gitpane 1.0.0__py3-none-any.whl

gitpane/controller/reference_form_controller.py

@@ -0,0 +1,1677 @@
+"""Run the forms that create, move, delete or check out a reference."""
+
+from __future__ import annotations
+
+import os
+import uuid
+from dataclasses import replace
+from typing import TYPE_CHECKING
+
+from shiboken6 import isValid
+
+from gitpane.config import LOCAL_PREFIX, REMOTE_PREFIX, TAG_PREFIX, ConsoleOperation, SharedText
+from gitpane.controller.refresh_controller import RefreshScope
+from gitpane.history.file_history import WindowCapability
+from gitpane.history.repository_value import ReferenceKind
+from gitpane.history.revision import commit_count_text, commit_difference_in_memory, complete_ancestor_oid_set, is_ancestor_in_memory, resolve_revision_in_memory, revision_text_problem, unmerged_branch_refs_in_memory
+from gitpane.operation.console_line import REPOSITORY_HEADER_LABEL, ConsoleHeader, end_line_with_cause, operation_end_text
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.operation_trace import OperationTrace, publish_after_trace
+from gitpane.operation.repository_operation import OperationAction, OperationIntent, OperationOutcome, OperationStepResult
+from gitpane.reference.reference_edit import (
+    DELETE_LOCAL_BRANCH_OPERATION,
+    DELETE_LOCAL_TAG_OPERATION,
+    DELETE_REMOTE_BRANCH_OPERATION,
+    DELETE_REMOTE_TAG_OPERATION,
+    BranchDeletionIntent,
+    BranchMode,
+    ResetMode,
+    deletable_branch_refs,
+    merge_base_oid_by_ref,
+    push_remote_name,
+    remote_branch_destination,
+    remote_delete_candidates,
+    suggested_branch_name,
+)
+from gitpane.reference.reference_snapshot import short_reference_name
+from gitpane.transport.branch_exchange import TransportRequest
+from gitpane.ui.console.operation_dialog import OperationDialog
+from gitpane.ui.reference.checkout_dialog import CheckoutDialog
+from gitpane.ui.reference.checkout_revision_dialog import CheckoutRevisionDialog
+from gitpane.ui.reference.create_branch_dialog import CreateBranchDialog
+from gitpane.ui.reference.create_tag_dialog import CreateTagDialog
+from gitpane.ui.reference.delete_local_branch_dialog import DeleteLocalBranchDialog
+from gitpane.ui.reference.delete_tag_dialog import NO_PUSH_ADDRESS_CAUSE, NO_REMOTE_CAUSE, SEVERAL_PUSH_ADDRESSES_CAUSE, UNUSABLE_REMOTE_CAUSE, DeleteTagDialog
+from gitpane.ui.reference.form_opening import refuse_form_opening, reveal_form
+from gitpane.ui.reference.reference_dialog import DeleteBranchDialog
+from gitpane.ui.reference.rename_branch_dialog import RenameBranchDialog
+from gitpane.ui.reference.reset_branch_dialog import ResetOtherBranchDialog
+from gitpane.ui.reference.reset_dialog import ResetDialog
+from gitpane.ui.reference.revision_dialog import RevisionChoiceDialog
+from gitpane.ui.widget.refresh_advice import refresh_advice_text
+from gitpane.ui.window_control.dialog_modality import open_window_modal
+from gitpane.worktree.command_sequence import GitCommandError
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
+    from gitpane.controller.console_registry import ConsoleRegistry
+    from gitpane.controller.history_read_controller import HistoryReadController
+    from gitpane.controller.operation_policy import OperationPolicy
+    from gitpane.controller.reference_read_controller import ReferenceReadController
+    from gitpane.controller.refresh_controller import RefreshController
+    from gitpane.controller.session_registry import SessionRegistry
+    from gitpane.controller.staging_controller import StagingController
+    from gitpane.controller.transport_controller import TransportController
+    from gitpane.history.repository import GitRepository
+    from gitpane.operation.diagnostic import DiagnosticLog
+    from gitpane.preference.preference_store import PreferenceStore
+    from gitpane.reference.reference_edit import BranchIntent, CheckoutIntent, MergeAbortIntent, ReferenceDeletionIntent, ReferenceService, ResetIntent, TagIntent
+    from gitpane.reference.reference_snapshot import ReferenceSnapshot
+    from gitpane.sequencer.replay import ReplayIntent
+    from gitpane.transport.branch_exchange import TransportService
+    from gitpane.transport.remote import RemoteService
+    from gitpane.transport.remote_config import RemoteSnapshot
+    from gitpane.ui.sequencer.replay_dialog import ReplayDialog
+    from gitpane.worktree.worktree_service import WorktreeService
+
+# The reference forms built around the Git Extensions revision field.
+RevisionForm = CheckoutRevisionDialog | CreateBranchDialog | CreateTagDialog
+# Text the --log file keeps at the end of a reference operation (Checkout, branches, tags, Cherry pick, Revert); the
+# console shows the operation's name and the word of its status instead.
+REFERENCE_RESULT_LOG_TEMPLATE = "Result: {status}"
+# The branch forms whose result is a branch on a new commit or a new name, shown at the top of the graph once done.
+HISTORY_TOP_BRANCH_MODE_SET = frozenset((BranchMode.CREATE, BranchMode.CREATE_CHECKOUT, BranchMode.CREATE_ORPHAN, BranchMode.RENAME))
+# A Cherry-pick or Revert console shows what the user would run in a terminal: Git's own command, its output and its
+# result. The reads GitPane runs around it for its checks stay in the --log file only.
+NATIVE_ONLY_CONSOLE_ACTION_SET = frozenset((OperationAction.REPLAY_START, OperationAction.REPLAY_CONTINUE, OperationAction.REPLAY_ABORT, OperationAction.MERGE_ABORT))
+
+
+class ReferenceFormController:
+    """The reference forms of every repository window: Reset, Create tag, the branch forms, the deletions of branches and tags, Checkout and Checkout revision, with the consoles of the reference operations they start."""
+
+    def __init__(self, *, session_registry_controller: SessionRegistry, operation_policy_controller: OperationPolicy, console_registry_controller: ConsoleRegistry, reference_read_controller: ReferenceReadController,
+                 refresh_controller: RefreshController, history_read_controller: HistoryReadController, staging_controller: StagingController, transport_controller: TransportController, preference: PreferenceStore, repository: GitRepository,
+                 worktree_service: WorktreeService, reference: ReferenceService, remote: RemoteService, transport: TransportService, diagnostic_log: DiagnosticLog | None) -> None:
+        """Receive the services and the lower controllers the reference forms work with; the wiring builds it after the transport controller, and the repository windows, the replay and the conflict reach it through the wiring."""
+        self.session_registry_controller = session_registry_controller
+        self.operation_policy_controller = operation_policy_controller
+        self.reference_read_controller = reference_read_controller
+        self.refresh_controller = refresh_controller
+        self.repository = repository
+        self.worktree_service = worktree_service
+        self.reference = reference
+        self.diagnostic_log = diagnostic_log
+        self.console_registry_controller = console_registry_controller
+        self.history_read_controller = history_read_controller
+        self.transport_controller = transport_controller
+        self.preference = preference
+        self.remote = remote
+        self.transport = transport
+        self.staging_controller = staging_controller
+        self.reset_dialog_by_session: dict[str, ResetDialog] = {}
+        self.reset_intent_by_id: dict[str, ResetIntent] = {}
+        self.reference_trace_by_id: dict[str, OperationTrace] = {}
+        self.reference_label_by_id: dict[str, str] = {}
+        self.reference_form_by_id: dict[str, CheckoutDialog | CheckoutRevisionDialog | CreateBranchDialog | CreateTagDialog | DeleteLocalBranchDialog | ReplayDialog | None] = {}
+        self.branch_dialog_by_session: dict[str, CreateBranchDialog | RenameBranchDialog | ResetOtherBranchDialog] = {}
+        self.branch_intent_by_id: dict[str, BranchIntent] = {}
+        # The deletion form of each window: a remote branch's, or Delete tag; one at a time per window.
+        self.delete_dialog_by_session: dict[str, DeleteBranchDialog | DeleteTagDialog] = {}
+        self.delete_intent_by_id: dict[str, ReferenceDeletionIntent] = {}
+        # The Delete branch window of local branches, and the group deletions it submitted, by operation.
+        self.local_branch_delete_dialog_by_session: dict[str, DeleteLocalBranchDialog] = {}
+        self.branch_deletion_intent_by_id: dict[str, BranchDeletionIntent] = {}
+        self.tag_dialog_by_session: dict[str, CreateTagDialog] = {}
+        self.tag_intent_by_id: dict[str, TagIntent] = {}
+        self.created_tag_by_id: dict[str, tuple[TagIntent, str, str]] = {}
+        self.checkout_dialog_by_session: dict[str, CheckoutDialog] = {}
+        self.checkout_revision_dialog_by_session: dict[str, CheckoutRevisionDialog] = {}
+        self.checkout_intent_by_id: dict[str, CheckoutIntent] = {}
+
+    def open_reset(self, session_id: str, target_oid: str, *, expected_snapshot: ReferenceSnapshot | None = None) -> ResetDialog | None:
+        """Capture current-branch reset authority and local state before user confirmation."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.reset_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = ResetDialog(session_id, target_oid, window)
+        self.reset_dialog_by_session[session_id] = dialog
+        dialog.reset_requested.connect(lambda intent: self.submit_reset(session_id, intent))
+        dialog.finished.connect(lambda: self.reset_dialog_by_session.pop(session_id, None) if self.reset_dialog_by_session.get(session_id) is dialog else None)
+
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Reject late reads after closing or replacing the form or the repository authority."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.reset_dialog_by_session, context, git_filename)
+
+        def metadata_complete(fields: tuple | None, error: Exception | None) -> None:
+            """Publish only the originally requested commit's metadata, and never to a submitted form."""
+            if is_current() and not dialog.busy and not dialog.completed:
+                dialog.show_metadata(fields, str(error) if error else "")
+
+        preparing = False
+
+        def prepare_local() -> None:
+            """Capture file and index authority only when the chosen mode can change them."""
