lattice_magit/

actions.rs

//! MG.3: magit-status action handlers.
//!
//! Each handler captures shared state from the mode's Guard so it
//! can read the cursor line, resolve the repo, and invoke git
//! operations. Async operations (diff expansion, refresh) use the
//! stored tokio handle — no `Runtime::new()`, no `block_on`.

use std::collections::HashMap;
use std::path::{Path, PathBuf};
use std::sync::{Arc, Mutex};

use lattice_core::BufferId;
use lattice_grammar::Effect;
use lattice_mode::{
    ActionContext, ActionHandlerContribution, BufferStoreHandle, PendingSyntheticHighlights,
};
use lattice_protocol::edit::Edit;
use lattice_protocol::position::Position;
use lattice_vcs::{Index, Repository};

use crate::buffer_state::DiffSource;
use crate::refresh;

pub struct StatusBufferState {
    pub buffer_id: BufferId,
    pub store: Arc<BufferStoreHandle>,
    pub workdir: PathBuf,
    pub runtime: tokio::runtime::Handle,
    /// MG.2: optional handle to store styled spans after async edit
    /// lands, so highlights appear without a keystroke.
    pub pending_highlights: Option<std::sync::Arc<PendingSyntheticHighlights>>,
    /// Entries currently inline-expanded (file diff / stash show /
    /// commit show), keyed by [`entry_key`], value = number of buffer
    /// lines the expansion occupies.
    ///
    /// MG.18d: a refresh no longer clears this. The rebuild *carries*
    /// the open entries' diffs (`refresh::build_and_format`), so the
    /// map is replaced with counts recomputed from the text that was
    /// actually written — staging a hunk makes a diff shorter, and a
    /// carried-over count would then collapse the wrong rows.
    pub expanded: HashMap<String, usize>,
    /// MG.14: the buffer's headerline — branch, ahead/behind, repo
    /// name, dirty counts. Re-set by every refresh from the same
    /// `SectionIndex` the body is built from.
    pub headerline: Option<crate::headerline::MagitHeaderlineHandle>,
    /// MG.22b: the config, not the value — read per refresh so a
    /// `:set magit.hunk.context-lines` takes effect on the next `gr`
    /// rather than only on reopen.
    pub config: Option<Arc<lattice_config::ConfigRegistry>>,
    /// MG.18d: where the cursor should land once the next refresh's
    /// text exists. Set by a mutation, consumed by the refresh it was
    /// queued for — a later `gr` must not re-apply a stale jump.
    pub pending_cursor: Option<crate::cursor_restore::HunkRestore>,
    /// MG.18d: the wake-baked bus the resolved position goes back on.
    pub cursor_bus: Option<crate::cursor_restore::CursorBusHandle>,
    /// DS.3: the grammar registry, for syntax-highlighting the code
    /// inside an inline-expanded diff.
    ///
    /// `None` in a harness without the service — the diff then renders
    /// exactly as it did before syntax layering existed, which is the
    /// degradation this feature is designed around rather than an
    /// error path.
    pub lang_registry: Option<Arc<lattice_syntax::LangRegistry>>,
}

// ── line classification ─────────────────────────────────

/// What kind of entry occupies a status-buffer line. Derived directly
/// from the rendered line's fixed layout (see
/// `SectionIndex::format_buffer_styled`), not by guessing at word
/// boundaries — this is what lets `classify_line` tell a "new file"
/// (two-word label) entry apart from every other one-word label.
#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) enum StatusLine {
    File {
        path: PathBuf,
        staged: bool,
        /// Git has no record of this path.
        ///
        /// Load-bearing for discard and nothing else so far: `git
        /// checkout -- <path>` restores a tracked file from the index,
        /// and on an untracked one it fails with "pathspec … did not
        /// match any file(s) known to git". Discarding an untracked
        /// file means *deleting* it, which is a different command and
        /// a different question to ask the user.
        untracked: bool,
        /// Where a renamed / copied path came from, parsed back out of
        /// the row's `old -> new` rendering.
        ///
        /// Load-bearing for UNSTAGE: `git reset HEAD -- <new>` alone
        /// leaves the old path staged-DELETED, so "unstage this
        /// rename" would record a deletion the user never asked for.
        /// Both paths have to be reset together.
        original_path: Option<PathBuf>,
    },
    Stash {
        index: usize,
    },
    Commit {
        sha: String,
    },
}

/// Status labels `SectionIndex::format_buffer_styled` renders via
/// `format!("  {:<12} {}", label, path)`. Checked as whole-word
/// prefixes (label followed by whitespace) so diff content inserted
/// by a toggled-open entry — which can start with an arbitrary
/// number of leading spaces when the underlying source line is
/// itself indented — never collides with these.
///
/// Must stay in sync with `sections::status_label`'s outputs — the
/// test `status_label_is_a_subset_of_actions_file_labels` enforces it
/// mechanically rather than by inspection.
///
/// `"clean"` is gone with `PathStatus::Clean`: a clean path is
/// `PathChange::CLEAN` (nothing on either axis) and never reaches a
/// rendered row. `"renamed"` / `"copied"` / `"typechange"` arrived
/// with the variants that were previously collapsed into `Added` (or,
/// for a type change, dropped entirely).
pub(crate) const FILE_LABELS: [&str; 16] = [
    "modified",
    "new file",
    "deleted",
    "renamed",
    "copied",
    "typechange",
    "untracked",
    "ignored",
    // The seven unmerged combinations, in git's own wording, plus the
    // generic fallback for a `U` pairing git documents no name for.
    "both deleted",
    "added by us",
    "deleted by them",
    "added by them",
    "deleted by us",
    "both added",
    "both modified",
    "unmerged",
];

/// Classify the entry at `line`, or `None` if it isn't a
/// stage/unstage/visit-able entry line (a header, blank line, or
/// content inside an inline-expanded diff).
pub(crate) fn classify_line(state: &StatusBufferState, line: u32) -> Option<StatusLine> {
    let handle = state.store.handle_for(state.buffer_id)?;
    let snap = handle.snapshot();
    let text = snap.buffer.line(line)?;
    // `section_header_above` needs the live buffer, so only call it
    // when `classify_line_text` actually needs to disambiguate
    // (File → staged?, or the Recent-commits fallback) — see there.
    classify_line_text(&text, || section_header_above(state, line))
}

/// The pure classification core of [`classify_line`], split out so it's
/// testable without a live buffer/store. `header_above` is called lazily
/// (only when a candidate match needs to know its enclosing section) so
/// callers with a real buffer don't pay for an unnecessary backward scan.
pub(crate) fn classify_line_text(
    text: &str,
    header_above: impl FnOnce() -> Option<String>,
) -> Option<StatusLine> {
    if !text.starts_with("  ") {
        return None;
    }
    let trimmed = &text[2..];
    if let Some(rest) = trimmed.strip_prefix("stash@{") {
        let idx_str = rest.split('}').next()?;
        return Some(StatusLine::Stash {
            index: idx_str.parse().ok()?,
        });
    }
    // LONGEST FIRST, and that ordering is load-bearing rather than
    // tidy: labels are matched as PREFIXES, and `"deleted"` is a
    // prefix of `"deleted by us"`. Iterating in declaration order, a
    // `deleted by us   path` row matches `"deleted"`, leaves
    // `" by us   path"` (which does start with whitespace), and parses
    // the path as `"by us   path"` — a file that does not exist. Same
    // trap for `"deleted by them"`.
    let mut labels = FILE_LABELS;
    labels.sort_by_key(|l| std::cmp::Reverse(l.len()));
    for label in labels {
        if let Some(rest) = trimmed.strip_prefix(label)
            && rest.starts_with(char::is_whitespace)
        {
            let field = rest.trim_start();
            // A rename / copy row renders `old -> new`. Split from the
            // RIGHT: ` -> ` is legal inside a filename, and the new
            // path — the one every action targets — is what follows
            // the last separator. A ` -> ` inside the NEW name is not
            // recoverable from the rendered text, which is inherent to
            // the display form git and magit both use.
            let (original_path, path) = match field.rsplit_once(" -> ") {
                Some((from, to)) if label == "renamed" || label == "copied" => {
                    (Some(PathBuf::from(from)), PathBuf::from(to))
                }
                _ => (None, PathBuf::from(field)),
            };
            let staged = header_above()
                .map(|h| h.starts_with("Staged"))
                .unwrap_or(false);
            // The label is the fact, and it is already parsed: the
            // Untracked section renders `PathStatus::Untracked` as
            // `"untracked"` (`sections::status_label`, held to
            // `FILE_LABELS` by `status_label_is_a_subset_of_actions_file_labels`).
            return Some(StatusLine::File {
                path,
                staged,
                untracked: label == "untracked",
                original_path,
            });
        }
    }
    // Only commit entries fall through to here: "<sha> <subject>".
    // Both commit sections render identical rows, so both must classify
    // — otherwise `<CR>` would work under one heading and silently do
    // nothing under the other.
    let header = header_above()?;
    if header.starts_with("Recent commits") || header.starts_with("Unmerged into") {
        let sha = trimmed.split_whitespace().next()?;
        if !sha.is_empty() && sha.chars().all(|c| c.is_ascii_hexdigit()) {
            return Some(StatusLine::Commit {
                sha: sha.to_string(),
            });
        }
    }
    None
}

/// Stable identity for a `StatusLine`, used as the [`StatusBufferState::expanded`]
/// key. Includes `staged` for `File` — a `Conflicted` path appears in
/// BOTH the Staged and Unstaged sections simultaneously (see
/// `refresh::build_section_index`), as two distinct buffer rows that
/// can be independently expanded; collapsing that distinction would
/// let expanding one row's diff make `toggle_expand` treat the
/// *other* row as already-expanded too, and collapse the wrong line
/// range.
pub(crate) fn entry_key(sl: &StatusLine) -> String {
    match sl {
        StatusLine::File { path, staged, .. } => format!("f:{staged}:{}", path.display()),
        StatusLine::Stash { index } => format!("s:{index}"),
        StatusLine::Commit { sha } => format!("c:{sha}"),
    }
}

fn section_header_above(state: &StatusBufferState, line: u32) -> Option<String> {
    let handle = state.store.handle_for(state.buffer_id)?;
    let snap = handle.snapshot();
    for l in (0..=line).rev() {
        let text = snap.buffer.line(l)?;
        let t = text.trim();
        if crate::sections::is_section_header(t) {
            return Some(t.to_string());
        }
    }
    None
}

/// MG.18c: map a status section header to the tree its entries' diffs
/// were produced against.
///
/// Untracked files count as Unstaged: a whole-file `s` there is
/// `git add`, and an untracked file has no diff to expand, so the
/// hunk path never reaches this with one — the row is here so the
/// mapping is total rather than silently defaulting.
///
/// Split from [`StatusView::diff_source`] so the classification is
/// testable without a live buffer, the same split `classify_line` /
/// `classify_line_text` already uses.
pub(crate) fn diff_source_for_header(header: &str) -> Option<DiffSource> {
    if header.starts_with("Staged") {
        Some(DiffSource::Staged)
    } else if header.starts_with("Unstaged") || header.starts_with("Untracked") {
        Some(DiffSource::Unstaged)
    } else {
        // "Recent commits", "Stashes", "Merge conflicts", …
        None
    }
}

/// Run the git command that shows `sl`'s content: a file's diff
/// (staged-aware), a stash's patch, or a commit's patch.
pub(crate) fn run_show(workdir: &Path, sl: &StatusLine, context: i64) -> Option<String> {
    let mut cmd = std::process::Command::new("git");
    cmd.current_dir(workdir);
    // MG.22b: `magit.hunk.context-lines` applies to every patch magit
    // generates, not only the dedicated diff view — a value honoured in
    // `:magit-diff` but ignored by magit-status's inline `=` would be
    // the more confusing half of a half-migration.
    let unified = format!("--unified={context}");
    match sl {
        StatusLine::File { path, staged, .. } => {
            cmd.arg("diff");
            if *staged {
                cmd.arg("--cached");
            }
            cmd.arg(&unified).arg("--").arg(path);
        }
        StatusLine::Stash { index } => {
            cmd.args([
                "stash",
                "show",
                "-p",
                &unified,
                &format!("stash@{{{index}}}"),
            ]);
        }
        StatusLine::Commit { sha } => {
            cmd.args(["show", &unified, sha]);
        }
    }
    let output = cmd.output().ok()?;
    if output.status.success() {
        String::from_utf8(output.stdout).ok()
    } else {
        None
    }
}

/// Toggle the inline expansion of `sl` at `cursor_line`: collapse it
/// if already expanded (removing exactly the number of lines recorded
/// in `StatusBufferState::expanded` — not a re-scanned guess), or
/// insert its `git show`/`git diff` output and record the inserted
/// line count if collapsed. Shared by `=` (files) and `<CR>`
/// (stashes/commits).
/// MG.44: what a press on an already-classified file line should do.
///
/// Pulled out as a pure decision because it is the whole behavioural
/// change: before, an expanded entry was DELETED from the buffer and
/// the next press re-ran `git diff`. Now it folds, so the fetched rows
/// survive. Keeping the decision separate from the effect is what
/// makes that assertable without a `BufferStoreHandle`.
#[derive(Debug, PartialEq, Eq)]
enum DiffToggle {
    /// Nothing fetched yet — run `git diff` and insert it.
    Fetch,
    /// Rows are present — hide/show them, keeping the text.
    Fold,
    /// Recorded as expanded but occupying no rows, so there is
    /// nothing to fold; forget it instead.
    Drop,
}

impl DiffToggle {
    fn for_state(existing_count: Option<usize>) -> Self {
        match existing_count {
            None => Self::Fetch,
            Some(0) => Self::Drop,
            Some(_) => Self::Fold,
        }
    }
}

