gitpane 1.0.0__py3-none-any.whl

gitpane/sequencer/rebase.py

@@ -0,0 +1,750 @@
+"""Own asynchronous rebase observations independently of repository windows."""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field, replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, Signal
+
+from gitpane.config import DETACHED_HEAD_NAME, GIT_COMMIT_TIMEOUT_MS, LINE_SEPARATOR, REFERENCE_ROOT_PREFIX, SUBMODULE_RECURSION_OFF_ARGUMENTS, ProcessPriority
+from gitpane.history.repository_value import GIT_CONFLICT_RETURN_CODE, validate_oid
+from gitpane.operation.console_line import REBASE_LABEL
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.launch_signature import capture_write_launch_signature, prepare_write_launch_signature, verify_launch_signature
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.repository_operation import OperationAction, OperationOutcome, OperationStepResult, native_rebase_capture
+from gitpane.process.process_runner import LOCAL_WRITE_PROFILE, READ_PROFILE, ProcessStatus
+from gitpane.reference.reference_edit import reference_signature, reference_signature_paths
+from gitpane.sequencer.rebase_state import REBASE_CONTINUABLE_STATE_SET, REBASE_STOPPED_STATE_SET, RebaseSnapshot, can_abort_rebase, capture_rebase, capture_rebase_passive, ended_outside_state
+from gitpane.system.path_identity import canonical_path
+from gitpane.worktree.command_sequence import FileTask, GitCommand, GitCommandError, observation_priority
+from gitpane.worktree.worktree_service import STATUS_ARGUMENTS, read_worktree_probe
+from gitpane.worktree.worktree_snapshot import StagingSide, WorktreeKey, parse_status, read_index
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.operation.diagnostic import PreparedDiagnostic
+    from gitpane.operation.repository_operation import OperationIntent, RepositoryOperationService
+    from gitpane.tool.editor import EditorService
+    from gitpane.worktree.worktree_service import WorktreeService
+    from gitpane.worktree.worktree_snapshot import LocalEntry, PassiveObservationSource, WorktreeProbe
+
+# The one read that resolves the rebase target, HEAD and the branch HEAD is on answers exactly these three lines.
+INTENT_ANSWER_LINE_COUNT = 3
+UNREADABLE_INTENT_CAUSE = "The rebase target or HEAD could not be read. Refresh before rebasing."
+# Without it, a repository set with i18n.commitEncoding gets its rebase list written in that encoding, which the GitPane
+# editor and the rebase state reader can no longer read as UTF-8. It only adds arguments to the rebase commands, no process.
+UTF8_LOG_OUTPUT_ARGUMENTS = ("-c", "i18n.logOutputEncoding=UTF-8")
+# The status that proves how a rebase ended leaves out untracked files, which Git leaves alone, and rename detection,
+# which would only relabel a change that must not exist anyway. Every other option, submodules included, is the shared one.
+FINAL_STATUS_OPTION_BY_SHARED_OPTION = {"--untracked-files=all": "--untracked-files=no", "--renames": "--no-renames"}
+ABORT_REBASE_LABEL = "Abort rebase"
+REBASE_ABORTED_TEXT = "Rebase aborted."
+REBASE_ABORT_UNVERIFIED_CAUSE = "The original rebase HEAD, branch or index could not be verified. Refresh to inspect the result."
+REBASE_ABORT_LEFT_CHANGES_CAUSE = "The index or tracked files still differ from the original commit after Abort. Refresh to inspect the result."
+EDITOR_ABORT_CHANGED_CAUSE = "The rebase left after Abort in the GitPane editor is not the one this command started from. Refresh to inspect it."
+# Git names the command that corrects its instructions in each refusal of them, and in nothing else: at launch and after
+# a list edit ("You can fix this with 'git rebase --edit-todo' and then run 'git rebase --continue'."), and on Continue
+# ("error: please fix this using 'git rebase --edit-todo'."). Texts of Git 2.53; GitPane runs Git in the C locale, so
+# they are never translated.
+INSTRUCTION_ERROR_MARKER = "'git rebase --edit-todo'"
+# Start of each line Git writes for an error: the lines the editor shows above the list to correct.
+GIT_ERROR_PREFIX = "error: "
+# Git's exit status when it refuses the instructions. A stop on a conflict exits with the same status; the fresh read of
+# the rebase tells the two apart.
+INSTRUCTION_ERROR_RETURN_CODE = 1
+
+
+def final_status_arguments() -> list[str]:
+    """Build the one-off status that proves how a rebase ended from the arguments every worktree read uses."""
+    arguments = []
+    for argument in STATUS_ARGUMENTS:
+        arguments.append(FINAL_STATUS_OPTION_BY_SHARED_OPTION.get(argument, argument))
+    return arguments
+
+
+def read_rebase_final_status() -> Generator[GitCommand, bytes, tuple[WorktreeProbe, tuple[LocalEntry, ...]]]:
+    """Read HEAD, its branch, the conflicts and the tracked changes of the worktree from one status, once a rebase ended.
+
+    Both answers come from the very same output. A branch header Git cannot name costs the probe its usual second read.
+    """
+    output = yield GitCommand(final_status_arguments(), profile=READ_PROFILE)
+    probe = yield from read_worktree_probe(output)
+    return probe, parse_status(output)
+
+
+def parent_differences(entries: tuple[LocalEntry, ...]) -> tuple[LocalEntry, ...]:
+    """Keep the final status entries where the index or a file of the parent repository differs.
+
+    A submodule whose working side alone differs, a gitlink on both sides with changed content or a folder on another
+    commit, is left out: a write of the parent never touches a submodule folder, so that difference is not the parent's.