+            nonlocal preparing
+            snapshot = dialog.snapshot
+            if preparing or snapshot is None or not is_current() or dialog.mode == ResetMode.SOFT or dialog.worktree_snapshot is not None:
+                return
+            preparing = True
+            dialog.status_label.setText("Checking index and working files…")
+
+            def local_complete(result: tuple | None, error: Exception | None) -> None:
+                """Never replace submitted authority when a background read finishes."""
+                nonlocal preparing
+                preparing = False
+                if not is_current() or dialog.busy or dialog.completed:
+                    return
+                if error is not None:
+                    if dialog.mode != ResetMode.SOFT:
+                        dialog.show_error(str(error))
+                    return
+                local, signature, paths, target_paths = result
+                dialog.populate(snapshot, local, signature, paths, target_paths)
+                dialog.status_label.clear()
+
+            self.worktree_service.run(snapshot.context, snapshot.git_filename, self.reference.capture_reset(snapshot, target_oid), local_complete)
+
+        dialog.preparation_requested.connect(prepare_local)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Check symbolic HEAD and read local bytes before enabling the form."""
+            if not is_current() or dialog.busy or dialog.completed:
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                                                  or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.REFERENCE_CHANGED_BEFORE_OPENING))
+                return
+            if not snapshot.head_ref or not snapshot.head_oid:
+                refuse_form_opening(dialog, "Reset requires a current local branch with a commit")
+                return
+
+            dialog.populate(snapshot)
+            reveal_form(dialog)
+            self.reference.metadata(snapshot, target_oid, metadata_complete)
+            prepare_local()
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_reset(session_id, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def submit_reset(self, session_id: str, intent: ResetIntent) -> str | None:
+        """Submit only the captured reset from its authorized live form."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        dialog = self.reset_dialog_by_session.get(session_id)
+        if dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id or not dialog.busy:
+            return None
+        session = self.session_registry_controller.session_by_id[session_id]
+
+        def is_current() -> bool:
+            """Recheck live session, executable and context at the actual process launch."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+
+        self.reset_intent_by_id[intent.operation.operation_id] = intent
+        return self.reference.reset(intent, is_current=is_current)
+
+    def reset_finished(self, outcome: object) -> None:
+        """Show observed reset effects and refresh related windows after real process exit."""
+        intent = self.reset_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        dialog = self.reset_dialog_by_session.get(intent.operation.session_id)
+        if dialog is not None and isValid(dialog) and not dialog.closed and dialog.intent == intent:
+            dialog.show_outcome(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status == OperationStatus.REFUSED:
+            return
+        self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.FULL)
+
+    def open_tag(self, session_id: str, target_oid: str, *, expected_snapshot: ReferenceSnapshot | None = None) -> CreateTagDialog | None:
+        """Open the Create tag window on one commit, drawn from what the repository window already holds.
+
+        The references come from the window's own capture while their files are unchanged, the push remote from their
+        listing and the position from the history graph in memory; the window shows no commit details, so opening it
+        on a displayed commit of a fully loaded graph starts no Git process.
+        """
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.tag_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = CreateTagDialog(session_id, target_oid, window)
+        dialog.setAccessibleDescription(f"Create a tag in {window.context.repository_dir}")
+        self.tag_dialog_by_session[session_id] = dialog
+        dialog.tag_requested.connect(lambda intent: self.submit_tag(session_id, intent))
+        dialog.finished.connect(lambda: self.tag_dialog_by_session.pop(session_id, None) if self.tag_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.tag_dialog_by_session, context, git_filename) and not dialog.busy
+
+        self._bind_revision_picker(session_id, dialog, is_current)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Show the commit and the push remote only while the form and the references it was asked from are current."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                                                  or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.REFERENCE_CHANGED_BEFORE_OPENING))
+                return
+            dialog.populate(snapshot, target_oid, push_remote_name(snapshot))
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_tag(session_id, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def submit_tag(self, session_id: str, intent: TagIntent) -> str | None:
+        """Submit only the exact tag intention displayed by the authorized live form."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        dialog = self.tag_dialog_by_session.get(session_id)
+        if dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id:
+            return None
+        session = self.session_registry_controller.session_by_id[session_id]
+
+        def is_current() -> bool:
+            """Recheck the form and repository authority when queued Git actually starts."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+
+        self.tag_intent_by_id[intent.operation.operation_id] = intent
+        self.open_reference_output(intent, dialog)
+        return self.reference.create_tag(intent, is_current=is_current)
+
+    def tag_finished(self, outcome: object) -> None:
+        """Publish separate creation and refresh results before refreshing related windows."""
+        intent = self.tag_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        dialog = self.tag_dialog_by_session.get(intent.operation.session_id)
+        if outcome.status == OperationStatus.SUCCESS and intent.push_after_creation:
+            creation = next((step for step in outcome.steps if step.operation == "Create tag"), None)
+            object_oid = creation.after.object_oid_by_name.get(intent.full_ref) if creation is not None and creation.after is not None else None
+            if object_oid:
+                # The remote the form's Push check box named, derived from the very references the request was frozen on.
+                self.created_tag_by_id[outcome.operation_id] = (intent, object_oid, push_remote_name(intent.snapshot))
+                output = self.console_registry_controller.reference_output_by_id.get(outcome.operation_id)
+                if output is not None:
+                    output.followup_requested.connect(lambda: self.push_created_tag(outcome.operation_id))
+        if (dialog is self.reference_form_by_id.get(outcome.operation_id) and dialog is not None
+                and isValid(dialog) and not dialog.closed and dialog.intent == intent):
+            dialog.show_outcome(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status != OperationStatus.REFUSED:
+            self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.REFERENCES)
+        self.push_created_tag(outcome.operation_id)
+        self.finish_reference_output(outcome)
+
+    def push_created_tag(self, operation_id: str) -> None:
+        """Open the exact created tag's Push form on the remote the Create tag form named, keeping a retry if another Push is busy.
+
+        The Push check box of Create tag never pushes by itself: this only opens Push, where the user confirms.
+        """
+        capture = self.created_tag_by_id.get(operation_id)
+        output = self.console_registry_controller.reference_output_by_id.get(operation_id)
+        if capture is None or output is None or not isValid(output) or output.dismissed:
+            return
+        intent, object_oid, remote_name = capture
+        session_id = intent.operation.session_id
+        session = self.session_registry_controller.session_by_id.get(session_id)
+        if (not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or session is None
+                or intent.snapshot.context != session.repository_context or intent.snapshot.git_filename != self.repository.git_filename):
+            output.show_followup("Tag created locally. Reopen the original repository with management access before pushing it.")
+            return
+        existing = self.transport_controller.push_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed and (existing.busy or existing.commit_push_intent is not None):
+            output.show_followup("Tag created locally. Finish and close the existing Push dialog, then choose Push tag.")
+            return
+        push_dialog = self.transport_controller.open_push(session_id)
+        if push_dialog is None or not push_dialog.pin_tag(intent.full_ref, object_oid, remote_name):
+            output.show_followup("Tag created locally. Push could not be prepared. Choose Push tag to try again.")
+            return
+        if existing is push_dialog:
+            self.transport_controller.read_push(session_id, push_dialog)
+        self.created_tag_by_id.pop(operation_id, None)
+        output.show_followup()
+        if not output.running:
+            output.show_result(OperationStatus.SUCCESS)
+
+    def open_delete_branch(self, session_id: str, full_ref: str, target_oid: str, *,
+                           expected_snapshot: ReferenceSnapshot | None = None) -> DeleteBranchDialog | DeleteLocalBranchDialog | DeleteTagDialog | None:
+        """Open the deletion form of the clicked reference, only for a live management session.
+
+        A local branch opens the Delete branch window of Git Extensions, which deletes local branches only; a tag opens
+        the Delete tag window; a remote branch keeps its own form, which deletes it on the server.
+        """
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        if full_ref.startswith(LOCAL_PREFIX):
+            return self._open_local_branch_deletion(session_id, full_ref, target_oid, expected_snapshot)
+        if full_ref.startswith(TAG_PREFIX):
+            return self._open_tag_deletion(session_id, full_ref, target_oid, expected_snapshot)
+        if not full_ref.startswith(REMOTE_PREFIX):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.delete_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = DeleteBranchDialog(session_id, full_ref, window)
+        self.delete_dialog_by_session[session_id] = dialog
+        dialog.prepare_requested.connect(lambda intent: self._prepare_delete(session_id, dialog, intent))
+        dialog.delete_requested.connect(lambda intent: self.submit_delete(session_id, intent))
+        dialog.destination_changed.connect(lambda: self._prepare_delete_target(session_id, dialog))
+        dialog.retry_requested.connect(lambda: self._retry_delete(session_id, dialog))
+        dialog.finished.connect(lambda: self.delete_dialog_by_session.pop(session_id, None) if self.delete_dialog_by_session.get(session_id) is dialog else None)
+
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Discard reads for a closed or replaced form or a replaced repository session."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.delete_dialog_by_session, context, git_filename)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Refuse a stale badge capture before exposing a usable Delete button."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if (expected_snapshot is None or snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                    or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context
+                    or snapshot.object_oid_by_name.get(full_ref) != target_oid):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.SELECTED_REFERENCE_OR_REPOSITORY_CHANGED))
+                return
+            dialog.populate(snapshot)
+            reveal_form(dialog)
+            def remote_complete(remote_snapshot: RemoteSnapshot | None, remote_error: Exception | None) -> None:
+                """Attach remote configuration only when it still describes the same local capture."""
+                if not is_current() or dialog.busy or dialog.outcome is not None:
+                    return
+                if remote_error is not None:
+                    dialog.status_label.setText(dialog.text_filter.redact("Remote destination could not be read: " + str(remote_error)))
+                    return
+                if remote_snapshot.reference_state != snapshot.signature:
+                    dialog.show_error("References or configuration changed while reading remote destinations")
+                    return
+                dialog.populate_remote(remote_snapshot)
+            self.worktree_service.run(snapshot.context, snapshot.git_filename, self.remote.capture(snapshot.context, snapshot.git_filename, generation), remote_complete)
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_delete_branch(session_id, full_ref, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _open_local_branch_deletion(self, session_id: str, full_ref: str, target_oid: str, expected_snapshot: ReferenceSnapshot | None) -> DeleteLocalBranchDialog | None:
+        """Open the Delete branch window on the clicked local branch, from what the repository window already holds.
