SOLIDWORKS Bridge - tests/launch.rs

Overview Files Skills Discover Packages Releases Dependencies Issues2 Breadcrumbs Pull Requests Activity
main
Drew Owens 0.11.2 source 784acbf 5d ago
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898
//! LAUNCH RESILIENCE, end to end against the real compiled binary.
//!
//! Every test here drives a SIMULATED MACHINE (`SWX_LAUNCH_FAKE_DIR`) whose
//! behaviour is written down as a scenario — "route A starts a chain and stalls
//! at SecurityContext; route B reaches Run Begin and attaches" — and then
//! measures WHAT THE BRIDGE DID ABOUT IT on that machine: which processes it
//! ended, how many launcher invocations it made, what it left running. Not what
//! it returned.
//!
//! That distinction is the whole point. The pre-0.4 bridge returned
//! `stillLaunching:true` with a hint promising "call swx_start again, which
//! ATTACHES rather than launching a second copy" — and every one of those calls
//! fired the launcher again. The return value was right and the effect was
//! wrong, four times over, on somebody's real desktop.

mod common;

use common::{AbStub, Bridge, TempDir};
use serde_json::{json, Value};
use std::time::{Duration, Instant};

fn s(v: &Value) -> String {
    serde_json::to_string_pretty(v).unwrap_or_default()
}

/// The pids `FakeOs` gives the Nth simulated launcher invocation.
fn chain_pids(n: u64) -> (u64, u64) {
    let base = 900_000 + n * 10;
    (base, base + 1)
}

/// A simulated machine. `routes` says what each launch route does; the
/// pre-existing processes are the ones that MUST still be there afterwards.
struct Machine {
    dir: TempDir,
}

impl Machine {
    fn new(tag: &str, routes: Value) -> Machine {
        let dir = TempDir::new(tag);
        std::fs::write(dir.join("routes.json"), routes.to_string()).unwrap();
        // The Platform's daemons and a chain the USER started a minute ago.
        // Nothing this bridge does may touch any of them, ever.
        std::fs::write(
            dir.join("preexisting.json"),
            json!([
                {"pid": 6076, "image": "3DEXPERIENCELauncher.exe", "ageSeconds": 30000},
                {"pid": 90552, "image": "3DEXPERIENCELauncherSysTray.exe", "ageSeconds": 30000},
                {"pid": 90553, "image": "3DEXPERIENCELauncherService.exe", "ageSeconds": 30000},
                {"pid": 70001, "image": "CATSTART.exe", "ageSeconds": 60},
                {"pid": 70002, "image": "SWXDesktopLauncher.exe", "ageSeconds": 60}
            ])
            .to_string(),
        )
        .unwrap();
        Machine { dir }
    }

    fn sldworks(self, state: Value) -> Machine {
        std::fs::write(self.dir.join("sldworks.json"), state.to_string()).unwrap();
        self
    }

    /// Also list SOLIDWORKS itself as already running.
    fn with_running_solidworks(self) -> Machine {
        let mut rows: Vec<Value> =
            serde_json::from_str(&std::fs::read_to_string(self.dir.join("preexisting.json")).unwrap())
                .unwrap();
        rows.push(json!({"pid": 88556, "image": "SLDWORKS.exe", "ageSeconds": 7200}));
        std::fs::write(self.dir.join("preexisting.json"), Value::Array(rows).to_string()).unwrap();
        self
    }

    fn lines(&self, file: &str) -> Vec<Value> {
        std::fs::read_to_string(self.dir.join(file))
            .unwrap_or_default()
            .lines()
            .filter_map(|l| serde_json::from_str(l).ok())
            .collect()
    }

    /// Every launcher invocation the bridge made, in order.
    fn invocations(&self) -> Vec<String> {
        self.lines("invocations.jsonl")
            .iter()
            .filter_map(|v| v.get("route").and_then(|r| r.as_str()).map(String::from))
            .collect()
    }

    /// Every process the bridge terminated, in order.
    fn terminated(&self) -> Vec<(u64, String)> {
        self.lines("terminated.jsonl")
            .iter()
            .filter_map(|v| {
                Some((
                    v.get("pid")?.as_u64()?,
                    v.get("image")?.as_str()?.to_string(),
                ))
            })
            .collect()
    }

    fn boot(&self, scratch: TempDir, extra: &[(&str, &str)]) -> Bridge {
        let lnk = format!("{}/SOLIDWORKS Design.lnk", self.dir.path());
        std::fs::write(&lnk, "not really a shortcut").unwrap();
        let mut env: Vec<(&str, &str)> = vec![
            ("SWX_SOLIDWORKS_SHORTCUT", Box::leak(lnk.into_boxed_str())),
            ("SWX_LAUNCH_FAKE_DIR", Box::leak(self.dir.path().into_boxed_str())),
            // Compressed budgets: the real ones are 20s / 120s / 240s, and a
            // suite that waited them out would never be run.
            ("SWX_LAUNCH_RUN_BEGIN_SECS", "2"),
            ("SWX_LAUNCH_SLDWORKS_SECS", "4"),
            ("SWX_LAUNCH_ATTACH_SECS", "8"),
            ("SWX_LAUNCH_POLL_MS", "100"),
            ("SWX_LAUNCH_ATTACH_POLL_MS", "150"),
            ("SWX_LAUNCH_INFLIGHT_SECS", "120"),
            ("SWX_LAUNCH_HELPER_SECS", "30"),
            ("SWX_LAUNCH_RETRY_SETTLE_MS", "400"),
            ("SWX_LAUNCH_DIALOG_GRACE_MS", "3000"),
        ];
        env.extend_from_slice(extra);
        Bridge::start_in(scratch, &env)
    }
}

/// Poll `swx_status` until the launch attempt finishes, or give up. Returns the
/// last status seen — a test asserts on the MACHINE, this only paces it.
fn wait_for_launch(b: &Bridge, secs: u64) -> Value {
    let deadline = Instant::now() + Duration::from_secs(secs);
    let mut last = json!({});
    loop {
        last = b.call("swx_status", json!({}));
        if last["launch"]["finished"] == true {
            return last;
        }
        if Instant::now() > deadline {
            return last;
        }
        std::thread::sleep(Duration::from_millis(150));
    }
}

#[test]
fn a_stalled_route_is_cleaned_up_and_the_next_route_takes_over() {
    // FAILURE MODE A, exactly as measured on 2026-09-04: the chain starts, the
    // launcher log stops at `SecurityContext:`, `Run Begin` never comes.
    let m = Machine::new(
        "fallback",
        // Both ATTRIBUTABLE routes: only a route that can say what it started
        // may have its chain cleaned up, so the fallback story is told with the
        // two that can. See `launch::AttributionRule`.
        json!({
            "shellExecute": {"chain": true},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "helperAfterMs": 100,
                           "sldworksAfterMs": 200, "attachAfterMs": 400}
        }),
    );
    let b = m.boot(TempDir::new("scratch"), &[]);

    let r = b.call("swx_start", json!({"reason": "modelling a bracket for Drew", "waitSeconds": 0}));
    check!(b, "swx_start reports a launch in flight, not a failure", r["success"] == true && r["stillLaunching"] == true, s(&r));

    let st = wait_for_launch(&b, 25);
    check!(b, "swx_start reaches an attached SOLIDWORKS by falling back", st["launch"]["outcome"] == "attached", s(&st));

    // THE EFFECT, on the machine.
    check!(
        b,
        "exactly two launcher invocations: the stalled route, then the next one",
        m.invocations() == vec!["shellExecute".to_string(), "powershell".to_string()],
        format!("{:?}", m.invocations())
    );
    let (cat1, lnk1) = chain_pids(1);
    let killed = m.terminated();
    check!(
        b,
        "ONLY the stalled chain we started was ended — by pid, both of it, nothing else",
        killed.iter().map(|(p, _)| *p).collect::<Vec<_>>() == vec![cat1, lnk1],
        format!("terminated: {killed:?}")
    );
    check!(
        b,
        "...and it was ended as the images it really was",
        killed.iter().all(|(_, i)| i == "CATSTART.exe" || i == "SWXDesktopLauncher.exe"),
        format!("{killed:?}")
    );
    for guarded in [6076u64, 90552, 90553, 70001, 70002, 88556] {
        check!(
            b,
            "no daemon, no pre-existing chain and no SOLIDWORKS was ever terminated",
            !killed.iter().any(|(p, _)| *p == guarded),
            format!("pid {guarded} was terminated: {killed:?}")
        );
    }
    let (cat2, lnk2) = chain_pids(2);
    check!(
        b,
        "the WORKING route's chain was left alone",
        !killed.iter().any(|(p, _)| *p == cat2 || *p == lnk2),
        format!("{killed:?}")
    );

    // The stall is on the record, with what it cost.
    let tried = &st["launch"]["routesTried"];
    check!(b, "the stalled route is recorded", tried[0]["route"] == "shellExecute" && tried[0]["stalled"] == true, s(&st["launch"]));
    check!(
        b,
        "...and that the chain it ended was one the INVOKE identified, not one it recognised",
        tried[0]["attributed"] == true && tried[0]["cleanup"] == "cleaned",
        s(&st["launch"])
    );
    check!(
        b,
        "...naming the exact processes it ended",
        tried[0]["killed"][0]["pid"] == cat1 && tried[0]["killed"][1]["pid"] == lnk1,
        s(&st["launch"])
    );
    let ledger = b.call("swx_action_ledger", json!({"limit": 200}));
    check!(b, "the stall and the cleanup are in the human's ledger", s(&ledger).contains("solidworks_launch_stalled"), s(&ledger));
    check!(b, "...and so is Run Begin never arriving", s(&ledger).contains("never logged 'Run Begin'"), s(&ledger));
}

#[test]
fn the_route_that_worked_is_remembered_and_tried_first_next_time() {
    let scratch = TempDir::new("scratch");
    let m = Machine::new(
        "preferred",
        json!({
            "shellExecute": {"chain": true},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300}
        }),
    );
    {
        let b = m.boot(TempDir::borrowed(&scratch.0), &[]);
        b.call("swx_start", json!({"reason": "first launch of the day", "waitSeconds": 0}));
        let st = wait_for_launch(&b, 25);
        check!(b, "the working route is remembered on disk", st["launch"]["preferredRoute"] == "powershell", s(&st["launch"]));
    }
    // A DIFFERENT SERVER PROCESS, same scratch dir. The memory has to be the
    // FILE, not the process — a bridge is restarted far more often than a
    // desktop is.
    let state: Value = serde_json::from_str(
        &std::fs::read_to_string(scratch.join("launch-state.json")).unwrap(),
    )
    .unwrap();
    assert_eq!(state["preferredRoute"], "powershell", "{}", s(&state));