+    A gitlink changed in the index, or a submodule replaced by a file, still counts.
+    """
+    differences = []
+    for entry in entries:
+        if entry.side == StagingSide.UNSTAGED and entry.is_gitlink and entry.old_mode == entry.new_mode:
+            continue
+        differences.append(entry)
+    return tuple(differences)
+
+
+def prove_rebase_restored(state: RebaseSnapshot, expected_head_oid: str | None, expected_branch: str | None) -> Generator[GitCommand, bytes, RebaseSnapshot]:
+    """Prove from one status that an abandoned rebase left HEAD, its branch, the index and the tracked files as they were before it.
+
+    The answer is the state to publish, saying the rebase was aborted; a difference raises ValueError with its cause.
+    Untracked files are Git's to leave alone and are not listed. A submodule folder that alone differs does not count
+    either: an Abort never touches it, so its own changes and the commit it has checked out stay as they were.
+    """
+    probe, entries = yield from read_rebase_final_status()
+    state = replace(state, head_oid=probe.head_oid, original_branch=probe.branch_head or "")
+    if probe.head_oid != expected_head_oid or probe.branch_head != expected_branch or probe.unmerged_records:
+        raise ValueError(REBASE_ABORT_UNVERIFIED_CAUSE)
+    if parent_differences(entries):
+        raise ValueError(REBASE_ABORT_LEFT_CHANGES_CAUSE)
+    return replace(state, diagnostic=REBASE_ABORTED_TEXT)
+
+
+def _parse_intent_answer(output: bytes) -> tuple[str, str, str | None]:
+    """Split the grouped target and HEAD read into the peeled target, HEAD and its full branch name, None when detached.
+
+    Anything but two full object IDs followed by a full reference name or HEAD is refused; nothing is guessed.
+    """
+    lines = output.decode().removesuffix("\n").split("\n")
+    if len(lines) != INTENT_ANSWER_LINE_COUNT:
+        raise ValueError(UNREADABLE_INTENT_CAUSE)
+    target_line, head_line, name_line = lines
+    try:
+        target_oid, head_oid = validate_oid(target_line), validate_oid(head_line)
+    except ValueError as error:
+        raise ValueError(UNREADABLE_INTENT_CAUSE) from error
+    if name_line == DETACHED_HEAD_NAME:
+        return target_oid, head_oid, None
+    if not name_line.startswith(REFERENCE_ROOT_PREFIX):
+        raise ValueError(UNREADABLE_INTENT_CAUSE)
+    return target_oid, head_oid, name_line
+
+
+def stopped_on_conflict(state: RebaseSnapshot, return_code: int | None) -> bool:
+    """Tell whether Git stopped the rebase on a conflict that waits for the user, an expected pause rather than a failure.
+
+    Git reports such a stop with its conflict exit status. Only a fresh read showing the rebase in conflict with named
+    unmerged paths turns it into a pause; any other failure (a refusing hook, a fatal error) stays one. The caller
+    checks that the rebase read is the one its command started or continued.
+    """
+    return return_code == GIT_CONFLICT_RETURN_CODE and state.fresh and state.state == "conflict" and bool(state.conflict_paths)
+
+
+def list_error_lines(text: str) -> list[str]:
+    """Keep the error lines Git writes about the list itself, leaving out the line that only names the correction."""
+    lines = []
+    for line in text.split(LINE_SEPARATOR):
+        if line.startswith(GIT_ERROR_PREFIX) and INSTRUCTION_ERROR_MARKER not in line:
+            lines.append(line)
+    return lines
+
+
+def instruction_error_text(state: RebaseSnapshot, return_code: int | None, stderr: str, error_before_edit: str = "") -> str:
+    """Answer the error lines of instructions Git refused and kept for a correction, or an empty text for any other end.
+
+    Git refuses a list it cannot run with its failure status, keeps the rebase waiting for a corrected list, and names
+    git rebase --edit-todo in its message. A stop on a conflict, an editor that failed, a rebase Git removed, a read
+    that is not fresh or any other exit status is no list to correct. The caller checks that the rebase read is the one
+    its command started or continued.
+
+    The text is the error lines of the last block of Git's messages, a block ending at the line that names the
+    correction; that line itself is left out, since the window already runs the command it advises. Before opening the editor on a list it refused, Git checks that list again and writes its errors once
+    more with no such line: when they are the ones error_before_edit already showed, they are left out, so only the
+    errors of the edited list remain.
+    """
+    if return_code != INSTRUCTION_ERROR_RETURN_CODE or not state.fresh or state.identity is None or stopped_on_conflict(state, return_code):
+        return ""
+    if INSTRUCTION_ERROR_MARKER not in stderr:
+        return ""
+    error_lines: list[str] = []
+    block_lines: list[str] = []
+    for line in stderr.split(LINE_SEPARATOR):
+        # Git writes the line naming the correction after the errors of the list, and the window already runs for the
+        # user the command it advises: that line closes the block without entering it.
+        if line.startswith(GIT_ERROR_PREFIX) and INSTRUCTION_ERROR_MARKER not in line:
+            block_lines.append(line)
+        if INSTRUCTION_ERROR_MARKER in line:
+            if block_lines:
+                error_lines = block_lines
+            block_lines = []
+    known_lines = list_error_lines(error_before_edit)
+    known_count = len(known_lines)
+    if known_lines and len(error_lines) > known_count and error_lines[:known_count] == known_lines:
+        error_lines = error_lines[known_count:]
+    return LINE_SEPARATOR.join(error_lines)
+
+
+def _expected_branch(identity_head_name: str) -> str | None:
+    """Answer the branch a rebase started from, None for a detached HEAD."""