+
+        The references come from the window's own capture while their files are unchanged, and the deletable branches
+        are computed from them, so opening the window starts no Git process. A capture that no longer matches the
+        menu the branch was chosen from refuses the window instead of offering another branch.
+        """
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.local_branch_delete_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = DeleteLocalBranchDialog(session_id, window)
+        dialog.setAccessibleDescription(f"Delete local branches in {window.context.repository_dir}")
+        self.local_branch_delete_dialog_by_session[session_id] = dialog
+        dialog.delete_requested.connect(lambda full_refs: self._prepare_branch_deletion(session_id, dialog, full_refs))
+        dialog.finished.connect(lambda: self.local_branch_delete_dialog_by_session.pop(session_id, None)
+                                if self.local_branch_delete_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.local_branch_delete_dialog_by_session, context, git_filename)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Offer the deletable branches only when the references still match the menu the branch was chosen from."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if (expected_snapshot is None or snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                    or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context
+                    or snapshot.object_oid_by_name.get(full_ref) != target_oid):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.SELECTED_REFERENCE_OR_REPOSITORY_CHANGED))
+                return
+            dialog.populate(snapshot, deletable_branch_refs(snapshot), full_ref)
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_delete_branch(session_id, full_ref, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _local_branch_deletion_is_current(self, session_id: str, dialog: DeleteLocalBranchDialog) -> bool:
+        """Tell whether the Delete branch window may still act: open, registered for its window, with management rights."""
+        return (isValid(dialog) and not dialog.closed and self.local_branch_delete_dialog_by_session.get(session_id) is dialog
+                and dialog.snapshot is not None and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE))
+
+    def _prepare_branch_deletion(self, session_id: str, dialog: DeleteLocalBranchDialog, full_refs: tuple[str, ...]) -> None:
+        """Sort the chosen branches into merged and not merged as "git branch -d" would, then ask about the others once.
+
+        Each branch is compared with its upstream when it has one, and with HEAD otherwise. The history graph in memory
+        answers when it is complete and was read for the same HEAD as the form; otherwise Git is asked once per
+        distinct base commit. Merged branches alone are deleted without a question.
+        """
+        if not self._local_branch_deletion_is_current(session_id, dialog):
+            return
+        snapshot = dialog.snapshot
+        for full_ref in full_refs:
+            if full_ref not in dialog.candidate_refs:
+                dialog.release()
+                dialog.show_error(f"'{short_reference_name(full_ref)}' cannot be deleted from this window")
+                return
+        base_oid_by_ref = merge_base_oid_by_ref(snapshot, full_refs)
+        branch_oid_by_ref: dict[str, str] = {}
+        for full_ref in full_refs:
+            branch_oid_by_ref[full_ref] = snapshot.object_oid_by_name[full_ref]
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        history_snapshot = window.history_model.snapshot if window is not None and isValid(window) else None
+        unmerged_refs = None
+        if history_snapshot is not None and history_snapshot.head_oid == snapshot.head_oid:
+            unmerged_refs = unmerged_branch_refs_in_memory(branch_oid_by_ref, base_oid_by_ref, history_snapshot.parent_oids_by_oid, history_snapshot.complete)
+        if unmerged_refs is not None:
+            self._confirm_branch_deletion(session_id, dialog, full_refs, unmerged_refs)
+            return
+        dialog.classification_generation += 1
+        classification_generation = dialog.classification_generation
+
+        def complete(merged_ref_set: set[str] | None, error: Exception | None) -> None:
+            """Use Git's answer only for the request it was asked for, while the window is still the one that asked."""
+            if (not self._local_branch_deletion_is_current(session_id, dialog) or dialog.classification_generation != classification_generation
+                    or not dialog.busy):
+                return
+            if error is not None:
+                dialog.release()
+                dialog.show_error(str(error))
+                return
+            not_merged_refs: list[str] = []
+            for full_ref in full_refs:
+                if full_ref not in merged_ref_set:
+                    not_merged_refs.append(full_ref)
+            self._confirm_branch_deletion(session_id, dialog, full_refs, tuple(not_merged_refs))
+
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, self.reference.merged_branch_refs(snapshot, base_oid_by_ref), complete)
+
+    def _confirm_branch_deletion(self, session_id: str, dialog: DeleteLocalBranchDialog, full_refs: tuple[str, ...], unmerged_refs: tuple[str, ...]) -> None:
+        """Delete merged branches at once, or first ask one question that lists every branch that is not merged."""
+        unmerged_ref_set = set(unmerged_refs)
+        merged_refs: list[str] = []
+        for full_ref in full_refs:
+            if full_ref not in unmerged_ref_set:
+                merged_refs.append(full_ref)
+        if not unmerged_refs:
+            self._submit_branch_deletion(session_id, dialog, tuple(merged_refs), ())
+            return
+
+        def answer(accepted: bool) -> None:
+            """Delete everything on Yes; on No delete nothing and give the form back."""
+            if not accepted:
+                dialog.release()
+                return
+            self._submit_branch_deletion(session_id, dialog, tuple(merged_refs), unmerged_refs)
+
+        dialog.show_unmerged_question(unmerged_refs, answer)
+
+    def _submit_branch_deletion(self, session_id: str, dialog: DeleteLocalBranchDialog, merged_refs: tuple[str, ...], unmerged_refs: tuple[str, ...]) -> str | None:
+        """Freeze the classified branches into one request and submit it once, with its console opened before Git starts."""
+        if not self._local_branch_deletion_is_current(session_id, dialog):
+            return None
+        try:
+            intent = BranchDeletionIntent.capture(dialog.snapshot, merged_refs, unmerged_refs, session_id=session_id, refresh_advice=refresh_advice_text)
+        except ValueError as error:
+            dialog.release()
+            dialog.show_error(str(error))
+            return None
+        dialog.intent = intent
+        session = self.session_registry_controller.session_by_id[session_id]
+
+        def is_current() -> bool:
+            """Recheck the form and repository authority when queued Git actually starts."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+
+        self.branch_deletion_intent_by_id[intent.operation.operation_id] = intent
+        self.open_reference_output(intent, dialog)
+        return self.reference.delete_branches(intent, is_current=is_current)
+
+    def branch_deletion_finished(self, outcome: OperationOutcome) -> None:
+        """Show a group deletion's result in its window and console, then refresh every window of the repository."""
+        intent = self.branch_deletion_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        dialog = self.reference_form_by_id.get(outcome.operation_id)
+        if dialog is not None and isValid(dialog) and not dialog.closed and dialog.intent == intent:
+            dialog.show_outcome(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status != OperationStatus.REFUSED:
+            self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.REFERENCES)
+        self.finish_reference_output(outcome)
+
+    def _prepare_delete_target(self, session_id: str, dialog: DeleteBranchDialog) -> None:
+        """Capture one effective Push endpoint and its current account without network access."""
+        if dialog.closed or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or not dialog.remote_checkbox.isChecked():
+            return
+        if dialog.remote_snapshot is None or not dialog.remote_selector.currentData() or not dialog.endpoint_selector.currentData():
+            dialog.set_push_target(None, "Select a remote repository, remote branch and one Push endpoint")
+            return
+        try:
+            target = self.transport.capture_push_target(dialog.remote_snapshot, dialog.remote_selector.currentData(), dialog.endpoint_selector.currentData())
+            dialog.set_push_target(target)
+        except (ValueError, OSError) as error:
+            dialog.set_push_target(None, str(error))
+
+    def open_delete_tag(self, session_id: str, full_ref: str, target_oid: str, *, expected_snapshot: ReferenceSnapshot | None = None) -> DeleteTagDialog | None:
+        """Open the Delete tag window on the clicked tag, only for a tag of a live management session."""
+        if not full_ref.startswith(TAG_PREFIX) or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        return self._open_tag_deletion(session_id, full_ref, target_oid, expected_snapshot)
+
+    def _open_tag_deletion(self, session_id: str, full_ref: str, target_oid: str, expected_snapshot: ReferenceSnapshot | None) -> DeleteTagDialog | None:
+        """Open the Delete tag window on the clicked tag, from what the repository window already holds.
+
+        The tags and the remote names come from the window's own capture while its reference files are unchanged, so
+        opening the window starts no Git process; the remote configuration is read only once the remote option is
+        checked. A capture that no longer matches the menu the tag was chosen from refuses the window instead of
+        offering another tag.
+        """
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.delete_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = DeleteTagDialog(session_id, window)
+        dialog.setAccessibleDescription(f"Delete a tag in {window.context.repository_dir}")
+        self.delete_dialog_by_session[session_id] = dialog
+        dialog.delete_requested.connect(lambda intent: self._submit_tag_deletion(session_id, dialog, intent))
+        dialog.remote_requested.connect(lambda: self._read_tag_delete_remote(session_id, dialog))
+        dialog.retry_requested.connect(lambda: self._retry_delete(session_id, dialog))
+        dialog.finished.connect(lambda: self.delete_dialog_by_session.pop(session_id, None) if self.delete_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.delete_dialog_by_session, context, git_filename)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Offer the tags only when the references still match the menu the tag was chosen from."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if (expected_snapshot is None or snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                    or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context
+                    or snapshot.object_oid_by_name.get(full_ref) != target_oid):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.SELECTED_REFERENCE_OR_REPOSITORY_CHANGED))
+                return
+            dialog.populate(snapshot, full_ref)
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_delete_tag(session_id, full_ref, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _read_tag_delete_remote(self, session_id: str, dialog: DeleteTagDialog) -> None:
+        """Read the remote configuration once for a Delete tag window, the first time its remote option is checked.
+
+        The configuration must describe the very references the window shows; one read after a reference change is
+        refused, and checking the option again reads it anew.
+        """
+        snapshot = dialog.snapshot
+        session = self.session_registry_controller.session_by_id.get(session_id)
+        if snapshot is None or session is None or dialog.closed or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            dialog.remote_read_requested = False
+            return
+        generation = session.generation
+
+        def complete(remote_snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Hand the configuration to the form only while it still shows the same references and nothing was submitted."""