    // Every route still stalls except the remembered one, and the remembered
    // one is tried FIRST — so a second cold start costs one invocation, not two.
    let m2 = Machine::new(
        "preferred2",
        json!({"powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300}}),
    );
    std::fs::copy(scratch.join("launch-state.json"), m2.dir.join("seed.json")).unwrap();
    let scratch2 = TempDir::new("scratch2");
    std::fs::copy(scratch.join("launch-state.json"), scratch2.join("launch-state.json")).unwrap();
    let b2 = m2.boot(scratch2, &[]);
    b2.call("swx_start", json!({"reason": "second launch", "waitSeconds": 0}));
    let st2 = wait_for_launch(&b2, 25);
    check!(b2, "the second cold start attaches", st2["launch"]["outcome"] == "attached", s(&st2["launch"]));
    check!(
        b2,
        "...on the FIRST invocation, because the remembered route led the plan",
        m2.invocations() == vec!["powershell".to_string()],
        format!("{:?}", m2.invocations())
    );
    check!(b2, "...and nothing had to be cleaned up", m2.terminated().is_empty(), format!("{:?}", m2.terminated()));
}

#[test]
fn three_calls_during_a_launch_start_exactly_zero_extra_launchers() {
    // FAILURE MODE B. The old hint said calling again ATTACHES rather than
    // launching a second copy. It did not. Four launcher chains accumulated.
    let m = Machine::new(
        "inflight",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "helperAfterMs": 50,
                                "sldworksAfterMs": 150, "attachAfterMs": 600000}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_ATTACH_SECS", "120")]);

    let first = b.call("swx_start", json!({"reason": "starting SOLIDWORKS for Drew", "waitSeconds": 0}));
    check!(b, "the first call starts the launch", first["stillLaunching"] == true, s(&first));

    // Let the machine get past Run Begin so the calls land mid-flight.
    std::thread::sleep(Duration::from_millis(700));
    for n in 1..=3 {
        let again = b.call("swx_start", json!({"reason": "checking on it", "waitSeconds": 0}));
        check!(b, "a call during flight never fails", again["success"] == true, s(&again));
        check!(
            b,
            "...it reports the SAME attempt as still launching",
            again["stillLaunching"] == true && again["launchedNow"] == false,
            format!("call {n}: {}", s(&again))
        );
        check!(
            b,
            "...and it says, in words, that it launched nothing",
            again["_hint"].as_str().unwrap_or("").contains("NOTHING WAS LAUNCHED BY THIS CALL"),
            s(&again)
        );
        check!(
            b,
            "...carrying the live stage so the caller knows what it is waiting for",
            ["invoked", "launcherStarted", "runBegin", "helperSignIn", "sldworksUp", "attaching"]
                .contains(&again["stage"].as_str().unwrap_or("")),
            s(&again)
        );
    }
    // A call with NO reason must not be refused either — polling with swx_start
    // is what this bridge's own hint tells a caller to do.
    let bare = b.call("swx_start", json!({}));
    check!(b, "polling with swx_start needs no reason while a launch is in flight", bare["success"] == true && bare["stillLaunching"] == true, s(&bare));

    check!(
        b,
        "ONE launcher invocation, after five swx_start calls",
        m.invocations() == vec!["shellExecute".to_string()],
        format!("{:?}", m.invocations())
    );
    check!(b, "and nothing was terminated on the way", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    // swx_status tells the same story, which is where a caller should be looking.
    let st = b.call("swx_status", json!({}));
    check!(b, "swx_status carries the live launch block", st["launch"]["inFlight"] == true && st["launch"]["route"] == "shellExecute", s(&st["launch"]));
}

#[test]
fn the_machine_stops_at_the_first_chain_it_cannot_prove_is_its_own() {
    // All four routes behave the way cmd/start did on 2026-09-04: they start a
    // launcher chain that never reaches Run Begin.
    //
    // The two ATTRIBUTABLE routes hand back the root they started, so their
    // chains are ended. `explorer` cannot say what it started — and it started
    // SOMETHING (a launcher log appeared) — so the machine stops there rather
    // than putting a fourth chain on the desktop beside one nobody can find.
    let m = Machine::new("exhaust", json!({}));
    let b = m.boot(
        TempDir::new("scratch"),
        &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1"), ("SWX_LAUNCH_BACKOFF_SECS", "0")],
    );
    b.call("swx_start", json!({"reason": "trying to start SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 40);

    check!(b, "the attempt ends", st["launch"]["outcome"] == "exhausted", s(&st["launch"]));
    check!(
        b,
        "it stopped at the first route whose chain it could not prove was its own",
        m.invocations() == vec!["shellExecute", "powershell", "explorer"],
        format!("{:?}", m.invocations())
    );
    let tried = st["launch"]["routesTried"].as_array().cloned().unwrap_or_default();
    check!(
        b,
        "the two attributable routes ended the chains they started",
        tried[0]["attributed"] == true
            && tried[0]["cleanup"] == "cleaned"
            && tried[1]["attributed"] == true
            && tried[1]["cleanup"] == "cleaned",
        s(&st["launch"])
    );
    check!(
        b,
        "...and the unattributable one is recorded as exactly that, not as a clean recovery",
        tried[2]["attributed"] == false && tried[2]["cleanup"] == "notAttributable",
        s(&st["launch"])
    );
    check!(
        b,
        "...saying, in words, that a chain may remain which the bridge cannot identify",
        tried[2]["cleanupError"].as_str().unwrap_or("").contains("MAY still be running"),
        s(&st["launch"])
    );

    // THE EFFECT. Four processes ended — both attributable chains — and the
    // chain the bridge could not prove was its own was LEFT ALONE.
    let killed = m.terminated();
    check!(b, "two attributable chains, four processes", killed.len() == 4, format!("{killed:?}"));
    for ours in [900010u64, 900011, 900020, 900021] {
        check!(b, "each attributed chain was ended", killed.iter().any(|(p, _)| *p == ours), format!("{killed:?}"));
    }
    for unproven in [900030u64, 900031] {
        check!(
            b,
            "a chain the bridge could not prove was its own is NEVER terminated",
            !killed.iter().any(|(p, _)| *p == unproven),
            format!("{killed:?}")
        );
    }
    for guarded in [6076u64, 90552, 90553, 70001, 70002] {
        check!(b, "no daemon and no pre-existing chain was touched", !killed.iter().any(|(p, _)| *p == guarded), format!("{killed:?}"));
    }
    check!(
        b,
        "the advice is to ask the USER, which is the honest remaining move",
        st["launch"]["advice"].as_str().unwrap_or("").contains("ASK THE USER"),
        s(&st["launch"])
    );

    // And a fresh swx_start afterwards is allowed to try again — a finished
    // attempt is not a permanent lock.
    let again = b.call("swx_start", json!({"reason": "trying once more", "waitSeconds": 0}));
    check!(b, "a finished attempt does not block the next one", again["success"] == true, s(&again));
    let deadline = Instant::now() + Duration::from_secs(10);
    while m.invocations().len() <= 3 && Instant::now() < deadline {
        std::thread::sleep(Duration::from_millis(100));
    }
    check!(b, "...and it really did invoke again", m.invocations().len() > 3, format!("{:?}", m.invocations()));
    std::thread::sleep(Duration::from_millis(1500));
    check!(
        b,
        "a retry after a failure tries ONE route, not the whole plan again",
        m.invocations().len() == 4,
        format!("{:?}", m.invocations())
    );
}

#[test]
fn a_route_that_cannot_say_what_it_started_is_still_tried_when_it_started_nothing() {
    // The stop rule is about what a route LEFT BEHIND, not about whether it was
    // attributable. A route that started nothing at all leaves nothing behind,
    // so the machine may go on and try the ones that might actually work — the
    // two unattributable routes are kept precisely because they may be the ones
    // that launch SOLIDWORKS on this machine.
    let m = Machine::new(
        "nochain-continue",
        json!({"shellExecute": {"chain": false}, "powershell": {"chain": false},
               "explorer": {"chain": false},
               "cmdStart": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 40);

    check!(b, "the last route works and the launch attaches", st["launch"]["outcome"] == "attached", s(&st["launch"]));
    check!(
        b,
        "every route was tried, because none of the earlier ones left anything behind",
        m.invocations() == vec!["shellExecute", "powershell", "explorer", "cmdStart"],
        format!("{:?}", m.invocations())
    );
    check!(b, "and nothing was terminated anywhere", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    check!(
        b,
        "a route that started nothing says so, rather than inventing a stall at SecurityContext",
        st["launch"]["routesTried"][0]["note"]
            .as_str()
            .unwrap_or("")
            .contains("NO launcher log at all"),
        s(&st["launch"])
    );
    // AND IT IS NOT MEMORISED. `cmdStart` cannot say what it started, so no
    // launcher log can be attributed to it — the `Run Begin` in the log that
    // appeared might have been written by a launch the USER started while we
    // watched. SOLIDWORKS is up and usable (that is what `attached` means and
    // it is proven by COM), but nothing proves THIS ROUTE did it, so the route
    // memory is left alone rather than taught something that may be false.
    check!(
        b,
        "an unattributable route is never learned as 'the one that works'",
        st["launch"]["preferredRoute"].is_null() && st["launch"]["runBeginSeen"] == false,
        s(&st["launch"])
    );
    check!(
        b,
        "...and the log it could not attribute is reported as exactly that",
        st["launch"]["unattributedLog"] == true,
        s(&st["launch"])
    );
}

#[test]
fn a_root_the_census_cannot_see_is_still_confirmed_by_its_children() {
    // `rootVisible:false` — the invoke hands back a root whose image this
    // bridge does not watch (a shim, a wrapper), so the census never shows it.
    // Its CHILDREN are there, and their ppid points at the handle-proven pid,
    // so the lineage is confirmed and the chain is cleaned up. Getting this
    // wrong reported a "clean recovery" with a real chain still running.
    let m = Machine::new(
        "rootinvisible",
        json!({"shellExecute": {"chain": true, "rootVisible": false}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);

    let tried = &st["launch"]["routesTried"][0];
    check!(b, "the lineage was confirmed through the invisible root", tried["rootConfirmed"] == true, s(&st["launch"]));
    check!(b, "...so the chain was cleaned, not reported clean", tried["cleanup"] == "cleaned", s(&st["launch"]));
    let killed = m.terminated();
    check!(
        b,
        "the child the root started WAS ended",
        killed.iter().any(|(p, _)| *p == 900011),
        format!("{killed:?}")
    );
    check!(
        b,
        "...and the root itself was not, because the census never showed it",
        !killed.iter().any(|(p, _)| *p == 900010),
        format!("{killed:?}")
    );
}

