SOLIDWORKS Bridge

@@ -465,6 +465,18 @@ pub trait LaunchOs: Send + Sync {         Err("this host cannot read dialog contents".into())     } +    /// THE FOREGROUND WINDOW, for the user-presence guard (0.9.9): `Ok(None)`+    /// when no window has the foreground; `Err` = could not look, which the+    /// guard treats as PRESENT.+    fn foreground_window(&self) -> Result<Option<ForegroundWindow>, String> {+        Err("this host cannot read the foreground window".into())+    }+    /// SECONDS SINCE THE LAST USER INPUT, system-wide (GetLastInputInfo). `Err`+    /// = could not read, which the guard treats as PRESENT.+    fn seconds_since_last_input(&self) -> Result<u64, String> {+        Err("this host cannot read the last-input time".into())+    }+     /// RE-READ ONE WINDOW'S OWNER: is the frame that owns `hwnd` enabled right     /// now? `None` = no owner, or the read failed — UNKNOWN, never "enabled".     /// The owner-state settle (0.9.8) reads this several times, because a frame@@ -485,6 +497,15 @@ pub trait LaunchOs: Send + Sync {     fn kind(&self) -> &'static str; } +/// The window that has the foreground, and the process that owns it.+#[derive(Clone, Debug, Default)]+pub struct ForegroundWindow {+    pub hwnd: i64,+    pub pid: u32,+    pub title: String,+    pub class_name: String,+}+ pub fn epoch_secs() -> u64 {     SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0) }@@ -1159,6 +1180,35 @@ impl LaunchOs for FakeOs {         })     } +    /// `foreground.json`: `{"hwnd","pid","title","className"}`, or absent / `{}`+    /// for "no window has the foreground". `presence-unreadable` makes both+    /// presence reads fail.+    fn foreground_window(&self) -> Result<Option<ForegroundWindow>, String> {+        if self.dir.join("presence-unreadable").exists() {+            return Err("simulated: the foreground window could not be read".into());+        }+        let v = self.read_json("foreground.json");+        let Some(hwnd) = v.get("hwnd").and_then(|h| h.as_i64()) else { return Ok(None) };+        Ok(Some(ForegroundWindow {+            hwnd,+            pid: v.get("pid").and_then(|p| p.as_u64()).unwrap_or(0) as u32,+            title: v.get("title").and_then(|t| t.as_str()).unwrap_or("").to_string(),+            class_name: v.get("className").and_then(|t| t.as_str()).unwrap_or("").to_string(),+        }))+    }++    /// `last-input-secs` holds the seconds since the last user input; absent =+    /// an idle machine (an hour).+    fn seconds_since_last_input(&self) -> Result<u64, String> {+        if self.dir.join("presence-unreadable").exists() {+            return Err("simulated: the last-input time could not be read".into());+        }+        Ok(std::fs::read_to_string(self.dir.join("last-input-secs"))+            .ok()+            .and_then(|t| t.trim().parse().ok())+            .unwrap_or(3600))+    }+     /// The scenario's row for `hwnd` may carry `ownerEnabledReads: [false,     /// false, true]` — one value per re-read, the last repeating; otherwise its     /// `ownerEnabled` holds for every read.@@ -1664,6 +1714,44 @@ mod win {             Ok(out)         } +        fn foreground_window(&self) -> Result<Option<ForegroundWindow>, String> {+            use windows::Win32::UI::WindowsAndMessaging::{+                GetClassNameW, GetForegroundWindow, GetWindowTextW, GetWindowThreadProcessId,+            };+            unsafe {+                let h = GetForegroundWindow();+                if h.0.is_null() {+                    return Ok(None);+                }+                let mut pid = 0u32;+                if GetWindowThreadProcessId(h, Some(&mut pid)) == 0 || pid == 0 {+                    return Err("GetWindowThreadProcessId failed on the foreground window".into());+                }+                let mut class = [0u16; 256];+                let mut title = [0u16; 512];+                let cl = GetClassNameW(h, &mut class);+                let tl = GetWindowTextW(h, &mut title);+                Ok(Some(ForegroundWindow {+                    hwnd: h.0 as i64,+                    pid,+                    title: String::from_utf16_lossy(&title[..tl.max(0) as usize]),+                    class_name: String::from_utf16_lossy(&class[..cl.max(0) as usize]),+                }))+            }+        }++        fn seconds_since_last_input(&self) -> Result<u64, String> {+            use windows::Win32::System::SystemInformation::GetTickCount;+            use windows::Win32::UI::Input::KeyboardAndMouse::{GetLastInputInfo, LASTINPUTINFO};+            unsafe {+                let mut info = LASTINPUTINFO { cbSize: std::mem::size_of::<LASTINPUTINFO>() as u32, dwTime: 0 };+                if !GetLastInputInfo(&mut info).as_bool() {+                    return Err("GetLastInputInfo failed".into());+                }+                Ok((GetTickCount().wrapping_sub(info.dwTime) / 1000) as u64)+            }+        }+         fn owner_enabled_of(&self, hwnd: i64) -> Option<bool> {             use windows::Win32::UI::WindowsAndMessaging::{GetWindow, GetWindowLongPtrW, GWL_STYLE, GW_OWNER};             unsafe {

