gitpane 1.0.0__py3-none-any.whl

gitpane/reference/reference_edit.py

@@ -0,0 +1,2030 @@
+"""Run the native reference edits of a repository, each one checked against a reference capture read for it.
+
+The captures (``capture``, ``read``, ``read_display``) and the signatures that tell whether the references or the
+working files changed before an edit starts are read here too, with the format of ``gitpane.reference.reference_snapshot``.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import uuid
+from dataclasses import dataclass, replace
+from enum import Enum
+from typing import TYPE_CHECKING, Self
+
+from gitpane.config import COMMAND_LINE_CONTROL_CHARACTER_SET, GIT_MUTATION_TIMEOUT_MS, GIT_REFTABLE_DIR_BASENAME, LOCAL_PREFIX, REMOTE_PREFIX, SUBMODULE_RECURSION_OFF_ARGUMENTS, TAG_PREFIX, SharedText
+from gitpane.history.repository_value import COMMIT_PEEL_SUFFIX, Reference, ReferenceKind, validate_oid
+from gitpane.history.revision import revision_text_problem
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.repository_operation import OperationAction, OperationIntent, OperationOutcome, OperationStepResult, StaleCaptureError, WriteScope
+from gitpane.process.process_runner import LOCAL_WRITE_PROFILE, ProcessStatus
+from gitpane.reference.reference_snapshot import REFERENCE_FIELD_SEPARATOR, REFERENCE_FORMAT, ReferenceSnapshot, mark_head, parse_reference_read, short_reference_name
+from gitpane.reference.stash_list import read_stash_list
+from gitpane.sequencer.merge_state import read_merge_banner_state
+from gitpane.system.path_identity import canonical_path
+from gitpane.tool.system_tool import worktree_filename
+from gitpane.worktree.command_sequence import FileTask, GitCommand, GitCommandError, ReadBatch
+from gitpane.worktree.worktree_snapshot import WorktreeKey, fingerprint_files, read_index
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.operation.repository_operation import RepositoryOperationService
+    from gitpane.transport.remote_config import RemoteSnapshot
+    from gitpane.worktree.worktree_service import WorktreeService
+    from gitpane.worktree.worktree_snapshot import WorktreeSnapshot
+
+DELETE_LOCAL_TAG_OPERATION = "Delete local tag"
+DELETE_REMOTE_TAG_OPERATION = "Delete remote tag"
+DELETE_LOCAL_BRANCH_OPERATION = "Delete local branch"
+DELETE_REMOTE_BRANCH_OPERATION = "Delete remote branch"
+# The whole request of the Delete branch window, which deletes one or several local branches.
+DELETE_BRANCH_OPERATION = "Delete branch"
+# The Git options that delete branches: the checked one refuses a branch Git does not see as merged, the forced one
+# deletes whatever it is given. Each deleted branch is written with the option it was deleted with, so the captured
+# request says which branches the user allowed to lose commits.
+CHECKED_BRANCH_DELETE_OPTION = "-d"
+FORCED_BRANCH_DELETE_OPTION = "-D"
+# "git branch -d/-D" exits with 1 when at least one of the named branches could not be deleted; the others still are.
+BRANCH_DELETE_ACCEPTED_CODES = (0, 1)
+# One line per branch: its full name and the commit it points to, separated like the reference listing's fields.
+BRANCH_VALUE_FORMAT = "--format=%(refname)%00%(objectname)"
+CLEAR_ORPHAN_OPERATION = "Clear working directory and index"
+# The ID of the tree without any entry in each object format, told apart by the length of a full object ID. Git
+# knows this tree without storing it, so clearing can move the index to it in any repository.
+SHA1_EMPTY_TREE_OID = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
+SHA256_EMPTY_TREE_OID = "6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321"
+EMPTY_TREE_OID_BY_OID_LENGTH = {len(SHA1_EMPTY_TREE_OID): SHA1_EMPTY_TREE_OID, len(SHA256_EMPTY_TREE_OID): SHA256_EMPTY_TREE_OID}
+ORPHAN_CLEAR_REFUSAL = ("The working directory has uncommitted changes. Commit or stash them before creating an orphan branch that clears the "
+                        "working directory and index.")
+# Clearing removes every entry of the commit's tree from the index and the disk. What happens to a submodule's own
+# files then depends on the Git command and its settings (a forced "git rm" deletes the whole submodule working tree,
+# untracked and ignored files included), and "status" does not even show what is in there. So a commit holding a
+# submodule refuses the clearing before any write rather than rely on it.
+ORPHAN_CLEAR_SUBMODULE_REFUSAL = ("The commit contains submodules. Clearing the working directory and index could delete files inside them, "
+                                  "untracked and ignored ones included. Create the orphan branch without clearing, then remove the files "
+                                  "you do not want yourself.")
+# The mode Git gives a submodule entry (a gitlink) in a tree or in the index.
+GITLINK_MODE = b"160000"
+# One tree entry per record: only its mode, which is all the submodule check needs.
+TREE_ENTRY_MODE_FORMAT = "--format=%(objectmode)"
+TREE_ENTRY_TERMINATOR = b"\0"
+
+# The remote Git Extensions offers for a push when the current branch follows no remote branch.
+DEFAULT_PUSH_REMOTE_NAME = "origin"
+TAG_TARGET_TYPE_LINE = b"type commit"
+# "rev-parse --verify --quiet" exits with 1 and prints nothing when the revision does not exist.
+REVISION_READ_EXPECTED_CODES = (0, 1)
+# "check-ref-format --normalize" exits with 1 and prints nothing for a name Git refuses. Accepting that code keeps the
+# refusal from showing as a failed process: GitPane gives the reason itself, in the line that ends the operation.
+NEW_REFERENCE_NAME_CHECK_ACCEPTED_CODES = (0, 1)
+# Git's answer to a refused name is an empty output and an exit code, nothing a user can act on, so GitPane writes the
+# reason. It names the refused name between quotes, so a stray space shows, and recalls what Git refuses in a name.
+REFUSED_REFERENCE_NAME_TEMPLATE = ("'{name}' is not a valid {kind} name: Git refuses spaces, '..', '~', '^', ':', '?', '*', '[', '\\', "
+                                   "a name starting with '/' or '.', and a name ending with '.' or '.lock'")
+TAG_NAME_KIND = "tag"
+BRANCH_NAME_KIND = "branch"
+# Git's reference name rules accept "refs/heads/HEAD"; only Git's branch check refuses that name, and it writes the
+# refusal on its error output, which a console would show in red without GitPane's reason. GitPane refuses this one
+# name itself, before any process, so every other name goes through the same silent reference name check as a tag.
+RESERVED_BRANCH_NAME = "HEAD"
+RESERVED_BRANCH_NAME_REFUSAL = "'HEAD' is not a valid branch name: Git keeps this name for the commit that is checked out"
+
+
+def read_commit_metadata(target_oid: str) -> Generator:
+    """Read and validate literal commit fields shared by revision forms."""
+    validate_oid(target_oid)
+    output = yield GitCommand(["show", "--no-patch", "--format=%H%x00%an%x00%aI%x00%cn%x00%cI%x00%B", target_oid, "--"])
+    field_count = 6
+    fields = output.decode("utf-8", "replace").split("\0", field_count - 1)
+    oid_field_index = 0
+    if len(fields) != field_count or fields[oid_field_index] != target_oid:
+        raise ValueError("Git could not read complete metadata for the selected commit")
+    return tuple(fields)
+
+
+def empty_tree_oid(object_oid: str) -> str:
+    """Answer the empty tree's ID in the object format of a full object ID from the same repository."""
+    validate_oid(object_oid)
+    return EMPTY_TREE_OID_BY_OID_LENGTH[len(object_oid)]
+
+
+def verify_git_dir_identity(context: RepositoryContext, git_dir_output: bytes) -> None:
+    """Refuse a read when Git works in another administration directory than the one the window owns.
+
+    A working tree whose .git file was redirected would otherwise have its references read, and later written,
+    under the identity of the repository the window believes it holds.
+    """
+    git_dir = git_dir_output.removesuffix(b"\n")
+    if not git_dir or canonical_path(os.fsdecode(git_dir)) != WorktreeKey.from_context(context).git_dir:
+        raise ValueError("The repository identity changed; reopen the repository")
+
+
+def _parent_write_command(arguments: list[str], before_start: Callable[[], None], accepted_codes: tuple[int, ...] = (0,)) -> GitCommand:
+    """Keep reference writes within the parent reservation despite recursive user settings.
+
+    ``accepted_codes`` lists the exit codes that are not an error: a command that works on several branches exits
+    with 1 when only some of them failed, and the caller then proves each result from the references themselves.
+    """
+    # These commands can start the user's own hooks, and those must finish before the repository is handed
+    # back. The profile says so here rather than being inherited, so it holds whatever the surrounding
+    # sequence was launched as.
+    return GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, *arguments], accepted_codes=accepted_codes, timeout_ms=GIT_MUTATION_TIMEOUT_MS,
+                      idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS, before_start=before_start, profile=LOCAL_WRITE_PROFILE)
+
+
+def check_new_reference_name(full_ref: str, name: str, kind: str) -> Generator:
+    """Ask Git whether a new tag or branch may take this name, and refuse it with a readable reason when Git says no.
+
+    Git prints the normalized name of a valid reference and nothing for a refused one. The answer must be the full name
+    asked, byte for byte: a name only normalization would make valid (doubled or leading slashes) is refused too, so the
+    rule stays exactly Git's. ``name`` is the name as the user typed it and ``kind`` names what it is for (tag, branch).
+    """
+    answer = yield GitCommand(["check-ref-format", "--normalize", full_ref], accepted_codes=NEW_REFERENCE_NAME_CHECK_ACCEPTED_CODES)
+    if answer.removesuffix(b"\n") != full_ref.encode("utf-8", "surrogateescape"):
+        raise ValueError(REFUSED_REFERENCE_NAME_TEMPLATE.format(name=name, kind=kind))
+
+
+def check_branch_name(name: str) -> Generator:
+    """Check a name for a branch GitPane creates, renames or moves, and refuse it with a readable reason.
+
+    This is the one rule for every branch name, so a refusal reads the same everywhere and never shows Git's error
+    output. The name is placed where Git reads options in some commands, so a leading dash and control characters are
+    refused before any process. Git's reference name rules refuse "@{", so a name such as "@{-1}", which Git's branch
+    check would replace by another branch, is refused and never adopted. Answers the name, unchanged.
+    """
+    if not name or name.startswith("-") or any(character in COMMAND_LINE_CONTROL_CHARACTER_SET for character in name):
+        raise ValueError("Enter a valid branch name without options or control characters")
+    if name == RESERVED_BRANCH_NAME:
+        raise ValueError(RESERVED_BRANCH_NAME_REFUSAL)
+    yield from check_new_reference_name(LOCAL_PREFIX + name, name, BRANCH_NAME_KIND)
+    return name
+
+
+def push_remote_name(snapshot: ReferenceSnapshot) -> str:
+    """Name the remote a push from this repository goes to: the remote of the current branch's upstream, else origin.
+
+    This is the rule Git Extensions follows when it offers a remote for a tag push, so the dialog proposes the same one.
+    """
+    return snapshot.upstream_remote_by_name.get(snapshot.head_ref or "", "") or DEFAULT_PUSH_REMOTE_NAME
+
+
+# The step that closes an operation; only its observation describes the repository after every write of it.
+TERMINAL_STEP_INDEX = -1
+
+
+def final_reference_snapshot(outcome: OperationOutcome) -> ReferenceSnapshot | None:
+    """Answer the reference capture that closed an operation, when its last step carries one.
+
+    Only the last step counts: an earlier capture may predate another write of the same operation. A last step that
+    observed a working tree, or observed nothing, gives no answer and the caller reads the references again. This is
+    display data only; no write may rely on it.
+    """
+    if not outcome.steps:
+        return None
+    after = outcome.steps[TERMINAL_STEP_INDEX].after
+    return after if isinstance(after, ReferenceSnapshot) else None
+
+
+class ResetMode(Enum):
+    """A mode of "git reset", with the text of the Reset window choice that offers it.
+
+    The value is the word Git takes after "--"; the members are in the order the window lists them.
+    """
+
+    SOFT = ("soft", "Soft: leave working directory and index untouched")
+    MIXED = ("mixed", "Mixed: leave working directory untouched, reset index")
+    KEEP = ("keep", "Keep: update working directory to the commit\n(abort if there are local changes), reset index")
+    MERGE = ("merge", "Merge: update working directory to the commit and keep local changes\n(abort if there are conflicts), reset index")
+    HARD = ("hard", "Hard: reset working directory and index\n(discard ALL local changes, even uncommitted changes)")
+
+    def __new__(cls, value: str, label: str) -> Self:
+        """Keep Git's word as the value and the choice text beside it."""
+        member = object.__new__(cls)
+        member._value_ = value
+        member.label = label
+        return member
+
+
+class BranchMode(Enum):
+    """What a branch form does to a branch, with the name of the operation that reports it.
+
+    The value is the word the operation is captured with. A creation asked by a form becomes CREATE_CHECKOUT when the
+    new branch is checked out, and CREATE_ORPHAN when it starts without any commit on a commit's tree.
+    """
+
+    CREATE = ("create", "Create branch")
+    CREATE_CHECKOUT = ("create-checkout", "Create branch")
+    CREATE_ORPHAN = ("create-orphan", "Create branch")
+    RENAME = ("rename", "Rename branch")
+    MOVE = ("move", "Move branch")
+
+    def __new__(cls, value: str, operation_label: str) -> Self:
+        """Keep the captured word as the value and the operation name beside it."""
+        member = object.__new__(cls)
+        member._value_ = value
+        member.operation_label = operation_label
+        return member
+
+
+class CheckoutMode(Enum):
+    """What a checkout does with the reference it was given, and with the local branch of the same name for a remote one."""
