redact: fix render state, support late updates, queue on pending

Five bugs in the message-redaction path:

- xtext entry_set_text didn't invalidate sublines, so render drew
  only str_len-many bytes of the new placeholder and burned the
  line budget, hiding entries below.  Also reconcile num_lines via
  the display_lines delta and update_weight234 so index234_by_weight
  stays in sync.
- xtext set_redaction_info no-op'd on a second REDACT, so the stored
  info diverged from the displayed placeholder and the click cycle
  flipped between operators/reasons.  Always refresh redactor info;
  snapshot original_content only on the first call.
- fe_redact_message's REDACTED-only guard missed PROMPT and REVEALED.
  New gtk_xtext_entry_redaction_matches helper skips true duplicates
  while letting a corrected reason fall through.
- REDACT against an unknown msgid only inserted an in-memory notice.
  Persist via scrollback_db_save with NULL msgid so it survives a
  restart without colliding with later chathistory results.
- Redact-X on a PENDING entry sent the "pending:<label>" placeholder
  msgid; server replied UNKNOWN_MSGID.  Queue via a new pending_redact
  bit (strike-through visual), fire from fe_confirm_entry once the
  echo binds the real msgid.  Wired into both the hover X and the
  right-click "Delete Message" menu.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MrLenin

src/common/text.c

@@ -157,7 +157,11 @@ scrollback_confirm_pending (session *sess, const char *label, const char *real_m
 	g_free (pending_key);
 }
 
-/* IRCv3 redaction: mark message as redacted in scrollback */
+/* IRCv3 redaction: mark message as redacted in scrollback.
+ * If the target msgid isn't in scrollback (we never saw the original),
+ * persist a standalone notice line so the redaction event survives a
+ * restart — matching the in-memory notice fe_redact_message inserts
+ * when gtk_xtext_find_by_msgid returns NULL. */
 void
 scrollback_redact_for_session (session *sess, const char *msgid,
                                const char *redacted_by, const char *reason,
@@ -169,8 +173,26 @@ scrollback_redact_for_session (session *sess, const char *msgid,
 		return;
 
 	db = get_scrollback_db (sess);
-	if (db)
-		scrollback_redact_message (db, msgid, redacted_by, reason, redact_time);
+	if (!db)
+		return;
+
+	if (scrollback_redact_message (db, msgid, redacted_by, reason, redact_time))
+		return;
+
+	/* Original wasn't in the DB — save a notice keyed by NULL msgid so it
+	 * never collides with a later chathistory-fetched original. */
+	if (sess->channel[0] && redacted_by && *redacted_by)
+	{
+		char *notice;
+		if (reason && *reason)
+			notice = g_strdup_printf ("\017[Message redacted by %s: %s]",
+			                          redacted_by, reason);
+		else
+			notice = g_strdup_printf ("\017[Message redacted by %s]",
+			                          redacted_by);
+		scrollback_db_save (db, sess->channel, redact_time, NULL, notice);
+		g_free (notice);
+	}
 }
 
 /* IRCv3 reactions: persist to scrollback */

src/fe-gtk/fe-gtk.c

@@ -1418,7 +1418,13 @@ fe_redact_message (session *sess, const char *msgid,
 			gtk_xtext_entry_set_reply (buf, notice_ent, msgid, NULL, NULL, 0);
 		return;
 	}
-	if (gtk_xtext_entry_get_state (ent) == XTEXT_STATE_REDACTED)
+
+	/* Duplicate suppression: skip if existing redaction matches the new
+	 * one exactly.  Without this, a server retransmit (chathistory replay,
+	 * rejoin) would kick the user out of REVEALED state back to REDACTED.
+	 * A truly-changed redaction (different reason, different op) falls
+	 * through and refreshes the placeholder + redaction info. */
+	if (gtk_xtext_entry_redaction_matches (ent, redacted_by, reason, redact_time))
 		return;
 
