SOLIDWORKS Bridge

@@ -96,15 +96,6 @@ pub fn assess(ctx: &crate::verbs::Ctx) -> Value {                 .and_then(|ps| ps.iter().find(|x| x.pid == p).and_then(|x| x.created_at))         })         .or_else(|| state.get("processCreatedAt").and_then(|v| v.as_u64()));-    // ANY POLL THAT SEES A DOCUMENT RECORDS IT (adversary pass 42, S5).-    if let (Some(p), Some(n)) = (-        pid.and_then(|p| u32::try_from(p).ok()),-        state.get("documentCount").and_then(|v| v.as_u64()),-    ) {-        if n > 0 {-            crate::session_history::mark(p, created);-        }-    }     let (log, log_why) = crate::perflog::startup_complete(created);     use crate::perflog::LogVerdict as L;     let mut guard = SESSIONS.lock().unwrap_or_else(|e| e.into_inner());@@ -141,6 +132,20 @@ pub fn assess(ctx: &crate::verbs::Ctx) -> Value {     if ready && pid.is_some() {         seen.ready = true;     }+    drop(guard);+    // WHAT THE POLL SAW, recorded — but only on a session verified READY. Live+    // 2026-10-01 (pid 29108): a count read during startup recorded a session no+    // one had opened a document in as having held one. A count while starting is+    // never evidence; after the start, a count > 0 must persist across two polls+    // (session_history::observe) to count.+    if let (Some(p), Some(n)) = (+        pid.and_then(|p| u32::try_from(p).ok()),+        state.get("documentCount").and_then(|v| v.as_u64()),+    ) {+        if ready {+            crate::session_history::observe(p, created, n, "readinessPoll");+        }+    }     let unverifiable = verdict.is_none();     if unverifiable {         based_on.push("graceAfterFirstSeen");@@ -166,6 +171,17 @@ pub fn assess(ctx: &crate::verbs::Ctx) -> Value {     }) } +/// Has this bridge VERIFIED that session `pid` finished starting? Read from the+/// per-session cache; no COM.+pub fn known_ready(pid: u32) -> bool {+    SESSIONS+        .lock()+        .unwrap_or_else(|e| e.into_inner())+        .as_ref()+        .and_then(|m| m.get(&(pid as i64)).map(|s| s.ready))+        .unwrap_or(false)+}+ /// What a verb does to SOLIDWORKS, for the gate. #[derive(Clone, Copy, PartialEq, Eq)] pub enum Touch {@@ -181,8 +197,33 @@ pub enum Touch { /// unverifiable past the grace), or not running at all (the verb then answers /// that for itself), or the host could not say (the verb's own call meets the /// same failure and reports it). `Some` is the refusal.-pub fn refuse_until_ready(ctx: &crate::verbs::Ctx, verb: &str, touch: Touch) -> Option<Value> {+/// What the gate saw, for the verb's reply (0.9.6, G3): every gated verb —+/// success or refusal — carries `readiness: {ready, state, basedOn, readsAllowed,+/// evaluatedAt:"gate"}`, so a live run can prove no COM verb ran while starting.+pub fn gate_summary(r: &Value) -> Value {+    json!({+        "ready": r.get("ready").cloned().unwrap_or(Value::Null),+        "state": r.get("state").cloned().unwrap_or(Value::Null),+        "basedOn": r.get("basedOn").cloned().unwrap_or_else(|| json!([])),+        "readsAllowed": r.get("readsAllowed").cloned().unwrap_or(Value::Null),+        "running": r.get("running").cloned().unwrap_or(Value::Null),+        "why": r.get("why").cloned().unwrap_or(Value::Null),+        "evaluatedAt": "gate",+    })+}++/// The gate itself. `Ok(summary)` lets the verb run (the summary goes into its+/// reply); `Err(refusal)` is the refusal, which carries the full assessment.+pub fn gate(ctx: &crate::verbs::Ctx, verb: &str, touch: Touch) -> Result<Value, Value> {     let r = assess(ctx);+    match refusal_for(&r, verb, touch) {+        None => Ok(gate_summary(&r)),+        Some(refusal) => Err(refusal),+    }+}++fn refusal_for(r: &Value, verb: &str, touch: Touch) -> Option<Value> {+    let r = r.clone();     if r.get("ready").and_then(|v| v.as_bool()) != Some(false) {         return None;     }