@@ -0,0 +1,338 @@+//! IS THE USER WORKING IN THIS SOLIDWORKS? — the user-presence guard (0.9.9).+//!+//! MEASURED 2026-10-01 on hosted 0.9.8: a "leave the machine as found"+//! `swx_stop` on a bridge-launched, relaunched, EMPTY-LOOKING session returned+//! `stop_blocked_by_dialog` — the dialog was SOLIDWORKS's own File Open dialog,+//! because DREW HAD STARTED USING THE SESSION. Minutes later it held 34+//! documents: his crate assembly and its parts. Nothing was lost only because+//! his dialog happened to be up; a session he had just brought to the front+//! would have been quit under him, and a sweep a minute later would have closed+//! his documents. The bridge had no notion that the USER had taken over a+//! session it launched.+//!+//! So, before every verb that ENDS work — swx_stop, swx_shutdown,+//! swx_close_all_safely, swx_close_all_documents, swx_reset_workspace, and the+//! quit ladder's priming — presence is MEASURED:+//!+//!   * is a SOLIDWORKS window (the session's process or one of its children)+//!     the FOREGROUND window, and how long since the last user input+//!     (system-wide) — foreground AND input within `idle_secs()` (120 s);+//!   * have documents appeared that the bridge did not open — any document+//!     not in the set the bridge last looked at, which is refreshed after every+//!     verb the bridge runs that can add one;+//!   * was the session already marked `takenOverByUser`.+//!+//! PRESENT refuses `user_is_active` with the evidence. An unreadable+//! measurement is PRESENT (fail closed) — but only POSITIVE evidence marks the+//! session taken over, persistently for its (pid, creation time): from then on+//! the bridge never ends or sweeps it without `userPresentOverride:true` ++//! `userAuthorized:true` + a reason, even after the user steps away.+//! Attribution of the launch stays; authority to end the session does not.++use serde_json::{json, Value};++/// Input within this many seconds, with SOLIDWORKS in the foreground, is a+/// user at the keyboard. `SWX_PRESENCE_IDLE_SECS` overrides.+pub fn idle_secs() -> u64 {+    std::env::var("SWX_PRESENCE_IDLE_SECS").ok().and_then(|v| v.trim().parse().ok()).unwrap_or(120)+}++/// The verbs that end a user's work, and so are guarded.+pub const GUARDED: &[&str] = &[+    "swx_stop",+    "swx_shutdown",+    "swx_close_all_safely",+    "swx_close_all_documents",+    "swx_reset_workspace",+];++fn path() -> std::path::PathBuf {+    crate::scratch::root().join("presence.json")+}++fn key(pid: u32, created: Option<u64>) -> String {+    format!("{pid}:{}", created.map(|c| c.to_string()).unwrap_or_else(|| "?".into()))+}++fn load() -> serde_json::Map<String, Value> {+    std::fs::read_to_string(path())+        .ok()+        .and_then(|t| serde_json::from_str::<Value>(&t).ok())+        .and_then(|v| v.as_object().cloned())+        .unwrap_or_default()+}++fn save(mut m: serde_json::Map<String, Value>) {+    while m.len() > 20 {+        let oldest = m+            .iter()+            .min_by_key(|(_, v)| v.get("atMs").and_then(|a| a.as_u64()).unwrap_or(0))+            .map(|(k, _)| k.clone());+        match oldest {+            Some(o) => {+                m.remove(&o);+            }+            None => break,+        }+    }+    let _ = crate::launch::write_atomic(&path(), &Value::Object(m).to_string());+}++fn entry(k: &str) -> Value {+    load().get(k).cloned().unwrap_or_else(|| json!({}))+}++fn put(k: &str, v: Value) {+    let mut m = load();+    let mut v = v;+    if let Value::Object(o) = &mut v {+        o.insert("atMs".into(), json!(crate::launchos::epoch_ms() as u64));+    }+    m.insert(k.to_string(), v);+    save(m);+}++/// The running session: (pid, creation time, documents, truncated). `None`+/// when SOLIDWORKS is not running or the host cannot say.+struct Session {+    pid: u32,+    created: Option<u64>,+    docs: Vec<String>,+    count: Option<u64>,+    titles: std::collections::HashMap<String, String>,+}++fn doc_key(d: &Value) -> String {+    let p = d.get("path").and_then(|p| p.as_str()).unwrap_or("");+    if !p.is_empty() {+        p.replace('/', "\\").to_lowercase()+    } else {+        format!("title:{}", d.get("title").and_then(|t| t.as_str()).unwrap_or("").to_lowercase())+    }+}++fn session(ctx: &crate::verbs::Ctx) -> Option<Session> {+    let st = ctx.call("app_state", json!({}), 30).ok()?;+    if st.get("running").and_then(|v| v.as_bool()) == Some(false) {+        return None;+    }+    let pid = st.get("processId").and_then(|v| v.as_u64()).map(|p| p as u32)?;+    let created = crate::launchos::os()+        .processes()+        .ok()+        .and_then(|ps| ps.iter().find(|p| p.pid == pid).and_then(|p| p.created_at))+        .or_else(|| ctx.call("startup_state", json!({}), 20).ok().and_then(|s| s.get("processCreatedAt").and_then(|v| v.as_u64())));+    let truncated = st.get("documentsTruncated").and_then(|v| v.as_bool()).unwrap_or(false);+    let list: Vec<Value> = st.get("documents").and_then(|d| d.as_array()).cloned().unwrap_or_default();+    let mut titles = std::collections::HashMap::new();+    let docs: Vec<String> = if truncated {+        Vec::new()+    } else {+        list.iter()+            .map(|d| {+                let k = doc_key(d);+                titles.insert(k.clone(), d.get("title").and_then(|t| t.as_str()).unwrap_or("").to_string());+                k+            })+            .collect()+    };+    let count = st+        .get("documentCount")+        .and_then(|v| v.as_u64())+        .or_else(|| (!truncated).then_some(docs.len() as u64));+    Some(Session { pid, created, docs, count, titles })+}++/// THE BRIDGE LOOKED: the documents open right now are known to it. Called+/// after every verb the bridge runs that can change the document set, and by a+/// presence check that finds the user absent.