 	/* Preserve original content for accountability */
@@ -1541,9 +1547,24 @@ fe_confirm_entry (session *sess, guint64 entry_id, const char *msgid)
 	textentry *ent = gtk_xtext_find_by_id (sess->res->buffer, entry_id);
 	if (ent && gtk_xtext_entry_get_state (ent) == XTEXT_STATE_PENDING)
 	{
+		gboolean wants_redact = gtk_xtext_entry_get_pending_redact (ent);
+
 		gtk_xtext_entry_set_state (sess->res->buffer, ent, XTEXT_STATE_NORMAL);
 		if (msgid)
 			gtk_xtext_set_msgid (sess->res->buffer, ent, msgid);
+
+		/* User clicked the redact button while the entry was still
+		 * pending; we deferred the REDACT until the real msgid was
+		 * known.  Fire it now. */
+		if (wants_redact && msgid && sess->channel[0] &&
+		    sess->server && sess->server->have_redact &&
+		    sess->server->connected)
+		{
+			char *cmd = g_strdup_printf ("REDACT %s %s", sess->channel, msgid);
+			handle_command (sess, cmd, FALSE);
+			g_free (cmd);
+		}
+		gtk_xtext_entry_set_pending_redact (ent, FALSE);
 	}
 	/* Virtual scrollback: if the entry was evicted (find_by_id returns NULL),
 	 * the DB-side msgid update is already handled by scrollback_confirm_pending

src/fe-gtk/maingui.c

@@ -2846,9 +2846,22 @@ mg_redact_button_cb (GtkXText *xtext, const char *msgid, const char *nick, gpoin
 	if (xtext->redact_confirm_ent == xtext->hover_ent &&
 	    (g_get_monotonic_time () - xtext->redact_confirm_time) < 3 * G_USEC_PER_SEC)
 	{
-		char *cmd = g_strdup_printf ("REDACT %s %s", sess->channel, msgid);
-		handle_command (sess, cmd, FALSE);
-		g_free (cmd);
+		/* Entry still awaiting echo/labeled-response — msgid is a
+		 * "pending:<label>" placeholder the server doesn't know.  Mark
+		 * the entry and let fe_confirm_entry fire REDACT once the real
+		 * msgid binds. */
+		if (gtk_xtext_entry_get_state (xtext->hover_ent) == XTEXT_STATE_PENDING)
+		{
+			gtk_xtext_entry_set_pending_redact (xtext->hover_ent, TRUE);
+			fe_toast_show (sess, _("Will delete once the message is confirmed by the server"),
+			               3000, TOAST_TYPE_INFO, 0);
+		}
+		else
+		{
+			char *cmd = g_strdup_printf ("REDACT %s %s", sess->channel, msgid);
+			handle_command (sess, cmd, FALSE);
+			g_free (cmd);
+		}
 		xtext->redact_confirm_ent = NULL;
 	}
 	else

src/fe-gtk/menu.c

@@ -1465,12 +1465,30 @@ static void
 middle_action_redact (GSimpleAction *action, GVariant *parameter, gpointer user_data)
 {
 	session *sess = middle_menu_sess;
+	textentry *ent;
 	(void)action; (void)parameter; (void)user_data;
 
 	if (!sess || !sess->server || !sess->server->have_redact ||
 	    !sess->server->connected || !middle_menu_clicked_msgid)
 		return;
 
+	/* Same pending-echo gate as the hover-X path (maingui.c): if the
+	 * entry is still awaiting its real msgid, queue the redact and let
+	 * fe_confirm_entry fire it once the echo lands. */
+	ent = sess->res && sess->res->buffer
+		? gtk_xtext_find_by_msgid (sess->res->buffer, middle_menu_clicked_msgid)
+		: NULL;
+	if (ent && gtk_xtext_entry_get_state (ent) == XTEXT_STATE_PENDING)
+	{
+		gtk_xtext_entry_set_pending_redact (ent, TRUE);
+		fe_toast_show (sess,
+			_("Will delete once the message is confirmed by the server"),
+			3000, TOAST_TYPE_INFO, 0);
+		if (sess->gui && sess->gui->xtext)
+			gtk_widget_queue_draw (sess->gui->xtext);
+		return;
+	}
+
 	{
 		char *cmd = g_strdup_printf ("REDACT %s %s", sess->channel, middle_menu_clicked_msgid);
 		handle_command (sess, cmd, FALSE);