@@ -13,7 +13,11 @@ //! the current document count, and the quit ladder needs to know it. //! //! Recorded per session — (pid, creation time) — in `session-history.json` in the-//! data root, whenever a verb shows a document open in it. `None` (UNKNOWN) when+//! data root: TRUE when the bridge itself created or opened a document in it, or+//! when a document count > 0 persists across two polls of the STARTED session+//! (never from a count read while starting — live 2026-10-01, pid 29108, such a+//! read recorded a session no one had opened a document in). ADVISORY since+//! 0.9.6: the quit ladder's priming no longer reads it. `None` (UNKNOWN) when //! the bridge did not watch the session from its start: it attached to one it //! did not launch, so a document may have come and gone unseen. @@ -35,15 +39,8 @@ fn load() -> serde_json::Map<String, Value> {         .unwrap_or_default() } -/// Record that this session has held a document. Keeps the twenty most recent-/// sessions; older ones cannot be running any more.-pub fn mark(pid: u32, created: Option<u64>) {-    let mut m = load();-    let k = key(pid, created);-    if m.get(&k).and_then(|v| v.get("everHadDocument")).and_then(|v| v.as_bool()) == Some(true) {-        return;-    }-    m.insert(k, json!({"everHadDocument": true, "atMs": crate::launchos::epoch_ms() as u64}));+fn save(m: serde_json::Map<String, Value>) {+    let mut m = m;     while m.len() > 20 {         let oldest = m             .iter()@@ -59,6 +56,76 @@ pub fn mark(pid: u32, created: Option<u64>) {     let _ = crate::launch::write_atomic(&path(), &Value::Object(m).to_string()); } +/// Record that this session has held a document BECAUSE THE BRIDGE ITSELF+/// created or opened one in it — the only single event that is proof.+pub fn mark(pid: u32, created: Option<u64>) {+    set_true(pid, created, "the bridge itself created or opened a document in this session");+}++fn set_true(pid: u32, created: Option<u64>, basis: &str) {+    let mut m = load();+    let k = key(pid, created);+    let mut entry = m.get(&k).cloned().unwrap_or_else(|| json!({}));+    if entry.get("everHadDocument").and_then(|v| v.as_bool()) == Some(true) {+        return;+    }+    if let Value::Object(e) = &mut entry {+        e.insert("everHadDocument".into(), json!(true));+        e.insert("basis".into(), json!(basis));+        e.insert("atMs".into(), json!(crate::launchos::epoch_ms() as u64));+    }+    m.insert(k, entry);+    save(m);+}++/// Two observations count as two polls only if they are this far apart.+const DISTINCT_POLL_MS: u64 = 1000;++/// WHAT A POLL SAW: a document count read on a session the bridge has VERIFIED+/// ready (callers never pass a count read while starting). Recorded with its+/// time and source (the last eight are kept). It sets `everHadDocument` only+/// when a count > 0 PERSISTS across two distinct polls with no zero between them+/// — live 2026-10-01 (pid 29108), a single count read near startup recorded a+/// session nobody had opened a document in.+pub fn observe(pid: u32, created: Option<u64>, count: u64, source: &str) {+    let mut m = load();+    let k = key(pid, created);+    let now = crate::launchos::epoch_ms() as u64;+    let mut entry = m.get(&k).cloned().unwrap_or_else(|| json!({}));+    let mut obs: Vec<Value> =+        entry.get("observations").and_then(|v| v.as_array()).cloned().unwrap_or_default();+    obs.push(json!({"count": count, "atMs": now, "source": source}));+    while obs.len() > 8 {+        obs.remove(0);+    }+    // PERSISTED: an earlier observation with a count > 0, at least+    // DISTINCT_POLL_MS older than this one, and no zero-count observation since.+    let mut persisted = false;+    if count > 0 {+        for o in obs.iter().rev().skip(1) {+            if o.get("count").and_then(|c| c.as_u64()).unwrap_or(0) == 0 {+                break;+            }+            let at = o.get("atMs").and_then(|a| a.as_u64()).unwrap_or(now);+            if now.saturating_sub(at) >= DISTINCT_POLL_MS {+                persisted = true;+                break;+            }+        }+    }+    if let Value::Object(e) = &mut entry {+        e.insert("observations".into(), json!(obs));+        if !e.contains_key("atMs") {+            e.insert("atMs".into(), json!