gitpane 1.0.0__py3-none-any.whl

gitpane/controller/history_rewrite_controller.py

@@ -0,0 +1,739 @@
+"""Coordinate explicitly confirmed removal of historical paths."""
+
+from __future__ import annotations
+
+import os
+import uuid
+from dataclasses import dataclass, field, replace
+from enum import Enum
+from threading import Event
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, QTimer, Signal
+from shiboken6 import isValid
+
+from gitpane.config import LOCAL_PREFIX, ConsoleOperation
+from gitpane.controller.refresh_controller import RefreshScope
+from gitpane.history.file_history import WindowCapability
+from gitpane.history_rewrite.prepare import discard_preparation, prepare_rewrite
+from gitpane.history_rewrite.publish import RewriteProgress, RewritePublicationOutcome, compensate_rewrite, publish_rewrite, rewrite_operation
+from gitpane.history_rewrite.recovery import RecoveryDiscovery, RewritePublicationState, coherent_recovery_state, context_identity, discover_recovery, observe_recovery, read_recovery_record, recover_rewrite
+from gitpane.history_rewrite.value import RewriteCapture, RewriteTarget, RewriteTargetKind
+from gitpane.operation.console_line import REPOSITORY_HEADER_LABEL, ConsoleHeader, operation_end_text
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.operation_trace import OperationTrace, publish_after_trace
+from gitpane.operation.repository_operation import OperationAction, OperationIntent, OperationOutcome, WriteScope
+from gitpane.system.path_identity import canonical_path
+from gitpane.ui.console.operation_dialog import OperationDialog
+from gitpane.ui.history_rewrite.preview import HistoryRewritePreview, PreviewState
+from gitpane.ui.history_rewrite.question import HistoryRewriteQuestion
+from gitpane.ui.history_rewrite.recovery_dialog import HistoryRewriteRecoveryDialog, RecoveryText, RestoreBranchesQuestion, RestoreText, can_restore
+from gitpane.ui.window_control.dialog_modality import open_window_modal
+from gitpane.worktree.command_sequence import FileTask, GitCommand
+from gitpane.worktree.file_action_target import FileActionTargetKind
+from gitpane.worktree.file_menu_action import FileAction
+from gitpane.worktree.worktree_snapshot import WorktreeKey
+
+PREVIEW_STORAGE_SUFFIX = "-previews"
+
+if TYPE_CHECKING:
+    from collections.abc import Generator
+
+    from gitpane.controller.console_registry import ConsoleRegistry
+    from gitpane.controller.operation_policy import OperationPolicy
+    from gitpane.controller.reference_read_controller import ReferenceReadController
+    from gitpane.controller.refresh_controller import RefreshController
+    from gitpane.controller.session_registry import RepositorySession, SessionRegistry
+    from gitpane.history.repository import GitRepository
+    from gitpane.history_rewrite.recovery import RecoveryObservation, RewriteRecoveryRecord
+    from gitpane.history_rewrite.value import RewritePreparation
+    from gitpane.operation.diagnostic import DiagnosticLog
+    from gitpane.operation.repository_operation import RepositoryOperationService
+    from gitpane.preference.preference_store import PreferenceStore
+    from gitpane.worktree.file_action_target import FileActionSelection
+    from gitpane.worktree.staging import StagingSession
+    from gitpane.worktree.worktree_service import WorktreeService
+
+
+class HistoryRewriteText(Enum):
+    """Describe unavailable historical actions without inventing repository facts."""
+
+    UNAVAILABLE = "This window can no longer remove history. Reopen the repository and select the path again."
+    STALE_SELECTION = "This file selection changed. Select the path again before removing its history."
+    WORKTREE_REQUIRED = "Open a working repository before removing a path from history."
+    READING = "Wait for the repository references to finish loading."
+    RESTORED = "Previous branches were restored. The original index and working files were retained."
+    RECOVERY = "The repository update needs recovery. Keep the recovery data at {directory}."
+    REFRESH_FAILED = "The repository update finished, but its views could not be fully refreshed. Refresh the repository to inspect its current state."
+
+
+@dataclass
+class RewriteRequest:
+    """Bind one private calculation to its requesting session and explicit consent."""
+
+    session: RepositorySession
+    operation: OperationIntent
+    target: RewriteTarget
+    branch: str | None
+    cancelled: Event = field(default_factory=Event)
+    running: bool = False
+    preparation: RewritePreparation | None = None
+    submitted: bool = False
+
+
+@dataclass
+class RewriteRefresh:
+    """Keep a reconciled result pending until its current repository readers have settled."""
+
+    outcome: OperationOutcome
+    generation_by_session: dict[str, int]
+
+
+@dataclass
+class RecoveryRequest:
+    """Bind visible recovery facts to the exact session that may approve their restoration."""
