SOLIDWORKS Bridge

//! ADVERSARIAL REVIEW OF 0.6.8 — pass twenty-one.
//!
//! The wiring is real: I re-ran the call-site mutations myself rather than
//! reading them. Neutering the `swx_stop` FRONT GATE fails
//! `swx_stop_refuses_when_the_launch_claim_names_another_session`; neutering the
//! `close_all_documents`/`reset_workspace` helper fails two e2e tests. Behaviour
//! with no claim recorded is unchanged by construction —
//! `identity_matches_attribution(None, _) => Ok(())` — so a session this bridge
//! never claimed is still refused by the preconditions that were there before.
//!
//! Two gaps, both about what the suite can SEE rather than what the bridge does,
//! and both demonstrated by mutation:
//!
//!   1. The PER-RUNG re-sweep call site (`verbs.rs`, the second of the two in
//!      `swx_stop`) is untested. Replacing it with `Ok(())` and running ALL 301
//!      tests produces zero failures. It is also not testable as things stand:
//!      the comparison is `attributed_solidworks()` against the identity built
//!      from the COM `processId`, and the mock's reported processId cannot be
//!      changed between rungs from a fixture. A `mock-com-pid` fault read per
//!      call would make it stageable — and the per-rung site is the one that
//!      catches the session changing DURING the ladder, which is the whole
//!      reason it exists.
//!
//!   2. `tests/wiring.rs` cannot see TRANSITIVE deadness. With both live
//!      `swx_stop` call sites neutered and a single never-called function added
//!      that mentions `identity_matches_attribution`, the wiring test still
//!      passes. "Has a production caller" is a weaker property than "is
//!      reachable", and the guard that shipped inert in 0.6.7 would satisfy it.
//!
//! This file is the third thing: the same regression net, extended to the guards
//! `wiring.rs` leaves out. All of them are wired TODAY — I checked — so this
//! passes now and exists to stop one of them being quietly unwired later.

use std::path::Path;

/// Guards that are load-bearing and absent from `wiring.rs::GUARDS`.
const ALSO_LOAD_BEARING: &[(&str, &str)] = &[
    ("prune_unless_truncated",
     "an unlistable open set must never disown the documents this bridge created — bug #5"),
    ("owns_doc",
     "the ownership gate: the bridge writes only to documents it made, in this session"),
    ("doc_matches",
     "one path comparison, shared by the ownership check and the prune, or they disagree"),
    ("safe_out",
     "a relative or traversing destination is refused before it reaches the host"),
    ("is_hung",
     "hung needs BOTH signals, and an unknown is never a yes"),
    ("exhaustion_confirmed",
     "exhaustion is a compound verdict, never a memory number on its own"),
    ("same_process",
     "a pid is not an identity: pid + image + creation time is"),
];

fn production_sources() -> Vec<(String, String)> {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
    let mut out = Vec::new();
    let mut stack = vec![root];
    while let Some(dir) = stack.pop() {
        let Ok(entries) = std::fs::read_dir(&dir) else { continue };
        for e in entries.flatten() {
            let p = e.path();
            if p.is_dir() {
                stack.push(p);
            } else if p.extension().map(|x| x == "rs").unwrap_or(false) {
                if let Ok(text) = std::fs::read_to_string(&p) {
                    out.push((p.to_string_lossy().to_string(), strip_test_modules(&text)));
                }
            }
        }
    }
    out
}

/// Remove `#[cfg(test)] mod tests { … }` by brace counting — a call from inside
/// one is not a production caller. Same approach as `wiring.rs`.
fn strip_test_modules(text: &str) -> String {
    let mut out = String::with_capacity(text.len());
    let mut rest = text;
    while let Some(i) = rest.find("#[cfg(test)]") {
        out.push_str(&rest[..i]);
        let after = &rest[i..];
        let Some(brace) = after.find('{') else { break };
        let mut depth = 0i32;
        let mut end = None;
        for (j, c) in after[brace..].char_indices() {
            match c {
                '{' => depth += 1,
                '}' => {
                    depth -= 1;
                    if depth == 0 {
                        end = Some(brace + j + 1);
                        break;
                    }
                }
                _ => {}
            }
        }
        match end {
            Some(e) => rest = &after[e..],
            None => return out,
        }
    }
    out.push_str(rest);
    out
}

#[test]
fn the_other_load_bearing_guards_have_production_callers_too() {
    let sources = production_sources();
    assert!(!sources.is_empty(), "no source files were read");
    let mut unwired: Vec<String> = Vec::new();
    for (name, why) in ALSO_LOAD_BEARING {
        let called = sources.iter().any(|(_, text)| {
            text.lines()
                .map(str::trim)
                .filter(|t| {
                    !t.starts_with("//")
                        && !t.starts_with("fn ")
                        && !t.starts_with("pub fn ")
                        && !t.starts_with("pub(crate) fn ")
                })
                .any(|t| t.contains(&format!("{name}(")))
        });
        if !called {
            unwired.push(format!("{name} — {why}"));
        }
    }
    assert!(
        unwired.is_empty(),
        "these guards have no production caller, so they are written and not run:\n  {}\n\
         (The same check `wiring.rs` makes, for the guards it does not list. If one of these was \
         retired on purpose, remove it here — that should be a decision, not a silent drift.)",
        unwired.join("\n  ")
    );
}