(now));+        }+    }+    m.insert(k, entry);+    save(m);+    if persisted {+        set_true(pid, created, "a document count > 0 on two distinct polls of the started session");+    }+}+ /// `Some(true)`: this session has held a document. `Some(false)`: NONE SEEN BY /// THIS BRIDGE — it launched the session and no poll since has seen a document /// (a non-zero `GetDocumentCount` at any readiness poll, or a verb reply showing@@ -100,7 +167,18 @@ pub fn note_reply(ctx: &crate::verbs::Ctx, command: &str, reply: &Value) {         .ok()         .and_then(|ps| ps.iter().find(|p| p.pid == pid).and_then(|p| p.created_at))         .or_else(|| state.get("processCreatedAt").and_then(|v| v.as_u64()));-    mark(pid, created);+    if made_one {+        mark(pid, created);+    } else if crate::readiness::known_ready(pid) {+        // A COUNT IN A REPLY is a poll like any other: evidence only on a started+        // session, and only once it persists.+        let n = ["documentCount", "count", "openDocuments"]+            .iter()+            .filter_map(|k| reply.get(*k).and_then(|v| v.as_u64()))+            .max()+            .unwrap_or(0);+        observe(pid, created, n, command);+    } }  /// THE SESSION'S HISTORY, for `swx_status` — so a caller can predict whether a@@ -108,11 +186,13 @@ pub fn note_reply(ctx: &crate::verbs::Ctx, command: &str, reply: &Value) { /// says which evidence decided it. pub fn describe(pid: u32, created: Option<u64>) -> Value {     let ever = ever_had_document(pid, created);+    let rec = load().get(&key(pid, created)).cloned().unwrap_or(Value::Null);+    let recorded_basis = rec.get("basis").and_then(|v| v.as_str()).map(String::from);     let basis = match ever {-        Some(true) => "a document was seen open in this session",-        Some(false) => "none seen by this bridge: it launched this session, and no poll it has made since \-                        (GetDocumentCount on every readiness check, and every verb reply) has seen a \-                        document open — a document opened and closed between two polls would not be seen",+        Some(true) => recorded_basis.as_deref().unwrap_or("a document was seen open in this session"),+        Some(false) => "none seen by this bridge: it launched this session, it has not created or opened a \+                        document in it, and no document count > 0 has persisted across two polls of the \+                        started session — a document opened and closed between two polls would not be seen",         None => "the bridge did not watch this session from its start, so a document may have come and gone unseen",     };     json!({@@ -120,8 +200,13 @@ pub fn describe(pid: u32, created: Option<u64>) -> Value {         "basis": basis,         "processId": pid,         "processCreatedAt": created,+        // ADVISORY ONLY (0.9.6): no decision reads this — priming triggers on the+        // measured decline itself.+        "advisory": true,+        "observations": rec.get("observations").cloned().unwrap_or_else(|| json!([])),         "note": "MEASURED 2026-10-01: a session that has never held a document quit without help at \                  ~25 s old but DECLINED ExitApp at 50 s, 130 s, 150 s and 8 min old; swx_stop primes \-                 such a session (userAuthorized, empty, no dialog) before asking again.",+                 an EMPTY session whose ExitApp was declined (userAuthorized, no blocking dialog) and \+                 asks once more — whatever this history says, which is advisory.",     }) }

