Module undo 

Undo list / planning domain (inspection + batch selection + apply preflight + human labels).

Owns the read-side and pure apply-path preflight of heddle undo:

• listing user-facing oplog batches for the current checkout scope
• pure batch summarization for stable machine JSON field names
• selecting the next N undo/redo batches
• shared domain refusals for mode conflict and empty history
• pure redaction / thread-worktree / state-reachability preflights given caller-supplied batch facts (no FS / store I/O in the decision layer)
• apply step order (reverse within batch for undo; forward for redo) and preview / completed message strings

Locks, store lookups, dirty-worktree checks, git-checkpoint simulation, and the apply engine remain CLI-owned (undo.rs + undo_apply/*).

Structs

LiveThreadWorktree

A hazard whose materialized path still exists (caller-resolved FS fact).

PurgeOpRef

A Purge op participating in undo redaction safety.

RedactOpRef

A Redact op participating in undo redaction safety.

RedactionUndoBatchFacts

Batch-derived redaction facts (no store I/O).

RequiredStateRef

State the apply inverse/replay must load, tagged with the owning op id.

ThreadWorktreeHazard

ThreadCreate in the undo chain that can orphan a materialized worktree.

UndoApplyPlan

Pure apply plan after batch selection: step order + stable messages.

UndoApplyStep

One entry as the apply engine will visit it (batch order fixed; entry order depends on undo vs redo).

UndoBatchSummary

One oplog batch as surfaced by undo list / preview / completed payloads.

UndoListReport

Machine JSON for heddle undo --list (stable field names).

UndoOperationSummary

One operation inside an undo batch summary.

UndoPlan

Result of selecting batches for a multi-step undo/redo plan.

UnsupportedRedoOp

A redo-unsupported redaction-adjacent op (Redact / Purge).

Enums

UndoApplyPreflightError

Typed apply-path preflight refusals (CLI maps to recovery advice).

UndoHistoryAction

Whether empty-history advice refers to undo or redo.

Functions

batch_status

(all_undone, partial) for a batch — pure status flags for machine output.

check_redaction_redo_supported

Pure redo redaction support preflight.

check_redaction_undo_safe

Pure redaction-undo safety given batch facts + caller-resolved purge status.

check_states_reachable

Pure: refuse when caller-resolved missing states are non-empty.

check_thread_worktree_undo_safe

Pure worktree-orphan preflight: refuse when any live materialized path remains.

collect_redaction_undo_facts

Collect purge/redact ops from a planned undo chain (pure scan).

collect_redo_required_states

Collect states required for redo reachability (pure scan of batches).

collect_thread_worktree_hazards

Collect ThreadCreate worktree-orphan hazards from batches (pure; no FS).

collect_undo_required_states

Collect states required for undo reachability (pure scan of batches).

collect_unsupported_redo_ops

Collect redo-unsupported ops from batches (pure).

empty_history_refusal

Shared advice: no undo/redo-eligible batch in the current checkout lane.

human_operation_description

Soften git-checkpoint batch descriptions for human undo listing.

human_post_undo_trust_status

Soften post-undo verification status for operators.

human_undo_redo_message

Human text status line for undo/redo preview or completed output.

list_undo_history

List user-facing undo history for the current checkout scope.

list_undo_history_ctx

List undo history via an ExecutionContext (embeddable facade entry).

live_materialized_path_blocks_undo

Pure: whether a materialized worktree path still on disk blocks ThreadCreate undo.

machine_undo_redo_message

Machine JSON message field for undo/redo preview or completed payloads.

plan_redo_apply_steps

Redo apply order: each batch in selection order, entries forward within batch.

plan_redo_batches

Select the next steps redoable batches for the current checkout scope.

plan_undo_apply

Build an apply plan from a selected UndoPlan (pure; no preflight).

plan_undo_apply_steps

Undo apply order: each batch in selection order, entries reverse within batch.

plan_undo_batches

Select the next steps undoable batches for the current checkout scope.

require_nonempty_history

Refuse when a plan selected zero batches.

summarize_batch

Summarize one OpBatch into stable list/preview JSON fields.

undo_mode_conflict

Shared advice: undo --list combined with --preview.

validate_undo_list_preview_modes

Pure mode preflight: --list and --preview are mutually exclusive.