+
+    session: RepositorySession
+    operation: OperationIntent
+    dialog: HistoryRewriteRecoveryDialog
+    record: RewriteRecoveryRecord | None = None
+    observation: RecoveryObservation | None = None
+    question: RestoreBranchesQuestion | None = None
+    running: bool = False
+    submitted: bool = False
+    resolving: bool = False
+
+
+class HistoryRewriteController(QObject):
+    """Coordinate the question, private preview and confirmed publication lifecycle."""
+
+    recovery_requested = Signal(object)
+
+    def __init__(self, *, session_registry_controller: SessionRegistry, operation_policy_controller: OperationPolicy,
+                 reference_read_controller: ReferenceReadController, console_registry_controller: ConsoleRegistry, refresh_controller: RefreshController,
+                 repository: GitRepository, worktree_service: WorktreeService, repository_operation: RepositoryOperationService,
+                 storage_root_dir: str, preference: PreferenceStore, diagnostic_log: DiagnosticLog | None = None, parent: QObject | None = None) -> None:
+        """Receive existing authorities and services without owning a second Git runner."""
+        super().__init__(parent)
+        self.session_registry_controller = session_registry_controller
+        self.operation_policy_controller = operation_policy_controller
+        self.reference_read_controller = reference_read_controller
+        self.console_registry_controller = console_registry_controller
+        self.refresh_controller = refresh_controller
+        self.repository = repository
+        self.worktree_service = worktree_service
+        self.repository_operation = repository_operation
+        self.storage_root_dir = storage_root_dir
+        self.preference = preference
+        self.diagnostic_log = diagnostic_log
+        self.request_by_session: dict[str, RewriteRequest] = {}
+        self.question_by_session: dict[str, HistoryRewriteQuestion] = {}
+        self.preview_by_session: dict[str, HistoryRewritePreview] = {}
+        self.publication_by_id: dict[str, RewriteRequest] = {}
+        self.outcome_by_id: dict[str, OperationOutcome] = {}
+        self.finishing_id_set: set[str] = set()
+        self.refresh_by_id: dict[str, RewriteRefresh] = {}
+        self.recovery_by_session: dict[str, RecoveryRequest] = {}
+        self.recovery_publication_by_id: dict[str, RecoveryRequest] = {}
+        self.recovery_discovery_session_set: set[str] = set()
+        self.pending_recoveries_by_session: dict[str, list[RecoveryDiscovery]] = {}
+
+    def present_recovery(self, record: RewriteRecoveryRecord) -> None:
+        """Rediscover interrupted work in its live owning session after the normal refresh starts."""
+        for session_id, session in tuple(self.session_registry_controller.session_by_id.items()):
+            if not session.is_closed and context_identity(session.repository_context) == record.context_identity:
+                QTimer.singleShot(0, self, lambda identity=session_id: self.check_pending_recovery(identity))
+                return
+
+    def check_pending_recovery(self, session_id: str) -> None:
+        """Find durable incomplete records at repository access, including unreadable journals."""
+        registry = self.session_registry_controller
+        session = registry.session_by_id.get(session_id)
+        window = registry.window_by_session.get(session_id)
+        if (session is None or session.is_closed or session.repository_context.is_bare or window is None or not isValid(window)
+                or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE)):
+            return
+        if session_id in self.recovery_by_session:
+            return
+        if session_id in self.recovery_discovery_session_set:
+            return
+        self.recovery_discovery_session_set.add(session_id)
+        context = session.repository_context
+        git_filename = self.repository.git_filename
+
+        def sequence() -> Generator:
+            """Read private journal directories on the shared file worker."""
+            return (yield FileTask(lambda: discover_recovery(self.storage_root_dir, context)))
+
+        def complete(discoveries: tuple[RecoveryDiscovery, ...] | None, error: Exception | None) -> None:
+            """Ignore a discovery completed after navigation or closure of its original session."""
+            self.recovery_discovery_session_set.discard(session_id)
+            if (registry.session_by_id.get(session_id) is not session or session.is_closed or session.repository_context != context
+                    or self.repository.git_filename != git_filename or not isValid(window)):
+                return
+            if error is not None:
+                discoveries = (RecoveryDiscovery(self.storage_root_dir, None, str(error)),)
+            self.pending_recoveries_by_session[session_id] = list(discoveries or ())
+            self._show_next_recovery(session_id)
+
+        self.worktree_service.run(context, git_filename, sequence(), complete)
+
+    def _show_next_recovery(self, session_id: str) -> None:
+        """Present one durable record at a time without deleting dismissed evidence."""
