gitpane 1.0.0__py3-none-any.whl

gitpane/sequencer/replay.py

@@ -0,0 +1,1435 @@
+"""Share native replay observations between current worktree views."""
+
+from __future__ import annotations
+
+import os
+import string
+import tempfile
+import uuid
+from dataclasses import dataclass, replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, Signal
+
+from gitpane.commit.commit_metadata import read_path_metadata
+from gitpane.config import GIT_COMMIT_TIMEOUT_MS, GIT_PATH_SEPARATOR, SUBMODULE_RECURSION_OFF_ARGUMENTS, ProcessPriority
+from gitpane.history.repository_value import GIT_CONFLICT_RETURN_CODE, SUCCESS_EXIT_CODE
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.launch_signature import (
+    capture_write_launch_signature,
+    changed_launch_paths,
+    exclude_covered_launch_paths,
+    prepare_write_launch_signature,
+    sign_launch_paths,
+    verify_launch_signature,
+)
+from gitpane.operation.operation_status import OperationStatus, operation_status
+from gitpane.operation.repository_operation import OperationAction, OperationIntent, OperationOutcome, OperationStepResult, WriteScope
+from gitpane.process.process_runner import LOCAL_WRITE_PROFILE, READ_PROFILE, ProcessStatus
+from gitpane.reference.reference_edit import GITLINK_MODE, read_commit_metadata, reference_signature, reference_signature_paths, validate_oid
+from gitpane.sequencer import replay_legacy
+from gitpane.sequencer.commit_message_rule import AUTOMATIC_COMMENT_PREFIX, DEFAULT_COMMENT_PREFIX
+from gitpane.sequencer.rebase_state import REBASE_BASENAMES
+from gitpane.sequencer.replay_state import (
+    LIVE_INDEX_BASENAME,
+    MERGE_MESSAGE_BASENAME,
+    REPLAY_BASENAMES,
+    REPLAY_SEQUENCER_BASENAMES,
+    REPLAY_STEP_UNATTRIBUTED_CONFLICT,
+    SEQUENCER_BASENAME,
+    TRAILING_EMPTY_PIECE_COUNT,
+    ReplayAction,
+    ReplayCommitMode,
+    ReplayEffect,
+    ReplayKind,
+    ReplayLaunch,
+    ReplayOwnership,
+    ReplaySnapshot,
+    capture_replay,
+    capture_replay_passive,
+    join_replay_launch,
+    read_replay_metadata,
+    replay_action_diagnostic,
+    unreadable_replay_state,
+)
+from gitpane.submodule.submodule_loss import gitlink_paths, submodule_loss_refusal
+from gitpane.worktree.command_sequence import FileTask, GitCommand, GitCommandError, ReadBatch, observation_priority
+from gitpane.worktree.worktree_snapshot import WorktreeKey, read_index
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.operation.diagnostic import PreparedDiagnostic
+    from gitpane.operation.launch_signature import LaunchSignature, WriteLaunchSignature
+    from gitpane.operation.repository_operation import RepositoryOperationService
+    from gitpane.sequencer.replay_state import ReplayMetadata
+    from gitpane.worktree.worktree_service import WorktreeService
+    from gitpane.worktree.worktree_snapshot import PassiveObservationSource
+
+FIRST_PARENT_NUMBER = 1
+MERGE_PARENT_MINIMUM = 2
+# The folders in which Git keeps a paused rebase and the instructions of a cherry-pick or revert series.
+NATIVE_REBASE_DIR_BASENAMES = ("rebase-merge", "rebase-apply")
+# One grouped show describes several commits: NUL between the fields of one commit, and the 0x01 marker at the end of
+# each, which Git follows with the line end it writes after every commit. The message comes last so that it may hold
+# any other byte.
+REPLAY_SOURCE_FORMAT = "%H%x00%P%x00%an%x00%aI%x00%cn%x00%cI%x00%B%x01"
+REPLAY_RECORD_END = b"\x01\n"
+REPLAY_FIELD_SEPARATOR = b"\0"
+RECORD_OID_POSITION = 0
+SOURCE_FIELD_COUNT = 7
+SOURCE_PARENTS_POSITION = 1
+SOURCE_AUTHOR_POSITION = 2
+SOURCE_AUTHOR_DATE_POSITION = 3
+SOURCE_COMMITTER_POSITION = 4
+SOURCE_COMMIT_DATE_POSITION = 5
+SOURCE_MESSAGE_POSITION = 6
+# The line end Git writes after the description of one commit, and after one answer of rev-parse.
+COMMIT_TERMINATOR = b"\n"
+# How a path of a replayed commit is split and checked before Git applies it. Windows reads both slashes, ignores dots
+# and spaces at the end of a name, and may open Git's folder under its short name.
+# Paths are read from Git as bytes; this form is drawn from the one text separator rather than written again.
+GIT_PATH_SEPARATOR_BYTES = GIT_PATH_SEPARATOR.encode("ascii")
+WINDOWS_PATH_SEPARATOR = b"\\"
+PATH_SEPARATORS = (GIT_PATH_SEPARATOR_BYTES, WINDOWS_PATH_SEPARATOR)
+DRIVE_LETTER_POSITION = 0
+DRIVE_SEPARATOR_POSITION = 1
+DRIVE_SEPARATOR = b":"
+RELATIVE_COMPONENT_SET = frozenset((b".", b".."))
+WINDOWS_IGNORED_TRAILING_CHARACTERS = b". "
+GIT_DIRECTORY_COMPONENT_SET = frozenset((b".git", b"git~1"))
+REPLAY_PATH_OUTSIDE_CAUSE = "The selected commit changes a path outside the working tree. It was not applied."
+REPLAY_PATH_GIT_DIRECTORY_CAUSE = "The selected commit changes a path inside the .git folder. It was not applied."
+REPLAY_CHANGES_UNREADABLE_CAUSE = "The changes of the selected commit could not be read. Refresh before applying it."
+# One record of a raw, NUL-framed diff listing (diff-tree, or diff --cached) is its metadata then its path: a colon,
+# both modes, both objects and the status, separated by spaces.
+RAW_DIFF_PREFIX = b":"
+RAW_DIFF_FIELD_COUNT = 5
+RAW_DIFF_OLD_MODE_POSITION = 0
+RAW_DIFF_NEW_MODE_POSITION = 1
+RAW_DIFF_PIECES_PER_RECORD = 2
+# The mode Git writes for the missing side of an added or removed entry. A change whose two sides are only a submodule
+# or nothing moves, adds or removes a submodule entry without Git touching the submodule's folder.
+RAW_DIFF_ABSENT_MODE = b"000000"
+SUBMODULE_ENTRY_MODE_SET = frozenset((GITLINK_MODE, RAW_DIFF_ABSENT_MODE))
+# Git's pathspec magic for a path kept out of a command, read literally whatever characters it holds.
+LITERAL_EXCLUSION_PATHSPEC_PREFIX = ":(exclude,literal)"
+# A command stopped by its time limit or by the user: the process status then names the result on its own.
+STOPPED_PROCESS_STATUSES = (ProcessStatus.TIMEOUT, ProcessStatus.IDLE_TIMEOUT, ProcessStatus.CANCELLED)
+PAUSE_CHANGED_CAUSE = "The commit operation, HEAD or the index changed. Refresh before trying again."
+CONTINUE_UNVERIFIED_CAUSE = "Continue finished without a verified commit. Inspect the current operation."
+ABORT_UNVERIFIED_CAUSE = "Abort did not bring back the checkout the operation started from. Inspect the current state."
+# rev-list --parents writes each commit followed by its parents; a commit of the chain Continue creates has exactly one.
+CHAIN_COMMIT_FIELD_COUNT = 2
+CHAIN_PARENT_POSITION = 1
+# The background write that removes the anchor references earlier versions left. It opens no console: its only trace
+# is the process log.
+LEGACY_ANCHOR_RETIREMENT_OPERATION = "Retire earlier replay references"
+LEGACY_ANCHOR_RETIREMENT_REFUSED_CAUSE = "A cherry-pick or revert is in progress. The earlier replay references were kept."
+
+
+def native_pause_paths(context: RepositoryContext) -> tuple[list[str], list[str]]:
+    """Name every file Git keeps for a paused cherry-pick, revert or rebase in one worktree, then the folders holding them.
+
+    The names are the ones the native readers already open, joined to the worktree's own Git folder; nothing is read.
+    """
+    filenames = []
+    for basename in REPLAY_BASENAMES:
+        filenames.append(os.path.join(context.git_dir, basename))
+    sequencer_dir = os.path.join(context.git_dir, SEQUENCER_BASENAME)
+    for basename in REPLAY_SEQUENCER_BASENAMES:
+        filenames.append(os.path.join(sequencer_dir, basename))
+    watched_dirs = [sequencer_dir]
+    for rebase_dir_basename in NATIVE_REBASE_DIR_BASENAMES:
+        state_dir = os.path.join(context.git_dir, rebase_dir_basename)
+        watched_dirs.append(state_dir)
+        for basename in REBASE_BASENAMES:
+            filenames.append(os.path.join(state_dir, basename))
+    return filenames, watched_dirs
+
+
+def replay_path_refusal(path: bytes) -> str:
+    """Name why a path a replayed commit changes must not be handed to Git, or answer "" for an ordinary path of the working tree.
+
+    A path is refused when it is empty or absolute, when one of its components is empty, "." or "..", or when one of
+    them names Git's own folder in any spelling Windows opens as that folder: any case, trailing dots and spaces, or
+    its short name. Both slashes count as separators, since Windows reads either.
+    """
+    drive_form = path[DRIVE_LETTER_POSITION:DRIVE_LETTER_POSITION + 1].isalpha() and path[DRIVE_SEPARATOR_POSITION:].startswith(DRIVE_SEPARATOR)
+    if not path or path.startswith(PATH_SEPARATORS) or drive_form:
+        return REPLAY_PATH_OUTSIDE_CAUSE
+    for component in path.replace(WINDOWS_PATH_SEPARATOR, GIT_PATH_SEPARATOR_BYTES).split(GIT_PATH_SEPARATOR_BYTES):
+        if not component or component in RELATIVE_COMPONENT_SET:
+            return REPLAY_PATH_OUTSIDE_CAUSE
+        folded = component.rstrip(WINDOWS_IGNORED_TRAILING_CHARACTERS).lower()
+        if not folded:
+            return REPLAY_PATH_OUTSIDE_CAUSE
+        if folded in GIT_DIRECTORY_COMPONENT_SET:
+            return REPLAY_PATH_GIT_DIRECTORY_CAUSE
+    return ""
+
+
+def replay_change_refusal(output: bytes) -> str:
+    """Read the raw, NUL-framed diff-tree listing of the changes a replay applies and name the first reason to refuse it, or answer "".