+
+    LOCAL = "local"
+    """Check out a local branch."""
+    DETACHED = "detached"
+    """Check out a commit or a remote branch without any local branch: detached HEAD."""
+    SAME = "same"
+    """Create the local branch of the same name as the remote branch, and check it out."""
+    RESET_LOCAL = "reset_local"
+    """Move the existing local branch of the same name onto the remote branch, and check it out."""
+    CUSTOM = "custom"
+    """Create a local branch with the name the user typed on the remote branch, and check it out."""
+
+
+class TagMode(Enum):
+    """Whether a created tag is annotated, with a message, or lightweight, a plain name on a commit."""
+
+    ANNOTATED = "annotated"
+    LIGHTWEIGHT = "lightweight"
+
+
+@dataclass(frozen=True)
+class ReferenceDeletionIntent:
+    """Bind the deletion of one branch or tag to the references it was asked on and to the exact object it named.
+
+    ``unmerged_confirmed`` is the user's answer when a local branch is not merged into HEAD: without it the deletion
+    is refused.
+    """
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    full_ref: str
+    target_oid: str
+    unmerged_confirmed: bool = False
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, full_ref: str, *, session_id: str) -> ReferenceDeletionIntent:
+        """Capture one exact reference object without authorizing unmerged branch deletion."""
+        reference = next((reference for reference in snapshot.references if reference.full_name == full_ref), None)
+        if reference is None or reference.kind not in (ReferenceKind.HEADS, ReferenceKind.REMOTES, ReferenceKind.TAGS) or reference.symbolic_target or not reference.target_oid:
+            raise ValueError("Select an existing non-symbolic reference")
+        target_oid = snapshot.object_oid_by_name[full_ref]
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=(full_ref, target_oid), session_id=session_id, operation="Delete tag" if reference.kind == ReferenceKind.TAGS else "Delete branch",
+                                            action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, (full_ref,)), from_form=True)
+        return cls(operation, snapshot, full_ref, target_oid)
+
+
+@dataclass(frozen=True)
+class ResetIntent:
+    """Bind a Reset of the current branch to its branch, its target commit, its mode and the local state it was read with.
+
+    ``worktree_snapshot``, ``working_signature``, ``working_paths`` and ``reset_target_paths`` hold the index and the
+    working files read for a mode that changes them; a Soft reset has none. ``hard_confirmed`` is the user's answer
+    to the Hard warning.
+    """
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    full_ref: str
+    target_oid: str
+    mode: ResetMode
+    worktree_snapshot: WorktreeSnapshot | None = None
+    working_signature: tuple = ()
+    hard_confirmed: bool = False
+    working_paths: tuple[bytes, ...] | None = None
+    reset_target_paths: tuple[bytes, ...] = ()
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, target_oid: str, worktree_snapshot: WorktreeSnapshot | None, working_signature: tuple,
+                *, session_id: str, mode: ResetMode = ResetMode.SOFT) -> ResetIntent:
+        """Capture the current branch and require local bytes only for file-changing reset modes."""
+        validate_oid(target_oid)
+        if not snapshot.head_ref or not snapshot.head_ref.startswith(LOCAL_PREFIX) or not snapshot.head_oid:
+            raise ValueError("Reset requires a current local branch with a commit")
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=(snapshot.head_ref, target_oid, mode), session_id=session_id, operation="Reset current branch",
+                                            action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, (snapshot.head_ref,)), from_form=True)
+        return cls(operation, snapshot, snapshot.head_ref, target_oid, mode, worktree_snapshot=worktree_snapshot, working_signature=working_signature)
+
+
+@dataclass(frozen=True)
+class CheckoutIntent:
+    """Bind a checkout to the reference or commit it was asked on, what it does with the local branch, and the Force choice."""
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    full_ref: str
+    target_oid: str
+    mode: CheckoutMode
+    local_name: str = ""
+    force_checkout: bool = False
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, full_ref: str, *, refresh_advice: Callable[..., str], session_id: str | None = None, mode: CheckoutMode = CheckoutMode.LOCAL,
+                local_name: str = "", force_checkout: bool = False) -> CheckoutIntent:
+        """Capture only a reference present in the displayed snapshot, or a full commit ID for a detached checkout.
+
+        For a remote branch, ``mode`` says what happens to the local branch of the same name: SAME creates it,
+        RESET_LOCAL moves the existing one onto the remote branch, and CUSTOM creates ``local_name`` instead.
+        ``force_checkout`` discards local changes, and only a detached revision checkout offers it. ``refresh_advice``
+        writes the refusal of a reference the snapshot no longer holds, naming the Refresh action and its shortcut,
+        which only the interface knows.
+        """
+        if force_checkout and mode != CheckoutMode.DETACHED:
+            raise ValueError("Force applies only to checking out a revision")
+        reference = next((reference for reference in snapshot.references if reference.full_name == full_ref), None)
+        if reference is None and mode == CheckoutMode.DETACHED:
+            validate_oid(full_ref)
+            target_oid = full_ref
+            full_ref = ""
+        elif reference is None or reference.target_oid is None:
+            raise ValueError(refresh_advice(SharedText.SELECTED_REFERENCE_CHANGED))
+        else:
+            target_oid = reference.target_oid
+        refs = ()
+        if mode in (CheckoutMode.SAME, CheckoutMode.RESET_LOCAL, CheckoutMode.CUSTOM):
+            name = local_name if mode == CheckoutMode.CUSTOM else remote_branch_name(snapshot, full_ref)
+            refs = (LOCAL_PREFIX + name,)
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=(full_ref, target_oid, str(force_checkout)), session_id=session_id, operation="Checkout",
+                                            action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, refs), from_form=True)
+        return cls(operation, snapshot, full_ref, target_oid, mode, local_name, force_checkout=force_checkout)
+
+
+@dataclass(frozen=True)
+class BranchIntent:
+    """Bind the creation, rename or move of one local branch to its exact names, its commit and its options.
+
+    ``checkout_after_reset`` and ``force_reset`` are the choices of a move; ``orphan_clear`` is the choice of an
+    orphan branch creation that also empties the index and removes every tracked file afterwards.
+    """
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    full_ref: str
+    target_oid: str
+    mode: BranchMode
+    local_name: str = ""
+    checkout_after_reset: bool = False
+    force_reset: bool = False
+    orphan_clear: bool = False
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, target_oid: str, *, session_id: str, name: str = "", checkout: bool = True,
+                mode: BranchMode = BranchMode.CREATE, full_ref: str = "", force_reset: bool = False, orphan: bool = False, clear: bool = False) -> BranchIntent:
+        """Bind branch editing to immutable commits, exact names and an explicit action.
+
+        A form asks for CREATE, RENAME or MOVE; a creation is captured as CREATE_CHECKOUT when ``checkout`` is set.
+        ``orphan`` creates a branch without any commit on the target's tree, which always checks it out, and ``clear``
+        then empties the index and removes the tracked files; clearing means nothing without an orphan branch.
+        """
+        validate_oid(target_oid)
+        if clear and not orphan:
+            raise ValueError("Clearing the working directory and index applies only to an orphan branch")
+        if orphan and mode != BranchMode.CREATE:
+            raise ValueError("Only a branch creation can start an orphan branch")
+        if orphan:
+            mode = BranchMode.CREATE_ORPHAN
+        elif mode == BranchMode.CREATE:
+            mode = BranchMode.CREATE_CHECKOUT if checkout else BranchMode.CREATE
+        elif mode not in (BranchMode.RENAME, BranchMode.MOVE) or not full_ref.startswith(LOCAL_PREFIX):
+            raise ValueError("Select a local branch and a supported branch action")
+        targets = (full_ref, target_oid, mode, name)
+        if mode == BranchMode.MOVE:
+            targets += (str(checkout), str(force_reset))
+        if mode == BranchMode.CREATE_ORPHAN:
+            targets += (str(clear),)
+        refs = (full_ref,) if mode == BranchMode.MOVE else (full_ref, LOCAL_PREFIX + name) if mode == BranchMode.RENAME else (LOCAL_PREFIX + name,)
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=targets, session_id=session_id, operation=mode.operation_label,
+                                            action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, refs), from_form=True)
+        return cls(operation, snapshot, full_ref, target_oid, mode, name, checkout_after_reset=mode == BranchMode.MOVE and checkout, force_reset=force_reset, orphan_clear=clear)
+
+
+@dataclass(frozen=True)
+class TagIntent:
+    """Bind the creation of one tag to the references it was asked on, its exact name and its commit.
+
+    ``message`` is the annotation of an annotated tag, empty for a lightweight one; ``push_after_creation`` is the
+    form's Push check box, which opens the Push of the created tag once it exists.
+    """
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    full_ref: str
+    target_oid: str
+    mode: TagMode
+    local_name: str
+    message: str = ""
+    push_after_creation: bool = False
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, target_oid: str, *, session_id: str, name: str = "", annotated: bool = False, message: str = "", push_after_creation: bool = False) -> TagIntent:
+        """Capture a tag name and immutable commit without carrying unused annotation drafts."""
+        validate_oid(target_oid)
+        mode = TagMode.ANNOTATED if annotated else TagMode.LIGHTWEIGHT
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=(TAG_PREFIX + name, target_oid, mode), session_id=session_id, operation="Create tag",
+                                            action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, (TAG_PREFIX + name,)), from_form=True)
+        return cls(operation, snapshot, TAG_PREFIX + name, target_oid, mode, name, message=message if annotated else "", push_after_creation=push_after_creation)
+
+
+def branch_names(full_refs: tuple[str, ...]) -> list[str]:
+    """Turn full local branch names into the short names "git branch" takes."""
+    names: list[str] = []
+    for full_ref in full_refs:
+        names.append(full_ref.removeprefix(LOCAL_PREFIX))
+    return names
+
+
+def branch_deletion_targets(merged_refs: tuple[str, ...], unmerged_refs: tuple[str, ...], target_oid_by_ref: dict[str, str]) -> tuple[str, ...]:
+    """Write a group deletion as the flat list of targets its operation carries: option, full name and commit of each branch.
+
+    Every branch takes exactly three entries in that order, and neither an option nor a commit ID can be taken for a
+    full name, so the list reads back to one request only.
+    """
+    targets: list[str] = []
+    for option, refs in ((FORCED_BRANCH_DELETE_OPTION, unmerged_refs), (CHECKED_BRANCH_DELETE_OPTION, merged_refs)):
+        for full_ref in refs:
+            targets.extend((option, full_ref, target_oid_by_ref.get(full_ref, "")))
+    return tuple(targets)
+
+
+@dataclass(frozen=True)
+class MergeAbortIntent:
+    """Bind the Abort of a merge to the merge and the HEAD the banner showed when it was clicked.
+
+    ``merge_head_oids`` are the commits Git recorded as being merged and ``head_oid`` the commit the merge started
+    from: the Abort is refused before Git runs when either changed, so a click never applies to another merge.
+    """
+
+    operation: OperationIntent
+    merge_head_oids: tuple[str, ...]
+    head_oid: str
+
+
+@dataclass(frozen=True)
+class BranchDeletionIntent:
+    """Bind the deletion of several local branches to the references it was read on and to the user's answer.
+
+    ``merged_refs`` are deleted by the checked "git branch -d", which still refuses a branch Git does not see as
+    merged; ``unmerged_refs`` are the branches the user agreed to lose commits from, deleted by "git branch -D".
+    ``target_oid_by_ref`` keeps the commit each branch pointed to when the request was frozen.
+    """
+
+    operation: OperationIntent
+    snapshot: ReferenceSnapshot
+    merged_refs: tuple[str, ...]
+    unmerged_refs: tuple[str, ...]
+    target_oid_by_ref: dict[str, str]
+
+    @classmethod
+    def capture(cls, snapshot: ReferenceSnapshot, merged_refs: tuple[str, ...], unmerged_refs: tuple[str, ...], *, session_id: str | None,
+                refresh_advice: Callable[..., str]) -> BranchDeletionIntent:
+        """Freeze local branches of the displayed capture, refusing anything a deletion of local branches must never touch.
+
+        An empty request, a name the capture does not hold, a remote branch or a tag, a symbolic reference, the
+        current branch and a branch named in both lists are all refused before any process. ``refresh_advice`` writes
+        the refusal of a name that is not a local branch of the capture, naming the Refresh action and its shortcut.
+        """
+        all_refs = unmerged_refs + merged_refs
+        if not all_refs:
+            raise ValueError("Select at least one branch to delete")
+        if len(set(all_refs)) != len(all_refs):
+            raise ValueError("A branch is named twice in the deletion request")
+        reference_by_name: dict[str, Reference] = {}
+        for reference in snapshot.references:
+            reference_by_name[reference.full_name] = reference
+        target_oid_by_ref: dict[str, str] = {}
+        for full_ref in all_refs:
+            reference = reference_by_name.get(full_ref)
+            if (reference is None or not full_ref.startswith(LOCAL_PREFIX) or reference.symbolic_target or not reference.target_oid
+                    or full_ref not in snapshot.object_oid_by_name):
+                raise ValueError(refresh_advice(SharedText.NOT_A_LOCAL_BRANCH, branch=short_reference_name(full_ref)))
+            if full_ref == snapshot.head_ref:
+                raise ValueError(f"'{short_reference_name(full_ref)}' is the current branch and cannot be deleted")
+            target_oid_by_ref[full_ref] = snapshot.object_oid_by_name[full_ref]
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            targets=branch_deletion_targets(merged_refs, unmerged_refs, target_oid_by_ref), session_id=session_id,
+                                            operation=DELETE_BRANCH_OPERATION, action=OperationAction.REF_WRITE, scope=WriteScope.capture(snapshot.context, all_refs), from_form=True)
+        return cls(operation, snapshot, merged_refs, unmerged_refs, target_oid_by_ref)
+
+
+def working_signature(context: RepositoryContext, paths: tuple[bytes, ...] | None = None, target_paths: tuple[bytes, ...] = ()) -> tuple:
+    """Hash reset-exposed files and directory membership without walking unrelated ignored trees."""
