gitpane 1.0.0__py3-none-any.whl

gitpane/transport/branch_exchange.py

@@ -0,0 +1,1690 @@
+"""Exchange captured branches with native Git, keeping each observed remote result."""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import uuid
+from dataclasses import dataclass, field, replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, QTimer, Signal
+
+from gitpane.account.authentication import PREVIEW_HELPER_COMMANDS, isolated_http_arguments
+from gitpane.account.credential_manager import CredentialManagerRefusal
+from gitpane.config import CREDENTIAL_READ_RETRY_DELAY_MS, GCM_TRACE_SECRETS_NAME, GIT_MUTATION_TIMEOUT_MS, GIT_TRANSPORT_TIMEOUT_MS, LOCAL_PREFIX, REMOTE_PREFIX, SUBMODULE_RECURSION_OFF_ARGUMENTS, TAG_PREFIX, TRANSPORT_IDLE_TIMEOUT_MS, SharedText
+from gitpane.history.repository_value import validate_oid
+from gitpane.operation.console_line import DELETED_LOCALLY_ONLY_TEMPLATE, DELETED_REMOTELY_ONLY_TEMPLATE, FAILED_REMOTES_TEMPLATE, NOT_PUSHED_REFS_TEMPLATE, REPOSITORY_HEADER_LABEL, ConsoleHeader, ConsoleLine, operation_end_text
+from gitpane.operation.console_tone import ConsoleTone
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus, operation_status
+from gitpane.operation.operation_trace import OperationTrace
+from gitpane.operation.repository_operation import GITPANE_CLOSING_TEXT, OperationAction, OperationIntent, OperationOutcome, OperationStepResult, WriteScope
+from gitpane.process.process_runner import LOCAL_WRITE_PROFILE, NETWORK_PROFILE, READ_PROFILE, ProcessRequest, ProcessStatus
+from gitpane.reference.reference_edit import DELETE_LOCAL_BRANCH_OPERATION, DELETE_LOCAL_TAG_OPERATION, DELETE_REMOTE_BRANCH_OPERATION, DELETE_REMOTE_TAG_OPERATION, reference_signature
+from gitpane.transport.clone import HTTPS_ENDPOINT_KIND, SSH_ENDPOINT_KIND, endpoint_kind
+from gitpane.transport.credential_read_retry import credential_read_retry_due, credential_read_retry_text
+from gitpane.transport.remote_config import (
+    MERGE_TRACKING_FIELD,
+    config_signature,
+    fetch_branch_refspecs,
+    field_values,
+    refspec_write_refs,
+    remote_boolean,
+    remote_reference_oid,
+    remote_tracking_ref,
+    rewrite_url,
+    selected_endpoint_arguments,
+    tracking_values,
+)
+from gitpane.worktree.command_sequence import FileTask, GitCommand, GitCommandError
+
+# Said when a transport is asked to start while GitPane is shutting down.
+TRANSPORT_CLOSED_TEXT = "GitPane is closing, so nothing was started."
+# Said when an HTTPS process would start before its operation found its credential manager; the steps never run in
+# that order, so this only guards against a broken sequence.
+CREDENTIAL_MANAGER_NOT_SEARCHED_TEXT = "The credential manager was not searched for this operation. Start it again."
+TRANSPORT_TRACE_ENVIRONMENT_BY_NAME = {
+    "GIT_TRACE": "1", "GIT_TRACE_CURL": "1", "GIT_TRACE_CURL_NO_DATA": "0", "GIT_TRACE_REDACT": "1",
+    "GCM_TRACE": "1", GCM_TRACE_SECRETS_NAME: "0",
+}
+PUSH_ARGUMENT_LIMIT = 24000
+WINDOWS_CODE_UNIT_BYTES = 2
+TRACKING_UPDATE_OPERATION = "Update remote-tracking branch"
+TRACKING_DELETE_OPERATION = "Delete remote-tracking branch"
+# The reflog message Git itself writes when a push moves a remote-tracking branch.
+TRACKING_REFLOG_MESSAGE = "update by push"
+# Porcelain reasons of a branch refused because the server holds commits the push would replace (without force, or with a
+# lease that no longer matches). Other refusals, such as a server hook, keep their own diagnostic.
+PUSH_REJECTION_REASONS = ("non-fast-forward", "fetch first", "stale info")
+# Porcelain summary of a reference the server itself refused after receiving it, for instance from a hook, with Git's
+# reason in parentheses: "[remote rejected] (hook declined)".
+SERVER_REFUSAL_SUMMARY_PREFIX = "[remote rejected]"
+SERVER_REFUSAL_REASON_PATTERN = re.compile(r"\((?P<reason>.*)\)\s*$")
+REFUSED_PORCELAIN_FLAG = "!"
+# The final read after a remote-tracking update: every local and remote-tracking branch, with the upstream Git resolves.
+TRACKING_RESULT_FORMAT = "--format=%(refname)%00%(objectname)%00%(symref)%00%(upstream)"
+TRACKING_RESULT_FIELD_COUNT = 4
+# The local steps of a remote deletion: the tag deleted before its server counterpart, the branches after theirs.
+LOCAL_DELETE_OPERATION_SET = frozenset({DELETE_LOCAL_TAG_OPERATION, DELETE_LOCAL_BRANCH_OPERATION})
+# The network steps a transport starts again by itself when the credential manager could not read back a secret, a
+# failure that happens before Git sends any authenticated request, so the server is still as it was. Each is safe to repeat:
+# - delete-before, delete-recheck, delete-after, push-before and push-after are ls-remote reads;
+# - delete is a push with --force-with-lease on the object the ls-remote before it read, so it can only delete that object;
+# - push sends a replaced branch or tag only with a lease per reference, and an addition already made reads "up to date";
+# - fetch only moves remote-tracking branches, exactly as a successful fetch would.
+CREDENTIAL_READ_RETRY_STAGE_SET = frozenset({"delete-before", "delete-recheck", "delete", "delete-after", "push-before", "push", "push-after", "fetch"})
+# The steps that read the server after a push or a deletion was sent: once cancelled, their result stays unknown.
+OBSERVATION_STAGE_SET = frozenset({"push-after", "delete-after"})
+PUSH_ARGUMENTS = ("-c", "push.followTags=false", "-c", "push.recurseSubmodules=no", "push", "--porcelain", "--progress", "--no-follow-tags", "--recurse-submodules=no", "--no-mirror", "--no-prune")
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator, Sequence
+
+    from gitpane.account.authentication import AccountSelection, AuthenticationService
+    from gitpane.account.credential_manager import CredentialManagerDetection
+    from gitpane.account.ssh import SshService
+    from gitpane.operation.diagnostic import DiagnosticLog, PreparedDiagnostic
+    from gitpane.operation.repository_operation import RepositoryOperationService
+    from gitpane.process.process_runner import ProcessResult, ProcessRunner
+    from gitpane.transport.remote import RemoteService
+    from gitpane.transport.remote_config import RemoteSnapshot
+
+
+@dataclass(frozen=True)
+class TransportRequest:
+    """Capture the repository, binary and authority before asynchronous preparation."""
+
+    operation: OperationIntent
+    prune_all: bool = True
+    remote_name: str = ""
+    snapshot: RemoteSnapshot | None = None
+    mode: str = "fetch"
+    source_ref: str = ""
+    source_oid: str = ""
+    destination_ref: str = ""
+    endpoint: str = ""
+    force: bool = False
+    push_target: PushTarget | None = None
+    tag_refs: tuple[tuple[str, str], ...] = ()
+    delete_local_refs: tuple[tuple[str, str], ...] = ()
+    immutable_commit: bool = False
+    # Link source_ref to the remote branch of remote_name it was pushed to, once the server is observed holding it.
+    add_tracking: bool = False
+
+
+@dataclass(frozen=True)
+class PushTarget:
+    """Freeze one visible endpoint and its effective authentication and tool configuration."""
+
+    remote_name: str
+    endpoint: str
+    command_endpoint: str
+    kind: str
+    arguments: tuple[str, ...] = ()
+    environment_by_name: dict[str, str] = field(default_factory=dict)
+    selection: AccountSelection | None = None
+
+
+@dataclass(frozen=True)
+class FetchTarget:
+    """Retain one remote's endpoint, branch mapping and authentication for the entire run."""