+pub fn note_bridge_looked(ctx: &crate::verbs::Ctx) {+    let Some(s) = session(ctx) else { return };+    let k = key(s.pid, s.created);+    let mut e = entry(&k);+    if let Value::Object(o) = &mut e {+        o.insert("baselineDocs".into(), json!(s.docs));+        o.insert("baselineCount".into(), json!(s.count));+    }+    put(&k, e);+}++/// The running session's taken-over record, if it has one — for the reply of a+/// verb that adds a document to it (allowed: it adds, never removes).+pub fn taken_over_now(ctx: &crate::verbs::Ctx) -> Option<Value> {+    let st = ctx.call("startup_state", json!({}), 20).ok()?;+    let pid = st.get("processId").and_then(|v| v.as_u64()).map(|p| p as u32)?;+    let created = crate::launchos::os()+        .processes()+        .ok()+        .and_then(|ps| ps.iter().find(|p| p.pid == pid).and_then(|p| p.created_at))+        .or_else(|| st.get("processCreatedAt").and_then(|v| v.as_u64()));+    taken_over(pid, created).map(|e| {+        json!({"takenOverByUser": true, "evidence": e.get("evidence").cloned().unwrap_or(Value::Null),+               "note": "the user has taken over this session; documents may be added, and nothing \+                        will be closed or quit without the user-present override"})+    })+}++/// Is this session marked as taken over by the user?+pub fn taken_over(pid: u32, created: Option<u64>) -> Option<Value> {+    let e = entry(&key(pid, created));+    (e.get("takenOverByUser").and_then(|v| v.as_bool()) == Some(true)).then_some(e)+}++fn mark_taken_over(pid: u32, created: Option<u64>, evidence: &Value) {+    let k = key(pid, created);+    let mut e = entry(&k);+    if e.get("takenOverByUser").and_then(|v| v.as_bool()) == Some(true) {+        return;+    }+    if let Value::Object(o) = &mut e {+        o.insert("takenOverByUser".into(), json!(true));+        o.insert("takenOverAtMs".into(), json!(crate::launchos::epoch_ms() as u64));+        o.insert("evidence".into(), evidence.clone());+    }+    put(&k, e);+    crate::ledger::record("session_taken_over_by_user", json!({"pid": pid, "createdAt": created, "evidence": evidence}));+}++/// MEASURE PRESENCE. `(present, evidence)`.+pub fn measure(ctx: &crate::verbs::Ctx) -> Option<(bool, Value)> {+    let s = session(ctx)?;+    let os = crate::launchos::os();+    let k = key(s.pid, s.created);+    let e = entry(&k);+    let taken = e.get("takenOverByUser").and_then(|v| v.as_bool()) == Some(true);++    // FOREGROUND: the session's process, or one of its children (a sign-in+    // web view is a child process).+    let census = os.processes().ok();+    let children: Vec<u32> = census+        .as_ref()+        .map(|c| c.iter().filter(|p| p.ppid == Some(s.pid)).map(|p| p.pid).collect())+        .unwrap_or_default();+    let fg = os.foreground_window();+    let input = os.seconds_since_last_input();+    let simulator_without_scenario = crate::is_mock() && std::env::var(crate::launchos::ENV_FAKE_DIR).map(|d| d.is_empty()).unwrap_or(true);+    let (fg_json, fg_is_sw, fg_unreadable) = match &fg {+        Ok(Some(w)) => (+            json!({"hwnd": w.hwnd, "pid": w.pid, "title": w.title, "className": w.class_name}),+            w.pid == s.pid || children.contains(&w.pid),+            false,+        ),+        Ok(None) => (Value::Null, false, false),+        Err(e) => (json!({"unreadable": e}), false, true),+    };+    let (input_secs, input_unreadable) = match &input {+        Ok(n) => (Some(*n), false),+        Err(_) => (None, true),+    };+    // A simulated SOLIDWORKS with no presence scenario is on nobody's screen.+    let (fg_unreadable, input_unreadable) = if simulator_without_scenario {+        (false, false)+    } else {+        (fg_unreadable, input_unreadable)+    };+    let at_keyboard = fg_is_sw && input_secs.map(|n| n < idle_secs()).unwrap_or(false);++    // FOREIGN DOCUMENTS: open now, not in the set the bridge last looked at.+    let baseline: Option<Vec<String>> = e+        .get("baselineDocs")+        .and_then(|v| v.as_array())+        .map(|a| a.iter().filter_map(|x| x.as_str().map(String::from)).collect());+    let baseline_count = e.get("baselineCount").and_then(|v| v.as_u64());+    let foreign: Vec<String> = match &baseline {+        Some(b) => s.docs.iter().filter(|d| !b.contains(d)).cloned().collect(),+        None => Vec::new(),+    };+    let count_rose = match (baseline_count, s.count) {+        (Some(b), Some(n)) => n > b,+        _ => false,+    };+    let foreign_titles: Vec<String> =+        foreign.iter().map(|k| s.titles.get(k).cloned().unwrap_or_else(|| k.clone())).collect();+    let foreign_seen = !foreign.is_empty() || (count_rose && s.docs.is_empty());++    let unreadable = fg_unreadable || input_unreadable;+    let positive = at_keyboard || foreign_seen;+    let present = positive || unreadable || taken;+    let evidence = json!