+    if context.worktree_dir is None:
+        raise ValueError("Reset requires a working tree")
+    captured_paths: list[bytes] = []
+    for path in paths or ():
+        filename = _reset_working_filename(context, path)
+        captured_paths.append(os.fsencode(os.path.relpath(filename, context.worktree_dir).replace(os.sep, "/")))
+    pending_dirs = [context.worktree_dir] if paths is None else []
+    directory_set = {context.worktree_dir}
+    for path in target_paths:
+        filename = _reset_working_filename(context, path)
+        # Hard can remove an ignored directory to replace it with a target file.
+        if os.path.isdir(filename) and not os.path.islink(filename):
+            pending_dirs.append(filename)
+    while pending_dirs:
+        directory = pending_dirs.pop()
+        directory_set.add(directory)
+        with os.scandir(directory) as entries:
+            for entry in entries:
+                if entry.name == ".git" and paths is None:
+                    continue
+                if entry.is_dir(follow_symlinks=False):
+                    pending_dirs.append(entry.path)
+                else:
+                    captured_paths.append(os.fsencode(os.path.relpath(entry.path, context.worktree_dir).replace(os.sep, "/")))
+    for path in captured_paths:
+        directory = os.path.dirname(os.path.join(context.worktree_dir, os.fsdecode(path)))
+        while directory != context.worktree_dir:
+            directory_set.add(directory)
+            parent = os.path.dirname(directory)
+            if parent == directory:
+                raise ValueError("Reset path is outside the working tree")
+            directory = parent
+    records: list[tuple] = []
+    for directory in sorted(directory_set):
+        try:
+            with os.scandir(directory) as entries:
+                names: list[str] = []
+                for entry in entries:
+                    if entry.name != ".git":
+                        names.append(entry.name)
+                names.sort()
+            records.append((directory, tuple(names)))
+        except (FileNotFoundError, NotADirectoryError):
+            records.append((directory, None))
+    return tuple(sorted(fingerprint_files(context, tuple(captured_paths)).items())), tuple(records)
+
+
+def _reset_working_filename(context: RepositoryContext, path: bytes) -> str:
+    """Select the target or its obstructing ancestor without following an external symlink."""
+    filename = worktree_filename(context, path)
+    parent = os.path.dirname(filename)
+    root_dir = os.path.abspath(context.worktree_dir)
+    while os.path.normcase(parent) != os.path.normcase(root_dir):
+        if os.path.lexists(parent) and (not os.path.isdir(parent) or os.path.islink(parent)):
+            filename = parent
+        next_parent = os.path.dirname(parent)
+        if next_parent == parent:
+            raise ValueError("Reset path is outside the working tree")
+        parent = next_parent
+    return filename
+
+
+def occupied_branch_set(snapshot: ReferenceSnapshot) -> set[str]:
+    """Return branches checked out or retained by a detached rebase or bisect."""
+    branch_set: set[str] = set()
+    for field in snapshot.worktrees.split(b"\0"):
+        if field.startswith(b"branch "):
+            branch_set.add(field.removeprefix(b"branch ").decode("utf-8", "surrogateescape"))
+    if snapshot.head_ref:
+        branch_set.add(snapshot.head_ref)
+    for directory in reference_git_dirs(snapshot.context):
+        for relative_parts in (("rebase-merge", "head-name"), ("rebase-apply", "head-name"), ("BISECT_START",)):
+            try:
+                with open(os.path.join(directory, *relative_parts), encoding="utf-8", errors="surrogateescape") as stream:
+                    branch = stream.read().strip()
+            except FileNotFoundError:
+                continue
+            if branch:
+                branch_set.add(branch if branch.startswith(LOCAL_PREFIX) else LOCAL_PREFIX + branch)
+    return branch_set
+
+
+def deletable_branch_refs(snapshot: ReferenceSnapshot) -> tuple[str, ...]:
+    """List the local branches the Delete branch window offers, sorted by name; the Reset branch window offers the same ones.
+
+    The current branch and every branch another worktree, a rebase or a bisect holds are left out: Git would refuse
+    to delete or reset them anyway. Symbolic branches and branches without a commit are left out too.
+    """
+    occupied_ref_set = occupied_branch_set(snapshot)
+    full_refs: list[str] = []
+    for reference in snapshot.references:
+        full_ref = reference.full_name
+        if (reference.kind != ReferenceKind.HEADS or reference.symbolic_target or not reference.target_oid or full_ref == snapshot.head_ref
+                or full_ref in occupied_ref_set):
+            continue
+        full_refs.append(full_ref)
+    full_refs.sort()
+    return tuple(full_refs)
+
+
+def merge_base_oid_by_ref(snapshot: ReferenceSnapshot, branch_refs: tuple[str, ...]) -> dict[str, str | None]:
+    """Name the commit each branch must be merged into for "git branch -d" to delete it, as Git itself decides.
+
+    Git compares a branch with its upstream when that upstream exists, and with HEAD otherwise, so a branch merged
+    into HEAD but not into its upstream is refused. The upstream comes from the listing the capture was built from;
+    one that is not configured, or whose reference does not exist, falls back to HEAD like in Git. None means there is
+    nothing to compare with (no upstream and HEAD without a commit): Git then refuses the branch as not merged.
+    """
+    base_oid_by_ref: dict[str, str | None] = {}
+    for full_ref in branch_refs:
+        upstream = snapshot.upstream_by_name.get(full_ref)
+        upstream_oid = snapshot.object_oid_by_name.get(upstream) if upstream else None
+        base_oid_by_ref[full_ref] = upstream_oid or snapshot.head_oid
+    return base_oid_by_ref
+
+
+def reference_git_dirs(context: RepositoryContext) -> list[str]:
+    """Include each worktree's private administration when protecting branch operations."""
+    directories = [context.common_git_dir]
+    if context.git_dir != context.common_git_dir:
+        directories.append(context.git_dir)
+    worktree_dir = os.path.join(context.common_git_dir, "worktrees")
+    if os.path.isdir(worktree_dir):
+        with os.scandir(worktree_dir) as entries:
+            for entry in entries:
+                if entry.is_dir(follow_symlinks=False) and entry.path not in directories:
+                    directories.append(entry.path)
+    return directories
+
+
+def remote_branch_name(snapshot: ReferenceSnapshot, full_ref: str) -> str:
+    """Remove the actual remote prefix, including remote names containing slashes."""
+    for remote_name in sorted(snapshot.remote_names, key=len, reverse=True):
+        prefix = REMOTE_PREFIX + remote_name + "/"
+        if full_ref.startswith(prefix):
+            return full_ref.removeprefix(prefix)
+    raise ValueError("The selected remote reference has no configured remote")
+
+
+def suggested_branch_name(snapshot: ReferenceSnapshot, target_oid: str) -> str:
+    """Propose a branch name for a commit the way Git Extensions fills its Create branch window, without any Git process.
+
+    The first local branch on the commit gives its name; otherwise the first remote branch gives its name without the
+    remote; otherwise the first tag gives its name; otherwise nothing is proposed. References are taken in the order
+    Git lists them, by full name, and symbolic ones are skipped.
+    """
+    local_names: list[str] = []
+    remote_names: list[str] = []
+    tag_names: list[str] = []
+    for reference in sorted(snapshot.references, key=lambda reference: reference.full_name):
+        if not target_oid or reference.target_oid != target_oid or reference.symbolic_target:
+            continue
+        full_name = reference.full_name
+        if full_name.startswith(LOCAL_PREFIX):
+            local_names.append(full_name.removeprefix(LOCAL_PREFIX))
+        elif full_name.startswith(REMOTE_PREFIX):
+            try:
+                remote_names.append(remote_branch_name(snapshot, full_name))
+            except ValueError:
+                # A remote branch whose remote is no longer configured has no name to offer.
+                continue
+        elif full_name.startswith(TAG_PREFIX):
+            tag_names.append(full_name.removeprefix(TAG_PREFIX))
+    for names in (local_names, remote_names, tag_names):
+        if names:
+            first_name_index = 0
+            return names[first_name_index]
+    return ""
+
+
+def _refspec_match(pattern: str, full_ref: str) -> str | None:
+    """Return the wildcard replacement, distinguishing no match from an exact match."""
+    prefix, wildcard, suffix = pattern.partition("*")
+    if not wildcard:
+        return "" if pattern == full_ref else None
+    if not full_ref.startswith(prefix) or not full_ref.endswith(suffix) or len(full_ref) < len(prefix) + len(suffix):
+        return None
+    end = len(full_ref) - len(suffix) if suffix else len(full_ref)
+    return full_ref[len(prefix):end]
+
+
+def remote_branch_destination(snapshot: RemoteSnapshot, full_ref: str) -> tuple[str, str]:
+    """Invert configured Fetch mappings and refuse excluded or ambiguous server branches."""
+    from gitpane.transport.remote_config import field_values
+
+    destination_set: set[tuple[str, str]] = set()
+    for name, entry in sorted(snapshot.entry_by_name.items()):
+        if not entry.active or entry.collision:
+            continue
+        refspecs = tuple(value.value for value in field_values(snapshot, name, "fetch"))
+        for refspec in refspecs:
+            if refspec.startswith("^"):
+                continue
+            source, _separator, destination = refspec.removeprefix("+").partition(":")
+            if (not source.startswith(LOCAL_PREFIX) or not destination.startswith(REMOTE_PREFIX) or source.count("*") > 1
+                    or source.count("*") != destination.count("*")):
+                continue
+            replacement = _refspec_match(destination, full_ref)
+            if replacement is None:
+                continue
+            server_ref = source.replace("*", replacement)
+            if any(_refspec_match(negative.removeprefix("^"), server_ref) is not None for negative in refspecs if negative.startswith("^")):
+                continue
+            destination_set.add((name, server_ref))
+    if len(destination_set) != 1:
+        raise ValueError("The selected remote branch has no unique Fetch mapping; review its configuration")
+    return next(iter(destination_set))
+
+
+def remote_delete_candidates(snapshot: ReferenceSnapshot, remote_snapshot: RemoteSnapshot, full_ref: str, session_id: str) -> tuple[ReferenceDeletionIntent, ...]:
+    """Capture local branches whose configured and native upstream matches this remote ref."""
+    from gitpane.transport.remote_config import tracking_values
+
+    name, destination = remote_branch_destination(remote_snapshot, full_ref)
+    candidates: list[ReferenceDeletionIntent] = []
+    for branch_ref, tracking in sorted(remote_snapshot.tracking_by_ref.items()):
+        remotes = tracking_values(remote_snapshot, branch_ref, "remote")
+        merges = tracking_values(remote_snapshot, branch_ref, "merge")
+        if (len(remotes) != 1 or next(iter(remotes)).value != name or not any(value.value == destination for value in merges)
+                or not tracking.observed or tracking.upstream != full_ref or snapshot.object_oid_by_name.get(branch_ref) != tracking.oid):
+            continue
+        candidates.append(ReferenceDeletionIntent.capture(snapshot, branch_ref, session_id=session_id))
+    return tuple(candidates)
+
+
+def _validate_deletion_authority(intent: ReferenceDeletionIntent) -> None:
+    """Refuse a deletion whose operation no longer names the captured reference and object."""
+    snapshot = intent.snapshot
+    operation = intent.operation
+    if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename
+            or operation.generation != snapshot.generation or operation.targets != (intent.full_ref, intent.target_oid)
+            or not intent.full_ref.startswith((LOCAL_PREFIX, TAG_PREFIX))):
+        raise ValueError("Deletion does not match its captured reference authority")
+
+
+def reference_signature_paths(context: RepositoryContext) -> tuple[tuple[str, ...], tuple[str, ...]]:
+    """List every file the reference signature reads, then every folder whose entries decide that list.
+
+    The folders are the roots of the walk, present or absent, and every folder it entered: a reference created in a
+    folder that was empty, or a table added to a reftable store, changes one of them before it appears as a file.
+    Both lists are deduplicated and sorted, so two walks of an unchanged repository give the same answer.
+    """
+    filename_set: set[str] = set()
+    directory_set: set[str] = set()
+    seen_dir_set: set[str] = set()
+    for directory in reference_git_dirs(context):
+        if directory in seen_dir_set:
+            continue
+        seen_dir_set.add(directory)
+        # The shallow list and the graft file change which commits count as ancestors while every object ID stays
+        # the same, so a merge proof computed before them must not survive their change.
+        for basename in ("HEAD", "packed-refs", "config", "config.worktree", "shallow"):
+            filename_set.add(os.path.join(directory, basename))
+        for relative_parts in (("rebase-merge", "head-name"), ("rebase-apply", "head-name"), ("BISECT_START",), ("info", "grafts")):
+            filename_set.add(os.path.join(directory, *relative_parts))
+        worktree_dir = os.path.join(directory, "worktrees")
+        directory_set.add(worktree_dir)
+        if os.path.isdir(worktree_dir):
+            with os.scandir(worktree_dir) as entries:
+                for entry in entries:
+                    if entry.is_dir(follow_symlinks=False):
+                        for basename in ("HEAD", "gitdir", "locked"):
+                            filename_set.add(os.path.join(entry.path, basename))
+        pending_dirs = [os.path.join(directory, "refs"), os.path.join(directory, GIT_REFTABLE_DIR_BASENAME)]
+        directory_set.update(pending_dirs)
+        while pending_dirs:
+            current_dir = pending_dirs.pop()
+            if not os.path.isdir(current_dir):
+                continue
+            directory_set.add(current_dir)
+            with os.scandir(current_dir) as entries:
+                for entry in entries:
+                    if entry.is_dir(follow_symlinks=False):
+                        pending_dirs.append(entry.path)
+                    else:
+                        filename_set.add(entry.path)
+    return tuple(sorted(filename_set)), tuple(sorted(directory_set))
+
+
+def reference_signature(context: RepositoryContext) -> tuple:
+    """Detect reference or configuration changes while a validated command waits to launch."""