+
+    Every path replay_path_refusal refuses is refused, the path of a submodule included, and a listing that does not
+    split into whole records is refused as unreadable. What a change does to the folder of a submodule is checked
+    separately, by replaced_submodule_paths.
+    """
+    try:
+        records = _split_raw_diff_records(output)
+    except ValueError as error:
+        return str(error)
+    for _fields, path in records:
+        refusal = replay_path_refusal(path)
+        if refusal:
+            return refusal
+    return ""
+
+
+def replaced_submodule_paths(output: bytes, index_gitlink_paths: list[bytes]) -> list[bytes]:
+    """Name the submodules of the index whose folder the replayed changes of a raw, NUL-framed listing would remove or write into, in index order.
+
+    Git, launched without descending into submodules, handles a change that only moves, adds or removes a submodule
+    entry without touching the submodule's folder. Any other change on the path of a submodule of the index (turned
+    into a file or a link, or a file changed there), inside it (a folder of files taking its place) or on a folder
+    that holds it makes Git remove that folder or write into it. Direction does not matter, so a Revert that turns a
+    submodule back into a file is found like a Cherry-pick. Paths are compared the way Windows opens them. A listing
+    that does not split into whole records raises ValueError.
+    """
+    records = _split_raw_diff_records(output)
+    folded_records = []
+    for fields, path in records:
+        folded_records.append((fields, _folded_path(path)))
+    replaced_paths = []
+    for gitlink_path in index_gitlink_paths:
+        folded_gitlink_path = _folded_path(gitlink_path)
+        for fields, folded_path in folded_records:
+            if _change_replaces_submodule(fields, folded_path, folded_gitlink_path):
+                replaced_paths.append(gitlink_path)
+                break
+    return replaced_paths
+
+
+def _change_replaces_submodule(fields: list[bytes], folded_path: bytes, folded_gitlink_path: bytes) -> bool:
+    """Tell whether one change removes the folder of a submodule or writes into it, rather than only moving, adding or removing its entry."""
+    if folded_path == folded_gitlink_path:
+        return not {fields[RAW_DIFF_OLD_MODE_POSITION], fields[RAW_DIFF_NEW_MODE_POSITION]} <= SUBMODULE_ENTRY_MODE_SET
+    return folded_path.startswith(folded_gitlink_path + GIT_PATH_SEPARATOR_BYTES) or folded_gitlink_path.startswith(folded_path + GIT_PATH_SEPARATOR_BYTES)
+
+
+def _folded_path(path: bytes) -> bytes:
+    """Spell a path the way Windows opens it, so two spellings of one folder compare equal: either slash, any case, trailing dots and spaces dropped."""
+    components = []
+    for component in path.replace(WINDOWS_PATH_SEPARATOR, GIT_PATH_SEPARATOR_BYTES).split(GIT_PATH_SEPARATOR_BYTES):
+        text = component.rstrip(WINDOWS_IGNORED_TRAILING_CHARACTERS).decode("utf-8", "surrogateescape")
+        components.append(text.casefold().encode("utf-8", "surrogateescape"))
+    return GIT_PATH_SEPARATOR_BYTES.join(components)
+
+
+def _split_raw_diff_records(output: bytes) -> list[tuple[list[bytes], bytes]]:
+    """Split a raw, NUL-framed diff listing into the metadata fields and the path of each record, in Git's order.
+
+    A listing that does not split into whole records, or a record whose metadata is not the colon then five fields,
+    is refused as unreadable rather than read partly.
+    """
+    pieces = output.split(b"\0")
+    if pieces[-1] or len(pieces) % RAW_DIFF_PIECES_PER_RECORD != TRAILING_EMPTY_PIECE_COUNT:
+        raise ValueError(REPLAY_CHANGES_UNREADABLE_CAUSE)
+    records = []
+    for position in range(0, len(pieces) - TRAILING_EMPTY_PIECE_COUNT, RAW_DIFF_PIECES_PER_RECORD):
+        metadata, path = pieces[position], pieces[position + 1]
+        fields = metadata.removeprefix(RAW_DIFF_PREFIX).split(b" ")
+        if not metadata.startswith(RAW_DIFF_PREFIX) or len(fields) != RAW_DIFF_FIELD_COUNT:
+            raise ValueError(REPLAY_CHANGES_UNREADABLE_CAUSE)
+        records.append((fields, path))
+    return records
+
+
+def staged_gitlink_paths(raw_output: bytes) -> list[bytes]:
+    """Name the submodule entries a "diff --cached --raw -z --no-renames" listing shows as staged, in the order Git lists them.
+
+    An entry counts when either side of its change is a submodule: added, moved to another commit, removed, or
+    turned from or into a file. A listing that does not split into whole records raises ValueError.
+    """
+    paths = []
+    for fields, path in _split_raw_diff_records(raw_output):
+        if GITLINK_MODE in (fields[RAW_DIFF_OLD_MODE_POSITION], fields[RAW_DIFF_NEW_MODE_POSITION]):
+            paths.append(path)
+    return paths
+
+
+def reset_keeping_gitlinks_arguments(gitlink_paths: list[bytes]) -> list[str]:
+    """Name the reset that sets the index back to HEAD, except for the given submodule entries, which stay staged.
+
+    Each submodule path is kept out by an exact, literal exclusion. GitPane hands every command to Git with literal
+    pathspecs, which would read the exclusion as a file name, so this reset reads pathspec magic again: its only
+    pathspecs are the exclusions built here. A path that is not UTF-8 raises ValueError before anything runs.
+    """
+    if not gitlink_paths:
+        return ["reset", "--quiet"]
+    arguments = ["--no-literal-pathspecs", "reset", "--quiet", "--"]
+    for path in gitlink_paths:
+        arguments.append(LITERAL_EXCLUSION_PATHSPEC_PREFIX + path.decode("utf-8"))
+    return arguments
+
+
+def native_replay_message(message: str, source_oid: str, add_reference: bool, comment_prefix: str = "#") -> str:
+    """Remove only Git's trailing conflict notes and retain every authored message line."""
+    if comment_prefix == "auto":
+        before, separator, _notes = message.rpartition(" Conflicts:\n")
+        _body, _newline, comment_prefix = before.rpartition("\n")
+        if not separator or len(comment_prefix) != 1:
+            raise ValueError("The automatic native conflict comment prefix could not be verified. The message was preserved.")
+    body, separator, notes = message.rpartition("\n" + comment_prefix + " Conflicts:\n")
+    if separator and all(not line.strip() or line.startswith(comment_prefix + "\t") for line in notes.splitlines()):
+        message = body
+    message = message.rstrip("\n") + "\n"
+    trailer = "(cherry picked from commit " + source_oid + ")"
+    if add_reference and trailer not in message.splitlines():
+        message = message.rstrip("\n") + "\n\n" + trailer + "\n"
+    return message
+
+
+def native_message_comment_prefix(message: str) -> str:
+    """Choose a temporary Git comment prefix that cannot remove an authored message line."""
+    lines = message.splitlines()
+    for character in string.punctuation + string.ascii_letters + string.digits:
+        if not any(line.startswith(character) for line in lines):
+            return character
+    raise ValueError("The native message needs an unused comment prefix. Its original contents were preserved.")
+
+
+def publish_replay_message(context: RepositoryContext, metadata: ReplayMetadata, message: str, validate: Callable[[], None]) -> ReplayMetadata:
+    """Compare native bytes immediately before replacing the message with an owned prepared file."""
+    if metadata.content_by_basename.get(MERGE_MESSAGE_BASENAME) == message:
+        return metadata
+    descriptor, candidate_filename = tempfile.mkstemp(prefix="gitpane-replay-message-", dir=context.git_dir)
+    try:
+        with os.fdopen(descriptor, "wb") as stream:
+            stream.write(message.encode("utf-8"))
+            stream.flush()
+            os.fsync(stream.fileno())
+        validate()
+        if read_replay_metadata(context.git_dir) != metadata:
+            raise ValueError("The native commit message changed. Its external contents were preserved; refresh before continuing.")
+        os.replace(candidate_filename, os.path.join(context.git_dir, MERGE_MESSAGE_BASENAME))
+        return read_replay_metadata(context.git_dir)
+    finally:
+        if os.path.exists(candidate_filename):
+            os.unlink(candidate_filename)
+
+
+class ReplayRecordAmbiguity(ValueError):
+    """A grouped commit description holds its record separator inside a message, so its records cannot be told apart.
+
+    Only this answer may be asked again one question at a time; any other malformed answer is a refusal.
+    """
+
+
+def _split_replay_commit_records(output: bytes, field_count: int, expected_oids: list[str]) -> dict[str, tuple[bytes, ...]]:
+    """Split one grouped show answer into the raw fields of each asked commit, bound to its object ID, never to its position.
+
+    Each record ends with the 0x01 marker of the format followed by the line end Git writes after every commit; only
+    that protocol ending is removed, never a line end of a message. The first field of each record must be one of the
+    asked object IDs, each exactly once, and every record must hold all of its fields; the message, last, keeps any
+    further NUL byte. More records than asked means a message holds the separator: that answer is ambiguous and
+    refused as such, to be asked again one question at a time.
+    """
+    expected_oid_set = set(expected_oids)
+    if not expected_oids or len(expected_oid_set) != len(expected_oids):
+        raise ValueError("A grouped commit description must name distinct commits.")
+    if not output.endswith(REPLAY_RECORD_END):
+        raise ValueError("Git gave back an incomplete commit description.")
+    records = output.removesuffix(REPLAY_RECORD_END).split(REPLAY_RECORD_END)
+    if len(records) > len(expected_oids):
+        raise ReplayRecordAmbiguity("A commit message holds the record separator of the grouped description.")
+    if len(records) != len(expected_oids):
+        raise ValueError("Git did not describe every asked commit.")
+    fields_by_oid = {}
+    for record in records:
+        fields = record.split(REPLAY_FIELD_SEPARATOR, field_count - 1)
+        if len(fields) != field_count:
+            raise ValueError("Git gave back an incomplete commit description.")
+        oid = validate_oid(fields[RECORD_OID_POSITION].decode("ascii"))
+        if oid not in expected_oid_set or oid in fields_by_oid:
+            raise ValueError("Git described a commit that was not asked for.")
+        fields_by_oid[oid] = tuple(fields)
+    return fields_by_oid
+
+
+def _decode_parent_oids(field: bytes) -> tuple[str, ...]:
+    """Read the space-separated parents of one commit description, in Git's order, refusing anything but full object IDs."""
+    parent_oids = []
+    for parent in field.decode("ascii").split(" ") if field else ():
+        parent_oids.append(validate_oid(parent))
+    return tuple(parent_oids)
+
+
+def replay_executable_signature(git_filename: str) -> tuple:
+    """Identify the Git executable a replay launches by its normalized path and the metadata of that file.