/// MG.44: the body BOTH `=` and `<Tab>` run on a status file line.
///
/// One operation with three states — not fetched, shown, hidden:
///
/// - not fetched -> run `git diff` and insert it
/// - shown       -> fold it shut (the rows stay)
/// - hidden      -> unfold
///
/// `=` and `<Tab>` were previously different operations on the same
/// line: one spliced text in and out, the other folded whatever was
/// already there. Sharing the body is what makes them agree, and it
/// has to be shared rather than duplicated because `<Tab>` is owned by
/// `magit-core-mode` (a MINOR mode, which outranks the status major in
/// the layer order) while `=` is the status major's own chord — two
/// copies would drift and only one of them would ever be reachable.
///
/// Off a file line there is nothing magit-specific to do, so the
/// generic fold toggle stands: `<Tab>` keeps working on section
/// headers and hunks exactly as before.
pub(crate) fn toggle_diff_or_fold(ctx: &ActionContext<'_>) -> Option<Effect> {
    let fold = || {
        Some(Effect::AppAction(
            lattice_grammar::AppEffect::ToggleFoldAtCursor,
        ))
    };
    let Some(s) = status_state(ctx) else {
        return fold();
    };
    let sl = {
        let Ok(g) = s.lock() else { return fold() };
        classify_line(&g, ctx.cursor.line)
    };
    let Some(sl @ StatusLine::File { .. }) = sl else {
        return fold();
    };
    toggle_expand(&s, sl, ctx.cursor.line)
}

fn toggle_expand(
    s: &Arc<Mutex<StatusBufferState>>,
    sl: StatusLine,
    cursor_line: u32,
) -> Option<Effect> {
    let key = entry_key(&sl);
    let (handle, wd, rt, existing_count, pending, bid, context, hl, registry) = {
        let g = s.lock().ok()?;
        let h = g.store.handle_for(g.buffer_id)?;
        let context = context_lines(&g.config);
        (
            h,
            g.workdir.clone(),
            g.runtime.clone(),
            g.expanded.get(&key).copied(),
            g.pending_highlights.clone(),
            g.buffer_id,
            context,
            g.headerline.clone(),
            crate::hunk_syntax::syntax_registry(g.lang_registry.clone(), g.config.as_ref()),
        )
    };

    match DiffToggle::for_state(existing_count) {
        DiffToggle::Fold => {
            // MG.44: **hide it, do not delete it.**
            //
            // This branch used to splice the diff out of the buffer, so
            // re-showing it re-ran `git diff` — throwing away work
            // already done and paying I/O for a keystroke that shows
            // text the buffer had a moment ago. A fold hides the rows
            // and keeps them, which is what emacs magit does and what
            // the buffer model already provides.
            //
            // Nothing is removed from `expanded` either: the entry IS
            // still expanded, it is merely folded shut. Clearing it
            // would make the next press re-fetch, which is the very
            // thing this removed — and would desync the fold ranges
            // `MagitStatusFoldSource` derives from that map.
            return Some(Effect::AppAction(
                lattice_grammar::AppEffect::ToggleFoldAtCursor,
            ));
        }
        DiffToggle::Drop => {
            // A zero-line expansion has no rows to fold, so there is
            // nothing to hide and the entry is dropped as before.
            if let Ok(mut g) = s.lock() {
                g.expanded.remove(&key);
            }
        }
        DiffToggle::Fetch => {
            let pos = Position::new(cursor_line + 1, 0);
            let start_line = cursor_line + 1;
            let s = s.clone();
            let path = match &sl {
                StatusLine::File { path, .. } => path.display().to_string(),
                _ => String::new(),
            };
            rt.spawn(async move {
                // MG.31: the git call happens HERE, inside the spawned
                // task, not above on the actor thread. See
                // [`expand_payload`].
                let (text, line_count, spans, refine) =
                    match expand_payload(wd, sl, context, registry).await {
                        Ok(payload) => payload,
                        // MG.56: say something. Returning quietly here is
                        // what made `=` look like an unbound key on a row
                        // whose changes had been committed elsewhere — the
                        // press did fire, git did answer, and the answer
                        // was an empty patch.
                        Err(miss) => {
                            crate::headerline::publish_notice(
                                &hl,
                                Some(match miss {
                                    ExpandMiss::NoChanges => {
                                        format!("no changes in {path} — press gr to refresh")
                                    }
                                    ExpandMiss::Failed(e) => {
                                        format!("could not diff {path}: {e}")
                                    }
                                }),
                            );
                            return;
                        }
                    };
                let _ = handle
                    .apply_edit_batch(vec![Edit::insert(pos, format!("{}\n", text))])
                    .await;
                // Recorded only after the insert lands — see the
                // collapse-branch comment above. Recording it
                // beforehand let a rapid second `=`/`<CR>` press see
                // "already expanded" and race the collapse branch
                // against rows the insert hadn't populated yet.
                if let Ok(mut g) = s.lock() {
                    g.expanded.insert(key, line_count);
                }
                if let Some(ref ph) = pending {
                    ph.insert_at_refined_and_wake(bid, start_line, spans, refine);
                }
            });
        }
    }
    None
}

/// MG.31: the blocking half of an inline expansion — the `git` call and
/// the styling of its output — on the blocking pool.
///
/// **Why this is a function and not three lines in `toggle_expand`.**
/// `toggle_expand` is an action handler, so its body runs on the editor
/// actor's `current_thread` runtime (`editor_actor.rs`: one task,
/// `run_actor` processes commands one at a time). [`run_show`] ends in
/// `Command::output()` — a fork/exec plus wait — so calling it from the
/// handler stalled the loop that services keystrokes for the whole
/// duration of a `git diff`, which alone exceeds paramount-goal-1's
/// one-frame ceiling. Every other magit view already ran its git call
/// inside `spawn_blocking`, including [`run_show`]'s two other callers;
/// this path was the one that did not.
///
/// The styling moves with it deliberately: it is `O(lines)` over the
/// diff and belongs on the same side of the boundary as the call that
/// produced it.
///
/// `None` when the entry has no diff to show (git failed, or the output
/// was blank) — the caller then inserts nothing, exactly as before.
/// Why an expansion produced nothing.
///
/// The two used to collapse into one `None`, and the caller returned
/// silently on either — so pressing `=` on a file whose changes had
/// since been committed elsewhere did *nothing*, repeatedly, and looked
/// exactly like an unbound key. They are different problems with
/// different fixes and have to be told apart to say anything useful.
#[derive(Debug)]
pub(crate) enum ExpandMiss {
    /// git answered, and the answer was an empty patch. Almost always
    /// a stale buffer: the row is still listed because the status scan
    /// that produced it has been overtaken by a commit, a stage, or an
    /// edit made outside this view.
    NoChanges,
    /// The git call itself failed.
    Failed(String),
}

async fn expand_payload(
    workdir: PathBuf,
    sl: StatusLine,
    context: i64,
    lang_registry: Option<Arc<lattice_syntax::LangRegistry>>,
) -> Result<
    (
        String,
        usize,
        Vec<Vec<lattice_cells::style::StyledSpan>>,
        Vec<Vec<lattice_cells::RefineSpan>>,
    ),
    ExpandMiss,
> {
    tokio::task::spawn_blocking(move || {
        let raw = run_show(&workdir, &sl, context)
            .ok_or_else(|| ExpandMiss::Failed("git could not read the diff".to_string()))?;
        if raw.trim().is_empty() {
            return Err(ExpandMiss::NoChanges);
        }
        // MG.46: only the trailing newline goes. A patch is not free
        // text — each hunk's `@@` header declares how many body lines
        // follow, and `hunk_fold_source` bounds the fold by that count.
        // `.trim()` also ate a trailing blank context line (git emits
        // one as a lone space), leaving the text one line shorter than
        // its own header claimed, and the fold then ran past the end of
        // the diff into the status rows below.
        let text = raw.trim_end_matches('\n').to_string();
        let line_count = text.lines().count();
        // DR.3 fix: the `=` toggle publishes refinement too. It
        // previously took spans alone, so an expansion opened by `=`
        // showed no intra-line highlight while the same expansion
        // rebuilt by `gr` did — the same route asymmetry DS-fix
        // removed for syntax.
        let styled = crate::hunk_syntax::styled_diff(&text, lang_registry.as_ref());
        Ok((text, line_count, styled.spans, styled.refine))
    })
    .await
    .unwrap_or_else(|e| Err(ExpandMiss::Failed(e.to_string())))
}

// ── registration ────────────────────────────────────────

/// MG.13: service alias for magit-status's per-buffer state
/// (`feedback_servicesregistry_arc_typeid`).
pub type StatusStatesHandle = Arc<crate::buffer_state::BufferStates<StatusBufferState>>;

/// Resolve the status buffer's state for the buffer an action fired
/// in. `None` means this is not a live magit-status buffer, so the
/// handler declines — the same outcome as before, minus the race.
pub(crate) fn status_state(ctx: &ActionContext<'_>) -> Option<Arc<Mutex<StatusBufferState>>> {
    crate::buffer_state::state_for::<StatusBufferState>(ctx)
}

/// MG.13: magit-status's action handlers, registered once at boot by
/// `MagitStatusMode::action_handlers()`.
///
/// Each body opens with `let s = status_state(ctx)?;` — resolving this
/// buffer's state from the `BufferStates<StatusBufferState>` service
/// rather than closing over it at activation. That removes the window
/// in which `x` / `=` / `<CR>` resolved but had no handler yet. `s`,
/// `u` and `gr` are NOT here: they are shared with `magit-diff-mode`,
/// so `magit-core-mode` owns their single handler and reaches this
/// buffer through [`StatusView`] (see `buffer_state::MagitView`).
pub fn status_action_handlers() -> Vec<ActionHandlerContribution> {
    let mut contributions: Vec<ActionHandlerContribution> = Vec::new();

    macro_rules! handler {
        ($name:expr, $body:expr) => {
            contributions.push(ActionHandlerContribution {
                action_name: $name,
                handler: Arc::new($body),
            });
        };
    }

    // Run `mutate` (a blocking git call) on `spawn_blocking`, off the
    // actor thread entirely, then refresh — the shape every mutating
    // handler below uses instead of calling git synchronously inline.
    // Handlers read whatever cursor/path state they need up front
    // (fast, in-memory) and hand this a self-contained closure; the
    // handler itself returns `None` immediately, before the git call
    // has even started.

    // ── stage (s) ──────────────────────────────────────
    // MG.13: registered once at boot by `magit-core-mode` (a shared
    // action — `magit-diff-mode` binds `s` too) and dispatched
    // through `StatusView`'s `MagitView` impl below.

    // ── unstage (u) ───────────────────────────────────
    // MG.13: registered once at boot by `magit-core-mode` (a shared
    // action — `magit-diff-mode` binds `u` too) and dispatched
    // through `StatusView`'s `MagitView` impl below.

