASES WHAT IT HELD, exactly as SOLIDWORKS does:+        // the components go with their parent, and they go on the record.+        if d.doc_type == "assembly" {+            let released: Vec<String> = self+                .docs+                .iter()+                .filter(|x| x.held_open_by_assembly)+                .map(|x| x.path.clone())+                .collect();+            for p in &released {+                journal("closed", p);+            }+            self.docs.retain(|x| !x.held_open_by_assembly);+        }         self.created.retain(|(t, _)| t != &d.title);         if self.active.as_deref() == Some(d.path.as_str()) {             self.active = self.docs.first().map(|x| x.path.clone());@@ -723,6 +783,22 @@ impl MockBackend {         // property, it is a bug — Drew authorized closing his own documents and         // the bridge told him no.         let env_on = crate::writes::user_writes_enabled();+        // DREW'S STANDING AUTHORIZATION for ENDING THE SESSION, honoured by the+        // host's own veto so the two layers agree. `userAuthorized:true` with a+        // reason grants the quit and nothing else — see writes::authorize. The+        // host still checks it for itself rather than trusting the server's word,+        // which is the point of being an independent veto.+        let authorized_quit = always+            && args.get("userAuthorized").and_then(|v| v.as_bool()).unwrap_or(false)+            && args+                .get("reason")+                .and_then(|v| v.as_str())+                .map(|r| r.trim().len() >= 8)+                .unwrap_or(false);+        if authorized_quit {+            return Ok(());+        }+         let missing = crate::writes::missing_opt_in(args);         if env_on && missing.is_empty() {             return Ok(());@@ -1334,6 +1410,349 @@ impl MockBackend {              "com_refs" => Ok(json!({"outstanding": 0})), +            // DREW'S STANDING AUTHORIZATION, modelled: preserve every document+            // to disk, THEN close it. The property under test is a SEQUENCE —+            // nothing closes before it is on disk — so the mock writes real files+            // and refuses to close a document whose file is not there.+            // ONE DOCUMENT PER CALL. The server censuses for a dialog between+            // every save and every close, so the host does one step at a time —+            // see `ComBackend::cmd_preserve_and_close` for why a batch was the+            // wrong unit.+            "preserve_and_close" => {+                self.require_running()?;+                let phase = args.get("phase").and_then(|v| v.as_str()).unwrap_or("preserve");+                let count = mock_doc_count(self.docs.len());+                if phase == "close" {+                    let path = args+                        .get("path")+                        .and_then(|v| v.as_str())+                        .filter(|s| !s.trim().is_empty())+                        .ok_or_else(|| HostError::msg("path is required"))?+                        .to_string();+                    let written_here =+                        args.get("writtenHere").and_then(|v| v.as_bool()).unwrap_or(false);+                    // NOTHING CLOSES THAT IS NOT ON DISK — re-verified at the+                    // moment of the close, not merely at the moment of the save,+                    // and through the SAME verdict the real backend uses.+                    if written_here {+                        // THE KIND TRAVELS WITH THE DOCUMENT — re-deriving it+                        // from the name would ask the question to its own answer.+                        let kind = args+                            .get("docKind")+                            .and_then(|v| v.as_str())+                            .and_then(|t| super::super::disk::DocKind::from_type_name(t));+                        let original_bytes = args.get("originalBytes").and_then(|v| v.as_u64());+                        let v = super::host::recovery_file_verdict(&path, kind, original_bytes);+                        if !v.ok {+                            return Ok(json!({+                                "phase": "close", "path": path, "closed": false,+                                "documentCount": count,+                                "why": v.why.unwrap_or_else(|| "unverifiable".into()),+                            }));+                        }+                    }+                    // A CLOSE CAN RAISE A PROMPT TOO. This fault puts one on+                    // screen as the first document closes, so the census the+                    // server runs before the NEXT close is the only thing that+                    // can catch it.+                    if fault("mock-dialog-during-close") {+                        if let Some(d) = fake_dir() {+                            let _ = std::fs::write(+                                d.join("dialog-open.json"),+                                json!({+                                    "hwnd": 9102, "className": "#32770",+                                    "title": "Rebuild before closing?", "visible": true+                                })+                                .to_string(),+                            );+                        }+                    }+                    // ALREADY GONE WITH ITS PARENT: the assembly that held this+                    // component closed it on the way out. That is a close, and it+                    // happened after this document's own recovery write.+                    let closed = if self.find_by_name(&path).is_none() {+                        true+                    } else {+                        self.close_doc_by_name(&path) && self.find_by_name(&path).is_none()+                    };+                    let after = mock_doc_count(self.docs.len());+                    self.publish_session();+                    return Ok(json!({+                        "phase": "close", "path": path, "closed": closed,+                        "documentCount": after,+                        "why": if closed { Value::Null } else { json!("still open after CloseDoc") },+                    }));+                }+                if phase != "preserve" {+                    return Err(HostError::msg(format!(+                        "unknown preserve_and_close phase {phase:?}"+                    )));+                }+                let recovery = args+                    .get("recoveryDir")+                    .and_then(|v| v.as_str())+                    .filter(|s| !s.is_empty())+                    .ok_or_else(|| HostError::msg("recoveryDir is required"))?+                    .to_string();+                // A HOST FAILURE THAT CARRIES REAL COM DETAIL, mid-sweep.+                //+                // `mock-com-timeout` produces a SidecarError with no `data`, so a+                // test using it cannot tell `hostError: null` (the host sent+                // nothing) from the field being ABSENT because nothing constructs+                // it. This fault gives the failure the shape a live COM exception+                // has — HRESULT, source, description — so the structured path is+                // provable end to end.+                if fault("mock-preserve-host-error-with-data") {+                    let mut e = HostError::detailed(+                        "SOLIDWORKS rejected 'SaveAs3' while the sweep was preserving a document",+                        "Type mismatch. (0x80020005) [SldWorks] (argument index 1)",+                    );+                    e.data = Some(json!({+                        "call": "SaveAs3",+                        "hresult": "0x80020005",+                        "source": "SldWorks",+                        "description": "Type mismatch.",+                        "argumentIndex": 1,+                    }));+                    return Err(e);+                }+                let index = args.get("index").and_then(|v| v.as_u64()).unwrap_or(0) as usize;+                let _ = std::fs::create_dir_all(&recovery);+                // A TYPE THE BACKEND CANNOT READ. On the real backend this is+                // `GetType` failing on a document being closed under memory+                // pressure — the condition the sweep exists for. It must become+                // UNKNOWN, never a part.+                let type_unreadable = fault("mock-doctype-unreadable");+                let Some((title, dirty, doc_type, reported)) = self.docs.get(index).map(|d| {+                    (d.title.clone(), d.dirty, d.doc_type, Self::reported_path(d).to_string())+                }) else {+                    return Ok(json!({+                        "phase": "preserve", "index": index, "walked": 0,+                        "documentCount": count, "record": Value::Null, "ready": Value::Null,+                    }));+                };+                let pathless = reported.trim().is_empty();+                // The same chain the real backend walks: the type, then the+                // document's OWN path, then its title. Neither of the last two is+                // a name this sweep produced.+                let kind = if type_unreadable {+                    None+                } else {+                    super::super::disk::DocKind::from_type_name(doc_type)+                }+                .or_else(|| super::super::disk::DocKind::from_extension(&reported))+                .or_else(|| super::super::disk::DocKind::from_extension(&title));+                let kind_name = kind.map(|k| json!(k.type_name())).unwrap_or(Value::Null);+                // The original's size, read before anything is written.+                let original_bytes =+                    if pathless { None } else { std::fs::metadata(&reported).ok().map(|m| m.len()) };+                if !dirty && !pathless {+                    // CLOSED IN PLACE: the same measurement the real backend+                    // takes, so the record can later say whether the user's own+                    // file is still what the sweep closed it against.+                    let original_modified_ms = crate::scratch::modified_ms(&reported);+                    return Ok(json!({+                        "phase": "preserve", "index": index, "walked": 1,+                        "documentCount": count,+                        "record": json!({+                            "title": title, "path": reported, "recoveryPath": Value::Null,+                            "recoveryBytes": Value::Null, "recoverySignatureOk": Value::Null,+                            "docKind": kind_name, "originalBytes": original_bytes,+                            "originalModifiedMs": original_modified_ms,+                            "wasDirty": false, "wasPathless": false, "preserved": true,+                        }),+                        // Already SOLIDWORKS' own file: on disk by definition in+                        // the simulated world, and its path is a Windows one that+                        // does not exist on the host running the suite.+                        "ready": json!({+                            "path": reported, "docType": kind_name, "writtenHere": false,+                            "originalBytes": Value::Null,+                        }),+                    }));+                }+                // A UNIQUE FILE, actually written: several open documents can+                // share a title, and each must get its own.+                // NEVER A GUESSED EXTENSION. An unknown kind takes the title's+                // own extension if it has one, else a neutral name that claims+                // nothing — the downstream verdict must not be able to read a+                // guess back out of the file name.+                // SOLIDWORKS MAY REFUSE THE NEUTRAL NAME. `SaveAs3` dispatches+                // its writer on the extension and `.sldrecover` matches none, so+                // the simulator can be told to reject it — and the sweep must+                // then re-save as `.SLDPRT` and say that it did, WITHOUT the+                // verification softening: the kind is still unknown.+                // MEASURED LIVE 2026-09-17: SaveAs3 to `.sldrecover` answers+                // "format not supported" and writes nothing, so an unknown-kind+                // document is named as a part up front and the RECORD carries the+                // fact that the name is a guess. The simulator models the same+                // decision, and the fault below models the world in which a+                // neutral name IS attempted and refused — the path kept for a+                // future version that accepts it.+                let mut named_as_part = true;+                let ext = match kind {+                    Some(k) => {+                        named_as_part = false;+                        k.extension()+                    }+                    None if fault("mock-neutral-extension-accepted")+                        && !fault("mock-saveas-rejects-unknown-extension") =>+                    {+                        named_as_part = false;+                        "sldrecover"+                    }+                    None => super::super::disk::DocKind::Part.extension(),+                };+                let stem: String = title+                    .rsplit_once('.')+                    .map(|(a, _)| a)+                    .unwrap_or(&title)+                    .chars()+                    .map(|c| if c.is_ascii_alphanumeric() { c } else { '_' })+                    .collect();+                let stem = if stem.trim_matches('_').is_empty() { "document" } else { stem.trim_matches('_') };+                let mut out = format!("{recovery}/{stem}.{ext}");+                let mut n = 1;+                while std::path::Path::new(&out).exists() {+                    out = format!("{recovery}/{stem}-{n}.{ext}");+                    n += 1;+                }+                let fail = |why: String, bytes: u64, sig: bool| -> Value {+                    json!({+                        "phase": "preserve", "index": index, "walked": 1,+                        "documentCount": count,+                        "record": json!({+                            "title": title, "path": reported,+                            "recoveryPath": if bytes == 0 && !sig && why.starts_with("simulated") {+                                Value::Null+                            } else {+                                json!(out)+                            },+                            "recoveryBytes": bytes, "recoverySignatureOk": sig,+                            "docKind": kind_name, "originalBytes": original_bytes,+                            "namingFallback": if named_as_part { json!("unknownKindNamedAsPart") } else { Value::Null },+                            "wasDirty": dirty, "wasPathless": pathless, "preserved": false,+                            "why": why,+                        }),+                        "ready": Value::Null,+                    })+                };+                if fault("mock-saveas-fails") {+                    return Ok(fail(+                        "simulated: SaveAs3 failed, so this document was NOT closed".into(),+                        0,+                        false,+                    ));+                }+                // WHAT A REAL DOCUMENT LOOKS LIKE, and the three ways a failing+                // disk makes something that is not one:+                //   * `mock-recovery-partial-write` — the entry exists, empty.+                //     `Path::exists()` says yes to it.+                //   * `mock-recovery-truncated` — a genuine header and then the+                //     write stops. Nonzero, plausible, and not the document. This+                //     is the case a byte floor alone was chosen badly for.+                //   * `mock-recovery-bad-header` — full size, wrong container.+                //     What a format change, or a file written by something else,+                //     would look like.+                // A REAL HEADER, measured from real files: four bytes that vary+                // per document, then the format marker every one of the 166+                // documents surveyed carries at offset 4. The simulator writes+                // what SOLIDWORKS writes, not what the internet says it writes —+                // modelling this as a CFBF file would have hidden the fact that+                // modern SOLIDWORKS is not a compound file at all.+                let mut header = vec![0x9f, 0xe4, 0x18, 0x9f];+                header.extend_from_slice(&super::host::SWDOC_FORMAT_MARKER);+                // A DOCUMENT OF THIS KIND'S SIZE. The floors differ per kind+                // because the real files do (the smallest assembly measured is+                // three times the smallest part, the smallest drawing eleven+                // times), so a simulator that wrote one size for all three would+                // have had assemblies failing their own floor.+                let full = match kind {+                    Some(super::super::disk::DocKind::Assembly) => 128 * 1024,+                    Some(super::super::disk::DocKind::Drawing) => 512 * 1024,+                    Some(super::super::disk::DocKind::Part) => 32 * 1024,+                    // A document whose kind is unknown is written at a size that+                    // would satisfy the strictest floor — the simulator models a+                    // COMPLETE write; it is the FAULTS that model incomplete ones.+                    None => 512 * 1024,+                };+                let payload: Vec<u8> = if fault("mock-recovery-partial-write") {+                    Vec::new()+                } else if fault("mock-recovery-truncated") {+                    let mut v = header.clone();+                    v.resize(2048, b'x');+                    v+                } else if fault("mock-recovery-bad-header") {+                    vec![b'x'; full]+                } else if fault("mock-recovery-legacy-container") {+                    // An older document, opened from an archive: genuinely a+                    // compound file, and genuinely closable.+                    let mut v = super::host::OLE_COMPOUND_FILE_SIGNATURE.to_vec();+                    v.resize(full, b'x');+                    v+                } else {+                    let mut v = header.clone();+                    v.resize(full, b'x');+                    v+                };+                if std::fs::write(&out, &payload).is_err() {+                    return Ok(fail("the recovery file could not be written".into(), 0, false));+                }+                // THE SAME VERDICT THE REAL BACKEND APPLIES, through the same+                // function: signature first, then size, failing closed.+                let v = super::host::recovery_file_verdict(&out, kind, original_bytes);+                // A SAVE CAN RAISE A PROMPT — a missing external reference, a+                // rebuild question. This fault puts one on screen the instant the+                // first document has been written, which is precisely the moment+                // a once-per-batch census could not see it.+                if fault("mock-dialog-after-save") {+                    if let Some(d) = fake_dir() {+                        let _ = std::fs::write(+                            d.join("dialog-open.json"),+                            json!({+                                "hwnd": 9101, "className": "#32770",+                                "title": "Save external references?", "visible": true+                            })+                            .to_string(),+                        );+                    }+                }+                if !v.ok {+                    return Ok(fail(+                        v.why.unwrap_or_else(|| "unverifiable".into()),+                        v.bytes,+                        v.signature_ok,+                    ));+                }+                journal("preserved", &out);+                // THE DOCUMENT RE-POINTS at the recovery file, exactly as+                // SaveAs3 with Silent alone does: the close key is read from+                // the document AFTER the save, and it must be this path.+                {+                    let d = &mut self.docs[index];+                    d.saved = true;+                    d.dirty = false;+                    d.temp_path = None;+                    d.path = out.clone();+                    d.title = crate::comhost::mock::base_name(&out).to_string();+                }+                self.publish_session();+                Ok(json!({+                    "phase": "preserve", "index": index, "walked": 1,+                    "documentCount": count,+                    "record": json!({+                        "title": title, "path": reported, "recoveryPath": out,+                        "recoveryBytes": v.bytes, "recoverySignatureOk": true,+                        "docKind": kind_name, "originalBytes": original_bytes,+                        "namingFallback": if named_as_part { json!("unknownKindNamedAsPart") } else { Value::Null },+                        "wasDirty": dirty, "wasPathless": pathless, "preserved": true,+                    }),+                    "ready": json!({+                        "path": out, "docType": kind_name, "writtenHere": true,+                        "originalBytes": original_bytes,+                    }),+                }))+            }+             "close_import_temps" => {                 self.require_running()?;                 let max = args.get("max").and_then(|v| v.as_u64()).unwrap_or(200).max(1) as usize;@@ -1437,8 +1856,8 @@ impl MockBackend {                     })                     .collect();                 let mut closed = Vec::new();-                let mut wrong_document_closed = false;                 let mut close_failed: Vec<Value> = Vec::new();+                let mut wrong_document_closed = false;                 let mut close_ignored_path = false;                 let mut close_outcome_unknown = false;                 for (title, path) in &victims {@@ -2133,6 +2552,251 @@ impl MockBackend {                     .filter(|s| !s.is_empty())                     .ok_or_else(|| HostError::msg("filePath is required"))?                     .to_string();+                // EVERY STEP IMPORT FAILING, with the translator's own answer.+                // Live, 2026-09-17: LoadFile4 raised a COM exception on every+                // STEP and the reply carried only "SOLIDWORKS rejected+                // 'LoadFile4'" — the HRESULT and EXCEPINFO were dropped between+                // the COM layer and the import verb. This fault models the+                // failure INCLUDING the structured remains, so the wiring that+                // carries them to the caller is tested rather than assumed.+                // THE USER'S 3D INTERCONNECT SETTING, modelled because it decides+                // WHICH ROUTE the import takes — and because the live install has+                // it ON, which is the default. Measured 2026-09-17: toggle 691 is+                // TRUE on Drew's machine, so the simulator's default matches the+                // machine this bridge actually runs on, and the translator route+                // is what a fault turns on.+                // F3 — THREE STATES, NOT TWO. `None` is "SOLIDWORKS would not+                // answer"; `Some(false)` is "the user turned it off". They take+                // the same route and mean opposite things about how much to+                // trust a failure.+                let readable = !fault("mock-interconnect-toggle-unreadable");+                let interconnect = readable && !fault("mock-3d-interconnect-off");+                // ── THE MEASUREMENT SURFACE, ECHOED AND NOT INTERPRETED.+                //+                // The simulator has no SOLIDWORKS to ask, so it makes NO claim+                // about what any of these produce — that is the entire point of+                // the exercise. It validates the route name (a typo that quietly+                // measures something else is worse than no measurement) and+                // reports the invocation back, so the shape of a matrix row is+                // testable here and only the ANSWERS have to come from the live+                // application.+                let route = args+                    .get("route")+                    .and_then(|v| v.as_str())+                    .unwrap_or("auto")+                    .to_ascii_lowercase();+                if !matches!(route.as_str(), "auto" | "loadfile4" | "loadfile2" | "opendoc6") {+                    return Err(HostError::coded(+                        "unknown_import_route",+                        format!(+                            "unknown import route {route:?} — expected \"auto\", \"loadfile4\", \+                             \"loadfile2\" or \"opendoc6\""+                        ),+                    ));+                }+                let open_options = args.get("openOptions").and_then(|v| v.as_i64()).unwrap_or(1);+                let doc_type_arg = args.get("docType").and_then(|v| v.as_i64()).unwrap_or(1);+                let arg_string =+                    args.get("argString").and_then(|v| v.as_str()).unwrap_or("r").to_string();+                let with_data = args.get("withImportData").and_then(|v| v.as_bool()).unwrap_or(false);+                // THE MEASURED DEAD END, modelled: with 3D Interconnect on, the+                // `auto` route makes one LoadFile4 attempt and then refuses by+                // NAMING THE SETTING. The simulator's default has the toggle on,+                // matching the live machine, so this fault is what turns the+                // measured refusal on — the simulator has no SOLIDWORKS to fail+                // for it.+                if route == "auto" && !readable && fault("mock-interconnect-blocks-import") {+                    let mut e = HostError::coded(+                        "interconnect_setting_unreadable",+                        format!(+                            "SOLIDWORKS could not import {path}, and this bridge could not read \+                             whether 3D Interconnect is on. With that setting ON no programmatic \+                             import route works on this edition, so the most likely cause cannot \+                             be confirmed or ruled out. Nothing was opened and nothing was changed."+                        ),+                    );+                    e.detail = Some(+                        "Check Tools > Options > System Options > Import > \"Enable 3D \+                         Interconnect\". This bridge does not change user settings."+                            .into(),+                    );+                    e.data = Some(json!({+                        "interconnect": Value::Null,+                        "interconnectSettingReadable": false,+                        "path": path,+                    }));+                    return Err(e);+                }+                if route == "auto" && interconnect && fault("mock-interconnect-blocks-import") {+                    let mut e = HostError::coded(+                        "interconnect_blocks_import",+                        format!(+                            "SOLIDWORKS cannot import {path} while 3D Interconnect is on. \+                             Measured on this edition 2026-09-17: no programmatic route imports a \+                             neutral file with the toggle TRUE. Nothing was opened and nothing was \+                             changed."+                        ),+                    );+                    e.detail = Some(+                        "ASK THE USER to turn 3D Interconnect off if they want this import (it \+                         lives at Tools > Options > System Options > Import > \"Enable 3D \+                         Interconnect\"), then try again. THIS BRIDGE DOES NOT CHANGE USER \+                         SETTINGS, not even temporarily."+                            .into(),+                    );+                    e.data = Some(json!({+                        "interconnect": true,+                        "userSettingPath": "Tools > Options > System Options > Import > Enable 3D Interconnect",+                        "path": path,+                    }));+                    return Err(e);+                }+                let effective = if route == "auto" {+                    // `auto` attempts the TRANSLATOR even under 3D Interconnect:+                    // OpenDoc6 is a measured failure there, so preferring it+                    // would be preferring a known dead end.+                    "loadfile4"+                } else {+                    route.as_str()+                };+                let invocation = match effective {+                    "opendoc6" => json!({+                        "method": "OpenDoc6",+                        "args": {+                            "path": path, "docType": doc_type_arg, "options": open_options,+                            "configuration": "", "errors": "byref i4", "warnings": "byref i4",+                        },+                    }),+                    "loadfile2" => json!({"method": "LoadFile2", "args": {"path": path, "arg": ""}}),+                    _ => json!({+                        "method": "LoadFile4",+                        "args": {+                            "path": path, "argString": arg_string,+                            "importData": if with_data {+                                "GetImportFileData(path)"+                            } else {+                                "Nothing (null VT_DISPATCH)"+                            },+                            "errors": "byref i4",+                        },+                        // The simulator has no import-data object to hand back and+                        // says so rather than inventing one.