+        discoveries = self.pending_recoveries_by_session.get(session_id)
+        registry = self.session_registry_controller
+        session = registry.session_by_id.get(session_id)
+        window = registry.window_by_session.get(session_id)
+        if not discoveries or session is None or session.is_closed or window is None or not isValid(window) or session_id in self.recovery_by_session:
+            return
+        discovery = discoveries.pop(0)
+        dialog = HistoryRewriteRecoveryDialog(session.repository_context.repository_dir, discovery, window)
+        request = RecoveryRequest(session, self._operation(session_id), dialog, discovery.record)
+        self.recovery_by_session[session_id] = request
+        dialog.refresh_requested.connect(lambda: self.refresh_recovery_status(session_id))
+        dialog.restore_requested.connect(lambda: self.request_restore(session_id))
+
+        def closed(_result: int) -> None:
+            """Dismiss only the window; an accepted operation continues under its reservation."""
+            if self.recovery_by_session.get(session_id) is request:
+                self.recovery_by_session.pop(session_id, None)
+            if request.question is not None and isValid(request.question):
+                request.question.reject()
+            dialog.deleteLater()
+            QTimer.singleShot(0, self, lambda: self._show_next_recovery(session_id))
+
+        dialog.finished.connect(closed)
+        dialog.show_modal()
+        self.refresh_recovery_status(session_id)
+
+    def _recovery_current(self, session_id: str, request: RecoveryRequest) -> bool:
+        """Require the original live session, repository, executable and form authority."""
+        return (self.recovery_by_session.get(session_id) is request and isValid(request.dialog)
+                and self.session_registry_controller.session_by_id.get(session_id) is request.session and not request.session.is_closed
+                and request.session.repository_context == request.operation.context and self.repository.git_filename == request.operation.git_filename
+                and self.operation_policy_controller.operation_allowed(request.operation))
+
+    def refresh_recovery_status(self, session_id: str) -> None:
+        """Observe interrupted work, resolving only already consistent public state under reservation."""
+        request = self.recovery_by_session.get(session_id)
+        if request is None or request.running or request.submitted or not isValid(request.dialog):
+            return
+        if request.question is not None and isValid(request.question):
+            request.question.reject()
+        request.question = None
+        registry = self.session_registry_controller
+        if (registry.session_by_id.get(session_id) is not request.session or request.session.is_closed
+                or request.session.repository_context != request.operation.context or self.repository.git_filename != request.operation.git_filename):
+            request.dialog.set_error(HistoryRewriteText.UNAVAILABLE.value)
+            return
+        request.operation = replace(self._operation(session_id), operation=RestoreText.RESTORE.value,
+                                    scope=WriteScope.capture(request.operation.context, (LOCAL_PREFIX + "*",)))
+        request.observation = None
+        request.running = True
+        request.dialog.set_loading()
+        operation = request.operation
+
+        def sequence() -> Generator:
+            """Never substitute an in-memory journal when the durable record became unreadable."""
+            record = yield FileTask(lambda: read_recovery_record(request.dialog.operation_dir, operation.context))
+            if record.git_filename != operation.git_filename:
+                raise ValueError(RecoveryText.EXECUTABLE_CHANGED.value)
+            observation = yield from observe_recovery(record, operation.context)
+            return record, observation
+
+        def complete(value: tuple | None, error: Exception | None) -> None:
+            """Install only observations still attached to the original live authority."""
+            request.running = False
+            if self.recovery_by_session.get(session_id) is not request or not isValid(request.dialog):
+                return
+            if not self._recovery_current(session_id, request):
+                request.dialog.set_error(HistoryRewriteText.UNAVAILABLE.value)
+                return
+            if error is not None or value is None:
+                request.record = None
+                request.dialog.set_observation(None, None, str(error) if error is not None else RecoveryText.MISSING.value)
+                return
+            request.record, request.observation = value
+            request.dialog.set_observation(request.record, request.observation)
+            if (request.record.state not in (RewritePublicationState.COMPLETE, RewritePublicationState.RESTORED)
+                    and coherent_recovery_state(request.record, request.observation) is not None):
+                self._resolve_recovery(session_id, request)
+
+        self.worktree_service.run(operation.context, operation.git_filename, sequence(), complete)
+
+    def _resolve_recovery(self, session_id: str, request: RecoveryRequest) -> None:
+        """Submit one cleanup of coherent state without authorizing any public branch restoration."""
+        record, observation = request.record, request.observation
+        operation = request.operation
+        request.submitted = True
+        request.resolving = True
+        request.dialog.set_loading()
+        self.recovery_publication_by_id[operation.operation_id] = request
+
+        def sequence() -> Generator:
+            """Bind cleanup to the displayed journal, public state and still-live session."""
+            current = yield FileTask(lambda: read_recovery_record(record.operation_dir, operation.context))
+            if current != record or not self._recovery_current(session_id, request):
+                raise ValueError(RecoveryText.UNAVAILABLE.value)
+            return (yield from recover_rewrite(current, operation, self.repository_operation, restore=False, expected_observation=observation))
+
+        self.repository_operation.submit(operation, sequence())
+
+    def request_restore(self, session_id: str) -> RestoreBranchesQuestion | None:
+        """Open a separate confirmation for precisely the currently displayed observation."""
