dirstate: detect potential fishy transaction patterns while changing If we rely on the transaction more, we should be more careful about the transaction. Adding extra security seems reasonable.

dirstate: generalize the dirstate's invalidation on transaction abort The previous code was too specific, we should add the invalidation at next to the `addfilegenerator` in the `write` call.

dirstate: simplify some methods' decorator Since `changing_parents` and `changing_files` are mutually exclusive, having both `@requires_changing_files` and `@requires_not_changing_parents` on a method is redundant.

dirstate: document the functions that need consolidation They are more functions that make the dirstate dirty but does not currently enforce a clean change scoping, we add comments in front of each of them so clarify this. There is no urgency to it, but the world will be a better place when all of them have proper scoping in place.

dirstate: make `restorebackup` more robust when it is a noop If there are no data_file, we might not be able to determine its filename. Which can be safely ignored. (all this code is on the way out anyway)

dirstate-guard: remove the feature The dirstate guard duplicated some of the logic already implemented in the transaction (and now the changing_* context). However the feature was incomplete, for example, living only in memory meant we could not recover from the hardest crash. In addition this duplicated with the transaction logic meant things could go out of sync or step on each other. Removing the feature now that we no longer needs it seems the safest.

rollback: remove the dirstateguard usage Thanks to the previous changeset, we no longer needs it. begone !

rollback: explicitly skip dirstate rollback when applicable instead of letting the transaction logic overwrite the dirstate and then overwrite that overwrite with a backup. We simply do not restore the dirstate related file during the _playback call. This open the way to removing the last dirstate guard usage.

rollback: detect "parentgone" case earlier Detecting this earlier will help us to affect the rollback process sooner, which will help the next changesets. To keep things simple, we degrade the behavior a bit when the `undo.desc` is missing. However since `hg rollback` is not supposed to be used and the `undo.desc` file have been introduced in mercurial 1.6 (2010). I think this is an acceptable evil.

rollback: avoid a `hg commit --addremove` at a critical point The rollback behavior around `hg commit --addremove` has changed slightly. It does not really matters here but keeping that variant out of the way cannot hurt.

rollback: display some graphlog before/after a test piece This make the situation clearer.

rollback: show that the safety works in a associated test That test section is checking that --force is overcoming the safety check, however we did not check that the safety properly detect the situation. We now do for clarity.

dirstate-guard: remove its usage in `backout` We can simply replace it with a transaction.

dirstate-guard: remove the usage in `import` It is now redundant with the transaction spawning the same scope.

dirstate-guard: replace a usage in `rebase` with a transaction Opening the transaction sooner will provide us with the same benefit.

dirstate-guard: remove usage in `rebase` Now that the dirstate change and write are clearer, it does not seems we need to use a dirstate-guard here anymore. The transaction already wrap the full operation.