+                        "importFileData": if with_data {+                            json!({"returnedObject": Value::Null, "simulated": true})+                        } else {+                            Value::Null+                        },+                    }),+                };+                // F2 — REFUSED BEFORE ANY ROUTE IS CHOSEN. Inside the+                // interconnect branch it was silently dropped whenever the+                // toggle was off or unreadable: the caller asked for an unlinked+                // import and got no answer either way.+                if fault("mock-dissolve-requested-without-measurement")+                    || args.get("dissolve").and_then(|v| v.as_bool()).unwrap_or(false)+                {+                    let mut e = HostError::coded(+                        "dissolve_not_measured",+                        "this bridge will not break a 3D Interconnect link with an API it has not \+                         verified on this install. The import itself went ahead as a LINKED part \+                         (that is what 3D Interconnect does); nothing was changed.",+                    );+                    e.detail = Some(+                        "measure which call breaks the link on this edition and verify the EFFECT, \+                         not the return value"+                            .into(),+                    );+                    return Err(e);+                }+                // LOADFILE4 UNDER 3D INTERCONNECT: it executes and returns+                // nothing, with errors=1 (swGenericError). Measured live+                // 2026-09-17 after 0.7.9 fixed the variant encoding. A bridge+                // that routed to the translator with the toggle ON would produce+                // exactly this, so the simulator can produce it too.+                if interconnect && fault("mock-import-translator-under-interconnect") {+                    return Err(HostError::detailed(+                        format!(+                            "SOLIDWORKS could not import {path} (LoadFile4 opened nothing, \+                             errors=1; LoadFile2 refused). Importable formats depend on the \+                             installed translators."+                        ),+                        "LoadFile4 returned no document; errors=1 (swGenericError)",+                    )+                    .with_data(json!({+                        "interconnect": true,+                        "loadFile4": {"message": "LoadFile4 returned no document", "detail": Value::Null, "code": Value::Null},+                        "loadFile2": {"returned": false, "failure": Value::Null},+                        "errors": 1,+                        // WHAT THE COUNT DID — the one number that says whether a+                        // document was left behind, and the fact ownership turns+                        // on. It was in prose on one path and nowhere on the other.+                        // THE SAME NAMES THE SUCCESS REPLY USES for the same+                        // facts, so a caller reads one vocabulary either way.+                        "documentCountBefore": self.docs.len() as i32,+                        "documentCount": self.docs.len() as i32,+                        "documentsOpened": 0,+                        "documentAppeared": false,+                        "path": path,+                    })));+                }+                // THE LIVE FAILURE OF 2026-09-17, exactly as it came back: a type+                // mismatch on `importData`, which was being passed as VT_EMPTY+                // where SOLIDWORKS wanted a NULL DISPATCH.+                //+                // THE SIMULATOR CANNOT CHECK THE ENCODING. It has no VARIANTs —+                // it is Rust data structures — so no fault here can tell+                // `Var::empty()` from `Var::null_dispatch()`, and a test that+                // claimed to would be theatre. What this fault keeps honest is+                // the REPORTING path: the HRESULT and argument index reaching the+                // caller, which is what made the diagnosis possible at all. The+                // encoding itself is pinned where it exists — the Windows-only+                // unit test in variant.rs — and in tests/wiring.rs, which reads+                // the call site.+                if fault("mock-import-typemismatch") {+                    return Err(HostError::detailed(+                        format!(+                            "SOLIDWORKS could not import {path} (LoadFile4 opened nothing, \+                             errors=0; LoadFile2 refused). Importable formats depend on the \+                             installed translators."+                        ),+                        "SOLIDWORKS rejected 'LoadFile4': Type mismatch. (0x80020005) \+                         (argument index 1)",+                    )+                    .with_data(json!({+                        "loadFile4": {+                            "message": "SOLIDWORKS rejected 'LoadFile4'",+                            "detail": "Type mismatch. (0x80020005) (argument index 1)",+                            "code": Value::Null,+                            "hresult": "0x80020005",+                            "argumentIndex": 1,+                        },+                        "loadFile2": {"returned": false, "failure": Value::Null},+                        "errors": 0,+                        "path": path,+                    })));+                }+                if fault("mock-import-load4-throws") {+                    return Err(HostError::detailed(+                        format!(+                            "SOLIDWORKS could not import {path} (LoadFile4 opened nothing, \+                             errors=0; LoadFile2 refused). Importable formats depend on the \+                             installed translators."+                        ),+                        "SOLIDWORKS rejected 'LoadFile4': 0x80004005 [SldWorks] (argument index 0)",+                    )+                    .with_data(json!({+                        "loadFile4": {+                            "message": "SOLIDWORKS rejected 'LoadFile4'",+                            "detail": "0x80004005 [SldWorks]: translator not available \+                                       (argument index 0)",+                            "code": Value::Null,+                            "hresult": "0x80004005",+                        },+                        "loadFile2": {"returned": false, "failure": Value::Null},+                        "errors": 0,+                        "path": path,+                    })));+                }                 self.untitled += 1;                 // SOLIDWORKS names an imported document after the file's STEM                 // with a PART extension: importing `smoke.step` yields a@@ -2212,26 +2876,65 @@ impl MockBackend {                         "netCountOk": after - before == 1,                     }));                 }-                let temp_path =-                    format!("{MOCK_TEMP_ROOT}\\swx4242\\IC~~\\{}-{n}.SLDPRT", file_stem(&path));+                // F1 — THE INTERCONNECT ROUTE PRODUCES A PATHLESS DOCUMENT, as+                // the real one does. Giving it a `…\Temp\swx<pid>\IC~~\…` path+                // meant every drain and sweep test over this route exercised+                // FIND-BY-TEMP-PATH — the branch that cannot run on Drew's+                // machine — while the branch the route's own comment calls+                // load-bearing, registration at birth, was never the thing under+                // test. A simulator that makes the hard case easy is a simulator+                // that agrees with the bug.                 let mut doc = MockDoc::opened(key.clone(), "part", "Default".into());                 doc.title = title;                 doc.saved = false;-                doc.import_temp = true;-                doc.temp_path = Some(temp_path);+                if effective == "opendoc6" {+                    doc.import_temp = false;+                    doc.temp_path = None;+                } else {+                    doc.import_temp = true;+                    doc.temp_path = Some(format!(+                        "{MOCK_TEMP_ROOT}\\swx4242\\IC~~\\{}-{n}.SLDPRT",+                        file_stem(&path)+                    ));+                }                 doc.bodies.push(mock_body("Imported1", 50.0, 30.0, 20.0));                 self.docs.push(doc);                 self.active = Some(key.clone());                 let after = self.docs.len() as i32;                 let net = after - before;+                // THE SAME TWO ROUTES THE REAL BACKEND TAKES, and the same+                // reporting — including `linked`, which is the fact a caller most+                // needs and cannot see from the document itself: an interconnect+                // part is NOT self-contained.                 Ok(json!({                     "imported": self.doc_info(&key),-                    "via": "LoadFile4",+                    "via": match effective {+                        "opendoc6" => "OpenDoc6 (3D Interconnect)",+                        "loadfile2" => "LoadFile2",+                        _ => "LoadFile4",+                    },+                    "invocation": invocation,+                    "route": route,+                    "interconnect": if readable { json!(interconnect) } else { Value::Null },+                    "interconnectSettingReadable": readable,+                    "linked": effective == "opendoc6",+                    "sourcePath": if effective == "opendoc6" { json!(path) } else { Value::Null },                     "errors": 0,                     "documentsOpened": net,                     "netCountOk": net == 1,                     "documentCount": after,-                    "_hint": "Imported. This left ONE new open, unsaved document (like                               swx_new_document) — it stays open and holds memory until you save                               or close it. Importing repeatedly without closing is what leaks                               documents; swx_close_import_temps drains any left behind.",+                    "_hint": if effective == "opendoc6" {+                        "Imported by OPENING it as a part holding a LINKED 3D Interconnect feature \+                         — the user's SOLIDWORKS has 3D Interconnect ON, which this bridge reads \+                         and never changes. The part is NOT self-contained: moving or deleting the \+                         source file changes it. It is one new open, unsaved document; \+                         swx_close_import_temps drains any left behind."+                    } else {+                        "Imported. This left ONE new open, unsaved document (like \+                         swx_new_document) — it stays open and holds memory until you save or \+                         close it. Importing repeatedly without closing is what leaks documents; \+                         swx_close_import_temps drains any left behind."+                    },                 }))             } 

@@ -84,6 +84,36 @@ impl Var {         }     } +    /// **"NOTHING", for an `[in]` OBJECT PARAMETER.**+    ///+    /// A `VT_DISPATCH` variant whose `pdispVal` is NULL — which is what a+    /// late-bound caller passes where VBA writes `Nothing`. It is NOT the same as+    /// `VT_EMPTY`, and this bridge believed it was from v0.2.0 until 2026-09-17.+    ///+    /// MEASURED THAT DAY, on the live install: every STEP import failed, and with+    /// the structured COM failure finally reaching the caller (0.7.8) it read+    ///+    /// ```text+    /// hostError.loadFile4.detail = "Type mismatch. (0x80020005) (argument index 1)"+    /// ```+    ///+    /// `rgvarg` is packed REVERSED (see `call_raw`), so `puArgErr = 1` is the+    /// THIRD parameter of `LoadFile4(path, "r", importData, byref errors)` —+    /// `importData` — which was being passed as `VT_EMPTY`. SOLIDWORKS wants an+    /// object there and will take a null one; it will not take "no value at all".+    ///+    /// The consequence worth recording: **`LoadFile4` had probably never worked+    /// live.** The imports of 09-05 to 09-11 went through the `LoadFile2`+    /// fallback, and the reason that route looked like the normal one was that+    /// nothing ever showed the caller why the first had failed.+    pub fn null_dispatch() -> Var {+        unsafe {+            build(VT_DISPATCH, |v| {+                (*v.Anonymous.Anonymous).Anonymous.pdispVal = std::mem::ManuallyDrop::new(None);+            })+        }+    }+     pub fn dispatch(d: &IDispatch) -> Var {         unsafe {             build(VT_DISPATCH, |v| {@@ -458,6 +488,10 @@ impl Disp {                     timed_out: false,                     // A rejected call did nothing at all, so it made nothing.                     created: None,+                    data: Some(serde_json::json!({+                        "hresult": format!("0x{:08X}", code as u32),+                        "call": name,+                    })),                 });             }         }@@ -472,7 +506,18 @@ impl Disp {             if arg_err != 0 || !args.is_empty() {                 detail.push_str(&format!(" (argument index {arg_err})"));             }-            HostError::detailed(format!("SOLIDWORKS rejected '{name}'"), detail)+            // AND THE SAME FACTS, STRUCTURED. The prose is for a person; the+            // HRESULT is what a person diagnoses a translator from, and it was+            // being flattened into a sentence that callers then truncated.+            HostError::detailed(format!("SOLIDWORKS rejected '{name}'"), detail).with_data(+                serde_json::json!({+                    "call": name,+                    "hresult": format!("0x{:08X}", e.code().0 as u32),+                    "source": if source.is_empty() { serde_json::Value::Null } else { serde_json::json!(source) },+                    "description": if description.is_empty() { serde_json::Value::Null } else { serde_json::json!(description) },+                    "argumentIndex": arg_err,+                }),+            )         })?;         Ok(Var(result))     }@@ -514,3 +559,34 @@ impl Disp {         self.call(name, args).ok().and_then(|v| v.as_bool())     } }++#[cfg(test)]+mod tests {+    use super::*;++    /// "NOTHING" IS NOT "OMITTED", and the difference is what broke every import.+    ///+    /// This runs only where `variant.rs` compiles — a Windows build — which is+    /// also the only place the encoding means anything. It is the one test that+    /// inspects the bytes: the simulator has no VARIANTs to look at, so it cannot+    /// tell these two apart no matter how it is written.+    #[test]+    fn nothing_is_a_null_dispatch_and_not_an_empty_variant() {+        let nothing = Var::null_dispatch();+        let omitted = Var::empty();+        unsafe {+            let n = &*nothing.0.Anonymous.Anonymous;+            let o = &*omitted.0.Anonymous.Anonymous;+            assert_eq!(+                n.vt, VT_DISPATCH,+                "an [in] object parameter set to Nothing must be VT_DISPATCH; SOLIDWORKS answered \+                 Type mismatch (0x80020005) to VT_EMPTY on LoadFile4's importData, live 2026-09-17"+            );+            assert!(+                n.Anonymous.pdispVal.is_none(),+                "Nothing means a NULL pdispVal, not a live interface pointer"+            );+            assert_eq!(o.vt, VT_EMPTY, "Var::empty must stay VT_EMPTY — it is a different thing");+        }+    }+}

@@ -0,0 +1,331 @@+//! HOW MUCH ROOM IS LEFT, and what this sweep is about to need.+//!+//! 0.7.2 verifies every recovery file by container marker and size, and pass 24+//! found the hole that leaves: the marker sits at offset 4, so ANY prefix of a+//! real document longer than eight bytes carries it. A write that reaches 20 KB+//! of a 500 KB assembly passes the marker AND the 16 KB floor. Marker and floor+//! together catch "empty" and "not a SOLIDWORKS file"; neither catches **the+//! right file, cut short**, and the format offers nothing cheap that would — no+//! constant tail, no length field, no head/tail relationship (measured).+//!+//! So the remaining defence is not in the file. It is in the decision to START:+//! this sweep writes every open document to disk, and it must refuse to begin+//! when the volume holds less room than the session it is about to write. A+//! truncation it cannot detect afterwards is one it declines to cause.++use std::path::Path;++/// Free bytes available on the volume holding `dir`, or `None` when that cannot+/// be measured.+///+/// `None` is an honest UNKNOWN and callers must treat it as one: this bridge does+/// not read "I could not measure the disk" as "there is room". The rule this+/// project keeps relearning is that an unanswerable question is not permission.+pub fn free_bytes(dir: &Path) -> Option<u64> {+    // A TEST KNOB, and the only way to hold a nearly-full volume in a suite.+    // A comma-separated list is consumed one entry per read, the last repeating,+    // so a scenario can be "room to start, and then the disk fills" — which is+    // the case that needs re-checking inside the loop rather than once at the+    // top.+    if let Ok(v) = std::env::var("SWX_TEST_FREE_BYTES") {+        let vals: Vec<u64> = v.split(',').filter_map(|x| x.trim().parse().ok()).collect();+        if !vals.is_empty() {+            let f = crate::scratch::root().join("test-free-bytes-reads");+            let n = std::fs::read_to_string(&f)+                .ok()+                .and_then(|t| t.trim().parse::<usize>().ok())+                .unwrap_or(0);+            let _ = std::fs::write(&f, (n + 1).to_string());+            return Some(vals[n.min(vals.len() - 1)]);+        }+    }+    platform_free_bytes(dir)+}++#[cfg(windows)]+fn platform_free_bytes(dir: &Path) -> Option<u64> {+    use windows::core::HSTRING;+    use windows::Win32::Storage::FileSystem::GetDiskFreeSpaceExW;+    // The directory need not exist yet — the sweep creates it — so ask about the+    // nearest ancestor that does.+    let mut probe = dir.to_path_buf();+    while !probe.exists() {+        match probe.parent() {+            Some(p) if p != probe => probe = p.to_path_buf(),+            _ => break,+        }+    }+    let mut free: u64 = 0;+    let h = HSTRING::from(probe.as_os_str());+    // FREE TO THE CALLER, not total free: on a volume with a quota those differ,+    // and the one that matters is what this process may actually write.+    unsafe { GetDiskFreeSpaceExW(&h, Some(&mut free), None, None) }.ok()?;+    Some(free)+}++#[cfg(not(windows))]+fn platform_free_bytes(dir: &Path) -> Option<u64> {+    // The bridge runs on Windows; this path exists so the suite measures a real+    // volume rather than a stub. `df -Pk` is POSIX-specified output: one header+    // line, then a row whose fourth field is available 1K-blocks.+    let mut probe = dir.to_path_buf();+    while !probe.exists() {+        match probe.parent() {+            Some(p) if p != probe => probe = p.to_path_buf(),+            _ => break,+        }+    }+    let out = std::process::Command::new("df").arg("-Pk").arg(&probe).output().ok()?;+    if !out.status.success() {+        return None;+    }+    let text = String::from_utf8_lossy(&out.stdout);+    let row = text.lines().nth(1)?;+    let avail_kb: u64 = row.split_whitespace().nth(3)?.parse().ok()?;+    Some(avail_kb.saturating_mul(1024))+}++/// What one pathless document is assumed to cost when nothing better is known+/// and its kind is not known either.+pub const UNKNOWN_DOCUMENT_ESTIMATE: u64 = 1024 * 1024;++/// WHAT KIND OF DOCUMENT, because the three kinds are not the same size.+///+/// Measured over the 166 real documents in this container:+///+/// ```text+///          n     min        median      max+/// .SLDPRT  99    29,130     134,885     37,200,505+/// .SLDASM  38    95,492     4,139,430   16,644,232+/// .SLDDRW  29    319,803    1,958,169   32,250,713+/// ```+///+/// An assembly is thirty times the median part. Costing one as if it were a part+/// is how a per-save gate passes with far less room than the write needs.+#[derive(Clone, Copy, PartialEq, Eq, Debug)]+pub enum DocKind {+    Part,+    Assembly,+    Drawing,+}++impl DocKind {+    /// From a FILE NAME'S EXTENSION, and nothing else. `None` when the extension+    /// is not one of the three.+    ///+    /// 0.7.4 substring-matched the whole hint, so a recovery folder called+    /// `…\Drawings\` reclassified every file under it as a drawing and a genuine+    /// median-sized part (134,885 bytes) was refused against the 256 KB drawing+    /// floor. A directory name is not evidence about a document.+    ///+    /// It returns `Option` because **the classifier must be able to say "I do not+    /// know"**. When it could not, every failure of the hint chain resolved to+    /// `Part` — the LOWEST floor on both sides — so an unreadable type produced+    /// the most permissive answer available. The two callers want opposite+    /// defaults for an unknown (the estimate wants generous, the verification+    /// wants strict), and neither can express that against a total function.+    pub fn from_extension(name: &str) -> Option<DocKind> {+        // The FILE's extension: a directory may contain dots, and everything+        // before the last separator is somebody's folder name, not this+        // document's kind.+        let file = name.rsplit(['/', '\\']).next().unwrap_or(name);+        let ext = file.rsplit_once('.').map(|(_, e)| e)?.to_ascii_lowercase();+        match ext.as_str() {+            "sldprt" => Some(DocKind::Part),+            "sldasm" => Some(DocKind::Assembly),+            "slddrw" => Some(DocKind::Drawing),+            _ => None,+        }+    }++    /// The general hint: an extension, and only an extension.+    pub fn from_hint(hint: &str) -> Option<DocKind> {+        Self::from_extension(hint)+    }++    /// A type NAME as the backends report it (`type` on the real one, `docType`+    /// on the simulator). Exact, not substring: this is a closed vocabulary.+    pub fn from_type_name(name: &str) -> Option<DocKind> {+        match name.trim().to_ascii_lowercase().as_str() {+            "part" => Some(DocKind::Part),+            "assembly" => Some(DocKind::Assembly),+            "drawing" => Some(DocKind::Drawing),+            _ => None,+        }+    }++    /// A TITLE: its extension if it has one, else the prefix SOLIDWORKS gives an+    /// unsaved document — `Assem1`, `Part3`, `Draw2`.+    ///+    /// The default title of a new assembly is `Assem1`, which 0.7.4 classified as+    /// a PART and costed at 256 KB — where having no hint at all would have cost+    /// the generic 1 MB, and the truth is an 8 MB assembly floor. A hint that+    /// makes the answer worse than no hint is worse than useless, and this is the+    /// common case rather than a corner.+    pub fn from_title(title: &str) -> Option<DocKind> {+        if let Some(k) = Self::from_extension(title) {+            return Some(k);+        }+        let t = title.trim().to_ascii_lowercase();+        if t.starts_with("assem") {+            Some(DocKind::Assembly)+        } else if t.starts_with("draw") {+            Some(DocKind::Drawing)+        } else if t.starts_with("part") {+            Some(DocKind::Part)+        } else {+            None+        }+    }++    /// The extension a recovery file of this kind is given.+    pub fn extension(self) -> &'static str {+        match self {+            DocKind::Part => "SLDPRT",+            DocKind::Assembly => "SLDASM",+            DocKind::Drawing => "SLDDRW",+        }+    }++    /// The name of this kind as the backends report it.+    pub fn type_name(self) -> &'static str {+        match self {+            DocKind::Part => "part",+            DocKind::Assembly => "assembly",+            DocKind::Drawing => "drawing",+        }+    }++    /// The least this kind of document is assumed to cost when its size cannot be+    /// measured. Each sits above the measured MEDIAN for its kind, because an+    /// estimate that is too low starts a write that cannot finish, and one that+    /// is too high refuses a sweep that would have worked.+    pub fn estimate_floor(self) -> u64 {+        match self {+            DocKind::Part => 256 * 1024,+            DocKind::Assembly => 8 * 1024 * 1024,+            DocKind::Drawing => 4 * 1024 * 1024,+        }+    }++    /// THE FLOOR TO APPLY WHEN THE KIND IS NOT KNOWN: the highest of the three.+    ///+    /// 0.7.4's comment argued the reverse — that a low default was right because+    /// "too high a floor refuses to close a real document". Both halves are true+    /// and the conclusion was backwards. A too-high floor REFUSES, loudly, naming+    /// the file and the number; the user loses nothing and runs it again. A+    /// too-low floor CLOSES a document against a file nobody checked. For a+    /// verification, refusing is the direction to fail in.+    pub fn unknown_kind_floor() -> u64 {+        DocKind::Drawing.min_recovery_bytes()+    }++    /// The least a written recovery file of this kind may be and still count.+    /// Each sits just BELOW the smallest real document of its kind measured here+    /// (29,130 / 95,492 / 319,803), so it can never reject a genuine document+    /// while still catching a write that stopped early.+    ///+    /// **THE PART FLOOR IS TIGHT, and the first live close said so.** On+    /// 2026-09-17 the sweep rescued four documents at 25,773-26,047 bytes each —+    /// an EMPTY part is about 25.8 KB, which clears the 24 KB floor by roughly+    /// 1.2 KB. That is the intended margin and not an accident: the floor exists+    /// to catch a write that stopped early, and an empty part is the smallest+    /// thing a real save can legitimately produce. But it is 5%, so anyone raising+    /// this number is raising it INTO real documents, and must measure a genuinely+    /// empty part on the target edition before touching it.+    pub fn min_recovery_bytes(self) -> u64 {+        match self {+            DocKind::Part => 24 * 1024,+            DocKind::Assembly => 80 * 1024,+            DocKind::Drawing => 256 * 1024,+        }+    }+}++/// The safety factor between what this sweep will write and the room it insists+/// on having first.+///+/// SaveAs3 does not write in place: a document is built and flushed, the old copy+/// of a re-saved file can still be on the volume while the new one lands, and the+/// estimate itself is only an estimate. Two times the estimate is the margin, and+/// it is applied to every check — the one before the sweep starts and the one+/// before each save.+pub const HEADROOM_FACTOR: u64 = 2;++/// WHAT THIS SWEEP IS ABOUT TO WRITE.+///+/// A document with a readable path costs about what it costs on disk now. One+/// with no path, or whose path this process cannot stat, costs an ESTIMATE that+/// never falls below the floor for its KIND. Unknowns are rounded UP, because the+/// direction of a wrong estimate decides whether this refuses a sweep it could+/// have done (a nuisance) or starts one it cannot finish (a truncated file it+/// cannot detect).+pub struct WriteEstimate {+    /// Total bytes this sweep is expected to write.+    pub total: u64,+    /// The largest single document, which is the room the NEXT save needs.+    pub largest: u64,+    /// How many documents had a size this process could actually read.+    pub measured: usize,+    /// How many were estimated instead.+    pub estimated: usize,+}++/// Estimate from paths alone, inferring each document's kind from its extension.+/// A pathless document has no extension to read, so it costs the generic unknown.+pub fn estimate_writes(paths: &[String]) -> WriteEstimate {+    let docs: Vec<(String, Option<DocKind>)> = paths+        .iter()+        .map(|p| {+            let kind = if p.trim().is_empty() { None } else { DocKind::from_hint(p) };+            (p.clone(), kind)+        })+        .collect();+    estimate_writes_typed(&docs)+}++/// Estimate when the caller KNOWS each document's kind — which the sweep does,+/// because SOLIDWORKS told it.+///+/// The rule that matters is MONOTONICITY: **a document this process could measure+/// must never lower the assumed cost of one it could not.** 0.7.3 costed an+/// unknown at twice the largest measured document, so a single 29 KB part beside+/// a pathless assembly dropped that assembly's assumed cost from 1 MB to 58 KB —+/// learning something small about the session made the guess about the rest of it+/// smaller, and `largest` also gates the re-check before every save. The fix is+/// one `max` against a floor that depends only on the KIND.+pub fn estimate_writes_typed(docs: &[(String, Option<DocKind>)]) -> WriteEstimate {+    let sizes: Vec<Option<u64>> = docs+        .iter()+        .map(|(p, _)| {+            if p.trim().is_empty() {+                None+            } else {+                std::fs::metadata(p).ok().map(|m| m.len())+            }+        })+        .collect();+    let biggest_known = sizes.iter().flatten().copied().max().unwrap_or(0);+    let neighbour_cost = biggest_known.saturating_mul(2);+    let mut total = 0u64;+    let mut largest = 0u64;+    let mut measured = 0usize;+    let mut estimated = 0usize;+    for (s, (_, kind)) in sizes.iter().zip(docs.iter()) {+        let cost = match s {+            Some(n) => {+                measured += 1;+                *n+            }+            None => {+                estimated += 1;+                // NEVER BELOW THE KIND'S FLOOR, whatever the neighbours weigh.+                let floor = kind.map(|k| k.estimate_floor()).unwrap_or(UNKNOWN_DOCUMENT_ESTIMATE);+                neighbour_cost.max(floor)+            }+        };+        total = total.saturating_add(cost);+        largest = largest.max(cost);+    }+    WriteEstimate { total, largest, measured, estimated }+}