@@ -731,12 +731,20 @@ fn dialog_census_now(ctx: &Ctx) -> Option<crate::quit::DialogCensus> {         .and_then(|v| v.as_u64())         .map(|p| p as u32)?;     let census = os.processes().ok()?;-    let id = crate::quit::Identity {-        pid,-        created_at: census.iter().find(|p| p.pid == pid).and_then(|p| p.created_at)?,-        main_hwnd: None,-    };-    let pids = crate::quit::dialog_census_pids(Ok(&census), &id)?;+    let created_at = census.iter().find(|p| p.pid == pid).and_then(|p| p.created_at)?;+    dialog_census_of(os.as_ref(), &census, pid, created_at)+}++/// The judged census for one SOLIDWORKS process — no COM involved: the windows+/// of the process and its children, each judged by `quit::judge_window`.+fn dialog_census_of(+    os: &dyn crate::launchos::LaunchOs,+    census: &Vec<crate::launchos::ProcInfo>,+    pid: u32,+    created_at: u64,+) -> Option<crate::quit::DialogCensus> {+    let id = crate::quit::Identity { pid, created_at, main_hwnd: None };+    let pids = crate::quit::dialog_census_pids(Ok(census), &id)?;     let mut windows: Vec<crate::launchos::WindowInfo> = Vec::new();     for p in &pids {         match os.windows_of_pid(*p) {@@ -750,7 +758,7 @@ fn dialog_census_now(ctx: &Ctx) -> Option<crate::quit::DialogCensus> {     // answering — nothing here presses anything.     // JUDGED BY MEASURED MODALITY (0.9.4): a notification — owner frame enabled,     // a tool window, nothing to click — does not stop a sweep or an import.-    Some(crate::quit::dialog_census(&windows, os.as_ref()))+    Some(crate::quit::dialog_census(&windows, os)) }  /// `swx_close_all_safely` — PRESERVE EVERYTHING, THEN CLOSE EVERYTHING.@@ -3105,6 +3113,7 @@ pub fn window_info(ctx: &Ctx, _args: &Value) -> Value {         Ok(all) => {             let ours = crate::abwin::solidworks_windows(&all, hwnd, pid);             ok(json!({+                "dialogCensus": judged_dialog_census_without_com(),                 "mainHwnd": hwnd,                 "abAvailable": true,                 "windowCount": ours.len(),@@ -3121,6 +3130,41 @@ pub fn window_info(ctx: &Ctx, _args: &Value) -> Value {     } } +/// THE BRIDGE'S OWN VERDICT on every dialog of the running SOLIDWORKS —+/// blocking or notification, with the evidence — taken WITHOUT COM (the process+/// census names the one SOLIDWORKS), so it is available during startup and to a+/// gate that must not act on a window it has merely seen (0.9.6, G2).+fn judged_dialog_census_without_com() -> Value {+    let os = crate::launchos::os();+    let census = match os.processes() {+        Ok(c) => c,+        Err(e) => return json!({"readable": false, "why": format!("no process census: {e}")}),+    };+    let sw: Vec<&crate::launchos::ProcInfo> =+        census.iter().filter(|p| p.image.eq_ignore_ascii_case("SLDWORKS.exe")).collect();+    let (pid, created) = match sw.as_slice() {+        [] => return json!({"readable": true, "solidworksRunning": false, "blocking": Value::Null, "notifications": []}),+        [one] => match one.created_at {+            Some(c) => (one.pid, c),+            None => return json!({"readable": false, "why": "the SOLIDWORKS process's creation time could not be read"}),+        },+        many => {+            return json!({"readable": false,+                          "why": format!("{} SOLIDWORKS processes are running; the census cannot say which is meant", many.len())})+        }+    };+    match dialog_census_of(os.as_ref(), &census, pid, created) {+        None => json!({"readable": false, "processId": pid,+                       "why": "the windows of SOLIDWORKS or its children could not be read"}),+        Some(c) => json!({+            "readable": true,+            "processId": pid,+            "blocking": c.blocking.map(|d| d.to_json()),+            "notifications": c.notifications.iter().map(|d| d.to_json()).collect::<Vec<_>>(),+        }),+    }+}+ /// `swx_dismiss_blocking_dialogs` — REPORT by default; closing is opt-in. /// /// Learned live, the hard way, on 2026-09-02: closing a stuck SOLIDWORKS modal