+            if (not self.reference_read_controller.form_is_current(session_id, generation, dialog, self.delete_dialog_by_session, snapshot.context, snapshot.git_filename)
+                    or dialog.snapshot is not snapshot or dialog.busy or dialog.outcome is not None):
+                return
+            if error is not None:
+                dialog.show_remote_error(str(error))
+                return
+            if remote_snapshot.reference_state != snapshot.signature:
+                dialog.show_remote_error("references or configuration changed while reading it")
+                return
+            dialog.populate_remote(remote_snapshot)
+
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, self.remote.capture(snapshot.context, snapshot.git_filename, generation), complete)
+
+    def _tag_delete_request(self, dialog: DeleteTagDialog) -> tuple | str:
+        """Turn the chosen remote into the one server a tag deletion goes to, or answer why it cannot be used.
+
+        The push address is the remote's only one: a remote pushing to several addresses is refused rather than
+        deleting the tag on several servers, and a remote whose configuration is inactive, ambiguous or gone is refused
+        too. Nothing has been deleted when a cause is answered.
+        """
+        remote_name = dialog.remote_combo.currentData()
+        if not remote_name:
+            return NO_REMOTE_CAUSE
+        remote_snapshot = dialog.remote_snapshot
+        entry = remote_snapshot.entry_by_name.get(remote_name) if remote_snapshot is not None else None
+        if entry is None or not entry.active or entry.collision:
+            return UNUSABLE_REMOTE_CAUSE.format(remote_name)
+        endpoint_set = set(entry.push_urls)
+        if not endpoint_set:
+            return NO_PUSH_ADDRESS_CAUSE.format(remote_name)
+        if len(endpoint_set) > 1:
+            return SEVERAL_PUSH_ADDRESSES_CAUSE.format(remote_name)
+        (endpoint,) = endpoint_set
+        try:
+            push_target = self.transport.capture_push_target(remote_snapshot, remote_name, endpoint)
+        except (ValueError, OSError) as error:
+            return str(error)
+        return (remote_snapshot, remote_name, dialog.intent.full_ref, endpoint, push_target)
+
+    def _submit_tag_deletion(self, session_id: str, dialog: DeleteTagDialog, intent: ReferenceDeletionIntent) -> None:
+        """Submit the tag deletion Delete froze, locally only or also on the chosen remote's single push address.
+
+        A remote that cannot be used is refused before anything is deleted. A form this controller cannot run any more
+        is given back with the reason, never left frozen.
+        """
+        if dialog.closed or self.delete_dialog_by_session.get(session_id) is not dialog:
+            return
+        dialog.remote_request = None
+        if dialog.remote_checkbox.isChecked():
+            request = self._tag_delete_request(dialog)
+            if isinstance(request, str):
+                dialog.show_error(request)
+                return
+            dialog.remote_request = request
+        if self.submit_delete(session_id, intent) is None and dialog.busy and not dialog.closed:
+            dialog.show_error("The deletion could not start. Close this window and try again.")
+
+    def _retry_delete(self, session_id: str, dialog: DeleteBranchDialog) -> None:
+        """Reread captured reference authority before retrying only its unfinished deletion steps."""
+        if dialog.closed or dialog.busy or dialog.outcome is None or dialog.intent is None or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        previous_outcome, previous_intent, previous_request = dialog.outcome, dialog.intent, dialog.remote_request
+        if previous_outcome.status not in (OperationStatus.FAILED, OperationStatus.REFUSED, OperationStatus.PARTIAL):
+            return
+        if any(step.operation == DELETE_REMOTE_TAG_OPERATION and step.status == OperationStatus.UNKNOWN for step in previous_outcome.steps):
+            return
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        dialog.busy = True
+        dialog.retry_button.setEnabled(False)
+        dialog.status_label.setText("Rereading the failed step…")
+        remote_success = any(step.operation == DELETE_REMOTE_BRANCH_OPERATION and step.status == OperationStatus.SUCCESS for step in previous_outcome.steps)
+        local_tag_success = previous_intent.full_ref.startswith(TAG_PREFIX) and any(step.operation == DELETE_LOCAL_TAG_OPERATION and step.status == OperationStatus.SUCCESS for step in previous_outcome.steps)
+
+        def read() -> Generator:
+            """Keep the original OID and destination while acquiring fresh local authority."""
+            snapshot = yield from self.reference.capture(session.repository_context, self.repository.git_filename, generation)
+            oid = snapshot.object_oid_by_name.get(previous_intent.full_ref)
+            if not local_tag_success and oid is not None and oid != previous_intent.target_oid:
+                reference_kind = "tag" if previous_intent.full_ref.startswith(TAG_PREFIX) else "branch"
+                raise ValueError(f"The original {reference_kind} changed; close this result and select the {reference_kind} again")
+            remote_snapshot = None
+            if previous_request is not None and (not remote_success or dialog.remote_branch):
+                remote_snapshot = yield from self.remote.capture(snapshot.context, snapshot.git_filename, generation)
+                if remote_snapshot.reference_state != snapshot.signature:
+                    raise ValueError("References changed while rereading the failed deletion")
+            return snapshot, remote_snapshot
+
+        def complete(value: tuple | None, error: Exception | None) -> None:
+            """Present any new unmerged warning before dispatching the fresh retry."""
+            if dialog.closed or session.is_closed:
+                return
+            if session.generation != generation:
+                dialog.show_error("The repository view changed while rereading; retry the failed step again")
+                return
+            if error is not None:
+                dialog.show_error(str(error))
+                return
+            snapshot, remote_snapshot = value
+            operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=generation, session_id=session_id,
+                                                action=OperationAction.REF_WRITE, targets=(previous_intent.full_ref, previous_intent.target_oid), operation="Delete tag" if previous_intent.full_ref.startswith(TAG_PREFIX) else "Delete branch",
+                                                from_form=True)
+            dialog.snapshot = snapshot
+            dialog.intent = replace(previous_intent, operation=operation, snapshot=snapshot, unmerged_confirmed=False)
+            dialog.retry_operation_id = previous_outcome.operation_id
+            dialog.retry_remote_success = remote_success
+            if dialog.remote_branch:
+                refreshed_intents: list[ReferenceDeletionIntent] = []
+                for candidate in dialog.local_intents:
+                    local_operation = replace(operation, targets=(candidate.full_ref, candidate.target_oid))
+                    refreshed_intents.append(replace(candidate, operation=local_operation, snapshot=snapshot, unmerged_confirmed=False))
+                dialog.local_intents = tuple(refreshed_intents)
+            if previous_request is not None and not remote_success:
+                _old_snapshot, name, destination, endpoint, _target = previous_request
+                try:
+                    target = self.transport.capture_push_target(remote_snapshot, name, endpoint)
+                except (ValueError, OSError) as failure:
+                    dialog.show_error(str(failure))
+                    return
+                dialog.remote_snapshot = remote_snapshot
+                dialog.remote_request = (remote_snapshot, name, destination, endpoint, target)
+            if not dialog.remote_branch:
+                # A tag has no merge question to ask: its deletion is checked again when Git starts.
+                self.submit_delete(session_id, dialog.intent)
+                return
+            self._prepare_delete(session_id, dialog, dialog.intent)
+        self.worktree_service.run(session.repository_context, self.repository.git_filename, read(), complete)
+
+    def _prepare_delete(self, session_id: str, dialog: DeleteBranchDialog, intent: ReferenceDeletionIntent) -> None:
+        """Read the merge proof asynchronously without holding an owner across a question."""
+        if dialog.closed or dialog.intent != intent or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+
+        def inspect() -> Generator:
+            """Check every selected candidate before asking for any destructive answer."""
+            if not dialog.remote_branch:
+                return (yield from self.reference.inspect_delete(intent))
+            success_ref_set = self._successful_delete_ref_set(dialog)
+            warning_refs: list[str] = []
+            for candidate in dialog.local_intents:
+                if candidate.full_ref in success_ref_set or dialog.retry_remote_success and candidate.full_ref not in intent.snapshot.object_oid_by_name:
+                    continue
+                merged = yield from self.reference.inspect_delete(candidate)
+                if not merged:
+                    warning_refs.append(candidate.full_ref)
+            dialog.warning_refs = warning_refs
+            return not warning_refs
+
+        def complete(merged: bool | None, error: Exception | None) -> None:
+            """Publish the merge result only to the unchanged original form."""
+            if dialog.closed or dialog.intent != intent or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            if error is not None:
+                dialog.show_error(str(error))
+                return
+            dialog.prepared(merged)
+        self.worktree_service.run(intent.snapshot.context, intent.snapshot.git_filename, inspect(), complete)
+
+    def _successful_delete_ref_set(self, dialog: DeleteBranchDialog) -> set[str]:
+        """Keep completed local candidates out of later retries even if their refs reappear."""
+        if not dialog.retry_remote_success or dialog.outcome is None:
+            return set()
+        return {step.full_ref for step in dialog.outcome.steps if step.operation == DELETE_LOCAL_BRANCH_OPERATION and step.status == OperationStatus.SUCCESS}
+
+    def _delete_remote_candidates(self, dialog: DeleteBranchDialog, intent: ReferenceDeletionIntent, is_current: Callable[[], bool]) -> Generator:
+        """Revalidate each remaining tracking branch under the existing server operation owner."""