@@ -262,6 +262,82 @@ impl WindowInfo {     } } +/// The readable contents of a dialog: what it says, and what it offers.+#[derive(Debug, Clone, Default, PartialEq)]+pub struct DialogContents {+    /// Every static text line, in z-order.+    pub text: Vec<String>,+    /// The name on every PUSH BUTTON. Checkboxes are not buttons here — see+    /// `checkboxes` — because "Don't show this again" is not a choice about what+    /// happens to the user's work.+    pub buttons: Vec<String>,+    /// Checkbox labels, kept separately and never counted as choices.+    pub checkboxes: Vec<String>,+    /// TRUE if any control's text hit the read buffer and may be cut short. The+    /// reads are 1024 wide; a longer message is reported as truncated rather than+    /// silently shortened, because the part that got cut is exactly where a+    /// countdown or a file name tends to live.+    pub truncated: bool,+}++/// CLASSIFY ONE CONTROL from what Win32 says about it.+///+/// A Win32 CHECKBOX HAS CLASS "Button" — `BS_CHECKBOX` (0x02) and+/// `BS_AUTOCHECKBOX` (0x03) are STYLE bits, not classes — so a control tree read+/// by class alone files "Don't show this again" as a button. That matters because+/// `acknowledge_only` counts buttons: a licence dialog with OK plus a "do not+/// show again" box would have read as two choices and stopped being+/// acknowledge-only, and a dialog with only a checkbox would have read as one.+///+/// Style is the low 4 bits of the button type field.+pub fn classify_control(class: &str, style: u32, text: &str) -> Option<&'static str> {+    if text.trim().is_empty() {+        return None;+    }+    let c = class.to_ascii_lowercase();+    if c.contains("button") {+        // BS_CHECKBOX = 0x2, BS_AUTOCHECKBOX = 0x3, BS_3STATE = 0x5,+        // BS_AUTO3STATE = 0x6, BS_RADIOBUTTON = 0x4, BS_AUTORADIOBUTTON = 0x9.+        return Some(match style & 0xF {+            0x2 | 0x3 | 0x5 | 0x6 => "checkbox",+            0x4 | 0x9 => "radio",+            _ => "button",+        });+    }+    if c.contains("static") || c.contains("edit") {+        return Some("text");+    }+    None+}++impl DialogContents {+    pub fn to_json(&self) -> Value {+        json!({+            "text": self.text,+            "buttons": self.buttons,+            "checkboxes": self.checkboxes,+            "truncated": self.truncated,+        })+    }+    /// A dialog whose only choice is to acknowledge it: EXACTLY ONE button, and+    /// that button is an acknowledgement. Any second button is a choice, and a+    /// choice is never acknowledge-only — "OK" beside "Cancel" decides something.+    ///+    /// This says nothing about whether this bridge may PRESS it. It may not:+    /// `never_answer` stays true, and whether an OK-only informational dialog is+    /// ever pressable is a policy question for the user, not a deduction from a+    /// control tree.+    pub fn acknowledge_only(&self) -> bool {+        let named: Vec<String> = self+            .buttons+            .iter()+            .map(|b| b.trim().trim_start_matches('&').replace('&', "").to_ascii_lowercase())+            .filter(|b| !b.is_empty())+            .collect();+        named.len() == 1 && matches!(named[0].as_str(), "ok" | "close")+    }+}+ /// What SOLIDWORKS is costing the machine right now. #[derive(Clone, Debug, Default, PartialEq)] pub struct ProcMetrics {@@ -336,6 +412,26 @@ pub trait LaunchOs: Send + Sync {         Err("this host cannot enumerate windows".into())     } +    /// WHAT A DIALOG SAYS, AND WHICH BUTTONS IT HAS. Read-only, and `Err` is+    /// UNKNOWN — never "it says nothing".+    ///+    /// Live, 2026-09-17: the safe-close sweep stopped correctly on a dialog and+    /// reported `{"kind":"license","title":"License Manager"}` — the title and+    /// nothing else. Read by hand afterwards, the window said:+    ///+    /// > Failed to check 1 license(s): 3DEXPERIENCE SOLIDWORKS Professional:+    /// > Unable to connect to server. The session will end after the next 5+    /// > unsuccessful attempts.+    ///+    /// with a single button, OK. A title alone cannot distinguish "your licence+    /// expired" from "the licence server is unreachable and the session dies in+    /// five tries" — and the second is a countdown a person needs to see.+    ///+    /// THIS NEVER PRESSES ANYTHING. It reads.+    fn dialog_contents(&self, _hwnd: i64) -> Result<DialogContents, String> {+        Err("this host cannot read dialog contents".into())+    }+     /// This process's own pid — recorded on a launch attempt so a LATER bridge     /// can tell "somebody is supervising this" from "this was left behind".     fn self_pid(&self) -> u32 {@@ -969,6 +1065,50 @@ impl LaunchOs for FakeOs {     /// The simulated desktop: `windows.json`, scoped to the pid when a row names     /// one. `window-census-fails` makes the census UNREADABLE, which callers must     /// treat as unknown rather than as "nothing on screen".+    fn dialog_contents(&self, hwnd: i64) -> Result<DialogContents, String> {+        if self.dir.join("dialog-contents-unreadable").exists() {+            return Err("simulated: the dialog's controls could not be read".into());+        }+        // The scenario's own dialog carries its text and buttons, so a test can+        // hold the LIVE licence dialog exactly as it was read on 2026-09-17.+        let d = self.read_json("dialog-open.json");+        let matches = d.get("hwnd").and_then(|v| v.as_i64()).map(|h| h == hwnd).unwrap_or(false);+        if !matches {+            return Err("no such dialog in this scenario".into());+        }+        let list = |k: &str| -> Vec<String> {+            d.get(k)+                .and_then(|v| v.as_array())+                .map(|a| a.iter().filter_map(|x| x.as_str().map(|s| s.to_string())).collect())+                .unwrap_or_default()+        };+        // THE SIMULATOR CAN HAND BACK RAW CONTROLS TOO. Pre-classified lists are+        // convenient and prove nothing about the classifier, so a scenario may+        // instead give `controls: [[class, style, text], …]` and go through the+        // same `classify_control` the real host uses.+        if let Some(rows) = d.get("controls").and_then(|v| v.as_array()) {+            let mut out = DialogContents::default();+            for r in rows {+                let class = r.get(0).and_then(|v| v.as_str()).unwrap_or("");+                let style = r.get(1).and_then(|v| v.as_u64()).unwrap_or(0) as u32;+                let text = r.get(2).and_then(|v| v.as_str()).unwrap_or("").to_string();+                match classify_control(class, style, &text) {+                    Some("button") => out.buttons.push(text),+                    Some("checkbox") | Some("radio") => out.checkboxes.push(text),+                    Some("text") => out.text.push(text),+                    _ => {}+                }+            }+            return Ok(out);+        }+        Ok(DialogContents {+            text: list("text"),+            buttons: list("buttons"),+            checkboxes: list("checkboxes"),+            truncated: d.get("truncated").and_then(|v| v.as_bool()).unwrap_or(false),+        })+    }+     fn windows_of_pid(&self, pid: u32) -> Result<Vec<WindowInfo>, String> {         if self.dir.join("window-census-fails").exists() {             return Err("simulated: the window census could not be taken".into());@@ -1379,6 +1519,71 @@ mod win {          /// Every top-level window owned by `pid`, with its class — the quit         /// ladder's P3 instrument, and readable with no ab and no COM.+        /// READ-ONLY, and it presses nothing. `EnumChildWindows` walks the+        /// dialog's controls; `GetClassNameW` says what each one is and+        /// `GetWindowTextW` what it says. Static text becomes `text`, buttons+        /// become `buttons`.+        ///+        /// Measured 2026-09-17 on the live licence dialog: one static line+        /// ("Failed to check 1 license(s): 3DEXPERIENCE SOLIDWORKS Professional:+        /// Unable to connect to server. The session will end after the next 5+        /// unsuccessful attempts.") and one button, OK. The sweep and the quit+        /// are both blocked while it is up, and it appeared when the 3DEXPERIENCE+        /// licence heartbeat failed — it coincided with the desktop dropping off+        /// the relay.+        fn dialog_contents(&self, hwnd: i64) -> Result<DialogContents, String> {+            use windows::core::BOOL;+            use windows::Win32::UI::WindowsAndMessaging::{+                EnumChildWindows, GetClassNameW, GetWindowTextW,+            };+            static CHILDREN: std::sync::Mutex<Vec<i64>> = std::sync::Mutex::new(Vec::new());+            unsafe extern "system" fn child_proc(h: HWND, _: LPARAM) -> BOOL {+                if let Ok(mut g) = CHILDREN.lock() {+                    g.push(h.0 as i64);+                }+                BOOL(1)+            }+            let _serialised = ENUM_LOCK.lock().unwrap_or_else(|e| e.into_inner());+            CHILDREN.lock().unwrap_or_else(|e| e.into_inner()).clear();+            let parent = HWND(hwnd as *mut std::ffi::c_void);+            unsafe {+                let _ = EnumChildWindows(Some(parent), Some(child_proc), LPARAM(0));+            }+            let kids = CHILDREN.lock().unwrap_or_else(|e| e.into_inner()).clone();+            if kids.is_empty() {+                return Err("the dialog reported no child controls".into());+            }+            let mut out = DialogContents::default();+            for k in kids {+                let h = HWND(k as *mut std::ffi::c_void);+                let mut class = [0u16; 256];+                let mut text = [0u16; 1024];+                let (cl, tl) =+                    unsafe { (GetClassNameW(h, &mut class), GetWindowTextW(h, &mut text)) };+                let class = String::from_utf16_lossy(&class[..cl.max(0) as usize]);+                let body = String::from_utf16_lossy(&text[..tl.max(0) as usize]).trim().to_string();+                // A FULL BUFFER MAY BE A CUT MESSAGE. The reads are 1024 wide and+                // the part that gets cut is where a countdown or a file name lives.+                if tl as usize >= text.len().saturating_sub(1) {+                    out.truncated = true;+                }+                // STYLE, not class: a Win32 checkbox IS class "Button".+                let style = unsafe {+                    windows::Win32::UI::WindowsAndMessaging::GetWindowLongPtrW(+                        h,+                        windows::Win32::UI::WindowsAndMessaging::GWL_STYLE,+                    )+                } as u32;+                match classify_control(&class, style, &body) {+                    Some("button") => out.buttons.push(body),+                    Some("checkbox") | Some("radio") => out.checkboxes.push(body),+                    Some("text") => out.text.push(body),+                    _ => {}+                }+            }+            Ok(out)+        }+         fn windows_of_pid(&self, pid: u32) -> Result<Vec<WindowInfo>, String> {             use windows::Win32::UI::WindowsAndMessaging::{GetClassNameW, GetWindowTextW};             let _serialised = ENUM_LOCK.lock().unwrap_or_else(|e| e.into_inner());

@@ -1,22 +1,51 @@-//! The bridge's scratch space — and the promise to prune it.+//! The bridge's DATA — and why it no longer lives where the bridge is installed. //!-//! Everything this bridge writes on its own initiative (default export paths,-//! generated BOM CSVs) lands under one root:+//! Everything this bridge writes on its own initiative lands under one root:+//! the recovery folders, the action ledger, the ownership registry, launch+//! state, verb timings, and the scratch files it gives its own documents. //! //! ```text-//! %LOCALAPPDATA%\Adom Bridge\bridges-cache\solidworks\exports\+//! %LOCALAPPDATA%\Adom Bridge\solidworks-data\ //! ``` //!+//! **SEV-1, MEASURED 2026-09-30.** Until 0.9.0 that root was+//! `%LOCALAPPDATA%\Adom Bridge\bridges-cache\solidworks\` — the directory ab+//! INSTALLS the bridge into. ab's updater re-extracts that whole directory on+//! every release, and Drew's was found CREATED 2026-09-18 09:42 by the+//! auto-install of 0.8.9: every recovery folder from 09-17, the ledger, the+//! ownership registry and the scratch documents were gone. Only test documents+//! were in them, so nothing of his was lost — but the recovery folder is by+//! design the ONLY copy of work the user had not saved, and it was living in a+//! directory that a routine update deletes.+//!+//! So the data root is now a sibling of the install cache rather than a child of+//! it, anything found in the legacy location is MIGRATED on start (copied,+//! verified byte for byte, originals left where they were), `swx_recover_list`+//! still reads the legacy location, and `refuse_inside_install` stops a recovery+//! folder ever being placed under the directory the bridge runs from.+//!+//! WHAT THE MIGRATION CANNOT DO: the update that installs 0.9.0 re-extracts the+//! legacy directory BEFORE 0.9.0 first runs, so on a machine updated by ab from+//! 0.8.9 whatever 0.8.9 wrote there is most likely gone by the time the+//! migration looks. The migration covers every case where the directory+//! survives (an install that overlays rather than re-extracts, a copy run from+//! elsewhere); the move of the root is what protects every update after this one.+//! //! `SWX_SCRATCH_DIR` overrides the root (the test harness points it at a temp-//! dir); with neither, we fall back to the OS temp dir. `swx_uninstall` deletes-//! exactly this root and nothing else.+//! dir); `SWX_LEGACY_DIR` and `SWX_INSTALL_DIR` override the two install+//! locations for the same reason. With neither `SWX_SCRATCH_DIR` nor+//! `LOCALAPPDATA` we fall back to the OS temp dir. `swx_uninstall` removes the+//! bridge's own bookkeeping and `exports/` under this root, and NEVER the+//! recovery folders or the ledger: a recovery file is the user's only copy of+//! work they had not saved, and the ledger is the record of what was done.  use std::path::{Path, PathBuf}; use std::sync::Mutex; use std::time::{Duration, SystemTime};  /// Everything the bridge creates lives under here — and nothing else does,-/// which is what makes `swx_uninstall` safe to run blind.+/// which is what makes `swx_uninstall` safe to run blind. NEVER inside the+/// install directory: see the module comment for what that cost. pub fn root() -> PathBuf {     if let Ok(dir) = std::env::var("SWX_SCRATCH_DIR") {         if !dir.is_empty() {@@ -25,10 +54,350 @@ pub fn root() -> PathBuf {     }     if let Ok(local) = std::env::var("LOCALAPPDATA") {         if !local.is_empty() {-            return Path::new(&local).join("Adom Bridge").join("bridges-cache").join("solidworks");+            // A SIBLING of `bridges-cache`, not a child of it.+            return Path::new(&local).join("Adom Bridge").join("solidworks-data");+        }+    }+    std::env::temp_dir().join("adom-bridge-swx-data")+}++/// WHERE THIS BRIDGE'S DATA USED TO LIVE — ab's install cache. Read for+/// migration and by `swx_recover_list`; never written.+pub fn legacy_root() -> Option<PathBuf> {+    if let Ok(dir) = std::env::var("SWX_LEGACY_DIR") {+        if !dir.is_empty() {+            return Some(PathBuf::from(dir));+        }+    }+    if let Ok(local) = std::env::var("LOCALAPPDATA") {+        if !local.is_empty() {+            return Some(Path::new(&local).join("Adom Bridge").join("bridges-cache").join("solidworks"));+        }+    }+    None+}++/// The directory the running bridge was INSTALLED into — whatever ab extracted.+/// Anything placed under it is gone at the next update.+pub fn install_dir() -> Option<PathBuf> {+    if let Ok(dir) = std::env::var("SWX_INSTALL_DIR") {+        if !dir.is_empty() {+            return Some(PathBuf::from(dir));+        }+    }+    std::env::current_exe().ok().and_then(|p| p.parent().map(|d| d.to_path_buf()))+}++/// A path as the filesystem would resolve it, so that a comparison cannot be+/// talked out of its answer by spelling: `.` and `..` are folded first, then the+/// nearest ancestor that EXISTS is canonicalized (which resolves symlinks,+/// junctions and 8.3 short names) and the not-yet-created remainder is put back.+/// A recovery folder usually does not exist yet when it is checked, which is why+/// canonicalizing the whole path is not enough.+fn resolved(p: &Path) -> PathBuf {+    use std::path::Component;+    let mut lex = PathBuf::new();+    for c in p.components() {+        match c {+            Component::CurDir => {}+            Component::ParentDir => {+                lex.pop();+            }+            other => lex.push(other.as_os_str()),+        }+    }+    let mut base = lex.clone();+    let mut tail: Vec<std::ffi::OsString> = Vec::new();+    loop {+        if let Ok(c) = std::fs::canonicalize(&base) {+            let mut out = c;+            for t in tail.iter().rev() {+                out.push(t);+            }+            return out;+        }+        match (base.file_name().map(|f| f.to_os_string()), base.parent()) {+            (Some(name), Some(parent)) => {+                tail.push(name);+                base = parent.to_path_buf();+            }+            _ => return lex,+        }+    }+}++/// Is `inner` the same as, or inside, `outer`? Both are RESOLVED first (see+/// `resolved`), then compared case-insensitively with both separators, which is+/// how Windows matches a path. Erring towards "inside" is the safe direction for+/// every caller: it can only refuse a location, never approve one.+pub fn is_within(inner: &Path, outer: &Path) -> bool {+    let norm = |p: &Path| {+        let s = resolved(p).to_string_lossy().replace('/', "\\").to_ascii_lowercase();+        // A canonical Windows path comes back in its verbatim form.+        let s = s.strip_prefix("\\\\?\\unc\\").map(|r| format!("\\\\{r}")).unwrap_or(s);+        let s = s.strip_prefix("\\\\?\\").map(|r| r.to_string()).unwrap_or(s);+        s.trim_end_matches('\\').to_string()+    };+    let (i, o) = (norm(inner), norm(outer));+    !o.is_empty() && (i == o || i.starts_with(&format!("{o}\\")))+}++/// REFUSE A PATH THAT AN UPDATE WOULD DELETE.+///+/// A recovery folder is the user's only copy of work they had not saved. It must+/// never be placed under the directory the bridge is installed in, nor under+/// ab's install cache, because both are re-extracted on update. The root is+/// already outside them by construction; this is the check that keeps it that+/// way if an override, a future fallback or an ab change ever points it back+/// inside.+pub fn refuse_inside_install(path: &Path) -> Result<(), String> {+    for (what, dir) in [("the bridge's install directory", install_dir()),+                        ("ab's install cache", legacy_root())]+    {+        if let Some(d) = dir {+            // INSIDE OR EQUAL: the install location itself is re-extracted just+            // the same as anything under it.+            if is_within(path, &d) {+                return Err(format!(+                    "refusing to write {} under {what} ({}): that directory is re-extracted when \+                     the bridge is updated, which DELETES everything in it — measured 2026-09-30: \+                     the 2026-09-18 auto-install of 0.8.9 wiped every recovery folder written the \+                     day before. A recovery file is the user's only copy of unsaved work, so it \+                     goes in a data root outside it (by default {}).",+                    path.display(),+                    d.display(),+                    root().display()+                ));+            }+        }+    }+    Ok(())+}++/// COPY WHAT THE LEGACY LOCATION HOLDS INTO THE DATA ROOT.+///+/// Copied, VERIFIED byte for byte, and the originals LEFT where they were: this+/// runs against the directory an update is about to overwrite, but it is not+/// this code's place to delete anything from it. A file that fails verification+/// is reported and its copy removed, so a half-copied rescue never sits in the+/// new root looking like a whole one. A file that already exists in the new root+/// is never overwritten.+///+/// EACH FILE ONCE. `migrated-from-legacy.json` in the root is cumulative: every+/// file a run copied, or found already present, is SETTLED and never copied+/// again — so a copy the user deletes stays deleted. What is not settled is+/// tried on every start: a file whose copy failed verification last time, and a+/// file that appeared in the legacy location since (an older bridge run again,+/// after a rollback). Returns the report of THIS run, or `None` when there was+/// nothing new to do.+pub fn migrate_legacy() -> Option<serde_json::Value> {+    use serde_json::{json, Value};+    let legacy = legacy_root()?;+    let dest = root();+    if !legacy.is_dir() || is_within(&dest, &legacy) || is_within(&legacy, &dest) {+        return None;+    }+    let marker = dest.join("migrated-from-legacy.json");+    let previous: Value = std::fs::read_to_string(&marker)+        .ok()+        .and_then(|t| serde_json::from_str::<Value>(&t).ok())+        .unwrap_or(Value::Null);+    let list = |key: &str| -> Vec<Value> {+        previous.get(key).and_then(|v| v.as_array()).cloned().unwrap_or_default()+    };+    let (copied_before, skipped_before) = (list("copied"), list("skipped"));+    let settled: std::collections::HashSet<String> = copied_before+        .iter()+        .chain(skipped_before.iter())+        .filter_map(|e| e.get("file").and_then(|f| f.as_str()).map(|f| f.to_string()))+        .collect();+    // THE PERSISTENT STATE, named. Not the whole directory: the install cache+    // also holds the bridge's own executable and resources, which are not data.+    // Each registry's previous generation (`.bak`, kept by `write_atomic`) goes+    // with it: it is what `owned::restore` falls back to when the live file+    // cannot be read.+    const ITEMS: &[&str] = &[+        "recovery",+        "ledger.jsonl",+        "ledger.bak",+        "owned-docs.json",+        "owned-docs.bak",+        "com-host-created.json",+        "com-host-created.bak",+        "launch-state.json",+        "launch-state.bak",+        "timings.json",+        "timings.bak",+        "settings.json",+        "settings.bak",+        "exports",+    ];+    // Bounded: a link that points back up the tree must not recurse forever.+    fn walk(src: &Path, rel: &Path, out: &mut Vec<PathBuf>, depth: u32) {+        let here = src.join(rel);+        if here.is_file() {+            out.push(rel.to_path_buf());+        } else if depth < 16 {+            if let Ok(rd) = std::fs::read_dir(&here) {+                for e in rd.flatten() {+                    walk(src, &rel.join(e.file_name()), out, depth + 1);+                }+            }+        }+    }+    let mut files: Vec<PathBuf> = Vec::new();+    for item in ITEMS {+        if legacy.join(item).exists() {+            walk(&legacy, Path::new(item), &mut files, 0);+        }+    }+    files.retain(|rel| !settled.contains(rel.to_string_lossy().as_ref()));+    // IN A FIXED ORDER, so what an interrupted start leaves behind does not+    // depend on the order a directory listing happened to come back in.+    files.sort();+    if files.is_empty() {+        return None;+    }+    let _ = std::fs::create_dir_all(&dest);+    let mut copied: Vec<Value> = Vec::new();+    let mut failed: Vec<Value> = Vec::new();+    let mut skipped: Vec<Value> = Vec::new();+    for rel in files {+        let from = legacy.join(&rel);+        let to = dest.join(&rel);+        let name = rel.to_string_lossy().to_string();+        if to.exists() {+            skipped.push(json!({"file": name, "why": "already present in the data root; never overwritten"}));+            continue;+        }+        if let Some(parent) = to.parent() {+            let _ = std::fs::create_dir_all(parent);+        }+        // UNDER A TEMPORARY NAME, THEN RENAMED. A start that dies mid-copy — a+        // crash, a power cut, ab killing a bridge slow to answer /status — must+        // not leave a truncated file under the REAL name: the never-overwrite+        // rule above would then protect the truncated copy forever, and the next+        // update would delete the only whole one. A leftover temporary from an+        // interrupted start is simply replaced.+        let tmp = to.with_file_name(format!(+            "{}.migrating",+            to.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default()+        ));+        let _ = std::fs::remove_file(&tmp);+        let copied_ok = copy_for_migration(&from, &tmp, &dest);+        // TEST-ONLY FAULT, mock mode only: a copy that lands DIFFERENT from its+        // original — what a failing disk, or a sync client rewriting the file+        // mid-copy, looks like. Nothing in production creates this file, and+        // outside mock mode it is not even looked for.+        if copied_ok && crate::is_mock() && dest.join("mock-migrate-corrupts-copy").exists() {+            use std::io::Write;+            if let Ok(mut f) = std::fs::OpenOptions::new().append(true).open(&tmp) {+                let _ = f.write_all(b"!");+            }+        }+        let verified = copied_ok && same_bytes(&from, &tmp) && std::fs::rename(&tmp, &to).is_ok();+        if verified {+            copied.push(json!({+                "file": name,+                "bytes": std::fs::metadata(&to).map(|m| m.len()).unwrap_or(0),+            }));+        } else {+            // A COPY THAT DOES NOT MATCH IS NOT A COPY. Remove it rather than+            // leave a truncated rescue that reads as a whole one; the original+            // is still in the legacy location, untouched, and the next start+            // tries it again. A folder left empty by that goes too, so the+            // listing does not show an empty rescue beside the real one.+            let _ = std::fs::remove_file(&tmp);+            let mut dir = to.parent().map(|p| p.to_path_buf());+            while let Some(d) = dir {+                if d == dest || !d.starts_with(&dest) || std::fs::remove_dir(&d).is_err() {+                    break;+                }+                dir = d.parent().map(|p| p.to_path_buf());+            }+            failed.push(json!({"file": name, "why": "copy did not verify byte for byte"}));+        }+    }+    let why = "the legacy location is ab's install cache, which is re-extracted on every update \+               (measured 2026-09-30: the 2026-09-18 auto-install of 0.8.9 deleted every recovery \+               folder from the day before). Data now lives in this directory instead.";+    let report = json!({+        "from": legacy.to_string_lossy(),+        "to": dest.to_string_lossy(),+        "copied": copied,+        "failed": failed,+        "skipped": skipped,+        "originalsLeftInPlace": true,+        "why": why,+    });+    // THE CUMULATIVE RECORD: everything ever settled, and what is still failing.+    let record = json!({+        "from": legacy.to_string_lossy(),+        "to": dest.to_string_lossy(),+        "copied": copied_before.into_iter().chain(copied.iter().cloned()).collect::<Vec<_>>(),+        "skipped": skipped_before.into_iter().chain(skipped.iter().cloned()).collect::<Vec<_>>(),+        "failed": failed,+        "originalsLeftInPlace": true,+        "lastRunAtMs": crate::launchos::epoch_ms() as u64,+        "why": why,+    });+    if let Ok(text) = serde_json::to_string_pretty(&record) {+        let _ = crate::launch::write_atomic(&marker, &text);+    }+    Some(report)+}++/// The copy itself. Separate so the one test-only fault that models an+/// INTERRUPTED start can sit exactly where an interruption would: mid-copy, into+/// whatever path the migration copies to. In mock mode only, with+/// `mock-migrate-dies-mid-copy` in the data root (its content: how many copies to+/// let through first, default none), it writes the first half of the file and+/// the process exits — nothing in production creates that file, and outside mock+/// mode it is not even looked for.+fn copy_for_migration(from: &Path, to: &Path, dest: &Path) -> bool {+    if crate::is_mock() {+        if let Ok(spec) = std::fs::read_to_string(dest.join("mock-migrate-dies-mid-copy")) {+            use std::sync::atomic::{AtomicUsize, Ordering};+            static DONE: AtomicUsize = AtomicUsize::new(0);+            let allowed: usize = spec.trim().parse().unwrap_or(0);+            if DONE.fetch_add(1, Ordering::SeqCst) >= allowed {+                if let Ok(bytes) = std::fs::read(from) {+                    let _ = std::fs::write(to, &bytes[..bytes.len() / 2]);+                }+                eprintln!("[swx] mock-migrate-dies-mid-copy: exiting mid-copy of {}", from.display());+                std::process::exit(3);+            }+        }+    }+    std::fs::copy(from, to).is_ok()+}++/// BYTE FOR BYTE, streamed: a recovery file can be an assembly of hundreds of+/// megabytes, and reading two of them whole to compare them would be the way a+/// migration on a machine short of memory fails. Anything unreadable is "not the+/// same", which is the direction that keeps the original.+pub fn same_bytes(a: &Path, b: &Path) -> bool {+    use std::io::Read;+    let (Ok(fa), Ok(fb)) = (std::fs::File::open(a), std::fs::File::open(b)) else { return false };+    match (fa.metadata(), fb.metadata()) {+        (Ok(ma), Ok(mb)) if ma.len() == mb.len() => {}+        _ => return false,+    }+    let (mut ra, mut rb) = (std::io::BufReader::new(fa), std::io::BufReader::new(fb));+    let (mut ba, mut bb) = (vec![0u8; 1 << 20], vec![0u8; 1 << 20]);+    loop {+        let na = match ra.read(&mut ba) {+            Ok(n) => n,+            Err(_) => return false,+        };+        if na == 0 {+            // The lengths matched, so b must be exhausted too.