+
+    A capability of Git is proven for exactly this file: another path, or the same file rewritten in place (its Windows
+    change time moves even when size and modification time are put back), is another executable. A file that cannot be
+    found identifies nothing and is refused.
+    """
+    filename = os.path.normcase(os.path.abspath(git_filename))
+    identity = read_path_metadata(filename)
+    if identity is None:
+        raise ValueError("The Git executable could not be identified. Check the configured Git.")
+    return (filename, identity)
+
+
+@dataclass(frozen=True)
+class ReplaySourceRecord:
+    """The six displayed fields of one commit, in the order the form has always received them, and its parents in Git's order."""
+
+    fields: tuple[str, ...]
+    parent_oids: tuple[str, ...]
+
+
+def parse_replay_source_records(output: bytes, expected_oids: list[str]) -> dict[str, ReplaySourceRecord]:
+    """Read a grouped show written with REPLAY_SOURCE_FORMAT into one record per asked commit, bound to its object ID.
+
+    Text is decoded the way the form always decoded it, unreadable bytes replaced, and the message keeps the line end
+    Git writes after the description of a single commit, so each field reads exactly as it did when every commit had a
+    show of its own.
+    """
+    record_by_oid = {}
+    for oid, fields in _split_replay_commit_records(output, SOURCE_FIELD_COUNT, expected_oids).items():
+        texts = []
+        for position in (SOURCE_AUTHOR_POSITION, SOURCE_AUTHOR_DATE_POSITION, SOURCE_COMMITTER_POSITION, SOURCE_COMMIT_DATE_POSITION):
+            texts.append(fields[position].decode("utf-8", "replace"))
+        message = (fields[SOURCE_MESSAGE_POSITION] + COMMIT_TERMINATOR).decode("utf-8", "replace")
+        record_by_oid[oid] = ReplaySourceRecord((oid, *texts, message), _decode_parent_oids(fields[SOURCE_PARENTS_POSITION]))
+    return record_by_oid
+
+
+def read_replay_source_records(oids: list[str], *, read_parents: bool = True) -> Generator[GitCommand, object, dict[str, ReplaySourceRecord]]:
+    """Describe the given commits, each named once, in one show, the answers bound to their object IDs.
+
+    An answer made ambiguous by a message holding the separator is asked again commit by commit through the historical
+    metadata read, plus the parent list when `read_parents` asks for it; without it the parents of that fallback stay
+    empty, and the caller must not read them. A failure of Git is never retried.
+    """
+    for oid in oids:
+        validate_oid(oid)
+    output = yield GitCommand(["show", "--no-patch", "--format=" + REPLAY_SOURCE_FORMAT, *oids, "--"], profile=READ_PROFILE)
+    try:
+        return parse_replay_source_records(output, oids)
+    except ReplayRecordAmbiguity:
+        record_by_oid = {}
+        for oid in oids:
+            fields = yield from read_commit_metadata(oid)
+            parent_oids = ()
+            if read_parents:
+                parent_output = yield GitCommand(["show", "--no-patch", "--format=%P", oid, "--"])
+                if not parent_output.endswith(COMMIT_TERMINATOR):
+                    raise ValueError("Git could not read complete metadata for the selected commit") from None
+                parent_oids = _decode_parent_oids(parent_output.removesuffix(COMMIT_TERMINATOR))
+            record_by_oid[oid] = ReplaySourceRecord(tuple(fields), parent_oids)
+        return record_by_oid
+
+
+@dataclass(frozen=True)
+class ReplayParent:
+    """Identify a parent by its native position and full commit identity."""
+
+    number: int
+    oid: str
+    subject: str
+    author: str
+    commit_date: str
+
+
+@dataclass(frozen=True)
+class ReplaySource:
+    """Bind displayed metadata and ordered parents to one resolved source."""
+
+    oid: str
+    fields: tuple[str, ...]
+    parents: tuple[ReplayParent, ...]
+
+
+@dataclass(frozen=True)
+class ReplayIntent:
+    """Keep the selected source distinct from the checkout receiving its changes."""
+
+    operation: OperationIntent
+    kind: ReplayKind
+    source_oid: str
+    original_head_oid: str | None
+    original_symbolic_ref: str | None
+    create_commit: bool = True
+    add_reference: bool = False
+    mainline_parent_number: int | None = None
+    mainline_parent_oid: str | None = None
+
+
+@dataclass
+class NativeCommandRun:
+    """What became of the one native command an operation hands to Git: whether it started, how it ended and why it failed."""
+
+    started: bool = False
+    process_status: ProcessStatus | None = None
+    return_code: int | None = None
+    diagnostic: PreparedDiagnostic | None = None
+
+    def record_failure(self, operation: OperationIntent, error: GitCommandError | ValueError | OSError) -> None:
+        """Keep Git's own diagnostic of a failed command, or turn a refusal before Git into the first diagnostic of this run."""
+        if isinstance(error, GitCommandError):
+            self.diagnostic, self.process_status, self.return_code = error.diagnostic, error.process_status, error.return_code
+            return
+        if self.diagnostic is None:
+            self.diagnostic = Diagnostic(operation.operation, operation.context.repository_dir, operation.git_filename, [], str(error)).prepare()
+
+
+def commit_chain_from(output: bytes, base_oid: str, head_oid: str) -> bool:
+    """Tell whether a "rev-list --parents --reverse base..HEAD" listing is one line of new commits on `base_oid` ending at `head_oid`.
+
+    Each commit must have exactly one parent, the commit listed before it, the first one standing on `base_oid`.
+    """
+    parent_oid = base_oid
+    for line in output.decode("ascii").splitlines():
+        fields = line.split()
+        if len(fields) != CHAIN_COMMIT_FIELD_COUNT or fields[CHAIN_PARENT_POSITION] != parent_oid:
+            return False
+        parent_oid = fields[RECORD_OID_POSITION]
+    return parent_oid == head_oid and parent_oid != base_oid
+
+
+def empty_result_effect(kind: ReplayKind, changes: bytes) -> str:
+    """Name why a replay that brings nothing created no commit: an empty source, a Revert without effect, or changes already present.
+
+    `changes` is the listing of what the source changes against the parent it is replayed from; an empty listing is
+    an empty source whatever the operation. The answer is the word the step writes in its free-text effect.
+    """
+    if not changes:
+        return ReplayEffect.INITIALLY_EMPTY.value
+    if kind == ReplayKind.REVERT:
+        return ReplayEffect.REVERT_NO_EFFECT.value
+    return ReplayEffect.ALREADY_PRESENT.value
+
+
+def pause_origin(state: ReplaySnapshot) -> tuple[str | None, str | None]:
+    """Name the HEAD and the branch Git's Abort brings a pause back to.
+
+    A pause GitPane launched keeps the checkout of its launch; a series keeps its starting HEAD in Git's sequencer; a
+    single instruction never moves HEAD while it waits, so its current HEAD is its origin.
+    """
+    if state.launch is not None:
+        return state.launch.original_head_oid, state.launch.original_symbolic_ref
+    if state.identity is not None and state.identity.original_oid:
+        return state.identity.original_oid, state.symbolic_ref
+    return state.head_oid, state.symbolic_ref
+
+
+def continue_message(state: ReplaySnapshot, metadata: ReplayMetadata, comment_output: bytes) -> str:
+    """Prepare the message Git's Continue commits: Git's conflict notes removed, every authored line kept, the reference added when asked.
+
+    The comment character is the one the configuration sets last. When Git picks it per message and this message holds
+    no conflict notes any more (a Continue tried before already removed them), nothing is left to remove with it.
+    """
+    message = metadata.content_by_basename.get(MERGE_MESSAGE_BASENAME, "")
+    comment_prefix = DEFAULT_COMMENT_PREFIX
+    for line in comment_output.decode("utf-8").splitlines():
+        _name, _separator, comment_prefix = line.partition(" ")
+    if comment_prefix == AUTOMATIC_COMMENT_PREFIX and " Conflicts:\n" not in message:
+        comment_prefix = DEFAULT_COMMENT_PREFIX
+    launch = state.launch
+    source_oid = launch.source_oid if launch is not None else next(iter(state.instruction_oids))
+    add_reference = launch is not None and launch.add_reference and state.kind == ReplayKind.CHERRY_PICK
+    message = native_replay_message(message, source_oid, add_reference, comment_prefix)
+    if not message.strip():
+        raise ValueError("The prepared commit message is empty. Write it before continuing.")
+    return message
+
+
+def publish_continue_message(context: RepositoryContext, baseline: WriteLaunchSignature, metadata: ReplayMetadata, message: str) -> WriteLaunchSignature:
+    """Write the prepared message over Git's MERGE_MSG, then take the look the Continue is compared with when it launches.
+
+    Runs on the file worker. Between the first look and the new one, only that message may differ: the references,
+    the index and every other pause file must be exactly as the checks found them.
+    """
+    publish_replay_message(context, metadata, message, lambda: verify_launch_signature(baseline.metadata, PAUSE_CHANGED_CAUSE))
+    pause_filenames, pause_dirs = native_pause_paths(context)
+    prepared = capture_write_launch_signature(context, PAUSE_CHANGED_CAUSE, reference_signature, reference_signature_paths, baseline.index_filename,
+                                              baseline.index_content, extra_filenames=pause_filenames, extra_watched_dirs=pause_dirs)
+    message_filename = os.path.join(context.git_dir, MERGE_MESSAGE_BASENAME)
+    for filename in changed_launch_paths(baseline.metadata, prepared.metadata):
+        if filename != message_filename:
+            raise ValueError(PAUSE_CHANGED_CAUSE)
+    if prepared.reference_state != baseline.reference_state:
+        raise ValueError(PAUSE_CHANGED_CAUSE)
+    return prepared
+
+
+class ReplayService(QObject):
+    """Run Cherry-pick and Revert on Git's own commands and share one observation of their pause per worktree."""
+
+    changed = Signal(object)
+
+    def __init__(self, worktree_service: WorktreeService, parent: QObject | None = None, *, repository_operation: RepositoryOperationService | None = None) -> None:
+        """Inject the shared scheduler so file reads drain with existing Git work."""
+        super().__init__(parent)
+        self.worktree_service = worktree_service
+        self.state_by_key: dict[WorktreeKey, ReplaySnapshot] = {}
+        self.generation_by_key: dict[WorktreeKey, int] = {}
+        # Each caller keeps the queue priority it asked with, so a shared read waits at the level of its most urgent caller.
+        self.observers_by_key: dict[WorktreeKey, list[tuple[Callable[[], bool], Callable[[ReplaySnapshot], None], ProcessPriority]]] = {}
+        # A caller waiting for the read after the running one, with the generation known when it asked.