    // ── discard (x) ───────────────────────────────────
    // PU.6: prompt for confirmation before destructive discard.
    //
    // MG.18c: hunk-at-cursor first, exactly as `s` / `u` resolve —
    // but through the ask/execute pair, because §12.13 requires a
    // destructive action's chord to perform no git call at all. The
    // prompt names the hunk's file position so the question is
    // answerable without dismissing it.
    {
        handler!("action:magit-discard", move |ctx: &ActionContext<'_>| {
            match crate::magit_core_mode::resolve_hunk(ctx, crate::magit_core_mode::HunkOp::Discard)
            {
                crate::magit_core_mode::HunkResolution::Ready {
                    patch,
                    region_lines,
                    workdir,
                    ..
                } => {
                    // MG.18e: the prompt names what will actually go.
                    // "Discard hunk" over a 2-line selection would be a
                    // question about something the user did not ask for
                    // — and §12.13 requires the question to be
                    // answerable without dismissing it.
                    let target = match region_lines {
                        Some(1) => format!("1 line of {}", patch.display_location()),
                        Some(n) => format!("{n} lines of {}", patch.display_location()),
                        None => format!("hunk at {}", patch.display_location()),
                    };
                    // IX.2: carry the PATCH, not the rows it came
                    // from. A row span is a coordinate a rebuild
                    // invalidates — a refresh landing while the dialog
                    // is open would make the same span mean different
                    // lines. The patch is content, so it still means
                    // what it meant; and if the tree moved under it,
                    // `git apply`'s context check refuses it loudly
                    // rather than discarding somewhere plausible.
                    Some(crate::confirm::ask_with(
                        format!("Discard {target}?"),
                        "action:magit-discard-execute",
                        lattice_grammar::Args::List(vec![
                            lattice_grammar::ArgValue::String(String::new()),
                            lattice_grammar::ArgValue::String(patch.to_patch()),
                            lattice_grammar::ArgValue::String(
                                workdir.to_string_lossy().into_owned(),
                            ),
                        ]),
                    ))
                }
                crate::magit_core_mode::HunkResolution::Refused(effect) => Some(effect),
                crate::magit_core_mode::HunkResolution::FileLevel => {
                    let s = status_state(ctx)?;
                    // A Visual selection over ENTRY rows means "these files",
                    // not "this file" — the same rule `s` and `u` already
                    // follow in `stage_or_unstage`. `x` was the one that did
                    // not: it read `ctx.cursor.line` alone, so selecting three
                    // untracked files and pressing `x` discarded exactly one.
                    if let Some(region) = ctx.selection {
                        let lo = region.start.line.min(region.end.line);
                        let hi = region.start.line.max(region.end.line);
                        if hi > lo
                            && let Some((files, _)) = discardable_files_in_rows(&s, lo..=hi)
                            && files.len() > 1
                        {
                            return Some(batch_discard_confirm(&files));
                        }
                    }
                    let g = s.lock().ok()?;
                    let StatusLine::File {
                        path, untracked, ..
                    } = classify_line(&g, ctx.cursor.line)?
                    else {
                        return None;
                    };
                    drop(g);
                    Some(file_discard_confirm(&path, untracked))
                }
            }
        });
    }
    // PU.6: actual discard, dispatched by Confirm's yes-action.
    //
    // IX.2: acts on what the prompt named. The ask half carries either
    // the synthesized patch (hunk / region) or the path (file), and
    // this half prefers that over anything it could re-derive — a
    // refresh landing while the dialog is open rebuilds the buffer and
    // moves the cursor, so re-derivation is how you discard a file you
    // never confirmed.
    //
    // A patch is content, not coordinates, so it still means what it
    // meant; and if the working tree moved under it, `git apply`'s
    // exact-context check refuses it loudly instead of applying it at a
    // plausible-looking offset.
    {
        handler!(
            "action:magit-discard-execute",
            // The collapse lands on the EXECUTE half, not the ask: `x` over a
            // selection returns `Effect::Confirm` and has not acted yet, so
            // dropping the selection there would lose it for a question the
            // user may still answer `no` to.
            crate::magit_core_mode::consuming_selection(move |ctx: &ActionContext<'_>| {
                // Slot 1 is the carried patch, slot 2 its workdir.
                if let (Some(patch), Some(workdir)) = (ctx.arg_str(1), ctx.arg_str(2))
                    && !patch.is_empty()
                {
                    return Some(crate::magit_core_mode::spawn_patch_discard(
                        std::path::PathBuf::from(workdir),
                        patch.to_string(),
                        crate::buffer_state::view_for(ctx),
                    ));
                }
                if let Some(path) = crate::confirm::carried_target(ctx)
                    && !path.is_empty()
                {
                    let s = status_state(ctx)?;
                    let workdir = s.lock().ok()?.workdir.clone();
                    return spawn_mutation_and_refresh(
                        s.clone(),
                        format!("discard {path}"),
                        move || {
                            let repo = Repository::discover(&workdir)
                                .map_err(|e| format!("not a git repository: {e}"))?;
                            repo.run_git(["checkout", "--", &path])
                                .map(|out| String::from_utf8_lossy(&out).into_owned())
                                .map_err(|e| e.to_string())
                        },
                    );
                }
                match crate::magit_core_mode::resolve_hunk(
                    ctx,
                    crate::magit_core_mode::HunkOp::Discard,
                ) {
                    crate::magit_core_mode::HunkResolution::Ready {
                        view,
                        workdir,
                        patch,
                        site,
                        region_lines,
                    } => Some(crate::magit_core_mode::spawn_hunk_apply(
                        view,
                        workdir,
                        patch,
                        crate::magit_core_mode::HunkOp::Discard,
                        site,
                        region_lines,
                    )),
                    crate::magit_core_mode::HunkResolution::Refused(effect) => Some(effect),
                    crate::magit_core_mode::HunkResolution::FileLevel => {
                        let s = status_state(ctx)?;
                        let (path, untracked, workdir) = {
                            let g = s.lock().ok()?;
                            let StatusLine::File {
                                path, untracked, ..
                            } = classify_line(&g, ctx.cursor.line)?
                            else {
                                return None;
                            };
                            (path, untracked, g.workdir.clone())
                        };
                        // Same split as the ask half: `git checkout`
                        // cannot restore a path git has no record of.
                        if untracked {
                            return spawn_untracked_delete(s.clone(), workdir, path);
                        }
                        spawn_mutation_and_refresh(
                            s.clone(),
                            format!("discard {}", path.display()),
                            move || {
                                let repo = Repository::discover(&workdir)
                                    .map_err(|e| format!("not a git repository: {e}"))?;
                                repo.run_git(["checkout", "--", &path.to_string_lossy()])
                                    .map(|out| String::from_utf8_lossy(&out).into_owned())
                                    .map_err(|e| e.to_string())
                            },
                        )
                    }
                }
            })
        );
    }

    // Discarding an UNTRACKED file, after confirmation.
    //
    // A separate execute half rather than a branch inside the one
    // above, for the reason `magit-global-file-discard` / `-delete` /
    // `-checkout` are already three pairs: one action, one act. The
    // ask half chooses which to name, so the question the user
    // answered and the command that runs cannot drift apart.
    {
        handler!(
            "action:magit-discard-untracked-execute",
            // The collapse lands on the EXECUTE half, not the ask: `x` over a
            // selection returns `Effect::Confirm` and has not acted yet, so
            // dropping the selection there would lose it for a question the
            // user may still answer `no` to.
            crate::magit_core_mode::consuming_selection(move |ctx: &ActionContext<'_>| {
                let s = status_state(ctx)?;
                let workdir = s.lock().ok()?.workdir.clone();
                // IX.2: act on what the prompt named. Re-derivation is
                // the fallback for a path that carried nothing.
                let path = match crate::confirm::carried_target(ctx) {
                    Some(carried) if !carried.is_empty() => PathBuf::from(carried),
                    _ => {
                        let g = s.lock().ok()?;
                        let StatusLine::File { path, .. } = classify_line(&g, ctx.cursor.line)?
                        else {
                            return None;
                        };
                        path
                    }
                };
                spawn_untracked_delete(s.clone(), workdir, path)
            })
        );
    }

    // Discarding a MULTI-FILE selection, after confirmation.
    //
    // One handler for both kinds, unlike the single-file pair above, and the
    // split there is the reason: those two exist so the question the user
    // answered and the command that runs cannot drift apart, which works when
    // the ask names one file. A selection can hold both kinds at once, and
    // asking two questions for one keypress is worse than asking one — so the
    // ask names both counts (see `batch_discard_confirm`) and this half does
    // each path the right way.
    //
    // ONE task, ONE refresh, and one `git` invocation per kind rather than per
    // file — `stage_rows`' reasoning: N spawns meant N `.git/index.lock`
    // cycles and a partial batch nobody could describe.
    {
        handler!(
            "action:magit-discard-batch-execute",
            // The collapse lands on the EXECUTE half, not the ask: `x` over a
            // selection returns `Effect::Confirm` and has not acted yet, so
            // dropping the selection there would lose it for a question the
            // user may still answer `no` to.
            crate::magit_core_mode::consuming_selection(move |ctx: &ActionContext<'_>| {
                let files = carried_batch(&ctx.args);
                if files.is_empty() {
                    return None;
                }
                let s = status_state(ctx)?;
                let workdir = s.lock().ok()?.workdir.clone();
                let tracked: Vec<String> = files
                    .iter()
                    .filter(|(_, u)| !*u)
                    .map(|(p, _)| p.to_string_lossy().into_owned())
                    .collect();
                let untracked: Vec<String> = files
                    .iter()
                    .filter(|(_, u)| *u)
                    .map(|(p, _)| p.to_string_lossy().into_owned())
                    .collect();
                let label = format!("discard {} files", files.len());
                spawn_mutation_and_refresh(s.clone(), label, move || {
                    let repo = Repository::discover(&workdir)
                        .map_err(|e| format!("not a git repository: {e}"))?;
                    let mut out = String::new();
                    if !tracked.is_empty() {
                        let mut args: Vec<&str> = vec!["checkout", "--"];
                        args.extend(tracked.iter().map(String::as_str));
                        out.push_str(
                            &repo
                                .run_git(args)
                                .map(|o| String::from_utf8_lossy(&o).into_owned())
                                .map_err(|e| e.to_string())?,
                        );
                    }
                    if !untracked.is_empty() {
                        // `clean -f -d`, for `spawn_untracked_delete`'s
                        // reason: checkout addresses paths git knows, and
                        // these by definition are not.
                        let mut args: Vec<&str> = vec!["clean", "-f", "-d", "--"];
                        args.extend(untracked.iter().map(String::as_str));
                        out.push_str(
                            &repo
                                .run_git(args)
                                .map(|o| String::from_utf8_lossy(&o).into_owned())
                                .map_err(|e| e.to_string())?,
                        );
                    }
                    Ok(out)
                })
            })
        );
    }

    // ── visit (<CR>) ───────────────────────────────────
    // File entries open the file — the INDEX blob for a Staged
    // entry (`*magit:file:staged:<path>*`, read-only: this section
    // describes what's staged, which may already differ from a
    // since-edited working copy), the live editable working-tree
    // file for Unstaged (uniform with magit-diff-mode's own
    // Staged-vs-Unstaged `<CR>` split — see magit.md §6.3). Stash
    // entries toggle their inline patch, same mechanism `=` uses
    // for files (there's no dedicated "stash detail" buffer to open
    // instead).
    {
        handler!("action:magit-visit", move |ctx: &ActionContext<'_>| {
            let s = status_state(ctx)?;
            visit_status_line(&s, ctx.cursor.line)
        });
    }

    status_action_handlers_rest(&mut contributions);
    contributions
}

/// MG.22: magit-status's `<CR>` body, lifted out of the handler so the
/// `MagitView` can answer with it too.
///
/// `magit-hunk-mode` owns the chord; this stays the status buffer's
/// answer for rows that are not diff content, reached through
/// `MagitView::visit_at_cursor`. The `action:magit-visit` id is kept
/// so an ex-command or a user keymap can still reach it directly.
fn visit_status_line(s: &Arc<Mutex<StatusBufferState>>, line: u32) -> Option<Effect> {
    let (sl, label) = {
        let g = s.lock().ok()?;
        (
            classify_line(&g, line)?,
            crate::repo_scope::label_of_buffer(&g.store, g.buffer_id),
        )
    };
    match sl {
        StatusLine::File {
            path, staged: true, ..
        } => Some(Effect::OpenSyntheticBuffer {
            name: crate::magit_file_revision_mode::blob_buffer_name(&label, "staged", &path),
            mode_id: "magit-file-revision-mode".to_string(),
            content: None,
            cursor: None,
            activate_minor: None,
        }),
        StatusLine::File {
            path,
            staged: false,
            ..
        } => {
            let g = s.lock().ok()?;
            let full = g.workdir.join(&path);
            full.exists().then_some(Effect::OpenBuffer {
                path: Some(full),
                force: false,
            })
        }
        StatusLine::Stash { .. } => toggle_expand(s, sl, line),
        // Bug fix: `<CR>` on a commit SHA used to toggle the inline
        // diff (same as `=`) — but every other magit view that shows a
        // SHA (log, blame, rebase) treats `<CR>` as "open the dedicated
        // commit buffer", so status was the one inconsistent surface.
        // `=` still does the inline toggle for a quick look without
        // leaving the status buffer.
        // MR.3b: `show`, not `commit` — the compose buffer owns that
        // view word, and with the repository in segment 2 the two would
        // be the same name in a checkout called like a sha. The label
        // comes from THIS buffer's name, which is the status buffer of
        // the repository whose commit is being shown.
        StatusLine::Commit { sha } => Some(Effect::OpenSyntheticBuffer {
            name: crate::workdir::magit_buffer_name_with(
                crate::magit_revision_mode::SHOW_VIEW,
                &label,
                &sha,
            ),
            mode_id: "magit-revision-mode".to_string(),
            content: None,
            cursor: None,
            activate_minor: None,
        }),
    }
}

/// The remaining status handlers, split from
/// [`status_action_handlers`] only because `visit_status_line` had to
/// be lifted to module scope between them.
fn status_action_handlers_rest(contributions: &mut Vec<ActionHandlerContribution>) {
    macro_rules! handler {
        ($name:expr, $body:expr) => {
            contributions.push(ActionHandlerContribution {
                action_name: $name,
                handler: Arc::new($body),
            });
        };
    }

    // ── commit (cc) ───────────────────────────────────
    {
        handler!("action:magit-commit", move |ctx: &ActionContext<'_>| {
            let _ = status_state(ctx)?;
            Some(Effect::OpenSyntheticBuffer {
                name: "*magit:commit*".to_string(),
                mode_id: "magit-commit-mode".to_string(),
                content: None,
                cursor: None,
                activate_minor: None,
            })
        });
    }

    // ── commit amend (ca) ─────────────────────────────
    {
        handler!("action:magit-commit-amend", move |ctx: &ActionContext<
            '_,
        >| {
            let _ = status_state(ctx)?;
            Some(Effect::OpenSyntheticBuffer {
                name: "*magit:amend*".to_string(),
                mode_id: "magit-commit-mode".to_string(),
                content: None,
                cursor: None,
                activate_minor: None,
            })
        });
    }

    // ── stage patch (p) ───────────────────────────────
    // `git add -p` is genuinely interactive — it reads its own
    // prompts from stdin, which the TUI's raw-mode input loop already
    // owns. Running it via `Command::output()` (as this handler used
    // to) blocks the single-threaded actor waiting for a child that's
    // also waiting on stdin neither process routes to the other —
    // an indefinite hang, not just a slow blocking call. Until there's
    // a terminal-suspend mechanism (`:!`-style handoff) to route through,
    // fail loudly instead of hanging: stage via `s` (file-level) or
    // expand the diff with `=` and review before staging.
    {
        handler!("action:magit-stage-patch", move |ctx: &ActionContext<
            '_,
        >| {
            let _ = status_state(ctx)?;
            Some(Effect::Echo {
                level: lattice_grammar::EchoLevel::Error,
                text: "magit: interactive `git add -p` isn't supported yet — stage the whole \
                       file with `s`, or expand the diff with `=` to review first"
                    .to_string(),
            })
        });
    }

    // ── refresh (gr) ──────────────────────────────────
    // MG.13: registered once at boot by `magit-core-mode` and
    // dispatched through the status buffer's `MagitView`; see
    // `buffer_state::MagitView` for why it cannot be per-mode.