#[test]
fn each_route_carries_the_log_evidence_that_belongs_to_it() {
    // The gate's per-route table is its central measurement. Every field it
    // prints must come from the ROUTE, not from the attempt — the attempt's
    // copies are reset when the next route begins, so reading them per row
    // printed the last route's evidence against all of them.
    let m = Machine::new(
        "perroute",
        json!({
            "shellExecute": {"chain": false},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300}
        }),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);
    let tried = st["launch"]["routesTried"].as_array().cloned().unwrap_or_default();

    check!(b, "both routes are in the table", tried.len() == 2, s(&st["launch"]));
    check!(
        b,
        "the route that started nothing has no log and no Run Begin OF ITS OWN",
        tried[0]["launcherLog"].is_null() && tried[0]["runBeginSeen"] == false,
        s(&tried[0])
    );
    check!(
        b,
        "the route that worked has both, and says which root it was given",
        tried[1]["runBeginSeen"] == true
            && tried[1]["launcherLog"].is_string()
            && tried[1]["rootPid"].is_u64()
            && tried[1]["rootConfirmed"] == true,
        s(&tried[1])
    );
    check!(
        b,
        "the attach is recorded as an ordering hint that is explicitly NOT proof",
        st["launch"]["lastRouteBeforeAttach"]["route"] == "powershell"
            && st["launch"]["lastRouteBeforeAttach"]["proof"] == false,
        s(&st["launch"])
    );
}

#[test]
fn an_attributable_route_that_never_sees_its_own_chain_stops_the_machine() {
    // The invoke handed back a root and the census never showed it, nor
    // anything descending from it. That is not "there was nothing to kill" —
    // it is "I never found what I started", and another route would put a
    // second chain beside one nobody can account for.
    let m = Machine::new(
        "notconfirmed",
        // `attributable:false` alone models "no handle"; here the route DOES
        // report a root, but the simulated chain never appears in the census.
        // Route 1 starts nothing (so the machine reaches route 2), and route 2
        // reports a root whose chain the census never shows. Before the
        // per-route reset, `root_confirmed` carried over and `notConfirmed`
        // was unreachable after route 1.
        json!({"shellExecute": {"chain": false},
               "powershell": {"chain": true, "invisibleChain": true}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);

    let tried = &st["launch"]["routesTried"][1];
    check!(b, "the route is recorded as never confirmed", tried["cleanup"] == "notConfirmed", s(&st["launch"]));
    check!(b, "...as a FAILURE to account, not a clean recovery", tried["cleanupFailed"] == true, s(&st["launch"]));
    check!(b, "...and it says a chain may remain", tried["chainMayRemain"] == true, s(&st["launch"]));
    check!(
        b,
        "the machine stopped rather than starting another chain",
        m.invocations().len() == 2,
        format!("{:?}", m.invocations())
    );
    check!(b, "and nothing was terminated", m.terminated().is_empty(), format!("{:?}", m.terminated()));
}

#[test]
fn an_attributable_route_that_gets_no_handle_cleans_up_nothing_and_stops() {
    // THE SHAPE ShellExecuteExW IS MOST LIKELY TO PRODUCE on a .lnk: the shell
    // hands the link to an already-running process (DDE) and returns no handle,
    // so a route that CAN normally attribute does not, on this launch. It must
    // behave exactly like `explorer`: adopt nothing, kill nothing, and stop
    // once a launcher log shows something started.
    let m = Machine::new(
        "nohandle",
        json!({"shellExecute": {"chain": true, "attributable": false}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);

    check!(b, "nothing was attributed", st["launch"]["attributed"] == false, s(&st["launch"]));
    let tried = &st["launch"]["routesTried"][0];
    check!(b, "the route is recorded as unattributable", tried["cleanup"] == "notAttributable", s(&st["launch"]));
    check!(b, "...and says a chain may remain", tried["chainMayRemain"] == true, s(&st["launch"]));
    check!(
        b,
        "the machine stopped after ONE route, because a log says something started",
        m.invocations() == vec!["shellExecute".to_string()],
        format!("{:?}", m.invocations())
    );
    check!(b, "NOTHING was terminated", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    let chain = m.lines("invocations.jsonl").len();
    check!(b, "one invocation only", chain == 1, format!("{chain}"));
}

#[test]
fn a_retry_after_a_failure_waits_instead_of_starting_more_chains() {
    let m = Machine::new("backoff", json!({}));
    let b = m.boot(
        TempDir::new("scratch"),
        &[("SWX_LAUNCH_RUN_BEGIN_SECS", "1"), ("SWX_LAUNCH_BACKOFF_SECS", "300")],
    );
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 40);
    check!(b, "precondition: the attempt failed", st["launch"]["outcome"] == "exhausted", s(&st["launch"]));
    let after_first = m.invocations().len();

    let r = b.call("swx_start", json!({"reason": "and again", "waitSeconds": 0}));
    check!(b, "the retry is refused with a branchable code", r["errorCode"] == "host_app_launch_backoff", s(&r));
    check!(b, "...saying how long", r["backoffSeconds"].as_u64().unwrap_or(0) > 0, s(&r));
    check!(
        b,
        "...and pointing at the human, which is the honest remaining move",
        r["_hint"].as_str().unwrap_or("").contains("ASK THE USER"),
        s(&r)
    );
    std::thread::sleep(Duration::from_millis(800));
    check!(
        b,
        "NOT ONE new launcher chain was started by the refused retry",
        m.invocations().len() == after_first,
        format!("{:?}", m.invocations())
    );
}

#[test]
fn solidworks_up_but_not_attaching_stops_the_machine_instead_of_launching_another() {
    // sldworks.exe IS on the user's desktop — probably at a 3DEXPERIENCE
    // sign-in only they can answer. That is NOT a stalled launcher: the chain
    // must not be killed for it, no further route may be tried (a second route
    // would put a SECOND SOLIDWORKS on their screen), and it must not be
    // reported as attached.
    let m = Machine::new(
        "upnotattached",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_ATTACH_SECS", "3")]);
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 25);

    check!(
        b,
        "the outcome names what is true: up, and not attached",
        st["launch"]["outcome"] == "sldworksUpNotAttached",
        s(&st["launch"])
    );
    check!(b, "...and it is NEVER reported as attached", st["launch"]["stage"] != "attached", s(&st["launch"]));
    check!(
        b,
        "...pointing at the sign-in only the user can answer",
        st["launch"]["error"].as_str().unwrap_or("").contains("sign-in"),
        s(&st["launch"])
    );
    check!(b, "no second route was tried", m.invocations() == vec!["shellExecute".to_string()], format!("{:?}", m.invocations()));
    check!(b, "and the chain was NOT killed — SOLIDWORKS is coming up on their screen", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    check!(
        b,
        "the route is not remembered as one that worked",
        st["launch"]["preferredRoute"].is_null(),
        s(&st["launch"])
    );
}

#[test]
fn the_crash_reporters_restart_button_is_clicked_once_and_nothing_else_is() {
    // FAILURE MODE C, 2026-09-03: sldworks crashed on first spawn, the crash
    // reporter appeared, and clicking "Restart SOLIDWORKS Design" launched it.
    // pid 900012 is the sldworks.exe the simulator spawns for invocation 1 —
    // the crash reporter must be ATTRIBUTED to the process we are launching,
    // not merely titled like one.
    let ab = AbStub::start(json!([
        {"hwnd": 111, "title": "SOLIDWORKS Design has stopped working", "className": "#32770", "pid": 900012, "rect": {"left": 0}},
        {"hwnd": 222, "title": "Save changes to Part1?", "className": "#32770", "pid": 900012, "rect": {"left": 0}},
        {"hwnd": 333, "title": "gallia - Google Chrome", "className": "Chrome_WidgetWin_1", "pid": 4242, "rect": {"left": 0}}
    ]));
    ab.set_response(
        "desktop_find_control",
        json!({"success": true, "found": true, "name": "Restart SOLIDWORKS Design", "role": "button", "invokable": true}),
    );
    ab.set_response("desktop_ui_click", json!({"success": true, "invoked": true, "name": "Restart SOLIDWORKS Design"}));

    let m = Machine::new(
        "crash",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 1200}}),
    );
    let b = m.boot(
        TempDir::new("scratch"),
        &[
            ("ADOM_DIRECT_API_URL", &ab.url),
            ("ADOM_BRIDGE_TOKEN", "test-token"),
            // SHIPPED OFF. The click is decided from the shape of ab's
            // desktop_find_control reply, and that shape has never been seen on
            // a real desktop — so the feature is armed explicitly, here and by
            // the live gate, and nowhere else.
            ("SWX_CRASH_RECOVERY", "on"),
        ],
    );
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS to model a bracket", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 25);
    check!(b, "the launch still completes", st["launch"]["outcome"] == "attached", s(&st["launch"]));

    let clicks = ab.calls_to("desktop_ui_click");
    check!(b, "the Restart button was clicked EXACTLY once, however many polls ran", clicks.len() == 1, format!("{clicks:?}"));
    let args = &clicks[0]["args"];
    check!(b, "...on the crash reporter's window", args["hwnd"] == 111, s(&clicks[0]));
    check!(b, "...targeting the button BY NAME, never a coordinate", args["contains"] == "Restart SOLIDWORKS" && args["role"] == "button", s(&clicks[0]));
    check!(
        b,
        "...with a reason a human can read in their Activity Log",
        args["reason"].as_str().unwrap_or("").contains("crashed"),
        s(&clicks[0])
    );
    check!(
        b,
        "the button was CONFIRMED to exist before it was clicked",
        !ab.calls_to("desktop_find_control").is_empty(),
        format!("{:?}", ab.calls())
    );
    // NOTHING ELSE was touched. The Save-changes dialog is the one that must
    // never be answered by a bridge, and it was on screen the whole time.
    check!(b, "no window was closed", ab.calls_to("desktop_ui_window").is_empty(), format!("{:?}", ab.calls()));
    check!(b, "no shell command was run", ab.calls_to("shell_execute").is_empty(), format!("{:?}", ab.calls()));
    check!(
        b,
        "the user's Save-changes dialog was never touched",
        !ab.calls().iter().any(|c| c.to_string().contains("222")),
        format!("{:?}", ab.calls())
    );
    let ledger = b.call("swx_action_ledger", json!({"limit": 200}));
    check!(b, "the click is on the record", s(&ledger).contains("solidworks_crash_reporter_restarted"), s(&ledger));
}