+        self.waiting_observers_by_key: dict[WorktreeKey, list[tuple[int, Callable[[], bool], Callable[[ReplaySnapshot], None], ProcessPriority]]] = {}
+        # The generation of the last state an operation published for each worktree, as opposed to a state a read published.
+        self.published_generation_by_key: dict[WorktreeKey, int] = {}
+        self.closed = False
+        self.repository_operation = repository_operation
+        self.outcome_by_id: dict[str, OperationOutcome] = {}
+        self.submitted_id_set: set[str] = set()
+        # The pause GitPane launched in each worktree during this run, kept in memory only and dropped once an
+        # operation or a read finds no pause left. A restart forgets it: the pause is then read as an external one.
+        self.launch_by_key: dict[WorktreeKey, ReplayLaunch] = {}
+        # What each Git executable this service launched has proven about a source named twice to rev-list --no-walk:
+        # True when it keeps one instruction, False when it keeps two. A capability of Git, never a fact of a repository.
+        self.no_walk_support_by_executable: dict[tuple, bool] = {}
+
+    def read_source(self, context: RepositoryContext, git_filename: str, revision: str, *, callback: Callable[[ReplaySource | None, Exception | None], None],
+                    resolved: bool = False) -> None:
+        """Resolve a local revision and read its real parents without changing HEAD.
+
+        `resolved` says `revision` is the full object ID of a commit a successful preparation has just resolved and
+        checked, so it is not resolved again; any revision typed or chosen by the user keeps the default and is resolved.
+        """
+        self.worktree_service.run(context, git_filename, self._read_source(revision, resolved=resolved), callback)
+
+    def _read_source(self, revision: str, *, resolved: bool = False) -> Generator:
+        """Read the source and all its parents in two shows, building the parents in the source's own parent order.
+
+        The metadata of a parent named twice is asked once, while the list and numbering of the parents stay those of
+        the source. A root source asks nothing for its parents.
+        """
+        if resolved:
+            oid = validate_oid(revision)
+        else:
+            resolved_output = yield GitCommand(["rev-parse", "--verify", "--end-of-options", revision + "^{commit}"])
+            oid = validate_oid(resolved_output.decode().strip())
+        source = (yield from read_replay_source_records([oid]))[oid]
+        requested_oids = []
+        for parent_oid in source.parent_oids:
+            if parent_oid not in requested_oids:
+                requested_oids.append(parent_oid)
+        parent_record_by_oid = (yield from read_replay_source_records(requested_oids, read_parents=False)) if requested_oids else {}
+        parents = []
+        for number, parent_oid in enumerate(source.parent_oids, start=FIRST_PARENT_NUMBER):
+            actual_oid, author, _author_date, _committer, commit_date, message = parent_record_by_oid[parent_oid].fields
+            subject, _separator, _body = message.partition("\n")
+            parents.append(ReplayParent(number, actual_oid, subject, author, commit_date))
+        return ReplaySource(oid, source.fields, tuple(parents))
+
+    def prepare(self, intent: ReplayIntent, *, is_current: Callable[[], bool], callback: Callable[[ReplayIntent | None, Exception | None], None]) -> None:
+        """Resolve the source and inspect destination identity without mutating Git."""
+        self.worktree_service.run(intent.operation.context, intent.operation.git_filename, self._validate_intent(intent, is_current), callback)
+
+    def _check_start_request(self, intent: ReplayIntent, is_current: Callable[[], bool]) -> None:
+        """Refuse a launch request that no longer has a live service, a checkout, a known HEAD, a caller or a valid source."""
+        operation = intent.operation
+        if self.closed or operation.context.is_bare or not intent.original_head_oid or not is_current():
+            raise ValueError("The destination checkout is unavailable or changed. Refresh before applying a commit.")
+        if not intent.kind.is_replay or operation.action != OperationAction.REPLAY_START:
+            raise ValueError("This commit operation is unavailable.")
+        validate_oid(intent.source_oid)
+
+    def _validate_intent(self, intent: ReplayIntent, is_current: Callable[[], bool]) -> Generator:
+        """Refuse changed checkout identity and incompatible native operations before the form is confirmed."""
+        operation = intent.operation
+        self._check_start_request(intent, is_current)
+        # The first grouped read of the capture also resolves the source and the Git directory, and refuses the launch
+        # when either is not exactly the one this intent names.
+        state = yield from capture_replay(operation.context, operation.generation, source_oid=intent.source_oid, verify_git_dir=True)
+        if not state.fresh or state.kind != ReplayKind.ABSENT:
+            raise ValueError("A native commit operation already exists or cannot be read. Refresh its state.")
+        if state.head_oid != intent.original_head_oid or state.symbolic_ref != intent.original_symbolic_ref or not is_current():
+            raise ValueError("HEAD or its branch changed. Refresh before applying a commit.")
+        return intent
+
+    def _verify_no_walk(self, context: RepositoryContext, git_filename: str, source_oid: str) -> Generator:
+        """Prove, once per Git executable, that a source named twice gives one instruction, and answer that executable's identity.
+
+        A launch without a commit names its source twice so that Git keeps one abortable instruction, which holds only
+        when rev-list deduplicates the two. The answer is kept for exactly the executable identity found before and
+        after the probe; a failed, interrupted or unreadable probe proves nothing and is not kept. An executable known
+        to keep both instructions is refused without asking again. The caller compares the identity again at launch.
+        """
+        signature = yield FileTask(lambda: replay_executable_signature(git_filename))
+        supported = self.no_walk_support_by_executable.get(signature)
+        if supported is None:
+            validate_oid(source_oid)
+            output = yield GitCommand(["rev-list", "--no-walk=unsorted", source_oid, source_oid, "--"])
+            after = yield FileTask(lambda: replay_executable_signature(git_filename))
+            if after != signature:
+                raise ValueError("The Git executable changed while it was checked. Refresh before applying a commit.")
+            if not output.endswith(COMMIT_TERMINATOR):
+                raise ValueError("Git gave back an incomplete instruction list.")
+            answers = output.removesuffix(COMMIT_TERMINATOR).decode("ascii").split("\n")
+            if answers == [source_oid]:
+                supported = True
+            elif answers == [source_oid, source_oid]:
+                supported = False
+            else:
+                raise ValueError("Git gave back an unexpected instruction list.")
+            self.no_walk_support_by_executable[signature] = supported
+        if not supported:
+            raise ValueError("This Git version cannot safely select one replay instruction.")
+        return signature
+
+    def _validate_launch_authority(self, operation: OperationIntent, is_current: Callable[[], bool], *, session_policy: bool = True) -> None:
+        """Refuse a launch whose replay service, write owner, exact reservation or caller is no longer current.
+
+        Called on the Qt thread, both before a launch preparation leaves for the file worker and in the launch check.
+        With session_policy the application's permission for this action is asked again. The paths that compare their
+        own native state on purpose (a Skip or the end without a commit after a launch, the steps after a prepared message) do
+        not ask it: the native state captured with their authority predates the pause or message GitPane itself wrote.
+        """
+        owner = self.repository_operation
+        if self.closed or owner is None or owner.closed or owner.active_by_id.get(operation.operation_id) is not operation:
+            raise ValueError("This replay no longer owns the repository. Refresh before trying again.")
+        if not is_current():
+            raise ValueError("The caller changed before launch. Refresh first.")
+        if session_policy and owner.allows is not None and not owner.allows(operation):
+            raise ValueError("This action is no longer authorized. Refresh before writing.")
+
+    def _policy_launch_signature(self, operation: OperationIntent) -> LaunchSignature:
+        """Freeze the native pause files the write policy reads, in this worktree and in every related one.
+
+        It is taken before the policy check on the Qt thread, never after: a signature taken once the policy has run
+        could already describe a state that policy never saw. Only metadata is read. The launch check compares it again,
+        without the paths the launch signature itself covers, so a pause started in another worktree while the command
+        waited in the queue is still refused.
+        """
+        context_by_key = {}
+        for context in (operation.context, *operation.reserved_contexts, *self.repository_operation.context_by_key.values()):
+            context_by_key[WorktreeKey.from_context(context)] = context
+        filenames = []
+        watched_dirs = []
+        for context in context_by_key.values():
+            if context.is_bare:
+                continue
+            pause_filenames, pause_dirs = native_pause_paths(context)
+            filenames.extend(pause_filenames)
+            watched_dirs.extend(pause_dirs)
+        return sign_launch_paths(filenames, watched_dirs, ())
+
+    def start(self, intent: ReplayIntent, *, is_current: Callable[[], bool]) -> str:
+        """Submit one captured operation once, retaining ownership until observation finishes."""
+        if self.repository_operation is None or self.closed:
+            raise ValueError("The commit operation service is unavailable.")
+        operation_id = intent.operation.operation_id
+        if operation_id in self.submitted_id_set:
+            return operation_id
+        self.submitted_id_set.add(operation_id)
+        return self.repository_operation.submit(intent.operation, self._start(intent, is_current))
+
+    def _start(self, intent: ReplayIntent, is_current: Callable[[], bool]) -> Generator:
+        """Apply one commit with Git's own cherry-pick or revert, the way a terminal does, and publish what Git left.
+
+        Only quick checks run before Git: HEAD, its branch and the index unchanged since the form was confirmed, no
+        native operation and no conflict in progress, nothing staged, and no changed path outside the working tree or
+        inside its .git folder. Git runs with submodule recursion turned off, so a change that only moves, adds or
+        removes a submodule entry never writes in the submodule's folder. A change that removes that folder or writes
+        into it (a submodule turned into a file, a link or a folder of files, or the reverse through a Revert) is only
+        let through when nothing in the folder, nested submodules included, would be lost; otherwise it is refused and
+        the files at stake are named. Git's answer is
+        then read once and ended the way the form asked: a new commit on the original HEAD, a pause Git keeps for the
+        user, a result that brings nothing (ended without a commit, with its reason), changes left unstaged when no
+        commit was asked for, or a refusal that wrote nothing. Going back from a pause is left to Git's own Abort.
+        """
+        # No file of the working tree is signed, listed or copied here. Git itself refuses to overwrite a local change
+        # the commit would touch, and then stops before writing anything. Its rename detection may carry a change onto
+        # a renamed path: that is still Git's own result, on a path it found inside the working tree, never outside it
+        # or inside .git, so it is left to Git and not checked again afterwards.
+        operation = intent.operation
+        context = operation.context
+        run = NativeCommandRun()
+        state = None
+        status, effect = OperationStatus.REFUSED, OperationStatus.REFUSED.value
+        changes = b""
+        index_filename = os.path.join(context.git_dir, LIVE_INDEX_BASENAME)
+        pause_filenames, pause_dirs = native_pause_paths(context)
+        try:
+            self._check_start_request(intent, is_current)
+            changed_cause = "HEAD, the index or a native operation changed before launch. Refresh before applying a commit."