    // ── toggle diff (=) ───────────────────────────────
    {
        // MG.44: `=` and `<Tab>` are the same operation now — see
        // `toggle_diff_or_fold`.
        handler!("action:magit-toggle-diff", move |ctx: &ActionContext<
            '_,
        >| {
            toggle_diff_or_fold(ctx)
        });
    }

    // ── diff-file (d) — open a dedicated diff buffer scoped to
    // the file at cursor AND its section's baseline (index for
    // Staged, working-tree-vs-index for Unstaged), instead of
    // expanding inline like `=`. See `magit_diff_mode`'s `DiffScope`.
    {
        handler!("action:magit-diff-file", move |ctx: &ActionContext<'_>| {
            let s = status_state(ctx)?;
            let g = s.lock().ok()?;
            let StatusLine::File { path, staged, .. } = classify_line(&g, ctx.cursor.line)? else {
                return None;
            };
            // MR.3b: the scope and the path are this view's `rest`;
            // the repository in front of them comes from the buffer this
            // fired in, which is the status buffer of the repo being
            // diffed.
            let scope = if staged {
                crate::magit_diff_mode::DiffScope::Staged
            } else {
                crate::magit_diff_mode::DiffScope::Unstaged
            };
            Some(crate::magit_global_mode::open_repo_view_from_action_with(
                ctx,
                "diff",
                "magit-diff-mode",
                Some(&crate::magit_diff_mode::diff_view_rest(&scope, Some(&path))),
            ))
        });
    }

    // ── close (q) ─────────────────────────────────────
    // MG.13: removed from here. `action:magit-close` was registered by
    // BOTH this mode (`Effect::BufferDelete`) and `magit-core-mode`
    // (`Effect::DismissPopup`). Same action id ⇒ last registrant won,
    // decided by cascade ordering, so `q` in the status buffer was
    // nondeterministic between "delete the buffer" and "bury it".
    //
    // This is not a behaviour *choice* — `DismissPopup` is the already
    // documented and already tested intent. `magit-core-mode`'s handler
    // records the live-reported bug it fixed (`q` quitting the whole
    // editor), and
    // `lattice-ui-tui`'s `q_on_magit_status_buries_it_and_never_quits_the_editor`
    // asserts that `q` restores the buffer that was active before
    // magit-status opened. The registration here contradicted that
    // test; whenever it won the race the guarantee was simply not in
    // force. Removing it makes the tested behaviour deterministic.

    // ── MG.23h: jump to a section (the `s` row's submenu) ──
    //
    // Fired from the dispatch menu, which by then owns the keystrokes —
    // so the handler reads the buffer that was active when it opened
    // (`ActionContext::buffer_id`), the same seam every other menu row
    // resolves through.
    //
    // The section is found by scanning for its header text rather than
    // by consulting the `SectionIndex`: `]]` / `[[` already locate
    // sections that way, and two mechanisms for "where does this
    // section start" is one more than can stay in agreement. The
    // prefixes come from `sections::SECTION_HEADER_PREFIXES`, which is
    // also what renders them.
    for (action_name, prefix) in [
        ("action:magit-jump-staged", "Staged changes"),
        ("action:magit-jump-unstaged", "Unstaged changes"),
        ("action:magit-jump-untracked", "Untracked files"),
        ("action:magit-jump-stashes", "Stashes"),
        ("action:magit-jump-unmerged", "Unmerged into"),
        ("action:magit-jump-commits", "Recent commits"),
    ] {
        contributions.push(ActionHandlerContribution {
            action_name,
            handler: Arc::new(move |ctx: &ActionContext<'_>| Some(jump_to_section(ctx, prefix))),
        });
    }
}

/// MG.23h: move the cursor to the section whose header starts with
/// `prefix`, or say it isn't there.
///
/// A section with no entries is not rendered at all, so "jump to
/// Stashes" in a repo with no stashes has nothing to land on. Echoing
/// beats leaving the cursor where it was with no explanation — from
/// inside a menu, a row that appears to do nothing reads as broken.
fn jump_to_section(ctx: &ActionContext<'_>, prefix: &str) -> Effect {
    let found = ctx
        .services
        .get::<lattice_mode::BufferStoreHandle>()
        .and_then(|store| store.handle_for(lattice_core::BufferId(ctx.buffer_id.0 as u32)))
        .and_then(|handle| {
            let snap = handle.snapshot();
            (0..snap.buffer.content_line_count()).find(|l| {
                snap.buffer
                    .line(*l)
                    .is_some_and(|t| t.trim_start().starts_with(prefix))
            })
        });
    match found {
        Some(row) => Effect::CursorMove(lattice_protocol::position::Position::new(row, 0)),
        None => Effect::Echo {
            level: lattice_grammar::EchoLevel::Info,
            text: format!("magit: no {prefix} section here"),
        },
    }
}

/// The distinct files the buffer rows `rows` cover, plus the workdir.
///
/// `None` when the selection holds no file entry at all — a range over
/// section headers or commit rows, where staging means nothing. The
/// caller then falls through to the cursor's own entry, which declines
/// the same way it always did.
fn files_in_rows(
    s: &Arc<Mutex<StatusBufferState>>,
    rows: std::ops::RangeInclusive<u32>,
) -> Option<(Vec<PathBuf>, PathBuf)> {
    let g = s.lock().ok()?;
    let paths = distinct_files(rows.map(|line| classify_line(&g, line)));
    if paths.is_empty() {
        return None;
    }
    Some((paths, g.workdir.clone()))
}

/// The distinct file paths in a run of classified rows, in buffer
/// order.
///
/// Pure, because the decisions are here rather than in the lookup
/// around it. **Distinct** matters twice: a file entry and its expanded
/// inline diff are separate rows of the same file, so a selection
/// covering both must not stage it twice; and the same path can appear
/// in the staged *and* unstaged sections at once. **Buffer order**
/// matters because a batch reported in a different order than it is
/// shown is harder to check.
pub(crate) fn distinct_files(lines: impl Iterator<Item = Option<StatusLine>>) -> Vec<PathBuf> {
    let mut paths: Vec<PathBuf> = Vec::new();
    for line in lines.flatten() {
        if let StatusLine::File { path, .. } = line
            && !paths.contains(&path)
        {
            paths.push(path);
        }
    }
    paths
}

/// Run a repository mutation off-thread, report it, then refresh.
///
/// **`mutate` returns a `Result` and that is not incidental.** It used
/// to be `impl FnOnce()`, so every caller wrote
/// `let _ = repo.run_git(...)` and threw the outcome away. Staging,
/// unstaging and discarding therefore finished in total silence — and
/// worse, a *failed* one did too: the buffer refreshed as though it had
/// worked, so the only symptom was a file that stayed where it was.
///
/// Making the closure return `Result<String, String>` moves that from a
/// discipline nobody kept to something the compiler asks for, and
/// [`finish_task`] then logs and publishes in one call. `label` names
/// the operation in the notification, so it is what the user reads —
/// "stage src/main.rs", not an argv.
/// The confirm `x` raises on a file entry.
///
/// **An untracked file is a different act behind the same key**, and
/// the prompt has to say so. "Discard changes to X?" presumes a
/// committed version to go back to; for an untracked file there is
/// none, so the only thing `x` can mean is *delete it*, and git keeps
/// no copy to recover it from. Answering that question wrongly costs
/// the file.
///
/// Pure and separate from the handler for the same reason
/// `picker_sources::branch_checkout_outcome` is: the choice is worth
/// testing directly, and the handler's context fixture is not part of
/// the decision.
/// Every distinct file the selected rows cover, each with whether git
/// tracks it — the discard peer of [`files_in_rows`], which needs only
/// paths because staging treats both kinds alike.
///
/// Discard does not: a tracked file is restored with `git checkout` and an
/// untracked one is *deleted*, and `checkout` fails outright on a path git
/// has no record of. So the flag has to travel with the path.
fn discardable_files_in_rows(
    s: &Arc<Mutex<StatusBufferState>>,
    rows: std::ops::RangeInclusive<u32>,
) -> Option<(Vec<(PathBuf, bool)>, PathBuf)> {
    let g = s.lock().ok()?;
    let mut out: Vec<(PathBuf, bool)> = Vec::new();
    for line in rows.filter_map(|line| classify_line(&g, line)) {
        if let StatusLine::File {
            path, untracked, ..
        } = line
            // Distinct, for `distinct_files`' reasons: a file entry and its
            // expanded inline diff are separate rows of one file, and the
            // same path can sit in the staged and unstaged sections at once.
            && !out.iter().any(|(p, _)| *p == path)
        {
            out.push((path, untracked));
        }
    }
    if out.is_empty() {
        return None;
    }
    Some((out, g.workdir.clone()))
}

/// The question for a multi-file discard, and the list it carries.
///
/// **One question, even for a mixed selection.** The counts are named
/// separately because the two halves are not equally severe — a tracked
/// file comes back from the index, an untracked one does not come back at
/// all — and a prompt that said only "Discard 5 files?" would hide the
/// irreversible half behind the recoverable one.
///
/// Routes to a single batch execute rather than the two single-file halves.
/// Those stay as they are: one action, one act, for a selection of one.
fn batch_discard_confirm(files: &[(PathBuf, bool)]) -> Effect {
    let untracked = files.iter().filter(|(_, u)| *u).count();
    let tracked = files.len() - untracked;
    let prompt = match (tracked, untracked) {
        (0, n) => format!("Delete {n} untracked files? git has no copy to restore."),
        (n, 0) => format!("Discard changes to {n} files?"),
        (t, u) => format!(
            "Discard changes to {t} file(s) and DELETE {u} untracked file(s)? \
             The untracked ones cannot be restored."
        ),
    };
    // IX.2: carry the payload. Each entry is `<flag><path>` — one leading
    // byte for trackedness, so the flag travels with its path. That flag
    // decides `git checkout` versus `git clean`, and losing it would either
    // fail on an untracked path or DELETE a tracked one.
    //
    // **ONE slot holding every entry, not one slot per entry**, and that is
    // the fix for the bug this batch was written to solve reappearing one
    // seam later. `Effect::Confirm` seeds the dialog's transient state by
    // ZIPPING the yes-action's declared schema with the carried list
    // (`seed_transient_state`), so a list longer than the schema is silently
    // truncated. This action declares one slot, `files`, because
    // `TransientValue` is `Bool | String` and a transient slot cannot hold a
    // list at all — so emitting N values meant N-1 of them were dropped
    // between the ask and the act, and selecting three files discarded one.
    //
    // Joined on NUL: the only byte that cannot occur in a POSIX path, so the
    // split is exact for every path git can hand us — including the ones with
    // newlines and spaces that made a per-entry separator unusable in the
    // first place. A Rust `String` holds it fine; it is only paths that cannot.
    let args = lattice_grammar::Args::List(vec![lattice_grammar::ArgValue::String(
        files
            .iter()
            .map(|(path, untracked)| {
                format!(
                    "{}{}",
                    if *untracked { 'u' } else { 't' },
                    path.to_string_lossy()
                )
            })
            .collect::<Vec<_>>()
            .join(BATCH_SEPARATOR),
    )]);
    crate::confirm::ask_with(prompt, "action:magit-discard-batch-execute", args)
}