+    records: list[tuple] = []
+    filenames, _directories = reference_signature_paths(context)
+    for filename in filenames:
+        try:
+            metadata = os.stat(filename)
+            with open(filename, "rb") as stream:
+                content = stream.read()
+            records.append((filename, metadata.st_ino, metadata.st_mtime_ns, content))
+        except FileNotFoundError:
+            records.append((filename, None))
+    return tuple(sorted(records))
+
+
+@dataclass(frozen=True)
+class DeleteMergeProof:
+    """Remember whether one branch was merged, for one exact deletion request and the repository view it was read on.
+
+    It never authorizes a write: a deletion still captures its references, validates them and checks them again at
+    launch. It only spares a second ancestry check when that fresh capture matches this one exactly, ancestry view
+    included, because the answer could not have changed.
+    """
+
+    operation_id: str
+    key: WorktreeKey
+    context: RepositoryContext
+    git_filename: str
+    full_ref: str
+    target_oid: str
+    head_oid: str
+    head_ref: str | None
+    signature: tuple
+    worktrees: bytes
+    merged: bool
+
+    def matches(self, intent: ReferenceDeletionIntent, current: ReferenceSnapshot) -> bool:
+        """Tell whether this proof was computed for this very request on exactly this captured state."""
+        return (self.operation_id == intent.operation.operation_id and self.key == WorktreeKey.from_context(current.context) and self.context == current.context
+                and self.git_filename == current.git_filename and self.full_ref == intent.full_ref and self.target_oid == intent.target_oid
+                and self.head_oid == current.head_oid and self.head_ref == current.head_ref and self.signature == current.signature and self.worktrees == current.worktrees)
+
+
+class ReferenceService:
+    """Use the shared native runner and repository owner for read and write lifetimes."""
+
+    def __init__(self, worktree_service: WorktreeService, repository_operation: RepositoryOperationService, *, refresh_advice: Callable[..., str]) -> None:
+        """Inject existing owners so reference edits share the common repository reservation.
+
+        ``refresh_advice`` writes the refusals of an outdated capture: they name the Refresh action of the repository
+        window and its shortcut on this system, which belong to the interface, so this service receives the writer
+        instead of knowing them.
+        """
+        self.worktree_service = worktree_service
+        self.repository_operation = repository_operation
+        self.refresh_advice = refresh_advice
+        self.outcome_by_id: dict[str, OperationOutcome] = {}
+        # At most one merge result, left by the last deletion preparation for that request's next attempt.
+        self.delete_merge_proof: DeleteMergeProof | None = None
+
+    def _submit(self, operation: OperationIntent, sequence: Generator) -> str:
+        """Retain immediate policy refusals alongside completed native reference results."""
+        operation_id = self.repository_operation.submit(operation, sequence)
+        outcome = self.repository_operation.outcome_by_id.get(operation_id)
+        if outcome is not None:
+            self.outcome_by_id[operation_id] = outcome
+        return operation_id
+
+    def capture(self, context: RepositoryContext, git_filename: str, generation: int = 0) -> Generator:
+        """Read full names, object identities, branch upstreams and HEAD without guessing missing or partial values.
+
+        Git also names the administration directory it really read, which proves the repository identity. HEAD
+        comes from the listing when a local branch carries the current marker; a detached or unborn HEAD is asked
+        of Git separately, because the listing alone cannot tell either state apart from a missing marker.
+        """
+        signature = yield FileTask(lambda: reference_signature(context))
+        outputs = yield ReadBatch((GitCommand(["for-each-ref", "--format=" + REFERENCE_FORMAT]), GitCommand(["worktree", "list", "--porcelain", "-z"]),
+                                  GitCommand(["remote"]), GitCommand(["rev-parse", "--path-format=absolute", "--git-dir"])))
+        output, worktrees, remote_output, git_dir_output = outputs
+        verify_git_dir_identity(context, git_dir_output)
+        reference_read = parse_reference_read(output)
+        references, object_oid_by_name, head_oid, head_ref = reference_read.references, reference_read.object_oid_by_name, reference_read.head_oid, reference_read.head_ref
+        if head_ref is None:
+            head_outputs = yield ReadBatch((GitCommand(["rev-parse", "--verify", "--quiet", "HEAD"], accepted_codes=(0, 1)),
+                                           GitCommand(["symbolic-ref", "--quiet", "HEAD"], accepted_codes=(0, 1))))
+            head, symbolic = head_outputs
+            head_oid = head.decode().strip() or None
+            head_ref = symbolic.decode().strip() or None
+            references = mark_head(references, head_ref)
+        final_signature = yield FileTask(lambda: reference_signature(context))
+        if signature != final_signature:
+            raise ValueError(self.refresh_advice(SharedText.REFERENCE_CHANGED_DURING_READING))
+        return ReferenceSnapshot(context, git_filename, generation, references, object_oid_by_name, head_oid, head_ref,
+                                 worktrees, signature, tuple(remote_output.decode("utf-8", "surrogateescape").splitlines()), reference_read,
+                                 reference_read.upstream_by_name, reference_read.upstream_remote_by_name)
+
+    def _with_stash_list(self, context: RepositoryContext, snapshot: ReferenceSnapshot) -> Generator:
+        """Attach the stash list, read from the stash reflog off the Qt thread, to a capture shown in a window.
+
+        The reflog is read on its own rather than added to the reference signature: that signature also checks the
+        launch of writes such as rebase or replay, which a concurrent stash must not make fail.
+        """
+        stash_list = yield FileTask(lambda: read_stash_list(context))
+        if snapshot.stash_list == stash_list:
+            return snapshot
+        return replace(snapshot, stash_list=stash_list)
+
+    def read(self, context: RepositoryContext, git_filename: str, generation: int, callback: Callable, *, with_stash_list: bool = False) -> None:
+        """Publish a captured reference set asynchronously to its owning view, with the stash list when a window shows it."""
+        def sequence() -> Generator:
+            """Capture the references, then read the stash list when asked."""
+            snapshot = yield from self.capture(context, git_filename, generation)
+            if not with_stash_list:
+                return snapshot
+            return (yield from self._with_stash_list(context, snapshot))
+
+        self.worktree_service.run(context, git_filename, sequence(), callback)
+
+    def read_display(self, context: RepositoryContext, git_filename: str, generation: int, callback: Callable, *, previous: ReferenceSnapshot | None = None,
+                     with_stash_list: bool = False) -> None:
+        """Publish references for display, showing a previous capture again only when nothing it was read from has changed.
+
+        A previous capture of this very repository, Git and generation is checked against a fresh reading of every
+        reference file, off the Qt thread. Any difference, or any failure to read those files, falls back to the
+        usual native capture, whose own errors are reported. Nothing that writes uses this: every write captures its
+        references again and checks them at launch.
+
+        The stash list, when asked, is read again even for a reused capture: the reference files do not cover the
+        stash reflog, and a capture handed over by an operation or a navigation carries no list at all.
+        """
+        def sequence() -> Generator:
+            """Answer the same capture when its reference files are unchanged, and a fresh capture otherwise."""
+            snapshot = None
+            if previous is not None and previous.context == context and previous.git_filename == git_filename and previous.generation == generation:
+                try:
+                    signature = yield FileTask(lambda: reference_signature(context))
+                except OSError:
+                    signature = None
+                if signature == previous.signature:
+                    snapshot = previous
+            if snapshot is None:
+                snapshot = yield from self.capture(context, git_filename, generation)
+            if not with_stash_list:
+                return snapshot
+            return (yield from self._with_stash_list(context, snapshot))
+
+        self.worktree_service.run(context, git_filename, sequence(), callback)
+
+    def difference(self, snapshot: ReferenceSnapshot, target_oid: str, callback: Callable) -> None:
+        """Count commits unique to the captured HEAD and target, preserving unknown results."""
+        def sequence() -> Generator:
+            """Return only complete native left/right counts for the captured commits."""
+            if snapshot.head_oid is None:
+                if not snapshot.head_ref or not snapshot.head_ref.startswith(LOCAL_PREFIX) or snapshot.head_ref in snapshot.object_oid_by_name:
+                    raise ValueError("HEAD could not be read as a valid unborn branch")
+                output = yield GitCommand(["rev-list", "--count", target_oid, "--"])
+                return 0, int(output.strip())
+            output = yield GitCommand(["rev-list", "--left-right", "--count", snapshot.head_oid + "..." + target_oid, "--"])
+            fields = output.split()
+            expected_count = 2
+            if len(fields) != expected_count:
+                raise ValueError("Incomplete commit difference returned by Git")
+            left, right = fields
+            return int(left), int(right)
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, sequence(), callback)
+
+    def commits_only_in(self, snapshot: ReferenceSnapshot, local_oid: str, remote_oid: str, callback: Callable) -> None:
+        """Count the commits of a local branch that its remote branch lacks: the ones resetting it onto the remote would lose.
+
+        Two branches on the same commit lose nothing, so the callback gets 0 at once without starting Git.
+        """
+        if local_oid == remote_oid:
+            callback(0, None)
+            return
+
+        def sequence() -> Generator:
+            """Return the count Git prints, refusing anything that is not a plain number."""
+            output = yield GitCommand(["rev-list", "--count", remote_oid + ".." + local_oid, "--"])
+            text = output.decode("ascii", "replace").strip()
+            if not text.isdigit():
+                raise ValueError("Git returned no commit count")
+            return int(text)
+
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, sequence(), callback)
+
+    def resolve_revision(self, snapshot: ReferenceSnapshot, text: str, callback: Callable) -> None:
+        """Ask Git once which commit a typed revision names; the callback receives its full ID, or None when it names none.
+
+        A text Git must never receive is refused here, before any process. Git is told where its options end, so the
+        remaining text can never be read as one, and ``^{commit}`` makes an annotated tag or any other expression answer
+        with the commit it leads to, or with nothing.
+        """
+        problem = revision_text_problem(text)
+        if problem:
+            raise ValueError(problem)
+
+        def sequence() -> Generator:
+            """Return the validated commit ID Git prints, or None when Git finds no such commit."""
+            output = yield GitCommand(["rev-parse", "--verify", "--quiet", "--end-of-options", text + COMMIT_PEEL_SUFFIX], accepted_codes=REVISION_READ_EXPECTED_CODES)
+            oid = output.decode("utf-8", "replace").strip()
+            if not oid:
+                return None
+            return validate_oid(oid)
+
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, sequence(), callback)
+
+    def checkout(self, intent: CheckoutIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Submit one checkout once and retain native failures with the observed final state."""
+        return self._submit(intent.operation, self._checkout(intent, is_current))
+
+    def merge_work_at_risk(self, context: RepositoryContext, git_filename: str, callback: Callable[[object, Exception | None], None]) -> None:
+        """Answer True when aborting the merge in progress would throw away changes made since the merge stopped.
+
+        Git keeps the tree its merge left in AUTO_MERGE; the working tree still matching it means nothing was resolved
+        or edited since. One Git process answers: no difference is False, while differences, a missing AUTO_MERGE
+        (a merge strategy that does not write it) or a read that fails all count as work to lose, so the user is asked.
+        A submodule whose own content changed is left out: the Abort does not touch submodule content.
+        """
+        def sequence() -> Generator:
+            """Compare the working tree with the tree the merge left, treating any failure as a difference."""
+            try:
+                # Without these options the user's external diff program could run and its answer become the exit code.
+                yield GitCommand(["diff", "--quiet", "--no-ext-diff", "--no-textconv", "--ignore-submodules=dirty", "AUTO_MERGE", "--"])
+            except (OSError, ValueError, RuntimeError):
+                return True
+            return False
+
+        self.worktree_service.run(context, git_filename, sequence(), callback)
+
+    def abort_merge(self, intent: MergeAbortIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Submit Git's own merge --abort once, under the repository reservation, and retain its observed result."""
+        return self._submit(intent.operation, self._abort_merge(intent, is_current))
+
+    def capture_reset(self, snapshot: ReferenceSnapshot, target_oid: str) -> Generator:
+        """Capture a coherent local state without reserving a mutation during user review."""
+        validate_oid(target_oid)
+        outputs = yield ReadBatch((GitCommand(["ls-files", "-z", "--cached", "--others", "--exclude-standard"]),
+                                  GitCommand(["ls-tree", "-r", "-z", "--format=%(objecttype)%x09%(path)", target_oid])))
+        index_output, tree_output = outputs
+        path_set = set(index_output.split(b"\0"))
+        target_paths: list[bytes] = []
+        for record in tree_output.split(b"\0"):
+            kind, _, path = record.partition(b"\t")
+            if kind == b"blob":
+                target_paths.append(path)
+                path_set.add(path)
+        path_set.discard(b"")
+        paths = tuple(sorted(path_set))
+        target_paths = tuple(target_paths)
+        signature = yield FileTask(lambda: working_signature(snapshot.context, paths, target_paths))
+        local = yield from self.worktree_service.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+        final_signature = yield FileTask(lambda: working_signature(snapshot.context, paths, target_paths))
+        if signature != final_signature or local.head_oid != snapshot.head_oid or reference_signature(snapshot.context) != snapshot.signature:
+            raise ValueError("Repository changed during reading; reopen Reset")
+        return local, signature, paths, target_paths
+
+    def reset(self, intent: ResetIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Run the captured native reset once and retain its observed effects."""