+            # The index is read on the same worker that signs it, so the signature describes exactly the bytes kept here.
+            baseline = yield FileTask(lambda: capture_write_launch_signature(context, changed_cause, reference_signature, reference_signature_paths, index_filename,
+                                                                            read_index(index_filename), extra_filenames=pause_filenames, extra_watched_dirs=pause_dirs))
+            before = yield from capture_replay(context, operation.generation, source_oid=intent.source_oid, verify_git_dir=True)
+            if before.unmerged_paths:
+                raise ValueError("The index has unresolved conflicts. Resolve them before applying a commit.")
+            if not before.fresh or before.kind != ReplayKind.ABSENT:
+                raise ValueError("A native commit operation already exists or cannot be read. Refresh its state.")
+            if before.head_oid != intent.original_head_oid or before.symbolic_ref != intent.original_symbolic_ref or not is_current():
+                raise ValueError("HEAD or its branch changed. Refresh before applying a commit.")
+            # Without rename detection both sides of a staged rename are named, and a staged deletion is never hidden behind one.
+            parent_output, staged, index_entries = yield ReadBatch((GitCommand(["show", "--no-patch", "--format=%P", intent.source_oid, "--"]),
+                                                                   GitCommand(["diff", "--cached", "--name-only", "--no-renames", "-z", "HEAD", "--"]),
+                                                                   GitCommand(["ls-files", "--stage", "-z"])))
+            compared_oid = self._validated_compared_parent(intent, parent_output)
+            if staged:
+                raise ValueError("The index contains staged changes. Commit or unstage them before applying a commit.")
+            # The two options make Git compare the objects itself, so no diff program or text converter of the user runs.
+            if compared_oid is None:
+                changes = yield GitCommand(["diff-tree", "-r", "-z", "--root", "--no-commit-id", "--no-renames", "--no-ext-diff", "--no-textconv", intent.source_oid, "--"])
+            else:
+                changes = yield GitCommand(["diff-tree", "-r", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", compared_oid, intent.source_oid, "--"])
+            refusal = replay_change_refusal(changes)
+            if refusal:
+                raise ValueError(refusal)
+            # The submodules are read from the current index rather than from the replayed commit, so a folder that
+            # replaces a submodule on this branch only is found too.
+            replaced_paths = replaced_submodule_paths(changes, gitlink_paths(index_entries))
+            executable_signature = None
+            if not intent.create_commit:
+                # Only the launch that names its source twice relies on Git keeping one instruction for it.
+                executable_signature = yield from self._verify_no_walk(context, operation.git_filename, intent.source_oid)
+            # Checked as late as a Git read can run, just before the launch checks that happen on the Qt thread.
+            for submodule_path in replaced_paths:
+                loss = yield from submodule_loss_refusal(context, submodule_path)
+                if loss:
+                    raise ValueError(loss)
+            signature = yield FileTask(lambda: prepare_write_launch_signature(context, baseline, changed_cause, reference_signature))
+            # The policy reads native files on the Qt thread; the signature taken just before it lets the launch check
+            # prove those files, in every related worktree, still describe the state the policy accepted.
+            policy = self._policy_launch_signature(operation)
+            self.repository_operation.validate(operation)
+            self._validate_launch_authority(operation, is_current)
+            related_policy = exclude_covered_launch_paths(policy, signature.metadata)
+
+            def validate_launch() -> None:
+                """Compare only current authority, the metadata of the checked Git files and related pauses, and the Git executable, when the queued command launches."""
+                self._validate_launch_authority(operation, is_current)
+                verify_launch_signature(related_policy, changed_cause)
+                verify_launch_signature(signature.metadata, changed_cause)
+                if executable_signature is not None and replay_executable_signature(operation.git_filename) != executable_signature:
+                    raise ValueError("The Git executable changed before launch. Refresh before applying a commit.")
+                run.started = True
+
+            arguments = [*SUBMODULE_RECURSION_OFF_ARGUMENTS, intent.kind.value]
+            if not intent.create_commit:
+                arguments.append("--no-commit")
+            arguments.append("--no-edit")
+            if intent.create_commit and intent.add_reference and intent.kind == ReplayKind.CHERRY_PICK:
+                arguments.append("-x")
+            if intent.mainline_parent_number is not None:
+                arguments.extend(["-m", str(intent.mainline_parent_number)])
+            arguments.append(intent.source_oid)
+            if not intent.create_commit:
+                # Named once, a replay without a commit leaves Git no operation its own Abort can end. Named twice, Git
+                # keeps the one instruction the two names give in its sequencer, which Abort ends like any series.
+                arguments.append(intent.source_oid)
+            yield GitCommand(arguments, profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                             before_start=validate_launch, suppress_editor=True)
+            run.process_status, run.return_code = ProcessStatus.SUCCESS, SUCCESS_EXIT_CODE
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+        try:
+            after_look = None
+            if run.started:
+                # The look is taken before the reading of what Git left, so a step that ends that result compares the
+                # very state this reading accepted.
+                after_look = yield FileTask(lambda: capture_write_launch_signature(context, PAUSE_CHANGED_CAUSE, reference_signature, reference_signature_paths,
+                                                                                  index_filename, read_index(index_filename), extra_filenames=pause_filenames,
+                                                                                  extra_watched_dirs=pause_dirs))
+            state = yield from capture_replay(context, operation.generation, lone_message_is_trace=run.started)
+            if run.started:
+                state, status, effect, run = yield from self._launch_result(intent, after_look, state, run, changes, is_current)
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN if run.started else OperationStatus.REFUSED
+            run.record_failure(operation, error)
+            state = unreadable_replay_state(state or ReplaySnapshot(operation.key, operation.generation), run.diagnostic.cause)
+        if status in (OperationStatus.SUCCESS, OperationStatus.PAUSED) and (status == OperationStatus.SUCCESS or state.unmerged_paths and run.return_code == GIT_CONFLICT_RETURN_CODE):
+            # A conflict is an expected stop that waits for the user, not a failure: Git's exit status and its message
+            # are already in the console, so no failure cause is attached to the pause.
+            run.diagnostic = None
+        elif run.started and run.diagnostic is None:
+            run.diagnostic = Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [],
+                                        "Git finished without a verified new commit. Refresh to inspect the current checkout.").prepare()
+        state = self._publish_result(state)
+        step = OperationStepResult(operation.operation, status, intent, state, run.process_status, effect, run.diagnostic, run.return_code)
+        outcome = OperationOutcome(operation.operation_id, status, (step,), run.diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _validated_compared_parent(self, intent: ReplayIntent, parent_output: bytes) -> str | None:
+        """Check the parent choice of the form against the real parents of the source, and name the parent its changes are read against.
+
+        A merge needs the parent the form selected, still at the same place; any other source must not name one. The
+        answer is None for a source without parent, whose changes are read against the empty tree.
+        """
+        parent_oids = []
+        for parent_oid in parent_output.decode("ascii").split():
+            parent_oids.append(validate_oid(parent_oid))
+        if len(parent_oids) >= MERGE_PARENT_MINIMUM:
+            parent_number = intent.mainline_parent_number
+            if parent_number is None or not FIRST_PARENT_NUMBER <= parent_number <= len(parent_oids):
+                raise ValueError("Select a parent of this merge before applying it.")
+            parent_index = parent_number - FIRST_PARENT_NUMBER
+            if parent_oids[parent_index] != intent.mainline_parent_oid:
+                raise ValueError("The selected merge parent changed. Select its current parent again.")
+            return parent_oids[parent_index]
+        if intent.mainline_parent_number is not None or intent.mainline_parent_oid is not None:
+            raise ValueError("This source is not a merge and cannot use a mainline parent.")
+        return next(iter(parent_oids), None)
+
+    def _launch_result(self, intent: ReplayIntent, after_look: WriteLaunchSignature, state: ReplaySnapshot, run: NativeCommandRun, changes: bytes,
+                       is_current: Callable[[], bool]) -> Generator:
+        """Read what Git left after a launch and end what GitPane ends itself; answer the state, the status, the effect and the last run.
+
+        A new commit whose only parent is the original HEAD, on the same branch, is a success. A pause Git keeps on a
+        conflict is remembered as GitPane's own for this run of the program and waits for the user. A commit that
+        would bring nothing ends without one: Git's own Skip when Git keeps its pause, its Quit when it kept only its
+        message, then the reason. A launch without a commit ends with its changes unstaged. A failure that left HEAD
+        and the branch where they were is Git's own refusal. Anything else is unknown.
+        """
+        operation = intent.operation
+        if state.fresh and state.kind != ReplayKind.ABSENT:
+            self.launch_by_key[state.key] = ReplayLaunch(intent.kind, intent.source_oid, intent.create_commit, intent.add_reference,
+                                                         intent.original_head_oid, intent.original_symbolic_ref)
+        owned = join_replay_launch(state, self.launch_by_key.get(state.key))
+        origin = (intent.original_head_oid, intent.original_symbolic_ref)
+        origin_kept = (state.head_oid, state.symbolic_ref) == origin and not state.unmerged_paths
+        # A cherry-pick without a commit, and a revert with nothing to commit, leave only Git's prepared message behind.
+        message_only = state.kind == ReplayKind.UNKNOWN and state.pending_step == REPLAY_STEP_UNATTRIBUTED_CONFLICT and not state.unmerged_paths
+        own_pause = owned.ownership == ReplayOwnership.OWNED
+        finished = run.process_status == ProcessStatus.SUCCESS and run.return_code == SUCCESS_EXIT_CODE
+        stopped_empty = run.process_status == ProcessStatus.FAILED and run.return_code == GIT_CONFLICT_RETURN_CODE
+        effect_when_empty = empty_result_effect(intent.kind, changes)
+        # Git always leaves its message, and for a Revert its marker, after a replay without a commit; a clean exit
+        # that left no trace at all proves nothing about what was applied.