+
+    remote_name: str
+    endpoint: str = ""
+    command_endpoint: str = ""
+    refspecs: tuple[str, ...] = ()
+    arguments: tuple[str, ...] = ()
+    environment_by_name: dict[str, str] = field(default_factory=dict)
+    selection: AccountSelection | None = None
+    kind: str = ""
+    error: str = ""
+
+
+@dataclass(frozen=True)
+class FetchResult:
+    """Distinguish each remote's observed effects from a later refusal or interruption."""
+
+    remote_name: str
+    endpoint: str
+    status: OperationStatus
+    effect: str = "unknown"
+    diagnostic: PreparedDiagnostic | None = None
+
+
+@dataclass(frozen=True)
+class PushResult:
+    """Keep each exact destination ref's observed effect separate from the process exit."""
+
+    full_ref: str
+    source_oid: str
+    endpoint: str
+    status: OperationStatus
+    before_oid: str | None = None
+    after_oid: str | None = None
+    effect: str = "unknown"
+
+
+@dataclass(frozen=True)
+class PushRejection:
+    """Describe a branch Push the server refused because its branch holds commits the push would replace.
+
+    ``unseen_commits`` is true when the server branch is not at the last fetched position (the remote-tracking branch):
+    someone pushed commits this repository has not fetched, or there is no fetched state at all. Only when it is false
+    can a force push with lease succeed.
+    """
+
+    remote_name: str
+    destination_ref: str
+    reason: str
+    remote_oid: str
+    tracking_ref: str
+    tracking_oid: str
+    unseen_commits: bool
+
+
+@dataclass(frozen=True)
+class ServerRefusal:
+    """Name a reference the server refused after receiving the Push, with Git's own reason, such as "hook declined"."""
+
+    full_ref: str
+    reason: str
+
+    def short_name(self) -> str:
+        """Return the branch or tag name as the user knows it, without its refs/heads/ or refs/tags/ prefix."""
+        for prefix in (LOCAL_PREFIX, TAG_PREFIX):
+            if self.full_ref.startswith(prefix):
+                return self.full_ref.removeprefix(prefix)
+        return self.full_ref
+
+
+@dataclass(frozen=True)
+class TransportOutcome(OperationOutcome):
+    """Keep the exact endpoint and reread references independently of process success."""
+
+    remote_name: str = ""
+    endpoint: str = ""
+    snapshot: RemoteSnapshot | None = None
+    remote_results: tuple[FetchResult, ...] = ()
+    ref_results: tuple[PushResult, ...] = ()
+    rejection: PushRejection | None = None
+    # Whether the views must read the repository again. Only a Fetch or Push proven to have changed nothing, on the
+    # server or locally, sets it to False; every other outcome keeps the conservative default.
+    refresh_required: bool = True
+    # The account of the last network step, so a failure can name the account used; it never holds a secret.
+    selection: AccountSelection | None = None
+    # The references the server itself refused (a hook, for instance), in the order they were sent; empty otherwise.
+    server_refusals: tuple[ServerRefusal, ...] = ()
+    # The detection of the credential manager refusal, set only when that refusal stopped the operation or the HTTPS
+    # remotes of a Fetch, so the window explaining how to install it can open.
+    credential_manager_refusal: CredentialManagerDetection | None = None
+    # The Push itself succeeded but the link to its remote branch that the user asked for was not set: its console
+    # carries the red line saying so and must stay readable even when it would close by itself after a success.
+    upstream_not_linked: bool = False
+
+
+def unchanged_observation(before: RemoteSnapshot, after: RemoteSnapshot) -> bool:
+    """Tell whether two captures of one repository describe exactly the same configuration, branches and references."""
+    return (before.context == after.context and before.git_filename == after.git_filename and before.values == after.values
+            and before.direct_values == after.direct_values and before.signature == after.signature and before.entry_by_name == after.entry_by_name
+            and before.tracking_by_ref == after.tracking_by_ref and before.references == after.references and before.reference_state == after.reference_state)
+
+
+@dataclass
+class TransportRun:
+    """Retain one operation's captured configuration until its last reader exits."""
+
+    request: TransportRequest
+    trace: OperationTrace
+    snapshot: RemoteSnapshot | None = None
+    remote_name: str = ""
+    endpoint: str = ""
+    command_endpoint: str = ""
+    arguments: list[str] = field(default_factory=list)
+    environment_by_name: dict[str, str] = field(default_factory=dict)
+    selection: AccountSelection | None = None
+    kind: str = ""
+    stage: str = "preparing"
+    process_id: str = ""
+    cancelled: bool = False
+    steps: list[OperationStepResult] = field(default_factory=list)
+    targets: tuple[FetchTarget, ...] = ()
+    target_index: int = 0
+    remote_results: list[FetchResult] = field(default_factory=list)
+    output: bytearray = field(default_factory=bytearray)
+    before_oid: str | None = None
+    push_status: ProcessStatus | None = None
+    push_diagnostic: PreparedDiagnostic | None = None
+    ref_results: list[PushResult] = field(default_factory=list)
+    push_batches: list[tuple[tuple[str, str], ...]] = field(default_factory=list)
+    batch_index: int = 0
+    before_oid_by_ref: dict[str, str] = field(default_factory=dict)
+    porcelain_flag_by_ref: dict[str, str] = field(default_factory=dict)
+    porcelain_summary_by_ref: dict[str, str] = field(default_factory=dict)
+    rejection: PushRejection | None = None
+    server_refusals: list[ServerRefusal] = field(default_factory=list)
+    delete_local: Callable[[], Generator] | None = None
+    delete_current: Callable[[], bool] | None = None
+    local_started: bool = False
+    delete_started: bool = False
+    # Set when the link asked for after a successful Push was not set, so the outcome can keep its console open.
+    upstream_not_linked: bool = False
+    tracking_checked: bool = False
+    # The credential manager command this operation found once, off the Qt thread, before its first HTTPS process. It
+    # belongs to this run only and is cleared when the run ends; the search itself keeps its success for the next
+    # operation with the same Git.
+    verified_helper_commands: tuple[str, ...] | None = None
+    # A helper command injected into the authentication service when the run was created; a change refuses the run.
+    helper_override: tuple[str, ...] | None = None
+    # The sentence of the credential manager refusal for this run, empty until the search refuses. A Fetch ends each of
+    # its HTTPS remotes on it without searching a second time, and goes on with its other remotes, which never need the
+    # credential manager.
+    helper_refusal: str = ""
+    # The detection of the credential manager refusal that stopped the HTTPS work of this run, kept for the window that
+    # explains how to install the credential manager.
+    credential_manager_refusal: CredentialManagerDetection | None = None
+    # The operation's first capture, kept only to compare the final observation with it; it never authorizes a write.
+    first_snapshot: RemoteSnapshot | None = None
+    # The arguments the current step was last started with, so it can be started again unchanged.
+    launch_arguments: list[str] = field(default_factory=list)
+    # How many times the current step was started again after a failed secret read; a new step starts from zero.
+    credential_read_retry_count: int = 0
+    # Set while the current step waits to be started again, so a cancel during the wait ends the operation at once.
+    retry_waiting: bool = False
+
+
+def transport_console_label(request: TransportRequest) -> str:
+    """Return the operation's name as the user knows it, such as ``Push`` or ``Delete tag``, for its console and its diagnostics.
+
+    It differs from the operation name given to each Git process (``Delete remote branch``…), which the ``--log`` file
+    keeps as it is.
+    """
+    if request.mode == "delete":
+        return "Delete tag" if request.source_ref.startswith(TAG_PREFIX) else "Delete branch"
+    if request.mode == "push":
+        return "Push"
+    return "Fetch"
+
+
+def unsuccessful_count(results: Sequence[PushResult | FetchResult]) -> int:
+    """Count the references or remotes whose result is not a success, whatever else it is: refused, unknown or never started."""
+    count = 0
+    for result in results:
+        if result.status != OperationStatus.SUCCESS:
+            count += 1
+    return count
+
+
+def push_argument_size(arguments: list[str]) -> int:
+    """Bound quoted Windows code units and POSIX encoded bytes with one conservative budget."""
+    command = subprocess.list2cmdline(arguments)
+    return max(len(command.encode("utf-16-le", "surrogatepass")) // WINDOWS_CODE_UNIT_BYTES, len(os.fsencode(command))) + 1
+
+
+def lease_argument(full_ref: str, expected_oid: str) -> str:
+    """Let Git replace a server ref only while it still holds the expected object; an empty expectation requires the ref to be absent."""