+        success_ref_set = self._successful_delete_ref_set(dialog)
+        expected = intent.snapshot
+        remote_snapshot, _name, _destination, _endpoint, _target = dialog.remote_request
+        steps: list[OperationStepResult] = []
+        status, diagnostic = OperationStatus.SUCCESS, None
+        for candidate in dialog.local_intents:
+            if candidate.full_ref in success_ref_set:
+                continue
+            if status != OperationStatus.SUCCESS:
+                steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.NOT_STARTED, effect="previous local step did not succeed", full_ref=candidate.full_ref))
+                continue
+            try:
+                if not is_current():
+                    raise ValueError("The deletion form or repository authority is no longer current")
+                current = yield from self.reference.capture(expected.context, expected.git_filename, expected.generation)
+                if current.signature != expected.signature or current.head_oid != intent.snapshot.head_oid or current.head_ref != intent.snapshot.head_ref:
+                    raise ValueError("References, HEAD or worktrees changed before local deletion")
+                observed = yield from self.remote.capture(expected.context, expected.git_filename, expected.generation)
+                if observed.reference_state != current.signature:
+                    raise ValueError("References changed while checking local tracking")
+                absent = candidate.full_ref not in current.object_oid_by_name
+                ignored_ref_set = success_ref_set | ({candidate.full_ref} if absent and dialog.retry_remote_success else set())
+                ignored_prefixes = tuple("branch." + full_ref.removeprefix(LOCAL_PREFIX) + "." for full_ref in ignored_ref_set)
+                expected_values = tuple(value for value in remote_snapshot.values if not value.key.startswith(ignored_prefixes))
+                observed_values = tuple(value for value in observed.values if not value.key.startswith(ignored_prefixes))
+                if observed_values != expected_values:
+                    raise ValueError("Remote configuration or branch tracking changed before local deletion")
+                if not absent:
+                    candidates = remote_delete_candidates(current, observed, intent.full_ref, intent.operation.session_id)
+                    if not any(value.full_ref == candidate.full_ref and value.target_oid == candidate.target_oid for value in candidates):
+                        raise ValueError("The original local tracking branch changed; select it again")
+                operation = replace(intent.operation, targets=(candidate.full_ref, candidate.target_oid))
+                local_intent = replace(candidate, operation=operation, snapshot=current, unmerged_confirmed=intent.unmerged_confirmed)
+                outcome = yield from self.reference.delete_sequence(local_intent, is_current=is_current, allow_absent=dialog.retry_remote_success)
+                for step in outcome.steps:
+                    steps.append(replace(step, full_ref=candidate.full_ref))
+                status, diagnostic = outcome.status, outcome.diagnostic
+                if status == OperationStatus.SUCCESS:
+                    success_ref_set.add(candidate.full_ref)
+                    *_, last_step = outcome.steps
+                    expected = last_step.after
+            except (ValueError, OSError, GitCommandError) as error:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(DELETE_LOCAL_BRANCH_OPERATION, expected.context.repository_dir, expected.git_filename, [], str(error)).prepare()
+                status = OperationStatus.REFUSED
+                steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, status, effect="not deleted", diagnostic=diagnostic, full_ref=candidate.full_ref))
+        return OperationOutcome(intent.operation.operation_id, status, tuple(steps), diagnostic)
+
+    def submit_delete(self, session_id: str, intent: ReferenceDeletionIntent) -> str | None:
+        """Reserve the exact displayed deletion and recheck the form at native launch."""
+        dialog = self.delete_dialog_by_session.get(session_id)
+        if (dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id
+                or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE)):
+            return None
+        if intent.operation.operation_id in self.transport.run_by_id:
+            return intent.operation.operation_id
+        session = self.session_registry_controller.session_by_id[session_id]
+
+        def is_current() -> bool:
+            """Reject late writes after authority, executable or form lifetime changes."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+        self.delete_intent_by_id[intent.operation.operation_id] = intent
+        if dialog.remote_branch and not dialog.remote_checkbox.isChecked():
+            dialog.show_error("Select remote repository deletion before continuing")
+            return None
+        if dialog.remote_checkbox.isChecked():
+            if dialog.remote_request is None:
+                dialog.show_error("Choose the exact remote deletion destination")
+                return None
+            snapshot, remote_name, destination_ref, endpoint, target = dialog.remote_request
+            request = TransportRequest(intent.operation, remote_name=remote_name, snapshot=snapshot, mode="delete", source_ref=intent.full_ref,
+                                       source_oid=intent.target_oid, destination_ref=destination_ref, endpoint=endpoint, push_target=target,
+                                       delete_local_refs=tuple((candidate.full_ref, candidate.target_oid) for candidate in dialog.local_intents) if dialog.remote_branch else ())
+
+            def preflight() -> Generator:
+                """Prove the local branch is still deletable before changing its remote."""
+                if dialog.remote_branch:
+                    current = yield from self.reference.capture(intent.snapshot.context, intent.snapshot.git_filename, intent.snapshot.generation)
+                    if current.signature != intent.snapshot.signature or current.object_oid_by_name.get(intent.full_ref) != intent.target_oid:
+                        raise ValueError("The remote branch capture changed before deletion")
+                    if remote_branch_destination(snapshot, intent.full_ref) != (remote_name, destination_ref):
+                        raise ValueError("The displayed remote branch no longer matches its Fetch mapping")
+                    for candidate in dialog.local_intents:
+                        merged = yield from self.reference.inspect_delete(candidate)
+                        if not merged and not intent.unmerged_confirmed:
+                            raise ValueError("Explicit confirmation is required for an unmerged local tracking branch")
+                    return
+                merged = yield from self.reference.inspect_delete(intent)
+                if not merged and not intent.unmerged_confirmed:
+                    raise ValueError("Explicit confirmation is required for this unmerged branch")
+
+            def local_sequence() -> Generator:
+                """Keep server success and the shared owner while performing only the local step."""
+                if dialog.remote_branch:
+                    return (yield from self._delete_remote_candidates(dialog, intent, lambda: is_current() and not run.cancelled))
+                return (yield from self.reference.delete_sequence(intent, is_current=lambda: is_current() and not run.cancelled, allow_absent=dialog.retry_remote_success))
+
+            local_tag_success = intent.full_ref.startswith(TAG_PREFIX) and dialog.outcome is not None and any(step.operation == DELETE_LOCAL_TAG_OPERATION and step.status == OperationStatus.SUCCESS for step in dialog.outcome.steps)
+            if dialog.retry_remote_success or local_tag_success:
+                run = self.transport.reconcile(request, dialog.retry_operation_id, local_sequence=local_sequence, is_current=is_current)
+            else:
+                run = self.transport.delete_remote(request, preflight=preflight, local_sequence=local_sequence if not dialog.remote_branch or dialog.local_intents else None, is_current=is_current)
+            output_dialog = OperationDialog(run.trace, intent.operation.operation, self.session_registry_controller.window_by_session[session_id], preference=self.preference, console_operation=ConsoleOperation.REMOTE_DELETE)
+            self.console_registry_controller.transport_dialog_by_id[intent.operation.operation_id] = output_dialog
+            output_dialog.abort_requested.connect(lambda: self.transport.cancel(intent.operation.operation_id))
+            output_dialog.finished.connect(run.trace.close)
+            output_dialog.set_running()
+            open_window_modal(output_dialog, keeps_window_buttons=True)
+            return intent.operation.operation_id
+        return self.reference.delete(intent, is_current=is_current)
+
+    def delete_finished(self, outcome: object) -> None:
+        """Retain individual results and refresh every related repository window."""
+        intent = self.delete_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        dialog = self.delete_dialog_by_session.get(intent.operation.session_id)
+        if dialog is not None and not dialog.closed and dialog.intent == intent:
+            dialog.show_outcome(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status == OperationStatus.REFUSED or outcome.operation_id in self.transport.run_by_id:
+            return
+        self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.REFERENCES)
+
+    def open_branch(self, session_id: str, mode: BranchMode, target_oid: str, *, expected_snapshot: ReferenceSnapshot | None = None,
+                    full_ref: str = "") -> CreateBranchDialog | RenameBranchDialog | ResetOtherBranchDialog | None:
+        """Open branch editing for one captured commit under a live management authority."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or mode not in (BranchMode.CREATE, BranchMode.RENAME, BranchMode.MOVE):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.branch_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        if mode == BranchMode.CREATE:
+            return self._open_create_branch(session_id, target_oid, expected_snapshot)
+        if mode == BranchMode.RENAME:
+            return self._open_rename_branch(session_id, full_ref, target_oid, expected_snapshot)
+        return self._open_reset_other_branch(session_id, target_oid, expected_snapshot)
+
+    def _open_reset_other_branch(self, session_id: str, target_oid: str, expected_snapshot: ReferenceSnapshot | None) -> ResetOtherBranchDialog:
+        """Open the Reset branch window on one commit, drawn from what the repository window already holds.
+
+        The references come from the window's own capture while their files are unchanged and the commit box from the
+        history graph, so opening on a displayed commit starts no Git process. Whether resetting the chosen branch is
+        a fast-forward is answered from the target's ancestors in memory, walked once per window, when the graph is
+        complete; otherwise one ``merge-base --is-ancestor`` per chosen branch asks Git.
+        """
+        window = self.session_registry_controller.window_by_session[session_id]
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = ResetOtherBranchDialog(session_id, target_oid, window)
+        dialog.setAccessibleDescription(f"Reset another branch in {window.context.repository_dir}")
+        self.branch_dialog_by_session[session_id] = dialog
+        dialog.branch_requested.connect(lambda intent: self.submit_branch(session_id, intent))
+        dialog.finished.connect(lambda: self.branch_dialog_by_session.pop(session_id, None) if self.branch_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+        # The target's ancestors never change, so they are walked at most once for this window.
+        target_ancestry_by_oid: dict[str, set[str] | None] = {}
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.branch_dialog_by_session, context, git_filename) and not dialog.busy
+
+        def target_ancestry() -> set[str] | None:
+            """Return the target and its ancestors from a complete graph in memory, or None when only Git can tell."""
+            if target_oid not in target_ancestry_by_oid:
+                history_snapshot = window.history_model.snapshot if isValid(window) else None
+                if history_snapshot is None:
+                    return None
+                target_ancestry_by_oid[target_oid] = complete_ancestor_oid_set(target_oid, history_snapshot.parent_oids_by_oid, history_snapshot.complete)
+            return target_ancestry_by_oid[target_oid]
+
+        def inspect_ancestry(full_ref: str, old_oid: str) -> None:
+            """Tell the form whether moving the chosen branch to the target is a fast-forward, from memory or from Git."""
+            snapshot = dialog.snapshot
+            if snapshot is None or not is_current():
+                return
+            fast_forward = is_ancestor_in_memory(old_oid, target_ancestry())
+            if fast_forward is not None:
+                dialog.show_ancestry(full_ref, fast_forward)
+                return
+
+            def inspected(result: bool | None, error: Exception | None) -> None:
+                """Ignore ancestry from a closed form or replaced reference capture."""