@@ -748,12 +748,14 @@ fn the_same_window_over_a_disabled_frame_blocks_and_says_why() {  // ── 0.9.5 (adversary pass 42): PRIMING'S OTHER END, AND QUIT DURING STARTUP ─ -/// A SESSION THAT HAS HELD A DOCUMENT IS NEVER PRIMED. Both ends of the rule:-/// the bridge RECORDS that the session held one (a scratch part, created and-/// closed), and the prime's guard READS it — so a declined rung (a) on that-/// session stands, nothing is created, and the attempt says why.+/// THE SESSION'S HISTORY IS ADVISORY — NEVER A GUARD ON PRIMING (0.9.6, P1).+/// Live 2026-10-01 (pid 29108): a false `everHadDocument:true` made the guard+/// refuse to prime, and the quit was declined twice. The trigger is the+/// measured condition itself: rung (a) declined, the session empty, no blocking+/// dialog, userAuthorized. Here the history is TRUE (the bridge made and closed+/// a part) and the session is still primed once and asked again. #[test]-fn a_session_that_has_held_a_document_is_never_primed() {+fn a_session_that_has_held_a_document_is_still_primed_when_empty() {     let m = Sim::new("quit-prime-held", json!({"a": "declined"}));     let b = m.boot(&[]);     b.call("swx_start", json!({}));@@ -764,22 +766,63 @@ fn a_session_that_has_held_a_document_is_never_primed() {     let st = b.call("swx_status", json!({}));     check!(         b,-        "swx_status: the session is recorded as having held a document",-        st["solidworks"]["sessionHistory"]["everHadDocument"] == true,+        "swx_status: the session is recorded as having held a document (advisory)",+        st["solidworks"]["sessionHistory"]["everHadDocument"] == true+            && st["solidworks"]["sessionHistory"]["advisory"] == true,         s(&st["solidworks"]["sessionHistory"])     );     let r = b.call("swx_stop", authorized("a"));     let tries = r["rungsTried"].as_array().cloned().unwrap_or_default();     check!(         b,-        "swx_stop: the decline stands, unprimed, and says the session has held documents",-        r["stopped"] == false-            && tries.len() == 1+        "swx_stop: declined, primed ONCE, asked again — whatever the history says",+        tries.len() == 2             && tries[0]["result"] == "declined"-            && tries[0]["detail"].as_str().unwrap_or("").contains("has held documents"),+            && tries[0]["primed"] == false+            && tries[1]["primed"] == true,+        s(&r)+    );+    check!(b, "swx_stop: the prime is in the ledger", ledger_has(&b, "quit_prime"), String::new());+}++/// A PHANTOM DOCUMENT COUNT NEVER RECORDS HISTORY, AND PRIMING STILL FIRES. The+/// live shape (pid 29108): a session nobody opened a document in read a non-zero+/// count while starting. Simulated twice over: a count of 1 for as long as the+/// start is incomplete, and — after the start — a count of 1 on ONE poll only.+/// Neither is evidence; the declined quit is primed and SOLIDWORKS quits.+#[test]+fn a_phantom_document_count_never_records_history_and_priming_still_fires() {+    let m = Sim::new("quit-prime-phantom", json!({"a": "exitedIfEverHadDocument"}));+    let b = m.boot(&[]);+    std::fs::write(b.scratch.join("mock-startup-incomplete"), "").unwrap();+    std::fs::write(b.scratch.join("mock-phantom-doc-while-starting"), "").unwrap();+    b.call("swx_start", json!({}));+    // Polls 400 ms apart for 1.6 s: a count read while starting, persisting —+    // still never evidence.+    for _ in 0..5 {+        b.call("swx_status", json!({}));+        std::thread::sleep(std::time::Duration::from_millis(400));+    }+    std::fs::remove_file(b.scratch.join("mock-startup-incomplete")).unwrap();+    std::fs::write(b.scratch.join("mock-phantom-doc-once"), "").unwrap();+    b.call("swx_status", json!({}));+    std::thread::sleep(std::time::Duration::from_millis(1100));+    let st = b.call("swx_status", json!({}));+    let h = &st["solidworks"]["sessionHistory"];+    check!(+        b,+        "swx_status: neither a count read while starting nor a one-poll count records a document",+        h["everHadDocument"] != true,+        s(h)+    );+    let r = b.call("swx_stop", authorized("a"));+    let tries = r["rungsTried"].as_array().cloned().unwrap_or_default();+    check!(+        b,+        "swx_stop: declined, primed, and then it quits",+        r["stopped"] == true && tries.len() == 2 && tries[1]["primed"] == true && tries[1]["result"] == "quit",         s(&r)     );-    check!(b, "swx_stop: ...and no scratch part was made to prime it", !ledger_has(&b, "quit_prime"), String::new()); }  /// `false` MEANS "NONE SEEN BY THIS BRIDGE", and says so.