({+        "present": present,+        "foregroundWindow": fg_json,+        "foregroundIsSolidworks": fg_is_sw,+        "secondsSinceLastInput": input_secs,+        "idleThresholdSecs": idle_secs(),+        "foreignDocuments": {"count": foreign.len(), "titles": foreign_titles,+                              "countRoseWithoutTheBridge": count_rose},+        "takenOverByUser": taken || positive,+        "takenOverEarlier": taken,+        "measurementUnreadable": unreadable,+        "processId": s.pid,+        "processCreatedAt": s.created,+        "basis": if taken {+            "this session was taken over by the user earlier; the bridge does not end it without the override"+        } else if at_keyboard {+            "SOLIDWORKS is the foreground window and the user gave input recently"+        } else if foreign_seen {+            "documents appeared that this bridge did not open"+        } else if unreadable {+            "presence could not be measured, which counts as present"+        } else {+            "no sign of the user: SOLIDWORKS is not in the foreground with recent input, and no document appeared that the bridge did not open"+        },+    });+    if positive {+        mark_taken_over(s.pid, s.created, &evidence);+    }+    if !present {+        // The bridge looked, and the user is not here: this is the set it knows.+        let mut e = entry(&k);+        if let Value::Object(o) = &mut e {+            o.insert("baselineDocs".into(), json!(s.docs));+            o.insert("baselineCount".into(), json!(s.count));+        }+        put(&k, e);+    }+    Some((present, evidence))+}++/// THE GUARD, for a verb that ends work. `Ok(evidence)` lets it run (absent,+/// not running, or overridden); `Err(refusal)` is `user_is_active`.+pub fn guard(ctx: &crate::verbs::Ctx, verb: &str, args: &Value) -> Result<Value, Value> {+    let Some((present, evidence)) = measure(ctx) else {+        return Ok(json!({"present": Value::Null, "why": "no running SOLIDWORKS session to measure"}));+    };+    if !present {+        return Ok(evidence);+    }+    let overridden = args.get("userPresentOverride").and_then(|v| v.as_bool()) == Some(true)+        && args.get("userAuthorized").and_then(|v| v.as_bool()) == Some(true)+        && args.get("reason").and_then(|v| v.as_str()).map(|r| !r.trim().is_empty()).unwrap_or(false);+    if overridden {+        crate::ledger::record(+            "user_present_override",+            json!({"verb": verb, "reason": args.get("reason"), "evidence": evidence}),+        );+        let mut e = evidence;+        if let Value::Object(o) = &mut e {+            o.insert("overridden".into(), json!(true));+        }+        return Ok(e);+    }+    let mut out = crate::verbs::err_code(+        "user_is_active",+        format!(+            "{verb} refused: the user is working in this SOLIDWORKS ({}). The session is now the \+             user's — the bridge does not end it or sweep it.",+            evidence.get("basis").and_then(|b| b.as_str()).unwrap_or("present")+        ),+        "Nothing was closed, saved or quit. This session belongs to the person using it: leave \+         it alone. Only if the user has explicitly asked for it to be ended, pass \+         userPresentOverride:true together with userAuthorized:true and their reason — a sweep \+         under the override still preserves every document first.",+    );+    if let Value::Object(m) = &mut out {+        m.insert("userPresence".into(), evidence);+    }+    crate::ledger::record("user_present_refusal", json!({"verb": verb}));+    Err(out)+}

@@ -1546,7 +1546,8 @@ fn swx_stop(ctx: &Ctx, args: &Value) -> Value {             && attempt.dialog.is_none()             && user_authorized         {-            match prime_session(ctx, os.as_ref(), &id) {+            let presence_overridden = arg_bool(args, "userPresentOverride", false);+            match prime_session(ctx, os.as_ref(), &id, presence_overridden) {                 Ok(prime) => {                     crate::ledger::record(                         "solidworks_quit_rung",@@ -1855,6 +1856,7 @@ fn prime_session(     ctx: &Ctx,     os: &dyn crate::launchos::LaunchOs,     id: &crate::quit::Identity,+    presence_overridden: bool, ) -> Result<String, String> {     use crate::quit;     // THE SESSION'S HISTORY IS ADVISORY — reported, never a guard (0.9.6, P1).@@ -1864,6 +1866,17 @@ fn prime_session(     // rung (a) declined, the session empty (re-checked below), no blocking     // dialog, userAuthorized — once per swx_stop call.     let ever = crate::session_history::ever_had_document(id.pid, Some(id.created_at));+    // NEVER PRIME A SESSION THE USER IS IN (0.9.9): presence is measured again+    // here — the front gate's reading is a ladder rung old.+    if !presence_overridden {+        if let Some((true, evidence)) = crate::presence::measure(ctx) {+            return Err(format!(+                "the user is working in this session ({}) — the bridge does not create and close a \+                 document in it",+                evidence.get("basis").and_then(|b| b.as_str()).unwrap_or("present")+            ));+        }+    }     let count = ctx         .call("app_state", json!