+    return identity_head_name if identity_head_name.startswith(REFERENCE_ROOT_PREFIX) else None
+
+
+@dataclass(frozen=True)
+class RebaseAbortResult:
+    """What one abandonment of a rebase ended with, before it is published: status, state to show, cause and the Abort command's exit."""
+
+    status: OperationStatus
+    state: RebaseSnapshot
+    diagnostic: PreparedDiagnostic | None = None
+    process_status: ProcessStatus | None = None
+    return_code: int | None = None
+
+
+@dataclass(frozen=True)
+class RebaseOutcome(OperationOutcome):
+    """The result of a rebase command, with the error lines of the instructions Git refused and kept for a correction, when it did."""
+
+    instruction_error: str = field(default="", kw_only=True)
+
+
+@dataclass(frozen=True)
+class RebaseIntent:
+    """Keep the graph target distinct from the loaded branch or detached HEAD."""
+
+    operation: OperationIntent
+    target_oid: str
+    source_head_oid: str | None
+    source_symbolic_ref: str | None
+
+
+class RebaseService(QObject):
+    """Keep the latest native observation for each independent worktree."""
+
+    changed = Signal(object)
+
+    def __init__(self, worktree_service: WorktreeService, parent: QObject | None = None, *, repository_operation: RepositoryOperationService | None = None, editor: EditorService | None = None) -> None:
+        """Inject the existing bounded command and filesystem scheduler."""
+        super().__init__(parent)
+        self.worktree_service = worktree_service
+        self.state_by_key: dict[WorktreeKey, RebaseSnapshot] = {}
+        self.generation_by_key: dict[WorktreeKey, int] = {}
+        # The generation of the last result a command published for each worktree, as opposed to a read.
+        self.published_generation_by_key: dict[WorktreeKey, int] = {}
+        # Each caller keeps the queue priority it asked with, so a shared read waits at the level of its most urgent caller.
+        self.observers_by_key: dict[WorktreeKey, list[tuple[Callable[[], bool], Callable[[RebaseSnapshot], None], ProcessPriority]]] = {}
+        # Each waiting caller keeps the generation it asked at, so a command result can only answer callers it was published after.
+        self.waiting_observers_by_key: dict[WorktreeKey, list[tuple[int, Callable[[], bool], Callable[[RebaseSnapshot], None], ProcessPriority]]] = {}
+        self.outcome_by_id: dict[str, OperationOutcome] = {}
+        self.repository_operation = repository_operation
+        self.editor = editor
+        self.closed = False
+
+    def close(self) -> None:
+        """Stop accepting observations while existing workers drain without publishing to closing views."""
+        self.closed = True
+
+    def _publish_result(self, state: RebaseSnapshot) -> RebaseSnapshot:
+        """Supersede every pending observation before publishing a reconciled command result."""
+        latest = self.state_by_key.get(state.key)
+        generation = max(state.generation, self.generation_by_key.get(state.key, 0), latest.generation if latest is not None else 0) + 1
+        self.generation_by_key[state.key] = generation
+        self.published_generation_by_key[state.key] = generation
+        state = replace(state, generation=generation)
+        self.state_by_key[state.key] = state
+        self.changed.emit(state)
+        return state
+
+    def prepare(self, intent: RebaseIntent, *, is_current: Callable[[], bool], callback: Callable[[RebaseIntent | None, Exception | None], None]) -> None:
+        """Resolve the selected commit and reject stale source identity before confirmation."""
+        self.worktree_service.run(intent.operation.context, intent.operation.git_filename, self._validate_intent(intent, is_current), callback)
+
+    def _validate_intent(self, intent: RebaseIntent, is_current: Callable[[], bool]) -> Generator:
+        """Read native target, worktree and HEAD facts without changing the checkout."""
+        operation = intent.operation
+        if operation.context.is_bare or not intent.source_head_oid or not is_current():
+            raise ValueError("The rebase source is unavailable or changed. Refresh before rebasing.")
+        validate_oid(intent.target_oid)
+        # One read resolves the target as a commit, HEAD and the branch HEAD is on; a full object ID never reads as an option.
+        answer = yield GitCommand(["rev-parse", intent.target_oid + "^{commit}", "HEAD", "--symbolic-full-name", "HEAD"])
+        target_oid, head_oid, head_ref = _parse_intent_answer(answer)
+        git_directory = yield GitCommand(["rev-parse", "--absolute-git-dir"])
+        if canonical_path(os.fsdecode(git_directory).strip()) != operation.key.git_dir:
+            raise ValueError("The rebase worktree changed. Refresh before rebasing.")
+        state = yield from capture_rebase(operation.context, operation.generation)
+        if not state.fresh or state.state != "absent":
+            raise ValueError("A native rebase already exists or cannot be read. Refresh its state.")
+        if head_oid != intent.source_head_oid or head_ref != intent.source_symbolic_ref or not is_current():
+            raise ValueError("HEAD or its branch changed. Refresh before rebasing.")
+        return replace(intent, target_oid=target_oid)
+
+    def start(self, intent: RebaseIntent, *, is_current: Callable[[], bool]) -> str:
+        """Submit exactly one native rebase through the shared writer and editor owners; every edit Git asks for waits for a GitPane window."""
+        if self.repository_operation is None or self.editor is None:
+            raise ValueError("The rebase services are unavailable.")
+        return self.repository_operation.submit(intent.operation, self._start(intent, is_current))
+
+    def edit_todo(self, operation: OperationIntent, state: RebaseSnapshot, *, is_current: Callable[[], bool], error_before_edit: str = "") -> str:
+        """Edit the captured native list in a GitPane window under a new writer reservation without continuing Git.