@@ -505,9 +505,17 @@ fn an_on_demand_add_in_needs_quiet_and_is_never_the_3dexperience_add_in() {         ),         (             "ready-ondemand-3dx",-            "<LOAD_ADDIN> 3DEXPERIENCE\n<3DXLOAD_TIME>24000</3DXLOAD_TIME>\n<LOAD_ADDIN> SolidWorks Toolbox\n<LOAD_ADDIN> 3DEXPERIENCE\n",+            "<LOAD_ADDIN> 3DEXPERIENCE\n<3DXLOAD_TIME>24000</3DXLOAD_TIME>\n<LOAD_ADDIN> SolidWorks Toolbox\n\+             <LOAD_ADDIN> \"SWK3DCompassAddin.dll\" \"3DEXPERIENCE for WORKS\"\n",             300,-            "a quiet log whose LOAD_ADDIN after the marker names the 3DEXPERIENCE add-in",+            "a quiet log whose LOAD_ADDIN after the marker is the platform add-in (SWK3DCompassAddin.dll)",+        ),+        (+            "ready-header-scope",+            "<LOAD_ADDIN> old\n<3DXLOAD_TIME>24000</3DXLOAD_TIME>\n; SolidWorks generated log file - do not edit.\n\+             <VERSION> 6</VERSION>\n<PROC_NUM>8</PROC_NUM>\n",+            0,+            "a marker from BEFORE the start's header (the file is rewritten at every start)",         ),     ] {         let scratch = TempDir::new(tag);@@ -542,6 +550,25 @@ fn an_on_demand_add_in_needs_quiet_and_is_never_the_3dexperience_add_in() {         r["errorCode"] == "host_app_starting" && r["startingUnverifiable"] == true,         s(&r)     );+    // An add-in whose NAME carries "3DEXPERIENCE" but is not the platform —+    // measured 2026-10-01: SaveFolderTo3DEXPERIENCEAddin2.DLL — loaded after the+    // marker in a quiet log is on-demand, not a start.+    let scratch = TempDir::new("ready-ondemand-savefolder");+    session(&scratch, json!([]));+    let logp = write_log(+        &scratch,+        "<LOAD_ADDIN> \"SWK3DCompassAddin.dll\" \"3DEXPERIENCE for WORKS\"\n<3DXINITERROR>0\n\+         <LOAD_ADDIN> \"SaveFolderTo3DEXPERIENCEAddin2.DLL\" \"Batch Save to 3DEXPERIENCE\"\n",+        120,+    );+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[("SWX_PERF_LOG", &logp)]);+    let st = b.call("swx_start", json!({}));+    check!(+        b,+        "swx_start: a non-platform add-in naming 3DEXPERIENCE, after the marker, quiet => on demand, ready",+        st["ready"] == true && st["readiness"]["performanceLog"]["verdict"] == "onDemandAddInAfterComplete",+        s(&st)+    );     // ...and the on-demand case itself, with the rule's basis in the answer.     let scratch = TempDir::new("ready-ondemand-ok");     session(&scratch, json!([]));@@ -562,11 +589,12 @@ fn an_on_demand_add_in_needs_quiet_and_is_never_the_3dexperience_add_in() {     ); } -/// A DOCUMENT SEEN AT ANY POLL IS RECORDED. The user's own document, open when-/// the bridge first looks, never passed through a verb that "made one" — the-/// readiness poll's GetDocumentCount records it.+/// A DOCUMENT THAT PERSISTS ACROSS TWO POLLS IS RECORDED (0.9.6). The user's+/// own document, open when the bridge first looks, never passed through a verb+/// that "made one": the readiness polls record it — once the count has been+/// > 0 on two distinct polls of the STARTED session, never from one read. #[test]-fn a_document_seen_at_any_poll_marks_the_session() {+fn a_document_that_persists_across_two_polls_marks_the_session() {     let scratch = TempDir::new("ready-poll-marks");     session(         &scratch,@@ -575,11 +603,97 @@ fn a_document_seen_at_any_poll_marks_the_session() {     );     let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);     b.call("swx_start", json!({}));+    let first = b.call("swx_status", json!({}));+    let h1 = first["solidworks"]["sessionHistory"].clone();+    check!(+        b,+        "swx_status: what the poll saw is recorded, with its count",+        h1["observations"].as_array().map(|a| a.iter().any(|o| o["count"] == 1)).unwrap_or(false),+        s(&h1)+    );+    std::thread::sleep(std::time::Duration::from_millis(1100));     let st = b.call("swx_status", json!({}));     check!(         b,-        "swx_status: the session has held a document, recorded by the poll",-        st["solidworks"]["sessionHistory"]["everHadDocument"] == true,+        "swx_status: the count persisted across two polls — the session has held a document",+        st["solidworks"]["sessionHistory"]["everHadDocument"] == true+            && st["solidworks"]["sessionHistory"]["advisory"] == true,         s(&st["solidworks"])     ); }++/// EVERY GATED VERB SAYS WHAT THE GATE SAW (0.9.6, G3) — on success as well as+/// on refusal — so a live run can prove no COM verb ran while starting. Including+/// the arms that return straight from the handler table (swx_show_*, exports).+#[test]+fn every_gated_reply_carries_the_readiness_the_gate_evaluated() {+    let scratch = TempDir::new("ready-at-gate");+    session(&scratch, json!