+                if is_current() and dialog.snapshot is snapshot:
+                    dialog.show_ancestry(full_ref, result, str(error) if error else "")
+
+            self.worktree_service.run(snapshot.context, snapshot.git_filename, self.reference.is_fast_forward(old_oid, target_oid), inspected)
+
+        dialog.ancestry_requested.connect(inspect_ancestry)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Offer the branches and fill the commit box only while the form and the references it was asked from are current."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                                                  or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.REFERENCE_CHANGED_BEFORE_OPENING))
+                return
+            # Git refuses to reset exactly the branches it refuses to delete: the current one and those another worktree,
+            # a rebase or a bisect holds; symbolic branches and branches without a commit cannot be moved either.
+            dialog.populate(snapshot, target_oid, deletable_branch_refs(snapshot))
+            reveal_form(dialog)
+            self._show_target_commit(session_id, dialog, target_oid, is_current)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_branch(session_id, BranchMode.MOVE, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _open_rename_branch(self, session_id: str, full_ref: str, target_oid: str, expected_snapshot: ReferenceSnapshot | None) -> RenameBranchDialog:
+        """Open the Rename branch window on one local branch, drawn from the references the repository window already holds.
+
+        The window shows no commit, so nothing but the references is read, and those come from the window's own capture
+        while their files are unchanged: opening it starts no Git process.
+        """
+        window = self.session_registry_controller.window_by_session[session_id]
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = RenameBranchDialog(session_id, full_ref, target_oid, window)
+        dialog.setAccessibleDescription(f"Rename a branch in {window.context.repository_dir}")
+        self.branch_dialog_by_session[session_id] = dialog
+        dialog.branch_requested.connect(lambda intent: self.submit_branch(session_id, intent))
+        dialog.finished.connect(lambda: self.branch_dialog_by_session.pop(session_id, None) if self.branch_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Bind the window to the references only while it is current and its branch is still the one clicked."""
+            if not self.reference_read_controller.form_is_current(session_id, generation, dialog, self.branch_dialog_by_session, context, git_filename) or dialog.busy:
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                                                  or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.REFERENCE_CHANGED_BEFORE_OPENING))
+                return
+            reference = next((reference for reference in snapshot.references if reference.full_name == full_ref), None)
+            if reference is None or reference.kind != ReferenceKind.HEADS or reference.symbolic_target or reference.target_oid != target_oid:
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.SELECTED_LOCAL_BRANCH_CHANGED))
+                return
+            dialog.populate(snapshot, full_ref, target_oid)
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_branch(session_id, BranchMode.RENAME, target_oid, expected_snapshot=capture, full_ref=full_ref))
+        return dialog
+
+    def _open_create_branch(self, session_id: str, target_oid: str, expected_snapshot: ReferenceSnapshot | None) -> CreateBranchDialog:
+        """Open the Create branch window on one commit, drawn from what the repository window already holds.
+
+        The references come from the window's own capture while their files are unchanged, the proposed name from
+        those references, and the commit box and position from the history graph in memory, so opening on a displayed
+        commit of a fully loaded graph starts no Git process.
+        """
+        window = self.session_registry_controller.window_by_session[session_id]
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        expected_snapshot = expected_snapshot or self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = CreateBranchDialog(session_id, target_oid, window)
+        dialog.setAccessibleDescription(f"Create a branch in {window.context.repository_dir}")
+        self.branch_dialog_by_session[session_id] = dialog
+        dialog.branch_requested.connect(lambda intent: self.submit_branch(session_id, intent))
+        dialog.finished.connect(lambda: self.branch_dialog_by_session.pop(session_id, None) if self.branch_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.branch_dialog_by_session, context, git_filename) and not dialog.busy
+
+        self._bind_revision_picker(session_id, dialog, is_current)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Show the commit and the proposed name only while the form and the references it was asked from are current."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.signature != expected_snapshot.signature or snapshot.generation != expected_snapshot.generation
+                                                  or snapshot.git_filename != expected_snapshot.git_filename or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.REFERENCE_CHANGED_BEFORE_OPENING))
+                return
+            dialog.populate(snapshot, target_oid, suggested_branch_name(snapshot, target_oid))
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_branch(session_id, BranchMode.CREATE, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _show_target_commit(self, session_id: str, dialog: CreateBranchDialog | ResetOtherBranchDialog, oid: str, is_current: Callable[[], bool]) -> None:
+        """Fill a form's commit box for its new target from the history graph, and from one Git read only when the graph lacks it.
+
+        A commit the graph shows already carries its subject, author and date. Only a commit not loaded yet, or one
+        whose details the graph could not read, costs a ``git show``, whose answer is dropped once the form targets
+        another commit or went away. A box already filled, or refused, for this very commit is left as it is.
+        """
+        if dialog.commit_summary.target_oid != oid or dialog.metadata_ready or dialog.metadata_failed:
+            return
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        history_model = window.history_model if window is not None else None
+        row = history_model.row_by_oid.get(oid) if history_model is not None else None
+        if row is not None and not history_model.commits[row].detail_error:
+            dialog.show_loaded_commit(history_model.commits[row])
+            return
+        snapshot = dialog.snapshot
+        if snapshot is None:
+            return
+
+        def complete(fields: tuple | None, error: Exception | None) -> None:
+            """Publish the commit only to the form and target it was read for."""
+            if not is_current() or dialog.commit_summary is None or dialog.commit_summary.target_oid != oid:
+                return
+            dialog.show_metadata(fields, str(error) if error else "")
+
+        self.reference.metadata(snapshot, oid, complete)
+
+    def submit_branch(self, session_id: str, intent: BranchIntent) -> str | None:
+        """Reserve only the exact branch intention shown by a live management form."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        dialog = self.branch_dialog_by_session.get(session_id)
+        if dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id:
+            return None
+        session = self.session_registry_controller.session_by_id[session_id]
+        def is_current() -> bool:
+            """Recheck live session, executable and context at the actual native launch."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+        self.branch_intent_by_id[intent.operation.operation_id] = intent
+        if intent.mode == BranchMode.RENAME:
+            return self.reference.rename_branch(intent, is_current=is_current)
+        self.open_reference_output(intent, dialog)
+        if intent.mode == BranchMode.MOVE:
+            return self.reference.move_branch(intent, is_current=is_current)
+        return self.reference.create_branch(intent, is_current=is_current)
+
+    def branch_finished(self, outcome: object) -> None:
+        """Show observed effects and refresh related windows after native branch writes."""
+        intent = self.branch_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        dialog = self.branch_dialog_by_session.get(intent.operation.session_id)
+        expected_form = self.reference_form_by_id.get(outcome.operation_id) if intent.mode != BranchMode.RENAME else dialog
+        if dialog is not None and dialog is expected_form and isValid(dialog) and not dialog.closed and dialog.intent == intent:
+            dialog.show_outcome(outcome)
+        self.finish_reference_output(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status == OperationStatus.REFUSED:
+            return
+        # The scope follows what was asked, not the result: a checkout that started and failed may have changed files.
+        # An orphan branch is always checked out, and replaces the index and working files with the target's tree.
+        checkout_asked = intent.mode in (BranchMode.CREATE_CHECKOUT, BranchMode.CREATE_ORPHAN) or intent.mode == BranchMode.MOVE and intent.checkout_after_reset
+        if outcome.status == OperationStatus.SUCCESS and intent.mode in HISTORY_TOP_BRANCH_MODE_SET and intent.operation.session_id is not None:
+            self.history_read_controller.history_top_session_set.add(intent.operation.session_id)
+        self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.FULL if checkout_asked else RefreshScope.REFERENCES)
+
+    def open_reference_output(self, intent: TagIntent | BranchIntent | CheckoutIntent | BranchDeletionIntent | ReplayIntent | MergeAbortIntent,
+                               form: CheckoutDialog | CheckoutRevisionDialog | CreateBranchDialog | CreateTagDialog | DeleteLocalBranchDialog | ReplayDialog | None,
+                               *, modal: bool = True) -> OperationDialog:
+        """Subscribe before Git starts and keep its output independent of the input form.
+
+        Cherry-pick and Revert consoles are not modal: they can end on a pause that needs the repository window,
+        its banner and the conflict prompt, which a window-modal console would block. A Continue or Abort started
+        from the repository banner has no form, so ``form`` is None there.
+        """
+        operation = intent.operation
+        trace = OperationTrace(operation.operation_id, self.repository.runner, self.diagnostic_log, native_commands_only=operation.action in NATIVE_ONLY_CONSOLE_ACTION_SET,
+                               header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        output = OperationDialog(trace, operation.operation, self.session_registry_controller.window_by_session[operation.session_id], preference=self.preference, console_operation=ConsoleOperation.REFERENCE)
+        self.reference_trace_by_id[operation.operation_id] = trace
+        self.console_registry_controller.reference_output_by_id[operation.operation_id] = output
+        self.reference_label_by_id[operation.operation_id] = operation.operation
+        self.reference_form_by_id[operation.operation_id] = form
+
+        def closed() -> None:
+            """Release retained output only after the user or success policy dismisses it."""
+            self.reference_trace_by_id.pop(operation.operation_id, None)
+            self.console_registry_controller.reference_output_by_id.pop(operation.operation_id, None)
+            self.reference_label_by_id.pop(operation.operation_id, None)
+            self.reference_form_by_id.pop(operation.operation_id, None)
+            self.created_tag_by_id.pop(operation.operation_id, None)
+            trace.close()
+
+        output.finished.connect(closed)
+        self.session_registry_controller.session_by_id[operation.session_id].closed.connect(output.reject)
+        output.set_running()
+        if modal:
+            open_window_modal(output, keeps_window_buttons=True)
+            return output
+        output.show()
+        output.raise_()
+        output.activateWindow()
+        return output
+
+    def finish_reference_output(self, outcome: OperationOutcome, *, failure_text: str = "") -> None:
+        """Publish the result after all listeners have collected the final native output.
+
+        ``failure_text`` is shown in bold red under the status line of a failed result, for a refusal the user must
+        read to act on it rather than find among the console's status lines.