+
+        error_before_edit is the error Git gave for the list this edit corrects, so that a list still refused after the
+        edit reports only its own errors.
+        """
+        if self.repository_operation is None or self.editor is None or operation.action != OperationAction.REBASE_CONTINUE:
+            raise ValueError("The rebase instruction editor is unavailable.")
+        return self.repository_operation.submit(operation, self._edit_todo(operation, state, is_current, error_before_edit))
+
+    def continue_rebase(self, operation: OperationIntent, state: RebaseSnapshot, *, is_current: Callable[[], bool]) -> str:
+        """Capture the index at the explicit Continue request and reserve one native command."""
+        if self.repository_operation is None or self.editor is None or operation.action != OperationAction.REBASE_CONTINUE:
+            raise ValueError("The rebase services are unavailable.")
+        index_filename = os.path.join(operation.context.git_dir, "index")
+        index_content = read_index(index_filename)
+        return self.repository_operation.submit(operation, self._continue(operation, state, is_current, index_filename, index_content))
+
+    def abort(self, operation: OperationIntent, state: RebaseSnapshot, *, is_current: Callable[[], bool]) -> str:
+        """Reserve one native Abort while preserving the observed rebase, HEAD and requester."""
+        if self.repository_operation is None or operation.action != OperationAction.REBASE_ABORT:
+            raise ValueError("The native rebase abort service is unavailable.")
+
+        def current() -> bool:
+            """Accept unchanged refreshes while rejecting changed native state or editor ownership."""
+            latest = self.state_by_key.get(operation.key)
+            # A background read advances the observation counter even when Git has not changed.
+            # Bind Abort to native identity and HEAD so that read cannot invalidate the user's click.
+            if latest is not None and (latest.identity != state.identity or latest.head_oid != state.head_oid or not can_abort_rebase(latest)):
+                return False
+            if self.editor is not None:
+                for context in self.editor.context_by_id.values():
+                    if not context.closed and context.worktree_key == operation.key:
+                        return False
+            return is_current()
+
+        return self.repository_operation.submit(operation, self._abort(operation, state, current))
+
+    def _abort(self, operation: OperationIntent, previous: RebaseSnapshot, is_current: Callable[[], bool]) -> Generator:
+        """Let Git restore its origin and report abandonment only after reading the resulting files and references."""
+        result = yield from self._restore_native_rebase(operation, previous, is_current, lambda: self.repository_operation.validate(operation))
+        return self._publish_abort(operation, previous, result)
+
+    def _publish_abort(self, operation: OperationIntent, before: RebaseSnapshot | None, result: RebaseAbortResult) -> OperationOutcome:
+        """Publish the state an abandonment ended with and keep its outcome, one Abort step."""
+        state = self._publish_result(result.state)
+        step = OperationStepResult(ABORT_REBASE_LABEL, result.status, before, state, result.process_status, result.status.value, result.diagnostic, result.return_code)
+        outcome = OperationOutcome(operation.operation_id, result.status, (step,), result.diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _restore_native_rebase(self, operation: OperationIntent, previous: RebaseSnapshot, is_current: Callable[[], bool],
+                               validate_reservation: Callable[[], None]) -> Generator[object, object, RebaseAbortResult]:
+        """Run git rebase --abort on the rebase previous describes, kept out of submodules, then prove from the files that everything is back.
+
+        The rebase must still be the one previous read, with the same HEAD, and validate_reservation must accept the
+        launch; nothing is published here.
+        """
+        diagnostic = process_status = return_code = None
+        native_started = False
+        state = previous
+        status = OperationStatus.REFUSED
+        try:
+            changed_cause = "HEAD or the Abort request changed before launch. Refresh first."
+            baseline = yield FileTask(lambda: capture_write_launch_signature(operation.context, changed_cause, reference_signature, reference_signature_paths))
+            state = yield from capture_rebase(operation.context, previous.generation)
+            if (not is_current() or not can_abort_rebase(previous) or not can_abort_rebase(state) or previous.key != operation.key or state.key != operation.key
+                    or previous.identity is None or state.identity != previous.identity or state.head_oid != previous.head_oid):
+                raise ValueError("The native rebase or HEAD changed. Refresh before aborting.")
+            signature = yield FileTask(lambda: prepare_write_launch_signature(operation.context, baseline, changed_cause, reference_signature))
+
+            def validate_launch() -> None:
+                """Reject changed native metadata, HEAD, session or activity after scheduler waiting."""
+                nonlocal native_started
+                validate_reservation()
+                if not is_current():
+                    raise ValueError(changed_cause)
+                verify_launch_signature(signature.metadata, changed_cause)
+                native_started = True
+
+            # Without recursion, restoring the original commit leaves the files of every submodule as they are.
+            yield GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, "rebase", "--abort"], profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                             before_start=validate_launch)
+            process_status, return_code = ProcessStatus.SUCCESS, 0
+        except (GitCommandError, ValueError, OSError) as error:
+            if isinstance(error, GitCommandError):
+                diagnostic, process_status, return_code = error.diagnostic, error.process_status, error.return_code
+            else:
+                diagnostic = Diagnostic(ABORT_REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+        try:
+            state = yield from capture_rebase(operation.context, previous.generation)
+            if native_started and return_code == 0 and state.fresh and state.state == "absent":
+                state = yield from prove_rebase_restored(state, previous.identity.original_oid, _expected_branch(previous.identity.head_name))
+                status = OperationStatus.ABORTED
+            elif native_started:
+                status = OperationStatus.FAILED if return_code != 0 else OperationStatus.UNKNOWN
+                if diagnostic is None:
+                    diagnostic = Diagnostic(ABORT_REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [],
+                                            "Git exited but the native rebase restoration could not be verified. Refresh to inspect the result.").prepare()
+            elif state.state == "absent":
+                # The rebase ended elsewhere before this Abort could start: the refusal stays in the console, the views
+                # follow the ended rebase.
