fix(recovery): stop Escape from destroying recovered work (#1515)

Escape in the crash-recovery sheet was bound to the destructive Discard
button, so the gesture macOS teaches as "not now" irreversibly unlinked
every recovered buffer.

The keyboard policy now lives on the choice itself: a destructive choice
cannot carry a key equivalent, and the same value decides the button's
role, its title and what it deletes, so the three cannot drift apart.
Escape and Cmd-. resolve to a new Later button, which deletes nothing.

Review found the sheet was only one of several routes to the same loss.
The clean-quit sweep emptied the whole recovery directory, so quitting
with the sheet on screen destroyed exactly the snapshots it was showing;
the sweep is now scoped to snapshots belonging to open tabs, and
`deleteAllRecoveryFiles` is gone. The offer could also return the user's
own live dirty buffers, where Discard deleted the crash protection of
files they were looking at; the offer now filters live tab IDs and
suppresses itself while a restore is in flight.

The sheet states how long undecided work is kept, the retention window
is single-sourced with the launch sweep, and the destructive button's
VoiceOver hint no longer says "files" when it means unsaved changes.
Russian and French now use deletion verbs for Discard, which previously
read as "dismiss" beside the new Later button.

Closes #1503

Author: batonogov

Pine/AccessibilityIdentifiers.swift

@@ -165,6 +165,12 @@ nonisolated enum AccessibilityID {
     static let paneDropOverlay = "paneDropOverlay"
     static func paneLeaf(_ id: String) -> String { "paneLeaf_\(id)" }
 
+    // MARK: - Crash recovery sheet (#1503)
+    static let recoverySheet = "recoverySheet"
+    static let recoveryDiscardButton = "recoveryDiscardButton"
+    static let recoveryLaterButton = "recoveryLaterButton"
+    static let recoveryRecoverAllButton = "recoveryRecoverAllButton"
+
     // MARK: - Toast notifications
     static let toastNotification = "toastNotification"
 

Pine/AlertTemplate.swift

@@ -292,6 +292,12 @@ extension AlertTemplate {
     /// `.cancel`     — Escape / ⌘-. target (Cancel, Keep). A single-button
     ///                 OK alert uses `.default` since there is nothing to cancel.
     /// `.destructive`— Don't Save / Discard / Quit — confirmed data loss.
+    ///
+    /// No template ever gives one button both `.destructive` and `.cancel`:
+    /// Escape is how people dismiss dialogs without reading them. The
+    /// crash-recovery sheet is the one dialog in Pine built in SwiftUI rather
+    /// than from these templates, and it restates the same policy in
+    /// `RecoveryDialogChoice` (#1503). Change either and check the other.
     private var buttonRoles: [AlertButtonRole] {
         switch self {
         case .unsavedChangesSingle, .unsavedChangesBulk:

Pine/ContentView+Helpers.swift

@@ -73,9 +73,26 @@ extension ContentView {
         return .restored(result)
     }
 
-    func checkForRecovery() {
-        guard let entries = projectManager.recoveryManager?.pendingRecoveryEntries(),
-              !entries.isEmpty else { return }
+    /// Discovers the crash-recovery offer for this project and presents it.
+    ///
+    /// `async` and awaited by the caller rather than launched into a detached
+    /// `Task`: `seedInitialTerminalIfNeeded(disposition:)` runs straight after
+    /// it and its guard reads exactly the two properties this sets. Ordered
+    /// explicitly so a pending offer can never lose the race and have a
+    /// terminal seeded over the empty editor leaf the user is about to recover
+    /// into — `theTaskAwaitsRecoveryDiscoveryBeforeSeeding` pins the sequence
+    /// in `ContentView`'s `.task`.
+    func checkForRecovery() async {
+        // `pendingRecoveryOffer()` and not `pendingRecoveryEntries()`: SwiftUI
+        // re-runs this `.task` on scene restoration and when the window is
+        // closed and reopened, and the snapshots are deliberately still on
+        // disk after "Later". Asking the project, which outlives the window,
+        // is what keeps "not now" from meaning "again in ten seconds" (#1503).
+        // It suspends: the directory listing reads and decodes every snapshot,
+        // and those are whole unsaved buffers with no size limit, so it must
+        // not happen on the main thread before the window draws.
+        let entries = await projectManager.pendingRecoveryOffer()
+        guard !entries.isEmpty else { return }
         recoveryEntries = entries
         showRecoveryDialog = true
     }
@@ -95,7 +112,9 @@ extension ContentView {
     ///   - Only seeds on `.noSavedSession`. `restored`, `skipped`, and
     ///     `deferred` never inject a terminal.
     ///   - A pending recovery dialog means the user may restore real editor
-    ///     content — do not replace the empty leaf until they decide.
+    ///     content — do not replace the empty leaf until they decide. Since
+    ///     ``checkForRecovery()`` suspends, this guard is only meaningful
+    ///     because the caller `await`s it first; see the note there.
     ///   - Defends against the empty editor leaf having been touched between
     ///     the restore attempt and this call (e.g. a rapid sidebar click).
     func seedInitialTerminalIfNeeded(disposition: SessionStartupDisposition) {
@@ -144,24 +163,84 @@ extension ContentView {
         showRecoveryDialog = false
         recoveryEntries = []
 