src/fe-gtk/xtext.c

@@ -212,6 +212,7 @@ struct textentry
 	unsigned int collapsed:1;		/* multiline entry is currently collapsed */
 	unsigned int collapsible:1;		/* multiline entry can be collapsed/expanded */
 	unsigned int has_db_row:1;		/* entry was saved to DB (has valid DB rowid) */
+	unsigned int pending_redact:1;	/* user clicked redact while pending; fire on echo */
 
 	int display_lines;				/* cached display line count (replaces g_slist_length in hot paths) */
 	int sublines_width;				/* window_width when sublines were computed (0 = needs recompute) */
@@ -4526,6 +4527,18 @@ gtk_xtext_render_subline (GtkXText *xtext, int y, textentry *ent,
 			pango_attr_list_insert (attrs, fg_alpha);
 		}
 
+		/* Queued-redact strike-through: the user clicked delete while we were
+		 * still awaiting echo confirmation.  Strike the whole subline so the
+		 * intent is visible until the echo arrives and the real REDACT goes
+		 * out.  Combines with the pending dim above. */
+		if (ent->pending_redact)
+		{
+			PangoAttribute *strike = pango_attr_strikethrough_new (TRUE);
+			strike->start_index = 0;
+			strike->end_index = sub_len;
+			pango_attr_list_insert (attrs, strike);
+		}
+
 		pango_layout_set_text (xtext->layout,
 		                        (char *)(ent->stripped_str + sub_start), sub_len);
 		pango_layout_set_attributes (xtext->layout, attrs);
@@ -11178,7 +11191,7 @@ gboolean
 gtk_xtext_entry_set_text (xtext_buffer *buf, textentry *ent,
                           const unsigned char *new_text, int new_len)
 {
-	int old_sublines, new_sublines;
+	int old_dl, delta;
 
 	if (!buf || !ent || !new_text)
 		return FALSE;
@@ -11226,11 +11239,33 @@ gtk_xtext_entry_set_text (xtext_buffer *buf, textentry *ent,
 		ent->raw_to_stripped_map = r2s;
 	}
 
-	/* Recalculate derived data */
+	/* Recalculate derived data.  gtk_xtext_lines_taken mutates
+	 * ent->display_lines; bracket the call so we can apply the delta to
+	 * both buf->num_lines AND the order-statistic tree's cached weights.
+	 * Skipping the tree update leaves index234_by_weight out of sync with
+	 * display_lines and breaks every code path that resolves a scroll
+	 * line back to an entry (gtk_xtext_nth, char/click hit-testing). */
 	ent->str_width = gtk_xtext_text_width_ent (buf->xtext, ent);
-	old_sublines = g_slist_length (ent->sublines);
-	new_sublines = gtk_xtext_lines_taken (buf, ent);
-	buf->num_lines += (new_sublines - old_sublines);
+
+	/* Force lines_taken to rebuild sublines from scratch.  Its fast path
+	 * reuses ent->sublines without checking that the single GINT boundary
+	 * inside matches the new ent->str_len; on a redaction whose placeholder
+	 * is longer than the original message, the stale boundary makes the
+	 * render loop's `str < ent->str + str_len` advance recycle past the
+	 * end, truncating the placeholder and burning the line budget so the
+	 * entries below don't render. */
+	g_slist_free (ent->sublines);
+	ent->sublines = NULL;
+
+	old_dl = ent->display_lines;
+	gtk_xtext_lines_taken (buf, ent);
+	delta = ent->display_lines - old_dl;
+	if (delta)
+	{
+		buf->num_lines += delta;
+		if (buf->entry_tree)
+			update_weight234 (buf->entry_tree, ent, delta);
+	}
 