+        return self._submit(intent.operation, self._reset(intent, is_current))
+
+    def _reset(self, intent: ResetIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Validate the form and local bytes again when the native process actually starts.
+
+        A reset Git completed is proven by the final branch and commit, read from a fresh reference capture. Only a
+        native reset that started and then failed reads the whole working tree again: it may have rewritten the
+        index or files before stopping, and only that read compared with the initial one tells what it changed.
+        """
+        snapshot = intent.snapshot
+        before = intent.worktree_snapshot
+        after = None
+        refreshed = None
+        diagnostic = None
+        process_status = None
+        status = OperationStatus.REFUSED
+        native_started = False
+        try:
+            operation = intent.operation
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or operation.targets != (intent.full_ref, intent.target_oid, intent.mode) or intent.full_ref != snapshot.head_ref
+                    or not snapshot.head_ref or not snapshot.head_oid
+                    or before is None and intent.mode != ResetMode.SOFT or intent.mode == ResetMode.HARD and not intent.hard_confirmed
+                    or before is not None and (before.context != snapshot.context or before.generation != snapshot.generation or before.git_filename != snapshot.git_filename)):
+                raise ValueError("Reset does not match its captured branch and local state")
+            validate_oid(intent.target_oid)
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if current.signature != snapshot.signature or current.worktrees != snapshot.worktrees:
+                raise ValueError("References, HEAD or worktrees changed; reopen Reset")
+            checkout_count = current.worktrees.split(b"\0").count(b"branch " + intent.full_ref.encode("utf-8", "surrogateescape"))
+            if checkout_count != 1:
+                raise ValueError("The current branch is checked out in another worktree; reset it only when it is exclusively checked out here")
+            yield GitCommand(["cat-file", "-e", intent.target_oid + COMMIT_PEEL_SUFFIX])
+
+            def validate_launch() -> None:
+                """Reject external changes during confirmation or while the process is queued."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if (is_current is not None and not is_current() or reference_signature(snapshot.context) != snapshot.signature
+                        or before is not None and (read_index(before.index_filename) != before.index_content
+                        or working_signature(snapshot.context, intent.working_paths, intent.reset_target_paths) != intent.working_signature)):
+                    raise ValueError("HEAD, references, index, working files or reset authority changed; reopen Reset")
+                native_started = True
+
+            yield _parent_write_command(["reset", "--" + intent.mode.value, intent.target_oid, "--"], validate_launch)
+            status = OperationStatus.SUCCESS
+            process_status = ProcessStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Reset current branch", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        try:
+            if status == OperationStatus.FAILED and before is not None:
+                after = yield from self.worktree_service.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if status == OperationStatus.SUCCESS and (refreshed.head_oid != intent.target_oid or refreshed.head_ref != snapshot.head_ref):
+                raise ValueError("Git exited successfully but the expected branch and commit were not observed")
+            changed = native_started and (refreshed.head_oid != snapshot.head_oid or before is not None and after is not None and
+                                         (after.index_content != before.index_content or after.fingerprint_by_path != before.fingerprint_by_path))
+            if status == OperationStatus.FAILED and changed:
+                status = OperationStatus.PARTIAL
+        except (ValueError, OSError, GitCommandError) as error:
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Reset current branch", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            status = OperationStatus.UNKNOWN
+        step = OperationStepResult("Reset current branch", status, before, after if after is not None else refreshed, process_status,
+                                   "reset to " + intent.target_oid if status == OperationStatus.SUCCESS else "inspect final state", diagnostic)
+        outcome = OperationOutcome(intent.operation.operation_id, status, (step,), diagnostic)
+        self.outcome_by_id[outcome.operation_id] = outcome
+        return outcome
+
+    def metadata(self, snapshot: ReferenceSnapshot, target_oid: str, callback: Callable) -> None:
+        """Read the selected commit's full metadata without using the current graph selection."""
+        self.worktree_service.run(snapshot.context, snapshot.git_filename, read_commit_metadata(target_oid), callback)
+
+    def create_branch(self, intent: BranchIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Reserve branch creation and report its observed effect independently of checkout.
+
+        An orphan branch has no reference until its first commit, so it follows its own sequence and proof.
+        """
+        if intent.mode == BranchMode.CREATE_ORPHAN:
+            return self._submit(intent.operation, self._create_orphan(intent, is_current))
+        return self._submit(intent.operation, self._edit_branch(intent, is_current, (BranchMode.CREATE, BranchMode.CREATE_CHECKOUT)))
+
+    def inspect_delete(self, intent: ReferenceDeletionIntent) -> Generator:
+        """Revalidate the captured object and require a merge proof only for local branches.
+
+        The merge result is left for the next attempt of this same request, so a submission right after the form
+        prepared it does not ask Git the same question again on an unchanged repository.
+        """
+        _validate_deletion_authority(intent)
+        snapshot = intent.snapshot
+        current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+        merged = yield from self._inspect_captured_deletion(intent, current, preparing=True)
+        return merged
+
+    def _inspect_captured_deletion(self, intent: ReferenceDeletionIntent, current: ReferenceSnapshot, *, preparing: bool) -> Generator:
+        """Check one deletion against a capture the caller just made, without reading the references again.
+
+        A preparation computes the merge result and leaves it for its request. An attempt takes its own request's
+        result, and uses it only when its fresh capture matches the one the result was computed on; otherwise it
+        asks Git again. A failed or stopped ancestry check is an error, never a remembered answer.
+        """
+        snapshot = intent.snapshot
+        if current.signature != snapshot.signature or current.worktrees != snapshot.worktrees:
+            raise ValueError("References, HEAD or worktrees changed; reopen the deletion form")
+        if current.object_oid_by_name.get(intent.full_ref) != intent.target_oid:
+            raise ValueError(self.refresh_advice(SharedText.SELECTED_REFERENCE_CHANGED))
+        if intent.full_ref.startswith(TAG_PREFIX):
+            yield GitCommand(["check-ref-format", intent.full_ref])
+            return True
+        if intent.full_ref in occupied_branch_set(current):
+            worktree_dir = current.context.repository_dir
+            for field in current.worktrees.split(b"\0"):
+                if field.startswith(b"worktree "):
+                    worktree_dir = field.removeprefix(b"worktree ").decode("utf-8", "surrogateescape")
+                if field == ("branch " + intent.full_ref).encode("utf-8", "surrogateescape"):
+                    break
+            branch = intent.full_ref.removeprefix(LOCAL_PREFIX)
+            raise ValueError(f"Branch '{branch}' is checked out in '{worktree_dir}'. Switch that worktree to another branch before trying again.")
+        if not current.head_oid:
+            raise ValueError("A current HEAD commit is required to check whether the branch is merged")
+        proof = self.delete_merge_proof
+        if not preparing and proof is not None and proof.operation_id == intent.operation.operation_id:
+            self.delete_merge_proof = None
+            if proof.matches(intent, current):
+                return proof.merged
+        try:
+            yield GitCommand(["merge-base", "--is-ancestor", intent.target_oid, current.head_oid])
+            merged = True
+        except GitCommandError as error:
+            if error.return_code != 1 or error.process_status != ProcessStatus.FAILED:
+                raise
+            merged = False
+        final_signature = yield FileTask(lambda: reference_signature(current.context))
+        if final_signature != current.signature:
+            raise ValueError("References or the ancestry view changed while checking the merge; reopen the deletion form")
+        if preparing:
+            self.delete_merge_proof = DeleteMergeProof(intent.operation.operation_id, WorktreeKey.from_context(current.context), current.context, current.git_filename,
+                                                       intent.full_ref, intent.target_oid, current.head_oid, current.head_ref, current.signature, current.worktrees, merged)
+        return merged
+
+    def merged_branch_refs(self, snapshot: ReferenceSnapshot, base_oid_by_ref: dict[str, str | None]) -> Generator:
+        """Ask Git which branches are merged into their base, when the history in memory cannot tell.
+
+        One read per distinct base commit, limited to the branches compared with it; a branch without a base is
+        never merged. The answer is the set of full names Git lists as merged.
+        """
+        refs_by_base_oid: dict[str, list[str]] = {}
+        for full_ref, base_oid in base_oid_by_ref.items():
+            if base_oid is not None:
+                refs_by_base_oid.setdefault(base_oid, []).append(full_ref)
+        merged_ref_set: set[str] = set()
+        for base_oid in sorted(refs_by_base_oid):
+            validate_oid(base_oid)
+            requested_refs = refs_by_base_oid[base_oid]
+            output = yield GitCommand(["for-each-ref", "--format=%(refname)", "--merged=" + base_oid, "--", *requested_refs])
+            # A pattern also matches the references below it, so only the names asked for are kept.
+            requested_ref_set = set(requested_refs)
+            for line in output.decode("utf-8", "surrogateescape").splitlines():
+                if line in requested_ref_set:
+                    merged_ref_set.add(line)
+        return merged_ref_set
+
+    def delete_branches(self, intent: BranchDeletionIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Delete the captured local branches once and keep the result of each one."""
+        return self._submit(intent.operation, self._delete_branches(intent, is_current))
+
+    def _delete_branches(self, intent: BranchDeletionIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Delete merged branches with one "git branch -d", then confirmed unmerged ones with one "git branch -D".
+
+        The checked deletion goes first so Git sees the very references the branches were sorted on: it compares each
+        branch with its upstream, and an upstream that is itself a confirmed unmerged branch of the same request still
+        exists at that moment. Run the other way, the forced deletion would remove that upstream, Git would compare the
+        branch with HEAD instead and refuse a branch the confirmation never listed. The checked deletion starts only
+        while every reference file is still byte for byte the one the request was frozen on; Git checks the merge
+        again itself, and checks every branch of the command before deleting any, so one that moved is refused
+        rather than lost.
+
+        The forced deletion checks nothing itself: neither the merge nor the commit the branch pointed to. When it
+        runs alone it starts under the same frozen reference files. After a checked deletion those files changed on
+        purpose, so the confirmed branches are read again once: each must still point to the commit the user
+        answered about, and no reference file may change between that read and the launch.
+
+        A checked deletion that Git refuses for some branches (exit code 1) does not stop the forced one. A refused
+        launch, a confirmed branch that moved, or any other failure stops the request there, and the forced deletion
+        does not run. A reference Git cannot lock fails the whole command it belongs to, since Git deletes the
+        branches of one command in a single transaction. The result of each branch comes from one capture taken
+        after the writes, never from Git's messages: a branch that is gone is deleted, one that is still there is not.
+        """
+        snapshot = intent.snapshot
+        operation = intent.operation
+        all_refs = intent.unmerged_refs + intent.merged_refs
+        diagnostic = None
+        refreshed = None
+        started_ref_set: set[str] = set()
+        try:
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or not all_refs or operation.targets != branch_deletion_targets(intent.merged_refs, intent.unmerged_refs, intent.target_oid_by_ref)):
+                raise ValueError("Delete branch does not match its captured branches")
+            for full_ref in all_refs:
+                if (not full_ref.startswith(LOCAL_PREFIX) or full_ref == snapshot.head_ref
+                        or snapshot.object_oid_by_name.get(full_ref) != intent.target_oid_by_ref.get(full_ref)):
+                    raise ValueError("Delete branch does not match its captured branches")
+            if is_current is not None and not is_current():
+                raise ValueError("The deletion request is no longer current")
+            signature = yield FileTask(lambda: reference_signature(snapshot.context))
+            if signature != snapshot.signature:
+                raise ValueError("References changed; reopen Delete branch")
+            occupied_ref_set = occupied_branch_set(snapshot)
+            for full_ref in all_refs:
+                if full_ref in occupied_ref_set:
+                    raise ValueError(f"Branch '{short_reference_name(full_ref)}' is checked out in a worktree. Switch that worktree to another branch before trying again.")
+
+            def validate_owner() -> None:
+                """Keep a waiting deletion bound to its live request and repository owner."""
+                self.repository_operation.validate(operation)
+                if is_current is not None and not is_current():
+                    raise ValueError("The deletion request is no longer current")
+
+            def validate_checked_launch() -> None:
+                """Start the checked deletion only while no reference moved since the request was frozen."""
+                validate_owner()
+                if reference_signature(snapshot.context) != snapshot.signature:
+                    raise ValueError("References changed before launch; reopen Delete branch")
+                started_ref_set.update(intent.merged_refs)
+
+            # The reference files the forced deletion must still find at its launch.
+            forced_signature = snapshot.signature
+            if intent.merged_refs:
+                yield _parent_write_command(["branch", CHECKED_BRANCH_DELETE_OPTION, "--", *branch_names(intent.merged_refs)], validate_checked_launch,
+                                            accepted_codes=BRANCH_DELETE_ACCEPTED_CODES)
+                if intent.unmerged_refs:
+                    # Signature first, then the values: a branch moved before the signature shows in the values, one
+                    # moved after it changes the signature and the launch check refuses.
+                    forced_signature = yield FileTask(lambda: reference_signature(snapshot.context))
+                    unchanged = yield from self._branches_still_at(intent.unmerged_refs, intent.target_oid_by_ref)
+                    if not unchanged:
+                        raise ValueError("A branch confirmed for deletion changed after the merged branches were deleted, so it was kept; reopen Delete branch")
+
+            def validate_forced_launch() -> None:
+                """Start the forced deletion only while no reference moved since the confirmed branches were last proven unchanged."""