+        if origin_kept and not intent.create_commit and finished and (own_pause or message_only):
+            return (yield from self._finish_without_commit(operation, after_look, owned, origin, intent.kind, effect_when_empty, is_current, check_policy=False))
+        if origin_kept and intent.create_commit and stopped_empty and (own_pause or message_only):
+            staged = yield GitCommand(["diff", "--cached", "--name-only", "--no-renames", "-z", "HEAD", "--"])
+            if not staged and own_pause:
+                return (yield from self._skip(operation, after_look, owned, effect_when_empty, is_current, check_policy=False))
+            if not staged:
+                return (yield from self._finish_without_commit(operation, after_look, owned, origin, intent.kind, effect_when_empty, is_current, check_policy=False))
+        if not state.fresh:
+            return state, OperationStatus.UNKNOWN, "unknown", run
+        if state.kind != ReplayKind.ABSENT:
+            return state, operation_status(run.process_status) if run.process_status in STOPPED_PROCESS_STATUSES else OperationStatus.PAUSED, "unknown", run
+        if state.unmerged_paths or state.symbolic_ref != intent.original_symbolic_ref:
+            return state, OperationStatus.UNKNOWN, "unknown", run
+        if finished and state.head_oid and state.head_oid != intent.original_head_oid:
+            parent_output = yield GitCommand(["show", "--no-patch", "--format=%P", state.head_oid, "--"])
+            if parent_output.split() == [intent.original_head_oid.encode("ascii")]:
+                return state, OperationStatus.SUCCESS, "changed", run
+            return state, OperationStatus.UNKNOWN, "unknown", run
+        if run.process_status == ProcessStatus.FAILED and state.head_oid == intent.original_head_oid:
+            return state, OperationStatus.FAILED, "unknown", run
+        return state, OperationStatus.UNKNOWN, "unknown", run
+
+    def _skip(self, operation: OperationIntent, baseline: WriteLaunchSignature, paused: ReplaySnapshot, effect: str, is_current: Callable[[], bool], *,
+              check_policy: bool) -> Generator:
+        """End a checked pause whose instruction brings nothing with Git's own Skip; answer the state, the status, the effect and the run.
+
+        The Skip succeeds once no pause is left on the same HEAD and branch, without a new commit. When the pause is
+        one instruction of a longer series, Git goes on with the next ones as it does in a terminal, and the result is
+        read the way a Continue's is.
+        """
+        run = NativeCommandRun()
+        try:
+            yield from self._launch_pause_command(operation, baseline, [paused.kind.value, "--skip"], is_current, run, check_policy=check_policy)
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+        after = yield from self._read_after(operation, paused, run)
+        if not run.started:
+            return after, OperationStatus.UNKNOWN, "unknown", run
+        if (run.process_status == ProcessStatus.SUCCESS and after.fresh and after.kind == ReplayKind.ABSENT and not after.unmerged_paths
+                and (after.head_oid, after.symbolic_ref) == (paused.head_oid, paused.symbolic_ref)):
+            return after, OperationStatus.SUCCESS, effect, run
+        status = yield from self._continue_status(paused, after, run)
+        return after, status, status.value, run
+
+    def _finish_without_commit(self, operation: OperationIntent, baseline: WriteLaunchSignature, state: ReplaySnapshot, origin: tuple[str | None, str | None],
+                               kind: ReplayKind, effect_when_empty: str, is_current: Callable[[], bool], *, check_policy: bool) -> Generator:
+        """End a replay without a commit: Git's own Quit when a pause or its message is left, then the index set back to HEAD.
+
+        The index held exactly HEAD when the replay was launched, since a staged change refuses the launch, so setting
+        it back to HEAD leaves the replay's changes in the working tree only, as Unstaged changes; a staged change made
+        during the pause is unstaged with them, and nothing is written in a working file. A moved submodule pointer is
+        the exception: it stays staged, the only form it has. The reset starts only when something is staged, and is
+        compared with a look taken after the Quit. Answers the state, the status, the effect ("changed", or
+        `effect_when_empty` when the replay brought nothing) and the run.
+        """
+        context = operation.context
+        run = NativeCommandRun()
+        # What may be left is Git's pause of this very kind, its prepared message alone, or nothing at all.
+        message_only = state.kind == ReplayKind.UNKNOWN and state.pending_step == REPLAY_STEP_UNATTRIBUTED_CONFLICT
+        if not is_current() or state.unmerged_paths or (state.head_oid, state.symbolic_ref) != origin or state.kind not in (ReplayKind.ABSENT, kind) and not message_only:
+            run.record_failure(operation, ValueError(PAUSE_CHANGED_CAUSE))
+            return state, OperationStatus.UNKNOWN, "unknown", run
+        index_filename = baseline.index_filename
+        try:
+            if state.kind != ReplayKind.ABSENT:
+                yield from self._launch_pause_command(operation, baseline, [kind.value, "--quit"], is_current, run, check_policy=check_policy)
+            staged = yield GitCommand(["diff", "--cached", "--raw", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", "HEAD", "--"])
+            if staged:
+                # A submodule pointer has no unstaged form while the submodule is not checked out on the new commit,
+                # which GitPane never does: setting it back to HEAD would lose it without a trace. So the reset keeps
+                # every staged submodule entry out and sets only the rest back to HEAD.
+                reset_arguments = reset_keeping_gitlinks_arguments(staged_gitlink_paths(staged))
+                pause_filenames, pause_dirs = native_pause_paths(context)
+                reset_look = yield FileTask(lambda: capture_write_launch_signature(context, PAUSE_CHANGED_CAUSE, reference_signature, reference_signature_paths,
+                                                                                  index_filename, read_index(index_filename), extra_filenames=pause_filenames,
+                                                                                  extra_watched_dirs=pause_dirs))
+                if reset_look.reference_state != baseline.reference_state or reset_look.index_content != baseline.index_content:
+                    raise ValueError(PAUSE_CHANGED_CAUSE)
+                # The Quit changed Git's pause files and nothing else, so the reset is compared with the look taken after it.
+                yield from self._launch_pause_command(operation, reset_look, reset_arguments, is_current, run, check_policy=False)
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+            after = yield from self._read_after(operation, state, run)
+            return after, OperationStatus.UNKNOWN, "unknown", run
+        after = yield from self._read_after(operation, state, run)
+        if after.fresh and after.kind == ReplayKind.ABSENT and not after.unmerged_paths and (after.head_oid, after.symbolic_ref) == origin:
+            return after, OperationStatus.SUCCESS, "changed" if staged else effect_when_empty, run
+        run.record_failure(operation, ValueError("The operation without a commit did not end on the checkout it started from. Inspect the current state."))
+        return after, OperationStatus.UNKNOWN, "unknown", run
+
+    def _read_after(self, operation: OperationIntent, fallback: ReplaySnapshot, run: NativeCommandRun) -> Generator:
+        """Read what a native command left, or answer the last known state marked unreadable when Git cannot answer that read."""
+        try:
+            return (yield from capture_replay(operation.context, operation.generation))
+        except GitCommandError as error:
+            run.record_failure(operation, error)
+            return unreadable_replay_state(fallback, error.diagnostic.cause)
+
+    def continue_replay(self, operation: OperationIntent, state: ReplaySnapshot, *, is_current: Callable[[], bool]) -> str:
+        """Reserve one explicit Continue of the pause the user acted on, which Git's own Continue then ends."""
+        if self.repository_operation is None or self.closed:
+            raise ValueError("The commit operation service is unavailable.")
+        if operation.operation_id in self.submitted_id_set:
+            return operation.operation_id
+        self.submitted_id_set.add(operation.operation_id)
+        return self.repository_operation.submit(operation, self._continue(operation, state, is_current))
+
+    def abort(self, operation: OperationIntent, state: ReplaySnapshot, *, is_current: Callable[[], bool]) -> str:
+        """Reserve one explicit Abort of the pause the user acted on, which Git's own Abort then ends."""
+        if self.repository_operation is None or self.closed:
+            raise ValueError("The commit operation service is unavailable.")
+        if operation.operation_id in self.submitted_id_set:
+            return operation.operation_id
+        self.submitted_id_set.add(operation.operation_id)
+        return self.repository_operation.submit(operation, self._abort(operation, state, is_current))
+
+    def _same_pause(self, operation: OperationIntent, previous: ReplaySnapshot, is_current: Callable[[], bool]) -> Generator:
+        """Take the first look a command on a pause relies on, then read the pause once and require it to be the one the user acted on.
+
+        The look covers the references, the index and Git's pause files of this worktree. The read must show a fresh
+        Cherry-pick or Revert with the same native identity, HEAD, branch, owner and commit mode. Answers the look and
+        the state read.
+        """
+        context = operation.context
+        index_filename = os.path.join(context.git_dir, LIVE_INDEX_BASENAME)
+        pause_filenames, pause_dirs = native_pause_paths(context)
+        # The index is read on the same worker that signs it, so the look describes exactly the bytes kept here.
+        baseline = yield FileTask(lambda: capture_write_launch_signature(context, PAUSE_CHANGED_CAUSE, reference_signature, reference_signature_paths, index_filename,
+                                                                        read_index(index_filename), extra_filenames=pause_filenames, extra_watched_dirs=pause_dirs))
+        state = join_replay_launch((yield from capture_replay(context, operation.generation)), self.launch_by_key.get(operation.key))
+        if (not is_current() or previous.key != operation.key or state.key != operation.key or not state.fresh or not state.kind.is_replay
+                or state.identity != previous.identity or state.head_oid != previous.head_oid or state.symbolic_ref != previous.symbolic_ref
+                or state.ownership != previous.ownership or state.mode != previous.mode):
+            raise ValueError(PAUSE_CHANGED_CAUSE)
+        return baseline, state
+
+    def _launch_pause_command(self, operation: OperationIntent, baseline: WriteLaunchSignature, arguments: list[str], is_current: Callable[[], bool],
+                              run: NativeCommandRun, *, check_policy: bool, prepared_message: tuple[ReplayMetadata, str] | None = None) -> Generator:
+        """Hand one native write to the launcher once nothing moved since the first look, with submodule recursion turned off.
+
+        With `check_policy` the write policy is asked on the Qt thread the way a launch asks it, and the pause files of
+        related worktrees are compared again when the command starts. A step that follows GitPane's own command (the
+        Skip or the end without a commit of a launch) compares the pause GitPane itself left, so it skips that policy. A
+        prepared message is written over Git's MERGE_MSG only once the policy accepted the pause as the user saw it;
+        from then on the new message is part of what is compared. `run` records whether Git started and how it ended.
+        """
+        context = operation.context
+        policy = None
+        if check_policy:
+            policy = self._policy_launch_signature(operation)
+            self.repository_operation.validate(operation)
+        self._validate_launch_authority(operation, is_current, session_policy=check_policy)
+        # The policy compares the pause files with the ones captured at the click, so it is not asked again once
+        # GitPane rewrote the message itself.
+        session_policy = check_policy and prepared_message is None
+        if prepared_message is not None:
+            metadata, message = prepared_message
+            baseline = yield FileTask(lambda: publish_continue_message(context, baseline, metadata, message))
+        signature = yield FileTask(lambda: prepare_write_launch_signature(context, baseline, PAUSE_CHANGED_CAUSE, reference_signature))
+        related_policy = exclude_covered_launch_paths(policy, signature.metadata) if policy is not None else None
+        self._validate_launch_authority(operation, is_current, session_policy=session_policy)
+
+        def validate_launch() -> None:
+            """Compare only current authority and the metadata of the checked files and related pauses when the queued command launches."""