+    return "--force-with-lease=" + full_ref + ":" + expected_oid
+
+
+def push_batches(program_filename: str, arguments: list[str], remote_name: str, refs: tuple[tuple[str, str], ...], force: bool) -> list[tuple[tuple[str, str], ...]]:
+    """Split explicit refs before an OS argument limit can omit or duplicate a selected tag.
+
+    A forced ref also carries its lease argument; its expected object has the same length as the pushed one, so the
+    budget is measured with the pushed object in its place.
+    """
+    base_arguments = [program_filename, *arguments, *PUSH_ARGUMENTS, "--", remote_name]
+    batches: list[tuple[tuple[str, str], ...]] = []
+    batch: list[tuple[str, str]] = []
+    ref_arguments: list[str] = []
+    for full_ref, oid in refs:
+        new_arguments = [oid + ":" + full_ref]
+        if force:
+            new_arguments.append(lease_argument(full_ref, oid))
+        if push_argument_size([*base_arguments, *new_arguments]) > PUSH_ARGUMENT_LIMIT:
+            raise ValueError("A Push reference or endpoint exceeds the command argument limit.")
+        if batch and push_argument_size([*base_arguments, *ref_arguments, *new_arguments]) > PUSH_ARGUMENT_LIMIT:
+            batches.append(tuple(batch))
+            batch, ref_arguments = [], []
+        batch.append((full_ref, oid))
+        ref_arguments.extend(new_arguments)
+    if batch:
+        batches.append(tuple(batch))
+    return batches
+
+
+class TransportService(QObject):
+    """Own explicit network exchanges and reconcile local effects before releasing Git."""
+
+    finished = Signal(object)
+
+    def __init__(self, remote: RemoteService, authentication: AuthenticationService, ssh: SshService,
+                 repository_operation: RepositoryOperationService, runner: ProcessRunner, parent: QObject | None = None,
+                 *, is_current: Callable[[OperationIntent], bool], log: DiagnosticLog | None = None) -> None:
+        """Reuse the application's process, authentication and common-repository owners."""
+        super().__init__(parent)
+        self.remote = remote
+        self.authentication = authentication
+        self.ssh = ssh
+        self.repository_operation = repository_operation
+        self.runner = runner
+        self.is_current = is_current
+        self.log = log
+        self.run_by_id: dict[str, TransportRun] = {}
+        self.outcome_by_id: dict[str, TransportOutcome] = {}
+        # Fetch, Push and remote deletion all accept a remote that is a local folder, as Git Extensions does.
+        self.allow_local_endpoint = True
+        self.closed = False
+        runner.finished.connect(self._process_finished)
+        runner.stdout_chunk.connect(self._stdout)
+
+    def capture_push_target(self, snapshot: RemoteSnapshot, remote_name: str, endpoint: str) -> PushTarget:
+        """Prepare one displayed destination without network calls or stored configuration edits.
+
+        An HTTPS target holds a preview of its credential configuration, with every helper disabled: capturing and
+        comparing a destination never searches the credential manager, which is found once per operation before sending.
+        """
+        kind = endpoint_kind(endpoint, self.allow_local_endpoint)
+        entry = snapshot.entry_by_name.get(remote_name)
+        if remote_name and (entry is None or entry.collision or endpoint not in entry.push_urls):
+            raise ValueError("The selected Push endpoint is no longer configured. Reread destination.")
+        if rewrite_url(endpoint, snapshot.values) != endpoint:
+            raise ValueError("The endpoint has chained rewrite rules. Configure an unambiguous destination.")
+        command_endpoint, arguments, environment_by_name, selection = endpoint, [], {}, None
+        if kind == HTTPS_ENDPOINT_KIND:
+            selection = self.authentication.account_for_endpoint(endpoint, snapshot.context)
+            command_endpoint, arguments = self.authentication.command_configuration(endpoint, snapshot.context, selection=selection, helper_commands=PREVIEW_HELPER_COMMANDS)
+            arguments.extend(isolated_http_arguments(command_endpoint))
+        elif kind == SSH_ENDPOINT_KIND:
+            arguments, environment_by_name = self.ssh.command_configuration()
+        if rewrite_url(command_endpoint, snapshot.values) != command_endpoint:
+            raise ValueError("The authenticated URL would be rewritten to another destination. Review its configuration.")
+        return PushTarget(remote_name, endpoint, command_endpoint, kind, tuple(arguments), environment_by_name, selection)
+
+    def _prepare_network(self, run: TransportRun) -> Generator:
+        """Find the credential manager once for this operation, in a background task, just before its first HTTPS process.
+
+        The search runs with the operation's own Git, off the Qt thread, and its answer is kept only by this run: a later
+        remote or batch of the same operation reuses it. A refusal is noted in the run and raises ValueError with its
+        sentence before any HTTPS process starts: Push and deletion end on it, while a Fetch ends only its HTTPS remotes
+        on it. A refusal that comes back once the user cancelled the operation is not kept for the install window. A
+        helper command injected into the service is used as it is, as the service itself does. Authority and targets are
+        checked again once the background task returns.
+        """
+        if run.verified_helper_commands is not None:
+            return
+        if run.helper_override:
+            verified = tuple(run.helper_override)
+        else:
+            git_filename = run.request.operation.git_filename
+            try:
+                helper = yield FileTask(lambda: self.authentication.credential_helper(git_filename))
+            except ValueError as refusal:
+                run.helper_refusal = str(refusal)
+                # An operation the user cancelled was stopped by the user, not by the refusal, so it never opens the
+                # install window, as for a clone or a submodule initialization.
+                if isinstance(refusal, CredentialManagerRefusal) and not run.cancelled:
+                    run.credential_manager_refusal = refusal.detection
+                raise
+            verified = helper.commands
+        self._check_current(run)
+        run.verified_helper_commands = verified
+
+    def _network_arguments(self, run: TransportRun, target: PushTarget | FetchTarget) -> list[str]:
+        """Compose the arguments one network process really receives, from the frozen target and the credential manager found for this run.
+
+        Push and deletion also name their private single-URL alias. The same composition checks a queued process at its
+        real launch, so no second list of credential settings exists to drift from the one that is sent.
+        """
+        arguments = list(target.arguments)
+        if target.kind == HTTPS_ENDPOINT_KIND:
+            if not run.verified_helper_commands:
+                raise ValueError(CREDENTIAL_MANAGER_NOT_SEARCHED_TEXT)
+            command_endpoint, arguments = self.authentication.command_configuration(target.endpoint, run.snapshot.context, selection=target.selection,
+                                                                                   helper_commands=run.verified_helper_commands)
+            if command_endpoint != target.command_endpoint:
+                raise ValueError("The account URL of this destination changed. Reread the destination.")
+            arguments.extend(isolated_http_arguments(command_endpoint))
+        if run.request.mode == "fetch":
+            return arguments
+        return [*selected_endpoint_arguments(run.snapshot, run.request.remote_name, target.command_endpoint, run.command_endpoint), *arguments]
+
+    def _network_target(self, run: TransportRun) -> PushTarget | FetchTarget | None:
+        """Return the frozen destination the run's next network process addresses, or nothing when none can start."""
+        if run.request.mode != "fetch":
+            return run.request.push_target
+        if run.target_index < len(run.targets) and not run.targets[run.target_index].error:
+            return run.targets[run.target_index]
+        return None
+
+    def _check_https_launch(self, run: TransportRun, target: PushTarget | FetchTarget) -> None:
+        """Refuse an HTTPS process whose account, injected helper or composed credential settings changed since capture."""
+        if self.authentication.helper_commands != run.helper_override:
+            raise ValueError("The credential helper changed during this operation. Start it again.")
+        if run.request.mode == "fetch" and self.authentication.account_for_endpoint(target.endpoint, run.snapshot.context) != target.selection:
+            raise ValueError("The account selected for " + target.remote_name + " changed. Start Fetch again.")
+        if (run.verified_helper_commands is not None and run.arguments and run.remote_name == target.remote_name and run.endpoint == target.endpoint
+                and run.arguments != self._network_arguments(run, target)):
+            raise ValueError("The credential configuration of this destination changed. Start the transport again.")