/// Decode what [`batch_discard_confirm`] carried.
///
/// Takes the ARGS rather than the context so it is a pure function over the
/// payload — the encode/decode pair is the part worth testing, and a test
/// that had to stand up an `ActionContext` would be testing the harness.
/// Separates the entries packed into the batch discard's single carried slot.
///
/// NUL, because it is the one byte a POSIX path cannot contain — every other
/// candidate (newline, tab, any punctuation) is legal in a filename, and git
/// will hand us paths that use them.
const BATCH_SEPARATOR: &str = "\0";

fn carried_batch(args: &lattice_grammar::Args) -> Vec<(PathBuf, bool)> {
    let mut out = Vec::new();
    let entries = match args.as_list() {
        Some(list) => list,
        None => return out,
    };
    // Flattens NUL-joined slots. Written as split-then-flatten rather than
    // "read slot 0 and split it" so the decode is agnostic to how many slots
    // the value arrived in — the ask half packs everything into one because
    // the confirm round trip truncates to the schema's arity, and a decoder
    // that hard-coded that packing would break silently the day the transient
    // state learns to hold a list.
    for entry in entries
        .iter()
        .filter_map(|value| match value {
            lattice_grammar::ArgValue::String(v) | lattice_grammar::ArgValue::Raw(v) => {
                Some(v.as_str())
            }
            _ => None,
        })
        .flat_map(|slot| slot.split(BATCH_SEPARATOR))
    {
        let mut chars = entry.chars();
        match chars.next() {
            Some('u') => out.push((PathBuf::from(chars.as_str()), true)),
            Some('t') => out.push((PathBuf::from(chars.as_str()), false)),
            // Neither flag: not ours. Dropped rather than guessed — a
            // mis-decoded entry here would delete a path nobody named.
            _ => {}
        }
    }
    out
}

fn file_discard_confirm(path: &std::path::Path, untracked: bool) -> Effect {
    let target = path.to_string_lossy().into_owned();
    if untracked {
        return crate::confirm::ask_target(
            format!(
                "Delete untracked file {}? git has no copy to restore.",
                path.display()
            ),
            "action:magit-discard-untracked-execute",
            target,
        );
    }
    crate::confirm::ask_target(
        format!("Discard changes to {}?", path.display()),
        "action:magit-discard-execute",
        target,
    )
}

/// Delete an untracked path, then refresh.
///
/// `git clean -f -d -- <path>` rather than `checkout` or `rm`: those
/// two both address paths git already knows, and this one by
/// definition is not. `-d` is what makes an untracked *directory* row
/// work — `git status` reports one as a single entry when it contains
/// nothing tracked, so the Untracked section shows a directory exactly
/// where it shows a file, and `clean` without `-d` would silently skip
/// it and report success.
///
/// The pathspec is `--`-separated for the usual reason: a path that
/// looks like an option or a ref must not be read as one.
fn spawn_untracked_delete(
    s: Arc<Mutex<StatusBufferState>>,
    workdir: std::path::PathBuf,
    path: PathBuf,
) -> Option<Effect> {
    let shown = path.display().to_string();
    spawn_mutation_and_refresh(s, format!("delete untracked {shown}"), move || {
        let repo =
            Repository::discover(&workdir).map_err(|e| format!("not a git repository: {e}"))?;
        repo.run_git(["clean", "-f", "-d", "--", &path.to_string_lossy()])
            .map(|out| String::from_utf8_lossy(&out).into_owned())
            .map_err(|e| e.to_string())
    })
}

fn spawn_mutation_and_refresh(
    s: Arc<Mutex<StatusBufferState>>,
    label: String,
    mutate: impl FnOnce() -> Result<String, String> + Send + 'static,
) -> Option<Effect> {
    let ctx = refresh_context(&s)?;
    tokio::task::spawn(async move {
        let result = tokio::task::spawn_blocking(mutate)
            .await
            .unwrap_or_else(|e| Err(e.to_string()));
        crate::magit_global_mode::finish_task(&ctx.wd, &label, result);
        // `finish_task` published `BackgroundTaskFinished`, and every
        // live magit-status buffer is subscribed to it — including
        // this one. Refreshing here as well would run `git status`
        // twice per action.
        //
        // The fallback is not defensive padding: a harness that never
        // installed an event bus has no subscriber, and without this
        // the mutation would land with nothing redrawing it.
        if crate::magit_global_mode::event_bus().is_none() {
            run_refresh(ctx).await;
        }
    });
    None
}

/// Everything a refresh needs, read out of the state in one lock.
///
/// MG.18d: gathered into a struct because the list stopped fitting a
/// tuple once the refresh had to carry the open entries, the cursor
/// restore and the bus to answer on.
struct RefreshContext {
    handle: Arc<dyn lattice_runtime::Document>,
    wd: PathBuf,
    pending: Option<Arc<PendingSyntheticHighlights>>,
    bid: BufferId,
    headerline: Option<crate::headerline::MagitHeaderlineHandle>,
    /// Entry keys whose diffs must come back expanded.
    open: std::collections::HashSet<String>,
    restore: Option<crate::cursor_restore::HunkRestore>,
    cursor_bus: Option<crate::cursor_restore::CursorBusHandle>,
    /// MG.22b: `magit.hunk.context-lines`, snapshotted with the rest of
    /// the refresh inputs.
    context: i64,
    /// DS-fix (2026-08-12): the grammar registry the reopened
    /// expansions highlight through, snapshotted with the rest of the
    /// refresh inputs and resolved through the SAME
    /// `hunk_syntax::syntax_registry` gate the `=` toggle uses — so the
    /// `magit.hunk.syntax-highlight` option means one thing on both
    /// routes.
    lang_registry: Option<Arc<lattice_syntax::LangRegistry>>,
    state: Arc<Mutex<StatusBufferState>>,
}

/// Snapshot the refresh inputs. Takes `pending_cursor` — a restore is
/// consumed by the refresh it was queued for, so a later `gr` does not
/// re-apply a stale jump.
/// `magit.hunk.context-lines`, or git's own default when there is no
/// config registry (a stripped harness).
pub(crate) fn context_lines(config: &Option<Arc<lattice_config::ConfigRegistry>>) -> i64 {
    config
        .as_ref()
        .and_then(|c| c.get_typed::<crate::options::MagitHunkContextLines>())
        .map(|v| *v)
        .unwrap_or(3)
}

fn refresh_context(s: &Arc<Mutex<StatusBufferState>>) -> Option<RefreshContext> {
    let mut g = s.lock().ok()?;
    let handle = g.store.handle_for(g.buffer_id)?;
    let restore = g.pending_cursor.take();
    Some(RefreshContext {
        handle,
        wd: g.workdir.clone(),
        pending: g.pending_highlights.clone(),
        bid: g.buffer_id,
        headerline: g.headerline.clone(),
        // MG.18d: the keys survive the rebuild — `build_and_format`
        // re-runs their diffs and inlines them, rather than the buffer
        // coming back collapsed and the map being cleared to match.
        open: g.expanded.keys().cloned().collect(),
        restore,
        cursor_bus: g.cursor_bus.clone(),
        context: context_lines(&g.config),
        lang_registry: crate::hunk_syntax::syntax_registry(
            g.lang_registry.clone(),
            g.config.as_ref(),
        ),
        state: Arc::clone(s),
    })
}

async fn run_refresh(ctx: RefreshContext) {
    do_refresh(
        ctx.handle,
        ctx.wd,
        ctx.pending,
        ctx.bid,
        ctx.headerline,
        ctx.open,
        ctx.restore,
        ctx.cursor_bus,
        ctx.context,
        ctx.lang_registry,
        ctx.state,
    )
    .await;
}

/// Refresh the status buffer: blocking `git status`/`stash
/// list`/`log` on `spawn_blocking`, then apply the formatted text +
/// highlights on the current task.
///
/// MG.13: lifted to module scope (was nested in
/// `register_action_handlers`) so [`trigger_refresh`] can reach it
/// from the boot-registered `gr` path.
///
/// MG.18d: `open` names the entries whose diffs must come back
/// expanded, and the rebuilt text carries them — a refresh no longer
/// throws away what you had open. `restore` (set only by a mutation)
/// then resolves the cursor against that same text, so the entry and
/// the position agree by construction rather than by two lookups
/// against a buffer in motion.
#[allow(clippy::too_many_arguments)]
async fn do_refresh(
    handle: Arc<dyn lattice_runtime::Document>,
    wd: PathBuf,
    pending: Option<Arc<PendingSyntheticHighlights>>,
    bid: BufferId,
    headerline: Option<crate::headerline::MagitHeaderlineHandle>,
    open: std::collections::HashSet<String>,
    restore: Option<crate::cursor_restore::HunkRestore>,
    cursor_bus: Option<crate::cursor_restore::CursorBusHandle>,
    context: i64,
    lang_registry: Option<Arc<lattice_syntax::LangRegistry>>,
    state: Arc<Mutex<StatusBufferState>>,
) {
    // MG.27: the row says "refreshing" for the whole of this function,
    // cleared by the guard's drop — including if the `spawn_blocking`
    // below panics or the task is cancelled when the buffer closes.
    let _busy = crate::headerline::busy(&headerline);
    let (text, spans, header, reopened, refine) = tokio::task::spawn_blocking(move || {
        refresh::build_and_format(&wd, &open, context, lang_registry.as_ref())
    })
    .await
    .expect("spawn_blocking");
    // MG.14: publish before the edit — the header describes the state
    // the body is about to show, and `set` is a comparison plus (at
    // most) one atomic, nowhere near the edit's cost.
    crate::headerline::publish(&headerline, header);
    // The expansion bookkeeping describes the text about to be written,
    // so it is replaced (not merged): an entry that vanished from the
    // status output has no rows to collapse later.
    if let Ok(mut g) = state.lock() {
        g.expanded = reopened;
    }
    // Resolved against the text rather than the buffer — the buffer is
    // about to become this text, and reading it back would race the
    // very edit being applied.
    let position = restore.and_then(|r| crate::cursor_restore::restore_position(&text, &r));
    refresh::apply_and_highlight_refined(handle, text, spans, refine, pending, bid).await;
    // Sent AFTER the replace lands: a cursor delivered first would be
    // clamped against the outgoing content. The send wakes the editor,
    // so the cursor arrives without the user touching a key
    // (`boot-composition.md` §3).
    if let Some(position) = position {
        crate::cursor_restore::send_cursor(&cursor_bus, bid, position);
    }
}

/// `gr` — bare refresh of the status buffer, no prior mutation.
///
/// MG.13: a free function (not a closure inside
/// `register_action_handlers`) because the `gr` handler is now
/// registered once at boot by `magit-core-mode` and reaches this
/// through [`StatusView`]; see `buffer_state::MagitView`.
pub fn trigger_refresh(s: Arc<Mutex<StatusBufferState>>) -> Option<Effect> {
    let ctx = refresh_context(&s)?;
    tokio::task::spawn(run_refresh(ctx));
    None::<Effect>
}

/// The status buffer's `MagitView` — supplies `gr`'s body for buffers
/// `magit-status-mode` owns.
pub struct StatusView(pub Arc<Mutex<StatusBufferState>>);

impl crate::buffer_state::MagitView for StatusView {
    /// MG.22: magit-status's `<CR>` — the reason `visit_at_cursor`
    /// exists on the trait at all.
    ///
    /// `magit-hunk-mode` owns the chord now, but here it must keep
    /// resolving rows that are not diff content: a staged file opens
    /// its index blob, an unstaged one the live file, a stash toggles
    /// its inline patch, a commit opens its buffer. Returning `None`
    /// for anything `classify_line` does not recognise is what lets
    /// the caller fall through to diff-path resolution — and what
    /// keeps it from resolving a row against a *previous* entry's
    /// expanded diff.
    fn visit_at_cursor(&self, cursor: lattice_protocol::position::Position) -> Option<Effect> {
        visit_status_line(&self.0, cursor.line)
    }

    /// MG.20: the commit on the Recent-commits row under the cursor.
    /// File and stash rows correctly yield `None`, so `V` on a staged
    /// file does nothing rather than reverting an unrelated commit.
    fn commit_at_cursor(&self, cursor: lattice_protocol::position::Position) -> Option<String> {
        let g = self.0.lock().ok()?;
        let handle = g.store.handle_for(g.buffer_id)?;
        let snap = handle.snapshot();
        let line = snap.buffer.line(cursor.line)?;
        // A Recent-commits row is `"  <sha> <subject>"`; every other
        // row kind (file entries carry a status label, stashes carry
        // `stash@{`) fails the hex test.
        let tok = line.split_whitespace().next()?;
        (tok.len() >= 4 && tok.chars().all(|c| c.is_ascii_hexdigit())).then(|| tok.to_string())
    }

    /// The stash on the Stashes row under the cursor.
    ///
    /// magit-status renders these with the SAME `"  stash@{N} msg"`
    /// row `magit-stash-mode`'s list uses (`sections.rs` and
    /// `magit_stash_mode::list_row`), so both views share one parser
    /// rather than growing a second idea of the format. File and
    /// commit rows fail the `stash@{` prefix and correctly yield
    /// `None`, so `p` on a staged file pops nothing.
    fn stash_at_cursor(&self, cursor: lattice_protocol::position::Position) -> Option<usize> {
        let g = self.0.lock().ok()?;
        let handle = g.store.handle_for(g.buffer_id)?;
        let snap = handle.snapshot();
        let line = snap.buffer.line(cursor.line)?;
        crate::magit_stash_mode::parse_index(&line)
    }

    fn workdir(&self) -> Option<std::path::PathBuf> {
        Some(self.0.lock().ok()?.workdir.clone())
    }