+
+        A refused operation never reached Git's write, so its console ends with one red line that says why, such as
+        ``Create tag: not started — <reason>``: the step lines and the diagnostic block are stored and logged as before,
+        but not shown, since they would only repeat that nothing started. Every other result shows its step lines.
+        """
+        trace = self.reference_trace_by_id.get(outcome.operation_id)
+        output = self.console_registry_controller.reference_output_by_id.get(outcome.operation_id)
+        label = self.reference_label_by_id.get(outcome.operation_id)
+        self.reference_form_by_id.pop(outcome.operation_id, None)
+        if trace is None or output is None or label is None or not isValid(output):
+            return
+
+        def publish_result() -> None:
+            """Let the trace flush its final fragment before automatic console closure."""
+            if not isValid(output) or output.dismissed:
+                return
+            refused = outcome.status == OperationStatus.REFUSED
+            for step in outcome.steps:
+                # A step about one reference among several names it, so each branch of a group deletion has its own line.
+                subject = step.operation + (" " + short_reference_name(step.full_ref) if step.full_ref else "")
+                step_text = subject + ": " + step.status.value
+                if refused:
+                    trace.append_record(outcome.operation_id, "status", step_text, None)
+                else:
+                    trace.append_event(outcome.operation_id, "status", step_text)
+            end_text = operation_end_text(label, outcome.status)
+            if outcome.diagnostic is not None and refused:
+                end_text = end_line_with_cause(end_text, trace.unshown_cause(outcome.diagnostic) or "")
+                trace.append_record(outcome.operation_id, "status", outcome.diagnostic.detail, None)
+            elif outcome.diagnostic is not None:
+                trace.append_diagnostic(outcome.operation_id, "status", outcome.diagnostic, outcome.status)
+            failure_reported = outcome.diagnostic is not None
+            trace.append_end_line(outcome.operation_id, "status", REFERENCE_RESULT_LOG_TEMPLATE.format(status=outcome.status.value), end_text,
+                                  outcome.status, failure_reported=failure_reported)
+            output.show_result(outcome.status, failure_reported=failure_reported, failure_text=failure_text)
+
+        publish_after_trace(publish_result)
+
+    def _bind_revision_picker(self, session_id: str, dialog: RevisionForm, is_current: Callable[[], bool]) -> None:
+        """Connect a form's revision field to the resolution of what is typed and to the position of each new target.
+
+        Every form built around the Git Extensions revision field uses this same binding. ``is_current`` tells
+        whether an answer may still reach the form. The form connects its own target handling first, so a new
+        target's older position and commit details are invalidated before the new ones are filled. Following the
+        field's target covers every way a target arrives: opening, typing, the choice window and a restored commit.
+        """
+        def resolve(text: str, final: bool) -> None:
+            """Resolve the text the field reports after a typing pause or when it is left."""
+            self._resolve_revision_text(session_id, dialog, text, final, is_current)
+
+        def show_position(oid: str | None) -> None:
+            """Count how far each new target is from HEAD and fill the commit box; a field without a target shows neither."""
+            if oid is None or not is_current():
+                return
+            self._show_revision_position(session_id, dialog, oid)
+            if dialog.commit_summary is not None:
+                self._show_target_commit(session_id, dialog, oid, is_current)
+
+        def close_choice() -> None:
+            """Close the revision choice window together with the form it chooses for."""
+            choice = dialog.picker.revision_dialog
+            if choice is not None and isValid(choice) and not choice.closed:
+                choice.reject()
+
+        dialog.picker.revision_edited.connect(resolve)
+        dialog.picker.target_changed.connect(show_position)
+        dialog.picker.choose_requested.connect(lambda: self._open_revision_choice(session_id, dialog, is_current))
+        dialog.finished.connect(close_choice)
+
+    def _resolve_revision_text(self, session_id: str, dialog: RevisionForm, text: str, final: bool, is_current: Callable[[], bool]) -> None:
+        """Turn the text typed in a revision field into the form's target, from memory whenever memory can prove it.
+
+        HEAD, a full commit ID of the loaded graph and an unambiguous reference name are resolved without Git; any
+        other text costs one ``rev-parse``, whose answer is dropped once the text changed or the form went away. A
+        target found for a typing pause keeps the typed text; one found when the field is left shows its short hash.
+        A text already refused is refused again without Git. Leaving the field while the pause's ``rev-parse`` still
+        runs starts no second one: that answer settles the field as if it had been asked when the field was left.
+        """
+        if not is_current() or dialog.snapshot is None:
+            return
+        picker = dialog.picker
+        problem = revision_text_problem(text)
+        if problem or (text == picker.answered_text and picker.answered_oid is None):
+            self._refuse_revision_text(dialog, text, problem, final)
+            return
+        resolution_generation = picker.resolution_generation
+
+        def found(oid: str | None) -> None:
+            """Take the answer only for the text and form it was asked for; a field left meanwhile is settled by it."""
+            if not is_current() or picker.resolution_generation != resolution_generation:
+                return
+            settled = final or picker.settle_generation == resolution_generation
+            if oid is None:
+                self._refuse_revision_text(dialog, text, "", settled)
+                return
+            dialog.set_target(oid, rewrite_text=settled)
+
+        self._find_revision(session_id, dialog.snapshot, text, found)
+
+    def _find_revision(self, session_id: str, snapshot: ReferenceSnapshot, text: str, callback: Callable[[str | None], None]) -> None:
+        """Find the commit a revision text names, from memory when memory can prove it and by one Git read otherwise.
+
+        A memory answer reaches the callback at once, before this returns; a Git answer arrives later. The callback
+        receives None for a text that names no commit, a text Git must never receive, or a failed read.
+        """
+        if revision_text_problem(text):
+            callback(None)
+            return
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        history_snapshot = window.history_model.snapshot if window is not None else None
+        parent_oids_by_oid = history_snapshot.parent_oids_by_oid if history_snapshot is not None else {}
+        oid = resolve_revision_in_memory(text, snapshot.references, snapshot.head_oid, parent_oids_by_oid)
+        if oid is not None:
+            callback(oid)
+            return
+
+        def complete(resolved_oid: str | None, error: Exception | None) -> None:
+            """Treat a failed read like a text that names no commit."""
+            callback(resolved_oid if error is None else None)
+
+        self.reference.resolve_revision(snapshot, text, complete)
+
+    def _open_revision_choice(self, session_id: str, dialog: RevisionForm, is_current: Callable[[], bool]) -> None:
+        """Open the "Choose another revision" window of Cherry-pick for a form's revision field.
+
+        The commit clicked in its list, or the revision typed in it, is resolved like the field's own text: a loaded
+        commit needs no Git. The form takes the commit and the window closes; a text naming no commit stays in the
+        window with its explanation.
+        """
+        if not is_current() or dialog.snapshot is None:
+            return
+        picker = dialog.picker
+        if picker.revision_dialog is not None and isValid(picker.revision_dialog) and not picker.revision_dialog.closed:
+            picker.revision_dialog.raise_()
+            return
+        window = self.session_registry_controller.window_by_session[session_id]
+        selector = RevisionChoiceDialog(window.history_model.commits, dialog)
+        picker.revision_dialog = selector
+
+        def read_revision(text: str) -> None:
+            """Resolve the chosen revision for this edit of the choice window only."""
+            generation = selector.generation
+
+            def found(oid: str | None) -> None:
+                """Hand the commit to the form, or explain in the choice window that the text names none."""
+                if not isValid(selector) or selector.closed or selector.generation != generation or not is_current():
+                    return
+                if oid is None:
+                    selector.show_error()
+                    return
+                dialog.set_target(oid)
+                selector.accept()
+
+            self._find_revision(session_id, dialog.snapshot, text, found)
+
+        selector.revision_requested.connect(read_revision)
+        open_window_modal(selector)
+        selector.revision_edit.setFocus()
+
+    def _refuse_revision_text(self, dialog: RevisionForm, text: str, problem: str, final: bool) -> None:
+        """Answer a text that names no commit: no target while the user types, the previous commit once the field is left.
+
+        Leaving the field explains the refusal in the form's message box, as Git Extensions does. The previous commit
+        comes back after the message, so the form can act on it again.
+        """
+        if not final:
+            dialog.picker.show_invalid()
+            return
+        cause = problem or "'" + text + "' is not a revision of this repository"
+        dialog.show_error(cause + "; the previous revision is kept.")
+        dialog.picker.restore_last_target()
+
+    def _commit_difference_from_graph(self, session_id: str, snapshot: ReferenceSnapshot, target_oid: str) -> tuple[int, int] | None:
+        """Count the commits only in HEAD and only in the target from the window's history graph, or None when it cannot prove them.
+
+        The graph answers only when it was read for the same HEAD as the form's references and holds HEAD's whole
+        ancestry and the target; the counts have the order of ``git rev-list --left-right --count HEAD...target``.
+        """
+        if snapshot.head_oid is None:
+            return None
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        history_model = window.history_model if window is not None and isValid(window) else None
+        history_snapshot = history_model.snapshot if history_model is not None else None
+        if history_snapshot is None or history_snapshot.head_oid != snapshot.head_oid:
+            return None
+        return commit_difference_in_memory(target_oid, history_model.relative_oid_set, history_snapshot.parent_oids_by_oid)
+
+    def _show_revision_position(self, session_id: str, dialog: RevisionForm, target_oid: str) -> None:
+        """Show how far a commit is from HEAD, from the history graph in memory, and from Git only when memory cannot tell.
+
+        HEAD without a commit shows nothing, as in Git Extensions. The graph answers only when it is complete and was
+        read for the same HEAD as the form; otherwise one native count is started, and a late answer for another
+        target or a closed form is dropped.
+        """
+        snapshot = dialog.snapshot
+        if snapshot is None:
+            return
+        if snapshot.head_oid is None:
+            dialog.picker.show_count("")
+            return
+        difference = self._commit_difference_from_graph(session_id, snapshot, target_oid)
+        if difference is not None:
+            dialog.picker.show_count(commit_count_text(difference))
+            return
+        position_generation = dialog.position_generation
+
+        def complete(difference: tuple[int, int] | None, error: Exception | None) -> None:
+            """Show Git's count only for the target and form it was asked for."""