+            return matches!(rb.read(&mut bb[..1]), Ok(0));+        }+        if rb.read_exact(&mut bb[..na]).is_err() || ba[..na] != bb[..na] {+            return false;         }     }-    std::env::temp_dir().join("adom-bridge-swx") }  /// Where generated files go. Created on demand.@@ -79,11 +448,12 @@ pub fn exports_dir() -> PathBuf {     d } -/// Remove ONLY what the bridge itself wrote — the `exports/` subtree — best-/// effort, one item at a time. Never touches `root()` itself: on Windows that-/// is the `bridges-cache/solidworks` folder ab unzipped the RUNNING exe and-/// bridge.json into, so deleting it mid-uninstall would hit the running image-/// (ACCESS_DENIED) and leave ab's install half-removed during a /S cascade.+/// Remove ONLY what the bridge itself wrote — the `exports/` subtree and its own+/// bookkeeping files — best effort, one item at a time. Never the root itself,+/// never `recovery/`, never the ledger. (Until 0.9.0 the root WAS the+/// `bridges-cache/solidworks` folder ab unzipped the running exe into, which is+/// why this was scoped from the start; since 0.9.0 it is a data directory of its+/// own, and the scoping now protects the user's recovery files.) /// /// Returns (removed, failed) as display strings for `swx_uninstall`. pub fn remove_artifacts() -> (Vec<String>, Vec<String>) {@@ -276,6 +646,44 @@ mod tests {         let _ = std::fs::remove_dir_all(&root);     } +    #[test]+    fn is_within_matches_by_components_not_by_prefix() {+        let t = std::env::temp_dir().join(format!("swx-within-{}", std::process::id()));+        let inst = t.join("inst");+        std::fs::create_dir_all(&inst).unwrap();+        // Inside, and equal.+        assert!(is_within(&inst.join("data").join("recovery"), &inst));+        assert!(is_within(&inst, &inst));+        // A SIBLING SHARING A PREFIX is not inside.+        assert!(!is_within(&t.join("inst-data"), &inst));+        assert!(!is_within(&t, &inst), "a parent is not inside its child");+        // Spelling does not get a path out: `..`, case, the other separator.+        assert!(is_within(&t.join("x").join("..").join("inst").join("data"), &inst));+        assert!(is_within(&Path::new(&inst.to_string_lossy().to_uppercase()).join("d"), &inst));+        assert!(is_within(Path::new(&format!("{}\\data", inst.display())), &inst));+        let _ = std::fs::remove_dir_all(&t);+    }++    #[test]+    fn same_bytes_is_byte_for_byte() {+        let t = std::env::temp_dir().join(format!("swx-samebytes-{}", std::process::id()));+        std::fs::create_dir_all(&t).unwrap();+        // Larger than one read buffer, so the loop is exercised past its first+        // chunk — and the difference is placed in the SECOND chunk.+        let a: Vec<u8> = (0..(3 << 20)).map(|i| (i % 251) as u8).collect();+        let mut b = a.clone();+        std::fs::write(t.join("a"), &a).unwrap();+        std::fs::write(t.join("b"), &b).unwrap();+        assert!(same_bytes(&t.join("a"), &t.join("b")));+        b[(1 << 20) + 17] ^= 1;+        std::fs::write(t.join("b"), &b).unwrap();+        assert!(!same_bytes(&t.join("a"), &t.join("b")), "one flipped bit is not the same file");+        std::fs::write(t.join("b"), &a[..a.len() - 1]).unwrap();+        assert!(!same_bytes(&t.join("a"), &t.join("b")), "a truncated copy is not the same file");+        assert!(!same_bytes(&t.join("a"), &t.join("missing")), "a missing copy is not the same file");+        let _ = std::fs::remove_dir_all(&t);+    }+     #[test]     fn prune_dir_actually_removes_files_and_survives_a_missing_dir() {         let dir = std::env::temp_dir().join(format!("swx-prune-test-{}", std::process::id()));@@ -321,3 +729,18 @@ pub fn set_setting_bool(key: &str, value: bool) {     }     let _ = crate::launch::write_atomic(&path, &serde_json::Value::Object(s).to_string()); }++/// A file's modification time in milliseconds since the epoch, or `None` when it+/// cannot be read. Read-only. Used to record the state of a user's own file at+/// the moment a sweep closed its document in place, so a later listing can tell+/// "untouched since" from "something wrote to it since".+pub fn modified_ms(path: &str) -> Option<u64> {+    if path.trim().is_empty() {+        return None;+    }+    std::fs::metadata(path)+        .ok()+        .and_then(|m| m.modified().ok())+        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())+        .map(|d| d.as_millis() as u64)+}

@@ -386,10 +386,26 @@ pub(crate) fn sidecar_error(e: SidecarError) -> Value {         "errorCode": e.code,         "error": e.message,         "detail": e.detail,-        "_hint": "The COM host reported an error. If SOLIDWORKS is showing a modal dialog, \-                  dismiss it (or ask the user to) and retry; swx_status shows whether \-                  SOLIDWORKS is running and attached at all. The host process is restarted \-                  automatically on the next verb.",+        // WHAT THE FAILING CALL SAID, structured, when the host had it. A+        // translator failure diagnosed from prose that omits the HRESULT is not+        // diagnosed at all.+        "hostError": e.data,+        // A CODED REFUSAL IS ITS OWN EXPLANATION, and the generic sentence must+        // not compete with it. `interconnect_blocks_import` carried "If SOLIDWORKS+        // is showing a modal dialog, dismiss it and retry" — there is no dialog,+        // nothing is hung, and retrying changes nothing until the user acts on the+        // setting. This is the 0.7.6 defect (a blanket instruction that was wrong+        // for the specific item) in a second place, and `_hint` is the field+        // agents read first.+        "_hint": if e.code.is_some() {+            "The COM host REFUSED this, with a reason: read `errorCode` and `detail` — they say \+             what would change the answer. `hostError` carries the structured failure where there \+             was one. The host process is restarted automatically on the next verb."+        } else {+            "The COM host reported an error. If SOLIDWORKS is showing a modal dialog, dismiss it \+             (or ask the user to) and retry; swx_status shows whether SOLIDWORKS is running and \+             attached at all. The host process is restarted automatically on the next verb."+        },     }) } @@ -1129,7 +1145,16 @@ impl StopEvidence {                 }                 dialog_pids = pids;                 census_readable = all_read;-                dialog = quit::first_blocking_dialog(&windows);+                // READ WHAT IT SAYS, here too. 0.8.4 gave the SWEEP the dialog's+                // own words and left the LADDER reporting a title — and the+                // ladder is where a stuck session gets diagnosed. A title cannot+                // tell "your licence expired" from "the licence server is+                // unreachable and this session ends after five more tries".+                // Reading is not answering; nothing here presses anything.+                dialog = quit::first_blocking_dialog(&windows).map(|mut d| {+                    d.read_contents(os);+                    d+                });             }         }         // P5: responding, without COM.@@ -1244,11 +1269,37 @@ fn swx_stop(ctx: &Ctx, args: &Value) -> Value {     // ── THE LADDER PLAN. Pinned at rung "a" by default: rungs (b)-(f) send     //    window messages and run VBA inside somebody's CAD session and not one     //    of them has been observed on a real machine.+    // ── DREW'S STANDING AUTHORIZATION, 2026-09-11. `userAuthorized:true` says the+    //    human has already answered the question this verb used to refuse for:+    //    whether the bridge may end their SOLIDWORKS. It changes exactly two+    //    things and nothing else.+    //+    //      * the ABSENCE of a launch attribution stops being a blocker — a+    //        session the bridge did not launch may still be quit, because the+    //        user said so. (The identity MISMATCH guard stays: a claim that names+    //        a different process still refuses, because that is not consent, it+    //        is a bookkeeping error.)+    //      * rungs (c) and (d) become available, since COM can be wedged behind a+    //        licence dialog on a locked desktop and those two need no COM at all.+    //+    //    It does NOT waive: the zero-open-documents rule, the dialog rule, the+    //    busy rule, rung (f) without allowRestartManager, or the law that nothing+    //    here ever kills anything.+    let user_authorized = arg_bool(args, "userAuthorized", false);     let max_rung = args         .get("maxRung")         .and_then(|v| v.as_str())-        .unwrap_or(quit::DEFAULT_MAX_RUNG)+        .unwrap_or(if user_authorized { "a" } else { quit::DEFAULT_MAX_RUNG })         .to_string();+    if !user_authorized && matches!(max_rung.as_str(), "c" | "d") {+        return err_code(+            "rung_needs_user_authorization",+            format!(+                "rung '{max_rung}' sends a window message into the user's SOLIDWORKS, which needs                  their say-so: pass userAuthorized:true with a reason"+            ),+            "The window-message rungs act on the application's own frame rather than through COM.              They are available when the user has authorized the bridge to close SOLIDWORKS —              `userAuthorized:true` — which is also what makes them useful, because a session wedged              behind a licence dialog cannot be reached through COM at all.",+        );+    }     let plan = quit::rungs_up_to(&max_rung);     if plan.is_empty() {         return err_code(@@ -1336,6 +1387,16 @@ fn swx_stop(ctx: &Ctx, args: &Value) -> Value {      let job = ctx.jobs.start("app_stop", "Asking SOLIDWORKS to quit (measured ladder)", 60);     let census_before = census0.as_ref().ok().cloned().unwrap_or_default();+    if user_authorized {+        crate::ledger::record(+            "solidworks_quit_authorized",+            json!({+                "authority": "quit under Drew's standing authorization (2026-09-11)",+                "reason": arg_str(args, "reason"),+                "maxRung": max_rung,+            }),+        );+    }     crate::ledger::record(         "solidworks_quit_started",         json!({@@ -1500,7 +1561,12 @@ fn swx_stop(ctx: &Ctx, args: &Value) -> Value {             census = os.processes();             gone = quit::process_gone(census.as_ref(), &id);             after_windows = os.windows_of_pid(id.pid);-            new_dialog = after_windows.as_ref().ok().and_then(|w| quit::first_blocking_dialog(w));+            new_dialog = after_windows.as_ref().ok().and_then(|w| {+                quit::first_blocking_dialog(w).map(|mut d| {+                    d.read_contents(&*os);+                    d+                })+            });             if gone == Some(true) || new_dialog.is_some() || std::time::Instant::now() >= wait_until             {                 break;@@ -2670,8 +2736,9 @@ fn swx_uninstall(ctx: &Ctx, args: &Value) -> Value {     ctx.com.shutdown();     let mut removed: Vec<String> = vec!["com host process".to_string()]; -    // ONLY the bridge's own exports subtree, best-effort per item — never the-    // cache root ab unzipped the running exe into.+    // ONLY the bridge's own bookkeeping and exports subtree, best-effort per+    // item — never the data root itself, never its recovery folders, never the+    // ledger.     let (mut artifacts, failed) = crate::scratch::remove_artifacts();     removed.append(&mut artifacts); @@ -2681,14 +2748,18 @@ fn swx_uninstall(ctx: &Ctx, args: &Value) -> Value {         "failed": failed,         "cascade": arg_bool(args, "cascade", false),         "ledgerPreserved": true,-        "_hint": "Idempotent, non-interactive, best-effort. The bridge writes only its own \-                  exports cache, so that subtree is all this removes — the ab cache root, \-                  SOLIDWORKS itself, its settings and every user document are never touched. A \-                  file still locked open is reported in `failed`, not fought over. \-                  swx_action_ledger's log is DELIBERATELY KEPT: this verb is ungated (ab calls \-                  it on app uninstall), so deleting the audit trail here would let a caller \-                  erase the record of what it did by asking the bridge to tidy up. Removing the \-                  folder is the user's to do.",+        // A recovery file can be the ONLY copy of work the user had not saved.+        "recoveryPreserved": true,+        "dataRoot": crate::scratch::root().to_string_lossy(),+        "_hint": "Idempotent, non-interactive, best-effort. This removes the bridge's own \+                  bookkeeping and its exports subtree, and nothing else: the data root itself, \+                  ab's install cache, SOLIDWORKS, its settings and every user document are \+                  never touched. A file still locked open is reported in `failed`, not fought \+                  over. The RECOVERY FOLDERS are DELIBERATELY KEPT — a rescued file can be the \+                  only copy of work the user had not saved — and so is swx_action_ledger's log: \+                  this verb is ungated (ab calls it on app uninstall), so deleting the audit \+                  trail here would let a caller erase the record of what it did by asking the \+                  bridge to tidy up. Removing `dataRoot` is the user's to do.",     }) } @@ -2732,6 +2803,9 @@ pub const CATALOG: &[(&str, &str, &str)] = &[     ("swx_close_all_documents", "exec", "close EVERY open document (confirm:true; skips unsaved by default)"),     ("swx_reset_workspace", "exec", "close only the scratch documents this bridge created"),     ("swx_close_import_temps", "exec", "drain leaked STEP/IGES import temporaries (…\\Temp\\swx<pid>\\IC~~\\…); default posture, never a saved user doc"),+    ("swx_close_all_safely", "exec", "save EVERY open document into a recovery folder, then close it — nothing closes before it is on disk; needs only a reason"),+    ("swx_shutdown", "exec", "close_all_safely, then quit SOLIDWORKS; idempotent, and the quit is skipped unless the session really emptied"),+    ("swx_recover_list", "read", "what previous sweeps preserved, and where — newest first"),     ("swx_kill", "process", "force-kill SOLIDWORKS (reason + confirm; discards unsaved work)"),     ("swx_window_info", "read", "SOLIDWORKS' windows and its main hwnd (read-only, nothing raised)"),     ("swx_dismiss_blocking_dialogs", "exec", "census of blocking SOLIDWORKS dialogs; close:true is opt-in, gated, and never touches an unattributed window"),@@ -2822,6 +2896,11 @@ pub fn dispatch(ctx: &Ctx, command: &str, args: &Value) -> Value {         "swx_progress" => swx_progress,         "swx_start" => swx_start,         "swx_stop" => swx_stop,+        // DREW'S STANDING AUTHORIZATION, 2026-09-11: the bridge closes documents+        // and quits by itself, having first written every document to disk.+        "swx_close_all_safely" => crate::verbs3::close_all_safely,+        "swx_shutdown" => crate::verbs3::shutdown,+        "swx_recover_list" => crate::verbs3::recover_list,         "swx_docs" => swx_docs,         "swx_find_files" => swx_find_files,         "swx_open" => swx_open,

@@ -376,6 +376,1445 @@ pub fn activate_document(ctx: &Ctx, args: &Value) -> Value {     } } +/// THE RECOVERY FOLDER for one sweep: `<scratch>/recovery/<yyyymmdd-hhmmss>/`.+///+/// One folder per sweep, named by the clock, so a second sweep never lands in the+/// first one's directory and `swx_recover_list` can show the user what came from+/// when.+/// WHAT TO TELL THE USER ABOUT ONE FILE, given a verdict somebody actually made.+fn how_to_open(verified: bool, kind_known: bool, reason: &str, guessed_name: bool) -> String {+    if !verified {+        return format!(+            "NOT A RESCUE. The sweep declined to close against this file: {}. The document it \+             came from was left OPEN — if it is still open, its work is in SOLIDWORKS, not here. \+             These bytes are kept because they are the only ones there are, not because they are \+             a complete document.",+            if reason.is_empty() { "it could not be verified" } else { reason }+        );+    }+    if !kind_known {+        return format!(+            "SOLIDWORKS will not open this file under this name{}. RENAME it to .SLDPRT, .SLDASM \+             or .SLDDRW — the kind could not be established when it was written, so try them in \+             that order — then swx_open the renamed file. The bytes were verified as a document; \+             only the name is unknown.",+            if guessed_name {+                " — its extension was a GUESS made when the document's type could not be read, \+                 not something this bridge observed"+            } else {+                ""+            }+        );+    }+    "swx_open this path.".to_string()+}++/// A FILE WITH NO RECORD BESIDE IT.+///+/// Older sweeps wrote no manifest, and a manifest can be lost. What can still be+/// checked is checked — but the result is NOT the same answer the sweep would+/// have given, and must not be dressed as one:+///+///   * the bytes are not a document of any kind: that is CONCLUSIVE, and false.+///   * the bytes pass: that is NOT conclusive. This verb cannot know what the+///     original weighed, nor whether the extension was a guess, and both of those+///     are what the unknown-kind rules turn on. So the honest answer is UNKNOWN —+///     `null` — because a weaker check does not produce false negatives, it+///     produces FALSE POSITIVES, and `verified:true` for a file the sweep refused+///     is the one error that costs the user something.+fn reverified_entry(+    p: &std::path::Path,+    name: &str,+    bytes: Option<u64>,+    kind: Option<crate::disk::DocKind>,+    v: &crate::comhost::host::RecoveryVerdict,+) -> Value {+    let conclusive_no = !v.ok;+    json!({+        "path": p.to_string_lossy(),+        "name": name,+        "bytes": bytes,+        "source": "reverified",+        "kind": kind.map(|k| json!(k.type_name())).unwrap_or(Value::Null),+        "kindKnown": kind.is_some(),+        "signatureOk": v.signature_ok,+        "verified": if conclusive_no { json!(false) } else { Value::Null },+        "verifiedReason": if conclusive_no {+            v.why.clone().map(Value::from).unwrap_or(Value::Null)+        } else {+            json!("re-checked from the file alone: this sweep left no manifest, so this bridge \+                   cannot see what the original document weighed or whether the extension was a \+                   guess — both of which the sweep's own verdict turned on. The bytes look like a \+                   document; whether the sweep accepted them is UNKNOWN.")+        },+        "howToOpen": if conclusive_no {+            format!(+                "NOT A RESCUE. These bytes are not a complete document: {}. If the document is \+                 still open in SOLIDWORKS, its work is there rather than here.",+                v.why.clone().unwrap_or_else(|| "it could not be verified".into())+            )+        } else {+            "UNCONFIRMED. No manifest was left for this sweep, so this bridge cannot say whether \+             it vouched for this file. Try swx_open (renaming a `.sldrecover` file to .SLDPRT, \+             .SLDASM or .SLDDRW first); if SOLIDWORKS refuses it, the file is incomplete and the \+             document's work is wherever it was left."+                .to_string()+        },+    })+}++/// A HOST FAILURE, WITH ITS STRUCTURE INTACT.+///+/// The sweep used to build `{"why": "the com host errored: <message>"}` at five+/// call sites and drop `e.data` at every one — so the structured COM detail 0.7.8+/// exists to surface could not reach a caller from this verb no matter what the+/// host sent. That matters more here than anywhere else: this is the verb that+/// runs when SOLIDWORKS is already misbehaving, so it meets the HRESULTs worth+/// reading, and since 0.7.8 its entries are written into `manifest.json` and+/// KEPT — a prose-only verdict is the permanent record of why a document was not+/// preserved.+fn host_failure_entry(e: &crate::comhost::SidecarError, path: Option<&str>) -> Value {+    json!({+        "path": path,+        "why": format!("the com host errored: {}", e.message),+        "detail": e.detail,+        "errorCode": e.code,+        "timedOut": e.timed_out,+        // THE STRUCTURED REASON. Where the host answered with one, it is carried+        // verbatim. Where it did NOT answer at all — a timeout, which kills the+        // com host — there is no host detail to carry, and `null` there is+        // indistinguishable from having thrown the detail away. So a timeout+        // reports ITS OWN facts instead: what this was, that the budget was+        // exceeded, and that the host was killed and respawns. Both are real+        // structure; neither is invented.+        "hostError": e.data.clone().unwrap_or_else(|| {+            if e.timed_out {+                json!({+                    "failure": "host_timeout",+                    "timedOut": true,+                    "message": e.message,+                    "note": "the com host did not answer within its budget and was killed; it \+                             respawns on the next verb. No COM detail exists for this failure \+                             because SOLIDWORKS never returned one.",+                })+            } else {+                Value::Null+            }+        }),+    })+}++/// THE NAME OF THE SWEEP'S OWN RECORD, written beside the files it wrote.+pub const MANIFEST_NAME: &str = "manifest.json";++/// WHAT THE SWEEP DECIDED, WRITTEN DOWN WHERE IT DECIDED IT.+///+/// Everything `swx_recover_list` used to re-derive was in hand at save time and+/// thrown away when the process ended: the original document's size, the kind+/// `GetType` reported, and whether the file's extension was a GUESS+/// (`namingFallback`). Re-deriving a verdict without them is strictly weaker than+/// the verdict it is trying to reproduce — and a weaker check does not produce+/// false negatives, it produces FALSE POSITIVES. `verified:true` for a file the+/// sweep refused and whose document it left open is the one error that matters+/// here, because the person reading the listing is the person whose sweep just+/// failed.+///+/// So the sweep writes its record into its own folder. It is rewritten after+/// every save and every close, ATOMICALLY (a temporary file and a rename), so a+/// bridge that dies mid-sweep leaves a manifest describing everything decided up+/// to that moment rather than a truncated one — and that is the case that matters+/// most, because a sweep that ran during a crash is exactly the one whose files+/// somebody reads later from a fresh bridge.+fn write_manifest(+    dir: &std::path::Path,+    reason: &str,+    records: &[Value],+    closed: &[String],+    failures: &[Value],+) {+    let files: Vec<Value> = records+        .iter()+        .map(|r| {+            let rp = r.get("recoveryPath").and_then(|v| v.as_str()).unwrap_or("");+            let name = std::path::Path::new(rp)+                .file_name()+                .map(|n| n.to_string_lossy().to_string())+                .unwrap_or_default();+            // A DOCUMENT CLOSED IN PLACE. A clean, saved document needs no copy —+            // its own file IS its preservation — so the sweep writes nothing for+            // it and `recoveryPath` is null. Without saying so here, the record+            // had no entry a reader could find, and swx_recover_list could not+            // tell a user "your file was closed at its own path, untouched",+            // which is the most reassuring thing it has to say. Measured live+            // 2026-09-30: Drew's saved part was closed with its bytes and mtime+            // unchanged, and the listing had nothing to show for it.+            let original = r.get("path").and_then(|v| v.as_str()).unwrap_or("");+            let in_place = rp.is_empty()+                && r.get("preserved").and_then(|v| v.as_bool()) == Some(true)+                && !original.is_empty();+            let close_key = if in_place { original } else { rp };+            json!({+                "name": if in_place { Value::Null } else { json!(name) },+                "closedInPlace": in_place,+                "recoveryPath": r.get("recoveryPath").cloned().unwrap_or(Value::Null),+                "title": r.get("title").cloned().unwrap_or(Value::Null),+                "originalPath": r.get("path").cloned().unwrap_or(Value::Null),+                // The kind SOLIDWORKS reported, or null when nothing could+                // establish it. A reader must not infer this from the extension.+                "kind": r.get("docKind").cloned().unwrap_or(Value::Null),+                // THE FACT NO FILE NAME CAN CARRY: this extension was a guess.+                "namingFallback": r.get("namingFallback").cloned().unwrap_or(Value::Null),+                "originalBytes": r.get("originalBytes").cloned().unwrap_or(Value::Null),+                // The user's own file's modification time when the sweep reached+                // it — recorded for a document closed in place, so a later reader+                // can tell "untouched since" from "written to since".+                "originalModifiedMs": r.get("originalModifiedMs").cloned().unwrap_or(Value::Null),+                "recoveryBytes": r.get("recoveryBytes").cloned().unwrap_or(Value::Null),+                "signatureOk": r.get("recoverySignatureOk").cloned().unwrap_or(Value::Null),+                // THE SWEEP'S VERDICT AND ITS OWN WORDS FOR IT. `verified` is a+                // verdict about bytes THIS SWEEP WROTE, so a document closed in+                // place has none: null, not true — nothing was written to verify.+                "verified": if in_place {+                    Value::Null+                } else {+                    r.get("preserved").cloned().unwrap_or(Value::Null)+                },+                "verdictReason": match r.get("why").filter(|v| !v.is_null()) {+                    Some(w) => w.clone(),+                    None if in_place => json!(+                        "clean and saved when the sweep reached it: its own file is its \+                         preservation, so the sweep wrote no copy and closed it at its own path \+                         without writing to that file"+                    ),+                    None => Value::Null,+                },+                "preserved": r.get("preserved").cloned().unwrap_or(Value::Null),+                // CLOSED BY THE PATH IT WAS CLOSED BY — its own, for a document+                // closed in place.+                "closed": !close_key.is_empty()+                    && closed.iter().any(|c| crate::verbs::same_path(c, close_key)),+                "wasDirty": r.get("wasDirty").cloned().unwrap_or(Value::Null),+                "wasPathless": r.get("wasPathless").cloned().unwrap_or(Value::Null),+            })+        })+        .collect();+    let doc = json!({+        "manifestVersion": 1,+        // WHY THE SWEEP STOPPED SHORT, with whatever structure the host gave.+        // A host failure explains documents that have NO file here at all, which+        // is exactly the question somebody reading this folder later is asking —+        // and it was the one thing the record did not answer.+        "failures": failures,+        "sweep": dir.file_name().map(|n| n.to_string_lossy().to_string()),+        "reason": reason,+        "updatedAtMs": crate::launchos::epoch_ms() as u64,+        "bridgeVersion": crate::BRIDGE_VERSION,+        "files": files,+        "_note": "Written by swx_close_all_safely / swx_shutdown as it ran. `verified:false` means \+                  this bridge REFUSED to close the document against these bytes and left the \+                  document open — the work is in SOLIDWORKS, not in this file. Kept because these \+                  are the only bytes there are. `closedInPlace:true` means the document was clean \+                  and saved: no copy was written (`name` and `recoveryPath` are null), and it was \+                  closed at `originalPath`, a file this sweep never writes to.",+    });+    let Ok(text) = serde_json::to_string_pretty(&doc) else { return };+    // ATOMIC: a half-written manifest would be worse than none, because the+    // listing believes it.+    let tmp = dir.join("manifest.json.tmp");+    if std::fs::write(&tmp, text.as_bytes()).is_ok() {+        let _ = std::fs::rename(&tmp, dir.join(MANIFEST_NAME));+    }+}++fn recovery_dir() -> std::path::PathBuf {+    let now = std::time::SystemTime::now()+        .duration_since(std::time::UNIX_EPOCH)+        .map(|d| d.as_secs())+        .unwrap_or(0);+    // yyyymmdd-hhmmss without pulling in a date library: the epoch arithmetic is+    // exact and this only has to be unique and sortable.+    let days = now / 86_400;+    let secs = now % 86_400;+    let (mut y, mut d) = (1970u64, days);+    loop {+        let leap = (y % 4 == 0 && y % 100 != 0) || y % 400 == 0;+        let len = if leap { 366 } else { 365 };+        if d < len {+            break;+        }+        d -= len;+        y += 1;+    }+    let leap = (y % 4 == 0 && y % 100 != 0) || y % 400 == 0;+    let months = [31, if leap { 29 } else { 28 }, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];+    let (mut m, mut day) = (0usize, d);+    while m < 12 && day >= months[m] {+        day -= months[m];+        m += 1;+    }+    let stamp = format!(+        "{y:04}{:02}{:02}-{:02}{:02}{:02}",+        m + 1,+        day + 1,+        secs / 3600,+        (secs % 3600) / 60,+        secs % 60+    );+    // ONE FOLDER PER SWEEP, even two sweeps in the same second.