    /// MG.18c: the section an inline diff was expanded under says
    /// which tree it was diffed against — `run_show` passes
    /// `--cached` for a Staged entry and nothing for an Unstaged one,
    /// so the header the diff sits below is the same fact, already on
    /// screen.
    ///
    /// Stashes and commits expand patches too, and those belong to
    /// neither the index nor the worktree; `None` refuses hunk staging
    /// there rather than applying a commit's diff to the index.
    /// MG.50: `<CR>` inside an inline diff.
    ///
    /// This was the one view with no answer — `<CR>` in a magit-status
    /// hunk fell to the trait default and did nothing at all, while the
    /// same key in magit-diff or a revision opened the file.
    ///
    /// Which version to open is the SECTION's question, not the
    /// buffer's: a status buffer holds staged and unstaged diffs at
    /// once, and they describe different content. `diff_source` already
    /// answers it from the header above the cursor — the same seam
    /// `s` / `u` / `x` use to decide which tree a hunk applies to, so
    /// the version `<CR>` shows and the tree a hunk stages to can never
    /// disagree.
    fn diff_target(&self, path: &std::path::Path, cursor: Position) -> Option<Effect> {
        // MR.3b: the repository this buffer is showing, from its own
        // name — the blob buffer must open the file in THAT checkout.
        let label = {
            let g = self.0.lock().ok()?;
            crate::repo_scope::label_of_buffer(&g.store, g.buffer_id)
        };
        match self.diff_source(cursor)? {
            // Staged: the index blob, which is what the diff describes.
            // The working-tree file may have moved on since.
            DiffSource::Staged => Some(Effect::OpenSyntheticBuffer {
                name: crate::magit_file_revision_mode::blob_buffer_name(&label, "staged", path),
                mode_id: "magit-file-revision-mode".to_string(),
                content: None,
                cursor: None,
                activate_minor: None,
            }),
            // Unstaged (and untracked): the diff IS against the working
            // tree, so that file is the thing being described.
            DiffSource::Unstaged => {
                let full = self.0.lock().ok()?.workdir.join(path);
                full.exists().then_some(Effect::OpenBuffer {
                    path: Some(full),
                    force: false,
                })
            }
            // A commit's patch, expanded inline under its Recent-commits
            // row. THAT row names the revision, and it is the only place
            // the sha exists — the patch text below it does not repeat
            // it. So walk up to the entry this content was expanded
            // under, exactly as the fold source does to find an
            // expansion's extent.
            //
            // A stash's patch resolves to no sha and declines rather
            // than guessing a revision.
            DiffSource::Committed => {
                let g = self.0.lock().ok()?;
                let sha = (0..=cursor.line).rev().find_map(|l| {
                    match classify_line(&g, l) {
                        Some(StatusLine::Commit { sha }) => Some(sha),
                        // Any other classified entry means the walk left
                        // this patch without finding a commit.
                        Some(_) => None,
                        None => None,
                    }
                })?;
                Some(Effect::OpenSyntheticBuffer {
                    name: crate::magit_file_revision_mode::blob_buffer_name(&label, &sha, path),
                    mode_id: "magit-file-revision-mode".to_string(),
                    content: None,
                    cursor: None,
                    activate_minor: None,
                })
            }
        }
    }

    fn diff_source(&self, cursor: Position) -> Option<DiffSource> {
        let g = self.0.lock().ok()?;
        diff_source_for_header(&section_header_above(&g, cursor.line)?)
    }

    fn refresh(&self) -> Option<Effect> {
        trigger_refresh(self.0.clone())
    }

    /// MG.18d: queue the restore, then refresh. The refresh consumes it
    /// once it holds the rebuilt text — see [`refresh_context`].
    fn refresh_restoring(&self, site: crate::cursor_restore::HunkSite) -> Option<Effect> {
        if let Ok(mut g) = self.0.lock() {
            // A status buffer's landmark is the entry row; its section
            // is what `staged` selects between, since one path can be
            // listed under both.
            g.pending_cursor = Some(site.as_status_entry());
        }
        trigger_refresh(self.0.clone())
    }

    /// `s` — stage the file on the status entry line at `cursor`.
    fn stage(&self, cursor: Position) -> Option<Effect> {
        let s = self.0.clone();
        let (path, workdir) = {
            let g = s.lock().ok()?;
            let StatusLine::File { path, .. } = classify_line(&g, cursor.line)? else {
                return None;
            };
            (path, g.workdir.clone())
        };
        spawn_mutation_and_refresh(s, format!("stage {}", path.display()), move || {
            let repo =
                Repository::discover(&workdir).map_err(|e| format!("not a git repository: {e}"))?;
            Index::stage_path(&repo, &path)
                .map(|()| String::new())
                .map_err(|e| e.to_string())
        })
    }

    /// Every distinct file the selected rows cover, staged in ONE task
    /// with ONE refresh.
    ///
    /// Distinct because a file entry and its expanded inline diff are
    /// separate rows of the same file — a selection over both must not
    /// stage it twice — and because the same path can appear in both
    /// the staged and unstaged sections.
    fn stage_rows(&self, rows: std::ops::RangeInclusive<u32>) -> Option<Effect> {
        let s = self.0.clone();
        let (paths, workdir) = files_in_rows(&s, rows)?;
        spawn_mutation_and_refresh(s, format!("stage {} files", paths.len()), move || {
            let repo =
                Repository::discover(&workdir).map_err(|e| format!("not a git repository: {e}"))?;
            // ONE `git add` with every path, not one per file. N commands
            // meant N process spawns and N `.git/index.lock` cycles — and
            // a partial batch, which is why this used to report "3 of 5
            // staged". One command is atomic: it stages all of them or
            // none, and there is no half-outcome left to describe.
            Index::stage_paths(&repo, paths.iter())
                .map(|()| String::new())
                .map_err(|e| e.to_string())
        })
        // `Some` because the work was HANDLED, even though there is no
        // synchronous effect to return.
        //
        // `spawn_mutation_and_refresh` always returns `None` — it spawns
        // and has nothing to hand back — and the caller reads `None` as
        // "this did not apply, try the fallback":
        //
        //     rows.and_then(|r| view.stage_rows(r))
        //         .or_else(|| view.stage(ctx.cursor))
        //
        // so a visual-mode stage span the batch AND a second `git add`
        // for the cursor's file, concurrently. They raced on
        // `.git/index.lock` and the single one lost, which is how a
        // selection that staged correctly still reported
        // "stage <file> failed: Unable to create index.lock"
        // (2026-08-16).
        //
        // The `?` on `files_in_rows` above keeps `None` meaning the one
        // thing the fallback should react to: the selection covers no
        // files.
        .or(Some(Effect::None))
    }

    fn unstage_rows(&self, rows: std::ops::RangeInclusive<u32>) -> Option<Effect> {
        let s = self.0.clone();
        let (paths, workdir) = files_in_rows(&s, rows)?;
        spawn_mutation_and_refresh(s, format!("unstage {} files", paths.len()), move || {
            let repo =
                Repository::discover(&workdir).map_err(|e| format!("not a git repository: {e}"))?;
            // One `git reset` with every path — see `stage_rows`.
            Index::unstage_paths(&repo, paths.iter())
                .map(|()| String::new())
                .map_err(|e| e.to_string())
        })
        // Handled — see `stage_rows` for why this is `Some`.
        .or(Some(Effect::None))
    }

    fn unstage(&self, cursor: Position) -> Option<Effect> {
        let s = self.0.clone();
        let (path, original_path, workdir) = {
            let g = s.lock().ok()?;
            let StatusLine::File {
                path,
                original_path,
                ..
            } = classify_line(&g, cursor.line)?
            else {
                return None;
            };
            (path, original_path, g.workdir.clone())
        };
        spawn_mutation_and_refresh(s, format!("unstage {}", path.display()), move || {
            let repo =
                Repository::discover(&workdir).map_err(|e| format!("not a git repository: {e}"))?;
            // A rename is two index entries; both have to be reset or
            // the old path stays staged-deleted. See `unstage_paths`.
            let mut targets = vec![path.clone()];
            targets.extend(original_path.clone());
            Index::unstage_paths(&repo, &targets)
                .map(|()| String::new())
                .map_err(|e| e.to_string())
        })
    }
}

#[cfg(test)]
mod diff_toggle_tests {
    use super::DiffToggle;

    /// **An entry that has rows folds; it never re-fetches.**
    ///
    /// This is the regression the slice exists to prevent. The old
    /// behaviour spliced the diff out of the buffer, so pressing `=`
    /// twice meant two `git diff` runs and threw away text the buffer
    /// already had. Any future change that maps a present expansion
    /// back to `Fetch` reintroduces exactly that.
    #[test]
    fn an_expanded_entry_folds_rather_than_refetching() {
        assert_eq!(DiffToggle::for_state(Some(12)), DiffToggle::Fold);
        assert_eq!(DiffToggle::for_state(Some(1)), DiffToggle::Fold);
    }

    /// Nothing fetched yet is the only state that runs git.
    #[test]
    fn only_an_unfetched_entry_runs_git() {
        assert_eq!(DiffToggle::for_state(None), DiffToggle::Fetch);
    }

    /// A zero-row expansion has nothing to hide, so folding it would
    /// be a no-op the user reads as a dead key. It is forgotten
    /// instead, which lets the next press fetch again.
    #[test]
    fn a_zero_row_expansion_is_dropped_not_folded() {
        assert_eq!(DiffToggle::for_state(Some(0)), DiffToggle::Drop);
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn header(s: &str) -> impl FnOnce() -> Option<String> + '_ {
        move || Some(s.to_string())
    }

    fn file(path: &str, staged: bool) -> Option<StatusLine> {
        Some(StatusLine::File {
            path: PathBuf::from(path),
            staged,
            untracked: false,
            original_path: None,
        })
    }

    /// A Visual selection over several entries stages all of them, in
    /// the order the buffer shows.
    #[test]
    fn a_selection_collects_every_file_it_covers_in_buffer_order() {
        let rows = [
            file("src/a.rs", false),
            file("src/b.rs", false),
            file("src/c.rs", false),
        ];
        assert_eq!(
            distinct_files(rows.into_iter()),
            vec![
                PathBuf::from("src/a.rs"),
                PathBuf::from("src/b.rs"),
                PathBuf::from("src/c.rs")
            ]
        );
    }

    /// A file entry and its expanded inline diff are separate rows of
    /// the SAME file. A selection over both must stage it once — twice
    /// is not harmless when the second call runs against a tree the
    /// first already changed.
    #[test]
    fn an_expanded_entry_is_not_staged_twice() {
        let rows = [
            file("src/a.rs", false),
            file("src/a.rs", false),
            file("src/b.rs", false),
        ];
        assert_eq!(
            distinct_files(rows.into_iter()),
            vec![PathBuf::from("src/a.rs"), PathBuf::from("src/b.rs")]
        );
    }

    /// The same path can sit in the staged AND unstaged sections at
    /// once — a partially-staged file. A selection spanning both is
    /// still one path.
    #[test]
    fn a_partially_staged_file_appearing_twice_is_still_one_path() {
        let rows = [file("src/a.rs", true), file("src/a.rs", false)];
        assert_eq!(
            distinct_files(rows.into_iter()),
            vec![PathBuf::from("src/a.rs")]
        );
    }

    /// Rows that are not files — section headers, commit rows, blanks —
    /// contribute nothing, so a selection over them declines and the
    /// caller falls back to the cursor's own entry.
    #[test]
    fn non_file_rows_contribute_nothing() {
        let rows = [
            None,
            Some(StatusLine::Commit {
                sha: "a1b2c3d".into(),
            }),
            Some(StatusLine::Stash { index: 0 }),
        ];
        assert!(distinct_files(rows.into_iter()).is_empty());
    }

    /// MG.18c — the header a hunk sits under decides which tree its
    /// patch applies to. Getting this backwards would send an
    /// unstaged hunk through `u` (git refuses, harmless) or a staged
    /// one through `x` (reverses it out of the worktree while leaving
    /// it staged — the half-state the gate exists to prevent).
    #[test]
    fn section_headers_map_to_the_tree_their_diffs_came_from() {
        assert_eq!(
            diff_source_for_header("Staged changes (2)"),
            Some(DiffSource::Staged)
        );
        assert_eq!(
            diff_source_for_header("Unstaged changes (3)"),
            Some(DiffSource::Unstaged)
        );
        assert_eq!(
            diff_source_for_header("Untracked files (1)"),
            Some(DiffSource::Unstaged),
            "`s` on an untracked file is `git add` — the worktree side"
        );
    }

    /// A commit's or stash's inline patch belongs to neither the index
    /// nor the worktree. `None` refuses hunk staging there rather than
    /// applying a commit's diff to the index.
    #[test]
    fn commit_and_stash_sections_have_no_stageable_source() {
        assert_eq!(diff_source_for_header("Recent commits"), None);
        assert_eq!(diff_source_for_header("Stashes (2)"), None);
    }

    fn no_header() -> impl FnOnce() -> Option<String> {
        || None
    }

    // ── audit fix: collapse deleted the following entry's text ──
    // ── audit fix: the "new file" (two-word) label bug ──────────