 	/* Invalidate search marks */
 	if (ent->marks)
@@ -11302,17 +11337,60 @@ gtk_xtext_entry_set_redaction_info (xtext_buffer *buf, textentry *ent,
                                     const char *redacted_by, const char *reason,
                                     time_t redact_time)
 {
-	if (!ent || ent->redaction)
-		return;  /* already has redaction info — don't overwrite */
+	if (!ent)
+		return;
+
+	if (!ent->redaction)
+	{
+		/* First redaction: snapshot the original content for reveal. */
+		ent->redaction = g_new0 (xtext_redaction_info, 1);
+		ent->redaction->original_content = g_strndup (original_str, original_len);
+		ent->redaction->original_len = original_len;
+	}
+	/* Re-redaction: keep the first-call original_content (ent->str may be
+	 * the prompt or placeholder at this point) and only refresh the
+	 * redactor identity so the latest REDACT wins. */
 
-	ent->redaction = g_new0 (xtext_redaction_info, 1);
-	ent->redaction->original_content = g_strndup (original_str, original_len);
-	ent->redaction->original_len = original_len;
+	g_free (ent->redaction->redacted_by);
 	ent->redaction->redacted_by = g_strdup (redacted_by);
+
+	g_free (ent->redaction->redaction_reason);
 	ent->redaction->redaction_reason = (reason && *reason) ? g_strdup (reason) : NULL;
+
 	ent->redaction->redaction_time = redact_time;
 }
 
+gboolean
+gtk_xtext_entry_redaction_matches (textentry *ent,
+                                   const char *redacted_by,
+                                   const char *reason,
+                                   time_t redact_time)
+{
+	const char *normalized;
+
+	if (!ent || !ent->redaction)
+		return FALSE;
+
+	normalized = (reason && *reason) ? reason : NULL;
+
+	return g_strcmp0 (ent->redaction->redacted_by, redacted_by) == 0
+	    && g_strcmp0 (ent->redaction->redaction_reason, normalized) == 0
+	    && ent->redaction->redaction_time == redact_time;
+}
+
+void
+gtk_xtext_entry_set_pending_redact (textentry *ent, gboolean pending)
+{
+	if (ent)
+		ent->pending_redact = pending ? 1 : 0;
+}
+
+gboolean
+gtk_xtext_entry_get_pending_redact (textentry *ent)
+{
+	return ent ? (gboolean) ent->pending_redact : FALSE;
+}
+
 /* Lookup the textentry at a given y pixel coordinate.
  * Used by context menus to identify which message was clicked.
  */

src/fe-gtk/xtext.h

@@ -570,6 +570,21 @@ void gtk_xtext_entry_set_redaction_info (xtext_buffer *buf, textentry *ent,
                                          const char *redacted_by, const char *reason,
                                          time_t redact_time);
 
+/* TRUE if ent already carries redaction info that matches the given
+ * (redacted_by, reason, redact_time).  An empty/NULL reason is treated
+ * equivalently.  Used to suppress duplicate REDACT events. */
+gboolean gtk_xtext_entry_redaction_matches (textentry *ent,
+                                            const char *redacted_by,
+                                            const char *reason,
+                                            time_t redact_time);
+
+/* Mark ent as "redact-on-confirm": user clicked the redact button while
+ * the entry was still PENDING.  The flag is read and cleared by
+ * fe_confirm_entry once the echo/labeled-response arrives and a real
+ * msgid is bound to the entry. */
+void gtk_xtext_entry_set_pending_redact (textentry *ent, gboolean pending);
+gboolean gtk_xtext_entry_get_pending_redact (textentry *ent);
+
 /* IRCv3 reactions and reply context */
 struct xtext_reactions_info;
 struct xtext_reply_info;