+        request = self.recovery_by_session.get(session_id)
+        if request is None or request.running or request.submitted or not can_restore(request.record, request.observation):
+            return None
+        if not self._recovery_current(session_id, request):
+            request.dialog.set_error(HistoryRewriteText.UNAVAILABLE.value)
+            return None
+        if request.question is not None and isValid(request.question) and request.question.isVisible():
+            return request.question
+        question = RestoreBranchesQuestion(request.operation.context.repository_dir, request.record, request.observation, request.dialog)
+        request.question = question
+        question.restore_requested.connect(lambda: self.confirm_restore(session_id, question))
+        question.show_modal()
+        return question
+
+    def confirm_restore(self, session_id: str, question: RestoreBranchesQuestion) -> str | None:
+        """Consume explicit consent once, then revalidate its exact record and observed state."""
+        request = self.recovery_by_session.get(session_id)
+        if (request is None or request.running or request.submitted or request.question is not question or not isValid(question)
+                or question.result() != question.DialogCode.Accepted or not can_restore(request.record, request.observation)):
+            return None
+        request.question = None
+        if not self._recovery_current(session_id, request):
+            request.dialog.set_error(HistoryRewriteText.UNAVAILABLE.value)
+            return None
+        record, observation = request.record, request.observation
+        operation = replace(request.operation, operation_id=uuid.uuid4().hex)
+        request.operation = operation
+        request.submitted = True
+        request.dialog.set_loading()
+        self.recovery_publication_by_id[operation.operation_id] = request
+        self._open_output(request)
+
+        def sequence() -> Generator:
+            """Refuse altered journals before the domain performs its fresh collective comparison."""
+            fresh_record = yield FileTask(lambda: read_recovery_record(record.operation_dir, operation.context))
+            if fresh_record != record or not self._recovery_current(session_id, request):
+                raise ValueError(RecoveryText.UNAVAILABLE.value)
+            return (yield from compensate_rewrite(fresh_record, observation, operation, self.repository_operation))
+
+        self.repository_operation.submit(operation, sequence())
+        return operation.operation_id
+
+    def _recovery_finished(self, outcome: OperationOutcome, request: RecoveryRequest) -> None:
+        """Display verified restoration or preserve the failed attempt as an inspectable diagnostic."""
+        request.submitted = False
+        self.outcome_by_id[outcome.operation_id] = outcome
+        session_id = request.operation.session_id
+        if request.resolving:
+            request.resolving = False
+            if not self._recovery_current(session_id, request):
+                return
+            if outcome.diagnostic is not None:
+                request.dialog.set_error(outcome.diagnostic.cause)
+                return
+            # No public refs or index were changed, so a diagnostic reread is sufficient.
+            self.refresh_recovery_status(session_id)
+            return
+        # The domain reports the original rewrite as failed after compensation; this separately requested restoration succeeded.
+        restored = isinstance(outcome, RewritePublicationOutcome) and outcome.record is not None and outcome.record.state == RewritePublicationState.RESTORED
+        self._refresh_result(request.operation, replace(outcome, status=OperationStatus.SUCCESS) if restored else outcome)
+        if self.recovery_by_session.get(session_id) is request and isValid(request.dialog):
+            if isinstance(outcome, RewritePublicationOutcome) and outcome.record is not None:
+                request.record = outcome.record
+            if outcome.diagnostic is not None:
+                request.dialog.set_error(RecoveryText.UNAVAILABLE.value + "\n" + outcome.diagnostic.cause)
+            else:
+                self.refresh_recovery_status(session_id)
+
+    def _operation(self, session_id: str) -> OperationIntent:
+        """Capture current form authority through the common operation policy."""
+        registry = self.session_registry_controller
+        session = registry.session_by_id[session_id]
+        return OperationIntent.capture(uuid.uuid4().hex, session.repository_context, self.repository.git_filename,
+                                       session_id=session_id, generation=registry.generation_by_session[session_id], action=OperationAction.REF_WRITE,
+                                       operation=FileAction.REMOVE_FROM_HISTORY.label, from_form=True)
+
+    def remove_history_reason(self, session_id: str, selection: FileActionSelection) -> str:
+        """Check menu authority without launching Git or treating display data as write proof."""
+        registry = self.session_registry_controller
+        window = registry.window_by_session.get(session_id)
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or window is None or not isValid(window):
+            return HistoryRewriteText.UNAVAILABLE.value
+        if not window.file_action_is_current(selection):
+            return HistoryRewriteText.STALE_SELECTION.value
+        if window.context.is_bare:
+            return HistoryRewriteText.WORKTREE_REQUIRED.value
+        if self.reference_read_controller.reference_snapshot_by_session.get(session_id) is None:
+            return HistoryRewriteText.READING.value
+        operation = self._operation(session_id)
+        return self.operation_policy_controller.operation_refusal(operation) or self.repository_operation.availability_diagnostic(operation)
+
+    def request(self, session_id: str, selection: FileActionSelection) -> HistoryRewriteQuestion | None:
+        """Open one initial question for the exact still-current historical file or folder."""