+                state = replace(ended_outside_state(state), native_observations=None)
+            if diagnostic is not None and not state.ended_outside:
+                # The published message is the command's, not the capture's own, so the state no longer describes a plain capture.
+                state = replace(state, diagnostic=diagnostic.cause, native_observations=None)
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(ABORT_REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            state = replace(previous, state="unknown", fresh=False, diagnostic=diagnostic.cause, native_observations=None)
+        return RebaseAbortResult(status, state, diagnostic, process_status, return_code)
+
+    def _abort_after_editor(self, operation: OperationIntent, previous: RebaseSnapshot | None, expected_head_oid: str | None, expected_branch: str | None) -> Generator:
+        """Cancel the whole rebase the user aborted in the GitPane editor, inside the reservation of the command Git answered.
+
+        Git exits as soon as the editor answers Abort. On the first list it has already removed its state, so running
+        git rebase --abort would only fail: the result is proven from the files alone. On any later edit Git waits
+        paused, and its own git rebase --abort brings everything back. Either way HEAD and its branch must be the ones
+        the rebase started from. Git's lines about the editor stay in the console; the outcome carries no failure cause.
+
+        The caller's own currency check is not asked again: it judges the action it was captured for (a start, a
+        continue, a list edit), which the rebase Git left paused no longer matches. The Abort is judged instead by the
+        reservation, still this command's, and by the application's rules for an Abort of the rebase read now.
+        """
+        try:
+            state = yield from capture_rebase(operation.context, operation.generation)
+            if state.fresh and state.state == "absent":
+                state = yield from prove_rebase_restored(state, expected_head_oid, expected_branch)
+                result = RebaseAbortResult(OperationStatus.ABORTED, state)
+            elif state.identity is None or state.identity.original_oid != expected_head_oid or _expected_branch(state.identity.head_name) != expected_branch:
+                raise ValueError(EDITOR_ABORT_CHANGED_CAUSE)
+            else:
+                # The reservation is still this command's, but Git changed the rebase it was captured on: the Abort is judged
+                # on the rebase Git left, read now, so a change made by anyone else before its launch still refuses it.
+                rebase_capture = yield FileTask(lambda: native_rebase_capture(operation.context))
+                follow_up = replace(operation, action=OperationAction.REBASE_ABORT, rebase_capture=rebase_capture)
+                result = yield from self._restore_native_rebase(operation, state, lambda: True, lambda: self.repository_operation.validate_follow_up(operation, follow_up))
+        except (GitCommandError, ValueError, OSError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(ABORT_REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            fallback = previous or self.state_by_key.get(operation.key) or RebaseSnapshot(operation.key, operation.generation)
+            result = RebaseAbortResult(OperationStatus.UNKNOWN, replace(fallback, state="unknown", fresh=False, diagnostic=diagnostic.cause, native_observations=None), diagnostic)
+        return self._publish_abort(operation, previous, result)
+
+    def _continue(self, operation: OperationIntent, previous: RebaseSnapshot, is_current: Callable[[], bool], index_filename: str, index_content: bytes | None) -> Generator:
+        """Recheck the stopped commit before launch and prove completion from native effects."""
+        diagnostic = process_status = return_code = editor_context = None
+        native_started = aborted_in_editor = False
+        instruction_error = ""
+        state = previous
+        status = OperationStatus.REFUSED
+        try:
+            changed_cause = "HEAD or the index changed before Continue. Refresh first."
+            baseline = yield FileTask(lambda: capture_write_launch_signature(operation.context, changed_cause, reference_signature, reference_signature_paths, index_filename, index_content))
+            state = yield from capture_rebase(operation.context, operation.generation)
+            if (not is_current() or not previous.fresh or not state.fresh or previous.key != operation.key or state.identity is None
+                    or state.identity != previous.identity or state.head_oid != previous.head_oid or state.current_step != previous.current_step
+                    or state.state not in REBASE_CONTINUABLE_STATE_SET):
+                raise ValueError("The paused rebase or HEAD changed. Refresh before continuing.")
+            # This fresh capture, read inside the reservation, is the authority; a displayed or passive state never is.
+            if state.unmerged:
+                raise ValueError("Resolve and stage all conflicts before continuing the rebase.")
+            signature = yield FileTask(lambda: prepare_write_launch_signature(operation.context, baseline, changed_cause, reference_signature))
+            editor_context = self.editor.create_context(operation.operation_id, operation.context.git_dir, operation.key)
+
+            def validate_launch() -> None:
+                """Reject index, HEAD and native-state changes during scheduler waiting."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if not is_current():
+                    raise ValueError(changed_cause)
+                verify_launch_signature(signature.metadata, changed_cause)
+                native_started = True
+
+            # Without recursion, the remaining steps leave the files of every submodule as they are.