({}), 20)         .ok()@@ -2994,6 +3007,7 @@ pub const CATALOG: &[(&str, &str, &str)] = &[     ("swx_close_all_safely", "exec", "save EVERY open document into a recovery folder, then close it — nothing closes before it is on disk; needs only a reason"),     ("swx_shutdown", "exec", "close_all_safely, then quit SOLIDWORKS; idempotent, and the quit is skipped unless the session really emptied"),     ("swx_recover_list", "read", "what previous sweeps preserved, and where — newest first"),+    ("swx_user_presence", "read", "is the user working in this SOLIDWORKS? foreground + last input + documents the bridge did not open (the guard every quit and sweep passes)"),     ("swx_kill", "process", "force-kill SOLIDWORKS (reason + confirm; discards unsaved work)"),     ("swx_window_info", "read", "SOLIDWORKS' windows and its main hwnd (read-only, nothing raised)"),     ("swx_dismiss_blocking_dialogs", "exec", "census of blocking SOLIDWORKS dialogs; close:true is opt-in, gated, and never touches an unattributed window"),@@ -3027,6 +3041,27 @@ pub const CATALOG: &[(&str, &str, &str)] = &[     ("swx_export_dwg", "write", "export DWG (drawings; refused for a part on this edition)"), ]; +/// `swx_user_presence` — the presence measurement every quit and sweep is+/// guarded by, on its own (0.9.9). Read-only towards SOLIDWORKS; positive+/// evidence marks the session taken over by the user, exactly as the guard does.+fn swx_user_presence(ctx: &Ctx, _args: &Value) -> Value {+    match crate::presence::measure(ctx) {+        None => ok(json!({"present": Value::Null, "running": false,+                          "_hint": "No running SOLIDWORKS session to measure."})),+        Some((present, evidence)) => ok(json!({+            "present": present,+            "evidence": evidence,+            "_hint": if present {+                "The user is working in this SOLIDWORKS: swx_stop, swx_shutdown and every sweep \+                 refuse user_is_active. Leave the session alone; it is theirs."+            } else {+                "No sign of the user right now. This is a reading, not a promise — every verb that \+                 ends work measures again before it acts."+            },+        })),+    }+}+ fn swx_describe(_ctx: &Ctx, _args: &Value) -> Value {     let verbs: Vec<Value> = CATALOG         .iter()@@ -3192,10 +3227,46 @@ pub fn dispatch(ctx: &Ctx, command: &str, args: &Value) -> Value {         }     }     let args: &Value = gated_args.as_ref().unwrap_or(args);+    // THE USER-PRESENCE GUARD (0.9.9): a verb that ends work never runs on a+    // session the user is working in — measured, fail-closed. See+    // src/presence.rs.+    let mut presence: Option<Value> = None;+    if crate::presence::GUARDED.contains(&command) {+        match crate::presence::guard(ctx, command, args) {+            Ok(evidence) => presence = Some(evidence),+            Err(refusal) => {+                let mut refusal = refusal;+                if let (Some(summary), Value::Object(m)) = (at_gate.clone(), &mut refusal) {+                    m.entry("readiness").or_insert(summary);+                }+                return refusal;+            }+        }+    }     let mut out = dispatch_after_gate(ctx, command, args);     if let (Some(summary), Value::Object(m)) = (at_gate, &mut out) {         m.entry("readiness").or_insert(summary);     }+    if let (Some(evidence), Value::Object(m)) = (presence, &mut out) {+        m.entry("userPresence").or_insert(evidence);+    }+    if is_known(command) && startup_touch(command) == crate::readiness::Touch::Mutate+        && !is_startup_exempt(command)+    {+        // A verb that adds documents on a session the user has taken over is+        // allowed — it adds, never removes — and says so.+        if crate::session_history::ADDS_DOCUMENTS.contains(&command) {+            if let Some(t) = crate::presence::taken_over_now(ctx) {+                if let Value::Object(m) = &mut out {+                    m.insert("userPresent".into(), t);+                }+            }+        }+        // THE BRIDGE LOOKED: whatever this verb did to the document set is the+        // bridge's own doing, so it is the new baseline. A document that+        // appears between two bridge verbs is the user's.+        crate::presence::note_bridge_looked(ctx);+    }     out } @@ -3214,6 +3285,7 @@ fn dispatch_after_gate(ctx: &Ctx, command: &str, args: &Value) -> Value {         "swx_close_all_safely" => crate::verbs3::close_all_safely,         "swx_shutdown" => crate::verbs3::shutdown,         "swx_recover_list" => crate::verbs3::recover_list,+        "swx_user_presence" => swx_user_presence,         "swx_docs" => swx_docs,         "swx_find_files" => swx_find_files,         "swx_open" => swx_open,