+        reason = self.remove_history_reason(session_id, selection)
+        if reason:
+            window = self.session_registry_controller.window_by_session.get(session_id)
+            if window is not None and isValid(window):
+                window.statusBar().showMessage(reason)
+            return None
+        if session_id in self.request_by_session:
+            return self.question_by_session.get(session_id)
+        registry = self.session_registry_controller
+        snapshot = self.reference_read_controller.reference_snapshot_by_session[session_id]
+        kind = RewriteTargetKind.FOLDER if selection.kind == FileActionTargetKind.FOLDER else RewriteTargetKind.FILE
+        target = RewriteTarget(selection.path(), kind)
+        request = RewriteRequest(registry.session_by_id[session_id], self._operation(session_id), target, snapshot.head_ref)
+        self.request_by_session[session_id] = request
+        question = HistoryRewriteQuestion(target, request.branch, registry.window_by_session[session_id])
+        self.question_by_session[session_id] = question
+        question.build_requested.connect(lambda _target: self.build_preview(session_id, request))
+        question.abort_requested.connect(lambda: self.abort_preview(session_id, request))
+        request.session.closed.connect(lambda: self.abort_preview(session_id))
+        question.show_modal()
+        return question
+
+    def _current(self, session_id: str, request: RewriteRequest) -> bool:
+        """Reject results after cancellation, replacement, loss of authority or a new generation."""
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        return (self.request_by_session.get(session_id) is request and not request.cancelled.is_set()
+                and window is not None and isValid(window) and not window.is_closed
+                and self.session_registry_controller.session_by_id.get(session_id) is request.session
+                and not request.session.is_closed and request.session.repository_context == request.operation.context
+                and self.repository.git_filename == request.operation.git_filename
+                and self.operation_policy_controller.operation_allowed(request.operation))
+
+    def build_preview(self, session_id: str, request: RewriteRequest) -> None:
+        """Start one private calculation after explicit Build preview consent."""
+        if request.running or request.preparation is not None or request.cancelled.is_set():
+            return
+        registry = self.session_registry_controller
+        preview = self.preview_by_session.get(session_id)
+        if preview is None or not isValid(preview) or preview.state == PreviewState.CLOSED:
+            family = self.refresh_controller.submodule_snapshot_by_session.get(session_id)
+            parent_dir = ""
+            if family is not None:
+                for entry in family.entries:
+                    if entry.repository_dir == request.operation.context.repository_dir:
+                        parent_dir = entry.parent_dir or ""
+                        break
+            preview = HistoryRewritePreview(request.target, request.branch or "", request.operation.context.repository_dir,
+                                            registry.window_by_session[session_id], active_submodule=bool(parent_dir), parent_repository_dir=parent_dir)
+            self.preview_by_session[session_id] = preview
+            preview.abort_requested.connect(lambda: self.abort_preview(session_id))
+            preview.recompute_requested.connect(lambda: self.recompute(session_id))
+            preview.confirm_requested.connect(lambda preparation: self.confirm(session_id, preparation))
+            preview.show_modal()
+        if not self._current(session_id, request):
+            preview.mark_stale()
+            return
+        request.running = True
+        # _current has just checked that the operation's Git is the repository's chosen Git. Its version is the line the Git check at start or in
+        # Settings read for that Git; it stays empty while that check has not answered or after it failed, and the preparation then reads it itself
+        # before the export.
+        capture = RewriteCapture(request.operation.context, request.operation.git_filename, request.branch, generation=request.operation.generation,
+                                 git_version=self.repository.git_version)
+
+        def prepare() -> Generator:
+            """Read the active repository's parent identity before showing its mandatory warning."""
+            parent_output = yield GitCommand(["rev-parse", "--show-superproject-working-tree"])
+            if isValid(preview) and self._current(session_id, request):
+                preview.parent_repository_dir = os.fsdecode(parent_output.removesuffix(b"\n"))
+                preview.active_submodule = bool(preview.parent_repository_dir)
+            # Unpublished scratch directories must never be mistaken for durable interrupted publications.
+            preview_storage_dir = self.storage_root_dir + PREVIEW_STORAGE_SUFFIX
+            return (yield from prepare_rewrite(capture, request.target, preview_storage_dir, cancelled=request.cancelled.is_set))
+
+        def complete(preparation: RewritePreparation | None, error: Exception | None) -> None:
+            """Publish only into the live original preview after every private process has drained."""