#[test]
fn a_window_that_merely_looks_like_a_crash_reporter_is_never_clicked() {
    // The gate is the BUTTON, not the title. ab says the control is not there,
    // so nothing may be clicked — a title is a guess and a click is an act.
    let ab = AbStub::start(json!([
        {"hwnd": 111, "title": "SOLIDWORKS Error Report", "className": "#32770", "pid": 900012, "rect": {"left": 0}}
    ]));
    ab.set_response("desktop_find_control", json!({"success": true, "found": false}));
    let m = Machine::new(
        "nocrash",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 1000}}),
    );
    let b = m.boot(
        TempDir::new("scratch"),
        &[
            ("ADOM_DIRECT_API_URL", &ab.url),
            ("ADOM_BRIDGE_TOKEN", "test-token"),
            ("SWX_CRASH_RECOVERY", "on"),
        ],
    );
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    wait_for_launch(&b, 25);
    check!(b, "no click was dispatched at all", ab.calls_to("desktop_ui_click").is_empty(), format!("{:?}", ab.calls()));
    check!(b, "...though the window WAS looked at", !ab.calls_to("desktop_find_control").is_empty(), format!("{:?}", ab.calls()));
}

#[test]
fn crash_recovery_is_off_unless_it_is_explicitly_armed() {
    // It ships DISABLED. The decision to click rests entirely on the shape of
    // ab's desktop_find_control reply, and no reply from that verb has ever
    // been observed on a real desktop — so until the live gate captures one,
    // the bridge reports the crash reporter and does nothing about it.
    let ab = AbStub::start(json!([
        {"hwnd": 111, "title": "SOLIDWORKS Design has stopped working", "className": "#32770", "pid": 900012, "rect": {"left": 0}}
    ]));
    ab.set_response(
        "desktop_find_control",
        json!({"success": true, "found": true, "name": "Restart SOLIDWORKS Design", "invokable": true}),
    );
    let m = Machine::new(
        "crashoff",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 1000}}),
    );
    let b = m.boot(
        TempDir::new("scratch"),
        &[("ADOM_DIRECT_API_URL", &ab.url), ("ADOM_BRIDGE_TOKEN", "test-token")],
    );
    b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 25);
    check!(b, "the launch is unaffected", st["launch"]["outcome"] == "attached", s(&st["launch"]));
    check!(
        b,
        "ab was never even asked about the window, let alone told to click it",
        ab.calls_to("desktop_find_control").is_empty() && ab.calls_to("desktop_ui_click").is_empty(),
        format!("{:?}", ab.calls())
    );
    check!(
        b,
        "...and the report says so, so a reader knows the feature is not armed",
        st["launch"]["crashRecovery"] == "off",
        s(&st["launch"])
    );
}

#[test]
fn a_hung_solidworks_is_reported_as_hung_and_a_second_one_is_never_launched() {
    // FAILURE MODE D. SOLIDWORKS is alive, the window is not answering, COM
    // times out. The old bridge said "not running, and this edition cannot be
    // started programmatically" — and on a shortcut machine it would have
    // launched a SECOND SOLIDWORKS onto the user's desktop.
    let m = Machine::new("hung", json!({}))
        .with_running_solidworks()
        .sldworks(json!({"responding": false, "hwnd": 4242, "privateMB": 2400, "handles": 9000}));
    let scratch = TempDir::new("scratch");
    let scratch_path = scratch.0.clone();
    let b = m.boot(scratch, &[]);
    // BOTH signals, from two independent causes: Windows says the window is not
    // answering (above), and a COM call this bridge made overran its budget.
    // Neither alone is a hang, and the bridge must not manufacture the second
    // one out of its own busy com host — see the adversary test.
    std::fs::write(scratch_path.join("mock-com-timeout"), "").unwrap();

    let r = b.call("swx_start", json!({"reason": "trying to use SOLIDWORKS"}));
    check!(b, "the bridge says it is HUNG, with a branchable code", r["errorCode"] == "host_app_hung", s(&r));
    check!(
        b,
        "...and says only the user can end it, and why",
        r["_hint"].as_str().unwrap_or("").contains("ONLY THE USER CAN END IT"),
        s(&r)
    );
    check!(b, "NOTHING was launched", m.invocations().is_empty(), format!("{:?}", m.invocations()));
    check!(b, "and nothing was killed", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    check!(
        b,
        "the evidence is reported, not just the verdict",
        r["solidworksProcess"]["responding"] == false && r["solidworksProcess"]["processId"] == 88556,
        s(&r)
    );

    // swx_status tells the same story WITHOUT COM — which is the point, because
    // COM is what has stopped answering.
    let st = b.call("swx_status", json!({}));
    check!(b, "swx_status reports responding:false read from the OS, not from COM", st["solidworks"]["responding"] == false, s(&st["solidworks"]));
    check!(b, "...with the memory and handle counts a human needs", st["solidworks"]["privateMemoryMB"] == 2400 && st["solidworks"]["handles"] == 9000, s(&st["solidworks"]));
    check!(
        b,
        "...and resident memory beside the commit charge, so neither is read as 'memory'",
        st["solidworks"]["workingSetMB"].is_u64(),
        s(&st["solidworks"])
    );

    // TAKE THE TIMEOUT AWAY and the verdict must go with it: a window that is
    // not pumping messages, on its own, is a rebuild — not a hang.
    std::fs::remove_file(scratch_path.join("mock-com-timeout")).unwrap();
    let st2 = b.call("swx_status", json!({}));
    check!(
        b,
        "one signal alone is never a hang",
        st2["solidworks"]["hung"] != json!(true),
        s(&st2["solidworks"])
    );
}

#[test]
fn a_very_large_session_is_an_observation_not_a_verdict() {
    // 2026-09-03: 17.4 GB private, 52 documents, and BOTH stock templates
    // returned no document. That measurement is worth REPORTING — and it is not
    // a verdict. The 0.4.0 threshold (12 GB / 40 docs) called the same
    // machine's HEALTHY 13.1 GB / 33-document session out of room and told the
    // user to restart it, so memory is now advisory and the only sufficient
    // signal is SOLIDWORKS handing back no document (below).
    let m = Machine::new("exhausted", json!({}))
        .with_running_solidworks()
        .sldworks(json!({"responding": true, "hwnd": 4242, "privateMB": 17900, "handles": 21770}));
    let b = m.boot(TempDir::new("scratch"), &[]);

    let r = b.call("swx_start", json!({"reason": "trying to model"}));
    check!(
        b,
        "swx_start refuses to launch a second copy, and names what is ACTUALLY known",
        r["errorCode"] == "host_app_com_unreachable",
        s(&r)
    );
    check!(b, "nothing was launched", m.invocations().is_empty(), format!("{:?}", m.invocations()));

    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "the memory figure is reported as an OBSERVATION",
        st["solidworks"]["memoryAdvisory"].as_str().unwrap_or("").contains("17900"),
        s(&st["solidworks"])
    );
    check!(
        b,
        "...explicitly not a verdict",
        st["solidworks"]["memoryAdvisory"].as_str().unwrap_or("").contains("not a verdict"),
        s(&st["solidworks"])
    );
    check!(
        b,
        "...and `exhausted` stays null, because nothing has proved it",
        st["solidworks"]["exhausted"].is_null(),
        s(&st["solidworks"])
    );
}

#[test]
fn a_new_document_that_comes_back_empty_is_exhaustion_not_a_template_fault() {
    let m = Machine::new(
        "newdoc",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0, "attachAfterMs": 0}}),
    );
    let b = m.boot(TempDir::new("scratch"), &[]);
    b.call("swx_start", json!({"reason": "modelling", "waitSeconds": 10}));
    let ok = b.call("swx_new_document", json!({"type": "part"}));
    check!(b, "a healthy session creates documents normally", ok["success"] == true, s(&ok));

    // Now SOLIDWORKS accepts the call and hands back nothing — the signature.
    std::fs::write(b.scratch.join("mock-newdoc-empty"), "").unwrap();
    let r = b.call("swx_new_document", json!({"type": "assembly"}));
    check!(b, "an empty NewDocument is reported as exhaustion", r["errorCode"] == "host_app_exhausted", s(&r));
    check!(b, "...quoting what SOLIDWORKS actually said", r["hostAppError"].as_str().unwrap_or("").contains("created no document"), s(&r));
    check!(b, "...and telling the caller not to loop on it", r["_hint"].as_str().unwrap_or("").contains("Do NOT retry"), s(&r));
}

#[test]
fn ownership_survives_an_unanswerable_probe_and_a_com_host_respawn() {
    // BUG #5, in both the shapes that were observed. No simulator needed: this
    // is about the SERVER's registry, not about launching.
    let scratch = TempDir::new("scratch");
    let scratch_path = scratch.0.clone();
    let b = Bridge::start_in(TempDir::borrowed(&scratch_path), &[]);
    b.call("swx_start", json!({}));
    let made = b.call("swx_new_document", json!({"type": "part"}));
    let title = made["created"]["title"].as_str().unwrap_or("Part1").to_string();
    check!(b, "the bridge created a document", made["success"] == true, s(&made));

    let write = b.call("swx_props_set", json!({"targetDocument": title, "properties": {"Owner": "bridge"}}));
    check!(b, "it may write to its own document", write["success"] == true, s(&write));

    // ...and the claim is ON DISK, not only in this process's memory.
    let registry: Value =
        serde_json::from_str(&std::fs::read_to_string(scratch_path.join("owned-docs.json")).unwrap()).unwrap();
    check!(b, "the ownership registry is persisted", s(&registry).contains(&title), s(&registry));

