fix(macapp): surface rewind divergence and require explicit force confirmation

[dennisonbertram]

Parent: #991
Depends on: #996

Summary

The client supports safe rewind refusal and force: true, but the GUI collapses 409 rewind_refused into a generic status string. There is no way to inspect divergent paths or intentionally retry with a distinct second confirmation.

Evidence

• macapp/Sources/HarnessKit/ClientConversations.swift:126-146 documents that 409 is a safety feature and must never auto-force.
• macapp/Sources/GoCodeUI/ProjectSession.swift:384-398 catches HarnessError but retains only message text, losing the structured refusal state needed by the view.
• macapp/Sources/GoCodeUI/SessionsView.swift:146-152 explicitly documents the missing GUI path.
• This remains finding 9 in open review issue Front-end code quality: 15 findings from adversarial review #951.

Scope

• Preserve structured rewind_refused data (including divergent paths when present) in a typed UI action result.
• First confirmation remains the normal destructive rewind confirmation.
• On 409 only, show divergent paths and require a second, clearly distinct “Restore Anyway” confirmation.
• Never auto-force; Cancel/Escape is safe.
• Refresh transcript and checkpoints only after acknowledged success.

Tests first

• Stub 409 response proves no automatic second POST occurs.
• Force retry sends force: true only after the second confirmation.
• Cancel after 409 sends nothing further and preserves state.
• Success refreshes the active conversation/checkpoints.
• Live daemon test with an externally modified target file if the existing test harness can produce one.

Acceptance criteria

• Normal rewind and forced rewind are visibly distinct two-step decisions.
• Divergent paths are shown before force is offered.
• force: true is impossible without explicit second confirmation.
• Error/cancel paths preserve transcript and files.
• Finding 9 in Front-end code quality: 15 findings from adversarial review #951 is resolved with regression coverage.
• swift test, Swift build, formatting, strict format lint, and live rewind smoke pass.

[dennisonbertram]

Repair reconciliation for PR #1021:

The structural rewind_refused outcome and distinct force confirmation remain in scope. This repair adds the missing active-run guard without implementing #1007. The real externally modified-file / Restore Anyway installed-app smoke remains explicitly pending until the coordinated native smoke phase.

[dennisonbertram]

PR #1021 repair is pushed at 575b670938821f9db8b5bb096e3956753b0f0e25. #997 now has a session-boundary rewind busy guard, generation/target ownership for rewind-point loads, post-await busy rechecks, and disabled Restore affordances with reasons. Rewind/lifecycle/request-ownership coverage passes; native Restore Anyway smoke remains under #1020.

[dennisonbertram]

PR #1021 exact head afa92d20c7ec10438cbbde4550bb8886e2b0465a binds rewind refusals and explicit force retries to the originating conversation. New red/green regressions prove a late refusal is discarded after a conversation switch and a captured refusal cannot be applied to the new conversation. Focused review set passes 13 tests / 3 suites; full Swift passes 308 tests / 55 suites.

[dennisonbertram]

PR #1021 exact head 5f76a74a3593a7191a9135b742503658d50ffab2 closes the alert-dismissal race: force rewind synchronously claims the bound refusal before scheduling I/O, so SwiftUI clearing the confirmation binding cannot suppress the explicit force retry. The red regression reproduces action-then-dismiss and proves force:true reaches the original conversation. Full Swift: 313 tests / 55 suites.