    #[test]
    fn staged_new_file_entry_classifies_with_full_path() {
        // Root cause of the u / =-on-staged bugs: the old
        // `parse_file_path` split on the first space and got the
        // "file" half of the "new file" label instead of the path.
        let line = format!("  {:<12} {}", "new file", "src/lib.rs");
        let sl = classify_line_text(&line, header("Staged changes (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("src/lib.rs"),
                staged: true,
                untracked: false,
                original_path: None,
            })
        );
    }

    #[test]
    fn unstaged_modified_entry_classifies_as_not_staged() {
        let line = format!("  {:<12} {}", "modified", "src/main.rs");
        let sl = classify_line_text(&line, header("Unstaged changes (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("src/main.rs"),
                staged: false,
                untracked: false,
                original_path: None,
            })
        );
    }

    /// `x` on an untracked entry must ask a different question and
    /// route to a different command.
    ///
    /// The bug: both paths ran `git checkout -- <path>`, which fails on
    /// a path git has no record of — "pathspec 'test' did not match any
    /// file(s) known to git" — so `x` on an untracked file reported a
    /// git error and deleted nothing. The prompt was wrong too: it
    /// offered to discard *changes* to a file that has no committed
    /// version, when the only available act is deleting it outright.
    #[test]
    fn discarding_an_untracked_file_asks_to_delete_it_not_to_revert_it() {
        let tracked = file_discard_confirm(&PathBuf::from("src/main.rs"), false);
        let untracked = file_discard_confirm(&PathBuf::from("test"), true);

        let (t_prompt, t_yes) = match tracked {
            Effect::Confirm {
                prompt, yes_action, ..
            } => (prompt, yes_action),
            other => panic!("expected Confirm, got {other:?}"),
        };
        let (u_prompt, u_yes) = match untracked {
            Effect::Confirm {
                prompt, yes_action, ..
            } => (prompt, yes_action),
            other => panic!("expected Confirm, got {other:?}"),
        };

        assert_eq!(t_prompt, "Discard changes to src/main.rs?");
        assert_eq!(t_yes, "action:magit-discard-execute");

        assert!(
            u_prompt.starts_with("Delete untracked file test?"),
            "the prompt must name deletion — there are no changes to \
             discard on a file git has never seen: {u_prompt:?}"
        );
        assert!(
            u_prompt.contains("no copy"),
            "and must say the deletion is unrecoverable: {u_prompt:?}"
        );
        assert_ne!(
            u_yes, t_yes,
            "the untracked path must not reach `git checkout --`, which \
             fails outright on a path git has no record of"
        );
        assert_eq!(u_yes, "action:magit-discard-untracked-execute");
    }

    #[test]
    fn untracked_file_entry_classifies_as_untracked_and_not_staged() {
        let line = format!("  {:<12} {}", "untracked", "notes.txt");
        let sl = classify_line_text(&line, header("Untracked files (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("notes.txt"),
                staged: false,
                untracked: true,
                original_path: None,
            })
        );
    }

    #[test]
    fn deleted_entry_classifies_correctly() {
        let line = format!("  {:<12} {}", "deleted", "old.rs");
        let sl = classify_line_text(&line, header("Unstaged changes (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("old.rs"),
                staged: false,
                untracked: false,
                original_path: None,
            })
        );
    }

    /// Every label a status row can carry must round-trip back to its
    /// path — including the multi-word unmerged ones.
    ///
    /// The trap this pins: labels are matched as PREFIXES, and
    /// `"deleted"` is a prefix of `"deleted by us"`. In declaration
    /// order, a `deleted by us` row matched `"deleted"`, left
    /// `" by us   path"` (whitespace-led, so the guard passed) and
    /// parsed the path as `"by us   path"` — a file that does not
    /// exist, so staging or visiting it would silently miss. Matching
    /// longest-first is what makes this correct, which is why it is
    /// asserted over the whole label set rather than one example.
    #[test]
    fn every_label_round_trips_to_its_path() {
        for label in FILE_LABELS {
            let line = format!(
                "  {label:<width$} {path}",
                width = crate::sections::LABEL_WIDTH,
                path = "src/deep/path.rs"
            );
            let sl = classify_line_text(&line, header("Unstaged changes (1)"));
            assert_eq!(
                sl,
                Some(StatusLine::File {
                    path: PathBuf::from("src/deep/path.rs"),
                    staged: false,
                    untracked: label == "untracked",
                    original_path: None,
                }),
                "label {label:?} must yield the path, not a fragment of its own text"
            );
        }
    }

    /// A rename row renders `old -> new`, and classification must
    /// return the NEW path (what every action targets) while keeping
    /// the origin — unstaging needs both, or the old path stays
    /// staged-deleted.
    #[test]
    fn a_rename_row_yields_the_new_path_and_keeps_its_origin() {
        let line = format!(
            "  {label:<width$} {path}",
            label = "renamed",
            width = crate::sections::LABEL_WIDTH,
            path = "docs/old name.md -> docs/new name.md"
        );
        let sl = classify_line_text(&line, header("Staged changes (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("docs/new name.md"),
                staged: true,
                untracked: false,
                original_path: Some(PathBuf::from("docs/old name.md")),
            })
        );
    }

    /// ` -> ` is legal in a filename, so the split is from the RIGHT:
    /// the new path is whatever follows the LAST separator.
    #[test]
    fn a_rename_splits_from_the_right() {
        let line = format!(
            "  {label:<width$} {path}",
            label = "renamed",
            width = crate::sections::LABEL_WIDTH,
            path = "a -> b.txt -> c.txt"
        );
        match classify_line_text(&line, header("Staged changes (1)")) {
            Some(StatusLine::File {
                path,
                original_path,
                ..
            }) => {
                assert_eq!(path, PathBuf::from("c.txt"));
                assert_eq!(original_path, Some(PathBuf::from("a -> b.txt")));
            }
            other => panic!("expected a File row, got {other:?}"),
        }
    }

    /// Only rename / copy rows carry the arrow form — a MODIFIED file
    /// whose name happens to contain ` -> ` keeps its whole name.
    #[test]
    fn only_rename_rows_split_on_the_arrow() {
        let line = format!(
            "  {label:<width$} {path}",
            label = "modified",
            width = crate::sections::LABEL_WIDTH,
            path = "weird -> name.txt"
        );
        match classify_line_text(&line, header("Unstaged changes (1)")) {
            Some(StatusLine::File {
                path,
                original_path,
                ..
            }) => {
                assert_eq!(path, PathBuf::from("weird -> name.txt"));
                assert_eq!(original_path, None);
            }
            other => panic!("expected a File row, got {other:?}"),
        }
    }

    /// A path containing a label word must not be mistaken for one.
    #[test]
    fn a_path_that_looks_like_a_label_is_still_a_path() {
        let line = format!(
            "  {label:<width$} {path}",
            label = "modified",
            width = crate::sections::LABEL_WIDTH,
            path = "deleted by us.txt"
        );
        let sl = classify_line_text(&line, header("Unstaged changes (1)"));
        assert_eq!(
            sl,
            Some(StatusLine::File {
                path: PathBuf::from("deleted by us.txt"),
                staged: false,
                untracked: false,
                original_path: None,
            })
        );
    }

    // ── stash / commit entries — <CR> previously no-op'd on both ──

    #[test]
    fn stash_entry_classifies_by_index() {
        let sl = classify_line_text("  stash@{2} WIP on main: 1234abc msg", no_header());
        assert_eq!(sl, Some(StatusLine::Stash { index: 2 }));
    }

    #[test]
    fn commit_entry_classifies_sha_under_recent_commits_header() {
        let sl = classify_line_text("  a1b2c3d Fix the thing", header("Recent commits (20)"));
        assert_eq!(
            sl,
            Some(StatusLine::Commit {
                sha: "a1b2c3d".to_string(),
            })
        );
    }

    /// The unmerged section renders identical commit rows, so `<CR>`
    /// must work there too. Without this the same row would be live
    /// under one heading and inert under the other — a difference the
    /// user cannot see and would read as a bug.
    #[test]
    fn commit_entry_classifies_sha_under_the_unmerged_header() {
        let sl = classify_line_text(
            "  a1b2c3d Fix the thing",
            header("Unmerged into origin/main (3)"),
        );
        assert_eq!(
            sl,
            Some(StatusLine::Commit {
                sha: "a1b2c3d".to_string(),
            })
        );
    }

    /// The unmerged section shows commits, which have no file diff to
    /// expand — same as recent commits and stashes.
    #[test]
    fn the_unmerged_header_has_no_diff_source() {
        assert_eq!(
            diff_source_for_header("Unmerged into origin/main (3)"),
            None
        );
    }

    #[test]
    fn commit_like_line_outside_recent_commits_header_is_not_a_commit() {
        // Guards against misclassifying arbitrary indented text as a
        // commit entry when it isn't actually under that section.
        let sl = classify_line_text("  a1b2c3d Fix the thing", header("Stashes (1)"));
        assert_eq!(sl, None);
    }

    // ── non-entry lines ──────────────────────────────────────────

    #[test]
    fn section_header_line_is_not_an_entry() {
        assert_eq!(classify_line_text("Staged changes (2)", no_header()), None);
    }

    #[test]
    fn blank_line_is_not_an_entry() {
        assert_eq!(classify_line_text("", no_header()), None);
    }

    #[test]
    fn no_changes_message_is_not_an_entry() {
        assert_eq!(
            classify_line_text("No changes (working tree clean)", no_header()),
            None
        );
    }

    // ── entry_key: Conflicted-file staged/unstaged collision fix ──

    #[test]
    fn entry_key_distinguishes_staged_and_unstaged_rows_for_the_same_path() {
        // A Conflicted file appears in BOTH sections at once
        // (refresh::build_section_index); the two rows must map to
        // distinct expansion-tracking keys or expanding one would
        // make `toggle_expand` treat the other as already-expanded.
        let staged = StatusLine::File {
            path: PathBuf::from("conflict.rs"),
            staged: true,
            untracked: false,
            original_path: None,
        };
        let unstaged = StatusLine::File {
            path: PathBuf::from("conflict.rs"),
            staged: false,
            untracked: false,
            original_path: None,
        };
        assert_ne!(entry_key(&staged), entry_key(&unstaged));
    }

    #[test]
    fn entry_key_stable_for_same_status_line() {
        let a = StatusLine::Stash { index: 3 };
        let b = StatusLine::Stash { index: 3 };
        assert_eq!(entry_key(&a), entry_key(&b));
    }
}

/// MG.31: the inline `=` expansion's git call belongs on the blocking
/// pool, not the actor thread.
#[cfg(test)]
mod expand_payload_tests {
    use super::*;
    use lattice_cells::style::Style;
    use std::process::Command;
    use std::time::{Duration, Instant};

    fn git_ok(dir: &Path, args: &[&str]) {
        let st = Command::new("git")
            .args(args)
            .current_dir(dir)
            .status()
            .expect("git");
        assert!(st.success(), "git {args:?} failed");
    }

    /// A repo with one tracked file whose working tree differs from
    /// HEAD in `changed` lines. `changed` drives how long `git diff`
    /// takes, which is what the responsiveness probe below needs.
    fn repo_with_modified_file(lines: usize) -> tempfile::TempDir {
        let dir = tempfile::tempdir().expect("tempdir");
        let p = dir.path();
        git_ok(p, &["init"]);
        git_ok(p, &["config", "user.email", "t@lattice.dev"]);
        git_ok(p, &["config", "user.name", "lattice-test"]);
        let base: String = (1..=lines).map(|i| format!("line {i}\n")).collect();
        std::fs::write(p.join("a.txt"), &base).expect("write base");
        git_ok(p, &["add", "a.txt"]);
        git_ok(p, &["commit", "-m", "base"]);
        // Every line differs, so the diff is proportional to `lines`.
        let modified: String = (1..=lines).map(|i| format!("line {i} CHANGED\n")).collect();
        std::fs::write(p.join("a.txt"), &modified).expect("write modified");
        dir
    }

    fn unstaged(path: &str) -> StatusLine {
        StatusLine::File {
            path: PathBuf::from(path),
            staged: false,
            untracked: false,
            original_path: None,
        }
    }