+            request.running = False
+            request.preparation = preparation
+            if request.cancelled.is_set() or not isValid(preview) or request.session.is_closed:
+                self._discard(session_id, request, close=True)
+                return
+            if not self._current(session_id, request):
+                preview.mark_stale()
+                preview.recompute_button.setEnabled(True)
+                return
+            if error is not None:
+                preview.set_error(str(error))
+                return
+            if preparation is None:
+                preview.set_error(HistoryRewriteText.READING.value)
+                return
+            preview.set_preparation(preparation)
+
+        self.worktree_service.run(capture.context, capture.git_filename, prepare(), complete, operation_id=request.operation.operation_id)
+
+    def abort_preview(self, session_id: str, request: RewriteRequest | None = None) -> None:
+        """Cancel only this private calculation, then close after its processes and cleanup finish."""
+        request = request or self.request_by_session.get(session_id)
+        if request is None or self.request_by_session.get(session_id) is not request or request.submitted:
+            return
+        request.cancelled.set()
+        if request.running:
+            runner = self.worktree_service.runner
+            requests = list(runner.pending_requests)
+            for active in tuple(runner.active_by_id.values()):
+                requests.append(active.request)
+            for process in requests:
+                if process.operation_id == request.operation.operation_id:
+                    runner.cancel(process.request_id)
+            return
+        self._discard(session_id, request, close=True)
+
+    def _discard(self, session_id: str, request: RewriteRequest, *, close: bool) -> None:
+        """Remove only owned private storage outside the GUI thread before releasing the form."""
+        def sequence() -> Generator:
+            """Wait for ownership-checked private cleanup on the shared file worker."""
+            if request.preparation is not None:
+                yield FileTask(lambda: discard_preparation(request.preparation))
+
+        def complete(_value: object, error: Exception | None) -> None:
+            """Close the original form without interfering with a newer request."""
+            request.running = False
+            if self.request_by_session.get(session_id) is not request:
+                return
+            preview = self.preview_by_session.get(session_id)
+            if error is not None:
+                window = self.session_registry_controller.window_by_session.get(session_id)
+                if window is not None and isValid(window):
+                    window.statusBar().showMessage(str(error))
+            self.request_by_session.pop(session_id, None)
+            question = self.question_by_session.pop(session_id, None)
+            if question is not None and isValid(question):
+                question.close()
+                question.deleteLater()
+            if close and preview is not None and isValid(preview):
+                preview.finish_abort()
+
+        request.running = True
+        self.worktree_service.run(request.operation.context, request.operation.git_filename, sequence(), complete)
+
+    def recompute(self, session_id: str) -> None:
+        """Create fresh form authority after draining the previous private proposal."""
+        previous = self.request_by_session.get(session_id)
+        if previous is None or previous.running or previous.submitted or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        previous.cancelled.set()
+
+        def sequence() -> Generator:
+            """Discard the superseded token before calculating another proposal."""
+            if previous.preparation is not None:
+                yield FileTask(lambda: discard_preparation(previous.preparation))
+
+        def complete(_value: object, error: Exception | None) -> None:
+            """Start anew only while the same repository session still owns the form."""
+            previous.running = False
+            if self.request_by_session.get(session_id) is not previous or previous.session.is_closed:
+                return
+            preview = self.preview_by_session.get(session_id)
+            if preview is None or not isValid(preview) or preview.state != PreviewState.PREPARING:
+                self.abort_preview(session_id)
+                return
+            if error is not None:
+                preview.set_error(str(error))
+                return
+            if (self.session_registry_controller.session_by_id.get(session_id) is not previous.session
+                    or previous.session.repository_context != previous.operation.context):
+                preview.mark_stale(HistoryRewriteText.UNAVAILABLE.value)
+                return
+            snapshot = self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+            request = RewriteRequest(previous.session, self._operation(session_id), previous.target, snapshot.head_ref if snapshot is not None else previous.branch)
+            self.request_by_session[session_id] = request
+            self.build_preview(session_id, request)
+
+        previous.running = True
+        self.worktree_service.run(previous.operation.context, previous.operation.git_filename, sequence(), complete)
+
+    def confirm(self, session_id: str, preparation: RewritePreparation) -> str | None:
+        """Consume exactly one fresh proposal and let the shared service reserve its publication."""
+        request = self.request_by_session.get(session_id)
+        preview = self.preview_by_session.get(session_id)
+        if (request is None or request.submitted or request.running or request.preparation is not preparation
+                or preview is None or not isValid(preview) or preview.state != PreviewState.EXECUTING):
+            return None
+        if not self._current(session_id, request):
+            preview.mark_stale(self.operation_policy_controller.operation_refusal(request.operation))
+            return None
+        request.submitted = True
+        operation = rewrite_operation(preparation, uuid.uuid4().hex, session_id=session_id)
+        request.operation = operation
+        self.publication_by_id[operation.operation_id] = request
+        self._open_output(request)
+        self.repository_operation.submit(operation, publish_rewrite(preparation, operation, self.repository_operation, self.storage_root_dir,
+                                                                    progress=lambda phase: self._show_progress(operation.operation_id, phase)))
+        return operation.operation_id
+
+    def _open_output(self, request: RewriteRequest | RecoveryRequest) -> None:
+        """Keep the common console registered so repository closure waits for reconciliation."""