    // THE OBSERVED FAILURE: one probe SOLIDWORKS could not answer. The old code
    // read that as "no session, nothing open" and pruned the registry empty —
    // permanently disowning documents the bridge had created seconds earlier.
    std::fs::write(scratch_path.join("mock-fail-app-state"), "").unwrap();
    let blind = b.call("swx_props_set", json!({"targetDocument": title, "properties": {"Owner": "bridge"}}));
    check!(b, "an unanswerable probe fails HONESTLY", blind["success"] == false, s(&blind));
    check!(
        b,
        "...and never claims the document was not ours",
        !s(&blind).contains("did not create"),
        s(&blind)
    );
    std::fs::remove_file(scratch_path.join("mock-fail-app-state")).unwrap();

    let after = b.call("swx_props_set", json!({"targetDocument": title, "properties": {"Owner": "bridge"}}));
    check!(b, "OWNERSHIP SURVIVED the blind window", after["success"] == true, s(&after));

    // THE SECOND SHAPE: the com host is killed mid-build and respawns.
    let host_pid = b.call("swx_status", json!({}))["com"]["hostPid"].as_u64().unwrap();
    assert!(
        std::process::Command::new("kill")
            .args(["-9", &host_pid.to_string()])
            .status()
            .expect("kill the com host")
            .success(),
        "could not kill com host {host_pid}"
    );
    std::thread::sleep(Duration::from_millis(300));
    let st = b.call("swx_status", json!({}));
    check!(b, "the com host really was replaced", st["com"]["hostPid"].as_u64().unwrap_or(host_pid) != host_pid, s(&st["com"]));
    let survived = b.call("swx_props_set", json!({"targetDocument": title, "properties": {"Owner": "bridge"}}));
    check!(b, "OWNERSHIP SURVIVED the respawn", survived["success"] == true, s(&survived));

    // ...and a whole new SERVER reads the registry back off disk.
    drop(b);
    let b2 = Bridge::start_in(TempDir::borrowed(&scratch_path), &[]);
    let st2 = b2.call("swx_status", json!({}));
    check!(b2, "a restarted bridge restores the registry", b2.log().contains("ownership registry restored"), b2.log());
    check!(b2, "...and is otherwise healthy", st2["success"] == true, s(&st2));
}

#[test]
fn a_bridge_that_cannot_see_the_machine_still_launches_rather_than_refusing() {
    // No simulator, not Windows: the process census cannot be taken. UNKNOWN
    // must not become "SOLIDWORKS is running" (which would refuse every launch)
    // NOR a silent claim that it is not. The launch proceeds, and the report
    // says the census failed rather than inventing a census.
    let lnk = TempDir::new("lnk");
    let path = format!("{}/SOLIDWORKS Design.lnk", lnk.path());
    std::fs::write(&path, "x").unwrap();
    let b = Bridge::start_with(&[
        ("SWX_SOLIDWORKS_SHORTCUT", &path),
        ("SWX_LAUNCH_RUN_BEGIN_SECS", "1"),
        ("SWX_LAUNCH_POLL_MS", "100"),
    ]);
    let r = b.call("swx_start", json!({"reason": "starting SOLIDWORKS", "waitSeconds": 0}));
    check!(b, "the launch is attempted", r["success"] == true && r["stillLaunching"] == true, s(&r));
    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "an unavailable census is reported as unavailable, never as 'not running'",
        st["solidworks"]["running"].is_null() || st["solidworks"]["censusError"].is_string(),
        s(&st["solidworks"])
    );
    check!(
        b,
        "...and responsiveness is UNKNOWN rather than a comfortable 'yes'",
        st["solidworks"]["responding"].is_null(),
        s(&st["solidworks"])
    );
}


#[test]
fn a_corrupt_registry_falls_back_to_the_previous_generation() {
    // `write_atomic` keeps one generation as `.bak`, and it is a strictly
    // better answer than owning nothing: it is a registry this bridge itself
    // wrote one write ago, so at worst it is missing the newest claim — while
    // owning nothing refuses every document the bridge created before the
    // restart, which IS bug #5.
    let scratch = TempDir::new("scratch");
    let dir = scratch.0.clone();
    {
        let b = Bridge::start_in(TempDir::borrowed(&dir), &[]);
        b.call("swx_start", json!({}));
        let a = b.call("swx_new_document", json!({"type": "part"}));
        check!(b, "a document is created and owned", a["success"] == true, s(&a));
        // A second write, so a .bak generation exists containing the first.
        let c = b.call("swx_new_document", json!({"type": "part"}));
        check!(b, "...and a second", c["success"] == true, s(&c));
    }
    check!(
        Bridge::start_in(TempDir::borrowed(&dir), &[]),
        "precondition: a backup generation exists",
        dir.join("owned-docs.bak").exists(),
        format!("{:?}", std::fs::read_dir(&dir).unwrap().count())
    );

    // A rewrite interrupted half way through.
    std::fs::write(dir.join("owned-docs.json"), r#"{"documents":[{"title":"Part1","sess"#).unwrap();
    let b2 = Bridge::start_in(TempDir::borrowed(&dir), &[]);
    let log = b2.log();
    check!(b2, "the corruption is reported, loudly", log.contains("UNREADABLE") || log.contains("could not be read"), log.clone());
    check!(
        b2,
        "...and the previous generation is used instead of owning nothing",
        log.contains("recovered from owned-docs.bak"),
        log
    );
}

#[test]
fn an_unknown_interference_count_reaches_the_caller_as_null_with_guidance() {
    // The shape has to be TESTED, not just produced: `count: null` on a
    // clearance report is the one null in this bridge that can reach a physical
    // part, and every caller's truthiness check reads it as zero.
    let b = Bridge::start();
    b.call("swx_start", json!({"reason": "checking clearances"}));
    let made = b.call("swx_new_document", json!({"type": "assembly"}));
    let title = made["created"]["title"].as_str().unwrap_or("Assem1").to_string();

    let ok = b.call("swx_interference", json!({"targetDocument": title}));
    check!(b, "a normal check reports a count and says it is known", ok["count"] == 1 && ok["countKnown"] == true, s(&ok));

    std::fs::write(b.scratch.join("mock-interference-count-unknown"), "").unwrap();
    let r = b.call("swx_interference", json!({"targetDocument": title}));
    check!(b, "an uncountable check answers null, never 0", r["count"].is_null() && r["countKnown"] == false, s(&r));
    check!(
        b,
        "...and the hint tells the caller not to use a truthiness check on it",
        r["_hint"].as_str().unwrap_or("").contains("never with a truthiness check")
            && r["_hint"].as_str().unwrap_or("").contains("countKnown"),
        s(&r)
    );
    check!(
        b,
        "...saying plainly that null is not a clear result",
        r["_hint"].as_str().unwrap_or("").contains("NOT a clear result"),
        s(&r)
    );

    // The same shape on the other two newly-nullable counts.
    std::fs::write(b.scratch.join("mock-doccount-unknown"), "").unwrap();
    let rec = b.call("swx_check_recovery", json!({}));
    check!(b, "an unknown open-document count is null, not 0", rec["com"]["openDocuments"].is_null(), s(&rec));

    std::fs::write(b.scratch.join("mock-component-count-unknown"), "").unwrap();
    let add = b.call("swx_add_component", json!({
        "targetDocument": title,
        "components": [{"file": "C:\\mock\\bracket.sldprt", "xMm": 0, "yMm": 0, "zMm": 0}]
    }));
    check!(
        b,
        "an uncountable assembly refuses the insert rather than risking a DOUBLE insert",
        add["success"] == false && add["errorCode"] == "component_count_failed",
        s(&add)
    );
    check!(
        b,
        "...and says why, in terms of the harm",
        add["error"].as_str().unwrap_or("").contains("TWICE"),
        s(&add)
    );
}


#[test]
fn a_not_responding_solidworks_that_is_burning_cpu_is_reported_as_busy() {
    // LIVE, 2026-09-08: 17.9 GB with an unsaved assembly, not-responding and a
    // COM timeout for ~5 minutes, ~70% of a core, memory creeping, NO dialog —
    // and it RECOVERED once Drew saved. The bridge said "only the user can end
    // it". `verdict` exists so a caller can tell "wait" from "it is gone".
    let m = Machine::new("busy", json!({}))
        .with_running_solidworks()
        .sldworks(json!({
            "responding": false, "hwnd": 4242, "privateMB": 17900, "handles": 21000,
            // Every metrics read advances the simulated CPU clock: work IS
            // happening, which is the whole point.
            "cpuSeconds": 1000.0, "cpuSecondsPerRead": 12.0
        }));
    let scratch = TempDir::new("scratch");
    let dir = scratch.0.clone();
    let b = m.boot(scratch, &[]);
    std::fs::write(dir.join("mock-com-timeout"), "").unwrap();

    // Two reads far enough apart: the verdict needs a sample, and one reading is
    // never enough to call a session dead.
    b.call("swx_status", json!({}));
    let st = b.call("swx_status", json!({}));
    let sw = &st["solidworks"];
    check!(b, "the window is not responding and a COM call timed out", sw["hung"] == true, s(sw));
    check!(b, "...but the verdict is BUSY, not dead", sw["verdict"] == "busy", s(sw));
    check!(
        b,
        "...and the advice is to WAIT, not to end the task",
        sw["verdictAdvice"].as_str().unwrap_or("").contains("WAIT")
            && !sw["verdictAdvice"].as_str().unwrap_or("").contains("ONLY THE USER CAN END IT"),
        s(sw)
    );
    check!(b, "...with the CPU it burned across the sample", sw["cpuActiveSeconds"].as_f64().unwrap_or(0.0) > 0.0, s(sw));
    check!(b, "...and the memory delta beside it", sw["memoryDeltaMB"].is_i64(), s(sw));
}

#[test]
fn one_reading_never_calls_a_session_dead() {
    // The guard that would have stopped the wrong call: with no previous sample
    // there is no CPU delta, so the verdict is UNKNOWN however bad it looks.
    let m = Machine::new("onesample", json!({}))
        .with_running_solidworks()
        .sldworks(json!({"responding": false, "hwnd": 4242, "privateMB": 17900, "cpuSecondsPerRead": 0.0}));
    let scratch = TempDir::new("scratch");
    let dir = scratch.0.clone();
    let b = m.boot(scratch, &[]);
    std::fs::write(dir.join("mock-com-timeout"), "").unwrap();
    let st = b.call("swx_status", json!({}));
    let sw = &st["solidworks"];
    check!(b, "a single reading is UNKNOWN, never dead", sw["verdict"] == "unknown", s(sw));
    check!(
        b,
        "...and it says to poll again rather than concluding",
        sw["verdictAdvice"].as_str().unwrap_or("").contains("Poll swx_status again"),
        s(sw)
    );
}