([]));+    std::fs::write(scratch.join("mock-startup-incomplete"), "").unwrap();+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);+    b.call("swx_start", json!({}));+    let refused = b.call("swx_docs", json!({}));+    check!(+        b,+        "refusal: readiness.ready false, with basedOn",+        refused["errorCode"] == "host_app_starting"+            && refused["readiness"]["ready"] == false+            && refused["readiness"]["basedOn"].as_array().map(|a| !a.is_empty()).unwrap_or(false),+        s(&refused)+    );+    std::fs::remove_file(scratch.join("mock-startup-incomplete")).unwrap();+    for (verb, args) in [+        ("swx_docs", json!({})),+        ("swx_new_document", json!({"type": "part"})),+        ("swx_show_part", json!({"path": "C:\\Users\\drew\\work\\nothing-here.SLDPRT"})),+        ("swx_get_app_state", json!({})),+    ] {+        let r = b.call(verb, args);+        check!(+            b,+            &format!("{verb}: the reply carries readiness as evaluated at the gate"),+            r["readiness"]["evaluatedAt"] == "gate"+                && r["readiness"]["ready"] == true+                && r["readiness"]["basedOn"].as_array().map(|a| !a.is_empty()).unwrap_or(false),+            s(&r)+        );+    }+    let free = b.call("swx_find_files", json!({"root": "/nonexistent"}));+    check!(b, "an exempt verb is not gated and says nothing of a gate", free["readiness"].is_null(), s(&free));+}++/// THE TWO-POLL RULE, both edges (0.9.6). Two counts > 0 read within a second+/// are one blip, not persistence; and a zero between two counts breaks the run.+#[test]+fn a_blip_or_an_interrupted_count_never_records_a_document() {+    let scratch = TempDir::new("ready-blip");+    session(&scratch, json!([]));+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);+    b.call("swx_start", json!({}));+    // A blip: a count of 1 on two reads close together, then 0.+    std::fs::write(scratch.join("mock-phantom-doc-once"), "2").unwrap();+    b.call("swx_docs", json!({}));+    b.call("swx_docs", json!({}));+    std::thread::sleep(std::time::Duration::from_millis(1100));+    let st = b.call("swx_status", json!({}));+    check!(+        b,+        "two counts > 0 within a second, then zero: not a document",+        st["solidworks"]["sessionHistory"]["everHadDocument"] != true,+        s(&st["solidworks"]["sessionHistory"])+    );+    // Interrupted: 1 ... 0 ... (a second later) 1.+    std::fs::write(scratch.join("mock-phantom-doc-once"), "1").unwrap();+    std::fs::remove_file(scratch.join("mock-phantom-doc-once.used")).unwrap();+    b.call("swx_docs", json!({}));+    b.call("swx_docs", json!({}));+    std::thread::sleep(std::time::Duration::from_millis(1100));+    std::fs::remove_file(scratch.join("mock-phantom-doc-once.used")).unwrap();+    let st = b.call("swx_status", json!({}));+    check!(+        b,+        "a count, a zero, a count a second later: the zero breaks the run — not a document",+        st["solidworks"]["sessionHistory"]["everHadDocument"] != true,+        s(&st["solidworks"]["sessionHistory"])+    );+}

@@ -358,6 +358,26 @@ def identity_of(rows):     return (sw[0]["pid"], sw[0]["created"]) if sw else None  +def dialog_verdict(judged):+    """The BRIDGE's verdict decides, never a raw window list. Returns+    ("clear" | "blocking" | "unknown", message). Only a BLOCKING dialog is handed+    to the user (a screenshot, their decision); a notification is listed and the+    gate goes on; an unreadable census refuses without blaming the user's screen."""+    if not isinstance(judged, dict) or judged.get("readable") is not True:+        return ("unknown", "the bridge could not judge the dialogs on screen (%s) — whether one "+                           "blocks is UNKNOWN, so the gate does not quit on a guess. Nothing was "+                           "attempted." % ((judged or {}).get("why") if isinstance(judged, dict) else judged))+    b = judged.get("blocking")+    if b:+        return ("blocking", "a BLOCKING dialog is on screen (title=%r kind=%s: %s). This bridge never "+                            "answers one, and a gate must not either. A blocking dialog is the one "+                            "thing that is genuinely the user's to answer — show them a screenshot "+                            "(swx_state) and let them decide. Closing documents is NOT theirs to do: "+                            "the sweep does that." % (b.get("title"), b.get("kind"), b.get("why")))+    return ("clear", "no blocking dialog (%d notification(s) listed, never answered)"+            % len(judged.get("notifications") or []))++ def is_dialog(w):     return str(w.get("class") or "") == "#32770" @@ -408,6 +428,12 @@ def baseline():         print("  SC_CLOSE on the main frame: 0x%X — Close is %s" %               (state, "DISABLED" if state & 0x3 else "ENABLED")) +    # THE BRIDGE'S VERDICT on those windows (0.9.6, G2): blocking vs notification,+    # judged by measured modality and by the window's words. A visible #32770 is+    # NOT a dialog somebody must answer — the 3DEXPERIENCE "Connected" notice+    # (title '') is one, and refusing on it made this gate refuse its own baseline.