+                validate_owner()
+                if reference_signature(snapshot.context) != forced_signature:
+                    raise ValueError("References changed before launch; reopen Delete branch")
+                started_ref_set.update(intent.unmerged_refs)
+
+            if intent.unmerged_refs:
+                yield _parent_write_command(["branch", FORCED_BRANCH_DELETE_OPTION, "--", *branch_names(intent.unmerged_refs)], validate_forced_launch,
+                                            accepted_codes=BRANCH_DELETE_ACCEPTED_CODES)
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(DELETE_BRANCH_OPERATION, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+        if started_ref_set:
+            try:
+                refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            except (ValueError, OSError, GitCommandError) as error:
+                diagnostic = diagnostic or (error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(DELETE_BRANCH_OPERATION, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare())
+        steps: list[OperationStepResult] = []
+        deleted_count = 0
+        failed_names: list[str] = []
+        for full_ref in sorted(all_refs):
+            started = full_ref in started_ref_set
+            if started and refreshed is None:
+                steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.UNKNOWN, snapshot, None, effect="inspect final state", full_ref=full_ref))
+                continue
+            deleted = started and full_ref not in refreshed.object_oid_by_name
+            if deleted:
+                deleted_count += 1
+            elif started:
+                failed_names.append(short_reference_name(full_ref))
+            step_status = OperationStatus.SUCCESS if deleted else OperationStatus.FAILED if started else OperationStatus.REFUSED
+            steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, step_status, snapshot, refreshed, effect="deleted" if deleted else "not deleted", full_ref=full_ref))
+        if not started_ref_set:
+            status = OperationStatus.REFUSED
+        elif refreshed is None:
+            status = OperationStatus.UNKNOWN
+        elif deleted_count == len(all_refs):
+            status = OperationStatus.SUCCESS
+        elif deleted_count:
+            status = OperationStatus.PARTIAL
+        else:
+            status = OperationStatus.FAILED
+        if diagnostic is None and failed_names:
+            diagnostic = Diagnostic(DELETE_BRANCH_OPERATION, snapshot.context.repository_dir, snapshot.git_filename, [],
+                                    "Git did not delete: " + ", ".join(failed_names) + ". See the Git output above.").prepare()
+        outcome = OperationOutcome(operation.operation_id, status, tuple(steps), diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _branches_still_at(self, full_refs: tuple[str, ...], target_oid_by_ref: dict[str, str]) -> Generator:
+        """Answer whether every listed local branch still exists and points to its expected commit, in one read."""
+        output = yield GitCommand(["for-each-ref", BRANCH_VALUE_FORMAT, "--", *full_refs])
+        current_oid_by_ref: dict[str, str] = {}
+        for line in output.decode("utf-8", "surrogateescape").splitlines():
+            full_ref, _separator, oid = line.partition(REFERENCE_FIELD_SEPARATOR)
+            current_oid_by_ref[full_ref] = oid
+        # A pattern also matches the references below it; only the names asked for count.
+        for full_ref in full_refs:
+            if current_oid_by_ref.get(full_ref) != target_oid_by_ref.get(full_ref):
+                return False
+        return True
+
+    def delete(self, intent: ReferenceDeletionIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Delete one captured reference once, preserving native branch worktree protections."""
+        operation = replace(intent.operation, scope=WriteScope.capture(intent.operation.context, (intent.full_ref,)), action=OperationAction.REF_WRITE)
+        intent = replace(intent, operation=operation)
+        return self._submit(intent.operation, self.delete_sequence(intent, is_current=is_current))
+
+    def _validate_deletion_owner(self, intent: ReferenceDeletionIntent) -> None:
+        """Accept a captured local continuation only inside its existing transport owner's scope."""
+        owner = self.repository_operation.active_by_id.get(intent.operation.operation_id)
+        if owner is None or owner.scope is None or not owner.scope.touches(intent.full_ref):
+            raise ValueError("This deletion no longer owns its captured reference")
+        expected = replace(intent.operation, targets=owner.targets, scope=owner.scope, action=owner.action)
+        if expected != owner:
+            raise ValueError("The deletion authority changed before its local continuation")
+        self.repository_operation.validate(owner)
+
+    def delete_sequence(self, intent: ReferenceDeletionIntent, *, is_current: Callable[[], bool] | None = None, allow_absent: bool = False) -> Generator:
+        """Revalidate at native start and report deletion separately from command failure.
+
+        Every attempt starts from a fresh capture. The capture taken right after the deletion proves the absence;
+        it is also the final observation unless a configuration section is then removed, which is a second write
+        and needs a capture of its own.
+        """
+        snapshot = intent.snapshot
+        tag = intent.full_ref.startswith(TAG_PREFIX)
+        operation_name = "Delete tag" if tag else "Delete branch"
+        diagnostic = None
+        refreshed = None
+        status = OperationStatus.REFUSED
+        native_started = False
+        reference_deleted = False
+        process_status = None
+        try:
+            if is_current is not None and not is_current():
+                raise ValueError("The deletion request is no longer current")
+            if allow_absent and intent.full_ref not in snapshot.object_oid_by_name:
+                current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+                if (current.signature != snapshot.signature or intent.operation.context != snapshot.context or intent.operation.git_filename != snapshot.git_filename
+                        or intent.operation.targets != (intent.full_ref, intent.target_oid) or not intent.full_ref.startswith(LOCAL_PREFIX)
+                        or intent.full_ref == current.head_ref or is_current is not None and not is_current()):
+                    raise ValueError("The absent branch no longer matches the captured deletion")
+                step = OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.SUCCESS, snapshot, current, effect="already absent")
+                return OperationOutcome(intent.operation.operation_id, OperationStatus.SUCCESS, (step,))
+            _validate_deletion_authority(intent)
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            merged = yield from self._inspect_captured_deletion(intent, current, preparing=False)
+            if not merged and not intent.unmerged_confirmed:
+                raise ValueError("The branch is not fully merged into current HEAD; explicit confirmation is required")
+
+            def validate_launch() -> None:
+                """Bind a queued deletion to the same branch, HEAD, worktrees and live owner."""
+                nonlocal native_started
+                self._validate_deletion_owner(intent)
+                if is_current is not None and not is_current() or reference_signature(snapshot.context) != snapshot.signature:
+                    raise ValueError("References, HEAD or deletion authority changed before launch")
+                native_started = True
+
+            # The old object is checked under Git's reference lock, closing the race
+            # between application validation and an external client's replacement.
+            arguments = ["update-ref", "--no-deref", "-d", intent.full_ref, intent.target_oid]
+            yield GitCommand(arguments, timeout_ms=GIT_MUTATION_TIMEOUT_MS,
+                             idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS, before_start=validate_launch, profile=LOCAL_WRITE_PROFILE)
+            reference_deleted = True
+            process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+            deleted_snapshot = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            refreshed = deleted_snapshot
+            if not tag:
+                if intent.full_ref in deleted_snapshot.object_oid_by_name:
+                    raise ValueError("The branch was recreated after deletion; its configuration was preserved")
+                branch_name = intent.full_ref.removeprefix(LOCAL_PREFIX)
+                configuration = yield GitCommand(["config", "--local", "--name-only", "--get-regexp", "^branch\\." + re.escape(branch_name) + "\\.[^.]+$"], accepted_codes=(0, 1))
+                if configuration:
+                    # Removing the section is a second write: what it leaves behind needs a capture of its own.
+                    refreshed = None
+
+                    def validate_cleanup() -> None:
+                        """Preserve metadata when another client recreates or edits the deleted branch."""
+                        self._validate_deletion_owner(intent)
+                        if reference_signature(snapshot.context) != deleted_snapshot.signature:
+                            raise ValueError("References or configuration changed after deletion; branch configuration was preserved")
+                    yield GitCommand(["config", "--local", "--remove-section", "branch." + branch_name], timeout_ms=GIT_MUTATION_TIMEOUT_MS,
+                                     idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS, before_start=validate_cleanup, profile=LOCAL_WRITE_PROFILE)
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            if not reference_deleted:
+                process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.PARTIAL if reference_deleted else OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        if refreshed is None:
+            try:
+                refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            except (ValueError, OSError, GitCommandError) as error:
+                diagnostic = diagnostic or (error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare())
+                status = OperationStatus.UNKNOWN if native_started else status
+        deleted = native_started and refreshed is not None and intent.full_ref not in refreshed.object_oid_by_name
+        if native_started and not reference_deleted and refreshed is not None and refreshed.object_oid_by_name.get(intent.full_ref) not in (None, intent.target_oid):
+            status = OperationStatus.REFUSED
+            diagnostic = Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], "The selected reference changed before deletion; its replacement was preserved.").prepare()
+        if deleted and (status != OperationStatus.SUCCESS or refreshed.head_oid != snapshot.head_oid or refreshed.head_ref != snapshot.head_ref):
+            status = OperationStatus.PARTIAL
+        elif status == OperationStatus.SUCCESS and not deleted:
+            status = OperationStatus.UNKNOWN
+        step = OperationStepResult(DELETE_LOCAL_TAG_OPERATION if tag else DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.SUCCESS if deleted or reference_deleted else status, snapshot, refreshed, process_status,
+                                   "deleted" if deleted else "deleted; name recreated" if reference_deleted and refreshed is not None else "not deleted" if refreshed is not None else "inspect final state", diagnostic, full_ref=intent.full_ref)
+        outcome = OperationOutcome(intent.operation.operation_id, status, (step,), diagnostic)
+        self.outcome_by_id[outcome.operation_id] = outcome
+        return outcome
+
+    def create_tag(self, intent: TagIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Create one native tag and retain its result so a refresh cannot repeat the write."""
+        return self._submit(intent.operation, self._create_tag(intent, is_current))
+
+    def _create_tag(self, intent: TagIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Validate exact authority, create without signing and inspect the stored tag object."""
+        snapshot = intent.snapshot
+        operation = intent.operation
+        current = None
+        refreshed = None
+        diagnostic = None
+        native_started = False
+        process_status = None
+        status = OperationStatus.REFUSED
+        observed = False
+        try:
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or operation.targets != (intent.full_ref, intent.target_oid, intent.mode) or intent.full_ref != TAG_PREFIX + intent.local_name
+                    or intent.mode not in (TagMode.LIGHTWEIGHT, TagMode.ANNOTATED)):
+                raise ValueError("Tag creation does not match its captured authority")
+            if is_current is not None and not is_current():
+                raise ValueError("The tag request is no longer current")
+            name = intent.local_name
+            if not name or name.startswith("-") or any(character in COMMAND_LINE_CONTROL_CHARACTER_SET for character in name):
+                raise ValueError("Enter a valid tag name without options or control characters")
+            if intent.mode == TagMode.LIGHTWEIGHT and intent.message:
+                raise ValueError("A lightweight tag cannot have an annotation")
+            validate_oid(intent.target_oid)
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if current.signature != snapshot.signature:
+                raise ValueError("References or HEAD changed; reopen the form after refreshing")
+            yield from check_new_reference_name(intent.full_ref, name, TAG_NAME_KIND)
+            if intent.full_ref in current.object_oid_by_name:
+                raise ValueError("A tag with this name already exists; choose another name")
+            object_type = yield GitCommand(["cat-file", "-t", intent.target_oid])
+            if object_type.strip() != b"commit":
+                raise ValueError("The selected revision is not a commit")
+
+            def validate_launch() -> None:
+                """Bind queued writes to the same live form, references and repository configuration."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                allows = self.repository_operation.allows
+                if (is_current is not None and not is_current() or allows is not None and not allows(operation)
+                        or reference_signature(snapshot.context) != current.signature):
+                    raise ValueError("References, HEAD or tag authority changed before launch; reopen the form")
+                native_started = True
+
+            arguments = ["-c", "tag.gpgSign=false", "tag"]
+            stdin = None
+            if intent.mode == TagMode.ANNOTATED:
+                arguments.extend(["--annotate", "--cleanup=verbatim", "--file=-"])
+                stdin = intent.message.encode("utf-8")
+            arguments.extend(["--", name, intent.target_oid])
+            yield GitCommand(arguments, stdin=stdin, timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS, before_start=validate_launch, profile=LOCAL_WRITE_PROFILE)
+            process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Create tag", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        try:
+            refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            reference = next((reference for reference in refreshed.references if reference.full_name == intent.full_ref), None)
+            object_oid = refreshed.object_oid_by_name.get(intent.full_ref)
+            observed = native_started and current is not None and intent.full_ref not in current.object_oid_by_name and reference is not None and reference.target_oid == intent.target_oid
+            if observed and intent.mode == TagMode.ANNOTATED:
+                # Git refuses to print anything but a tag object here, so this one read proves the type as well as
+                # the target and the exact message.
+                content = yield GitCommand(["cat-file", "tag", object_oid])
+                header, separator, message = content.partition(b"\n\n")
+                header_lines = header.split(b"\n")
+                if (not separator or message != intent.message.encode("utf-8") or ("object " + intent.target_oid).encode("ascii") not in header_lines
+                        or TAG_TARGET_TYPE_LINE not in header_lines):
+                    raise ValueError("The created tag does not contain the exact requested annotation")
+            elif observed and object_oid != intent.target_oid:
+                # A lightweight tag is the validated commit itself; any other object is not what was requested.
+                raise ValueError("The created tag does not have the requested object type")
+            if status == OperationStatus.SUCCESS and (not observed or refreshed.head_oid != snapshot.head_oid or refreshed.head_ref != snapshot.head_ref):
+                raise ValueError("Git exited successfully but the expected tag or unchanged HEAD was not observed")
+        except (ValueError, OSError, GitCommandError) as error:
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Read created tag", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            status = OperationStatus.PARTIAL if process_status == ProcessStatus.SUCCESS or observed else OperationStatus.UNKNOWN
+        creation_status = OperationStatus.SUCCESS if observed or process_status == ProcessStatus.SUCCESS else status
+        if observed and status != OperationStatus.SUCCESS:
+            status = OperationStatus.PARTIAL
+        creation = OperationStepResult("Create tag", creation_status, current, refreshed, process_status,
+                                       "created" if observed else "Git completed; verify the tag" if process_status == ProcessStatus.SUCCESS else "not observed", diagnostic)
+        refresh = OperationStepResult("Read created tag", OperationStatus.SUCCESS if status == OperationStatus.SUCCESS else OperationStatus.STEP_NOT_STARTED if status == OperationStatus.REFUSED else OperationStatus.UNKNOWN,
+                                      after=refreshed, effect="verified" if status == OperationStatus.SUCCESS else "inspect final state", diagnostic=diagnostic)
+        outcome = OperationOutcome(operation.operation_id, status, (creation, refresh), diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def rename_branch(self, intent: BranchIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Reserve a native rename, preserving its configuration and unrelated references."""