// ════════════════════════════════════════════════════════════════════════════
// LIVE, 2026-09-11 — A SIGN-IN WAIT IS NOT A STALL
// ════════════════════════════════════════════════════════════════════════════

/// Drew's machine, and the worst thing this bridge has done to date.
///
/// A cold launch stopped at the 3DEXPERIENCE ID sign-in — a native WebView2
/// window (`DSYSysLoginPanelWebView2Class`) owned by `SWXDesktopLauncher.exe` in
/// the bridge's OWN chain, with no controls UIA can even see. The
/// "sldworks.exe within 120s" deadline then fired while he was reading it, and
/// the machine killed its own chain — including the window he was about to type
/// into — escalated to the next route, killed that too, and finished
/// `exhausted`.
///
/// The launch was not stalled. It was waiting for a person, and a person is
/// slower than any budget worth setting.
#[test]
fn a_sign_in_window_pauses_every_deadline_instead_of_killing_the_chain() {
    // sldworks NEVER appears while the sign-in is up: on the old code the
    // 4-second budget here would fire and kill the chain.
    let m = Machine::new(
        "signin",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0}}),
    );
    // The sign-in window, owned by whichever of our launcher pids is asked.
    std::fs::write(
        m.dir.join("sign-in.json"),
        json!({"hwnd": 777001, "className": "DSYSysLoginPanelWebView2Class",
               "title": "Login | 3DEXPERIENCE ID | Dassault Systemes"})
            .to_string(),
    )
    .unwrap();
    let b = m.boot(TempDir::new("signin-scratch"), &[]);
    let r = b.call("swx_start", json!({"waitSeconds": 0, "reason": "the user asked for SOLIDWORKS"}));
    check!(b, "the launch is in flight", r["success"] == true || r["stillLaunching"] == true, s(&r));

    // Well past the sldworks budget (4s here, 120s live) with the window up.
    std::thread::sleep(std::time::Duration::from_secs(7));
    let st = b.call("swx_status", json!({}));
    let launch = &st["launch"];
    check!(
        b,
        "NOTHING was killed while the user was being asked to sign in",
        m.terminated().is_empty(),
        format!("{:?}", m.terminated())
    );
    check!(
        b,
        "...the machine did not escalate to another route",
        m.invocations() == vec!["shellExecute".to_string()],
        format!("{:?}", m.invocations())
    );
    check!(
        b,
        "...the stage SAYS it is waiting on a sign-in",
        launch["stage"] == "helperSignIn" || launch["signInSeen"] == true,
        s(launch)
    );
    check!(b, "...and the attempt is not finished", launch["finished"] != true, s(launch));
    // 0.9.12: SAID PLAINLY, with the window — "waitingOn: userSignIn".
    check!(
        b,
        "...swx_status says it is waiting on the USER's sign-in, naming the window",
        st["waitingOn"] == "userSignIn"
            && st["signInWindow"]["title"].as_str().unwrap_or("").contains("3DEXPERIENCE ID") && st["signInWindow"]["hwnd"].is_number(),
        s(&st)
    );

    // The user signs in: the window closes and SOLIDWORKS comes up.
    std::fs::remove_file(m.dir.join("sign-in.json")).unwrap();
    std::fs::write(
        m.dir.join("routes.json"),
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0,
                                "attachAfterMs": 0}})
            .to_string(),
    )
    .unwrap();
    let mut attached = false;
    for _ in 0..60 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        let st = b.call("swx_status", json!({}));
        if st["launch"]["stage"] == "attached" || st["com"]["running"] == true {
            attached = true;
            break;
        }
    }
    let st = b.call("swx_status", json!({}));
    check!(b, "once signed in, the launch attaches", attached, s(&st["launch"]));
    check!(
        b,
        "...and the session is still recorded as OURS — attribution survives the wait",
        st["launch"]["attributed"] == true,
        s(&st["launch"])
    );
    check!(b, "...with nothing killed, start to finish", m.terminated().is_empty(),
           format!("{:?}", m.terminated()));
}

/// The other half: an unreadable window census must PAUSE too. Resuming a
/// deadline on a census we could not take is how the machine killed a window it
/// could not see.
#[test]
fn a_window_census_that_cannot_be_read_pauses_the_deadline_too() {
    let m = Machine::new(
        "signin-blind",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0}}),
    );
    std::fs::write(m.dir.join("window-census-fails"), "").unwrap();
    let b = m.boot(TempDir::new("signin-blind-scratch"), &[]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));
    std::thread::sleep(std::time::Duration::from_secs(7));
    check!(
        b,
        "a blind census does not license a kill",
        m.terminated().is_empty(),
        format!("{:?}", m.terminated())
    );
}

/// RE-ATTRIBUTION NEEDS LINEAGE, not just timing.
///
/// A session that comes up after the bridge gave up IS often the one it started
/// — that is the live failure 0.6.0 fixed. But "it started after our invoke and
/// we never saw another launcher chain" is timing plus the ABSENCE of an
/// observation, and absence is not evidence: a chain that started and finished
/// between two censuses was never seen at all. 0.6.1 requires a positive link —
/// a parent walk that reaches our own chain, or a launcher log a thread of our
/// chain wrote.
#[test]
fn a_session_with_no_link_to_our_chain_is_not_adopted_after_the_fact() {
    let m = Machine::new(
        "reattr-nolineage",
        // Every route fails to attach, so the attempt finishes un-attached.
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0},
               "powershell": {"chain": false},
               "explorer": {"chain": false},
               "cmdStart": {"chain": false}}),
    );
    let b = m.boot(TempDir::new("reattr-nolineage-scratch"), &[]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));
    // Let the attempt run itself out.
    let mut finished = false;
    for _ in 0..80 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["launch"]["finished"] == true {
            finished = true;
            break;
        }
    }
    check!(b, "precondition: the attempt finished without attaching", finished, "never finished");

    // NOW SOLIDWORKS APPEARS — with no parent link to anything of ours.
    std::fs::write(
        m.dir.join("preexisting.json"),
        json!([{"pid": 99001, "image": "SLDWORKS.exe", "ageSeconds": 0}]).to_string(),
    )
    .unwrap();
    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "a SOLIDWORKS with no proven link to our chain is NOT claimed as ours",
        st["launch"]["attributed"] != true && st["launch"]["outcome"] != "attachedAfterSignIn",
        s(&st["launch"])
    );
}

/// PASS 16, finding 2. A DEAD parent may be lineage — the launcher always exits
/// once SOLIDWORKS is up — but "a pid we once recorded" is not enough once that
/// process is gone: the NUMBER is free. A user's launcher that reuses it would
/// have its SOLIDWORKS record our dead pid as its parent, with nothing alive left
/// to contradict it, and "the child is younger than the parent" is vacuously true
/// of anything that started later.
///
/// So the child must have been created inside the window we actually WATCHED the
/// parent run, plus a grace for the poll interval.
#[test]
fn a_child_that_appeared_long_after_our_launcher_died_is_not_its_descendant() {
    let m = Machine::new(
        "lineage-window",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0}}),
    );
    let b = m.boot(TempDir::new("lineage-window-scratch"), &[]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));
    let mut finished = false;
    for _ in 0..80 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["launch"]["finished"] == true {
            finished = true;
            break;
        }
    }
    check!(b, "precondition: the attempt finished", finished, "never finished");

    // A SOLIDWORKS that claims our launcher's pid as its parent but was created
    // an hour after we last saw that launcher alive: a recycled pid, not a child.
    let chain = b.call("swx_status", json!({}))["launch"]["chainPids"].clone();
    let launcher = chain
        .as_array()
        .and_then(|a| a.iter().find(|p| p["image"] == "SWXDesktopLauncher.exe"))
        .and_then(|p| p["pid"].as_u64())
        .unwrap_or(0);
    check!(b, "precondition: we recorded a launcher pid", launcher > 0, format!("{chain}"));
    std::fs::write(m.dir.join("sldworks-parent"), launcher.to_string()).unwrap();
    std::fs::write(
        m.dir.join("preexisting.json"),
        json!([{"pid": 99123, "image": "SLDWORKS.exe", "ageSeconds": -3600}]).to_string(),
    )
    .unwrap();

    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "a process created long after that launcher died is not adopted as its child",
        st["launch"]["outcome"] != "attachedAfterSignIn",
        s(&st["launch"])
    );
}

/// PID REUSE, END TO END — through the whole bridge, with the simulator finally
/// able to pose it (`census-overrides.json` retires a pid and reissues it with a
/// new creation time).
///
/// HONEST LIMIT OF THIS TEST, because a test nobody can characterise is worse
/// than none: it asserts the OUTCOME (the bridge does not adopt that session),
/// and I could NOT establish which guard produces it. Disabling the `same_process`
/// check and the lifetime-window check — together, not just one — leaves it
/// passing, so something earlier in `reattribute_after_attach` is refusing and
/// this test does not pin the lineage rule. The rule itself is proved directly,
/// with a mutation check that does fail when it is removed, in
/// `launch::tests::a_child_created_after_we_last_saw_the_parent_alive_is_not_its_descendant`.
/// What this test genuinely covers is the WHOLE PATH: a census that retires and
/// reissues a pid does not end with somebody else's session recorded as ours.
#[test]
fn a_recycled_launcher_pid_does_not_make_someone_elses_solidworks_ours() {
    let m = Machine::new(
        "pid-reuse",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0}}),
    );
    let b = m.boot(TempDir::new("pid-reuse-scratch"), &[]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));
    let mut finished = false;
    for _ in 0..80 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["launch"]["finished"] == true {
            finished = true;
            break;
        }
    }
    check!(b, "precondition: the attempt finished", finished, "never finished");
    let chain = b.call("swx_status", json!({}))["launch"]["chainPids"].clone();
    let launcher = chain
        .as_array()
        .and_then(|a| a.iter().find(|p| p["image"] == "SWXDesktopLauncher.exe"))
        .and_then(|p| p["pid"].as_u64())
        .unwrap_or(0);
    check!(b, "precondition: we recorded and watched a launcher", launcher > 0, format!("{chain}"));

    let before = b.call("swx_status", json!({}))["launch"]["outcome"].clone();