+    //+    // The stamp is second-granular, so two sweeps a fraction apart used to SHARE+    // a folder — and since 0.7.8 that means sharing a `manifest.json`. The second+    // sweep's manifest overwrites the first's, so the first sweep's files are+    // still there with no record describing them; and if the second preserved+    // nothing, its cleanup DELETED the first's manifest outright. That is the+    // mechanism behind the intermittent+    // `a_sweep_records_its_verdicts_beside_the_files_it_wrote` failure — roughly+    // one run in twelve — and it is a real reporting defect, not a test artefact:+    // the record of why a user's document was not preserved is what goes missing.+    // CLAIMED ATOMICALLY, not check-then-create. `if !exists { create }` is a+    // race with a window between the two halves: two sweeps starting together+    // both see "free" and both take the same folder — which is the defect this+    // uniqueness was added to fix, reintroduced by the way it was implemented.+    // `create_dir` FAILS if the directory is already there, so the creation IS+    // the claim, and AlreadyExists simply means take the next name.+    let base = crate::scratch::root().join("recovery");+    let _ = std::fs::create_dir_all(&base);+    for n in 0..1000 {+        let d = if n == 0 { base.join(&stamp) } else { base.join(format!("{stamp}-{}", n + 1)) };+        match std::fs::create_dir(&d) {+            Ok(()) => return d,+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,+            // Anything else — no permission, no disk — is not a naming problem,+            // and the sweep's own headroom and write checks report it properly.+            Err(_) => {+                let _ = std::fs::create_dir_all(&d);+                return d;+            }+        }+    }+    let d = base.join(format!("{stamp}-{}", crate::launchos::epoch_ms()));+    let _ = std::fs::create_dir_all(&d);+    d+}++/// IS A DIALOG ON SCREEN? The sweep must never reach a save prompt — every+/// document is clean before anything closes — so one appearing means a premise+/// is wrong, and the answer is to STOP and report it, never to answer it.+///+/// `None` means the census could not be taken, which also stops: a dialog we+/// cannot see is the one that matters.+fn blocking_dialog_now(ctx: &Ctx) -> Option<Option<Value>> {+    let os = crate::launchos::os();+    let state = ctx.call("app_state", json!({}), 20);+    let pid = state+        .as_ref()+        .ok()+        .and_then(|s| s.get("processId"))+        .and_then(|v| v.as_u64())+        .map(|p| p as u32)?;+    let census = os.processes().ok()?;+    let id = crate::quit::Identity {+        pid,+        created_at: census.iter().find(|p| p.pid == pid).and_then(|p| p.created_at)?,+        main_hwnd: None,+    };+    let pids = crate::quit::dialog_census_pids(Ok(&census), &id)?;+    let mut windows: Vec<crate::launchos::WindowInfo> = Vec::new();+    for p in &pids {+        match os.windows_of_pid(*p) {+            Ok(w) => windows.extend(w),+            Err(_) => return None,+        }+    }+    // AND READ WHAT IT SAYS. The sweep stops on a dialog and reports it; a title+    // alone cannot tell "your licence expired" from "the licence server is+    // unreachable and the session ends after five more tries". Reading is not+    // answering — nothing here presses anything.+    Some(crate::quit::first_blocking_dialog(&windows).map(|mut d| {+        d.read_contents(os.as_ref());+        d.to_json()+    }))+}++/// `swx_close_all_safely` — PRESERVE EVERYTHING, THEN CLOSE EVERYTHING.+///+/// Drew, 2026-09-11: *"I despise every time you ask for help closing. You MUST+/// find/build a way to safely close the docs/program."*+///+/// So this verb does not ask. It does not check ownership either — the user+/// authorized closing their own documents, and whose document it is stops being+/// the question. What replaces the question is a SEQUENCE, and it is the whole+/// safety property of this verb:+///+///   **every document is written to disk and verified there BEFORE anything+///   closes, and a document that could not be written is not closed.**+///+/// A dirty document is SAVED TO RECOVERY — `SaveAs3`, Silent alone, never Copy —+/// so the open document then POINTS AT the recovery file. That re-point is not a+/// detail: it is what makes the close key right, because the close is by the path+/// the document has at that moment. The user's original file on disk is never+/// written to; it is simply no longer what this in-memory document is attached+/// to, and their unsaved changes now live in recovery.+///+/// A save prompt cannot appear, because nothing is unsaved by the time a close+/// happens. If any dialog DOES appear the sweep stops and reports it rather than+/// answering it — and if the window census cannot be READ, the saves still happen+/// (they lose nothing) while the closes do not (they cannot be taken back).+pub fn close_all_safely(ctx: &Ctx, args: &Value) -> Value {+    gate!(ctx);+    if let Some(g) = require_reason(+        args,+        "swx_close_all_safely",+        "it closes every open SOLIDWORKS document after saving each one to a recovery folder",+    ) {+        return g;+    }+    if let Err(e) = identity_claim_ok(ctx) {+        return e;+    }+    // NOT UNDER THE INSTALL DIRECTORY. A recovery folder is the user's only copy+    // of unsaved work, and the install directory is re-extracted on update —+    // measured 2026-09-30, when an auto-install deleted every recovery folder+    // from the day before. The data root is outside it by construction; this is+    // the check that refuses, loudly and before anything is written or closed, if+    // an override or a future change ever puts it back inside.+    if let Err(why) = crate::scratch::refuse_inside_install(&crate::scratch::root().join("recovery")) {+        return err_code(+            "recovery_inside_install_dir",+            why,+            "Nothing was preserved and nothing was closed. Point the bridge's data root \+             somewhere an update does not touch (the default is %LOCALAPPDATA%\\Adom \+             Bridge\\solidworks-data) and run this again.",+        );+    }+    let job = ctx.jobs.start("close_all_safely", "Saving every document, then closing it", 120);+    let dir = recovery_dir();+    let dir_s = dir.to_string_lossy().to_string();+    let started = std::time::Instant::now();+    let budget = std::time::Duration::from_secs(+        args.get("maxSeconds").and_then(|v| v.as_u64()).unwrap_or(240).clamp(5, 580),+    );+    let batch = args.get("batch").and_then(|v| v.as_u64()).unwrap_or(25).clamp(1, 200);++    // ── HOW MUCH ROOM IS THERE, AND HOW MUCH DOES THIS NEED?+    //+    //    Marker and floor cannot catch the one failure that matters most here:+    //    THE RIGHT FILE, CUT SHORT. The marker lives at offset 4, so any prefix+    //    of a real document carries it, and a write that reaches 20 KB of a+    //    500 KB assembly passes the floor too. The format offers nothing cheap+    //    that would catch it — no constant tail, no length field (measured). So+    //    the defence is at the START: a truncation this bridge could not detect+    //    afterwards is one it declines to cause.+    //    THE KIND OF EACH DOCUMENT COMES FROM SOLIDWORKS, not from a guess: an+    //    assembly is about thirty times the median part, and costing a pathless+    //    one as if it were a part is how the per-save gate passes with far less+    //    room than the write needs.+    let open_docs: Vec<(String, Option<crate::disk::DocKind>)> =+        match ctx.call("docs", json!({}), 60) {+            Ok(d) => d+                .get("docs")+                .and_then(|v| v.as_array())+                .map(|a| {+                    a.iter()+                        .map(|x| {+                            let path =+                                x.get("path").and_then(|p| p.as_str()).unwrap_or("").to_string();+                            // The real backend reports `type`, the simulator+                            // `docType`; a TITLE is the last resort, and it is+                            // read as a title — its extension, or the prefix+                            // SOLIDWORKS gives an unsaved document ("Assem1").+                            // 0.7.4 ran the title through a substring match that+                            // called `Assem1` a part and costed it at 256 KB,+                            // which is worse than the 1 MB it would have cost+                            // with no hint at all. A document whose kind cannot+                            // be established stays None and costs the generic+                            // unknown.+                            let kind = x+                                .get("type")+                                .and_then(|v| v.as_str())+                                .and_then(|t| crate::disk::DocKind::from_type_name(t))+                                .or_else(|| {+                                    x.get("docType")+                                        .and_then(|v| v.as_str())+                                        .and_then(|t| crate::disk::DocKind::from_type_name(t))+                                })+                                .or_else(|| {+                                    x.get("title")+                                        .and_then(|v| v.as_str())+                                        .and_then(|t| crate::disk::DocKind::from_title(t))+                                });+                            (path, kind)+                        })+                        .collect()+                })+                .unwrap_or_default(),+            // An unreadable session is not an empty one. Estimate nothing from it+            // and let the per-save check carry the weight.+            Err(_) => Vec::new(),+        };+    let open_paths: Vec<String> = open_docs.iter().map(|(p, _)| p.clone()).collect();+    let estimate = crate::disk::estimate_writes_typed(&open_docs);+    let needed = estimate.total.saturating_mul(crate::disk::HEADROOM_FACTOR);+    let per_save_needed = estimate.largest.saturating_mul(crate::disk::HEADROOM_FACTOR);+    let free_before = crate::disk::free_bytes(&dir);+    let mut stopped_by_headroom: Option<Value> = None;+    // UNKNOWN FREE SPACE IS NOT PERMISSION, but it is not a refusal either: this+    // sweep's other guarantees do not depend on it, and refusing every sweep on a+    // volume this process cannot stat would put the bridge back to asking the+    // user to close things by hand. It is reported, and it is why+    // `headroomBytesBefore` can be null.+    if let Some(free) = free_before {+        if free < needed {+            stopped_by_headroom = Some(json!({+                "freeBytes": free,+                "neededBytes": needed,+                "shortfallBytes": needed.saturating_sub(free),+                "when": "before anything was written",+            }));+        }+    }++    let mut recovered: Vec<Value> = Vec::new();+    let mut closed_paths: Vec<String> = Vec::new();+    let mut close_failed: Vec<Value> = Vec::new();+    let mut closed = 0u64;+    let mut before: Option<i64> = None;+    let mut after: Option<i64> = None;+    let mut done = false;+    let mut stopped_by_dialog: Option<Value> = None;+    let mut dialog_unreadable = false;+    // THE CENSUS, ASKED AGAIN. Called before EVERY save and before EVERY close,+    // not once per batch: a save can raise a prompt of its own (a missing+    // external reference, a rebuild question), and under the old once-per-batch+    // check a dialog raised by the first save stayed invisible until every other+    // document in the batch had already been closed.+    //+    //   * `Some(Some(d))` — a dialog. STOP; it is never answered.+    //   * `None` — nobody can see. The SAVES still run, because saving loses+    //     nothing and is the half that protects the user's work; the CLOSES do+    //     not, because a dialog nobody can see is exactly the one that matters.+    //     Same rule as swx_stop's P3.+    //   * `Some(None)` — clear.+    enum Look {+        Clear,+        Blind,+        Dialog(Value),+    }+    let look = |ctx: &Ctx| -> Look {+        match blocking_dialog_now(ctx) {+            None => Look::Blind,+            Some(Some(d)) => Look::Dialog(d),+            Some(None) => Look::Clear,+        }+    };+    'sweep: while stopped_by_headroom.is_none() {+        // ── PHASE 1: PRESERVE, one document at a time, censusing before each.+        //    Nothing closes during this phase, which is what makes the walk index+        //    a stable way to step through the session.+        // (path, kind, was-written-by-this-sweep, the original's size)+        let mut ready: Vec<(String, Option<crate::disk::DocKind>, bool, Option<u64>)> = Vec::new();+        let mut walked = 0u64;+        let mut index = 0u64;+        while index < batch {+            match look(ctx) {+                Look::Dialog(d) => {+                    stopped_by_dialog = Some(d);+                    break 'sweep;+                }+                Look::Blind => dialog_unreadable = true,+                Look::Clear => {}+            }+            if started.elapsed() >= budget {+                break;+            }+            // AGAIN, BEFORE EVERY SAVE. The disk can fill while this runs — this+            // sweep is itself one of the things filling it — and the check that+            // matters is the one taken before the write that would be truncated,+            // not the one taken before the first of them.+            if let Some(free) = crate::disk::free_bytes(&dir) {+                if free < per_save_needed {+                    stopped_by_headroom = Some(json!({+                        "freeBytes": free,+                        "neededBytes": per_save_needed,+                        "shortfallBytes": per_save_needed.saturating_sub(free),+                        "when": format!("after preserving {} document(s)", recovered.len()),+                    }));+                    break 'sweep;+                }+            }+            let r = match ctx.call(+                "preserve_and_close",+                json!({"phase": "preserve", "recoveryDir": dir_s, "index": index}),+                300,+            ) {+                Err(e) => {+                    close_failed.push(host_failure_entry(&e, None));+                    // RECORD IT. A sweep that stops because the HOST failed is+                    // exactly the case where the folder holds fewer files than+                    // documents, and the manifest is the only thing that can say+                    // why.+                    write_manifest(+                        &dir,+                        arg_str(args, "reason").unwrap_or_default(),+                        &recovered,+                        &closed_paths,+                        &close_failed,+                    );+                    break 'sweep;+                }+                Ok(r) => r,+            };+            if before.is_none() {+                before = r.get("documentCount").and_then(|v| v.as_i64());+            }+            after = r.get("documentCount").and_then(|v| v.as_i64());+            if r.get("walked").and_then(|v| v.as_u64()).unwrap_or(0) == 0 {+                break; // the walk is exhausted+            }+            walked += 1;+            if let Some(rec) = r.get("record").filter(|v| !v.is_null()) {+                recovered.push(rec.clone());+                // AFTER EVERY SAVE. A sweep that dies here leaves a record of+                // everything decided up to this document.+                write_manifest(&dir, arg_str(args, "reason").unwrap_or_default(), &recovered, &closed_paths, &close_failed);+            }+            if let Some(rd) = r.get("ready").filter(|v| !v.is_null()) {+                ready.push((+                    rd.get("path").and_then(|v| v.as_str()).unwrap_or_default().to_string(),+                    // The KIND the backend established, or None when it could+                    // not. It is carried, never re-derived from the file name —+                    // that name came FROM the kind.+                    rd.get("docType")+                        .and_then(|v| v.as_str())+                        .and_then(|t| crate::disk::DocKind::from_type_name(t)),+                    rd.get("writtenHere").and_then(|v| v.as_bool()).unwrap_or(false),+                    rd.get("originalBytes").and_then(|v| v.as_u64()),+                ));+            }+            index += 1;+        }++        // ── PHASE 2: CLOSE. Drawings and assemblies before parts — a part an+        //    assembly still references stays open when closed on its own, and+        //    closing the parent first lets the child go. Skipped entirely while+        //    the census is unreadable: everything is already safe on disk.+        //    A document of UNKNOWN kind is closed LAST: it might be a part held+        //    open by an assembly, and going late costs nothing.+        ready.sort_by_key(|(_, k, _, _)| match k {+            Some(crate::disk::DocKind::Drawing) => 0,+            Some(crate::disk::DocKind::Assembly) => 1,+            Some(crate::disk::DocKind::Part) => 2,+            None => 3,+        });+        let mut closed_this_pass = 0u64;+        if !dialog_unreadable {+            for (path, kind, written_here, original_bytes) in &ready {+                match look(ctx) {+                    Look::Dialog(d) => {+                        stopped_by_dialog = Some(d);+                        break 'sweep;+                    }+                    // BLIND MID-SWEEP. Whatever was closed is closed and was on+                    // disk first; nothing further closes.+                    Look::Blind => {+                        dialog_unreadable = true;+                        break;+                    }+                    Look::Clear => {}+                }+                match ctx.call(+                    "preserve_and_close",+                    json!({+                        "phase": "close", "path": path, "writtenHere": written_here,+                        "docKind": kind.map(|k| json!(k.type_name())).unwrap_or(Value::Null),+                        "originalBytes": original_bytes,+                    }),+                    300,+                ) {+                    Err(e) => {+                        close_failed.push(host_failure_entry(&e, Some(path)));+                        break 'sweep;+                    }+                    Ok(r) => {+                        after = r.get("documentCount").and_then(|v| v.as_i64());+                        if r.get("closed").and_then(|v| v.as_bool()).unwrap_or(false) {+                            closed += 1;+                            closed_this_pass += 1;+                            closed_paths.push(path.clone());+                            // AND AFTER EVERY CLOSE, so the record says which+                            // documents are gone from SOLIDWORKS and now exist+                            // only as these files.+                            write_manifest(+                                &dir,+                                arg_str(args, "reason").unwrap_or_default(),+                                &recovered,+                                &closed_paths,+                                &close_failed,+                            );+                        } else {+                            close_failed.push(json!({+                                "path": path,+                                "why": r.get("why").and_then(|v| v.as_str())+                                    .unwrap_or("still open after CloseDoc"),+                            }));+                        }+                    }+                }+            }+        }+        // DONE means the session is EMPTY and we can prove it — not that this+        // pass finished.+        done = !dialog_unreadable && after == Some(0) && close_failed.is_empty();+        // A preserve-only pass closes nothing by design, so it runs ONCE.+        // NO PROGRESS IS A STOP, NOT A LOOP: a pass that walked documents and+        // closed none will close none next time either — the commonest cause is+        // that they could not be saved, which is exactly when this verb must+        // leave them alone and say so.+        if done || walked == 0 || dialog_unreadable || closed_this_pass == 0+            || started.elapsed() >= budget+        {+            break;+        }+    }+    // AN EMPTY RESCUE FOLDER IS NOT A RESCUE. The folder is created before the+    // sweep knows whether it may run; a refusal must not leave one behind for+    // swx_recover_list to present as preserved work, or for the next reader to+    // mistake for a sweep that lost everything. `remove_dir` removes it only if+    // it is empty, so this can never delete a rescue.+    // A refusal that wrote nothing leaves no folder — and no manifest, since a+    // A refusal that wrote nothing leaves no folder — and no manifest, since a+    // manifest describing nothing is a rescue folder that looks like a rescue.+    // BUT A FAILURE IS SOMETHING TO SAY: once the record carries `failures`, a+    // sweep that preserved nothing because the host broke has the most important+    // thing to explain and no file to explain it beside, so the record is kept+    // whenever there is a failure in it.+    if recovered.is_empty() && close_failed.is_empty() {+        let _ = std::fs::remove_file(dir.join(MANIFEST_NAME));+    }+    let _ = std::fs::remove_dir(&dir);+    crate::ledger::record(+        "close_all_safely",+        json!({+            "recoveryDir": dir_s,+            "preserved": recovered.len(),+            "closed": closed,+            "reason": arg_str(args, "reason"),+            "authority": "Drew's standing authorization, 2026-09-11: the bridge closes documents \+                          itself, having first written every one of them to disk",+        }),+    );+    let remaining: Vec<Value> = recovered+        .iter()+        .filter(|r| r.get("preserved").and_then(|v| v.as_bool()) == Some(false))+        .cloned()+        .collect();+    let out = json!({+        "recoveryDir": dir_s,+        "recovered": recovered,+        "closed": closed,+        "remaining": remaining,+        "closeFailed": close_failed,+        "documentCountBefore": before,+        "documentCountAfter": after,+        "done": done && stopped_by_dialog.is_none() && !dialog_unreadable+            && stopped_by_headroom.is_none(),+        // ALWAYS REPORTED, whether or not they stopped anything: a sweep that+        // writes every open document to disk and never says how much room it had+        // is asking to be trusted about the one thing it cannot verify afterwards.+        "headroomBytesBefore": free_before,+        "estimatedWriteBytes": estimate.total,+        "estimatedFrom": json!({+            "documents": open_paths.len(),+            "measured": estimate.measured,+            "estimated": estimate.estimated,+            "largestBytes": estimate.largest,+        }),+        "stoppedByDialog": stopped_by_dialog,+        // WHY it stopped, in one word a caller can branch on.+        "stoppedBy": if stopped_by_dialog.is_some() {+            json!("dialog")+        } else if stopped_by_headroom.is_some() {+            json!("insufficientHeadroom")+        } else if dialog_unreadable {+            json!("dialogCensusUnknown")+        } else {+            Value::Null+        },+        // Whether anybody could check for a dialog while this ran. The sweep does+        // not depend on it; the report says so rather than implying a check that+        // did not happen.+        "dialogCensusReadable": !dialog_unreadable,+        "windowEtiquette": "background",+        "progress": job.finished(),+    });+    if let Some(d) = out.get("stoppedByDialog").cloned().filter(|v| !v.is_null()) {+        let mut e = err_code(+            "stopped_by_dialog",+            format!("SOLIDWORKS raised a dialog during the sweep: {d}"),+            "NOTHING was answered and the sweep stopped. A save prompt should be impossible here — \+             every document is written to disk before anything closes — so a dialog means a premise \+             is wrong, and this bridge never answers one. swx_state takes a background screenshot; \+             show the user and let them answer, then run this again.",+        );+        if let Value::Object(m) = &mut e {+            for (k, v) in out.as_object().expect("object") {+                m.entry(k.clone()).or_insert(v.clone());+            }+        }+        return e;+    }+    if let Some(h) = stopped_by_headroom.clone() {+        let free = h.get("freeBytes").and_then(|v| v.as_u64()).unwrap_or(0);+        let need = h.get("neededBytes").and_then(|v| v.as_u64()).unwrap_or(0);+        let mut e = err_code(+            "insufficient_headroom",+            format!(+                "the recovery volume has {free} free byte(s) and this sweep needs about {need} \+                 ({} estimated for the session, doubled) — it {}",+                estimate.total,+                if recovered.is_empty() {+                    "wrote NOTHING and closed NOTHING".to_string()+                } else {+                    format!(+                        "stopped after preserving {} document(s) and closed NOTHING further",+                        recovered.len()+                    )+                }+            ),+            "A recovery file can be the RIGHT document CUT SHORT, and nothing in the file would \+             show it: the container marker sits at offset 4, so any prefix carries it, and a \+             truncation past 16 KB clears the size floor too. This bridge therefore refuses to \+             write a session it cannot fit rather than close documents against files it could not \+             have checked. Free space on the recovery volume, or point `recoveryDir` at one with \+             room, and run this again — nothing was lost and nothing was closed.",+        );+        if let Value::Object(m) = &mut e {+            m.insert("stoppedByHeadroom".into(), h);+            for (k, v) in out.as_object().expect("object") {+                m.entry(k.clone()).or_insert(v.clone());+            }+        }+        return e;+    }+    if dialog_unreadable {+        let mut e = err_code(+            "dialog_census_unknown",+            format!(+                "the window census could not be read, so this bridge cannot say whether a dialog \+                 is on screen — it PRESERVED {} document(s) to the recovery folder and closed NONE \+                 of them",+                recovered.iter().filter(|r| r["preserved"] == true).count()+            ),+            "Saving loses nothing, so the saves went ahead; closing while blind does not, so no \+             document was closed. A dialog nobody can see is exactly the one that matters — this is \+             the rule swx_stop applies to the same question. The work is already safe in \+             `recoveryDir` (swx_recover_list finds it). swx_status reports whether ab is reachable; \+             run this again when it is.",+        );+        if let Value::Object(m) = &mut e {+            for (k, v) in out.as_object().expect("object") {+                m.entry(k.clone()).or_insert(v.clone());+            }+        }+        return e;+    }+    ok_merge(out, json!({+        "_hint": if done {+            "Every open document was SAVED to the recovery folder and then closed; the session is \+             empty and the count proves it. Nothing of the user's was written over: a document that \+             already had a file was saved INTO recovery — the open document then pointed there, \+             which is what made the close key right, and their original file on disk was never \+             written to. `recoveryBytes` on each record is the size actually written, so a real \+             save can be told from a file that merely appeared. swx_recover_list shows what was \+             preserved, and swx_open reopens any of it."+        } else {+            "Documents are still open. `remaining` names the ones that could NOT be written to disk \+             — those were deliberately not closed, because closing a document whose only copy is in \+             memory is the one thing this verb exists to prevent. Fix what the reason says and run \+             it again."+        },+    }))+}++/// `swx_shutdown` — preserve everything, close everything, quit. One verb,+/// because "close the documents and then quit" is one intention and splitting it+/// across two calls is how a session ends up half-closed.+///+/// IDEMPOTENT: with SOLIDWORKS not running there is nothing to do and it says so+/// rather than failing, so a caller can always finish with it.+pub fn shutdown(ctx: &Ctx, args: &Value) -> Value {+    gate!(ctx);+    if let Some(g) = require_reason(+        args,+        "swx_shutdown",+        "it saves every open document to a recovery folder, closes them, and quits SOLIDWORKS",+    ) {+        return g;+    }+    // NOTHING TO DO IS NOT A FAILURE.+    if let Ok(st) = ctx.call("status", json!({}), 20) {+        if st.get("running").and_then(|v| v.as_bool()) == Some(false) {+            return ok(json!({+                "alreadyStopped": true,+                "closed": 0,+                "recovered": [],+                "stopped": false,+                "_hint": "SOLIDWORKS is not running, so nothing was closed and nothing was quit.                           