+        // The restore is in flight from here until the `defer` below, and
+        // `pendingRecoveryOffer()` is empty for as long as it is.
+        //
+        // Without that, `restorePendingEntries` parking on a large-file sheet
+        // is a window in which a second sheet can be built from the same crash
+        // entries: SwiftUI re-runs the scene's `.task` on restoration and on
+        // close/reopen, `didAnswerRecoveryOffer` is deliberately still false
+        // (a restore that never finishes must not silence the offer for good),
+        // and both snapshots are still on disk under IDs no open tab owns. A
+        // second Recover All then migrates them again — writing a snapshot
+        // under a runtime ID no window owns, which comes back on the next
+        // launch as a phantom "recovered file" — and leaves the parked restore
+        // to resume against a detached `TabManager`.
+        //
+        // The flag and not `markRecoveryOfferAnswered()`, because they are
+        // different claims: this says "being handled", that says "decided".
+        // The two come apart exactly when the restorer hands entries back.
+        //
+        // No `Task.isCancelled` check: this is an unstructured task, which
+        // inherits no cancellation, and its handle is discarded — nothing in
+        // the app can cancel it, so the guard that used to sit after the
+        // `await` could never fire and only made it look as though ⌘W were
+        // being handled here. (It is not reachable in the first place: with
+        // the sheet up, `documentWindow(for: NSApp.keyWindow)` resolves to the
+        // sheet, whose delegate is not a `CloseDelegate`.)
+        projectManager.beginRecoveryRestore()
         Task { @MainActor in
+            defer { projectManager.endRecoveryRestore() }
             let retained = await recoveryManager.restorePendingEntries(
                 entries,
                 in: target,
                 context: context
             )
-            guard !Task.isCancelled else { return }
+            // Answered once the restore has actually finished, not before the
+            // `await`. A successful restore leaves live snapshots under the
+            // recovered tabs' runtime IDs, and re-running `checkForRecovery()`
+            // after a scene restart would otherwise offer the user their own
+            // open buffers back as "recovered" (#1503). Anything the restorer
+            // hands back stays on disk for the next launch either way.
+            projectManager.markRecoveryOfferAnswered()
             recoveryEntries = retained
             showRecoveryDialog = !retained.isEmpty
         }
     }
 
-    func discardRecovery() {
-        projectManager.recoveryManager?.deleteRecoveryFiles(
-            for: recoveryEntries.map(\.0)
-        )
-        showRecoveryDialog = false
-        recoveryEntries = []
+    /// Applies the user's answer to the crash-recovery offer.
+    ///
+    /// The single place in the app that can delete a displayed snapshot, and
+    /// it holds no opinion about which answers delete: it asks the chosen
+    /// option what it is allowed to unlink and passes that through.
+    /// ``RecoveryDialogChoice/snapshotsToDelete(from:)`` answers with the
+    /// empty list for everything but Discard, and it is the same value that
+    /// decides the button's role and denies it a keyboard equivalent, so the
+    /// three cannot drift apart. Written as an `if` here it would be one
+    /// plausible "the guard above already handled the other case" edit away
+    /// from #1503 — in a file the coverage gate excludes and no unit test
+    /// loads.
+    ///
+    /// Escape and ⌘-. resolve to ``RecoveryDialogChoice/later``, which unlinks
+    /// nothing: the clean-quit sweep only removes snapshots belonging to open
+    /// tabs (``RecoveryManager/deleteSnapshotsOfOpenTabs(_:)``), and these
+    /// belong to none, so they stay on disk and the offer returns on the next
+    /// launch (#1503).
+    ///
+    /// Exhaustive and without a `default`, so a fourth choice is a compile
+    /// error here rather than a silent "close the sheet and delete nothing".
+    func resolveRecoveryOffer(_ choice: RecoveryDialogChoice) {
+        switch choice {
+        case .recoverAll:
+            recoverTabs()
+        case .discard, .later:
+            projectManager.recoveryManager?.deleteSnapshots(
+                withRecoveryIDs: choice.snapshotsToDelete(from: recoveryEntries)
+            )
+            projectManager.markRecoveryOfferAnswered()
+            showRecoveryDialog = false
+            recoveryEntries = []
+        }
     }
 
     /// Reads `PINE_SEARCH_QUERY` from the environment (used by UI tests) and

Pine/ContentView.swift

@@ -164,7 +164,14 @@ struct ContentView: View {
             if case .restored(let result) = disposition, result.didRestoreEditorTabs {
                 refreshLineDiffs()
             }
-            checkForRecovery()
+            // Awaited, not fired off: recovery discovery reads the snapshot
+            // directory off the main actor (#1503), so it suspends, and the
+            // seeding call below guards on `showRecoveryDialog` and
+            // `recoveryEntries` — the two properties this sets. Running them
+            // concurrently would let a terminal be seeded over the empty
+            // editor leaf a pending offer is about to recover into.
+            // `theTaskAwaitsRecoveryDiscoveryBeforeSeeding` pins this order.
+            await checkForRecovery()
             // #1251: a project with no saved session and no pending recovery
             // opens directly into a focused terminal rooted in the project,
             // instead of an empty editor canvas. This runs only after session
@@ -194,8 +201,7 @@ struct ContentView: View {
         .sheet(isPresented: $showRecoveryDialog) {
             RecoveryDialogView(
                 entries: recoveryEntries,
-                onRecover: { recoverTabs() },
-                onDiscard: { discardRecovery() }
+                onChoose: { resolveRecoveryOffer($0) }
             )
         }
         .overlay {