+            yield GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, *UTF8_LOG_OUTPUT_ARGUMENTS, "rebase", "--continue"], profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                             before_start=validate_launch, editor_context=editor_context)
+            process_status, return_code = ProcessStatus.SUCCESS, 0
+        except (GitCommandError, ValueError, OSError) as error:
+            if isinstance(error, GitCommandError):
+                diagnostic, process_status, return_code = error.diagnostic, error.process_status, error.return_code
+                aborted_in_editor = editor_context is not None and editor_context.abort_requested
+            else:
+                diagnostic = Diagnostic("Continue rebase", operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+        if aborted_in_editor:
+            return (yield from self._abort_after_editor(operation, previous, previous.identity.original_oid, _expected_branch(previous.identity.head_name)))
+        try:
+            state = yield from capture_rebase(operation.context, operation.generation)
+            if native_started:
+                status = OperationStatus.PAUSED if state.state != "absent" and return_code == 0 else OperationStatus.FAILED
+                if state.state == "absent" and state.fresh and return_code == 0:
+                    # The status ties the branch to HEAD itself, so the branch needs no read of its own.
+                    probe, _entries = yield from read_rebase_final_status()
+                    state = replace(state, head_oid=probe.head_oid, original_branch=probe.branch_head or "")
+                    if probe.branch_head != _expected_branch(previous.identity.head_name) or probe.unmerged_records or not probe.head_oid:
+                        raise ValueError("The final rebase branch or index could not be verified. Refresh to inspect it.")
+                    yield GitCommand(["merge-base", "--is-ancestor", previous.identity.onto_oid, probe.head_oid])
+                    status = OperationStatus.SUCCESS
+                elif state.identity != previous.identity:
+                    status = OperationStatus.UNKNOWN
+                elif stopped_on_conflict(state, return_code):
+                    # The next commit conflicts: Git waits for the user again. Its message is already in the console, so
+                    # no failure cause is attached to the pause.
+                    status, diagnostic = OperationStatus.PAUSED, None
+                elif diagnostic is not None:
+                    instruction_error = instruction_error_text(state, return_code, diagnostic.stderr)
+                    if instruction_error:
+                        # Git refused the remaining instructions and waits for a corrected list: a pause for the editor,
+                        # whose error lines are already in the console.
+                        status, diagnostic = OperationStatus.PAUSED, None
+            elif state.state == "absent":
+                # The rebase ended elsewhere before this Continue could start: the refusal stays in the console.
+                state = ended_outside_state(state)
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Continue rebase", operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            state = replace(previous, state="unknown", fresh=False, diagnostic=diagnostic.cause, native_observations=None)
+        state = self._publish_result(state)
+        step = OperationStepResult("Continue rebase", status, previous, state, process_status, status.value, diagnostic, return_code)
+        outcome = RebaseOutcome(operation.operation_id, status, (step,), diagnostic, instruction_error=instruction_error)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _edit_todo(self, operation: OperationIntent, previous: RebaseSnapshot, is_current: Callable[[], bool], error_before_edit: str) -> Generator:
+        """Revalidate native identity at launch and publish the resulting pause after editor exit.
+
+        An edited list Git refuses again leaves the rebase paused, with the errors Git wrote after the edit.
+        """
+        diagnostic = process_status = return_code = editor_context = None
+        aborted_in_editor = False
+        instruction_error = ""
+        status = OperationStatus.REFUSED
+        state = previous
+        try:
+            state = yield from capture_rebase(operation.context, operation.generation)
+            if (not is_current() or not state.fresh or not previous.fresh or state.key != previous.key or state.identity is None
+                    or state.identity != previous.identity or state.identity.backend != "rebase-merge"
+                    or state.state not in REBASE_STOPPED_STATE_SET):
+                raise ValueError("The native rebase changed. Refresh before editing its instructions.")
+            editor_context = self.editor.create_context(operation.operation_id, operation.context.git_dir, operation.key)
+
+            def validate_launch() -> None:
+                """Reject a replaced capture or closed session after scheduler waiting."""
+                self.repository_operation.validate(operation)
+                if not is_current():
+                    raise ValueError("The rebase instruction request is no longer current. Refresh first.")
+
+            # Saving the list replays nothing, but like every other write it starts with Git kept out of the submodules.
+            yield GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, *UTF8_LOG_OUTPUT_ARGUMENTS, "rebase", "--edit-todo"], profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                             before_start=validate_launch, editor_context=editor_context)
+            process_status, return_code, status = ProcessStatus.SUCCESS, 0, OperationStatus.PAUSED
+        except (GitCommandError, ValueError, OSError) as error:
+            if isinstance(error, GitCommandError):
+                diagnostic, process_status, return_code = error.diagnostic, error.process_status, error.return_code
+                status = OperationStatus.FAILED
+                aborted_in_editor = editor_context is not None and editor_context.abort_requested
+            else:
+                diagnostic = Diagnostic("Edit rebase instructions", operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+        if aborted_in_editor:
+            return (yield from self._abort_after_editor(operation, previous, previous.identity.original_oid, _expected_branch(previous.identity.head_name)))
+        try:
+            state = yield from capture_rebase(operation.context, operation.generation)
+            if not state.fresh or state.identity != previous.identity:
+                status = OperationStatus.UNKNOWN
+            elif status == OperationStatus.FAILED and diagnostic is not None:
+                instruction_error = instruction_error_text(state, return_code, diagnostic.stderr, error_before_edit)
+                if instruction_error:
+                    # Git kept the rebase paused on the list it refused: a pause for the editor, whose error lines are already in the console.
+                    status, diagnostic = OperationStatus.PAUSED, None
+            if state.state == "absent":
+                # Editing the instructions never ends a rebase: one that is gone was ended elsewhere.