+
+    def _scoped_request(self, request: TransportRequest) -> TransportRequest:
+        """Include local tracking updates and explicit deletion continuations in transport ownership."""
+        operation = request.operation
+        refs = list(operation.scope.refs if operation.scope is not None else ())
+        if request.mode != "fetch" and request.snapshot is not None and request.remote_name:
+            refspecs = tuple(value.value for value in field_values(request.snapshot, request.remote_name, "fetch"))
+            refs.extend(refspec_write_refs(refspecs))
+        if request.mode == "delete":
+            refs.append(request.source_ref)
+            for full_ref, _oid in request.delete_local_refs:
+                refs.append(full_ref)
+        action = operation.action if operation.action != OperationAction.UNKNOWN else OperationAction.REMOTE_WRITE
+        operation = replace(operation, action=action, scope=WriteScope.capture(operation.context, tuple(sorted(set(refs)))))
+        return replace(request, operation=operation)
+
+    def push(self, request: TransportRequest) -> TransportRun:
+        """Send one branch or captured tag objects and retain ownership through observation."""
+        request = self._scoped_request(request)
+        operation = request.operation
+        previous = self.run_by_id.get(operation.operation_id)
+        if previous is not None:
+            return previous
+        trace = OperationTrace(operation.operation_id, self.runner, self.log, header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        run = TransportRun(request, trace, snapshot=request.snapshot, helper_override=self.authentication.helper_commands, first_snapshot=request.snapshot)
+        self.run_by_id[operation.operation_id] = run
+        if self.closed or not self.is_current(operation) or not self.repository_operation.reserve(operation):
+            cause = self._reservation_refusal(operation)
+            QTimer.singleShot(0, self, lambda: self._fail(run, cause, OperationStatus.REFUSED))
+            return run
+
+        def validate() -> Generator:
+            """Validate both full reference names and the captured source with native Git."""
+            self._check_current(run)
+            snapshot = request.snapshot
+            if snapshot is None or snapshot.context != operation.context or snapshot.git_filename != operation.git_filename or snapshot.generation != operation.generation:
+                raise ValueError("The Push capture changed. Reread the destination before sending.")
+            if request.tag_refs:
+                if request.source_ref or request.source_oid or request.destination_ref:
+                    raise ValueError("Choose either tags or one branch for Push.")
+                seen_ref_set: set[str] = set()
+                for full_ref, oid in request.tag_refs:
+                    validate_oid(oid)
+                    if not full_ref.startswith(TAG_PREFIX) or full_ref in seen_ref_set:
+                        raise ValueError("Choose distinct full tag references for Push.")
+                    seen_ref_set.add(full_ref)
+                output = yield GitCommand(["for-each-ref", "--format=%(refname)%00%(objectname)", TAG_PREFIX], before_start=lambda: self._check_current(run))
+                oid_by_ref = {}
+                for record in output.splitlines():
+                    full_ref, oid = record.decode("utf-8", "surrogateescape").split("\0")
+                    oid_by_ref[full_ref] = oid
+                for full_ref, oid in request.tag_refs:
+                    if oid_by_ref.get(full_ref) != oid:
+                        raise ValueError("A selected tag changed or disappeared. Reread before sending.")
+                refs = tuple(sorted(request.tag_refs))
+            else:
+                validate_oid(request.source_oid)
+                if (not request.immutable_commit and not request.source_ref.startswith(LOCAL_PREFIX)) or not request.destination_ref.startswith(LOCAL_PREFIX):
+                    raise ValueError("Choose a local source branch and a remote branch destination.")
+                source = snapshot.tracking_by_ref.get(request.source_ref)
+                if not request.immutable_commit and (source is None or source.oid != request.source_oid):
+                    raise ValueError("The source branch changed. Reread before sending.")
+                for full_ref in ((request.destination_ref,) if request.immutable_commit else (request.source_ref, request.destination_ref)):
+                    yield GitCommand(["check-ref-format", full_ref], before_start=lambda: self._check_current(run))
+                if request.immutable_commit:
+                    output = yield GitCommand(["cat-file", "-t", request.source_oid], before_start=lambda: self._check_current(run))
+                    if output.strip() != b"commit":
+                        raise ValueError("The captured source is not a commit object.")
+                else:
+                    output = yield GitCommand(["rev-parse", "--verify", request.source_ref], before_start=lambda: self._check_current(run))
+                    if output.decode().strip() != request.source_oid:
+                        raise ValueError("The source branch changed. Reread before sending.")
+                refs = ((request.destination_ref, request.source_oid),)
+            target = request.push_target
+            if target is None or target != self.capture_push_target(snapshot, request.remote_name, request.endpoint):
+                raise ValueError("The Push endpoint, account or tool changed. Reread destination before sending.")
+            run.remote_name, run.endpoint = request.remote_name, request.endpoint
+            run.command_endpoint = "gitpane-push-" + uuid.uuid4().hex
+            run.kind, run.selection = target.kind, target.selection
+            if target.kind == HTTPS_ENDPOINT_KIND:
+                yield from self._prepare_network(run)
+            run.arguments = self._network_arguments(run, target)
+            run.environment_by_name = dict(target.environment_by_name)
+            run.environment_by_name.update(TRANSPORT_TRACE_ENVIRONMENT_BY_NAME)
+            run.push_batches = push_batches(operation.git_filename, run.arguments, run.command_endpoint, refs, request.force)
+
+        def validated(_value: object, error: Exception | None) -> None:
+            """Start read-only remote observation after validating the explicit request."""
+            try:
+                if error is not None:
+                    raise ValueError(str(error))
+                run.trace.append_event(operation.operation_id, "status", "Push remote " + (run.remote_name or "Url") + " to " + run.endpoint)
+                self._next_push_batch(run)
+            except (ValueError, OSError, RuntimeError) as failure:
+                self._fail(run, str(failure), OperationStatus.REFUSED)
+
+        self.remote.worktree_service.run(operation.context, operation.git_filename, validate(), validated, operation_id=operation.operation_id)
+        return run
+
+    def delete_remote(self, request: TransportRequest, *, preflight: Callable[[], Generator] | None = None,
+                      local_sequence: Callable[[], Generator] | None = None, is_current: Callable[[], bool] | None = None, previous_operation_id: str = "") -> TransportRun:
+        """Delete one exact server ref and retain ownership through any local continuation."""
+        request = self._scoped_request(request)
+        operation = request.operation
+        previous = self.run_by_id.get(operation.operation_id)
+        if previous is not None:
+            return previous
+        trace = OperationTrace(operation.operation_id, self.runner, self.log, header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        run = TransportRun(request, trace, snapshot=request.snapshot, delete_local=local_sequence, delete_current=is_current, helper_override=self.authentication.helper_commands)
+        self.run_by_id[operation.operation_id] = run
+        if previous_operation_id:
+            previous = self.run_by_id.get(previous_operation_id)
+            outcome = self.outcome_by_id.get(previous_operation_id)
+            valid = (request.source_ref.startswith(TAG_PREFIX) and previous is not None and outcome is not None
+                     and previous.request.source_ref == request.source_ref and previous.request.source_oid == request.source_oid
+                     and previous.request.destination_ref == request.destination_ref and previous.request.endpoint == request.endpoint
+                     and previous.request.remote_name == request.remote_name and previous.request.mode == request.mode == "delete"
+                     and previous.request.operation.context == operation.context and previous.request.operation.git_filename == operation.git_filename
+                     and outcome.status in (OperationStatus.PARTIAL, OperationStatus.FAILED, OperationStatus.REFUSED) and any(step.operation == DELETE_LOCAL_TAG_OPERATION and step.status == OperationStatus.SUCCESS for step in outcome.steps)
+                     and not any(result.status in (OperationStatus.SUCCESS, OperationStatus.UNKNOWN) for result in outcome.ref_results))
+            if not valid:
+                QTimer.singleShot(0, self, lambda: self._fail(run, "Remote tag retry requires a matching captured destination and a known local success", OperationStatus.REFUSED))
+                return run
+            for step in outcome.steps:
+                if step.operation == DELETE_LOCAL_TAG_OPERATION and step.status == OperationStatus.SUCCESS:
+                    run.steps.append(step)
+            run.local_started = True
+        if self.closed or not self.is_current(operation) or not self.repository_operation.reserve(operation):
+            cause = self._reservation_refusal(operation)
+            QTimer.singleShot(0, self, lambda: self._fail(run, cause, OperationStatus.REFUSED))
+            return run
+
+        def validate() -> Generator:
+            """Validate full destination and captured account before contacting the server."""