+        return self._submit(intent.operation, self._edit_branch(intent, is_current, (BranchMode.RENAME,)))
+
+    def move_branch(self, intent: BranchIntent, *, is_current: Callable[[], bool] | None = None) -> str:
+        """Move only an unoccupied local branch and retain native force-branch protections."""
+        return self._submit(intent.operation, self._edit_branch(intent, is_current, (BranchMode.MOVE,)))
+
+    def is_fast_forward(self, old_oid: str, target_oid: str) -> Generator:
+        """Require an ancestry proof before moving a branch without force consent."""
+        validate_oid(old_oid)
+        validate_oid(target_oid)
+        try:
+            yield GitCommand(["merge-base", "--is-ancestor", old_oid, target_oid])
+        except GitCommandError as error:
+            if error.return_code == 1 and error.process_status == ProcessStatus.FAILED:
+                return False
+            raise
+        return True
+
+    def _branch_config(self, name: str) -> Generator:
+        """Read local native branch settings to verify a rename did not lose its tracking."""
+        output = yield GitCommand(["config", "--null", "--local", "--list"])
+        prefix = ("branch." + name + ".").encode("utf-8", "surrogateescape")
+        settings: list[tuple[bytes, bytes]] = []
+        for record in output.split(b"\0"):
+            key, _, value = record.partition(b"\n")
+            if key.startswith(prefix):
+                settings.append((key.removeprefix(prefix), value))
+        return tuple(sorted(settings))
+
+    def _create_orphan(self, intent: BranchIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Start a branch without any commit on the target's tree and check it out, like "git checkout --orphan".
+
+        The checks before the write are those of any branch creation. When clearing is asked, a tracked file with
+        uncommitted changes refuses the whole request before any write: once the orphan branch exists every file
+        shows as added, and removing them would destroy those changes. A target commit holding a submodule refuses
+        it as well, because removing a submodule entry could take the submodule's own files with it. Clearing then
+        removes every tracked file from the index and the disk, and never touches an untracked file; Git checks each
+        file again as it removes them, so a change made after the first check refuses the clearing instead of being
+        lost. The new branch has no reference until its first
+        commit, so the result is proven by the final capture showing HEAD on that branch with no commit, never by a
+        reference in the list.
+        """
+        snapshot = intent.snapshot
+        operation = intent.operation
+        operation_name = BranchMode.CREATE_ORPHAN.operation_label
+        created_ref = LOCAL_PREFIX + intent.local_name
+        current = None
+        refreshed = None
+        diagnostic = None
+        process_status = None
+        clear_process_status = None
+        status = OperationStatus.REFUSED
+        native_started = False
+        orphan_completed = False
+        clear_started = False
+        clear_completed = False
+        observed = False
+        try:
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or intent.mode != BranchMode.CREATE_ORPHAN or operation.targets != (intent.full_ref, intent.target_oid, intent.mode, intent.local_name, str(intent.orphan_clear))):
+                raise ValueError("Branch action does not match its captured authority")
+            if is_current is not None and not is_current():
+                raise ValueError("The branch request is no longer current")
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if current.signature != snapshot.signature or current.worktrees != snapshot.worktrees:
+                raise ValueError("References, HEAD or worktrees changed; reopen the form after refreshing")
+            validate_oid(intent.target_oid)
+            yield GitCommand(["cat-file", "-e", intent.target_oid + COMMIT_PEEL_SUFFIX])
+            name = yield from check_branch_name(intent.local_name)
+            # An unborn current branch has no reference either, so its name is compared with HEAD as well.
+            if created_ref in current.object_oid_by_name or current.head_ref == created_ref:
+                raise ValueError("A local branch with this name already exists; choose another name")
+            if intent.orphan_clear:
+                # Staged and unstaged changes to tracked files both count; untracked files are left alone by the removal.
+                changes = yield GitCommand(["status", "--porcelain", "-z", "--untracked-files=no"])
+                if changes:
+                    raise ValueError(ORPHAN_CLEAR_REFUSAL)
+                # The clearing works on the target's tree, which the orphan checkout puts in the index; a submodule
+                # the current commit holds and the target does not is left on disk by that checkout, never cleared.
+                tree_modes = yield GitCommand(["ls-tree", "-r", "-z", TREE_ENTRY_MODE_FORMAT, intent.target_oid])
+                if GITLINK_MODE in tree_modes.split(TREE_ENTRY_TERMINATOR):
+                    raise ValueError(ORPHAN_CLEAR_SUBMODULE_REFUSAL)
+
+            def validate_launch() -> None:
+                """Keep a waiting creation bound to the exact repository, references and live form."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if is_current is not None and not is_current() or reference_signature(snapshot.context) != current.signature:
+                    raise ValueError("References, HEAD or branch authority changed before launch; reopen the form")
+                native_started = True
+
+            # No "--" is possible before the start point of this command; the name was validated above and cannot be
+            # an option, and the start point is a complete commit ID.
+            yield _parent_write_command(["checkout", "--orphan", name, intent.target_oid], validate_launch)
+            orphan_completed = True
+            process_status = ProcessStatus.SUCCESS
+            if intent.orphan_clear:
+
+                def validate_clear() -> None:
+                    """Remove files only while the request that created the orphan branch is still live."""
+                    nonlocal clear_started
+                    self.repository_operation.validate(operation)
+                    if is_current is not None and not is_current():
+                        raise ValueError("The orphan branch was created, but the request ended before clearing the working directory and index")
+                    clear_started = True
+
+                # The check for uncommitted changes ran before the checkout: a file saved or staged since then, by an
+                # editor or by the checkout's own hook, must not be lost. A forced "git rm" would delete it without a
+                # word. Moving the index from the target's tree to the empty tree with "read-tree -m -u" lets Git check
+                # every file again at the very moment it removes them: one that differs from the index, or an index
+                # entry that differs from the target, refuses the whole move before anything is removed. Untracked
+                # and ignored files are never touched, and an entry added to the index meanwhile is kept.
+                yield _parent_write_command(["read-tree", "-m", "-u", intent.target_oid, empty_tree_oid(intent.target_oid)], validate_clear)
+                clear_completed = True
+                clear_process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            error_process_status = error.process_status if isinstance(error, GitCommandError) else None
+            if orphan_completed:
+                clear_process_status = error_process_status
+            else:
+                process_status = error_process_status
+            status = OperationStatus.PARTIAL if orphan_completed else OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        try:
+            refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            observed = native_started and refreshed.head_ref == created_ref and refreshed.head_oid is None
+            if status == OperationStatus.SUCCESS and not observed:
+                raise ValueError("Git exited successfully but HEAD is not on the new branch without a commit")
+        except (ValueError, OSError, GitCommandError) as error:
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            status = OperationStatus.UNKNOWN
+        if observed and status not in (OperationStatus.SUCCESS, OperationStatus.PARTIAL):
+            status = OperationStatus.PARTIAL
+        creation_status = OperationStatus.SUCCESS if observed else OperationStatus.UNKNOWN if orphan_completed else status
+        creation_effect = "created orphan" if observed else "Git created the branch; inspect HEAD" if orphan_completed else "not observed"
+        creation = OperationStepResult(operation_name, creation_status, current, refreshed, process_status, creation_effect, diagnostic)
+        steps = (creation,)
+        if intent.orphan_clear:
+            clear_status = OperationStatus.SUCCESS if clear_completed else OperationStatus.FAILED if clear_started else OperationStatus.STEP_NOT_STARTED
+            clear_effect = "cleared" if clear_completed else "inspect the working directory and index" if clear_started else "not cleared"
+            clearing = OperationStepResult(CLEAR_ORPHAN_OPERATION, clear_status, after=refreshed, process_status=clear_process_status, effect=clear_effect, diagnostic=diagnostic)
+            steps = (creation, clearing)
+        outcome = OperationOutcome(operation.operation_id, status, steps, diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _edit_branch(self, intent: BranchIntent, is_current: Callable[[], bool] | None, allowed_modes: tuple[BranchMode, ...]) -> Generator:
+        """Validate exact authority at submission and launch, then reconcile native effects.
+
+        The branch and checkout steps report the fresh reference captures taken before and after the writes: a
+        branch edit and the checkout that may follow it change nothing but references and HEAD.
+        """
+        snapshot = intent.snapshot
+        operation = intent.operation
+        current = None
+        refreshed = None
+        diagnostic = None
+        process_status = None
+        status = OperationStatus.REFUSED
+        native_started = False
+        operation_name = intent.mode.operation_label
+        created_ref = LOCAL_PREFIX + intent.local_name
+        checkout = intent.mode == BranchMode.CREATE_CHECKOUT or intent.mode == BranchMode.MOVE and intent.checkout_after_reset
+        creation = intent.mode in (BranchMode.CREATE, BranchMode.CREATE_CHECKOUT)
+        resulting_ref = created_ref if intent.mode != BranchMode.MOVE else intent.full_ref
+        branch_settings = None
+        branch_completed = False
+        checkout_started = False
+        try:
+            targets = (intent.full_ref, intent.target_oid, intent.mode, intent.local_name)
+            if intent.mode == BranchMode.MOVE:
+                targets += (str(intent.checkout_after_reset), str(intent.force_reset))
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or operation.targets != targets or intent.mode not in allowed_modes):
+                raise ValueError("Branch action does not match its captured authority")
+            if is_current is not None and not is_current():
+                raise ValueError("The branch request is no longer current")
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if current.signature != snapshot.signature or current.worktrees != snapshot.worktrees:
+                raise ValueError("References, HEAD or worktrees changed; reopen the form after refreshing")
+            validate_oid(intent.target_oid)
+            yield GitCommand(["cat-file", "-e", intent.target_oid + COMMIT_PEEL_SUFFIX])
+            name = intent.local_name if intent.mode != BranchMode.MOVE else intent.full_ref.removeprefix(LOCAL_PREFIX)
+            yield from check_branch_name(name)
+            if intent.mode != BranchMode.MOVE and created_ref in current.object_oid_by_name:
+                raise ValueError("A local branch with this name already exists; choose another name")
+            if not creation:
+                reference = next((reference for reference in current.references if reference.full_name == intent.full_ref), None)
+                original_oid = snapshot.object_oid_by_name.get(intent.full_ref)
+                if not intent.full_ref.startswith(LOCAL_PREFIX) or reference is None or reference.symbolic_target or current.object_oid_by_name.get(intent.full_ref) != original_oid:
+                    raise ValueError(self.refresh_advice(SharedText.SELECTED_LOCAL_BRANCH_CHANGED))
+                occupied_ref_set = occupied_branch_set(current)
+                if intent.full_ref in occupied_ref_set and (intent.mode == BranchMode.MOVE or intent.full_ref != current.head_ref):
+                    raise ValueError("The selected branch is checked out in a worktree and cannot be changed here")
+                if intent.mode == BranchMode.RENAME:
+                    if reference.target_oid != intent.target_oid:
+                        raise ValueError("The renamed branch no longer points to the captured commit")
+                    branch_settings = yield from self._branch_config(intent.full_ref.removeprefix(LOCAL_PREFIX))
+                if intent.mode == BranchMode.MOVE and not (yield from self.is_fast_forward(original_oid, intent.target_oid)) and not intent.force_reset:
+                    raise ValueError("This reset is not a fast-forward; enable Force reset for a non-fast-forward reset")
+
+            def validate_launch() -> None:
+                """Keep waiting writes bound to the exact repository and live form."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if is_current is not None and not is_current() or reference_signature(snapshot.context) != current.signature:
+                    raise ValueError("References, HEAD or branch authority changed before launch; reopen the form")
+                native_started = True
+
+            arguments = ["switch", "--no-guess", "-c", name, "--", intent.target_oid] if checkout else ["branch", "--", name, intent.target_oid]
+            if intent.mode == BranchMode.RENAME:
+                arguments = ["branch", "-m", "--", intent.full_ref.removeprefix(LOCAL_PREFIX), name]
+            elif intent.mode == BranchMode.MOVE:
+                arguments = ["branch", "-f", "--", name, intent.target_oid]
+            yield _parent_write_command(arguments, validate_launch)
+            branch_completed = True
+            if intent.mode == BranchMode.MOVE and checkout:
+                moved = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+                if (moved.object_oid_by_name.get(resulting_ref) != intent.target_oid or moved.head_ref != snapshot.head_ref
+                        or moved.head_oid != snapshot.head_oid or resulting_ref in occupied_branch_set(moved)):
+                    raise ValueError("Branch moved, but references changed before checkout; inspect the repository")
+
+                def validate_checkout() -> None:
+                    """Keep checkout bound to the branch just moved, including while queued."""