+            if not isValid(dialog) or dialog.closed or dialog.position_generation != position_generation or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            dialog.picker.show_count(commit_count_text(difference if error is None else None))
+
+        self.reference.difference(snapshot, target_oid, complete)
+
+    def open_checkout(self, session_id: str, full_ref: str, *, target_oid: str | None = None,
+                      expected_snapshot: ReferenceSnapshot | None = None) -> CheckoutDialog | None:
+        """Open a captured branch choice only from a live management window."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.checkout_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        previous_snapshot = self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        if expected_snapshot is None:
+            expected_snapshot = previous_snapshot
+        if target_oid is None and previous_snapshot is not None:
+            for reference in previous_snapshot.references:
+                if reference.full_name == full_ref:
+                    target_oid = reference.target_oid
+                    break
+        dialog = CheckoutDialog(session_id, window)
+        dialog.setWindowTitle(f"Checkout — {os.path.basename(window.context.repository_dir)}")
+        dialog.setAccessibleDescription(f"Check out a branch in {window.context.repository_dir}")
+        dialog.checkout_button.setAccessibleDescription(f"Check out the selected reference in {window.context.repository_dir}")
+        self.checkout_dialog_by_session[session_id] = dialog
+        dialog.checkout_requested.connect(lambda intent: self.submit_checkout(session_id, intent))
+        dialog.selection_changed.connect(lambda oid: self._compare_checkout(session_id, dialog, oid))
+        dialog.lost_commit_count_requested.connect(lambda local_oid, remote_oid: self._count_lost_commits(session_id, dialog, local_oid, remote_oid))
+        dialog.finished.connect(lambda: self.checkout_dialog_by_session.pop(session_id, None) if self.checkout_dialog_by_session.get(session_id) is dialog else None)
+
+        context, git_filename = window.context, self.repository.git_filename
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Keep the target frozen and prevent publication after closure, refresh or submission."""
+            if not self.reference_read_controller.form_is_current(session_id, generation, dialog, self.checkout_dialog_by_session, context, git_filename) or dialog.busy:
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.head_oid != expected_snapshot.head_oid or snapshot.head_ref != expected_snapshot.head_ref
+                                                  or snapshot.generation != expected_snapshot.generation or snapshot.git_filename != expected_snapshot.git_filename):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.HEAD_CHANGED_BEFORE_OPENING))
+                return
+            if target_oid is not None:
+                selected = next((reference for reference in snapshot.references if reference.full_name == full_ref), None)
+                if selected is None or selected.target_oid != target_oid:
+                    refuse_form_opening(dialog, refresh_advice_text(SharedText.SELECTED_REFERENCE_CHANGED))
+                    return
+            dialog.populate(snapshot, full_ref)
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_checkout(session_id, full_ref, target_oid=target_oid, expected_snapshot=capture))
+        return dialog
+
+    def _compare_checkout(self, session_id: str, dialog: CheckoutDialog, target_oid: str) -> None:
+        """Show how the chosen branch differs from HEAD, from the history graph in memory, and from Git only when memory cannot tell.
+
+        The answer is bound to the selected target and the dialog generation, so a late Git count for an older choice
+        is dropped.
+        """
+        difference = self._commit_difference_from_graph(session_id, dialog.snapshot, target_oid) if dialog.snapshot is not None else None
+        if difference is not None:
+            dialog.show_difference(difference)
+            return
+        generation = dialog.read_generation
+        def complete(difference: object, error: Exception | None) -> None:
+            """Ignore comparison output after another branch choice or invalidated authority."""
+            if dialog.closed or not isValid(dialog) or generation != dialog.read_generation or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            dialog.show_difference(difference, str(error) if error else "")
+        self.reference.difference(dialog.snapshot, target_oid, complete)
+
+    def _count_lost_commits(self, session_id: str, dialog: CheckoutDialog, local_oid: str, remote_oid: str) -> None:
+        """Tell the Checkout window how many local commits resetting the branch onto the remote one would lose.
+
+        The answer is bound to the dialog generation like the commit comparison, so a late count for an older choice
+        is dropped. A count Git could not give shows its cause under the choices and makes Checkout available again.
+        """
+        if dialog.snapshot is None:
+            return
+        generation = dialog.read_generation
+
+        def complete(count: object, error: Exception | None) -> None:
+            """Ignore the count after another branch choice, closure or lost authority."""
+            if dialog.closed or not isValid(dialog) or generation != dialog.read_generation or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            if error is not None:
+                dialog.show_lost_commit_failure(str(error))
+                return
+            dialog.show_lost_commits(count)
+
+        self.reference.commits_only_in(dialog.snapshot, local_oid, remote_oid, complete)
+
+    def submit_checkout(self, session_id: str, intent: CheckoutIntent) -> str | None:
+        """Recheck authority and the displayed immutable intent before reserving Git writes."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        dialog = self.checkout_dialog_by_session.get(session_id)
+        if dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id:
+            return None
+        return self._launch_checkout(session_id, dialog, intent)
+
+    def open_checkout_revision(self, session_id: str, target_oid: str, *, expected_snapshot: ReferenceSnapshot | None = None) -> CheckoutRevisionDialog | None:
+        """Open the Checkout revision window on one commit, only from a live management window with a working tree.
+
+        The references come from the window's own capture while their files are unchanged, and the commit's position
+        from HEAD from the history graph in memory, so opening on a fully loaded graph starts no Git process.
+        """
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.context.is_bare:
+            return None
+        existing = self.checkout_revision_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        if expected_snapshot is None:
+            expected_snapshot = self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        dialog = CheckoutRevisionDialog(session_id, window)
+        dialog.setAccessibleDescription(f"Check out a commit in {window.context.repository_dir}")
+        self.checkout_revision_dialog_by_session[session_id] = dialog
+        dialog.checkout_requested.connect(lambda intent: self.submit_checkout_revision(session_id, intent))
+        dialog.finished.connect(lambda: self.checkout_revision_dialog_by_session.pop(session_id, None)
+                                if self.checkout_revision_dialog_by_session.get(session_id) is dialog else None)
+        context, git_filename = window.context, self.repository.git_filename
+
+        def is_current() -> bool:
+            """Let a result reach the form only while it, its window and its Git are the ones it was opened with."""
+            return self.reference_read_controller.form_is_current(session_id, generation, dialog, self.checkout_revision_dialog_by_session, context, git_filename) and not dialog.busy
+
+        self._bind_revision_picker(session_id, dialog, is_current)
+
+        def complete(snapshot: ReferenceSnapshot | None, error: Exception | None) -> None:
+            """Show the commit only while the form, its window and the HEAD it was asked from are still current."""
+            if not is_current():
+                return
+            if error is not None:
+                refuse_form_opening(dialog, str(error))
+                return
+            if expected_snapshot is not None and (snapshot.head_oid != expected_snapshot.head_oid or snapshot.head_ref != expected_snapshot.head_ref
+                                                  or snapshot.generation != expected_snapshot.generation or snapshot.git_filename != expected_snapshot.git_filename
+                                                  or snapshot.context != expected_snapshot.context):
+                refuse_form_opening(dialog, refresh_advice_text(SharedText.HEAD_CHANGED_BEFORE_OPENING))
+                return
+            dialog.populate(snapshot, target_oid)
+            reveal_form(dialog)
+
+        self.reference_read_controller.read_form_references(session_id, dialog, context, generation, complete,
+                                                            menu_capture=expected_snapshot, reopen=lambda capture: self.open_checkout_revision(session_id, target_oid, expected_snapshot=capture))
+        return dialog
+
+    def submit_checkout_revision(self, session_id: str, intent: CheckoutIntent) -> str | None:
+        """Recheck authority and the request the Checkout revision window shows before reserving the Git write."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        dialog = self.checkout_revision_dialog_by_session.get(session_id)
+        if dialog is None or dialog.closed or dialog.intent != intent or intent.operation.session_id != session_id:
+            return None
+        return self._launch_checkout(session_id, dialog, intent)
+
+    def _launch_checkout(self, session_id: str, dialog: CheckoutDialog | CheckoutRevisionDialog, intent: CheckoutIntent) -> str:
+        """Open the console, then start one checkout that stays current only while its form, window and Git do."""
+        session = self.session_registry_controller.session_by_id[session_id]
+
+        def is_current() -> bool:
+            """Keep captured session, executable and dialog authority current until launch."""
+            return (not dialog.closed and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) and session.generation == intent.snapshot.generation
+                    and self.repository.git_filename == intent.snapshot.git_filename and session.repository_context == intent.snapshot.context)
+
+        self.checkout_intent_by_id[intent.operation.operation_id] = intent
+        self.open_reference_output(intent, dialog)
+        return self.reference.checkout(intent, is_current=is_current)
+
+    def checkout_finished(self, outcome: object) -> None:
+        """Report a checkout's result to its form and console, then refresh the repository's windows unless the form may simply retry.
+
+        A checkout refused only because another operation held the repository wrote nothing, so the windows keep their
+        generation and the form given back can send its request again, as the branch forms do. A checkout refused
+        because its capture no longer matches the repository cannot succeed from that form: the windows read the
+        repository again, which is what the refusal asks for. A checkout that ran, whatever its result, refreshes the
+        repository's windows and its submodules.
+        """
+        intent = self.checkout_intent_by_id.pop(outcome.operation_id, None)
+        if intent is None:
+            return
+        self.reference.outcome_by_id[outcome.operation_id] = outcome
+        # The form that launched this checkout, read before the console bookkeeping below forgets it: the branch
+        # window and the revision window report their result the same way.
+        dialog = self.reference_form_by_id.get(outcome.operation_id)
+        if dialog is not None and isValid(dialog) and not dialog.closed and dialog.intent == intent:
+            dialog.show_outcome(outcome)
+        self.finish_reference_output(outcome)
+        if outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        if outcome.status == OperationStatus.REFUSED and not outcome.stale_capture:
+            return
+        self.refresh_controller.refresh_after_reference_operation(intent.operation, outcome, RefreshScope.FULL)
+        self.staging_controller.refresh_submodule_family(intent.snapshot.context)