SOLIDWORKS Bridge

//! ADVERSARIAL REVIEW OF 0.7.6 — pass twenty-eight.
//!
//! BOTH RUNTIME QUESTIONS COME OUT CLEAN, by reading the code rather than by
//! testing it, because the branch needs a live SOLIDWORKS to enter.
//!
//! (1) After a refused `.sldrecover` save, `out` is reassigned BEFORE the second
//!     `SaveAs3`, and `now_path = GetPathName` is read after the `match attempt`
//!     — so the close key comes off the object after the SECOND save, and
//!     `same_path(&now_path, &out)` compares it against the new name. A document
//!     that failed to re-point is caught by that comparison, not assumed. If the
//!     second save also fails, `code != 0` puts it on the `preserved: false`
//!     path. Nothing re-points to a name that was never written.
//!
//! (2) A `.sldrecover` save that SUCCEEDS while writing some other format is
//!     verified with `kind = None` against `recovery_file_verdict`, which reads
//!     the marker first. A non-native file carries neither `00 00 00 04` at
//!     offset 4 nor the CFBF signature, so `signature_ok` is false, `ok` is
//!     false, and the document is NOT closed. Fails closed, correctly, and the
//!     retry is deliberately not attempted for a save that returned success —
//!     retrying on a verdict rather than on a return code would write twice for
//!     every genuinely-full disk.
//!
//! Which leaves where those two answers PUT THE FILE. In both cases a file is
//! left in the sweep directory that the sweep itself declined to vouch for —
//! correctly, since deleting a user's only bytes is worse than keeping them. The
//! record says `preserved: false` and names the reason. And then
//! `swx_recover_list` reads that directory with `p.is_file()` and calls
//! everything in it a rescue.

mod common;
use common::*;
use serde_json::json;

fn s(v: &serde_json::Value) -> String {
    serde_json::to_string_pretty(v).unwrap_or_default()
}

/// THE LISTING DOES NOT KNOW WHAT THE SWEEP REFUSED TO VOUCH FOR.
///
/// Three ways a file lands in a sweep directory without being preserved work:
///
///   * the first `SaveAs3` to `.sldrecover` is refused AFTER touching the file,
///     leaving a husk at a name `out` no longer points to — 0.7.6 added the
///     retry, and the husk is what the retry leaves behind;
///   * the save returns 0 but writes a non-native format, and the marker check
///     rejects it;
///   * the save is truncated by a full disk and the size floor rejects it.
///
/// In every one the document stays OPEN and the record says `preserved: false`.
/// `swx_recover_list` sees none of that. It lists the file, reports its size,
/// and hands the user `howToOpen` — for a `.sldrecover` name, an instruction to
/// rename it to `.SLDPRT` and open it, ending "The bytes are the document; only
/// the name is unknown." For these files the bytes are NOT the document, which
/// is precisely why they were not closed against.
///
/// The response's own `_hint` states it outright: "Every document
/// swx_close_all_safely or swx_shutdown closed was written here first." True in
/// one direction and read as the other. The verb that reports the rescue is the
/// one the user reads on the worst day, and it is the one that cannot tell a
/// rescue from a husk.
///
/// `recovery_file_verdict` already computes exactly this answer at save time and
/// the listing throws it away — and it is a pure function of the file, so
/// `recover_list` can simply re-run it per file. Report `verified: false` and
/// replace `howToOpen` with what the sweep actually said. Nothing needs deleting.
#[test]
fn recover_list_does_not_present_an_unverified_file_as_preserved_work() {
    let scratch = TempDir::new("adv27-husk");
    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);

    let root = scratch.join("recovery").join("2026-09-12T00-00-00");
    std::fs::create_dir_all(&root).unwrap();
    // What a refused or wrong-format SaveAs3 leaves: bytes that are not a
    // SOLIDWORKS document. recovery_file_verdict rejects this on the marker, and
    // the sweep left the document open because of it.
    std::fs::write(root.join("Assem1.sldrecover"), vec![0x41u8; 900_000]).unwrap();

    let r = b.call("swx_recover_list", json!({}));
    let files = r["sweeps"][0]["files"].as_array().cloned().unwrap_or_default();
    assert_eq!(files.len(), 1, "precondition: the husk is in the listing: {}", s(&r));
    let f = &files[0];

    assert!(
        f.get("verified").and_then(|v| v.as_bool()) == Some(false)
            || f.get("howToOpen")
                .and_then(|v| v.as_str())
                .map(|h| h.to_ascii_lowercase().contains("not verif")
                    || h.to_ascii_lowercase().contains("could not be verified"))
                .unwrap_or(false),
        "a file the sweep REFUSED to vouch for — it holds no SOLIDWORKS marker, so the document \
         it came from is still open — is listed as a rescue, with its size and an instruction to \
         rename it to .SLDPRT and open it, ending \"The bytes are the document; only the name is \
         unknown.\" Here the bytes are not the document. recovery_file_verdict is a pure function \
         of the file and already knows this; recover_list can re-run it per file. Entry: {}",
        s(f)
    );
}

/// THE HEADLINE CLAIM IS THE UNCONDITIONAL ONE.
///
/// A sweep in which NOTHING was preserved still produces a populated listing
/// under the hint "Every document … closed was written here first". A user
/// reading the listing after a failed sweep — the situation the listing exists
/// for — is told their work is safe by the verb whose job is to say so, while
/// the documents are still open and the files are unusable.
///
/// This is the same defect as the test above, stated where the user meets it. I
/// am counting it once.
#[test]
fn a_sweep_that_preserved_nothing_does_not_report_rescued_work() {
    let scratch = TempDir::new("adv27-nothing");
    let b = Bridge::start_in(TempDir::borrowed(&scratch.0), &[]);

    let root = scratch.join("recovery").join("2026-09-12T00-00-00");
    std::fs::create_dir_all(&root).unwrap();
    // Two attempts, both refused: no marker on either.
    std::fs::write(root.join("Assem1.sldrecover"), vec![0x41u8; 900_000]).unwrap();
    std::fs::write(root.join("Part1.SLDPRT"), vec![0x42u8; 40_000]).unwrap();

    let r = b.call("swx_recover_list", json!({}));
    let text = s(&r).to_ascii_lowercase();
    let files = r["sweeps"][0]["files"].as_array().cloned().unwrap_or_default();
    assert_eq!(files.len(), 2, "precondition: both attempts are listed: {}", s(&r));

    assert!(
        text.contains("verif"),
        "nothing in this sweep was preserved — neither file carries a SOLIDWORKS marker, so both \
         documents are still open — and swx_recover_list reports two rescues under \"Every \
         document swx_close_all_safely or swx_shutdown closed was written here first\". The word \
         \"verified\" does not appear anywhere in the response. Response: {}",
        s(&r)
    );
}