+            snapshot = request.snapshot
+            if (request.mode != "delete" or snapshot is None or snapshot.context != operation.context or snapshot.git_filename != operation.git_filename
+                    or snapshot.generation != operation.generation or request.force or request.tag_refs
+                    or not request.destination_ref.startswith((LOCAL_PREFIX, TAG_PREFIX))):
+                raise ValueError("Deletion does not match its captured destination")
+            if request.source_ref.startswith(TAG_PREFIX) and (request.destination_ref != request.source_ref or operation.targets != (request.source_ref, request.source_oid)
+                                                            or not run.local_started and local_sequence is None):
+                raise ValueError("Tag deletion requires the captured tag object and its local-first step")
+            self._check_current(run)
+            yield GitCommand(["check-ref-format", request.destination_ref])
+            if preflight is not None and not run.local_started:
+                yield from preflight()
+            target = request.push_target
+            if target is None or target != self.capture_push_target(snapshot, request.remote_name, request.endpoint):
+                raise ValueError("The deletion endpoint, account or tool changed. Reread the destination.")
+            run.remote_name, run.endpoint = request.remote_name, request.endpoint
+            run.command_endpoint = "gitpane-delete-" + uuid.uuid4().hex
+            run.kind, run.selection = target.kind, target.selection
+            if target.kind == HTTPS_ENDPOINT_KIND:
+                yield from self._prepare_network(run)
+            run.arguments = self._network_arguments(run, target)
+            run.environment_by_name = dict(target.environment_by_name)
+            run.environment_by_name.update(TRANSPORT_TRACE_ENVIRONMENT_BY_NAME)
+            run.push_batches = [((request.destination_ref, ""),)]
+
+        def validated(_value: object, error: Exception | None) -> None:
+            """Observe the exact server branch before deleting any reference."""
+            try:
+                if error is not None:
+                    raise ValueError(str(error))
+                run.trace.append_event(operation.operation_id, "status", "Delete " + request.destination_ref + " on " + run.remote_name + " at " + run.endpoint)
+                self._start(run, "delete-before", ["ls-remote", "--refs", "--", run.command_endpoint, request.destination_ref])
+            except (ValueError, OSError, RuntimeError) as failure:
+                self._fail(run, str(failure), OperationStatus.REFUSED)
+        self.remote.worktree_service.run(operation.context, operation.git_filename, validate(), validated, operation_id=operation.operation_id)
+        return run
+
+    def _advance_delete(self, run: TransportRun, result: ProcessResult) -> None:
+        """Keep server refusal, known absence and local continuation results distinct."""
+        request = run.request
+        diagnostic = GitCommandError(result).diagnostic if result.status != ProcessStatus.SUCCESS else None
+        run.steps.append(OperationStepResult(run.stage, operation_status(result.status), process_status=result.status, diagnostic=diagnostic, return_code=result.return_code))
+        if run.stage == "delete-before":
+            if result.status != ProcessStatus.SUCCESS:
+                self._finish(run, operation_status(result.status), diagnostic)
+                return
+            run.before_oid = self._observed_oid_by_ref(run).get(request.destination_ref)
+            if request.source_ref.startswith(TAG_PREFIX):
+                if run.before_oid is not None and run.before_oid != request.source_oid:
+                    self._fail(run, "The server tag changed; close this result and select the observed tag again", OperationStatus.REFUSED)
+                    return
+                if not run.local_started:
+                    self._delete_tag_local(run)
+                else:
+                    self._send_ref_delete(run)
+                return
+            if run.before_oid is None:
+                self._deleted_remote(run, OperationStatus.SUCCESS, None, "already absent")
+                return
+            if request.source_ref.startswith(REMOTE_PREFIX) and run.before_oid != request.source_oid:
+                self._fail(run, "The server branch changed since this remote reference was captured; fetch and select it again", OperationStatus.REFUSED)
+                return
+            self._send_ref_delete(run)
+            return
+        if run.stage == "delete-recheck":
+            if result.status != ProcessStatus.SUCCESS:
+                self._finish(run, OperationStatus.UNKNOWN, diagnostic)
+                return
+            observed_oid = self._observed_oid_by_ref(run).get(request.destination_ref)
+            if observed_oid != run.before_oid:
+                self._fail(run, "The server tag changed during local deletion; make a fresh choice before deleting it", OperationStatus.REFUSED)
+                return
+            self._send_ref_delete(run)
+            return
+        if run.stage == "delete":
+            if not run.delete_started:
+                self._finish(run, OperationStatus.REFUSED, diagnostic)
+                return
+            run.push_status, run.push_diagnostic = result.status, diagnostic
+            self._read_porcelain(run)
+            try:
+                self._start(run, "delete-after", ["ls-remote", "--refs", "--", run.command_endpoint, request.destination_ref])
+            except (ValueError, OSError, RuntimeError) as error:
+                self._fail(run, "Deletion outcome unknown: " + str(error), OperationStatus.UNKNOWN)
+            return
+        after_oid = self._observed_oid_by_ref(run).get(request.destination_ref) if result.status == ProcessStatus.SUCCESS else None
+        if result.status != ProcessStatus.SUCCESS:
+            status, effect = OperationStatus.UNKNOWN, "inspect server state"
+        elif after_oid is None:
+            status, effect = OperationStatus.SUCCESS, "deleted"
+        elif run.push_status == ProcessStatus.FAILED and after_oid == run.before_oid:
+            status, effect = OperationStatus.FAILED, "not deleted"
+        elif run.push_status == ProcessStatus.FAILED and run.porcelain_flag_by_ref.get(request.destination_ref) == REFUSED_PORCELAIN_FLAG:
+            status, effect = OperationStatus.REFUSED, "server reference changed; deletion refused"
+        else:
+            status, effect = OperationStatus.UNKNOWN, "server ref changed; inspect before retrying"
+        self._deleted_remote(run, status, after_oid, effect, run.push_diagnostic or diagnostic)
+
+    def _delete_tag_local(self, run: TransportRun) -> None:
+        """Hold the shared owner while deleting the local tag before its server counterpart."""
+        run.local_started = True
+        run.stage = "delete-local"
+        operation = run.request.operation
+
+        def completed(outcome: OperationOutcome | None, error: Exception | None) -> None:
+            """Advance only after proven local success, using its observed reference state."""
+            if error is not None:
+                self._fail(run, str(error), OperationStatus.UNKNOWN)
+                return
+            run.steps.extend(outcome.steps)
+            if outcome.status != OperationStatus.SUCCESS:
+                self._finish(run, outcome.status, outcome.diagnostic)
+                return
+            local_step = next(step for step in outcome.steps if step.operation == DELETE_LOCAL_TAG_OPERATION)
+            run.snapshot = replace(run.snapshot, reference_state=local_step.after.signature)
+            try:
+                self._start(run, "delete-recheck", ["ls-remote", "--refs", "--", run.command_endpoint, run.request.destination_ref])
+            except (ValueError, OSError, RuntimeError) as failure:
+                self._fail(run, str(failure), OperationStatus.REFUSED)
+        self.remote.worktree_service.run(operation.context, operation.git_filename, run.delete_local(), completed, operation_id=operation.operation_id)
+
+    def _send_ref_delete(self, run: TransportRun) -> None:
+        """Delete only the explicitly observed server reference, or retain its proven absence."""
+        if run.before_oid is None:
+            self._deleted_remote(run, OperationStatus.SUCCESS, None, "already absent")
+            return
+        try:
+            # An explicit old object prevents deletion of a reference replaced after ls-remote and before the server advertisement.
+            expected_object_argument = lease_argument(run.request.destination_ref, run.before_oid)
+            self._start(run, "delete", [*PUSH_ARGUMENTS, expected_object_argument, "--", run.command_endpoint, ":" + run.request.destination_ref])
+        except (ValueError, OSError, RuntimeError) as failure:
+            self._fail(run, str(failure), OperationStatus.REFUSED)
+
+    def reconcile(self, request: TransportRequest, previous_operation_id: str, *, local_sequence: Callable[[], Generator],
+                  is_current: Callable[[], bool] | None = None) -> TransportRun:
+        """Retry only the unfinished deletion step while preserving each known success."""