@@ -0,0 +1,143 @@+//! ADVERSARIAL REVIEW OF 0.9.7 — pass forty-five, the last of this cycle.+//!+//! readiness.rs, perflog.rs, quit.rs and the dispatch gate compile here and were+//! exercised; com.rs and LiveOs are cfg(windows): READ, NOT RUN.+//!+//! WHAT CHECKS OUT+//!  * The pass-44 findings pass, and the platform add-in is now keyed on the DLL+//!    (`swk3dcompassaddin.dll`), not a word.+//!  * Underscore stripping: no handler reads any underscore-prefixed key except+//!    the dispatcher's own `_startupNotVerified`, so stripping ab's injected+//!    `_callerBudgetMs` changes nothing in the bridge — ab enforces its budget on+//!    its own side. Nothing caller-facing is lost.+//!  * swx_dismiss_blocking_dialogs on the Connected notice: its words are+//!    template placeholders ("Title", "Description", "Button1"…), which+//!    `classify_words` maps to `unknown`, which is never answered — refused.+//!  * (2) The 60 s quiet window decides only the NO-MARKER paths. A session+//!    whose marker is after its last LOAD_ADDIN is `complete` however busy the+//!    log is, so DocSave-time <PROCMEM> lines cannot hold a healthy platform+//!    start. The one place a session's own activity can hold it is a session+//!    that never loaded the platform add-in while somebody works by hand,+//!    saving more often than once a minute — and the bridge's own document+//!    commands are refused before the first ready, so it cannot keep the log+//!    busy itself. Availability, narrow; noted, not tested. Clock skew and+//!    coarse mtime shift the 60 s by seconds; they cannot fake a marker.++mod common;+use common::*;+use serde_json::{json, Value};++fn s(v: &Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++fn session(scratch: &TempDir) {+    std::fs::write(+        scratch.join("mock-solidworks-open-docs.json"),+        json!({"running": true, "untitled": 1, "active": Value::Null, "docs": [], "files": {}}).to_string(),+    )+    .unwrap();+}++const HEADER: &str = "; SolidWorks generated log file";+const COMPASS: &str = r#"<AD2> "LOAD_ADDIN" "SWK3DCompassAddin.dll" "3DEXPERIENCE for WORKS" [2.18] "6.34.0.2027" 14 COM.new 1770885081 13"#;+const TOOLBOX: &str = r#"<AD2> "LOAD_ADDIN" "SWToolbox.dll" "SOLIDWORKS Toolbox Library" [1.0] "34.0" 14 COM.new 1770885070 13"#;+const MARKER: &str = "<3DXLOAD_TIME>24000</3DXLOAD_TIME>";++/// SEVERITY 2 — AN UNREADABLE LOG IS TREATED AS NO LOG, AND NO LOG LETS COM+/// DECIDE ALONE.+///+/// `startup_complete` returns the same `Unavailable` for "no log to read" and+/// for "the performance log … could not be read", and the verdict table maps+/// `(Unavailable, Some(true))` to READY. So a log that EXISTS but cannot be+/// opened — locked, an ACL, an antivirus holding it, a path the process cannot+/// reach — hands the verdict to COM, which was MEASURED reporting complete before+/// the marker on a real start. That is the 10-01 crash window by a different+/// door.+///+/// Absent and unreadable are different facts. "No log" on a machine whose+/// SOLIDWORKS never writes one can defensibly leave COM alone; "a log I could+/// not read" says the edition DOES write one and this bridge simply did not see+/// it. That is `unverifiable` — reads after the grace, mutations refused — the+/// same answer the bridge already gives when nothing ties the log to the+/// session.+#[test]+fn a_log_that_exists_but_cannot_be_read_does_not_let_com_decide_alone() {+    use std::os::unix::fs::PermissionsExt;+    let scratch = TempDir::new("adv43-unreadable");+    session(&scratch);+    let log = scratch.join("SolidWorksPerformance.log");+    std::fs::write(&log, format!("{HEADER}\n{TOOLBOX}\n{COMPASS}\n")).unwrap();+    std::fs::set_permissions(&log, std::fs::Permissions::from_mode(0o000)).unwrap();+    let unreadable = std::fs::read(&log).is_err();+    let logp = log.to_string_lossy().to_string();+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[("SWX_PERF_LOG", &logp)]);+    b.call("swx_start", json!({}));+    let r = b.call("swx_new_document", json!({"type": "part"}));+    let _ = std::fs::set_permissions(&log, std::fs::Permissions::from_mode(0o644));+    assert!(unreadable, "precondition: this user cannot read the file (not running as root)");++    assert!(+        r["errorCode"] == json!("host_app_starting"),+        "the performance log EXISTS and could not be read — and its contents, had they been \+         readable, say a start is loading (the platform add-in loaded, no marker). The bridge \+         treated \"could not be read\" exactly like \"there is no log\" and let COM — measured true \+         before the marker — decide alone: swx_new_document ran. Unreadable is unverifiable, not \+         absent. {}",+        s(&r)+    );+}++/// SEVERITY 2 — THE READY LATCH IS KEYED BY PID ALONE, SO A NEW SESSION THAT+/// REUSES THE PID IS BORN READY.+///+/// `SESSIONS: HashMap<i64, Seen>` — the key is the process id; `seen.ready`, once+/// true, short-circuits every later assessment (`alreadyReadyThisSession`). The+/// process CREATION TIME is computed two lines earlier and not part of the key.+/// Windows reissues pids, and the map lives as long as the bridge server — so a+/// SOLIDWORKS quit and relaunched in one bridge lifetime that happens to get the+/// same pid skips the whole gate: no log, no COM, no grace. Ready at second 0 —+/// the crash window again. Everything else in this bridge that identifies a+/// session (session history, the quit ladder's `same_process`) keys on pid ++/// creation time; this is the one that does not.+///+/// It survives a com-host respawn (correct — the map is in the server), and a+/// server restart empties it (also correct). The fix is the key: (pid,+/// creation time).