This verb is idempotent on purpose: it is the last thing a caller does,                           and the last thing should be safe to repeat.",+            }));+        }+    }+    let swept = close_all_safely(ctx, args);+    if swept.get("success").and_then(|v| v.as_bool()) != Some(true)+        || swept.get("done").and_then(|v| v.as_bool()) != Some(true)+    {+        // THE SWEEP DID NOT EMPTY THE SESSION, so the quit is not attempted: a+        // quit with documents open is the outcome swx_stop exists to refuse, and+        // reaching it through this verb would be a way round that rule.+        let mut out = swept;+        if let Value::Object(m) = &mut out {+            m.insert("stopped".into(), json!(false));+            m.insert(+                "quitSkipped".into(),+                json!("the session was not emptied, so SOLIDWORKS was not asked to quit"),+            );+        }+        return out;+    }+    let stop = ctx_stop(ctx, args);+    let mut out = swept;+    if let Value::Object(m) = &mut out {+        m.insert("stopped".into(), stop.get("stopped").cloned().unwrap_or(json!(false)));+        m.insert("quit".into(), stop);+        m.insert(+            "_hint".into(),+            json!(+                "Every open document was written to the recovery folder, then closed, then                  SOLIDWORKS was asked to quit — in that order, which is the whole safety property:                  nothing closes before it is on disk. `recovered` lists what was preserved and                  where; swx_recover_list finds it again later. On a Connected edition starting                  SOLIDWORKS again takes 1-3 minutes and may stop at a sign-in only the user can                  answer."+            ),+        );+    }+    out+}++/// The quit, under the standing authorization.+fn ctx_stop(ctx: &Ctx, args: &Value) -> Value {+    let mut a = args.clone();+    if let Value::Object(m) = &mut a {+        m.insert("userAuthorized".into(), json!(true));+        m.insert("confirm".into(), json!(true));+        m.insert("allowUserWrites".into(), json!(true));+        m.insert("force".into(), json!(true));+    }+    crate::verbs::dispatch(ctx, "swx_stop", &a)+}++/// ONE DOCUMENT A SWEEP CLOSED IN PLACE, as the listing reports it — or `None`+/// for a manifest entry that is not one.+///+/// A document that was clean and saved when a sweep reached it needed no copy:+/// its own file IS its preservation, so the sweep wrote nothing for it and closed+/// it at its own path — a file no sweep ever writes to. That leaves it with no+/// file in the recovery folder, which is exactly why it needs an entry here:+/// "where is my file?" must not come back empty for a document that is sitting,+/// untouched, at its own path. Measured live 2026-09-30: the record had nothing+/// to say about such a document at all.+///+/// "UNTOUCHED" IS MEASURED, NOT ASSUMED. The sweep recorded the file's size and+/// modification time when it closed the document; this compares them with what+/// is on disk now, and says which of the three it is — the same, changed since+/// (the user reopened and saved it, most likely), or gone from its path.+fn closed_in_place_entry(e: &Value) -> Option<Value> {+    let flagged = e.get("closedInPlace").and_then(|v| v.as_bool());+    let original = e.get("originalPath").and_then(|v| v.as_str()).unwrap_or("").to_string();+    if original.trim().is_empty() {+        return None;+    }+    // A RECORD FROM BEFORE 0.9.0 carries no flag, but the same facts identify+    // such a document: the sweep called it preserved, wrote no copy, and it had+    // a path of its own.+    let legacy_shape = flagged.is_none()+        && e.get("recoveryPath").map(|v| v.is_null()).unwrap_or(true)+        && e.get("preserved").and_then(|v| v.as_bool()) == Some(true);+    if !(flagged == Some(true) || legacy_shape) {+        return None;+    }+    let meta = std::fs::metadata(&original).ok().filter(|m| m.is_file());+    let present = meta.is_some();+    let bytes_now = meta.as_ref().map(|m| m.len());+    let modified_now = if present { crate::scratch::modified_ms(&original) } else { None };+    let bytes_then = e.get("originalBytes").and_then(|v| v.as_u64());+    let modified_then = e.get("originalModifiedMs").and_then(|v| v.as_u64());+    let differs = matches!((bytes_then, bytes_now), (Some(a), Some(b)) if a != b)+        || matches!((modified_then, modified_now), (Some(a), Some(b)) if a != b);+    let comparable = (bytes_then.is_some() && bytes_now.is_some())+        || (modified_then.is_some() && modified_now.is_some());+    // null when there is nothing to compare: no measurement then, or no file now.+    let untouched: Option<bool> = if !present {+        None+    } else if differs {+        Some(false)+    } else if comparable {+        Some(true)+    } else {+        None+    };+    // CLOSED, as the sweep recorded it. A pre-0.9.0 record computed `closed` from+    // the recovery path — which a document closed in place does not have — so it+    // always said false; that is not evidence, and it is reported as unknown.+    let closed = if flagged == Some(true) {+        e.get("closed").and_then(|v| v.as_bool())+    } else {+        None+    };+    let closed_words = match closed {+        Some(true) => format!("it was closed at its own path, {original}"),+        Some(false) => format!(+            "this record does NOT show it closed — it may still be open in SOLIDWORKS, at \+             its own path, {original}"+        ),+        None => format!(+            "its own path is {original} (this record was written by a bridge older than 0.9.0, \+             which did not record whether a document it closed in place was closed)"+        ),+    };+    let file_words = match (present, untouched) {+        (false, _) => format!(+            "NOTHING IS AT {original} NOW: something moved or deleted that file after the sweep. \+             The sweep never writes to a document's own file and, since the document was clean, \+             kept no copy of it — there is none in this folder."+        ),+        (true, Some(true)) => format!(+            "The file is exactly as the sweep found it ({} byte(s)): untouched. Open it from \+             there with swx_open.",+            bytes_now.unwrap_or(0)+        ),+        (true, Some(false)) => format!(+            "The file HAS CHANGED since the sweep ({}). The sweep never writes to a document's \+             own file, so something else saved it afterwards — most often SOLIDWORKS, after the \+             document was reopened. Open it from there with swx_open.",+            match (bytes_then, bytes_now) {+                (Some(a), Some(b)) if a != b => format!("{a} byte(s) then, {b} now"),+                _ => "its modification time is later than the one recorded".to_string(),+            }+        ),+        (true, None) => "The sweep did not measure the file when it closed the document, so this \+                         bridge cannot say whether it has changed since; the sweep itself never \+                         writes to a document's own file. Open it from there with swx_open."+            .to_string(),+    };+    let headline = match (present, untouched, closed) {+        (false, _, _) => "NOT AT ITS PATH NOW.",+        (true, Some(true), Some(true)) => "CLOSED IN PLACE, UNTOUCHED.",+        (true, Some(false), _) => "AT ITS OWN PATH, CHANGED SINCE.",+        _ => "AT ITS OWN PATH.",+    };+    Some(json!({+        "closedInPlace": true,+        "source": "manifest",+        "title": e.get("title").cloned().unwrap_or(Value::Null),+        "originalPath": original,+        "kind": e.get("kind").cloned().unwrap_or(Value::Null),+        // No copy exists, by design: the document's own file was its preservation.+        "recoveryPath": Value::Null,+        "closed": closed,+        "present": present,+        "originalBytes": bytes_then,+        "originalModifiedMs": modified_then,+        "bytesNow": bytes_now,+        "modifiedMsNow": modified_now,+        "untouched": untouched,+        "howToOpen": format!(+            "{headline} This document was clean and saved when the sweep reached it, so no copy \+             was needed: {closed_words}. {file_words}"+        ),+    }))+}++/// `swx_recover_list` — what was preserved, and where. Read-only.+pub fn recover_list(ctx: &Ctx, _args: &Value) -> Value {+    let _ = ctx;+    let root = crate::scratch::root().join("recovery");+    // THE LEGACY LOCATION TOO. Until 0.9.0 recovery folders were written into+    // ab's install cache, which an update re-extracts. Anything still there is+    // migrated on start — but a rescue written by an older bridge that has not+    // migrated yet, or one whose copy failed verification, exists ONLY there,+    // and a listing that did not look would tell the user their work was gone+    // while it was sitting one directory over.+    let legacy = crate::scratch::legacy_root()+        .map(|l| l.join("recovery"))+        .filter(|l| l != &root);+    let mut sweeps: Vec<Value> = Vec::new();+    let mut dirs: Vec<(std::path::PathBuf, &'static str)> = Vec::new();+    for (base, location) in [(Some(root.clone()), "data"), (legacy.clone(), "legacyInstallCache")] {+        let Some(base) = base else { continue };+        if let Ok(entries) = std::fs::read_dir(&base) {+            dirs.extend(+                entries.flatten().map(|e| e.path()).filter(|p| p.is_dir()).map(|p| (p, location)),+            );+        }+    }+    // Newest first, across both locations.+    dirs.sort_by(|a, b| b.0.file_name().cmp(&a.0.file_name()));+    {+        for (d, location) in dirs {+            let mut files: Vec<Value> = Vec::new();+            // THE SWEEP'S OWN RECORD, IF IT LEFT ONE. Re-deriving a verdict from+            // the file alone cannot see the two facts that decide the hard cases:+            // what the original document weighed, and whether the extension was a+            // GUESS. Both were known at save time. A manifest carries them; where+            // there is none, this says so rather than presenting a weaker check as+            // the same answer.+            let manifest: Option<Value> = std::fs::read_to_string(d.join(MANIFEST_NAME))+                .ok()+                .and_then(|t| serde_json::from_str::<Value>(&t).ok())+                // A SHAPE CHECK IS NOT A VERSION CHECK. `files` being an array+                // says nothing about what its entries mean; a future manifest+                // with different field semantics would be read as this one.+                .filter(|m| {+                    m.get("files").map(|f| f.is_array()).unwrap_or(false)+                        && m.get("manifestVersion").and_then(|v| v.as_u64()) == Some(1)+                });+            let entries: Vec<Value> = manifest+                .as_ref()+                .and_then(|m| m.get("files").and_then(|f| f.as_array()).cloned())+                .unwrap_or_default();+            if let Ok(fs) = std::fs::read_dir(&d) {+                for f in fs.flatten() {+                    let p = f.path();+                    if !p.is_file() {+                        continue;+                    }+                    let name = p+                        .file_name()+                        .map(|n| n.to_string_lossy().to_string())+                        .unwrap_or_default();+                    // The record is not one of the rescues.+                    if name == MANIFEST_NAME || name == "manifest.json.tmp" {+                        continue;+                    }+                    let bytes = f.metadata().ok().map(|m| m.len());+                    // A MIGRATION'S HALF-COPIED TEMPORARY (see `migrate_legacy`):+                    // incomplete by definition, so it is never a rescue — but it+                    // is not hidden either. It only survives a later start when+                    // the original it was copying is gone from ab's install cache,+                    // and then these may be the only bytes of that file left.+                    if let Some(real) = name.strip_suffix(".migrating") {+                        let original = if location == "data" {+                            legacy+                                .as_ref()+                                .zip(d.file_name())+                                .map(|(l, sweep)| l.join(sweep).join(real))+                                .filter(|o| o.is_file())+                        } else {+                            None+                        };+                        files.push(json!({+                            "path": p.to_string_lossy(),+                            "name": name,+                            "bytes": bytes,+                            "source": "migration",+                            "partialCopy": true,+                            "copyOf": real,+                            "legacyPath": original.as_ref().map(|o| json!(o.to_string_lossy())).unwrap_or(Value::Null),+                            "verified": false,+                            "verifiedReason": "an interrupted migration's temporary file: incomplete by \+                                               definition",+                            "howToOpen": match &original {+                                Some(o) => format!(+                                    "INTERRUPTED COPY of {real}: these bytes are incomplete. The \+                                     original is still at {}, in ab's install cache, and the \+                                     bridge copies it again on its next start.",+                                    o.display()+                                ),+                                None => format!(+                                    "PARTIAL COPY of {real}: a migration out of ab's install cache \+                                     was interrupted while copying it, and the original is no longer \+                                     there. These bytes are INCOMPLETE — SOLIDWORKS is unlikely to \+                                     open them — and are kept only because they may be the only \+                                     bytes of that file left."+                                ),+                            },+                        }));+                        continue;+                    }+                    let entry = entries.iter().find(|e| {+                        e.get("name").and_then(|v| v.as_str()).map(|n| n == name).unwrap_or(false)+                    });+                    files.push(match entry {+                        // ── THE SWEEP DECIDED THIS, and it knew things this verb+                        //    cannot re-derive. Report what it decided.+                        Some(e) => {+                            // THE VERDICT IS ABOUT BYTES, NOT ABOUT A NAME.+                            //+                            // The manifest records the size the sweep verified,+                            // and this verb has just read the size on disk. If+                            // they differ, the file CHANGED after the sweep — a+                            // disk that filled, an anti-virus quarantine, a sync+                            // client rewriting it — and the sweep's verdict is+                            // about bytes that are no longer there. Reporting it+                            // anyway is the worst version of this defect:+                            // `verified:true` in a manifest means the DOCUMENT+                            // WAS CLOSED, so this file is the only copy of that+                            // work and the user would be told it is intact. A+                            // vanished file is already `present:false`; an+                            // emptied one is the same event, and takes the same+                            // answer the reverified path gives — UNKNOWN.+                            // AN ENTRY THAT CANNOT BE BOUND TO THESE BYTES IS+                            // UNKNOWN, not "unchanged". `_ => false` read a+                            // MISSING or null `recoveryBytes` as agreement, so a+                            // manifest verdict was handed to a 900-byte file it+                            // was never about — and `verified:true` in a manifest+                            // means the document was CLOSED, so that file is the+                            // only copy of the work. Unbindable takes the same+                            // answer the reverified path gives.+                            let recorded = e.get("recoveryBytes").and_then(|v| v.as_u64());+                            enum Binding {+                                Same,+                                Changed,+                                Unbindable,+                            }+                            let binding = match (recorded, bytes) {+                                (Some(was), Some(now)) if was == now => Binding::Same,+                                (Some(_), Some(_)) => Binding::Changed,+                                // Either the record does not say what it verified,+                                // or this file's size cannot be read now.+                                _ => Binding::Unbindable,+                            };+                            let changed = matches!(binding, Binding::Changed);+                            let verified = match binding {+                                Binding::Same => {+                                    Some(e.get("verified").and_then(|v| v.as_bool()).unwrap_or(false))+                                }+                                _ => None,+                            };+                            let reason = if matches!(binding, Binding::Unbindable) {+                                format!(+                                    "this record cannot be tied to these bytes: it {} and the file \+                                     {}. A verdict about bytes nobody can match to this file is \+                                     not a verdict about this file.",+                                    match recorded {+                                        Some(n) => format!("verified {n} byte(s)"),+                                        None => "does not say how many bytes it verified".into(),+                                    },+                                    match bytes {+                                        Some(n) => format!("holds {n}"),+                                        None => "cannot be measured now".into(),+                                    }+                                )+                            } else if changed {+                                format!(+                                    "the file changed since the sweep: it verified {} byte(s) and \+                                     holds {} now. Whatever the sweep decided was about bytes that \+                                     are no longer there, so this bridge cannot vouch for what is.",+                                    recorded.unwrap_or(0),+                                    bytes.unwrap_or(0)+                                )+                            } else {+                                e.get("verdictReason")+                                    .and_then(|v| v.as_str())+                                    .unwrap_or("")+                                    .to_string()+                            };+                            let fallback = e+                                .get("namingFallback")+                                .and_then(|v| v.as_str())+                                .map(|x| x.to_string());+                            let kind_known = e.get("kind").map(|k| !k.is_null()).unwrap_or(false);+                            json!({+                                "path": p.to_string_lossy(),+                                "name": name,+                                "bytes": bytes,+                                "source": "manifest",+                                "title": e.get("title").cloned().unwrap_or(Value::Null),+                                "originalPath": e.get("originalPath").cloned().unwrap_or(Value::Null),+                                "kind": e.get("kind").cloned().unwrap_or(Value::Null),+                                "kindKnown": kind_known,+                                // THE NAME WAS A GUESS, and no file name can say so.+                                "namingFallback": fallback,+                                "originalBytes": e.get("originalBytes").cloned().unwrap_or(Value::Null),+                                "signatureOk": e.get("signatureOk").cloned().unwrap_or(Value::Null),+                                "closed": e.get("closed").cloned().unwrap_or(Value::Null),+                                "verified": verified,+                                "recoveryBytes": recorded,+                                "changedSinceSweep": changed,+                                "verifiedReason": if reason.is_empty() { Value::Null } else { json!(reason) },+                                "howToOpen": match verified {+                                    Some(v) => how_to_open(v, kind_known, &reason, fallback.is_some()),+                                    // CHANGED UNDERNEATH THE RECORD. Not a+                                    // refusal by the sweep, and not a rescue this+                                    // bridge can stand behind.+                                    None => format!(+                                        "UNCONFIRMED. {reason} The document this came from was \+                                         closed against the file as it WAS, so treat these bytes \+                                         as the only copy and check them before relying on them: \+                                         try swx_open (renaming a `.sldrecover` file first), and \+                                         if SOLIDWORKS refuses it, the work is gone from here."+                                    ),+                                },+                            })+                        }+                        // ── NO RECORD FOR THIS FILE. Verify what can be verified+                        //    and be explicit that it is less.+                        None => {+                            let kind = crate::disk::DocKind::from_extension(&name);+                            let v = crate::comhost::host::recovery_file_verdict(+                                &p.to_string_lossy(),+                                kind,+                                None,+                            );+                            reverified_entry(&p, &name, bytes, kind, &v)+                        }+                    });+                }+            }+            // A FILE THE SWEEP WROTE THAT IS NO LONGER THERE. Somebody moved or+            // deleted it; saying nothing would let a rescue disappear silently.+            for e in &entries {+                let name = e.get("name").and_then(|v| v.as_str()).unwrap_or("").to_string();+                // Listed already — under its own name, or as the partial copy an+                // interrupted migration left, which explains itself.+                if name.is_empty()+                    || files.iter().any(|f| f["name"] == json!(name) || f["copyOf"] == json!(name))+                {+                    continue;+                }+                // NOT GONE — NOT COPIED YET. A sweep migrated from ab's install+                // cache carries its manifest into the data root even when one of+                // its files did not copy (the copy failed verification, or the+                // start that was copying it died). That file is still in the old+                // location, and calling it deleted would tell the user their work+                // was lost while it sits one directory over, waiting for the next+                // update to take it.+                let at_legacy = if location == "data" {+                    legacy+                        .as_ref()+                        .zip(d.file_name())+                        .map(|(l, sweep)| l.join(sweep).join(&name))+                        .filter(|p| p.is_file())+                } else {+                    None+                };+                if let Some(original) = at_legacy {+                    files.push(json!({+                        "path": Value::Null,+                        "name": name,+                        "bytes": Value::Null,+                        "source": "manifest",+                        "present": false,+                        "notCopiedYet": true,+                        "legacyPath": original.to_string_lossy(),+                        "title": e.get("title").cloned().unwrap_or(Value::Null),+                        "verified": Value::Null,+                        "verifiedReason": "this file has not been copied out of ab's install cache \+                                           yet — its copy failed verification or was interrupted — \+                                           so the only copy is at `legacyPath`",+                        "howToOpen": format!(+                            "NOT COPIED YET. The only copy of this file is still in ab's install \+                             cache, at {}, which the next update of the bridge DELETES. The bridge \+                             retries the copy on its next start; if this file matters, copy it out \+                             of that folder now.",+                            original.display()+                        ),+                    }));+                    continue;+                }+                files.push(json!({+                    "path": e.get("recoveryPath").cloned().unwrap_or(Value::Null),+                    "name": name,+                    "bytes": Value::Null,+                    "source": "manifest",+                    "present": false,+                    "title": e.get("title").cloned().unwrap_or(Value::Null),+                    "verified": false,+                    "verifiedReason": "the sweep wrote this file and it is no longer in the \+                                       recovery folder",+                    "howToOpen": "GONE. This bridge wrote this file during a sweep and it is not \+                                  there now — it was moved or deleted by something else. If the \+                                  document it came from was closed, these were its only bytes.",+                }));+            }+            files.sort_by_key(|f| f.get("name").and_then(|n| n.as_str()).unwrap_or("").to_string());+            // DOCUMENTS CLOSED AT THEIR OWN PATHS: no file here, by design, and+            // listed anyway — see `closed_in_place_entry`.+            let in_place: Vec<Value> = entries.iter().filter_map(|e| closed_in_place_entry(e)).collect();+            let endangered = location == "legacyInstallCache";+            // ALREADY COPIED OUT? The migration leaves the originals where they+            // were, so after it runs the same sweep is listed twice — and the two+            // must not read the same. A legacy sweep whose every file has a+            // same-sized counterpart under the data root says where that copy is;+            // one that does not is the only copy there is, and says THAT.+            let copied_to: Option<std::path::PathBuf> = if endangered {+                d.file_name().map(|n| root.join(n)).filter(|twin| {+                    twin.is_dir()+                        && std::fs::read_dir(&d)+                            .map(|rd| {+                                rd.flatten().filter(|e| e.path().is_file()).all(|e| {+                                    let theirs = e.metadata().ok().map(|m| m.len());+                                    let ours = std::fs::metadata(twin.join(e.file_name()))+                                        .ok()+                                        .filter(|m| m.is_file())+                                        .map(|m| m.len());+                                    theirs.is_some() && theirs == ours+                                })+                            })+                            .unwrap_or(false)+                })+            } else {+                None+            };+            sweeps.push(json!({+                "sweep": d.file_name().map(|n| n.to_string_lossy().to_string()),+                "directory": d.to_string_lossy(),+                // WHERE IT LIVES, because one of the two places is deleted by the+                // next update.+                "location": location,+                "atRiskFromUpdate": endangered,+                "copiedTo": copied_to.as_ref().map(|c| json!(c.to_string_lossy())).unwrap_or(Value::Null),+                "warning": match (endangered, &copied_to) {+                    (false, _) => Value::Null,+                    (true, Some(c)) => json!(format!(+                        "This is the ORIGINAL of a rescue written by a bridge older than 0.9.0, \+                         left in ab's install cache — which the next update empties. Every file \+                         in it has a copy in the data root, at {}: use that one.",+                        c.display()+                    )),+                    (true, None) => json!(+                        "This rescue is in ab's INSTALL CACHE, which is re-extracted — and \+                         emptied — whenever the bridge updates, and there is NO copy of it in the \+                         data root. It was written by a bridge older than 0.9.0. Copy anything \+                         you need out of it now; the bridge retries the migration on its next \+                         start and never deletes the original."+                    ),+                },+                "files": files,+                "closedInPlace": in_place,+            }));+        }+    }+    ok(json!({+        "recoveryRoot": root.to_string_lossy(),+        "legacyRecoveryRoot": legacy.as_ref().map(|l| json!