+        request = self._scoped_request(request)
+        if request.source_ref.startswith(TAG_PREFIX):
+            return self.delete_remote(request, is_current=is_current, previous_operation_id=previous_operation_id)
+        operation = request.operation
+        existing = self.run_by_id.get(operation.operation_id)
+        if existing is not None:
+            return existing
+        previous = self.run_by_id.get(previous_operation_id)
+        outcome = self.outcome_by_id.get(previous_operation_id)
+        # The remote-tracking branch belongs to the server deletion, which the first attempt already finished: Git drops it
+        # then and never again. Retrying only the local branch must therefore leave it alone, or a tracking branch that a
+        # concurrent push recreated in the meantime would be deleted although its server branch exists.
+        trace = OperationTrace(operation.operation_id, self.runner, self.log, header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        run = TransportRun(request, trace, snapshot=request.snapshot, remote_name=request.remote_name, endpoint=request.endpoint, delete_local=local_sequence,
+                           delete_current=is_current, tracking_checked=True)
+        self.run_by_id[operation.operation_id] = run
+        valid = (previous is not None and outcome is not None and previous.request.mode == request.mode == "delete"
+                 and previous.request.source_ref == request.source_ref and previous.request.source_oid == request.source_oid
+                 and previous.request.destination_ref == request.destination_ref and previous.request.endpoint == request.endpoint
+                 and previous.request.remote_name == request.remote_name and previous.request.operation.context == operation.context
+                 and previous.request.delete_local_refs == request.delete_local_refs
+                 and previous.request.operation.git_filename == operation.git_filename and outcome.ref_results
+                 and all(result.status == OperationStatus.SUCCESS for result in outcome.ref_results)
+                 and any(step.operation == DELETE_LOCAL_BRANCH_OPERATION and step.status in (OperationStatus.FAILED, OperationStatus.REFUSED, OperationStatus.NOT_STARTED) for step in outcome.steps))
+        if not valid:
+            QTimer.singleShot(0, self, lambda: self._fail(run, "A fresh local deletion can resume only a known remote success with an unfinished local step", OperationStatus.REFUSED))
+            return run
+        run.ref_results.extend(outcome.ref_results)
+        run.remote_results.extend(outcome.remote_results)
+        for step in outcome.steps:
+            if step.operation == DELETE_REMOTE_BRANCH_OPERATION or step.operation == DELETE_LOCAL_BRANCH_OPERATION and step.status == OperationStatus.SUCCESS:
+                run.steps.append(step)
+        if self.closed or not self.is_current(operation) or not self.repository_operation.reserve(operation):
+            QTimer.singleShot(0, self, lambda: self._fail(run, "Local deletion cannot start while its repository is unavailable or busy", OperationStatus.REFUSED))
+            return run
+        run.trace.append_event(operation.operation_id, "status", "Remote deletion already succeeded; retrying only the local branch")
+        QTimer.singleShot(0, self, lambda: self._finish(run, OperationStatus.SUCCESS))
+        return run
+
+    def _deleted_remote(self, run: TransportRun, status: OperationStatus, after_oid: str | None, effect: str, diagnostic: PreparedDiagnostic | None = None) -> None:
+        """Record the observed server effect before deciding whether local work may begin."""
+        request = run.request
+        run.ref_results.append(PushResult(request.destination_ref, "", run.endpoint, status, run.before_oid, after_oid, effect))
+        run.remote_results.append(FetchResult(run.remote_name, run.endpoint, status, effect, diagnostic))
+        label = DELETE_REMOTE_TAG_OPERATION if request.source_ref.startswith(TAG_PREFIX) else DELETE_REMOTE_BRANCH_OPERATION
+        run.steps.append(OperationStepResult(label, status, run.before_oid, after_oid, run.push_status or ProcessStatus.SUCCESS, effect, diagnostic, full_ref=request.destination_ref))
+        self._finish(run, status, diagnostic)
+
+    def _next_push_batch(self, run: TransportRun) -> None:
+        """Observe only the next frozen batch without discovering additional tags."""
+        run.trace.append_event(run.request.operation.operation_id, "status", "Push batch " + str(run.batch_index + 1) + " of " + str(len(run.push_batches)))
+        refs = []
+        for full_ref, _oid in run.push_batches[run.batch_index]:
+            refs.append(full_ref)
+        self._start(run, "push-before", ["ls-remote", "--refs", "--", run.command_endpoint, *refs])
+
+    def _stdout(self, request: ProcessRequest, data: bytes) -> None:
+        """Retain the current sending or deletion reader's output for exact ref observation."""
+        run = self.run_by_id.get(request.operation_id)
+        if run is not None and run.request.mode in ("push", "delete") and request.request_id == run.process_id:
+            run.output.extend(data)
+
+    def _advance_push(self, run: TransportRun, result: ProcessResult) -> None:
+        """Observe the same destination after sending, including a failed native command."""
+        request = run.request
+        diagnostic = GitCommandError(result).diagnostic if result.status != ProcessStatus.SUCCESS else None
+        run.steps.append(OperationStepResult(run.stage, operation_status(result.status), process_status=result.status, diagnostic=diagnostic, return_code=result.return_code))
+        if run.stage == "push-before":
+            if result.status != ProcessStatus.SUCCESS:
+                self._finish(run, operation_status(result.status), diagnostic)
+                return
+            run.before_oid_by_ref = self._observed_oid_by_ref(run)
+            run.before_oid = run.before_oid_by_ref.get(request.destination_ref)
+            try:
+                # Force is always a force with lease, never a plain "+" refspec: a server ref is only replaced while it still
+                # holds the expected object, so commits nobody here has seen are never overwritten.
+                leases: list[str] = []
+                refspecs: list[str] = []
+                for full_ref, oid in run.push_batches[run.batch_index]:
+                    refspecs.append(oid + ":" + full_ref)
+                    if request.force:
+                        expected_oid = self._lease_expectation(run, full_ref)
+                        leases.append(lease_argument(full_ref, expected_oid))
+                        run.trace.append_event(request.operation.operation_id, "status", "Force push with lease: " + full_ref + " is replaced only if the server still has "
+                                               + (expected_oid if expected_oid else "no such reference") + ".")
+                self._start(run, "push", [*PUSH_ARGUMENTS, *leases, "--", run.command_endpoint, *refspecs])
+            except (ValueError, OSError, RuntimeError) as error:
+                self._fail(run, str(error), OperationStatus.REFUSED)
+            return
+        if run.stage == "push":
+            run.push_status = result.status
+            run.push_diagnostic = diagnostic or run.push_diagnostic
+            self._read_porcelain(run)
+            self._record_server_refusals(run)
+            try:
+                refs = []
+                for full_ref, _oid in run.push_batches[run.batch_index]:
+                    refs.append(full_ref)
+                self._start(run, "push-after", ["ls-remote", "--refs", "--", run.command_endpoint, *refs])
+            except (ValueError, OSError, RuntimeError) as error:
+                self._fail(run, "Outcome unknown. Remote observation failed: " + str(error), OperationStatus.UNKNOWN)
+            return
+        after_oid_by_ref = self._observed_oid_by_ref(run) if result.status == ProcessStatus.SUCCESS else {}
+        for full_ref, oid in run.push_batches[run.batch_index]:
+            before_oid = run.before_oid_by_ref.get(full_ref)
+            after_oid = after_oid_by_ref.get(full_ref)
+            effect = "unknown" if result.status != ProcessStatus.SUCCESS else "unchanged" if after_oid == before_oid else "changed"
+            status = OperationStatus.UNKNOWN if result.status != ProcessStatus.SUCCESS else operation_status(run.push_status)
+            if result.status == ProcessStatus.SUCCESS and after_oid == oid:
+                flag = run.porcelain_flag_by_ref.get(full_ref)
+                reported_partial = bool(request.tag_refs) and REFUSED_PORCELAIN_FLAG in run.porcelain_flag_by_ref.values()
+                status = OperationStatus.SUCCESS if run.push_status == ProcessStatus.SUCCESS or reported_partial and flag in (" ", "+", "*", "=") else OperationStatus.PARTIAL
+            elif run.push_status == ProcessStatus.SUCCESS:
+                status = OperationStatus.UNKNOWN
+            run.steps.append(OperationStepResult("Observe " + full_ref, status, before=before_oid, after=after_oid, effect=effect))
+            run.ref_results.append(PushResult(full_ref, oid, run.endpoint, status, before_oid, after_oid, effect))
+            run.trace.append_event(request.operation.operation_id, "status", full_ref + ": " + status.value + " (" + effect + ")")
+        if result.status == ProcessStatus.SUCCESS and not run.cancelled and run.push_status in (ProcessStatus.SUCCESS, ProcessStatus.FAILED) and run.batch_index + 1 < len(run.push_batches):
+            try:
+                run.batch_index += 1
+                self._next_push_batch(run)
+            except (ValueError, OSError, RuntimeError) as error:
+                self._fail(run, str(error), OperationStatus.REFUSED)
+            return
+        if not request.tag_refs and run.push_status == ProcessStatus.FAILED:
+            remote_oid = after_oid_by_ref.get(request.destination_ref, "") if result.status == ProcessStatus.SUCCESS else run.before_oid_by_ref.get(request.destination_ref, "")
+            run.rejection = self._push_rejection(run, remote_oid)
+        status = self._push_status(run, OperationStatus.SUCCESS if result.status == ProcessStatus.SUCCESS else OperationStatus.UNKNOWN)
+        effect_set = {item.effect for item in run.ref_results}
+        effect = "unknown" if "unknown" in effect_set else "changed" if "changed" in effect_set else "unchanged"
+        run.remote_results.append(FetchResult(run.remote_name, run.endpoint, status, effect, run.push_diagnostic or diagnostic))
+        operation = request.operation
+
+        def reconcile() -> Generator:
+            """Read the repository's remotes again once the exact remote commit is observed, and update its remote-tracking branches."""