+#[test]+fn a_new_session_that_reuses_the_pid_does_not_inherit_ready() {+    let scratch = TempDir::new("adv43-pidreuse");+    session(&scratch);+    let log = scratch.join("SolidWorksPerformance.log");+    // Session one: a completed start, written since the (hour-old) process began.+    std::fs::write(&log, format!("{HEADER}\n{TOOLBOX}\n{COMPASS}\n{MARKER}\n")).unwrap();+    let logp = log.to_string_lossy().to_string();+    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[("SWX_PERF_LOG", &logp)]);+    let first = b.call("swx_start", json!({}));+    let pid1 = first["readiness"]["processId"].clone();+    let made = b.call("swx_new_document", json!({"type": "part"}));+    assert!(made["success"] == json!(true), "precondition: session one became ready: {}", s(&made));++    // Session two: SOLIDWORKS relaunched, the SAME pid reissued, created NOW,+    // and its log (rewritten at start) shows add-ins loading with no marker.+    let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs();+    std::fs::write(scratch.join("mock-sldworks-created"), now.to_string()).unwrap();+    std::fs::write(&log, format!("{HEADER}\n{TOOLBOX}\n{COMPASS}\n")).unwrap();+    let st = b.call("swx_status", json!({}));+    let r = b.call("swx_new_document", json!({"type": "part"}));+    let text = s(&st);+    assert!(+        text.contains(&format!("\"processCreatedAt\": {now}")) && pid1.is_number(),+        "precondition: a new process (created {now}) with pid {pid1} — status: {text}"+    );++    assert!(+        r["errorCode"] == json!("host_app_starting"),+        "a NEW SOLIDWORKS process — created just now, its log showing add-ins loading and no marker \+         — reused the pid of a session the bridge had already seen ready, and the latch \+         (`alreadyReadyThisSession`, keyed by pid alone) waved swx_new_document through without \+         reading the log or COM. Key the latch by (pid, creation time), as every other session \+         identity in this bridge is keyed. {}",+        s(&r)+    );+}

@@ -0,0 +1,217 @@+//! THE USER-PRESENCE GUARD (0.9.9) — never end a session the user is working in.+//!+//! MEASURED 2026-10-01 on hosted 0.9.8: a "leave the machine as found" swx_stop+//! on a bridge-launched, relaunched, empty-looking session hit SOLIDWORKS's own+//! File Open dialog — Drew had started using the session, and minutes later it+//! held 34 of his documents. Nothing was lost only because his dialog happened+//! to be up. Every verb that ends work now measures presence first: SOLIDWORKS+//! in the foreground with recent input, or documents the bridge did not open,+//! or an earlier take-over — and an unreadable measurement counts as present.++mod common;++use common::{Bridge, TempDir};+use serde_json::{json, Value};++fn s(v: &Value) -> String {+    serde_json::to_string_pretty(v).unwrap_or_default()+}++/// A simulated machine with a scripted quit ladder.+struct Sim {+    dir: TempDir,+}++impl Sim {+    fn new(tag: &str) -> Sim {+        let dir = TempDir::new(tag);+        std::fs::write(dir.join("quit-script.json"), json!({"a": "exited"}).to_string()).unwrap();+        std::fs::write(+            dir.join("sldworks.json"),+            json!({"responding": true, "hwnd": 6622700, "privateMB": 900, "handles": 4000}).to_string(),+        )+        .unwrap();+        Sim { dir }+    }++    fn boot(&self) -> Bridge {+        let b = Bridge::start_in(+            TempDir::new("presence-scratch"),+            &[+                ("SWX_LAUNCH_FAKE_DIR", Box::leak(self.dir.path().into_boxed_str())),+                ("SWX_ALLOW_USER_WRITES", "1"),+                ("SWX_QUIT_SETTLE_MS", "80"),+                ("SWX_QUIT_EXIT_WAIT_SECS", "3"),+            ],+        );+        b.call("swx_start", json!({}));+        b+    }++    /// SOLIDWORKS in the foreground (the user brought it to the front): the pid+    /// the session reports.+    fn foreground_solidworks(&self, b: &Bridge) {+        let pid = b.call("swx_get_app_state", json!({}))["processId"].as_u64().expect("a session pid");+        std::fs::write(+            self.dir.join("foreground.json"),+            json!({"hwnd": 6622700, "pid": pid, "title": "SOLIDWORKS Premium 2026 - [ASM-CRATE.SLDASM]",+                   "className": "Afx:00007FF6B0000000:8"})+            .to_string(),+        )+        .unwrap();+    }++    fn foreground_other_app(&self) {+        std::fs::write(+            self.dir.join("foreground.json"),+            json!({"hwnd": 777, "pid": 4321, "title": "Inbox - Outlook", "className": "rctrl_renwnd32"}).to_string(),+        )+        .unwrap();+    }++    fn last_input(&self, secs: u64) {+        std::fs::write(self.dir.join("last-input-secs"), secs.to_string()).unwrap();+    }++    fn quit_happened(&self) -> bool {+        self.dir.join("quit.jsonl").exists()+    }+}++fn authorized(max_rung: &str) -> Value {+    json!({"userAuthorized": true, "reason": "leave the machine as found", "maxRung": max_rung})+}++#[test]+fn solidworks_in_front_with_recent_input_refuses_every_verb_that_ends_work() {+    let m = Sim::new("presence-front");+    let b = m.boot();+    m.foreground_solidworks(&b);+    m.last_input(5);+    let r = b.call("swx_stop", authorized("a"));+    check!