+                    nonlocal checkout_started
+                    self.repository_operation.validate(operation)
+                    if is_current is not None and not is_current() or reference_signature(snapshot.context) != moved.signature:
+                        raise ValueError("Branch moved, but checkout authority changed before launch")
+                    checkout_started = True
+
+                yield _parent_write_command(["switch", "--no-guess", "--", name], validate_checkout)
+            process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        try:
+            refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            observed = native_started and current is not None and refreshed.object_oid_by_name.get(resulting_ref) == intent.target_oid
+            if intent.mode == BranchMode.MOVE:
+                observed = observed and (branch_completed or current.object_oid_by_name.get(resulting_ref) != intent.target_oid)
+            if intent.mode != BranchMode.MOVE:
+                observed = observed and resulting_ref not in current.object_oid_by_name
+            if intent.mode == BranchMode.RENAME:
+                observed = observed and intent.full_ref not in refreshed.object_oid_by_name
+            expected_ref = resulting_ref if checkout or intent.mode == BranchMode.RENAME and snapshot.head_ref == intent.full_ref else snapshot.head_ref
+            expected_oid = intent.target_oid if checkout else snapshot.head_oid
+            if status == OperationStatus.SUCCESS and (not observed or refreshed.head_ref != expected_ref or refreshed.head_oid != expected_oid):
+                raise ValueError("Git exited successfully but the expected branch or HEAD was not observed")
+            if intent.mode == BranchMode.RENAME and observed:
+                renamed_settings = yield from self._branch_config(intent.local_name)
+                if renamed_settings != branch_settings:
+                    raise ValueError("The branch was renamed but its local configuration was not fully preserved; inspect Git configuration")
+        except (ValueError, OSError, GitCommandError) as error:
+            if diagnostic is None:
+                diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation_name, snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            status = OperationStatus.UNKNOWN
+            observed = (native_started and refreshed is not None and refreshed.object_oid_by_name.get(resulting_ref) == intent.target_oid
+                        and (intent.mode == BranchMode.MOVE or current is not None and resulting_ref not in current.object_oid_by_name))
+        effect = "created" if creation else "renamed" if intent.mode == BranchMode.RENAME else "moved"
+        move_completed = intent.mode == BranchMode.MOVE and branch_completed
+        branch_status = OperationStatus.SUCCESS if observed else OperationStatus.UNKNOWN if move_completed else status
+        branch_effect = effect if observed else "Git moved the branch; inspect its final target" if move_completed else "not observed"
+        branch_step = OperationStepResult(operation_name, branch_status, current, refreshed, ProcessStatus.SUCCESS if branch_completed else process_status, branch_effect, diagnostic)
+        steps = (branch_step,)
+        if intent.mode == BranchMode.RENAME and observed:
+            # Once the configuration is proven preserved, the capture taken after the rename is still the final state:
+            # reading the configuration changes no reference.
+            settings_step = OperationStepResult("Preserve branch configuration", OperationStatus.SUCCESS if status == OperationStatus.SUCCESS else OperationStatus.UNKNOWN,
+                                               after=refreshed if status == OperationStatus.SUCCESS else None,
+                                               effect="preserved" if status == OperationStatus.SUCCESS else "inspect Git configuration", diagnostic=diagnostic)
+            steps = (branch_step, settings_step)
+        if checkout:
+            step = OperationStepResult("Checkout", status if checkout_started or intent.mode == BranchMode.CREATE_CHECKOUT and native_started else OperationStatus.STEP_NOT_STARTED, current, refreshed, process_status,
+                                       "checked out" if refreshed is not None and refreshed.head_ref == resulting_ref else "inspect final state", diagnostic)
+            steps = (branch_step, step)
+        if (observed or move_completed) and status != OperationStatus.SUCCESS:
+            status = OperationStatus.PARTIAL
+        outcome = OperationOutcome(operation.operation_id, status, steps, diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _abort_merge(self, intent: MergeAbortIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Check that the merge shown is still the one in progress, run Git's merge --abort, then read the result back.
+
+        Git restores the state from before the merge by itself, so nothing is copied or reset here: the checks are a few
+        cheap reads (the merge files and the references), the only write is merge --abort, with submodule recursion
+        off so no submodule content is touched. The result counts as done only when the merge is gone and HEAD is
+        the commit the merge started from.
+        """
+        operation = intent.operation
+        context = operation.context
+        diagnostic = None
+        status = OperationStatus.REFUSED
+        process_status = None
+        current = None
+        refreshed = None
+        native_started = False
+
+        def merge_shown_is_current() -> bool:
+            """Tell whether Git still records the very merge the banner showed, with no other operation paused beside it."""
+            state = read_merge_banner_state(context.git_dir)
+            return state.in_progress and state.merge is not None and state.merge.parent_oids == intent.merge_head_oids
+
+        try:
+            if operation.action != OperationAction.MERGE_ABORT or operation.targets != (*intent.merge_head_oids, intent.head_oid):
+                raise ValueError("Merge abort identity does not match its captured authority")
+            if is_current is not None and not is_current():
+                raise ValueError("The merge abort request is no longer current")
+            still_shown = yield FileTask(merge_shown_is_current)
+            if not still_shown:
+                raise ValueError("The merge in progress changed or ended; refresh before aborting it")
+            current = yield from self.capture(context, operation.git_filename, operation.generation)
+            if current.head_oid != intent.head_oid:
+                raise ValueError("HEAD changed since the merge was shown; refresh before aborting it")
+
+            def validate_launch() -> None:
+                """Refuse a queued Abort after the merge, the references or the request changed."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if is_current is not None and not is_current() or reference_signature(context) != current.signature or not merge_shown_is_current():
+                    raise ValueError("The merge, HEAD or the request changed before launch; refresh before aborting it")
+                native_started = True
+
+            yield _parent_write_command(["merge", "--abort"], validate_launch)
+            process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+        try:
+            remaining = yield FileTask(lambda: read_merge_banner_state(context.git_dir))
+            refreshed = yield from self.capture(context, operation.git_filename, operation.generation)
+            if status == OperationStatus.SUCCESS and (remaining.merge is not None or remaining.cause or refreshed.head_oid != intent.head_oid):
+                raise ValueError("Git exited successfully but the merge is still recorded or HEAD moved")
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic(operation.operation, context.repository_dir, operation.git_filename, [], str(error)).prepare()
+            status = OperationStatus.UNKNOWN
+        effect = "merge abandoned" if status == OperationStatus.SUCCESS else "inspect final state"
+        step = OperationStepResult(operation.operation, status, current, refreshed, process_status, effect, diagnostic)
+        outcome = OperationOutcome(operation.operation_id, status, (step,), diagnostic)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome
+
+    def _checkout(self, intent: CheckoutIntent, is_current: Callable[[], bool] | None) -> Generator:
+        """Recheck captured identities, run native switch and observe effects before release.
+
+        The step reports the fresh reference captures taken before and after the switch: they hold HEAD's branch
+        and commit, which is everything a checkout promises, so no complete working tree read is spent on it.
+
+        Resetting an existing local branch onto a remote branch is Git's own ``switch -C``: Git refuses by itself
+        when local changes would be overwritten or the branch is checked out in another worktree, so nothing is
+        discarded or stashed here. The Checkout window keeps Checkout greyed for a reset until it shows how many
+        commits the local branch loses, or why that number is unknown; the reference files are checked again just
+        before launch, so a branch moved meanwhile is refused.
+        """
+        operation = intent.operation
+        snapshot = intent.snapshot
+        diagnostic = None
+        status = OperationStatus.REFUSED
+        process_status = None
+        current = None
+        refreshed = None
+        expected_head_ref = intent.full_ref
+        created_ref = ""
+        native_started = False
+        stale_capture = False
+        try:
+            if (operation.context != snapshot.context or operation.git_filename != snapshot.git_filename or operation.generation != snapshot.generation
+                    or operation.targets != (intent.full_ref, intent.target_oid, str(intent.force_checkout))):
+                raise StaleCaptureError("Checkout identity does not match its captured authority")
+            if intent.force_checkout and intent.mode != CheckoutMode.DETACHED:
+                raise ValueError("Force applies only to checking out a revision")
+            if is_current is not None and not is_current():
+                raise StaleCaptureError("The checkout request is no longer current")
+            current = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if current.head_oid != snapshot.head_oid or current.head_ref != snapshot.head_ref or current.signature != snapshot.signature:
+                raise StaleCaptureError(self.refresh_advice(SharedText.CHECKOUT_REFERENCES_OR_HEAD_CHANGED))
+            reference = next((reference for reference in current.references if reference.full_name == intent.full_ref), None)
+            if intent.full_ref and (reference is None or reference.target_oid != intent.target_oid or reference.symbolic_target):
+                raise StaleCaptureError(self.refresh_advice(SharedText.SELECTED_REFERENCE_CHANGED_OR_SYMBOLIC))
+            validate_oid(intent.target_oid)
+            if intent.mode == CheckoutMode.DETACHED and intent.force_checkout:
+                # "git switch --discard-changes" still refuses when an untracked file is in the way; "checkout --force"
+                # overwrites it as the Force choice promises. No "--" here: after it the commit would be read as a path,
+                # and the full commit ID validated above can never be taken for an option.
+                arguments = ["checkout", "--force", "--detach", intent.target_oid]
+                expected_head_ref = None
+            elif intent.mode == CheckoutMode.DETACHED:
+                arguments = ["switch", "--detach", "--", intent.target_oid]
+                expected_head_ref = None
+            elif intent.mode == CheckoutMode.LOCAL and intent.full_ref.startswith(LOCAL_PREFIX):
+                arguments = ["switch", "--no-guess", "--", intent.full_ref.removeprefix(LOCAL_PREFIX)]
+            elif intent.mode == CheckoutMode.RESET_LOCAL and intent.full_ref.startswith(REMOTE_PREFIX):
+                name = remote_branch_name(snapshot, intent.full_ref)
+                yield from check_branch_name(name)
+                created_ref = LOCAL_PREFIX + name
+                if created_ref not in current.object_oid_by_name:
+                    raise StaleCaptureError(self.refresh_advice(SharedText.CHECKOUT_LOCAL_BRANCH_GONE))
+                expected_head_ref = created_ref
+                arguments = ["switch", "--no-guess", "-C", name, "--track=direct", "--", intent.full_ref]
+            elif intent.mode in (CheckoutMode.SAME, CheckoutMode.CUSTOM) and intent.full_ref.startswith(REMOTE_PREFIX):
+                name = remote_branch_name(snapshot, intent.full_ref) if intent.mode == CheckoutMode.SAME else intent.local_name
+                yield from check_branch_name(name)
+                created_ref = LOCAL_PREFIX + name
+                if created_ref in current.object_oid_by_name:
+                    raise ValueError("A local branch with this name already exists; choose another name")
+                expected_head_ref = created_ref
+                arguments = ["switch", "--no-guess", "-c", name, "--track=direct", "--", intent.full_ref]
+            else:
+                raise ValueError("Select a local branch, a remote branch creation mode or detached HEAD")
+
+            def validate_launch() -> None:
+                """Refuse a queued command after a changed reference or closed intention."""
+                nonlocal native_started
+                self.repository_operation.validate(operation)
+                if is_current is not None and not is_current() or reference_signature(snapshot.context) != current.signature:
+                    raise StaleCaptureError(self.refresh_advice(SharedText.CHECKOUT_CHANGED_BEFORE_LAUNCH))
+                native_started = True
+
+            yield _parent_write_command(arguments, validate_launch)
+            process_status = ProcessStatus.SUCCESS
+            status = OperationStatus.SUCCESS
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Checkout", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            process_status = error.process_status if isinstance(error, GitCommandError) else None
+            status = OperationStatus.FAILED if native_started else OperationStatus.REFUSED
+            stale_capture = isinstance(error, StaleCaptureError) and not native_started
+        try:
+            refreshed = yield from self.capture(snapshot.context, snapshot.git_filename, snapshot.generation)
+            if status == OperationStatus.SUCCESS and (refreshed.head_oid != intent.target_oid or refreshed.head_ref != expected_head_ref):
+                raise ValueError("Git exited successfully but checkout did not leave the expected HEAD")
+            if created_ref and status == OperationStatus.SUCCESS:
+                upstream = yield GitCommand(["for-each-ref", "--format=%(refname)%00%(upstream)", created_ref])
+                if (created_ref + "\0" + intent.full_ref) not in upstream.decode().splitlines():
+                    raise ValueError("The created branch does not track the selected remote reference")
+        except (ValueError, OSError, GitCommandError) as error:
+            diagnostic = error.diagnostic if isinstance(error, GitCommandError) else Diagnostic("Checkout", snapshot.context.repository_dir, snapshot.git_filename, [], str(error)).prepare()
+            status = OperationStatus.UNKNOWN
+        step = OperationStepResult("Checkout", status, current, refreshed, process_status, "checked out" if status == OperationStatus.SUCCESS else "inspect final state", diagnostic)
+        steps = (step,)
+        if created_ref and intent.mode == CheckoutMode.RESET_LOCAL:
+            # A branch that already sat on the target proves nothing about a failed Git, so only a successful
+            # switch or an observed move counts as the reset.
+            before_oid = current.object_oid_by_name.get(created_ref) if current is not None else None
+            exists = (native_started and refreshed is not None and refreshed.object_oid_by_name.get(created_ref) == intent.target_oid
+                      and (before_oid != intent.target_oid or status == OperationStatus.SUCCESS))
+            reset = OperationStepResult("Reset branch", OperationStatus.SUCCESS if exists else OperationStatus.STEP_NOT_STARTED, current, refreshed,
+                                        effect="reset" if exists else "not observed")
+            steps = (reset, step)
+            if exists and status != OperationStatus.SUCCESS:
+                status = OperationStatus.PARTIAL
+        elif created_ref:
+            exists = (native_started and refreshed is not None and current is not None and created_ref not in current.object_oid_by_name
+                      and refreshed.object_oid_by_name.get(created_ref) == intent.target_oid)
+            creation = OperationStepResult("Create branch", OperationStatus.SUCCESS if exists else OperationStatus.STEP_NOT_STARTED, current, refreshed,
+                                           effect="created" if exists else "not observed")
+            steps = (creation, step)
+            if exists and status != OperationStatus.SUCCESS:
+                status = OperationStatus.PARTIAL
+        outcome = OperationOutcome(operation.operation_id, status, steps, diagnostic, stale_capture=stale_capture and status == OperationStatus.REFUSED)
+        self.outcome_by_id[operation.operation_id] = outcome
+        return outcome