fix merge conflicts

src/slic3r/plugin/PythonPluginInterface.hpp

@@ -1,6 +1,7 @@
 #ifndef slic3r_PythonPluginInterface_hpp_
 #define slic3r_PythonPluginInterface_hpp_
 
+#include <atomic>
 #include <cctype>
 #include <string>
 #include <string_view>
@@ -97,13 +98,35 @@ struct ExecutionResult
 class PluginCapabilityInterface
 {
 public:
+    class RefCounter
+    {
+    public:
+        explicit RefCounter(const PluginCapabilityInterface& iface) : m_iface(&iface) { m_iface->increment(); }
+
+        ~RefCounter() { m_iface->decrement(); }
+
+        RefCounter(const RefCounter&)            = delete;
+        RefCounter& operator=(const RefCounter&) = delete;
+
+    private:
+        const PluginCapabilityInterface* m_iface;
+    };
+
     virtual ~PluginCapabilityInterface() = default;
 
-    // Required APIs
-    virtual std::string get_name() const = 0;
-
-    // Optional APIs
-    virtual PluginCapabilityType get_type() const { return PluginCapabilityType::Unknown; }
+    // DO NOT CALL THESE OUTSIDE THE LOADER'S MATERIALIZATION BLOCK. get_name() is pure virtual and
+    // always implemented in Python: the trampoline routes it through PYBIND11_OVERRIDE_PURE, so every
+    // call acquires the GIL, dispatches into the plugin, and opens a filesystem-enforcement scope.
+    // Capability lookup is by name and runs under the plugin registry lock, so calling this on a
+    // lookup would hold that lock while taking the GIL — inverting the lock order against plugin
+    // dispatch on the slicing threads — and it is undefined after the interpreter is finalized.
+    // get_type() is virtual with a C++ default that the typed bases override in C++, but the untyped
+    // trampoline still routes it to Python, so it is only GIL-free by accident of the base chosen.
+    //
+    // The loader resolves both exactly once, at materialization, under the GIL it already holds, and
+    // caches them below. Everything else reads name()/type().
+    virtual std::string get_name() const = 0;                                               // required — overridden in Python
+    virtual PluginCapabilityType get_type() const { return PluginCapabilityType::Unknown; } // optional — typed bases override
 
     // Every capability is configurable and always gets the host's default JSON editor over its
     // stored config; this only says whether it supplies its own UI *instead of* that editor.
@@ -121,22 +144,54 @@ public:
 
     virtual void on_load() {}
     virtual void on_unload() {}
+    virtual void on_cancelled() {}
 
-    // C++-only audit identity (never exposed to Python), set by PluginLoader after plugin capture so
-    // trampoline calls can scope filesystem enforcement to this plugin. PluginDescriptor::plugin_key.
+    // ── C++-only host state, never exposed to Python. Set by the loader at materialization. ──
+    //
+    // The capability owns its own identity and enable flag: they are read once under the GIL, live
+    // exactly as long as the capability does, and are discarded with it on unload. Nothing about a
+    // capability outlives the capability — the durable record is the .install_state.json sidecar.
+
+    // Cached identity. Plain C++ reads, safe under any lock and after the interpreter is gone. Also
+    // doubles as the audited capability name (paired with audit_plugin_key()) so host APIs invoked
+    // from Python can tell which capability they are serving.
+    const std::string&   name() const { return m_name; }
+    PluginCapabilityType type() const { return m_type; }
+    void                 set_resolved_identity(std::string name, PluginCapabilityType type)
+    {
+        m_name = std::move(name);
+        m_type = type;
+    }
+
+    // Logical enable/disable. A disabled capability stays loaded but is skipped by consumers.
+    // Atomic because dispatch reads it off a shared_ptr handed out by the manager, i.e. without the
+    // registry lock held. Seeded from the sidecar at load; PluginManager writes it through on change.
+    bool is_enabled() const { return m_enabled.load(std::memory_order_acquire); }
+    void set_enabled(bool enabled) { m_enabled.store(enabled, std::memory_order_release); }
+
+    // Whether this capability supplies its own config UI (has_config_ui()), resolved once at
+    // materialization under the GIL and cached here. Plain C++ read so the GUI can decide between
+    // the capability's custom UI and the host's default JSON editor without touching Python.
+    bool config_ui_available() const { return m_config_ui_available; }
+    void set_config_ui_available(bool available) { m_config_ui_available = available; }
+
+    // The owning package (PluginDescriptor::plugin_key), the canonical runtime id. Also scopes
+    // filesystem enforcement for trampoline calls.
     void set_audit_plugin_key(std::string key) { m_audit_plugin_key = std::move(key); }
     const std::string& audit_plugin_key() const { return m_audit_plugin_key; }
 
-    // get_name() cached at load, paired with the audit plugin key to identify which capability a
-    // trampoline call belongs to. Cached rather than read live: get_name() is itself a trampoline
-    // call, so calling it from inside a trampoline would recurse. Empty until PluginLoader
-    // materializes the capability.
-    void set_audit_capability_name(std::string name) { m_audit_capability_name = std::move(name); }
-    const std::string& audit_capability_name() const { return m_audit_capability_name; }
+    void increment() const { m_refs.fetch_add(1, std::memory_order_acq_rel); }
+    void decrement() const { m_refs.fetch_sub(1, std::memory_order_acq_rel); }
+    int ref_count() const { return m_refs.load(std::memory_order_acquire); }
 
 private:
+    std::string m_name;
+    PluginCapabilityType m_type = PluginCapabilityType::Unknown;
+    std::atomic<bool> m_enabled{true};
+    bool m_config_ui_available = false;
     std::string m_audit_plugin_key;
-    std::string m_audit_capability_name;
+
+    mutable std::atomic<int> m_refs{0};
 };
 
 } // namespace Slic3r