+            snapshot = yield from self.remote.capture(operation.context, operation.git_filename, operation.generation)
+            if not self.closed and not run.cancelled and (yield from self._update_remote_tracking(run, snapshot)):
+                snapshot = yield from self._read_tracking_result(run, snapshot)
+            if request.add_tracking and not self.closed and not run.cancelled:
+                snapshot = yield from self._link_upstream(run, snapshot)
+            return snapshot
+
+        def reread(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Keep the common owner until the local configuration and refs have been read."""
+            if error is not None:
+                self._fail(run, "Push finished but the local state could not be reread: " + str(error), OperationStatus.UNKNOWN)
+                return
+            self._finish(run, status, run.push_diagnostic or diagnostic, snapshot)
+
+        self.remote.worktree_service.run(operation.context, operation.git_filename, reconcile(), reread,
+                                        operation_id=operation.operation_id)
+
+    def _lease_expectation(self, run: TransportRun, full_ref: str) -> str:
+        """Return the object a forced ref must still hold on the server, or "" when it must not exist.
+
+        A branch expects its remote-tracking branch, the last fetched state, exactly like Git's own --force-with-lease; with
+        no remote-tracking branch it expects the branch to be absent. A tag has no remote-tracking reference, so it expects
+        the server tag observed just before sending.
+        """
+        if full_ref.startswith(TAG_PREFIX):
+            return run.before_oid_by_ref.get(full_ref, "")
+        tracking_ref = remote_tracking_ref(run.snapshot, run.request.remote_name, full_ref)
+        return remote_reference_oid(run.snapshot, tracking_ref) if tracking_ref else ""
+
+    def _push_rejection(self, run: TransportRun, remote_oid: str) -> PushRejection | None:
+        """Recognize a branch refused because the server holds commits the push would replace, and compare it with the last Fetch."""
+        destination_ref = run.request.destination_ref
+        if run.porcelain_flag_by_ref.get(destination_ref) != REFUSED_PORCELAIN_FLAG:
+            return None
+        summary = run.porcelain_summary_by_ref.get(destination_ref, "")
+        reason = ""
+        for candidate in PUSH_REJECTION_REASONS:
+            if "(" + candidate + ")" in summary:
+                reason = candidate
+        if not reason:
+            return None
+        tracking_ref = remote_tracking_ref(run.snapshot, run.request.remote_name, destination_ref)
+        tracking_oid = remote_reference_oid(run.snapshot, tracking_ref) if tracking_ref else ""
+        unseen_commits = not tracking_ref or remote_oid != tracking_oid
+        return PushRejection(run.request.remote_name, destination_ref, reason, remote_oid, tracking_ref, tracking_oid, unseen_commits)
+
+    def _record_server_refusals(self, run: TransportRun) -> None:
+        """Keep each reference of the batch just sent that the server itself refused, so a failure can say which and why.
+
+        The batch's own order is used, not the order of Git's output. A refusal because the server holds other commits
+        is not one of them: Git reports it locally, before the server sees the reference.
+        """
+        for full_ref, _oid in run.push_batches[run.batch_index]:
+            if run.porcelain_flag_by_ref.get(full_ref) != REFUSED_PORCELAIN_FLAG:
+                continue
+            summary = run.porcelain_summary_by_ref.get(full_ref, "")
+            if not summary.startswith(SERVER_REFUSAL_SUMMARY_PREFIX):
+                continue
+            match = SERVER_REFUSAL_REASON_PATTERN.search(summary)
+            run.server_refusals.append(ServerRefusal(full_ref, match.group("reason") if match is not None else ""))
+
+    def _update_remote_tracking(self, run: TransportRun, snapshot: RemoteSnapshot) -> Generator:
+        """Move the remote-tracking branch of each verified pushed branch to the pushed commit, as `git push <remote>` does.
+
+        GitPane pushes to a private alias of the remote's URL, so Git cannot do it on its own and the graph marker would
+        only move after the next Fetch. No network is used: the new position is the commit the server was just observed
+        to hold. Returns whether a reference changed.
+        """
+        changed = False
+        for result in run.ref_results:
+            if result.status != OperationStatus.SUCCESS or result.after_oid != result.source_oid:
+                continue
+            tracking_ref = remote_tracking_ref(snapshot, run.request.remote_name, result.full_ref)
+            old_oid = remote_reference_oid(snapshot, tracking_ref) if tracking_ref else ""
+            if not tracking_ref or old_oid == result.after_oid:
+                continue
+            absent_oid = "0" * len(result.after_oid)
+            arguments = ["update-ref", "--no-deref", "-m", TRACKING_REFLOG_MESSAGE, tracking_ref, result.after_oid, old_oid or absent_oid]
+            changed = (yield from self._write_tracking(run, TRACKING_UPDATE_OPERATION, tracking_ref, old_oid, result.after_oid, arguments)) or changed
+        return changed
+
+    def _link_upstream(self, run: TransportRun, snapshot: RemoteSnapshot) -> Generator:
+        """Make the pushed local branch follow the remote branch the server was just observed holding it on, on the configured remote.
+
+        It runs after the remote-tracking branch of that destination was moved, since Git only links a branch to a
+        remote-tracking branch that exists. The full remote-tracking name and the "--" before the branch keep a short
+        name that is ambiguous, or one that reads as an option, from linking anything else. An upstream already present
+        when the repository is read again after the Push is kept as it is; one that another tool writes between that
+        read and `git branch` is replaced, since Git cannot write a setting only while it is still unset. Once Git
+        answers, the repository is read again and the link is only said set when Git resolves exactly the asked
+        remote-tracking branch: Git can answer 0 and still resolve another upstream, for instance when
+        branch.<name>.remote has several values. Whatever happens here, the Push keeps its own result: a link that is
+        not set is a failed or unknown step and a red console line, never a failed Push. Returns the capture the rest of
+        the Push goes on with.