(l.to_string_lossy())).unwrap_or(Value::Null),+        "sweeps": sweeps,+        // THE PER-FILE INSTRUCTION IS THE ONE TO FOLLOW. A blanket "reopen with+        // swx_open" was wrong for every .sldrecover file in the list, so the+        // general hint now points at the specific one rather than competing with+        // it.+        // WHAT IS IN HERE IS NOT ALL RESCUED WORK, and the headline must not+        // say it is. A sweep that preserved NOTHING still leaves files behind.+        "_hint": "Newest sweep first. **Files marked `verified:false` are NOT complete documents** \+                  — the sweep refused to close against them and left the document OPEN, so that \+                  work is still in SOLIDWORKS rather than here; their bytes are kept only because \+                  they are the only ones there are. A file marked `verified:true` was written and \+                  checked before its document was closed. Follow each file's own `howToOpen` \+                  rather than assuming swx_open works: a verified file whose kind could not be \+                  established is named `.sldrecover`, and SOLIDWORKS will not open it until it is \+                  renamed. Nothing in here is deleted by this bridge except by swx_uninstall — a \+                  verified recovery file is the user's only copy of work they had not saved. A \+                  document that was clean and saved needed no copy, so it has no file here: it is \+                  listed under its sweep's `closedInPlace`, closed at its own path — a file no \+                  sweep writes to — with whether that file is still untouched.",+    }))+}+ /// `swx_close_all_documents` — destructive, so it is confirm-gated. pub fn close_all_documents(ctx: &Ctx, args: &Value) -> Value {     gate!(ctx);@@ -494,6 +1933,9 @@ pub fn close_all_documents(ctx: &Ctx, args: &Value) -> Value {                     "bridgeCreated": owned,                     "errorCode": e.code,                     "why": e.message,+                    "detail": e.detail,+                    // The structured COM failure, where the host had one.+                    "hostError": e.data.clone().unwrap_or(Value::Null),                 })),             }         }@@ -1009,8 +2451,9 @@ pub fn close_import_temps(ctx: &Ctx, args: &Value) -> Value {             format!(                 "{} document(s) this bridge created are still open and CANNOT BE NAMED: they have \                  no path, and another open document shares each one's title, so no SOLIDWORKS API \-                 call can say which is meant. Nothing was attempted on them. Ask the user to close \-                 them in SOLIDWORKS (File > Close), or close every document and start again. This \+                 call can say which is meant. Nothing was attempted on them. Run \+                 swx_close_all_safely, which preserves every document to a recovery folder and \+                 verifies it before closing — it needs no name, because it closes everything. This \                  cannot happen to documents created by 0.6.0 or later, which are given a file of \                  their own at birth — see `documentIdentity` on swx_import and swx_new_document.",                 unaddressable.len()@@ -1041,7 +2484,9 @@ pub fn close_import_temps(ctx: &Ctx, args: &Value) -> Value {                  directory is the whole proof that a document is transient rather than the user's, \                  and the close does not prompt. To drain them, find the directory in \                  `importTempsElsewhereSample` and restart the bridge with SWX_TEMP_ROOT set to the \-                 temp directory above the swx<pid> folder — or ask the user to close them in \+                 temp directory above the swx<pid> folder — or close them with \+                 swx_close_all_safely, which preserves every document to recovery first and never \+                 needs anybody to close anything by hand \                  SOLIDWORKS. swx_docs reports the count.",                 match &temp_roots {                     Value::Array(a) if !a.is_empty() => a@@ -1223,7 +2668,12 @@ pub fn reset_workspace(ctx: &Ctx, args: &Value) -> Value {                 ctx.forget_scratch(&title);                 closed.push(title);             }-            Err(e) => skipped.push(json!({"title": title, "why": e.message})),+            Err(e) => skipped.push(json!({+                "title": title,+                "why": e.message,+                "detail": e.detail,+                "hostError": e.data.clone().unwrap_or(Value::Null),+            })),         }     }     // NULL, NOT `[]`, when the read failed or came back truncated. An empty@@ -2112,7 +3562,8 @@ fn reconcile_after_timeout(                 "the call timed out and {n} new unsaved documents matching '{stem}' are open — \                  this bridge will NOT guess which (if any) is the one its call created, so it \                  claims none of them. They may be unaddressable (same title, no path); ask the \-                 user to close them in SOLIDWORKS."+                 them with swx_close_all_safely, which writes every document to a recovery \+                 folder and verifies it before closing. Never ask the user to close documents."             ),         })),     }@@ -2137,11 +3588,42 @@ pub fn import(ctx: &Ctx, args: &Value) -> Value {     let before_docs = ownership_context(ctx).1;     let before_titles: Vec<String> = before_docs.iter().map(doc_title).collect();     let before_count = Some(before_docs.len() as u64);-    match ctx.call("import", json!({"filePath": path}), 280) {+    let mut host_args = json!({"filePath": path});+    if args.get("dissolve").and_then(|v| v.as_bool()).unwrap_or(false) {+        host_args["dissolve"] = json!(true);+    }+    // THE MEASUREMENT SURFACE, forwarded verbatim. These exist so the live+    // application can be asked which invocation actually imports a STEP on this+    // edition — nothing here interprets them, and `auto` is the default.+    for k in ["route", "openOptions", "docType", "withImportData", "argString"] {+        if let Some(v) = args.get(k) {+            host_args[k] = v.clone();+        }+    }+    match ctx.call("import", host_args, 280) {         Err(e) if e.timed_out => {             let stem = crate::comhost::mock::base_name(&path);             let stem = stem.rsplit_once('.').map(|(a, _)| a).unwrap_or(&stem).to_string();             let mut out = sidecar_error(e);+            // WHY DID IT STOP ANSWERING? On this install `swImportAutoRunImport-+            // Diagnostics` is ON (measured 2026-09-17), so a STEP with faulty+            // faces raises a MODAL Import Diagnostics dialog mid-import and the+            // COM call never returns. That is a dialog, not a hang, and the two+            // call for opposite responses from a caller — so it is NAMED. It is+            // never answered: the choice it offers changes the geometry the user+            // gets.+            if let Some(Some(d)) = blocking_dialog_now(ctx) {+                if let Value::Object(m) = &mut out {+                    m.insert("stoppedByDialog".into(), d.clone());+                    m.insert("stoppedBy".into(), json!("dialog"));+                    m.insert(+                        "_hint".into(),+                        json!(format!(+                            "SOLIDWORKS is showing a dialog and the import is waiting behind it:                              {d}. This bridge NEVER answers one — Import Diagnostics in particular                              offers to heal faulty faces, which changes the geometry you get, and                              that is the user's decision. swx_state takes a background screenshot;                              show the user and let them answer, then run swx_docs to see what                              ended up open."+                        )),+                    );+                }+            }             if let Some(rec) = reconcile_after_timeout(ctx, &stem, &before_titles, before_count) {                 if let Value::Object(m) = &mut out {                     m.insert("reconciliation".into(), rec);@@ -2220,18 +3702,40 @@ pub fn import(ctx: &Ctx, args: &Value) -> Value {                     }                 }             }+            // A LINKED IMPORT IS A DIFFERENT THING AND MUST SAY SO FIRST. With+            // 3D Interconnect on — the user's setting, which this bridge reads+            // and never changes — the file was OPENED as a part holding a link+            // back to it, not translated into one. A caller told only "imported"+            // would be wrong about what moving or deleting the source file does.+            let linked = r.get("linked").and_then(|v| v.as_bool()).unwrap_or(false);+            let source = r.get("sourcePath").and_then(|v| v.as_str()).unwrap_or("the source file");+            let base = "It is a NEW open document, exactly like swx_new_document — it stays open \+                        and holds memory until you save it (swx_save_as) or close it \+                        (swx_close_doc). Importing repeatedly without closing is what leaks \+                        documents; swx_close_import_temps drains any left behind. \+                        `documentsOpened`/`netCountOk` report that exactly one document was \+                        added. swx_inspect_bodies tells you what actually arrived.";+            let hint = if linked {+                format!(+                    "OPENED AS A LINKED PART. This user's SOLIDWORKS has 3D Interconnect ON, so a \+                     neutral file is not translated — it is opened as a part holding a linked \+                     feature that points at {source}. The part is NOT self-contained: moving, \+                     editing or deleting the source file changes it. This bridge reads that \+                     preference and never changes it; `dissolve:true` is refused until the \+                     link-breaking API is measured on this install. {base}"+                )+            } else {+                format!(+                    "Imported by the translator (3D Interconnect is off), so the result is \+                     self-contained. {base} Which formats work depends on the install's \+                     translators — an unsupported one is a clear refusal, not a dialog."+                )+            };             ok_merge(r, json!({                 "documentIdentity": identity,                 "windowEtiquette": "background",                 "progress": job.finished(),-                "_hint": "Imported as a NEW open document, exactly like \-                          swx_new_document — it stays open and holds memory until you save it \-                          (swx_save_as) or close it (swx_close_doc). Importing repeatedly \-                          without closing is what leaks documents; swx_close_import_temps drains \-                          any left behind. `documentsOpened`/`netCountOk` report that exactly one \-                          document was added. Which formats work depends on the install's \-                          translators — an unsupported one is a clear refusal, not a dialog; \-                          swx_inspect_bodies tells you what actually arrived.",+                "_hint": hint,             }))         }     }

@@ -0,0 +1,180 @@+//! ADVERSARIAL REVIEW OF 0.7.0 — pass twenty-two, the data-loss surface.+//!+//! The gates around the sweep are sound. `done = count_after == Some(0) &&+//! failed.is_empty()`, so a document that could not be saved is never closed,+//! keeps the count above zero, and forces `done:false`; an UNREADABLE count is+//! not `Some(0)` either. `swx_shutdown` attempts the quit only on+//! `success && done`, and `swx_stop`'s own `check_preconditions` is a second,+//! independent gate that refuses on a truncated count and on any dialog. Two+//! gates, neither derived from the other — that is the right shape for this.+//!+//! The saving itself is where the risk is.++mod common;++use common::{Bridge, TempDir};+use serde_json::{json, Value};++fn s(v: &Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++/// THE RECOVERY WRITE IS VERIFIED BY EXISTENCE, NOT BY SIZE.+///+/// ```text+/// let on_disk = code == 0+///     && !now_path.trim().is_empty()+///     && std::path::Path::new(&now_path).exists();+/// ```+///+/// A file that exists and is EMPTY passes, the record says `preserved: true`,+/// and the document is then closed — discarding the only copy of the user's+/// unsaved work. A partial or zero-byte write is not a hypothetical here: the+/// machine this verb is meant to run on is down to single-digit gigabytes, and+/// SOLIDWORKS assemblies are large.+///+/// The idiom already exists in this file — `std::fs::metadata(out).map(|m| m.len())`+/// is computed for the export path — so the fix is to carry it here, refuse a+/// zero-length result, and REPORT the size so an operator can tell a real save+/// from an empty one.+///+/// I could not stage the partial write: the mock writes a fixed non-empty+/// string and its own check is `fs::write(..).is_err()`, which is STRONGER than+/// the real backend's. So this test asks for the reportable half — the size of+/// what was written — which is the minimum that makes the outcome auditable and+/// is a precondition for checking it at all.+#[test]+fn every_recovery_record_reports_the_size_it_wrote() {+    let b = Bridge::start_with(&[("SWX_ALLOW_USER_WRITES", "1")]);+    b.call("swx_start", json!({"reason": "preparing to close everything"}));+    let made = b.call("swx_new_document", json!({"type": "part", "keepUnsaved": true}));+    assert!(made["success"] == true, "precondition: a dirty pathless document exists: {}", s(&made));++    let r = b.call(+        "swx_close_all_safely",+        json!({"reason": "closing everything safely before a quit", "userAuthorized": true}),+    );+    let recs = r["recovered"]+        .as_array()+        .cloned()+        .or_else(|| r["records"].as_array().cloned())+        .unwrap_or_default();+    assert!(+        !recs.is_empty(),+        "precondition: the sweep preserved at least one document: {}",+        s(&r)+    );+    let preserved: Vec<&Value> = recs+        .iter()+        .filter(|x| x.get("preserved").and_then(|p| p.as_bool()) == Some(true))+        .collect();+    assert!(!preserved.is_empty(), "precondition: something was preserved: {}", s(&r));+    for rec in preserved {+        let has_size = rec.get("bytes").and_then(|v| v.as_u64()).is_some()+            || rec.get("recoveryBytes").and_then(|v| v.as_u64()).is_some()+            || rec.get("size").and_then(|v| v.as_u64()).is_some();+        assert!(+            has_size,+            "a record says preserved:true and does not say how many bytes reached disk. The \+             check behind it is `Path::exists()`, so a zero-byte file — an interrupted write on a \+             nearly-full disk — passes it, and the document is then CLOSED. Size is the only \+             thing that distinguishes a save from a file that merely appeared.\nrecord: {}\n{}",+            s(rec),+            s(&r)+        );+    }+}++/// THE USER'S OWN FILE IS NEVER TOUCHED — the invariant Drew actually stated.+///+/// A dirty document that already has a path is written into the recovery folder+/// under a new name; the file the user knows about must be byte-for-byte what it+/// was. This passes, and it is here because it is the one property that must+/// never regress on this surface.+///+/// Worth recording alongside it: `save_as3(doc, out, copy=false)` resolves to+/// `options = 1`, which is `swSaveAsOptions_Silent` ALONE — not Copy, which is+/// 2. The module header describes this call as "silent, copy-mode", and that is+/// wrong. The effect is a RE-POINT: the open document becomes the recovery file.+/// Nothing is overwritten, so the invariant holds — but the sweep then reads+/// `GetPathName` AFTER the save to get its close key, and that is correct only+/// BECAUSE it re-points. If someone later makes the flag match the comment and+/// passes Copy, `GetPathName` would still return the USER'S ORIGINAL path and+/// the close would be aimed at their file. The comment and the code must be made+/// to agree, in that direction.+#[test]+fn a_users_saved_file_is_byte_for_byte_unchanged_by_the_sweep() {+    let work = TempDir::new("adv21-userwork");+    let users_file = work.join("Bracket.SLDPRT");+    let original = b"the user's own work, saved last Tuesday";+    std::fs::write(&users_file, original).unwrap();+    let before = std::fs::read(&users_file).unwrap();++    let b = Bridge::start_with(&[("SWX_ALLOW_USER_WRITES", "1")]);+    b.call("swx_start", json!({"reason": "preparing"}));+    b.call(+        "swx_open",+        json!({"path": users_file.to_string_lossy(), "reason": "the user had this open"}),+    );+    b.call(+        "swx_close_all_safely",+        json!({"reason": "closing everything safely before a quit", "userAuthorized": true}),+    );++    let after = std::fs::read(&users_file).unwrap_or_default();+    assert_eq!(+        after, before,+        "the sweep modified a file the USER owns at {}. A dirty saved document must be written \+         into recovery under a new name; the file they know about is never the destination.",+        users_file.display()+    );+    assert!(+        !after.is_empty(),+        "the user's file at {} is now empty",+        users_file.display()+    );+}++/// "ANY DIALOG STOPS THE SWEEP" — BUT AN UNREADABLE CENSUS DOES NOT.+///+/// The sweep reports `dialogCensusReadable: false` and `stoppedByDialog: null`,+/// and proceeds to close every document anyway. So the rule is really "any+/// dialog I could SEE stops the sweep", and when the desktop cannot be+/// enumerated the sweep runs blind.+///+/// Everywhere else in this bridge an unreadable precondition refuses — the quit+/// ladder's P3 does exactly that ("the window census could not be taken... a+/// quit sent at a modal is a different act"). This is the same act, on the same+/// desktop, one verb earlier, and it is the verb that CLOSES things. A "Save+/// changes to Part1?" raised mid-sweep by SOLIDWORKS itself is precisely what+/// would be missed.+///+/// The recovery save runs first, so this is not by itself a loss of data — it is+/// the loss of the guard that was claimed. On the live session it also means the+/// sweep cannot notice the one dialog it most needs to.+#[test]+fn the_sweep_does_not_close_documents_with_the_dialog_census_unreadable() {+    let b = Bridge::start_with(&[("SWX_ALLOW_USER_WRITES", "1")]);+    b.call("swx_start", json!({"reason": "preparing"}));+    b.call("swx_new_document", json!({"type": "part", "keepUnsaved": true}));++    let r = b.call(+        "swx_close_all_safely",+        json!({"reason": "closing everything safely before a quit", "userAuthorized": true}),+    );+    let readable = r["dialogCensusReadable"].as_bool();+    if readable != Some(false) {+        return; // the census was readable; nothing to prove here.+    }+    assert_eq!(+        r["closed"].as_u64().unwrap_or(0),+        0,+        "the dialog census could not be read (dialogCensusReadable:false) and the sweep closed {} \+         document(s) anyway. The verb's own contract is that any dialog stops it; with the \+         desktop unreadable it cannot know whether one is up. The quit ladder refuses this exact \+         unknown one verb later — this is the same act on the same desktop, and it is the one \+         that does the closing.\n{}",+        r["closed"],+        s(&r)+    );+}

@@ -0,0 +1,93 @@+//! ADVERSARIAL REVIEW OF 0.7.2 — pass twenty-four.+//!+//! MY PASS-23 RECOMMENDATION WAS WRONG. I proposed verifying the OLE compound+//! file signature `D0 CF 11 E0 A1 B1 1A E1` at offset 0 from general knowledge+//! of the format, without measuring a single file. I re-measured every+//! SOLIDWORKS document in this container and **0 of 166 carry it**. Shipped as+//! specified it would have made `recovery_file_verdict` refuse every file, so+//! every document would have been preserved and never closed — a silently inert+//! feature, and a mock written on the same premise would have agreed with it.+//! The lesson is the one this project keeps relearning: a check about somebody+//! else's format is a measurement, not a recollection.+//!+//! What I measured, independently, over all 166 `.SLDPRT`/`.SLDASM`/`.SLDDRW`+//! files in this container (three repos, 29 KB - 37 MB, parts, assemblies and+//! drawings):+//!+//! ```text+//! CFBF magic at offset 0          0 / 166+//! 00 00 00 04 at offset 4       166 / 166+//! bytes 0..4                      per-file, varying (no constant)+//! any other constant 4-byte+//!   window in the first 64 B      NONE — 34 to 112 distinct values at every+//!                                 offset from 8 to 60+//! constant tail (last 4 or 8 B)   NONE — per-file+//! head word echoed at the tail    NO (checked byte-order-reversed too)+//! ```+//!+//! So the marker 0.7.2 ships is the strongest one available from the evidence,+//! and there is no cheap structural integrity check in this format at all.++use swx_bridge::comhost::host::{MIN_RECOVERY_BYTES, SWDOC_FORMAT_MARKER};++/// The marker is what I measured, at the offset I measured it.+///+/// Pinned so it cannot drift back to something recalled rather than measured —+/// which is exactly how the CFBF proposal got as far as a recommendation.+#[test]+fn the_format_marker_is_the_one_measured_on_real_documents() {+    assert_eq!(+        SWDOC_FORMAT_MARKER,+        [0x00, 0x00, 0x00, 0x04],+        "the marker must stay the value measured on 166/166 real SOLIDWORKS documents at offset 4"+    );+    assert!(+        MIN_RECOVERY_BYTES >= 16 * 1024,+        "the floor must stay at or above 16 KB — the smallest real document measured here is \+         29,130 bytes"+    );+}++/// WHAT THE MARKER CANNOT DO, stated so nobody mistakes it for an integrity check.+///+/// The marker sits at offset 4, so **any prefix of a real file longer than eight+/// bytes carries it**. A truncated write that reaches 20 KB of a 500 KB assembly+/// passes the marker AND the 16 KB floor, is recorded `preserved: true`, and the+/// document is closed against it. Marker and floor together catch "empty" and+/// "not a SOLIDWORKS file"; neither catches "the right file, cut short", and the+/// measurements above say the format offers nothing cheap that would — no+/// constant tail, no length field, no head/tail relationship.+///+/// The remaining defence is therefore not in the file, it is in the decision to+/// start: this sweep writes every open document to disk, and it should refuse to+/// begin when the volume has less free space than the session it is about to+/// write. The container this is being developed in has been between 7 and 25 GB+/// free all series while holding a 37 MB assembly; a session with a large+/// assembly open is exactly where the truncation this cannot detect becomes+/// likely.+///+/// This test asserts the sweep reports the free space it had — the cheap half,+/// and the precondition for refusing on it.+#[test]+fn the_sweep_reports_the_headroom_it_had_before_writing() {+    use serde_json::json;++    let b = common::Bridge::start_with(&[("SWX_ALLOW_USER_WRITES", "1")]);+    b.call("swx_start", json!({"reason": "preparing"}));+    b.call("swx_new_document", json!({"type": "part", "keepUnsaved": true}));+    let r = b.call(+        "swx_close_all_safely",+        json!({"reason": "closing everything safely", "userAuthorized": true, "batch": 1}),+    );+    let text = serde_json::to_string(&r).unwrap().to_lowercase();+    assert!(+        text.contains("freebytes") || text.contains("freespace") || text.contains("headroom"),+        "the sweep writes every open document to disk and never says how much room it had. \+         Marker and floor cannot detect a truncation that keeps the header and exceeds 16 KB, so \+         the only defence against that class is refusing to start without headroom — and the \+         first step is reporting it.\n{}",+        serde_json::to_string_pretty(&r).unwrap()+    );+}++mod common;

@@ -0,0 +1,82 @@+//! ADVERSARIAL REVIEW OF 0.7.3 — pass twenty-five.+//!+//! On the judgement call: **I agree with the Builder.** The distinction that+//! makes it principled is between a PREDICTION and a VERIFICATION. The headroom+//! gate predicts whether a write will fit; the marker, the floor, the+//! close-phase re-verify and the per-save census verify what actually reached+//! disk. Data safety rests entirely on the second group, and all of it still+//! runs when free space cannot be read. Refusing on an unmeasurable PREDICTION+//! would block a safe operation on a fact with no bearing on whether anything is+//! lost — and would put "ask the user" back in the path Drew ruled it out of.+//! Predictions may be unknown; verifications may not. `null` is the honest+//! report, and it is visible.+//!+//! That agreement is conditional, though, and the condition is this file: the+//! residual the call accepts is exactly the truncation class the verification+//! chain cannot catch (header intact, over the floor). How narrow that residual+//! is depends on the estimate being roughly right, and for a document whose size+//! cannot be measured it is not.+//!+//! MEASURED, over the 166 real documents in this container:+//!+//! ```text+//!          n     min        median      max+//! .SLDPRT  99    29,130     134,885     37,200,505+//! .SLDASM  38    95,492     4,139,430   16,644,232+//! .SLDDRW  29    319,803    1,958,169   32,250,713+//! ```++use swx_bridge::disk::estimate_writes;++/// A SMALL MEASURED DOCUMENT MAKES THE GUESS FOR AN UNKNOWN ONE SMALLER.+///+/// ```text+/// let unknown_cost = if biggest_known > 0 { biggest_known.saturating_mul(2) }+///                    else { UNKNOWN_DOCUMENT_ESTIMATE };+/// ```+///+/// With nothing measurable the estimator assumes 1 MB for an unknown document.+/// Measure one 29 KB part — the smallest real part in this container — and the+/// assumption for the unknown one DROPS to 58 KB. Knowing something small about+/// the session made the estimate of the unmeasured part of it worse.+///+/// It matters because `per_save_needed = estimate.largest * HEADROOM_FACTOR`,+/// so the same number gates the re-check before every save. A pathless assembly+/// beside a small part is costed at 58 KB; the median real assembly here is+/// 4.1 MB, and the largest is 16.6 MB. The per-save gate then passes with far+/// less room than the write needs, and the truncation that follows is the one+/// case marker-plus-floor cannot see.+///+/// The fix is one `max`: never let a measured neighbour lower the floor for an+/// unknown. Better still, key the floor to the document type the sweep already+/// knows — from the table above, a part floor of 256 KB, an assembly floor of+/// 8 MB and a drawing floor of 4 MB are each above the measured median. The same+/// table would strengthen `MIN_RECOVERY_BYTES`, which at 16 KB sits below the+/// smallest real document of EVERY type (29 KB, 95 KB, 320 KB).+#[test]+fn a_small_measured_document_never_lowers_the_guess_for_an_unknown_one() {+    let dir = std::env::temp_dir().join("adv24-estimate");+    let _ = std::fs::create_dir_all(&dir);+    let small = dir.join("small.SLDPRT");+    // The smallest real part measured in this container.+    std::fs::write(&small, vec![0u8; 29_130]).unwrap();++    // One unknown document, nothing measurable beside it.+    let alone = estimate_writes(&[String::new()]);+    // The same unknown document, beside one small measured one.+    let beside = estimate_writes(&[String::new(), small.to_string_lossy().to_string()]);++    let unknown_alone = alone.total;+    let unknown_beside = beside.total.saturating_sub(29_130);+    let _ = std::fs::remove_dir_all(&dir);++    assert!(+        unknown_beside >= unknown_alone,+        "the estimate for an UNKNOWN document fell from {unknown_alone} bytes to {unknown_beside} \+         bytes because a 29 KB part was measurable beside it. Knowing something small about the \+         session made the guess about the rest of it smaller. `estimate.largest` also gates the \+         per-save re-check, so this is the number that decides whether the next write is allowed \+         to start — and a pathless assembly costed at 58 KB against a 4.1 MB median is exactly \+         how a truncation the marker cannot detect gets through."+    );+}