    /// DS.3 end-to-end: with a grammar registry, the code inside an
    /// inline-expanded diff carries syntax spans UNDER the diff layer.
    ///
    /// Goes through `expand_payload` — the real path `=` takes — rather
    /// than calling the span builder directly, because the thing worth
    /// pinning is that the registry actually reaches it.
    #[test]
    fn an_expanded_diff_carries_syntax_under_the_diff_layer() {
        use lattice_cells::style::Style;

        let dir = tempfile::tempdir().expect("tempdir");
        let p = dir.path();
        git_ok(p, &["init"]);
        git_ok(p, &["config", "user.email", "t@lattice.dev"]);
        git_ok(p, &["config", "user.name", "lattice-test"]);
        std::fs::write(p.join("a.rs"), "fn main() {}\n").expect("write base");
        git_ok(p, &["add", "a.rs"]);
        git_ok(p, &["commit", "-m", "base"]);
        std::fs::write(p.join("a.rs"), "fn main() {\n    let x = 1;\n}\n").expect("write");

        let registry = lattice_syntax::LangRegistry::standard().expect("registry");
        let rt = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .expect("runtime");
        let (text, _, spans, _) = rt
            .block_on(expand_payload(
                p.to_path_buf(),
                unstaged("a.rs"),
                3,
                Some(registry),
            ))
            .expect("a modified tracked file has a diff");

        let added = text
            .lines()
            .position(|l| l.starts_with("+    let x"))
            .expect("the added line is in the diff");
        let style_at = |byte: usize| {
            spans[added]
                .iter()
                .find(|s| byte >= s.start && byte < s.end)
                .map(|s| s.style)
        };
        assert_eq!(
            style_at(0),
            Some(Style::DiffAdd),
            "the `+` column stays diff-coloured, which is also what the \
             sign map reads to tint the row"
        );
        let code = style_at(5);
        assert!(
            code.is_some() && code != Some(Style::DiffAdd),
            "the code past the marker must resolve to a syntax style, got {code:?}"
        );
    }

    /// The relocation must not change what the caller receives: the
    /// trimmed diff text, its line count, and one span row per line.
    #[test]
    fn returns_the_diff_its_line_count_and_a_span_row_per_line() {
        let dir = repo_with_modified_file(20);
        let rt = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .expect("runtime");
        let (text, line_count, spans, _) = rt
            .block_on(expand_payload(
                dir.path().to_path_buf(),
                unstaged("a.txt"),
                3,
                None,
            ))
            .expect("a modified tracked file has a diff");

        assert!(text.starts_with("diff --git"), "got: {text:?}");
        assert_eq!(line_count, text.lines().count());
        assert_eq!(
            spans.len(),
            line_count,
            "one span row per line, or the highlight splice misaligns"
        );
        assert!(
            spans
                .iter()
                .any(|row| row.iter().any(|s| s.style == Style::DiffAdd)),
            "a changed file's diff must carry added lines"
        );
    }

    /// MG.46: **the patch must be inlined verbatim**, because a hunk's
    /// `@@` header declares how many body lines it has and the fold
    /// source bounds the hunk by that count.
    ///
    /// A blank trailing context line is a single space, and `.trim()`
    /// on the whole patch removed it — leaving the text one line
    /// shorter than its own header claimed. The hunk fold then ran past
    /// the end of the diff into the status rows below it, which is the
    /// same symptom `hunk_fold_source` was fixed for and the reason
    /// only trailing newlines may be stripped.
    #[test]
    fn a_trailing_blank_context_line_survives_into_the_expansion() {
        let dir = tempfile::tempdir().expect("tempdir");
        let p = dir.path();
        git_ok(p, &["init"]);
        git_ok(p, &["config", "user.email", "t@lattice.dev"]);
        git_ok(p, &["config", "user.name", "lattice-test"]);
        // The file ends with a blank line, so the diff's last context
        // line is a lone space.
        std::fs::write(p.join("a.txt"), "one\ntwo\n\n").expect("write base");
        git_ok(p, &["add", "a.txt"]);
        git_ok(p, &["commit", "-m", "base"]);
        std::fs::write(p.join("a.txt"), "one\ntwo CHANGED\n\n").expect("write modified");

        let rt = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .expect("runtime");
        let (text, line_count, spans, _) = rt
            .block_on(expand_payload(p.to_path_buf(), unstaged("a.txt"), 3, None))
            .expect("a modified tracked file has a diff");

        let body: Vec<&str> = text.lines().collect();
        let at = body
            .iter()
            .position(|l| l.starts_with("@@"))
            .expect("the patch has a hunk header");
        // Every row after the header is hunk body, including the blank
        // context line git emits as a lone space.
        let declared = body[at]
            .split_whitespace()
            .find_map(|t| {
                t.strip_prefix('+')?
                    .split_once(',')
                    .map(|(_, c)| c.to_string())
            })
            .and_then(|c| c.parse::<usize>().ok())
            .expect("the header declares a new-side count");
        let present = body[at + 1..]
            .iter()
            .filter(|l| l.is_empty() || l.starts_with([' ', '+']))
            .count();
        assert_eq!(
            present, declared,
            "the inlined body must supply every line its header declares; \
             got {body:?}",
        );
        assert_eq!(line_count, text.lines().count());
        assert_eq!(spans.len(), line_count, "one span row per line");
    }

    /// An entry with nothing to show declines rather than inserting a
    /// blank expansion — the behaviour the old `!diff.trim().is_empty()`
    /// guard had.
    #[test]
    fn declines_when_there_is_no_diff() {
        let dir = repo_with_modified_file(5);
        let rt = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .expect("runtime");
        // `b.txt` is not in the repo at all, so `git diff -- b.txt` is
        // empty.
        let out = rt.block_on(expand_payload(
            dir.path().to_path_buf(),
            unstaged("b.txt"),
            3,
            None,
        ));
        // MG.56: not merely "nothing was inserted" — WHY. This used to
        // assert only the silence, which is exactly the behaviour that
        // made `=` look like an unbound key: a file whose changes had
        // been committed elsewhere produced an empty patch and no word
        // about it. The distinction between "git had nothing to show"
        // and "git failed" is what lets the caller say something
        // useful, so the test pins it rather than the emptiness.
        assert!(
            matches!(out, Err(ExpandMiss::NoChanges)),
            "an empty diff must report NoChanges, not a bare failure — \
             the row is stale, and `gr` is the fix worth naming"
        );
    }

    /// **The MG.31 regression guard.** Mirrors
    /// `lattice-multibuffer/tests/ui_responsive_during_scan.rs`: run on
    /// a `current_thread` runtime (the editor actor's configuration,
    /// `editor_actor.rs:562`) and assert a concurrent probe keeps its
    /// sleep budget while the expansion runs.
    ///
    /// **Verified non-vacuous**, not assumed: dropping the
    /// `spawn_blocking` from `expand_payload` (the pre-MG.31 shape) puts
    /// the git call and the styling on this runtime and the measured gap
    /// goes to **263 ms** against the 50 ms threshold — a 5× margin, so
    /// neither CI jitter nor a fast machine can flip the verdict. The
    /// file is sized (200k lines, every one changed) to buy exactly that
    /// margin; at 40k it was only 74 ms, which was too close to call.
    #[test]
    fn the_expansion_does_not_starve_the_actor_runtime() {
        let dir = repo_with_modified_file(200_000);
        let rt = tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
            .expect("runtime");

        let (max_gap, ticks, produced) = rt.block_on(async {
            let task = tokio::task::spawn(expand_payload(
                dir.path().to_path_buf(),
                unstaged("a.txt"),
                3,
                None,
            ));

            let mut max_gap = Duration::ZERO;
            let mut ticks = 0usize;
            let mut last = Instant::now();
            for _ in 0..50 {
                tokio::time::sleep(Duration::from_millis(5)).await;
                let now = Instant::now();
                max_gap = max_gap.max(now.duration_since(last));
                ticks += 1;
                last = now;
            }
            let produced = task.await.expect("join").is_ok();
            (max_gap, ticks, produced)
        });

        assert_eq!(ticks, 50, "all probe iterations ran");
        assert!(produced, "the expansion still produced its diff");
        assert!(
            max_gap < Duration::from_millis(50),
            "max probe gap was {max_gap:?}; expected < 50 ms — the actor's \
             current_thread runtime is being starved by the `=` expansion \
             (paramount-goal-1 regression, MG.31). The git call and the \
             styling belong inside `spawn_blocking`."
        );
    }
}

/// MG — `x` over a multi-file Visual selection.
///
/// Reported 2026-09-11: selecting several untracked files and pressing `x`
/// untracked only the first. `s` and `u` had honoured a selection since
/// MG.23g (`stage_or_unstage`'s FileLevel branch reads `ctx.selection`);
/// `x` alone still read `ctx.cursor.line`.
#[cfg(test)]
mod batch_discard_tests {
    use super::*;

    fn f(path: &str, untracked: bool) -> (PathBuf, bool) {
        (PathBuf::from(path), untracked)
    }

    /// The reported case: all untracked. The prompt says DELETE and says how
    /// many, because there is no copy to restore and a count of one would be
    /// a lie about what the key is about to do.
    #[test]
    fn an_all_untracked_selection_asks_to_delete_all_of_them() {
        let effect = batch_discard_confirm(&[f("a.txt", true), f("b.txt", true)]);
        let lattice_grammar::Effect::Confirm {
            prompt, yes_action, ..
        } = effect
        else {
            panic!("expected a Confirm, got {effect:?}");
        };
        assert!(prompt.contains('2'), "the count is named: {prompt}");
        assert!(prompt.contains("Delete"), "and that it deletes: {prompt}");
        assert_eq!(yes_action, "action:magit-discard-batch-execute");
    }

    #[test]
    fn an_all_tracked_selection_asks_to_discard_changes() {
        let effect = batch_discard_confirm(&[f("a.rs", false), f("b.rs", false)]);
        let lattice_grammar::Effect::Confirm { prompt, .. } = effect else {
            panic!("expected a Confirm");
        };
        assert!(prompt.contains("Discard changes"), "{prompt}");
        assert!(!prompt.contains("Delete"), "nothing is deleted: {prompt}");
    }

    /// **A mixed selection names BOTH counts.** The two halves are not
    /// equally severe — a tracked file comes back from the index, an
    /// untracked one does not come back at all — so a prompt saying only
    /// "Discard 3 files?" would hide the irreversible half behind the
    /// recoverable one.
    #[test]
    fn a_mixed_selection_names_the_irreversible_half_separately() {
        let effect = batch_discard_confirm(&[
            f("tracked.rs", false),
            f("new_a.txt", true),
            f("new_b.txt", true),
        ]);
        let lattice_grammar::Effect::Confirm { prompt, .. } = effect else {
            panic!("expected a Confirm");
        };
        assert!(prompt.contains("DELETE"), "{prompt}");
        assert!(prompt.contains("cannot be restored"), "{prompt}");
    }

    /// **The ask emits exactly as many slots as its action DECLARES**, and
    /// this is the assertion the whole batch turned on.
    ///
    /// `Effect::Confirm` seeds the dialog's transient state by ZIPPING the
    /// yes-action's schema with the carried values, and `TransientValue` is
    /// `Bool | String` — a slot cannot hold a list. So a producer emitting one
    /// slot per file against a one-slot schema loses every file but the first
    /// BETWEEN the ask and the act: the prompt says "Discard 3 files?", you
    /// confirm, and one is discarded. That is the bug `b0772901` set out to
    /// fix, reappearing one seam later because it shipped with no test.
    ///
    /// Asserted against the schema in `lib.rs` rather than against the literal
    /// `1`, so the two cannot drift apart in either direction.
    #[test]
    fn the_ask_emits_one_slot_per_declared_schema_slot() {
        let declared = crate::confirm_target_slots("action:magit-discard-batch-execute")
            .expect("the batch execute declares its slots");
        let lattice_grammar::Effect::Confirm { args, .. } =
            batch_discard_confirm(&[f("a.rs", false), f("b.txt", true), f("c.txt", true)])
        else {
            panic!("expected a Confirm");
        };
        assert_eq!(
            args.as_list().map(<[_]>::len),
            Some(declared),
            "the ask carries a different number of slots than the action \
             declares — anything past the declared count is dropped by the \
             confirm round trip, silently, and the act runs on a truncated list"
        );
    }

    /// The carried payload round-trips, flag included — that flag is what
    /// decides `git checkout` versus `git clean`, so losing it would either
    /// fail on an untracked path or DELETE a tracked one.
    #[test]
    fn the_carried_list_round_trips_with_its_flags() {
        let files = vec![f("a.rs", false), f("b.txt", true)];
        let lattice_grammar::Effect::Confirm { args, .. } = batch_discard_confirm(&files) else {
            panic!("expected a Confirm");
        };
        assert_eq!(carried_batch(&args), files);
    }

    /// A path with a space, a quote, a newline. The flag is ONE leading byte
    /// rather than a separator precisely so every path survives — splitting
    /// on one would lose exactly the paths that most need care.
    #[test]
    fn a_hostile_path_survives_the_round_trip() {
        let files = vec![f("dir with space/a'b\nc.txt", true)];
        let lattice_grammar::Effect::Confirm { args, .. } = batch_discard_confirm(&files) else {
            panic!("expected a Confirm");
        };
        assert_eq!(carried_batch(&args), files);
    }

    /// An entry carrying neither flag is DROPPED, not guessed. A
    /// mis-decoded entry here would delete a path nobody named.
    #[test]
    fn an_unflagged_entry_is_dropped_rather_than_guessed() {
        let args = lattice_grammar::Args::List(vec![
            lattice_grammar::ArgValue::String("ta.rs".to_string()),
            lattice_grammar::ArgValue::String("/etc/passwd".to_string()),
        ]);
        assert_eq!(carried_batch(&args), vec![f("a.rs", false)]);
    }
}