+                state = ended_outside_state(state)
+        except (ValueError, OSError, GitCommandError):
+            state = replace(state, state="unknown", fresh=False, diagnostic="Cannot reread the native rebase after editing. Refresh to inspect it.", native_observations=None)
+            status = OperationStatus.UNKNOWN
+        state = self._publish_result(state)
+        step = OperationStepResult("Edit rebase instructions", status, operation, state, process_status, status.value, diagnostic, return_code)
+        outcome = RebaseOutcome(operation.operation_id, status, (step,), diagnostic, instruction_error=instruction_error)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _start(self, intent: RebaseIntent, is_current: Callable[[], bool]) -> Generator:
+        """Reconcile native state after every exit before releasing command ownership."""
+        operation = intent.operation
+        diagnostic = process_status = return_code = editor_context = None
+        native_started = aborted_in_editor = False
+        instruction_error = ""
+        state = None
+        status = OperationStatus.REFUSED
+        try:
+            changed_cause = "HEAD or repository identity changed before rebase launch. Refresh first."
+            baseline = yield FileTask(lambda: capture_write_launch_signature(operation.context, changed_cause, reference_signature, reference_signature_paths))
+            intent = yield from self._validate_intent(intent, is_current)
+            signature = yield FileTask(lambda: prepare_write_launch_signature(operation.context, baseline, changed_cause, reference_signature))
+            editor_context = self.editor.create_context(operation.operation_id, operation.context.git_dir, operation.key)
+
+            def validate_launch() -> None:
+                """Reject changes made while the checked command waited in the scheduler."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if not is_current():
+                    raise ValueError(changed_cause)
+                verify_launch_signature(signature.metadata, changed_cause)
+                native_started = True
+
+            # Without recursion, a step that moves a gitlink changes what the branch points to, never the files checked out in the submodule.
+            arguments = [*SUBMODULE_RECURSION_OFF_ARGUMENTS, *UTF8_LOG_OUTPUT_ARGUMENTS, "-c", "rebase.abbreviateCommands=false", "-c", "rebase.instructionFormat=%s", "rebase", "--interactive", "--no-autosquash", "--no-autostash",
+                         "--no-rebase-merges", "--no-update-refs", "--no-fork-point", intent.target_oid]
+            yield GitCommand(arguments, profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                             before_start=validate_launch, editor_context=editor_context)
+            process_status, return_code = ProcessStatus.SUCCESS, 0
+        except (GitCommandError, ValueError, OSError) as error:
+            if isinstance(error, GitCommandError):
+                diagnostic, process_status, return_code = error.diagnostic, error.process_status, error.return_code
+                aborted_in_editor = editor_context is not None and editor_context.abort_requested
+            else:
+                diagnostic = Diagnostic(REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+        if aborted_in_editor:
+            return (yield from self._abort_after_editor(operation, None, intent.source_head_oid, intent.source_symbolic_ref))
+        try:
+            state = yield from capture_rebase(operation.context, operation.generation)
+            completed = False
+            if native_started and return_code == 0 and state.fresh and state.state == "absent":
+                # The status ties the branch to HEAD itself, so the branch needs no read of its own.
+                probe, _entries = yield from read_rebase_final_status()
+                state = replace(state, head_oid=probe.head_oid, original_branch=probe.branch_head or "")
+                completed = bool(probe.head_oid) and not probe.unmerged_records and probe.branch_head == intent.source_symbolic_ref
+            if completed:
+                yield GitCommand(["merge-base", "--is-ancestor", intent.target_oid, state.head_oid])
+                status = OperationStatus.SUCCESS
+            elif native_started:
+                status = OperationStatus.PAUSED if state.state != "absent" and return_code == 0 else OperationStatus.FAILED
+                started_here = state.identity is not None and state.identity.original_oid == intent.source_head_oid and state.identity.onto_oid == intent.target_oid
+                if started_here and stopped_on_conflict(state, return_code):
+                    # The rebase this command started stopped on a conflict and waits for the user: an expected pause
+                    # whose message is already in the console, not a failure.
+                    status, diagnostic = OperationStatus.PAUSED, None
+                elif started_here and diagnostic is not None:
+                    instruction_error = instruction_error_text(state, return_code, diagnostic.stderr)
+                    if instruction_error:
+                        # Git refused the instructions of the rebase this command started and keeps them for a
+                        # correction: a pause for the editor, whose error lines are already in the console.
+                        status, diagnostic = OperationStatus.PAUSED, None
+                if status == OperationStatus.FAILED and diagnostic is None:
+                    # Git exited cleanly and removed its native directory, yet the branch or index does not match the launch: name the cause rather than a bare Failed.
+                    diagnostic = Diagnostic(REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [],
+                                            "Git exited but the final branch or index could not be verified. Refresh to inspect the result.").prepare()
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN if native_started else OperationStatus.REFUSED
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(REBASE_LABEL, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            state = replace(state or self.state_by_key.get(operation.key) or RebaseSnapshot(operation.key, operation.generation), state="unknown", fresh=False,
+                            diagnostic=diagnostic.cause, native_observations=None)
+        state = self._publish_result(state)
+        step = OperationStepResult(REBASE_LABEL, status, intent, state, process_status, status.value, diagnostic, return_code)
+        outcome = RebaseOutcome(operation.operation_id, status, (step,), diagnostic, instruction_error=instruction_error)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def observe(self, context: RepositoryContext, git_filename: str, *, is_current: Callable[[], bool], callback: Callable[[RebaseSnapshot], None],
+                priority: ProcessPriority = ProcessPriority.USER) -> None:
+        """Publish only a current requester and the newest read for this worktree.
+
+        The priority is the caller's place in the process queue: a click by default, background for an automatic look.
+        """
+        key = WorktreeKey.from_context(context)
+        if self.closed:
+            return
+        if key in self.observers_by_key:
+            # The read already running may have started before the change this caller wants to see (a conflict staged in between).
+            # Answering from it could report a state that no longer exists, so late callers share one read started after it ends.