+        operation = request.operation
+        trace = OperationTrace(operation.operation_id, self.repository.runner, self.diagnostic_log, native_commands_only=True,
+                               header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        window = self.session_registry_controller.window_by_session[operation.session_id]
+        output = OperationDialog(trace, operation.operation, window, preference=self.preference, console_operation=ConsoleOperation.HISTORY_REWRITE)
+        self.console_registry_controller.reference_output_by_id[operation.operation_id] = output
+
+        def closed(_result: int) -> None:
+            """Release only this console's subscription once it can actually close."""
+            self.console_registry_controller.reference_output_by_id.pop(operation.operation_id, None)
+            trace.close()
+
+        output.finished.connect(closed)
+        output.abort_requested.connect(lambda: self.finish_safely(operation.operation_id))
+        open_window_modal(output, keeps_window_buttons=True)
+
+    def _show_progress(self, operation_id: str, phase: RewriteProgress) -> None:
+        """Report actual service steps without inventing a completion percentage."""
+        output = self.console_registry_controller.reference_output_by_id.get(operation_id)
+        if output is None or not isValid(output) or not output.running:
+            return
+        output.trace.append_event(operation_id, "status", phase.value)
+        output.status_label.setText((RewriteProgress.FINISHING if operation_id in self.finishing_id_set else phase).value)
+
+    def finish_safely(self, operation_id: str) -> None:
+        """Keep an accepted publication alive until refs and index have been reconciled."""
+        if operation_id not in self.publication_by_id and operation_id not in self.recovery_publication_by_id:
+            return
+        self.finishing_id_set.add(operation_id)
+        self._show_progress(operation_id, RewriteProgress.FINISHING)
+
+    def operation_finished(self, outcome: OperationOutcome) -> None:
+        """Present only the service's reconciled outcome, preserving incomplete recovery evidence."""
+        recovery = self.recovery_publication_by_id.pop(outcome.operation_id, None)
+        if recovery is not None:
+            self._recovery_finished(outcome, recovery)
+            return
+        request = self.publication_by_id.pop(outcome.operation_id, None)
+        if request is None:
+            return
+        self.outcome_by_id[outcome.operation_id] = outcome
+        session_id = request.operation.session_id
+        preview = self.preview_by_session.get(session_id)
+        if outcome.status == OperationStatus.REFUSED:
+            request.submitted = False
+            if preview is not None and isValid(preview):
+                preview.mark_stale(outcome.diagnostic.cause if outcome.diagnostic is not None else "")
+        else:
+            if preview is not None and isValid(preview):
+                preview.finish_publication()
+            self._discard(session_id, request, close=False)
+        if isinstance(outcome, RewritePublicationOutcome) and outcome.record is not None and outcome.record.state not in (RewritePublicationState.COMPLETE, RewritePublicationState.RESTORED):
+            self.recovery_requested.emit(outcome.record)
+        if outcome.status == OperationStatus.REFUSED:
+            self._finish_output(outcome)
+            return
+        replacement_by_oid = request.preparation.replacement_by_oid if outcome.status == OperationStatus.SUCCESS else None
+        self._refresh_result(request.operation, outcome, replacement_by_oid)
+
+    def _refresh_result(self, operation: OperationIntent, outcome: OperationOutcome, replacement_by_oid: dict[str, str | None] | None = None) -> None:
+        """Keep publication and restoration consoles pending until the shared readers settle."""
+        generation_by_session = {}
+        for identity, session in self.session_registry_controller.session_by_id.items():
+            if (not session.is_closed and canonical_path(session.repository_context.common_git_dir) == operation.common_git_dir
+                    and self.operation_policy_controller.allows(identity, WindowCapability.MANAGE)):
+                generation_by_session[identity] = session.generation + 1
+        self.refresh_by_id[outcome.operation_id] = RewriteRefresh(outcome, generation_by_session)
+        self._show_progress(outcome.operation_id, RewriteProgress.REFRESHING)
+        self.refresh_controller.refresh_after_reference_operation(operation, outcome, RefreshScope.FULL, replacement_by_oid=replacement_by_oid)
+        self.readers_changed()
+
+    def observe_refresh(self, session_id: str) -> None:
+        """Revoke a visible proposal immediately when its repository starts a new read generation."""