+            self._validate_launch_authority(operation, is_current, session_policy=session_policy)
+            if related_policy is not None:
+                verify_launch_signature(related_policy, PAUSE_CHANGED_CAUSE)
+            verify_launch_signature(signature.metadata, PAUSE_CHANGED_CAUSE)
+            run.started = True
+
+        yield GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, *arguments], profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_COMMIT_TIMEOUT_MS, idle_timeout_ms=GIT_COMMIT_TIMEOUT_MS,
+                         before_start=validate_launch, suppress_editor=True)
+        run.process_status, run.return_code = ProcessStatus.SUCCESS, SUCCESS_EXIT_CODE
+
+    def _finish_pause_operation(self, operation: OperationIntent, previous: ReplaySnapshot, state: ReplaySnapshot, status: OperationStatus, effect: str,
+                                run: NativeCommandRun) -> OperationOutcome:
+        """Publish the state an operation on a pause ends with and record its outcome, the diagnostic of a failure shown with that state."""
+        if run.diagnostic is not None:
+            state = replace(state, diagnostic=run.diagnostic.cause)
+        state = self._publish_result(state)
+        step = OperationStepResult(operation.operation, status, previous, state, run.process_status, effect, run.diagnostic, run.return_code)
+        outcome = OperationOutcome(operation.operation_id, status, (step,), run.diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _continue(self, operation: OperationIntent, previous: ReplaySnapshot, is_current: Callable[[], bool]) -> Generator:
+        """End a pause the way the mode chosen at its start asks, with Git's own commands.
+
+        In commit mode Git's own Continue commits the staged resolution with the prepared message and no editor; a
+        resolution that brings nothing is ended by Git's own Skip instead, without a commit. A pause GitPane launched
+        without a commit ends without one, its changes left unstaged. Only quick checks run first: the same pause, HEAD
+        and branch the user acted on, and no conflict left. A staged change unrelated to the replay is not refused: Git
+        commits the whole index, as it does in a terminal. Git's conflict notes leave the message; Git then runs with an
+        unused comment character, so no line the author wrote is taken for a comment.
+        """
+        context = operation.context
+        run = NativeCommandRun()
+        state = previous
+        status, effect = OperationStatus.REFUSED, OperationStatus.REFUSED.value
+        ended = None
+        try:
+            if operation.action != OperationAction.REPLAY_CONTINUE:
+                raise ValueError(PAUSE_CHANGED_CAUSE)
+            baseline, state = yield from self._same_pause(operation, previous, is_current)
+            refusal = replay_action_diagnostic(state, ReplayAction.CONTINUE, abort_available=True)
+            if refusal:
+                raise ValueError(refusal)
+            if state.mode == ReplayCommitMode.NO_COMMIT:
+                ended = yield from self._finish_without_commit(operation, baseline, state, pause_origin(state), state.kind, ReplayEffect.RESOLVED_NO_CHANGE.value, is_current,
+                                                               check_policy=True)
+            else:
+                staged = yield GitCommand(["diff", "--cached", "--name-only", "--no-renames", "-z", "HEAD", "--"])
+                if not staged:
+                    # The resolution brings nothing to this instruction, so Git would need an empty commit: its own Skip
+                    # ends the instruction without one.
+                    ended = yield from self._skip(operation, baseline, state, ReplayEffect.RESOLVED_NO_CHANGE.value, is_current, check_policy=True)
+                else:
+                    metadata = yield FileTask(lambda: read_replay_metadata(context.git_dir))
+                    comment_output = yield GitCommand(["config", "--get-regexp", r"^core\.comment(char|string)$"], accepted_codes=(0, 1))
+                    message = continue_message(state, metadata, comment_output)
+                    arguments = ["-c", "core.commentChar=" + native_message_comment_prefix(message), state.kind.value, "--continue"]
+                    yield from self._launch_pause_command(operation, baseline, arguments, is_current, run, check_policy=True, prepared_message=(metadata, message))
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+        if ended is not None:
+            state, status, effect, run = ended
+            if status == OperationStatus.UNKNOWN and not run.started:
+                # No command was handed to Git, so the pause is exactly as the user left it: the Continue was refused,
+                # whichever step refused it.
+                status, effect = OperationStatus.REFUSED, OperationStatus.REFUSED.value
+            if status not in (OperationStatus.SUCCESS, OperationStatus.REFUSED) and run.diagnostic is None:
+                run.diagnostic = Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [], CONTINUE_UNVERIFIED_CAUSE).prepare()
+            return self._finish_pause_operation(operation, previous, state, status, effect, run)
+        try:
+            after = yield from capture_replay(context, operation.generation)
+            if run.started:
+                status = yield from self._continue_status(previous, after, run)
+                effect = status.value
+            state = after
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN if run.started else OperationStatus.REFUSED
+            run.record_failure(operation, error)
+            state = unreadable_replay_state(state, run.diagnostic.cause)
+        if status not in (OperationStatus.SUCCESS, OperationStatus.REFUSED) and run.diagnostic is None:
+            run.diagnostic = Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [], CONTINUE_UNVERIFIED_CAUSE).prepare()
+        return self._finish_pause_operation(operation, previous, state, status, effect, run)
+
+    def _continue_status(self, previous: ReplaySnapshot, after: ReplaySnapshot, run: NativeCommandRun) -> Generator:
+        """Read what Git's Continue left: new commits standing on the paused HEAD, the next pause of a series, or an uncertain state.
+
+        Success needs Git's exit status 0, no pause left, the same branch and a line of new commits whose first one has
+        the paused HEAD as its only parent.
+        """
+        if not after.fresh:
+            return OperationStatus.UNKNOWN
+        if after.kind != ReplayKind.ABSENT or after.unmerged_paths:
+            return operation_status(run.process_status) if run.process_status in STOPPED_PROCESS_STATUSES else OperationStatus.PAUSED
+        if run.process_status != ProcessStatus.SUCCESS or after.symbolic_ref != previous.symbolic_ref or not after.head_oid or not previous.head_oid:
+            return OperationStatus.UNKNOWN
+        chain = yield GitCommand(["rev-list", "--first-parent", "--parents", "--reverse", previous.head_oid + "..HEAD", "--"])
+        return OperationStatus.SUCCESS if commit_chain_from(chain, previous.head_oid, after.head_oid) else OperationStatus.UNKNOWN
+
+    def _abort(self, operation: OperationIntent, previous: ReplaySnapshot, is_current: Callable[[], bool]) -> Generator:
+        """End a pause with Git's own Abort, which brings back the checkout the operation started from.
+
+        Git itself refuses to overwrite a local change it would lose, and keeps changes it does not need to touch. The
+        result is accepted once no pause is left and HEAD and its branch are back where the operation started; anything
+        else is reported with Git's own diagnostic.
+        """
+        context = operation.context
+        run = NativeCommandRun()
+        state = previous
+        status = OperationStatus.REFUSED
+        try:
+            if operation.action != OperationAction.REPLAY_ABORT:
+                raise ValueError(PAUSE_CHANGED_CAUSE)
+            baseline, state = yield from self._same_pause(operation, previous, is_current)
+            refusal = replay_action_diagnostic(state, ReplayAction.ABORT, abort_available=True)
+            if refusal:
+                raise ValueError(refusal)
+            yield from self._launch_pause_command(operation, baseline, [state.kind.value, "--abort"], is_current, run, check_policy=True)
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+        try:
+            after = yield from capture_replay(context, operation.generation)
+            if run.started:
+                origin_oid, origin_ref = pause_origin(state)
+                restored = after.fresh and after.kind == ReplayKind.ABSENT and not after.unmerged_paths and after.head_oid == origin_oid and after.symbolic_ref == origin_ref
+                status = OperationStatus.ABORTED if restored and run.process_status == ProcessStatus.SUCCESS else OperationStatus.UNKNOWN
+            state = after
+        except (GitCommandError, ValueError, OSError) as error:
+            status = OperationStatus.UNKNOWN if run.started else OperationStatus.REFUSED
+            run.record_failure(operation, error)
+            state = unreadable_replay_state(state, run.diagnostic.cause)
+        if status == OperationStatus.UNKNOWN and run.diagnostic is None:
+            run.diagnostic = Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [], ABORT_UNVERIFIED_CAUSE).prepare()
+        return self._finish_pause_operation(operation, previous, state, status, status.value, run)
+
+    def retire_legacy_anchors(self, context: RepositoryContext, git_filename: str, *, is_current: Callable[[], bool], callback: Callable[[tuple[str, ...]], None],
+                              session_id: str | None = None, generation: int = 0) -> None:
+        """Remove, in the background, the anchor references earlier versions left in this repository, and tell which of their backups stay.
+
+        The folder of earlier journals is read first on the file worker; when it holds no working tree subfolder,
+        nothing else runs. Otherwise the anchors are listed once, and the ones legacy_anchor_deletions chooses are
+        removed by one reserved write, refused while a Cherry-pick or Revert is in progress. No file of that folder is
+        ever changed. `callback` is called once, after everything ended, with the journal folders an earlier version
+        left in the middle of a restoration whose anchor this repository still holds, wherever the repository was when
+        they were written. A failure removes nothing and is written to the process log only.
+        """
+        answered = []
+
+        def answer(kept_dirs: tuple[str, ...]) -> None:
+            """Call the caller back once, whichever path ends the retirement first."""
+            if answered:
+                return
+            answered.append(True)
+            callback(kept_dirs)
+
+        if self.closed or context.is_bare:
+            answer(())
+            return
+        store_dir = replay_legacy.legacy_replay_store_dir()
+
+        def found(result: tuple[tuple[tuple[str, str], ...], tuple[str, ...]] | None, error: Exception | None) -> None:
+            """Submit the removal of the chosen anchors, or answer at once when there is nothing to remove or nobody left to ask."""
+            if error is not None or result is None:
+                answer(())
+                return
+            deletions, kept_dirs = result
+            if not deletions or self.closed or self.repository_operation is None or not is_current():
+                answer(kept_dirs)
+                return
+            refs = []
+            for ref, _oid in deletions:
+                refs.append(ref)
+            operation = OperationIntent.capture(uuid.uuid4().hex, context, git_filename, session_id=session_id, generation=generation, operation=LEGACY_ANCHOR_RETIREMENT_OPERATION,
+                                                action=OperationAction.REF_WRITE, scope=WriteScope.capture(context, tuple(refs)))
+            self.repository_operation.submit(operation, self._retire_legacy_anchors(operation, deletions, is_current, lambda: answer(kept_dirs)))
+            if operation.operation_id in self.repository_operation.outcome_by_id:
+                # Refused or ended before its first process: a refused sequence never runs, so it cannot answer by itself.