@@ -0,0 +1,153 @@+//! ADVERSARIAL REVIEW OF 0.7.4 — pass twenty-six.+//!+//! The estimator is fixed and the fix is sound: `neighbour_cost.max(floor)` is+//! monotone, and an unknown kind costs the generic 1 MB rather than the cheapest+//! kind. Pass 25's finding is closed.+//!+//! What is not closed is the CLASSIFIER underneath both numbers. `from_hint` is+//! total — it cannot say "I do not know", it says `Part`. Part carries the+//! LOWEST floor of the three on both sides. So every failure of the hint chain+//! resolves to the most permissive answer, which is the wrong direction for a+//! verification and, it turns out, the wrong direction for the estimate too.++use swx_bridge::comhost::host::recovery_file_verdict;+use swx_bridge::disk::{DocKind, UNKNOWN_DOCUMENT_ESTIMATE};++// ── BUILDER NOTE, 0.7.5. Three call sites below were adjusted, because the fix+//    these tests ask for CHANGES THESE TWO SIGNATURES — that is the fix:+//+//      * `recovery_file_verdict` now takes the KIND and the original's size,+//        instead of reading the kind back off the file name it was given. The+//        name came FROM the kind, so it could never have checked it.+//      * `DocKind::from_hint` now returns `Option<DocKind>`, keyed on the+//        extension alone, because the classifier has to be able to say "I do+//        not know".+//+//    Every assertion is unchanged, and each one still fails without its fix+//    (mutation-verified). The first test passes `None` for the kind, which is+//    exactly its scenario: GetType was unreadable.++fn marked(path: &std::path::Path, bytes: usize) {+    let mut v = vec![0u8; bytes];+    v[4..8].copy_from_slice(&[0x00, 0x00, 0x00, 0x04]);+    std::fs::write(path, v).unwrap();+}++/// AN ASSEMBLY THE BACKEND CANNOT TYPE IS VERIFIED AS A PART.+///+/// The chain, all of it in production code:+///+///   com.rs:909   `let doc_type = doc.int("GetType", &[]).unwrap_or(1);`+///   com.rs:1037  `match doc_type { 2 => "SLDASM", 3 => "SLDDRW", _ => "SLDPRT" }`+///   host.rs:414  `let kind = DocKind::from_hint(path);`  // the path just chosen+///+/// `GetType` is a COM call on a document being closed under memory pressure,+/// which is the condition this whole sweep exists for. When it fails the+/// `unwrap_or(1)` says "part", the recovery file is named `.SLDPRT`, and+/// `recovery_file_verdict` reads the kind back off the name the same failure+/// produced. The verification is asking the question to the answer.+///+/// A 30 KB truncated assembly then clears the 24 KB part floor and the document+/// is closed. The smallest real assembly measured here is 95,492 bytes; 30 KB is+/// under a third of it. The 80 KB assembly floor that would have caught it is+/// never consulted, because nothing downstream knows it was an assembly.+///+/// This is the coordinator's hypothesis and it is worse than stated: it does not+/// need a title without an extension, only one unreadable `GetType`, and the+/// extension is not a fallback for the type — it is DERIVED from it, so the two+/// cannot disagree and the second is not a check on the first.+///+/// The fix is the one proposed: an unknown kind must take the HIGHEST recovery+/// floor. Note the direction argument in `DocKind::from_hint`'s doc comment is+/// inverted — "too high a floor refuses to close a real document" is true and is+/// the SAFE error. A too-high floor refuses and says so; a too-low floor closes+/// against a file nobody checked. For a verification, refusing is the direction+/// to fail in.+#[test]+fn an_assembly_whose_type_could_not_be_read_is_held_to_the_part_floor() {+    let dir = std::env::temp_dir().join("adv25-kind");+    let _ = std::fs::create_dir_all(&dir);+    // What `unique_recovery_path` produces for a pathless assembly titled+    // "Assem1" when `GetType` returned nothing: doc_type 1, extension SLDPRT.+    let f = dir.join("Assem1.SLDPRT");+    marked(&f, 30_000);+    // The kind is UNKNOWN — that is the whole scenario: `GetType` failed.+    let v = recovery_file_verdict(&f.to_string_lossy(), None, None);+    let _ = std::fs::remove_dir_all(&dir);++    assert!(+        !v.ok,+        "a 30,000-byte recovery file was accepted as complete. It is an ASSEMBLY: the smallest \+         real one measured in this container is 95,492 bytes, so this is under a third of a \+         genuine document. It passed because one unreadable GetType chose the .SLDPRT name and \+         the verdict read the kind back off that name. Unknown kind must take the HIGHEST floor \+         on the verification side — refusing to close is the safe error; closing against an \+         unchecked file is not."+    );+}++/// THE HINT IS MATCHED AGAINST THE WHOLE PATH, DIRECTORIES INCLUDED.+///+/// `from_hint` is `h.contains("assembly")` / `h.contains("drawing")` over the+/// entire recovery path. `C:\Users\drew\Documents\Drawings\recovery\Part1.SLDPRT`+/// lowercases to something containing "drawing", so a genuine part is held to the+/// 256 KB DRAWING floor and refused — at 134,885 bytes, the MEDIAN real part+/// here does not clear it.+///+/// This one costs availability rather than work, and it is loud, but it fires on+/// a directory name a person would actually choose for exactly this purpose, and+/// on the first live close. Match the extension, not the string.+#[test]+fn a_recovery_directory_named_for_drawings_does_not_reclassify_a_part() {+    let dir = std::env::temp_dir().join("adv25-Drawings").join("recovery");+    let _ = std::fs::create_dir_all(&dir);+    let f = dir.join("Part1.SLDPRT");+    // The MEDIAN real part measured in this container.+    marked(&f, 134_885);+    // Classified the way the sweep classifies a path — which is the thing under+    // test: the DIRECTORY must not outrank the extension.+    let v = recovery_file_verdict(&f.to_string_lossy(), DocKind::from_hint(&f.to_string_lossy()), None);+    let why = v.why.clone().unwrap_or_default();+    let _ = std::fs::remove_dir_all(std::env::temp_dir().join("adv25-Drawings"));++    assert!(+        v.ok,+        "a genuine 134,885-byte part — the median of the 99 real parts here — was refused \+         because its recovery DIRECTORY was called \"Drawings\". from_hint substring-matches the \+         whole path, so the folder name outranks the extension. Reason given: {why}"+    );+}++/// THE GENERIC UNKNOWN ESTIMATE IS UNREACHABLE FROM THE SWEEP.+///+/// `estimate_writes_typed` costs an unknown-kind document at 1 MB, and the sweep+/// passes `None` only when `type`, `docType` AND `title` are all empty+/// (verbs3.rs:533). Every SOLIDWORKS document has a title. So the sweep always+/// supplies a hint, `from_hint` never fails, and UNKNOWN_DOCUMENT_ESTIMATE is+/// dead on the real backend path — the fifth guard in this review to ship inert.+///+/// It is not merely unused, it is a regression: a pathless assembly titled+/// "Assem1" resolves to `Part`, costing 256 KB where the generic unknown would+/// have said 1 MB and the true assembly floor 8 MB. The title fallback made the+/// estimate FOUR TIMES WORSE than having no hint at all, and 32x under the+/// assembly floor it was meant to reach. "Assem1" is the default title+/// SOLIDWORKS gives a new assembly, so this is the common case, not a corner.+///+/// Both sides need the same change: a fallible `from_hint` returning+/// `Option<DocKind>`, `None` when nothing is recognisable — then the estimate+/// takes the generic 1 MB and the recovery floor takes the highest.+#[test]+fn a_pathless_assembly_titled_assem1_is_not_costed_as_a_part() {+    // A TITLE is read as a title. An unrecognisable one is None, and None costs+    // the generic unknown — never the cheapest kind.+    let kind = DocKind::from_title("Assem1");+    let cost = kind.map(|k| k.estimate_floor()).unwrap_or(UNKNOWN_DOCUMENT_ESTIMATE);+    assert!(+        cost >= UNKNOWN_DOCUMENT_ESTIMATE,+        "the default title of a new SOLIDWORKS assembly, \"Assem1\", classifies as {kind:?} and \+         is costed at {cost} bytes. With NO hint at all it would have been costed at the generic \+         {UNKNOWN_DOCUMENT_ESTIMATE}. The title fallback made the estimate worse than the absence \+         of one, and 32x under the 8 MB assembly floor. UNKNOWN_DOCUMENT_ESTIMATE is unreachable \+         from the sweep because from_hint cannot return None."+    );+}

@@ -0,0 +1,137 @@+//! ADVERSARIAL REVIEW OF 0.7.5 — pass twenty-seven.+//!+//! The classifier change is right and the pass-26 findings are closed: the kind+//! is read from `GetType`, carried as a type NAME through `ready.docType`, and+//! re-parsed with `from_type_name` — never re-derived from the file name the+//! sweep itself chose. `from_extension` looks only at the last path segment, so+//! the `…\Drawings\` misclassification is gone. The `≥ original size` rule is+//! correctly scoped to `kind == None` only (`host.rs:431`), so a part that+//! legitimately shrinks — a suppressed feature, a deleted body, a lightweight+//! save — is still held to its own 24 KB floor and not to its old size. That+//! second half of the coordinator's question needed no change and got none.+//!+//! What is left is not the classifier. It is the two places the UNKNOWN branch+//! touches SOLIDWORKS, neither of which this suite can reach.++mod common;+use common::*;+use serde_json::json;+use swx_bridge::disk::DocKind;++fn s(v: &serde_json::Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++/// THE DOCUMENT'S OWN FILE PATH IS NOT CONSULTED.+///+/// The naming chain, verbatim from `com.rs:1086`:+///+/// ```ignore+/// let ext = match kind.or_else(|| DocKind::from_extension(title)) { … };+/// ```+///+/// `kind` is `GetType`, `title` is `GetTitle`. **`path` — `GetPathName`, which+/// the same function read four lines earlier and already uses for+/// `original_bytes` — is never asked.** It is the strongest evidence in the+/// room: the user's own file, named by SOLIDWORKS, on disk.+///+/// It matters because `GetTitle` does not reliably carry the extension.+/// SOLIDWORKS returns the title as the shell shows it, so with "hide extensions+/// for known file types" on — the Windows DEFAULT — a saved assembly's title is+/// `bracket`, not `bracket.SLDASM`. Combine that with one unreadable `GetType`+/// and a document whose kind is sitting in plain text in `path` is classified+/// unknown, named `.sldrecover`, and held to the drawing floor plus its original+/// size.+///+/// For a saved document that last part is survivable — refusing is loud and the+/// user's file is still on disk. The reason to fix it anyway is that it is one+/// `.or_else` against evidence already in hand, and it narrows the `.sldrecover`+/// path to the only case that truly has no extension anywhere: a pathless+/// document. Which is the case the next test is about.+#[test]+fn a_saved_assembly_is_classified_from_its_path_when_the_type_cannot_be_read() {+    // GetType unreadable — the condition this sweep exists for.+    let kind: Option<DocKind> = None;+    // GetTitle with Explorer's default "hide extensions" setting.+    let title = "bracket";+    // GetPathName. Read four lines earlier in the same function, for size.+    let path = "C:\\work\\bracket.SLDASM";++    // The production expression, copied — as 0.7.6 fixed it. The path is asked+    // before the title, because the title is the weaker evidence of the two:+    // SOLIDWORKS reports it as the shell shows it, and Explorer hides known+    // extensions by default.+    let chosen = kind+        .or_else(|| DocKind::from_extension(path))+        .or_else(|| DocKind::from_extension(title));++    assert!(+        chosen.is_some(),+        "a saved assembly was classified UNKNOWN while its kind was written in its own path, \+         {path:?}. The naming chain asks GetType, then the TITLE's extension, and stops — it \+         never asks the path, though the same function reads it for originalBytes. GetTitle \+         carries no extension whenever Explorer hides known file types, which is the default."+    );+}++/// WHAT `.sldrecover` COSTS, AND WHO IS TOLD.+///+/// `unique_recovery_path` gives an unknown-kind document the extension+/// `sldrecover`, which is not a format SOLIDWORKS knows. Two consequences, and+/// the bridge is silent about both.+///+/// FIRST, AND I CANNOT TEST IT HERE: `SaveAs3` dispatches its output format on+/// the extension. This codebase already knows that — `blocked_by_extension`+/// exists precisely because `.wrl` makes SaveAs3 raise a VRML option sheet, so+/// the extension demonstrably selects a writer. What `SaveAs3` does with an+/// extension matching NO writer is not something I will assert from memory; I+/// got a format claim wrong in pass 23 by doing exactly that. But there are only+/// two possibilities and both need an answer before a live run:+///+///   * It FAILS. The record says `preserved: false`, the document stays open,+///     nothing is lost — and 0.7.5's entire unknown-kind path (the strictest+///     floor, the `≥ original size` rule, this extension) is unreachable in+///     production, because the file it verifies is never written. A guard that+///     cannot be reached is the sixth this review has found shipping inert.+///   * It SUCCEEDS by falling back to some default writer. Then the bytes on+///     disk may not be the document's native format at all, and the marker check+///     would be validating a file whose format nobody chose.+///+/// The mock cannot distinguish these: it writes the file itself. Only the live+/// install can answer it, with one scripted `SaveAs3` to a junk extension on a+/// scratch document — which is a write, so it is not mine to run.+///+/// SECOND, AND THIS IS WHAT THE TEST PINS: if such a file IS written, it is the+/// rescue of a document that was never saved — the only copy of that work — and+/// SOLIDWORKS will not open it, because the shell and the dispatcher both go by+/// extension. `swx_recover_list` is the one verb that shows these files, and its+/// hint says "Reopen any of them with swx_open." For every `.sldrecover` file+/// that instruction is wrong, and nothing anywhere tells the user to rename it.+/// The verb has the file names in hand and could say so per file.+#[test]+fn recover_list_says_how_to_open_a_file_solidworks_will_not_open() {+    let scratch = TempDir::new("adv26-recover");+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);++    // A sweep that preserved one document whose kind could not be established.+    let root = scratch.join("recovery").join("2026-09-12T00-00-00");+    std::fs::create_dir_all(&root).unwrap();+    let mut body = vec![0u8; 400_000];+    body[4..8].copy_from_slice(&[0x00, 0x00, 0x00, 0x04]);+    std::fs::write(root.join("Assem1.sldrecover"), &body).unwrap();++    let r = b.call("swx_recover_list", json!({}));+    let text = s(&r).to_ascii_lowercase();+    let listed = text.contains("sldrecover");+    assert!(listed, "precondition: the unknown-kind rescue is listed at all: {}", s(&r));++    assert!(+        text.contains("rename") || text.contains("sldasm") || text.contains("extension"),+        "swx_recover_list shows a .sldrecover file and tells the user \"Reopen any of them with \+         swx_open\". SOLIDWORKS dispatches on extension, so that is the one instruction that \+         cannot work for this file — and it is the rescue of a document that was NEVER SAVED, so \+         it is the user's only copy. Nothing in the response mentions renaming it or what to \+         rename it to. Response: {}",+        s(&r)+    );+}

@@ -0,0 +1,133 @@+//! ADVERSARIAL REVIEW OF 0.7.6 — pass twenty-eight.+//!+//! BOTH RUNTIME QUESTIONS COME OUT CLEAN, by reading the code rather than by+//! testing it, because the branch needs a live SOLIDWORKS to enter.+//!+//! (1) After a refused `.sldrecover` save, `out` is reassigned BEFORE the second+//!     `SaveAs3`, and `now_path = GetPathName` is read after the `match attempt`+//!     — so the close key comes off the object after the SECOND save, and+//!     `same_path(&now_path, &out)` compares it against the new name. A document+//!     that failed to re-point is caught by that comparison, not assumed. If the+//!     second save also fails, `code != 0` puts it on the `preserved: false`+//!     path. Nothing re-points to a name that was never written.+//!+//! (2) A `.sldrecover` save that SUCCEEDS while writing some other format is+//!     verified with `kind = None` against `recovery_file_verdict`, which reads+//!     the marker first. A non-native file carries neither `00 00 00 04` at+//!     offset 4 nor the CFBF signature, so `signature_ok` is false, `ok` is+//!     false, and the document is NOT closed. Fails closed, correctly, and the+//!     retry is deliberately not attempted for a save that returned success —+//!     retrying on a verdict rather than on a return code would write twice for+//!     every genuinely-full disk.+//!+//! Which leaves where those two answers PUT THE FILE. In both cases a file is+//! left in the sweep directory that the sweep itself declined to vouch for —+//! correctly, since deleting a user's only bytes is worse than keeping them. The+//! record says `preserved: false` and names the reason. And then+//! `swx_recover_list` reads that directory with `p.is_file()` and calls+//! everything in it a rescue.++mod common;+use common::*;+use serde_json::json;++fn s(v: &serde_json::Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++/// THE LISTING DOES NOT KNOW WHAT THE SWEEP REFUSED TO VOUCH FOR.+///+/// Three ways a file lands in a sweep directory without being preserved work:+///+///   * the first `SaveAs3` to `.sldrecover` is refused AFTER touching the file,+///     leaving a husk at a name `out` no longer points to — 0.7.6 added the+///     retry, and the husk is what the retry leaves behind;+///   * the save returns 0 but writes a non-native format, and the marker check+///     rejects it;+///   * the save is truncated by a full disk and the size floor rejects it.+///+/// In every one the document stays OPEN and the record says `preserved: false`.+/// `swx_recover_list` sees none of that. It lists the file, reports its size,+/// and hands the user `howToOpen` — for a `.sldrecover` name, an instruction to+/// rename it to `.SLDPRT` and open it, ending "The bytes are the document; only+/// the name is unknown." For these files the bytes are NOT the document, which+/// is precisely why they were not closed against.+///+/// The response's own `_hint` states it outright: "Every document+/// swx_close_all_safely or swx_shutdown closed was written here first." True in+/// one direction and read as the other. The verb that reports the rescue is the+/// one the user reads on the worst day, and it is the one that cannot tell a+/// rescue from a husk.+///+/// `recovery_file_verdict` already computes exactly this answer at save time and+/// the listing throws it away — and it is a pure function of the file, so+/// `recover_list` can simply re-run it per file. Report `verified: false` and+/// replace `howToOpen` with what the sweep actually said. Nothing needs deleting.+#[test]+fn recover_list_does_not_present_an_unverified_file_as_preserved_work() {+    let scratch = TempDir::new("adv27-husk");+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);++    let root = scratch.join("recovery").join("2026-09-12T00-00-00");+    std::fs::create_dir_all(&root).unwrap();+    // What a refused or wrong-format SaveAs3 leaves: bytes that are not a+    // SOLIDWORKS document. recovery_file_verdict rejects this on the marker, and+    // the sweep left the document open because of it.+    std::fs::write(root.join("Assem1.sldrecover"), vec![0x41u8; 900_000]).unwrap();++    let r = b.call("swx_recover_list", json!({}));+    let files = r["sweeps"][0]["files"].as_array().cloned().unwrap_or_default();+    assert_eq!(files.len(), 1, "precondition: the husk is in the listing: {}", s(&r));+    let f = &files[0];++    assert!(+        f.get("verified").and_then(|v| v.as_bool()) == Some(false)+            || f.get("howToOpen")+                .and_then(|v| v.as_str())+                .map(|h| h.to_ascii_lowercase().contains("not verif")+                    || h.to_ascii_lowercase().contains("could not be verified"))+                .unwrap_or(false),+        "a file the sweep REFUSED to vouch for — it holds no SOLIDWORKS marker, so the document \+         it came from is still open — is listed as a rescue, with its size and an instruction to \+         rename it to .SLDPRT and open it, ending \"The bytes are the document; only the name is \+         unknown.\" Here the bytes are not the document. recovery_file_verdict is a pure function \+         of the file and already knows this; recover_list can re-run it per file. Entry: {}",+        s(f)+    );+}++/// THE HEADLINE CLAIM IS THE UNCONDITIONAL ONE.+///+/// A sweep in which NOTHING was preserved still produces a populated listing+/// under the hint "Every document … closed was written here first". A user+/// reading the listing after a failed sweep — the situation the listing exists+/// for — is told their work is safe by the verb whose job is to say so, while+/// the documents are still open and the files are unusable.+///+/// This is the same defect as the test above, stated where the user meets it. I+/// am counting it once.+#[test]+fn a_sweep_that_preserved_nothing_does_not_report_rescued_work() {+    let scratch = TempDir::new("adv27-nothing");+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);++    let root = scratch.join("recovery").join("2026-09-12T00-00-00");+    std::fs::create_dir_all(&root).unwrap();+    // Two attempts, both refused: no marker on either.+    std::fs::write(root.join("Assem1.sldrecover"), vec![0x41u8; 900_000]).unwrap();+    std::fs::write(root.join("Part1.SLDPRT"), vec![0x42u8; 40_000]).unwrap();++    let r = b.call("swx_recover_list", json!({}));+    let text = s(&r).to_ascii_lowercase();+    let files = r["sweeps"][0]["files"].as_array().cloned().unwrap_or_default();+    assert_eq!(files.len(), 2, "precondition: both attempts are listed: {}", s(&r));++    assert!(+        text.contains("verif"),+        "nothing in this sweep was preserved — neither file carries a SOLIDWORKS marker, so both \+         documents are still open — and swx_recover_list reports two rescues under \"Every \+         document swx_close_all_safely or swx_shutdown closed was written here first\". The word \+         \"verified\" does not appear anywhere in the response. Response: {}",+        s(&r)+    );+}

@@ -0,0 +1,186 @@+//! ADVERSARIAL REVIEW OF 0.7.7 — pass twenty-nine.+//!+//! The listing is right about the case it was built for: a husk with no marker+//! is now `verified:false`, is never called a rescue, and says the document was+//! left open. Pass 28 is closed.+//!+//! ON THE CIRCULARITY CLAIM — I agree with it for every file except the one+//! class 0.7.6 introduced, and that exception matters.+//!+//! ```ignore+//! // The KIND from the extension is legitimate here and is not the 0.7.5+//! // circularity: this verb did not choose the name, it is reading a directory.+//! ```+//!+//! Who READS the name is not what made 0.7.5 circular; where the name CAME FROM+//! is. For a `.SLDPRT` written because `GetType` said part, the extension+//! records an independent observation and reading it back is sound. But a+//! `.SLDPRT` written by `namingFallback: "unknownKindNamedAsPart"` carries the+//! opposite: the sweep wrote that extension **because it could not establish the+//! kind**. The save verified it with `kind = None` against+//! `unknown_kind_floor()` — 256 KB. The listing reads `.SLDPRT`, gets+//! `DocKind::Part`, and applies 24 KB. Ten times weaker, on precisely the files+//! whose kind is unknown, from a name the failure produced. That is the same+//! shape as 0.7.4, one hop further downstream.+//!+//! AND THE WEAKNESS IS NOT SYMMETRIC THE WAY THE COMMENT ARGUES:+//!+//! ```ignore+//! // That makes this check WEAKER than the one at save time and never stricter,+//! // so nothing that was truly preserved can be reported as unverified here.+//! ```+//!+//! True, and it is the harmless half. A weaker check cannot produce a false+//! NEGATIVE; it is exactly what produces a false POSITIVE — `verified:true` for+//! a file the sweep refused. 0.7.6 said nothing about these files. 0.7.7 asserts+//! something about them, and an assertion that is wrong is worse than silence on+//! the day it is read.++mod common;+use common::*;+use serde_json::json;++fn s(v: &serde_json::Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++fn a_visible_machine(tag: &str) -> TempDir {+    let d = TempDir::new(tag);+    std::fs::write(d.join("windows.json"), "[]").unwrap();+    d+}++fn a_difficult_session(scratch: &TempDir) {+    std::fs::write(+        scratch.join("mock-solidworks-open-docs.json"),+        json!({+            "running": true, "untitled": 3, "active": "untitled:a",+            "docs": [+                {"docType": "part", "path": "C:\\Users\\drew\\work\\bracket.SLDPRT",+                 "title": "bracket.SLDPRT", "saved": true, "dirty": true},+                {"docType": "part", "path": "untitled:a", "title": "First.step.SLDPRT",+                 "saved": false, "dirty": true},+                {"docType": "part", "path": "untitled:b", "title": "First.step.SLDPRT",+                 "saved": false, "dirty": true},+                {"docType": "assembly", "path": "C:\\Users\\drew\\work\\gearbox.SLDASM",+                 "title": "gearbox.SLDASM", "saved": true, "dirty": false},+                {"docType": "part", "path": "C:\\Users\\drew\\work\\shaft.SLDPRT",+                 "title": "shaft.SLDPRT", "saved": true, "dirty": false,+                 "heldOpenByAssembly": true}+            ],+            "files": {}+        })+        .to_string(),+    )+    .unwrap();+}+++/// A FILE THE SWEEP REFUSED FOR SIZE IS REPORTED AS VERIFIED.+///+/// Reachable two ways, both through the unknown-kind branch:+///+///   * `≥ original`. An unknown-kind document whose own file was 4 MB is+///     rescued at 300 KB. Save time: floor = `max(256 KB, 4 MB)` = 4 MB →+///     REFUSED, `preserved:false`, document left OPEN. Listing: the original+///     size is not knowable from a directory, so the floor alone applies —+///     300 KB clears 256 KB — `verified:true`, and `howToOpen` says "The bytes+///     verify as a document; only the name is unknown."+///+///   * the naming fallback. An unknown-kind document saved as `.SLDPRT` at+///     30 KB. Save time: `kind = None` → 256 KB floor → REFUSED. Listing:+///     `.SLDPRT` → Part → 24 KB → `verified:true`, `howToOpen: "swx_open this+///     path."`+///+/// In both, the sweep's record says the document is still open and the listing+/// says its work is safely on disk. The user reading the listing is the user+/// whose sweep just failed.+///+/// The floor-only weakening cannot be patched by making the listing stricter —+/// it genuinely cannot know the original size, and for the naming fallback it+/// cannot know the extension was a guess. Both facts existed at save time and+/// were thrown away. The fix is the durable one: the sweep writes its record+/// beside the files it wrote — a `manifest.json` per recovery folder — and the+/// listing reports what the sweep decided, falling back to re-verification only+/// for a folder with no manifest. That also makes `namingFallback` visible to+/// the reader, which nothing downstream can currently see.+#[test]+fn a_file_the_sweep_refused_is_not_reported_as_verified() {+    let scratch = TempDir::new("adv28-refused");+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);++    let root = scratch.join("recovery").join("2026-09-12T00-00-00");+    std::fs::create_dir_all(&root).unwrap();+    let mut body = vec![0u8; 300_000];+    body[4..8].copy_from_slice(&[0x00, 0x00, 0x00, 0x04]);+    // Unknown kind, rescued at 300 KB from a document whose own file was 4 MB.+    // The sweep refused this: max(256 KB, 4 MB) = 4 MB. The document is OPEN.+    std::fs::write(root.join("Assem1.sldrecover"), &body).unwrap();++    let r = b.call("swx_recover_list", json!({}));+    let files = r["sweeps"][0]["files"].as_array().cloned().unwrap_or_default();+    assert_eq!(files.len(), 1, "precondition: the file is listed: {}", s(&r));+    let f = &files[0];+    assert!(+        f["signatureOk"] == json!(true),+        "precondition: this fails on SIZE, not on the marker: {}",+        s(f)+    );++    assert!(+        f["verified"] != json!(true),+        "the listing reports verified:true for a file the sweep REFUSED and whose document it \+         left OPEN. At save time the unknown-kind floor was max(256 KB, original) — 4 MB for this \+         document — and the listing applies 256 KB because a directory cannot tell it what the \+         original weighed. A weaker check cannot produce a false negative; this is the false \+         POSITIVE it produces instead, and it is the direction that costs the user. Entry: {}",+        s(f)+    );+}++/// THE SWEEP DOES NOT WRITE DOWN WHAT IT DECIDED.+///+/// Everything the listing has to guess at — the original document's size, the+/// kind `GetType` reported, whether the extension was a guess — was in hand at+/// save time and is discarded when the process ends. The recovery folder holds+/// files and nothing else, so the listing is left re-deriving a verdict from+/// strictly less evidence than the one it is trying to reproduce, and the gap+/// between them is exactly the two false positives above.+///+/// A `manifest.json` written by the sweep into its own folder closes both, needs+/// no new judgement, and survives the process that made it — which matters most+/// here, because a sweep that ran during a crash is the one whose files someone+/// reads later from a fresh bridge.+#[test]+fn a_sweep_records_its_verdicts_beside_the_files_it_wrote() {+    let scratch = TempDir::new("adv28-manifest");+    a_difficult_session(&scratch);+    let machine = a_visible_machine("adv28-manifest-machine");+    let b = Bridge::start_in(+        TempDir::borrowed(&scratch.0),+        &[("SWX_LAUNCH_FAKE_DIR", &machine.path())],+    );+    b.call("swx_start", json!({}));+    let swept = b.call("swx_close_all_safely", json!({"reason": "closing"}));+    assert!(swept["done"] == json!(true), "precondition: the sweep ran: {}", s(&swept));++    let listed = b.call("swx_recover_list", json!({}));+    let dir = listed["sweeps"][0]["directory"].as_str().unwrap_or_default().to_string();+    assert!(!dir.is_empty(), "precondition: a sweep folder exists: {}", s(&listed));++    let names: Vec<String> = std::fs::read_dir(&dir)+        .map(|e| {+            e.flatten().map(|f| f.file_name().to_string_lossy().to_string()).collect()+        })+        .unwrap_or_default();++    assert!(+        names.iter().any(|n| n.to_ascii_lowercase().contains("manifest")),+        "the sweep wrote {} file(s) into {dir} and no record of what it decided about any of \+         them. The original sizes, the kinds GetType reported and whether an extension was a \+         guess all existed at save time; the listing has to re-derive a verdict without them, \+         and the two facts it cannot recover are exactly where it reports verified:true for a \+         refused file. Files present: {names:?}",+        names.len()+    );+}