    // OUR launcher is retired and the number REISSUED to the user's, created now
    // — inside the grace window, so timing alone cannot tell them apart. Their
    // SOLIDWORKS, created now too, names that number as its parent.
    std::fs::write(
        m.dir.join("census-overrides.json"),
        json!([
            {"retire": launcher},
            {"pid": launcher, "image": "SWXDesktopLauncher.exe", "ageSeconds": 0},
            {"pid": 991234, "image": "SLDWORKS.exe", "ageSeconds": 0, "ppid": launcher}
        ])
        .to_string(),
    )
    .unwrap();
    // ...and COM becomes attachable, which is what makes re-attribution REACHABLE
    // at all: without an attach it returns before it ever consults lineage, and
    // this test would pass while proving nothing.
    std::fs::write(
        m.dir.join("routes.json"),
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0,
                                "attachAfterMs": 0}})
            .to_string(),
    )
    .unwrap();
    // The user signs in and SOLIDWORKS comes up; the next call attaches to it —
    // which is the real sequence, and the only thing that makes re-attribution
    // REACHABLE. Without an attach it returns before consulting lineage at all
    // and this test would pass while proving nothing.
    let mut attached = false;
    for _ in 0..40 {
        b.call("swx_start", json!({"waitSeconds": 0, "reason": "attaching to the signed-in session"}));
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["com"]["running"] == true {
            attached = true;
            break;
        }
    }
    check!(b, "precondition: COM attached, so lineage is the guard under test", attached, "never");

    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "a SOLIDWORKS whose parent merely REUSED our launcher's pid is not adopted",
        st["launch"]["outcome"] != "attachedAfterSignIn",
        format!("was {before} / now {}", s(&st["launch"]))
    );
}

/// RE-ATTRIBUTION IS ONLY POSSIBLE FOR AN ATTRIBUTED ROUTE, end to end.
///
/// `explorer` and `cmdStart` cannot say what they started, so nothing of theirs
/// is ever recorded as our chain and there is no identity to walk a parent back
/// to. A session that comes up after one of them may well BE ours — and this
/// bridge still will not claim it, because it cannot prove it.
///
/// The RULE is pinned deterministically in
/// `launch::tests::an_unattributable_route_has_no_identities_to_walk_back_to`;
/// this one covers the path through the running bridge. Same honest limit as the
/// test above: it asserts the outcome, not which guard produced it.
#[test]
fn an_unattributable_route_can_never_re_attribute_a_session() {
    let m = Machine::new(
        "reattr-unattributable",
        // shellExecute reports no root at all here; explorer runs and stalls.
        json!({"shellExecute": {"chain": false}, "powershell": {"chain": false},
               "explorer": {"chain": true, "runBeginAfterMs": 0},
               "cmdStart": {"chain": false}}),
    );
    let b = m.boot(TempDir::new("reattr-unattributable-scratch"), &[]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));
    let mut finished = false;
    for _ in 0..100 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["launch"]["finished"] == true {
            finished = true;
            break;
        }
    }
    check!(b, "precondition: the attempt finished", finished, "never finished");

    // A SOLIDWORKS appears, descended from the explorer route's own launcher —
    // which really may be ours. The bridge cannot PROVE it, so it does not say it.
    let st0 = b.call("swx_status", json!({}));
    check!(
        b,
        "precondition: no attribution root was recorded for the route that ran",
        st0["launch"]["attribution"].is_null() || st0["launch"]["attributed"] != true,
        s(&st0["launch"])
    );
    std::fs::write(
        m.dir.join("preexisting.json"),
        json!([{"pid": 99321, "image": "SLDWORKS.exe", "ageSeconds": 0}]).to_string(),
    )
    .unwrap();
    // COM attaches — so re-attribution is REACHED and refuses on the rule, rather
    // than never being asked.
    std::fs::write(
        m.dir.join("routes.json"),
        json!({"explorer": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0,
                            "attachAfterMs": 0}})
            .to_string(),
    )
    .unwrap();
    let mut attached = false;
    for _ in 0..40 {
        b.call("swx_start", json!({"waitSeconds": 0, "reason": "attaching to the session"}));
        std::thread::sleep(std::time::Duration::from_millis(250));
        if b.call("swx_status", json!({}))["com"]["running"] == true {
            attached = true;
            break;
        }
    }
    check!(b, "precondition: COM attached, so the rule is what refuses", attached, "never");

    let st = b.call("swx_status", json!({}));
    check!(
        b,
        "an unattributable route never re-attributes a session, however plausible it looks",
        st["launch"]["outcome"] != "attachedAfterSignIn" && st["launch"]["attributed"] != true,
        s(&st["launch"])
    );
}

/// THE POSITIVE CASE'S MIRROR. Same scenario, one thing changed: our launcher is
/// retired and its pid REISSUED to a different process before COM attaches. The
/// session must NOT be adopted, and the report must name which clause refused —
/// so the next person diagnosing this reads one field instead of the source.
///
/// Mutation-checked: removing the lineage rule makes this fail.
#[test]
fn a_reissued_launcher_pid_is_refused_and_the_report_names_the_clause() {
    let m = Machine::new(
        "reissue-named",
        // The attach lands AFTER the attempt has given up — which is the whole
        // sign-in shape, and the only state in which re-attribution is even
        // consulted.
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0,
                                "attachAfterMs": 6000}}),
    );
    std::fs::write(m.dir.join("preexisting.json"), json!([]).to_string()).unwrap();
    let b = m.boot(TempDir::new("reissue-named-scratch"), &[("SWX_LAUNCH_ATTACH_SECS", "2")]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));

    // Let the chain be recorded and watched.
    let mut launcher = 0u64;
    for _ in 0..60 {
        std::thread::sleep(std::time::Duration::from_millis(200));
        let st = b.call("swx_status", json!({}));
        if let Some(a) = st["launch"]["chainPids"].as_array() {
            if let Some(p) = a.iter().find(|p| p["image"] == "SWXDesktopLauncher.exe") {
                launcher = p["pid"].as_u64().unwrap_or(0);
                if st["launch"]["finished"] == true {
                    break;
                }
            }
        }
    }
    check!(b, "precondition: our launcher was recorded and watched", launcher > 0, "none");

    // ...then that pid is REISSUED to a different process, and a SOLIDWORKS
    // claiming it as its parent appears. Both facts are exactly what a recycled
    // pid looks like from outside.
    std::fs::write(
        m.dir.join("census-overrides.json"),
        json!([
            {"retire": launcher},
            {"pid": launcher, "image": "SWXDesktopLauncher.exe", "ageSeconds": 0},
            {"pid": 991234, "image": "SLDWORKS.exe", "ageSeconds": 0, "ppid": launcher}
        ])
        .to_string(),
    )
    .unwrap();

    let mut st = json!({});
    for _ in 0..40 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        st = b.call("swx_status", json!({}));
        if st["com"]["attached"] == true {
            break;
        }
    }
    check!(b, "precondition: COM attached, so the lineage walk runs", st["com"]["attached"] == true, s(&st["com"]));
    check!(
        b,
        "the session is NOT adopted on a reissued pid",
        st["launch"]["outcome"] != "attachedAfterSignIn",
        s(&st["launch"])
    );
    // TWO LAYERS, since 0.6.7: the report carries the COMPOSITE reason (no
    // candidate could be proved), and the ledger carries the per-candidate
    // clause — because "the last one stands" hid which process failed which test.
    let why = st["launch"]["reattributionRefusedBecause"].as_str().unwrap_or("").to_string();
    check!(
        b,
        "...the report names the composite reason",
        why == "no_candidate_descends" || why == "attached_pid_not_ours",
        format!("reattributionRefusedBecause={why:?} / {}", s(&st["launch"]))
    );
    let ledger = s(&b.call("swx_action_ledger", json!({"limit": 80})));
    check!(
        b,
        "...and the ledger names the clause the REISSUED pid failed on",
        ledger.contains("alive_but_different_process") || ledger.contains("child_outside_window"),
        ledger.chars().rev().take(900).collect::<String>().chars().rev().collect::<String>()
    );
}

/// CONSENT-AFFECTING, from pass 19. Re-attribution must claim ONLY the process
/// COM is attached to.
///
/// 0.6.6 used the attached pid to ORDER the candidates and took the first that
/// descended — so with two SOLIDWORKS running it could prove lineage for OUR
/// launcher's child while COM was attached to a DIFFERENT process, and then
/// label the session `attributed:true`. Everything downstream reads that label:
/// the quit gate's bridge-launched proof, and a quit ladder that builds its
/// Identity from the COM pid. The bridge would have been willing to END a session
/// nothing had proved was ours.
///
/// Staged here so the attached process is NOT ours and a non-attached one IS:
/// the route's own SOLIDWORKS is re-parented to a stranger, and a second one is
/// given our launcher as its parent.
#[test]
fn re_attribution_claims_only_the_process_com_is_attached_to() {
    let m = Machine::new(
        "attached-only",
        json!({"shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 0,
                                "attachAfterMs": 6000}}),
    );
    std::fs::write(m.dir.join("preexisting.json"), json!([]).to_string()).unwrap();
    let b = m.boot(TempDir::new("attached-only-scratch"), &[("SWX_LAUNCH_ATTACH_SECS", "2")]);
    b.call("swx_start", json!({"waitSeconds": 0, "reason": "launching"}));

    let mut launcher = 0u64;
    let mut sw_pid = 0u64;
    for _ in 0..60 {
        std::thread::sleep(std::time::Duration::from_millis(200));
        let st = b.call("swx_status", json!({}));
        if let Some(a) = st["launch"]["chainPids"].as_array() {
            if let Some(p) = a.iter().find(|p| p["image"] == "SWXDesktopLauncher.exe") {
                launcher = p["pid"].as_u64().unwrap_or(0);
            }
        }
        if let Some(p) = st["solidworks"]["processId"].as_u64() {
            sw_pid = p;
        }
        if st["launch"]["finished"] == true && launcher > 0 && sw_pid > 0 {
            break;
        }
    }
    check!(b, "precondition: chain and SOLIDWORKS observed", launcher > 0 && sw_pid > 0,
           format!("launcher={launcher} sw={sw_pid}"));