+        recovery = self.recovery_by_session.get(session_id)
+        if recovery is not None and not recovery.submitted and isValid(recovery.dialog) and not self._recovery_current(session_id, recovery):
+            recovery.observation = None
+            recovery.dialog.set_error(HistoryRewriteText.UNAVAILABLE.value)
+            if recovery.question is not None and isValid(recovery.question):
+                recovery.question.reject()
+            recovery.question = None
+        request = self.request_by_session.get(session_id)
+        preview = self.preview_by_session.get(session_id)
+        if request is None or request.submitted or preview is None or not isValid(preview):
+            return
+        if not self._current(session_id, request):
+            preview.mark_stale()
+            preview.recompute_button.setEnabled(not request.running)
+
+    def observe_worktree(self, staging: StagingSession) -> None:
+        """Invalidate old index proposals when an existing worktree reader observes a change."""
+        snapshot = staging.snapshot
+        if snapshot is not None and snapshot.fresh:
+            for session_id, request in tuple(self.request_by_session.items()):
+                preparation = request.preparation
+                if request.submitted or preparation is None or snapshot.key != request.operation.key:
+                    continue
+                capture = preparation.capture
+                if (snapshot.index_content != capture.index_identity or snapshot.head_oid != capture.local_ref_by_name.get(capture.head_ref)
+                        or snapshot.probe is not None and snapshot.probe.branch_head != capture.head_ref):
+                    preview = self.preview_by_session.get(session_id)
+                    if preview is not None and isValid(preview):
+                        preview.mark_stale()
+        self.readers_changed()
+
+    def readers_changed(self) -> None:
+        """Check pending results after the current signal has finished updating reader state."""
+        if self.refresh_by_id:
+            QTimer.singleShot(0, self, self._finish_refresh)
+
+    def _finish_refresh(self) -> None:
+        """End consoles only after refreshed graphs, worktree reads and their processes have drained."""
+        if (self.repository.runner.active_by_id or self.repository.runner.pending_requests or self.worktree_service.file_task_by_id
+                or self.worktree_service.continuation_by_id):
+            return
+        registry = self.session_registry_controller
+        for operation_id, pending in tuple(self.refresh_by_id.items()):
+            waiting = False
+            failed = False
+            for session_id, generation in pending.generation_by_session.items():
+                session = registry.session_by_id.get(session_id)
+                if session is None or session.is_closed:
+                    continue
+                if session.generation < generation or session.refresh_active or session.refresh_queued is not None:
+                    waiting = True
+                    break
+                staging = self.refresh_controller.staging_session_registry_controller.staging_by_key.get(WorktreeKey.from_context(session.repository_context))
+                if staging is not None and staging.refresh_active:
+                    waiting = True
+                    break
+                if (session.snapshot is None or not session.snapshot.complete or session.snapshot.error
+                        or staging is not None and (staging.snapshot is None or not staging.snapshot.fresh)):
+                    failed = True
+            if waiting:
+                continue
+            self.refresh_by_id.pop(operation_id, None)
+            outcome = pending.outcome
+            if failed and outcome.status == OperationStatus.SUCCESS:
+                diagnostic = Diagnostic(FileAction.REMOVE_FROM_HISTORY.label, "", self.repository.git_filename, [], HistoryRewriteText.REFRESH_FAILED.value).prepare()
+                outcome = replace(outcome, status=OperationStatus.UNKNOWN, diagnostic=diagnostic)
+            self._finish_output(outcome)
+
+    def _finish_output(self, outcome: OperationOutcome) -> None:
+        """Append the terminal result after the trace has consumed the final native output."""
+        self.finishing_id_set.discard(outcome.operation_id)
+        output = self.console_registry_controller.reference_output_by_id.get(outcome.operation_id)
+        if output is None or not isValid(output):
+            return
+
+        def publish() -> None:
+            """End a still-live console with the exact observed status and diagnostic."""
+            if not isValid(output):
+                return
+            if outcome.diagnostic is not None:
+                output.trace.append_diagnostic(outcome.operation_id, "status", outcome.diagnostic, outcome.status)
+            if isinstance(outcome, RewritePublicationOutcome) and outcome.record is not None:
+                if outcome.record.state == RewritePublicationState.RESTORED:
+                    output.trace.append_event(outcome.operation_id, "status", HistoryRewriteText.RESTORED.value)
+                elif outcome.record.state != RewritePublicationState.COMPLETE:
+                    output.trace.append_event(outcome.operation_id, "status", HistoryRewriteText.RECOVERY.value.format(directory=outcome.record.operation_dir))
+            output.trace.append_end_line(outcome.operation_id, "status", outcome.status.value,
+                                         operation_end_text(output.windowTitle(), outcome.status), outcome.status,
+                                         failure_reported=outcome.diagnostic is not None)
+            output.show_result(outcome.status, failure_reported=outcome.diagnostic is not None,
+                               failure_text=outcome.diagnostic.cause if outcome.diagnostic is not None else "")
+
+        publish_after_trace(publish, self)