SOLIDWORKS Bridge

@@ -269,7 +269,24 @@ not create, and it never launches or stops SOLIDWORKS.  ## Roadmap -- v0.5.7 (this): **the close key is right; the window it reasoned over was not.**+- v0.5.8 (this): **an unreadable count is not "nothing happened".** The drain's+  discriminator had two arms and needed three: when a close reports success while+  the document is still open, a count that did not move means the call did nothing+  (`close_by_path_unsupported`) and a count that dropped means something else was+  closed (`wrong_document_closed`) — but a count that CANNOT BE READ means neither,+  and it can become unreadable *because* something large just changed. It is now+  `close_outcome_unknown` / `outcome:"undetermined"`: the drain stops and reports+  the path and the pre-close count with "a human must check whether this path, or+  another document, closed". The mock read its count from a `Vec` length, so that+  arm had no fixture at all; every count now goes through one seam that+  `mock-doccount-none` can make unreadable. `tools/drain-gate.py` also stops+  overclaiming: a PARTIAL banner when the collision half was not exercised, the+  twin save attempted in the DEFAULT posture first with the result recorded as a+  finding (a bridge-created document written to a new path in a scratch dir must+  pass the choke-point rule — pinned in the suite, and a live refusal would be a+  bridge bug worth naming), and cleanup that deletes only the two files it wrote+  rather than recursing a directory whose contents it did not write. 265 tests.+- v0.5.7: **the close key is right; the window it reasoned over was not.**   `done` never consulted `WalkStop::complete()`, so a walk that stopped at its scan   cap or on an invalidated iteration reported a finished drain with temporaries   still open past the window (measured: 55 of 60 scanned, a temp at #60 still open,@@ -284,7 +301,7 @@ not create, and it never launches or stops SOLIDWORKS.   failure (`close_by_path_unsupported`), the drain stops, and it never falls back   to a title; only a count that DROPPED while the victim is still open is   `wrong_document_closed`. `tools/drain-gate.py` proves the premise live on-  documents the bridge makes itself. 263 tests.+  documents the bridge makes itself. - v0.5.6: **a title is not an identity — and the drain's CLOSE was the one   place that rule was missing.** Victims were chosen by PATH and then closed with   `CloseDoc(title)`, which resolves by name and does not prompt: on Drew's live

@@ -300,6 +300,11 @@ adom-bridge --ai-thread "<thread>" swx_save_as '{"outputPath":"C:\\parts\\bracke   live 2144-document session). `swx_close_all_documents` on such a session still   closes, but reports `closed`/`remaining` as **null** with counts, and names the   unknown in `skipped`. Never read a null list as "nothing there".+- **`close_outcome_unknown` means a HUMAN has to look.** It is the drain's third+  outcome: a close reported success, the document is still open, and the count could+  not be read — so it cannot be told whether nothing closed or something else did.+  The drain stops. Do not retry it; ask the user what is on their screen, and read+  `closeFailed` for the path and the count immediately before the close. - **A drain that says `done:false` is not finished — read `walkStop`.** The drain   looks at a bounded WINDOW per call (`documentsScanned`), and `done:true` means the   walk reached the END of the session with nothing left. `walkStop` is

@@ -432,3 +432,48 @@ exactly one document closed, that it was named by its `IC~~` path, that the save twin is still open, that the count dropped by exactly one, that the collision was reported, and that every document open at baseline is still open. It closes only what it created and removes its own scratch directory.++## Adversary round 11 → the discriminator's third case, and the gate's own honesty (0.5.8)++**The unreadable count took the benign arm.** When `CloseDoc(path)` returned+success and the document was still open, 0.5.7 asked whether the open-document+count had moved — and an unreadable count fell into `_ => true`, meaning "the call+did nothing": `close_by_path_unsupported`, a capability problem, nobody accused.+But **a count can become unreadable *because* something large just changed**.+Closing a big assembly is exactly the kind of event that makes+`GetDocumentCount` stop answering, so the reassuring reading is the one this+bridge may not take. There are three outcomes, not two:++| after a close that "succeeded" while the victim is still open | verdict |+|---|---|+| the count did not move | the call did nothing — `close_by_path_unsupported` |+| the count DROPPED | another document was closed — `wrong_document_closed` |+| **the count cannot be read** | **`close_outcome_unknown`, `outcome:"undetermined"`** |++The third stops the drain and says what it does not know: the victim's path, the+count immediately before the close, and *"a human must check whether this path, or+another document, closed"*. It never claims nothing happened.++**And it had no fixture.** The mock read its count from `self.docs.len()`, so+`mock-doccount-none` could not reach the drain and that arm was dead code as far+as the suite was concerned — the arm that decides whether a user's document was+closed. The mock now reads every count through one seam that honours the fault.++**The gate's own claims got the same treatment** (`tools/drain-gate.py`):++* the PASS banner is conditional. With the saved twin never open it prints+  **PARTIAL** — the close key is proven, the collision half is untested — instead+  of a pass that covers something it did not exercise.+* step 3 now tries the twin save in the **default posture first**, with no+  `allowUserWrites`, and records `defaultGateAllowedScratchSave` as a finding. A+  bridge-created document written to a non-existing path inside a scratch dir the+  gate made is exactly what the choke-point rule is supposed to allow, so a+  refusal there is a BRIDGE BUG the gate names rather than works around. It then+  retries with the opt-in so the rest of the run still happens; the finding stands+  either way. (It does not reproduce in the mock — the rule is now pinned by+  `the_default_posture_lets_the_bridge_save_its_own_document_to_a_new_path`, which+  also pins that overwriting an EXISTING file still refuses.)+* cleanup deletes **only the two files the gate wrote**, by name, and removes the+  directory only if it is then empty. A recursive delete of a directory whose+  contents we did not write is the same class of act this bridge refuses+  everywhere else — and SOLIDWORKS puts its own artefacts in there.