    // The ATTACHED process is re-parented to a stranger; a SECOND SOLIDWORKS,
    // which COM is NOT attached to, descends from our launcher — created at the
    // moment we last SAW that launcher alive, so it is genuinely inside the
    // lineage window and the ONLY thing that can refuse it is the pid-equality
    // rule under test.
    let last_seen = b.call("swx_status", json!({}))["launch"]["chainLastSeen"]
        .as_array()
        .and_then(|rows| {
            rows.iter()
                .find(|r| r[0].as_u64() == Some(launcher))
                .and_then(|r| r[2].as_u64())
        })
        .unwrap_or(0);
    check!(b, "precondition: we know when the launcher was last seen", last_seen > 0, "none");
    // ABSOLUTE, not an age: the census computes "now" when it is read, so a
    // relative age drifts by however long the test takes to get there — and the
    // window is one census interval wide.
    std::fs::write(
        m.dir.join("census-overrides.json"),
        json!([
            {"pid": sw_pid, "image": "SLDWORKS.exe", "ageSeconds": 0, "ppid": 4242},
            {"pid": 900777, "image": "SLDWORKS.exe", "createdAt": last_seen, "ppid": launcher}
        ])
        .to_string(),
    )
    .unwrap();

    let mut st = json!({});
    for _ in 0..40 {
        std::thread::sleep(std::time::Duration::from_millis(250));
        st = b.call("swx_status", json!({}));
        if st["com"]["attached"] == true {
            break;
        }
    }
    check!(b, "precondition: COM attached", st["com"]["attached"] == true, s(&st["com"]));
    check!(
        b,
        "precondition: the attached process is NOT the one that descends from our chain",
        st["com"]["processId"].as_u64() == Some(sw_pid),
        s(&st["com"])
    );
    // NOTE on `attributed`: it stays TRUE here, and correctly — this attempt DID
    // launch a chain and attribute its root. What must not happen is the extra
    // claim that the session COM is now talking to is that launch's product.
    check!(
        b,
        "the session is NOT re-claimed, because the process COM answers for is not ours",
        st["launch"]["outcome"] != "attachedAfterSignIn",
        s(&st["launch"])
    );
    check!(
        b,
        "...and no claim is recorded about which SOLIDWORKS this attempt produced",
        st["launch"]["attributedSolidworks"].is_null(),
        s(&st["launch"])
    );
    check!(
        b,
        "...and the refusal NAMES that clause",
        st["launch"]["reattributionRefusedBecause"] == "attached_pid_not_ours",
        format!("{}", st["launch"]["reattributionRefusedBecause"])
    );
}

/// MEASURED 2026-10-12 (hosted 0.9.27): with SOLIDWORKS NOT running, `launch`
/// still said stage "attached" and "SOLIDWORKS is up and COM-attached. Carry
/// on." about the launch of 2026-10-02 — its process ten days gone. A record
/// that outlived every process it names is ENDED.
#[test]
fn a_launch_record_that_outlived_its_processes_is_ended_not_attached() {
    let m = Machine::new("launch-stale-record", json!({}));
    // pid 32224 has been REUSED by an unrelated process created just now: the
    // same number, another process (identity is pid + creation time).
    let mut rows: Vec<Value> = serde_json::from_str(&std::fs::read_to_string(m.dir.join("preexisting.json")).unwrap()).unwrap();
    rows.push(json!({"pid": 32224, "image": "SWXDesktopUpdate.exe", "ageSeconds": 5}));
    std::fs::write(m.dir.join("preexisting.json"), Value::Array(rows).to_string()).unwrap();
    let scratch = TempDir::new("launch-stale-record-scratch");
    std::fs::write(
        scratch.join("launch-state.json"),
        json!({"attempt": {
            "id": 7, "startedAt": 1790953690u64, "invokedAt": 1790953690u64, "route": "shellExecute",
            "stage": "attached", "finished": true, "outcome": "attached",
            "attribution": {"pid": 32224, "createdAt": 1790953692u64, "source": "shellExecuteHandle"},
            "attributedSolidworks": {"pid": 41000, "createdAt": 1790953720u64},
            "chainPids": [{"pid": 32224, "image": "CATSTART.exe", "createdAt": 1790953692u64}]
        }}).to_string(),
    )
    .unwrap();
    let b = m.boot(TempDir::borrowed(&scratch.0), &[]);
    let st = b.call("swx_status", json!({}));
    let l = &st["launch"];
    check!(
        b,
        "stage ended (not attached), finished, endedWhy names the gone pids, the old stage kept as recordedStage",
        l["stage"] == "ended" && l["finished"] == true && l["recordedStage"] == "attached"
            && l["endedWhy"].as_str().unwrap_or("").contains("32224"),
        s(l)
    );
    check!(
        b,
        "the advice never says carry on while nothing it names runs",
        !l["advice"].as_str().unwrap_or("").to_lowercase().contains("carry on") && l["advice"].as_str().unwrap_or("").contains("OVER"),
        s(l)
    );
}

// ── 0.11.2: THE FALSE STALL OF 2026-10-15 ───────────────────────────────────
//
// From the laptop's ledger (attempt 24, route platformShortcut): Run Begin at
// 14:49:04 and the helper sign-in with it; at 14:51:11 the supervisor called
// the route STALLED (no sldworks.exe within the budget), killed CATSTART and
// invoked the shortcut AGAIN; at 14:51:17 sldworks.exe came up — the FIRST
// invoke's — and the second invoke reached it as an "open" request: a File ▸
// Open dialog that blocked every quit for the rest of the day.

/// The File ▸ Open as measured, owned by the simulated main frame, its frame disabled.
fn open_dialog() -> Value {
    json!({"hwnd": 205698, "className": "#32770", "title": "Open ", "visible": true, "owner": 6622700,
           "ownerEnabled": false, "style": 0x96CC_02C4u64, "exStyle": 0x10101u64, "rect": [0, 0, 853, 533]})
}

fn ledger_actions(b: &Bridge) -> Vec<Value> {
    b.call("swx_action_ledger", json!({"limit": 500}))["actions"].as_array().cloned().unwrap_or_default()
}

#[test]
fn a_slow_helper_sign_in_is_not_a_stall_and_nothing_is_invoked_again() {
    // The incident scaled to the suite's budgets (sldworks 4 s): the helper
    // sign-in from +0.1 s, sldworks.exe at +5.5 s — past the sldworks budget,
    // as 2 min 13 s was past 120 s — and attach at +6.5 s. A re-invoke would
    // put up the Open dialog.
    let m = Machine::new(
        "helper-slow",
        json!({
            "shellExecute": {"chain": true, "runBeginAfterMs": 0, "helperAfterMs": 100, "sldworksAfterMs": 5500, "attachAfterMs": 6500},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300, "dialogOnInvoke": [open_dialog()]}
        }),
    );
    let b = m.boot(TempDir::new("scratch"), &[]);
    b.call("swx_start", json!({"reason": "modelling for Drew", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);
    check!(b, "the launch ATTACHES to the first invoke's SOLIDWORKS", st["launch"]["outcome"] == "attached", s(&st["launch"]));
    check!(b, "ONE invocation: the shortcut is never invoked again", m.invocations() == vec!["shellExecute".to_string()], format!("{:?}", m.invocations()));
    check!(b, "nothing was killed: a chain in its helper sign-in is not stalled", m.terminated().is_empty(), format!("{:?}", m.terminated()));
    check!(
        b,
        "no stall on the record, and no dialog on the screen",
        !ledger_actions(&b).iter().any(|e| e["action"] == "solidworks_launch_stalled")
            && !std::fs::read_to_string(m.dir.join("windows.json")).unwrap_or_default().contains("205698"),
        s(&json!(ledger_actions(&b)))
    );
}

#[test]
fn a_solidworks_that_comes_up_after_a_stall_cleanup_is_waited_for_never_re_invoked_over() {
    // No helper log, so the sldworks budget (4 s) does run out — but the
    // launcher had already spawned sldworks.exe, which comes up at +4.3 s
    // although its chain was killed.
    let m = Machine::new(
        "settle",
        json!({
            "shellExecute": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 4300, "sldworksSurvivesKill": true, "attachAfterMs": 5000},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300, "dialogOnInvoke": [open_dialog()]}
        }),
    );
    let b = m.boot(TempDir::new("scratch"), &[("SWX_LAUNCH_RETRY_SETTLE_MS", "2500")]);
    b.call("swx_start", json!({"reason": "modelling for Drew", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);
    check!(b, "the next route is NEVER invoked over a SOLIDWORKS this launch started", m.invocations() == vec!["shellExecute".to_string()], format!("{:?}", m.invocations()));
    check!(
        b,
        "...the retry is declined on the record, naming the SOLIDWORKS",
        ledger_actions(&b).iter().any(|e| e["action"] == "launch_retry_declined" && e["detail"]["why"].as_str().unwrap_or("").contains("already running")),
        s(&json!(ledger_actions(&b)))
    );
    check!(b, "...and the launch attaches to it", st["launch"]["outcome"] == "attached", s(&st["launch"]));
}

#[test]
fn a_file_dialog_a_retry_raised_is_attributed_to_it_and_cancelled_by_the_launch() {
    // A genuine stall (no Run Begin, no SOLIDWORKS) → a legitimate retry,
    // whose invoke puts up the Open dialog anyway. It is the launch's own: the
    // supervisor attributes it to `launch.retry` and cancels it.
    let m = Machine::new(
        "retry-dialog",
        json!({
            "shellExecute": {"chain": true},
            "powershell": {"chain": true, "runBeginAfterMs": 0, "sldworksAfterMs": 100, "attachAfterMs": 300, "dialogOnInvoke": [open_dialog()]}
        }),
    );
    std::fs::write(m.dir.join("file-dialogs.json"), json!({"205698": {"standard": true, "fileName": ""}}).to_string()).unwrap();
    std::fs::write(m.dir.join("last-input-secs"), "3600").unwrap();
    let b = m.boot(TempDir::new("scratch"), &[]);
    b.call("swx_start", json!({"reason": "modelling for Drew", "waitSeconds": 0}));
    let st = wait_for_launch(&b, 30);
    check!(b, "the retry attaches", st["launch"]["outcome"] == "attached" && m.invocations().len() == 2, s(&st["launch"]));
    let deadline = Instant::now() + Duration::from_secs(8);
    let mut cancelled = None;
    while Instant::now() < deadline && cancelled.is_none() {
        cancelled = ledger_actions(&b).into_iter().find(|e| e["action"] == "dialog_cancelled");
        std::thread::sleep(Duration::from_millis(200));
    }
    let c = cancelled.unwrap_or(Value::Null);
    check!(
        b,
        "the dialog is attributed to launch.retry and CANCELLED by the launch, ledgered",
        c["detail"]["raisedDuring"] == "launch.retry" && c["detail"]["ok"] == true && c["detail"]["hwnd"] == 205698,
        s(&json!(ledger_actions(&b)))
    );
    check!(b, "...the window is gone", !std::fs::read_to_string(m.dir.join("windows.json")).unwrap_or_default().contains("205698"), "");
}