+    judged = verb("swx_window_info", {}, 60).get("dialogCensus")+    show("the bridge's dialog census (blocking vs notification)", judged)     st = verb("swx_status", {}, 60)     app = verb("swx_get_app_state", {}, 60)     show("swx_status.solidworks (the bridge's own reading, recorded, not trusted)",@@ -427,7 +453,7 @@ def baseline():     # gate ASSERTED that in its docstring and checked nothing.     require_bridge_launched(st, created)     return {"pid": pid, "created": created, "procs": rows, "windows": wins,-            "dialogs": dialogs, "status": st, "app": app}+            "dialogs": dialogs, "judged": judged, "status": st, "app": app}   def to_epoch(iso):@@ -623,13 +649,14 @@ def prove_zero_documents(base):     if isinstance(listed, list) and len(listed) != 0:         raise Refused("the count says 0 but the enumeration lists %d — they DISAGREE, so neither "                       "is evidence." % len(listed))-    if base["dialogs"]:-        raise Refused("a dialog is on screen (%s). This bridge never answers one, and a gate must "-                      "not either. A DIALOG is the one thing that is genuinely the user's to answer — "-                      "this bridge never answers one — so show them a screenshot (swx_state) and "-                      "let them decide. Closing documents is NOT theirs to do: the sweep above "-                      "does that." %-                      [w.get("title") for w in base["dialogs"]])+    claim, why = dialog_verdict(base.get("judged"))+    if claim == "blocking":+        raise Refused(why)+    if claim == "unknown":+        raise Refused(why)+    for n in (base.get("judged") or {}).get("notifications") or []:+        print("  NOTIFICATION on screen (not blocking, never answered): title=%r kind=%s why=%s"+              % (n.get("title"), n.get("kind"), n.get("why")))     if base["status"].get("solidworks", {}).get("busy") is True:         raise Refused("SOLIDWORKS reports BUSY — a rung would land on a modal operation.")     check(True, "0 documents, 0 unsaved, count agrees with the enumeration, no dialog")@@ -776,12 +803,34 @@ def self_test():         if got != want or (len(FAILURES) > before) == want:             bad.append(label)     del FAILURES[:]+    # THE DIALOG VERDICT (0.9.6, G2): the measured Connected notice — title '',+    # judged a notification by the bridge — must NOT refuse the gate; a blocking+    # dialog must; an unreadable census must refuse WITHOUT telling the reader to+    # hand a dialog to the user.+    notice = {"title": "", "kind": "notification", "blocking": False,+              "why": "a tool window whose owner frame is ENABLED"}+    verdicts = [+        ("the Connected notification alone", {"readable": True, "blocking": None, "notifications": [notice]}, "clear"),+        ("a blocking save prompt", {"readable": True, "blocking": {"title": "SOLIDWORKS", "kind": "save_changes",+                                    "why": "by its text"}, "notifications": [notice]}, "blocking"),+        ("an unreadable census", {"readable": False, "why": "no process census"}, "unknown"),+        ("no census at all", None, "unknown"),+    ]+    for label, judged, want in verdicts:+        got, msg = dialog_verdict(judged)+        if got != want:+            bad.append("dialog verdict: " + label)+        if want == "unknown" and "screenshot" in msg:+            bad.append("dialog verdict: an unreadable census told the reader to show the user a screenshot")+        if want == "clear" and "screenshot" in msg:+            bad.append("dialog verdict: a notification was handed to the user")     print("\n" + "=" * 72)     if bad:         print("SELF-TEST FAILED — the status claim gave the wrong verdict for: " + "; ".join(bad))         return 1     print("SELF-TEST PASSED — the status claim FAILS on a declined quit and an unreadable status, "-          "and PASSES only on running:false.")+          "and PASSES only on running:false; the dialog verdict lists a notification and refuses "+          "only on a blocking dialog or an unreadable census.")     return 0