+            self.waiting_observers_by_key.setdefault(key, []).append((self.generation_by_key.get(key, 0), is_current, callback, priority))
+            return
+        self._start_read(context, git_filename, [(is_current, callback, priority)])
+
+    def observe_passive(self, context: RepositoryContext, git_filename: str, source: PassiveObservationSource, *, is_current: Callable[[], bool],
+                        callback: Callable[[RebaseSnapshot], None], priority: ProcessPriority = ProcessPriority.USER) -> None:
+        """Follow the rebase state for the banner with what the automatic refresh has just read; only that refresh calls it.
+
+        A request that has to wait for a read already running is answered by a complete read through Git, at the same priority.
+        """
+        if self.closed:
+            return
+        if WorktreeKey.from_context(context) in self.observers_by_key:
+            # The facts in hand may be older than the change this caller waits for, and a waiting request is never kept
+            # with them: it becomes a request through Git.
+            self.observe(context, git_filename, is_current=is_current, callback=callback, priority=priority)
+            return
+        self._start_read(context, git_filename, [(is_current, callback, priority)], source)
+
+    def _start_read(self, context: RepositoryContext, git_filename: str, observers: list[tuple[Callable[[], bool], Callable[[RebaseSnapshot], None], ProcessPriority]],
+                    source: PassiveObservationSource | None = None) -> None:
+        """Run one native state read for these callers, then one more for the callers that arrived while it ran."""
+        key = WorktreeKey.from_context(context)
+        self.observers_by_key[key] = observers
+        generation = self.generation_by_key.get(key, 0) + 1
+        self.generation_by_key[key] = generation
+
+        def complete(result: RebaseSnapshot | None, error: Exception | None) -> None:
+            """Publish this read first, so starting the follow-up read cannot mark it as superseded."""
+            running_observers = self.observers_by_key.get(key)
+            if self.generation_by_key.get(key) != generation and running_observers is not None:
+                # A command published its own verified result while this read ran. That result answers every caller that asked before
+                # the publication, so their refresh request ends here; a caller that asked after it needs a read newer than its request.
+                still_waiting_observers = []
+                for asked_generation, current, observer_callback, observer_priority in self.waiting_observers_by_key.pop(key, []):
+                    if asked_generation < self.generation_by_key.get(key, 0):
+                        running_observers.append((current, observer_callback, observer_priority))
+                    else:
+                        still_waiting_observers.append((asked_generation, current, observer_callback, observer_priority))
+                if still_waiting_observers:
+                    self.waiting_observers_by_key[key] = still_waiting_observers
+            try:
+                publish(result, error)
+            finally:
+                waiting_observers = []
+                for _asked_generation, current, observer_callback, observer_priority in self.waiting_observers_by_key.pop(key, []):
+                    if current():
+                        waiting_observers.append((current, observer_callback, observer_priority))
+                next_observers = self.observers_by_key.get(key)
+                if next_observers is not None:
+                    # A callback of this read already started the next one, after these callers asked, so it answers them too.
+                    next_observers.extend(waiting_observers)
+                elif waiting_observers and not self.closed:
+                    # The follow-up read answers requests made after the previous read started: the facts in hand then no longer
+                    # hold, so it reads everything through Git.
+                    self._start_read(context, git_filename, waiting_observers)
+
+        def publish(result: RebaseSnapshot | None, error: Exception | None) -> None:
+            """Retain known steps on read failure without reporting an invented completion."""
+            observers = self.observers_by_key.pop(key, [])
+            callbacks = []
+            for current, observer_callback, _observer_priority in observers:
+                if current():
+                    callbacks.append(observer_callback)
+            if self.closed or not callbacks:
+                return
+            if self.generation_by_key.get(key) != generation:
+                latest = self.state_by_key.get(key)
+                if latest is not None and latest.generation == self.generation_by_key.get(key):
+                    for observer_callback in callbacks:
+                        observer_callback(latest)
+                return
+            previous = self.state_by_key.get(key)
+            owned = self.repository_operation is not None and any(operation.key == key for operation in self.repository_operation.active_by_id.values())
+            if error is not None or result is None:
+                cause = str(error) if isinstance(error, ValueError) and str(error).startswith("Native rebase") else "Cannot read the native rebase state. Refresh to try again."
+                result = replace(previous or RebaseSnapshot(key, generation), generation=generation, state="unknown", fresh=False, diagnostic=cause, native_observations=None)
+            elif result.state == "absent":
+                if previous is not None and previous.state == "absent" and previous.diagnostic == REBASE_ABORTED_TEXT:
+                    result = replace(result, head_oid=previous.head_oid, diagnostic=previous.diagnostic)
+                elif previous is not None and previous.identity is not None and not owned:
+                    # The rebase is gone and no command of GitPane ended it. The read is published as it is, with no
+                    # rebase in it, so the next read has nothing left to compare with and the views stop showing one.
+                    result = ended_outside_state(result)
+            if (not owned and previous is not None and previous.identity is not None and result.identity is not None
+                    and (previous.identity != result.identity or previous.head_oid != result.head_oid or previous.current_step != result.current_step)):
+                result = replace(result, diagnostic="State changed outside GitPane. The current native rebase state has been read."
+                                 + ("\n" + result.diagnostic if result.diagnostic else ""))
+            self.state_by_key[key] = result
+            self.changed.emit(result)
+            for observer_callback in callbacks:
+                observer_callback(result)
+
+        self.worktree_service.run(context, git_filename, capture_rebase(context, generation) if source is None else capture_rebase_passive(context, generation, source),
+                                  complete, priority=observation_priority(observers))