(+        b,+        "swx_stop: user_is_active, with the evidence",+        r["errorCode"] == "user_is_active"+            && r["userPresence"]["foregroundIsSolidworks"] == true+            && r["userPresence"]["secondsSinceLastInput"] == 5+            && r["userPresence"]["foregroundWindow"]["title"].as_str().unwrap_or("").contains("ASM-CRATE"),+        s(&r)+    );+    check!(b, "...and SOLIDWORKS was not quit", !m.quit_happened(), String::new());+    for (verb, args) in [+        ("swx_shutdown", json!({"reason": "tidy"})),+        ("swx_close_all_safely", json!({"reason": "tidy"})),+        ("swx_close_all_documents", json!({"confirm": true, "reason": "tidy"})),+        ("swx_reset_workspace", json!({})),+    ] {+        let r = b.call(verb, args);+        check!(b, &format!("{verb}: user_is_active"), r["errorCode"] == "user_is_active", s(&r));+    }++    // THE USER STEPS AWAY. The session stays theirs: taken over, persistently.+    m.foreground_other_app();+    m.last_input(3600);+    let r = b.call("swx_stop", authorized("a"));+    check!(+        b,+        "swx_stop after the user stepped away: still refused — the session was taken over",+        r["errorCode"] == "user_is_active" && r["userPresence"]["takenOverEarlier"] == true,+        s(&r)+    );+    let st = b.call("swx_user_presence", json!({}));+    check!(b, "swx_user_presence: present, taken over earlier", st["present"] == true, s(&st));++    // A verb that ADDS is allowed on a taken-over session, and says so.+    let made = b.call("swx_new_document", json!({"type": "part"}));+    check!(+        b,+        "swx_new_document on a taken-over session: allowed, reporting userPresent",+        made["success"] == true && made["userPresent"]["takenOverByUser"] == true,+        s(&made)+    );+    b.call("swx_close_doc", json!({"name": made["created"]["title"].as_str().unwrap_or("")}));++    // ONLY the explicit override, with the user's authorization and a reason.+    let mut half = authorized("a");+    half["userPresentOverride"] = json!(true);+    half["userAuthorized"] = json!(false);+    let r = b.call("swx_stop", half);+    check!(b, "the override without userAuthorized is not an override", r["errorCode"] == "user_is_active", s(&r));+    let mut over = authorized("a");+    over["userPresentOverride"] = json!(true);+    let r = b.call("swx_stop", over);+    check!(+        b,+        "swx_stop with userPresentOverride + userAuthorized + reason: proceeds, and says it was overridden",+        r["stopped"] == true && r["userPresence"]["overridden"] == true,+        s(&r)+    );+}++#[test]+fn solidworks_in_front_but_idle_is_not_presence() {+    let m = Sim::new("presence-idle");+    let b = m.boot();+    m.foreground_solidworks(&b);+    m.last_input(600);+    let r = b.call("swx_stop", authorized("a"));+    check!(b, "swx_stop: SOLIDWORKS in front, no input for 10 min — not present; it quits", r["stopped"] == true, s(&r));+}++#[test]+fn recent_input_in_another_app_is_not_presence() {+    let m = Sim::new("presence-elsewhere");+    let b = m.boot();+    m.foreground_other_app();+    m.last_input(2);+    let r = b.call("swx_stop", authorized("a"));+    check!(b, "swx_stop: the user is busy in Outlook, not in SOLIDWORKS — it quits", r["stopped"] == true, s(&r));+}++#[test]+fn documents_the_bridge_did_not_open_are_the_user_taking_over() {+    let m = Sim::new("presence-foreign");+    let b = m.boot();+    // The bridge's OWN document is not foreign.+    let mine = b.call("swx_new_document", json!({"type": "part"}));+    check!(b, "precondition: the bridge made a part", mine["success"] == true, s(&mine));+    let pres = b.call("swx_user_presence", json!({}));+    check!(b, "the bridge's own document is not the user's", pres["present"] == false, s(&pres));+    // ...then the user opens their crate assembly.+    std::fs::write(b.scratch.join("mock-user-opens-document"), "").unwrap();+    let r = b.call("swx_close_all_safely", json!({"reason": "tidy"}));+    check!(+        b,+        "swx_close_all_safely: user_is_active, naming the document the bridge did not open",+        r["errorCode"] == "user_is_active"+            && r["userPresence"]["foreignDocuments"]["count"] == 1+            && r["userPresence"]["foreignDocuments"]["titles"].to_string().contains("ASM-CRATE"),+        s(&r)+    );+    let docs = b.call("swx_docs", json!({}));+    check!(b, "...and nothing was closed", s(&docs).contains("ASM-CRATE") && docs["count"] == 2, s(&docs));+}++#[test]+fn an_unreadable_presence_is_presence_but_never_a_take_over() {+    let m = Sim::new("presence-unreadable");+    let b = m.boot();+    std::fs::write(m.dir.join("presence-unreadable"), "").unwrap();+    let r = b.call("swx_stop", authorized("a"));+    check!(+        b,+        "swx_stop: presence could not be measured — refused as present",+        r["errorCode"] == "user_is_active" && r["userPresence"]["measurementUnreadable"] == true,+        s(&r)+    );+    check!(b, "...and SOLIDWORKS was not quit", !m.quit_happened(), String::new());+    std::fs::remove_file(m.dir.join("presence-unreadable")).unwrap();+    let r = b.call("swx_stop", authorized("a"));+    check!(+        b,+        "once it can be measured and the user is absent, the quit proceeds — unreadable is not a take-over",+        r["stopped"] == true,+        s(&r)+    );+}