SOLIDWORKS Bridge

//! ADVERSARIAL REVIEW OF 0.7.2 — pass twenty-four.
//!
//! MY PASS-23 RECOMMENDATION WAS WRONG. I proposed verifying the OLE compound
//! file signature `D0 CF 11 E0 A1 B1 1A E1` at offset 0 from general knowledge
//! of the format, without measuring a single file. I re-measured every
//! SOLIDWORKS document in this container and **0 of 166 carry it**. Shipped as
//! specified it would have made `recovery_file_verdict` refuse every file, so
//! every document would have been preserved and never closed — a silently inert
//! feature, and a mock written on the same premise would have agreed with it.
//! The lesson is the one this project keeps relearning: a check about somebody
//! else's format is a measurement, not a recollection.
//!
//! What I measured, independently, over all 166 `.SLDPRT`/`.SLDASM`/`.SLDDRW`
//! files in this container (three repos, 29 KB - 37 MB, parts, assemblies and
//! drawings):
//!
//! ```text
//! CFBF magic at offset 0          0 / 166
//! 00 00 00 04 at offset 4       166 / 166
//! bytes 0..4                      per-file, varying (no constant)
//! any other constant 4-byte
//!   window in the first 64 B      NONE — 34 to 112 distinct values at every
//!                                 offset from 8 to 60
//! constant tail (last 4 or 8 B)   NONE — per-file
//! head word echoed at the tail    NO (checked byte-order-reversed too)
//! ```
//!
//! So the marker 0.7.2 ships is the strongest one available from the evidence,
//! and there is no cheap structural integrity check in this format at all.

use swx_bridge::comhost::host::{MIN_RECOVERY_BYTES, SWDOC_FORMAT_MARKER};

/// The marker is what I measured, at the offset I measured it.
///
/// Pinned so it cannot drift back to something recalled rather than measured —
/// which is exactly how the CFBF proposal got as far as a recommendation.
#[test]
fn the_format_marker_is_the_one_measured_on_real_documents() {
    assert_eq!(
        SWDOC_FORMAT_MARKER,
        [0x00, 0x00, 0x00, 0x04],
        "the marker must stay the value measured on 166/166 real SOLIDWORKS documents at offset 4"
    );
    assert!(
        MIN_RECOVERY_BYTES >= 16 * 1024,
        "the floor must stay at or above 16 KB — the smallest real document measured here is \
         29,130 bytes"
    );
}

/// WHAT THE MARKER CANNOT DO, stated so nobody mistakes it for an integrity check.
///
/// The marker sits at offset 4, so **any prefix of a real file longer than eight
/// bytes carries it**. A truncated write that reaches 20 KB of a 500 KB assembly
/// passes the marker AND the 16 KB floor, is recorded `preserved: true`, and the
/// document is closed against it. Marker and floor together catch "empty" and
/// "not a SOLIDWORKS file"; neither catches "the right file, cut short", and the
/// measurements above say the format offers nothing cheap that would — no
/// constant tail, no length field, no head/tail relationship.
///
/// The remaining defence is therefore not in the file, it is in the decision to
/// start: this sweep writes every open document to disk, and it should refuse to
/// begin when the volume has less free space than the session it is about to
/// write. The container this is being developed in has been between 7 and 25 GB
/// free all series while holding a 37 MB assembly; a session with a large
/// assembly open is exactly where the truncation this cannot detect becomes
/// likely.
///
/// This test asserts the sweep reports the free space it had — the cheap half,
/// and the precondition for refusing on it.
#[test]
fn the_sweep_reports_the_headroom_it_had_before_writing() {
    use serde_json::json;

    let b = common::Bridge::start_with(&[("SWX_ALLOW_USER_WRITES", "1")]);
    b.call("swx_start", json!({"reason": "preparing"}));
    b.call("swx_new_document", json!({"type": "part", "keepUnsaved": true}));
    let r = b.call(
        "swx_close_all_safely",
        json!({"reason": "closing everything safely", "userAuthorized": true, "batch": 1}),
    );
    let text = serde_json::to_string(&r).unwrap().to_lowercase();
    assert!(
        text.contains("freebytes") || text.contains("freespace") || text.contains("headroom"),
        "the sweep writes every open document to disk and never says how much room it had. \
         Marker and floor cannot detect a truncation that keeps the header and exceeds 16 KB, so \
         the only defence against that class is refusing to start without headroom — and the \
         first step is reporting it.\n{}",
        serde_json::to_string_pretty(&r).unwrap()
    );
}

mod common;