+                answer(kept_dirs)
+
+        self.worktree_service.run(context, git_filename, self._find_legacy_anchors(store_dir, context.common_git_dir), found, priority=ProcessPriority.BACKGROUND)
+
+    def _find_legacy_anchors(self, store_dir: str, common_git_dir: str) -> Generator:
+        """Read the earlier journals, then list the anchors only when an earlier version left a working tree subfolder; answer the deletions and the kept folders.
+
+        The same listing decides both answers: a kept anchor always names its folder, and a restoration recorded for
+        this repository is named even when its anchor is gone.
+        """
+        in_use, records = yield FileTask(lambda: (replay_legacy.legacy_replay_store_in_use(store_dir), replay_legacy.read_legacy_replay_records(store_dir)))
+        if not in_use:
+            return (), ()
+        listing = yield GitCommand(["for-each-ref", "--format=" + replay_legacy.LEGACY_ANCHOR_LISTING_FORMAT, replay_legacy.LEGACY_ANCHOR_REF_PREFIX])
+        target_oid_by_ref = replay_legacy.parse_legacy_anchor_listing(listing)
+        return (yield FileTask(lambda: (replay_legacy.legacy_anchor_deletions(target_oid_by_ref, records), replay_legacy.kept_legacy_backup_dirs(records, target_oid_by_ref, common_git_dir))))
+
+    def _retire_legacy_anchors(self, operation: OperationIntent, deletions: tuple[tuple[str, str], ...], is_current: Callable[[], bool],
+                               answer: Callable[[], None]) -> Generator:
+        """Remove the chosen anchors in one update-ref transaction, each only while it still points to its listed object.
+
+        The replay state is read again under the reservation first, and the removal is refused while a Cherry-pick or
+        Revert is in progress. Only references are written: no index, no working file and no submodule is touched.
+        """
+        run = NativeCommandRun()
+        status = OperationStatus.REFUSED
+        try:
+            state = yield from capture_replay(operation.context, operation.generation)
+            if not state.fresh or state.kind != ReplayKind.ABSENT or state.unmerged_paths:
+                raise ValueError(LEGACY_ANCHOR_RETIREMENT_REFUSED_CAUSE)
+            self.repository_operation.validate(operation)
+            self._validate_launch_authority(operation, is_current)
+
+            def validate_launch() -> None:
+                """Compare only current authority when the queued removal launches."""
+                self._validate_launch_authority(operation, is_current)
+                run.started = True
+
+            yield GitCommand(["update-ref", "--no-deref", "--stdin", "-z"], stdin=replay_legacy.legacy_anchor_deletion_input(deletions), profile=LOCAL_WRITE_PROFILE,
+                             before_start=validate_launch)
+            run.process_status, run.return_code = ProcessStatus.SUCCESS, SUCCESS_EXIT_CODE
+            status = OperationStatus.SUCCESS
+        except (GitCommandError, ValueError, OSError) as error:
+            run.record_failure(operation, error)
+            status = OperationStatus.UNKNOWN if run.started else OperationStatus.REFUSED
+        answer()
+        step = OperationStepResult(operation.operation, status, process_status=run.process_status, effect="changed" if status == OperationStatus.SUCCESS else "unknown",
+                                   diagnostic=run.diagnostic, return_code=run.return_code)
+        return OperationOutcome(operation.operation_id, status, (step,), run.diagnostic)
+
+    def close(self) -> None:
+        """Stop publishing while scheduled filesystem and process work drains."""
+        self.closed = True
+
+    def _publish_result(self, state: ReplaySnapshot) -> ReplaySnapshot:
+        """Publish the reconciled state an operation ends with, under a generation newer than any read still running.
+
+        The generation is remembered as an operation's publication: a read that was running meanwhile answers its callers
+        with this state instead of its own result, and the replay controller may show it without reading it again.
+        """
+        generation = max(state.generation, self.generation_by_key.get(state.key, 0)) + 1
+        state = replace(self._joined_launch(state), generation=generation)
+        self.generation_by_key[state.key] = generation
+        self.published_generation_by_key[state.key] = generation
+        self.state_by_key[state.key] = state
+        self.changed.emit(state)
+        return state
+
+    def _joined_launch(self, state: ReplaySnapshot) -> ReplaySnapshot:
+        """Mark a state as GitPane's own pause when it is the one launched here, and forget that launch once a fresh read shows no pause left."""
+        if state.fresh and state.kind == ReplayKind.ABSENT:
+            self.launch_by_key.pop(state.key, None)
+            return state
+        return join_replay_launch(state, self.launch_by_key.get(state.key))
+
+    def observe(self, context: RepositoryContext, git_filename: str, *, is_current: Callable[[], bool], callback: Callable[[ReplaySnapshot], None],
+                priority: ProcessPriority = ProcessPriority.USER) -> None:
+        """Share one worktree read between concurrent callers and reject replaced requester sessions.
+
+        The priority is the caller's place in the process queue: a click by default, background for an automatic look.
+        """
+        if self.closed:
+            return
+        key = WorktreeKey.from_context(context)
+        if key in self.observers_by_key:
+            # The read already running may have started before the change this caller wants to see (a native pause that appeared in between).
+            # Answering from it could report a state that no longer exists, so late callers share one read started after it ends,
+            # unless an operation publishes its verified result first: that result is newer than the request and answers it.
+            self.waiting_observers_by_key.setdefault(key, []).append((self.generation_by_key.get(key, 0), is_current, callback, priority))
+            return
+        self._start_read(context, git_filename, [(is_current, callback, priority)])
+
+    def observe_passive(self, context: RepositoryContext, git_filename: str, source: PassiveObservationSource, *, is_current: Callable[[], bool],
+                        callback: Callable[[ReplaySnapshot], None], priority: ProcessPriority = ProcessPriority.USER) -> None:
+        """Follow a cherry-pick or revert state for the banner with what the automatic refresh has just read; only that refresh calls it.
+
+        A request that has to wait for a read already running is answered by a complete read through Git, at the same priority.
+        """
+        if self.closed:
+            return
+        if WorktreeKey.from_context(context) in self.observers_by_key:
+            # The facts in hand may be older than the change this caller waits for, and a waiting request is never kept
+            # with them: it becomes a request through Git.
+            self.observe(context, git_filename, is_current=is_current, callback=callback, priority=priority)
+            return
+        self._start_read(context, git_filename, [(is_current, callback, priority)], source)
+
+    def _start_read(self, context: RepositoryContext, git_filename: str, observers: list[tuple[Callable[[], bool], Callable[[ReplaySnapshot], None], ProcessPriority]],
+                    source: PassiveObservationSource | None = None) -> None:
+        """Run one native state read for these callers, then one more for the callers that arrived while it ran.
+
+        An operation that publishes its verified result while this read runs answers every caller who asked before that
+        publication, this read's callers included, with the published state; this read's own result or error is then
+        dropped. Only callers who asked after the publication need a new read, and they share one.
+        """
+        key = WorktreeKey.from_context(context)
+        self.observers_by_key[key] = observers
+        generation = self.generation_by_key.get(key, 0) + 1
+        self.generation_by_key[key] = generation
+
+        def complete(result: ReplaySnapshot | None, error: Exception | None) -> None:
+            """Publish this read first, so starting the follow-up read cannot mark it as superseded."""
+            finished_observers = self.observers_by_key.pop(key, [])
+            next_observers = []
+            published_generation = self.published_generation_by_key.get(key, 0)
+            for asked_generation, current, observer_callback, observer_priority in self.waiting_observers_by_key.pop(key, []):
+                if published_generation > generation and asked_generation < published_generation:
+                    finished_observers.append((current, observer_callback, observer_priority))
+                else:
+                    next_observers.append((current, observer_callback, observer_priority))
+            try:
+                # Callers of a superseded read that no publication answers still need an answer, so they join the follow-up read.
+                next_observers = publish(finished_observers, result, error) + next_observers
+            finally:
+                current_observers = []
+                for current, observer_callback, observer_priority in next_observers:
+                    if current():
+                        current_observers.append((current, observer_callback, observer_priority))
+                running_observers = self.observers_by_key.get(key)
+                if running_observers is not None:
+                    # A callback of this read already started the next one, after these callers asked, so it answers them too.
+                    running_observers.extend(current_observers)
+                elif current_observers and not self.closed:
+                    # The follow-up read answers requests made after the previous read started: the facts in hand then no longer
+                    # hold, so it reads everything through Git.
+                    self._start_read(context, git_filename, current_observers)
+
+        def publish(observers: list[tuple[Callable[[], bool], Callable[[ReplaySnapshot], None], ProcessPriority]], result: ReplaySnapshot | None,
+                    error: Exception | None) -> list[tuple[Callable[[], bool], Callable[[ReplaySnapshot], None], ProcessPriority]]:
+            """Keep errors and external disappearance explicit without claiming success; return the callers left without an answer."""
+            callbacks = []
+            for current, observer_callback, _observer_priority in observers:
+                if current():
+                    callbacks.append(observer_callback)
+            if self.closed or not callbacks:
+                return []
+            if self.generation_by_key.get(key) != generation:
+                latest = self.state_by_key.get(key)
+                if latest is not None and latest.generation == self.generation_by_key.get(key) == self.published_generation_by_key.get(key):
+                    # An operation published while this read was pending: its result is newer than every request here and
+                    # answers it as published, unknown included, while this read's own result or error is dropped.
+                    for observer_callback in callbacks:
+                        observer_callback(latest)
+                    return []
+                return observers
+            previous = self.state_by_key.get(key)
+            if error is not None or result is None:
+                result = unreadable_replay_state(previous or ReplaySnapshot(key, generation), "Cannot read the native replay state. Refresh to try again.", generation=generation)
+            else:
+                result = self._joined_launch(result)
+                if previous is not None and previous.identity is not None:
+                    if result.kind == ReplayKind.ABSENT:
+                        result = replace(result, diagnostic="Native commit operation disappeared externally. Refresh to inspect the result.", pending_step="disappeared")
+                    elif previous.identity != result.identity or previous.head_oid != result.head_oid:
+                        result = replace(result, diagnostic="Native commit operation changed externally. " + result.diagnostic)
+            self.state_by_key[key] = result
+            try:
+                # The callers who asked for this read hear its answer before it is announced to everyone: a request that
+                # asked for it (an automatic Continue waiting for its qualifying read) is answered by this very read
+                # before anything reacting to the announcement acts on the same state.
+                for observer_callback in callbacks:
+                    observer_callback(result)
+            finally:
+                self.changed.emit(result)
+            return []
+
+        reading = capture_replay(context, generation) if source is None else capture_replay_passive(context, generation, source)
+        self.worktree_service.run(context, git_filename, reading, complete, priority=observation_priority(observers))