+        """
+        request = run.request
+        operation_id = request.operation.operation_id
+        verified = False
+        for result in run.ref_results:
+            if result.full_ref == request.destination_ref and result.status == OperationStatus.SUCCESS and result.after_oid == result.source_oid:
+                verified = True
+        if not verified or not request.source_ref.startswith(LOCAL_PREFIX):
+            return snapshot
+        branch_name = request.source_ref.removeprefix(LOCAL_PREFIX)
+        if tracking_values(snapshot, request.source_ref, MERGE_TRACKING_FIELD):
+            run.steps.append(OperationStepResult(SharedText.UPSTREAM_LINK_STEP.value, OperationStatus.NOT_STARTED, effect="upstream already set", full_ref=request.source_ref))
+            run.trace.append_event(operation_id, "status", SharedText.UPSTREAM_KEPT.value.format(branch=branch_name))
+            return snapshot
+        tracking_ref = remote_tracking_ref(snapshot, request.remote_name, request.destination_ref)
+        if not tracking_ref:
+            tracking_name = request.remote_name + "/" + request.destination_ref.removeprefix(LOCAL_PREFIX)
+            cause = SharedText.UPSTREAM_NO_TRACKING_BRANCH.value.format(remote=request.remote_name, destination=request.destination_ref.removeprefix(LOCAL_PREFIX))
+            self._report_not_linked(run, OperationStatus.FAILED, branch_name, tracking_name, cause)
+            return snapshot
+        tracking_name = tracking_ref.removeprefix(REMOTE_PREFIX)
+        cause = self._link_refusal(run)
+        if cause:
+            self._report_not_linked(run, OperationStatus.FAILED, branch_name, tracking_name, cause)
+            return snapshot
+
+        def check_link() -> None:
+            """Refuse the link at its launch when the configuration may no longer change, judged right before Git writes it."""
+            refusal = self._link_refusal(run)
+            if refusal:
+                raise ValueError(refusal)
+
+        try:
+            yield GitCommand([*SUBMODULE_RECURSION_OFF_ARGUMENTS, "branch", "--set-upstream-to=" + tracking_ref, "--", branch_name], profile=LOCAL_WRITE_PROFILE,
+                             timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS, before_start=check_link)
+        except GitCommandError as error:
+            self._report_not_linked(run, OperationStatus.FAILED, branch_name, tracking_name, error.diagnostic.cause, error.diagnostic)
+            return snapshot
+        operation = request.operation
+        try:
+            linked_snapshot = yield from self.remote.capture(operation.context, operation.git_filename, operation.generation)
+        except (ValueError, OSError, RuntimeError, GitCommandError) as error:
+            self._report_not_linked(run, OperationStatus.UNKNOWN, branch_name, tracking_name, SharedText.UPSTREAM_UNREAD.value.format(cause=str(error)))
+            return snapshot
+        tracking = linked_snapshot.tracking_by_ref.get(request.source_ref)
+        upstream = tracking.upstream if tracking is not None else ""
+        if not upstream:
+            self._report_not_linked(run, OperationStatus.UNKNOWN, branch_name, tracking_name, SharedText.UPSTREAM_NO_UPSTREAM.value)
+            return linked_snapshot
+        if upstream != tracking_ref:
+            self._report_not_linked(run, OperationStatus.UNKNOWN, branch_name, tracking_name, SharedText.UPSTREAM_OTHER_UPSTREAM.value.format(upstream=upstream.removeprefix(REMOTE_PREFIX)))
+            return linked_snapshot
+        run.steps.append(OperationStepResult(SharedText.UPSTREAM_LINK_STEP.value, OperationStatus.SUCCESS, after=tracking_ref, effect="linked", full_ref=request.source_ref))
+        run.trace.append_event(operation_id, "status", SharedText.UPSTREAM_LINKED.value.format(branch=branch_name, tracking=tracking_name))
+        return linked_snapshot
+
+    def _link_refusal(self, run: TransportRun) -> str:
+        """Say why the repository's write rules refuse the link as a configuration write, or "" when they allow it.
+
+        The link writes branch.<name>.* into the configuration every worktree of the repository shares, so it follows
+        the rules of a configuration write, for instance no change while a linked worktree has a paused rebase. The
+        Push itself keeps its own action: those rules only judge this one step, so a refused link never stops the Push.
+        """
+        return self.repository_operation.policy_diagnostic(replace(run.request.operation, action=OperationAction.CONFIG_WRITE))
+
+    def _report_not_linked(self, run: TransportRun, status: OperationStatus, branch_name: str, tracking_name: str, cause: str, diagnostic: PreparedDiagnostic | None = None) -> None:
+        """Record a link asked for after a successful Push that is not set, say why in red, and keep the Push's console open for it."""
+        request = run.request
+        run.steps.append(OperationStepResult(SharedText.UPSTREAM_LINK_STEP.value, status, effect="not linked", diagnostic=diagnostic, full_ref=request.source_ref))
+        run.trace.append_event(request.operation.operation_id, "status", SharedText.UPSTREAM_NOT_LINKED.value.format(branch=branch_name, tracking=tracking_name, cause=cause), tone=ConsoleTone.FAILURE)
+        run.upstream_not_linked = True
+
+    def _read_tracking_result(self, run: TransportRun, snapshot: RemoteSnapshot) -> Generator:
+        """Observe the branches a remote-tracking update just moved, with one Git read instead of a second complete capture.
+
+        Configuration and reference signatures are taken before and after that read and must not move: only then do
+        the objects and upstreams Git reports replace the ones of ``snapshot``, whose configuration is still exact.
+        Anything else, a change during the read or an answer that cannot be parsed, leads to a complete capture, whose
+        own failure leaves the result unknown rather than a local success nobody observed.
+        """
+        context = snapshot.context
+        before = yield FileTask(lambda: (config_signature(context, snapshot.values), reference_signature(context)))
+        output = yield GitCommand(["for-each-ref", TRACKING_RESULT_FORMAT, LOCAL_PREFIX, REMOTE_PREFIX], profile=READ_PROFILE)
+        after = yield FileTask(lambda: (config_signature(context, snapshot.values), reference_signature(context)))
+        config_before, reference_before = before
+        config_after, reference_after = after
+        observed = None
+        if config_before == config_after == snapshot.signature and reference_before == reference_after:
+            observed = self._tracking_observation(snapshot, output, reference_after)
+        if observed is not None:
+            return observed
+        operation = run.request.operation
+        run.trace.append_event(operation.operation_id, "status", "Local branches changed while being read; reading every remote setting again.")
+        return (yield from self.remote.capture(operation.context, operation.git_filename, operation.generation))
+
+    def _tracking_observation(self, snapshot: RemoteSnapshot, output: bytes, reference_state: tuple) -> RemoteSnapshot | None:
+        """Rebuild the branch part of a capture from one complete reference read, or nothing when the read does not match it.
+
+        The local branches must be exactly the captured ones, with the same objects and upstreams: only remote-tracking
+        branches may have moved, and whether an upstream exists is computed again from the references Git reported.
+        """
+        remote_records: list[bytes] = []
+        local_by_ref: dict[str, tuple[str, str]] = {}
+        observed_ref_set: set[str] = set()
+        for record in output.splitlines():
+            fields = record.split(b"\0")
+            if len(fields) != TRACKING_RESULT_FIELD_COUNT:
+                return None
+            raw_name, oid, symref, upstream = fields
+            name = raw_name.decode("utf-8", "surrogateescape")
+            if name in observed_ref_set:
+                return None
+            observed_ref_set.add(name)
+            if name.startswith(REMOTE_PREFIX):
+                remote_records.append(raw_name + b"\0" + oid + b"\0" + symref + b"\n")
+            elif name.startswith(LOCAL_PREFIX):
+                local_by_ref[name] = (oid.decode("ascii", "replace"), upstream.decode("utf-8", "surrogateescape"))
+            else:
+                return None
+        if set(local_by_ref) != set(snapshot.tracking_by_ref):
+            return None
+        tracking_by_ref = {}
+        for full_ref, tracking in snapshot.tracking_by_ref.items():
+            if local_by_ref[full_ref] != (tracking.oid, tracking.upstream):
+                return None
+            tracking_by_ref[full_ref] = replace(tracking, observed=bool(tracking.upstream) and tracking.upstream in observed_ref_set)
+        # This read does not observe HEAD, so the rebuilt capture claims no HEAD rather than the older capture's one.
+        return replace(snapshot, references=b"".join(remote_records), tracking_by_ref=tracking_by_ref, reference_state=reference_state, head_oid=None, head_ref=None)
+
+    def _write_tracking(self, run: TransportRun, label: str, tracking_ref: str, old_oid: str, new_oid: str, arguments: list[str]) -> Generator:
+        """Write one remote-tracking branch with its old value checked under Git's reference lock, and record the step.
+
+        A tracking branch changed by someone else in the meantime is left alone: the step reports it and the transport
+        result itself is unchanged, since the server effect was already verified. Returns whether the write succeeded.
+        """
+        operation_id = run.request.operation.operation_id
+        try:
+            yield GitCommand(arguments, profile=LOCAL_WRITE_PROFILE, timeout_ms=GIT_MUTATION_TIMEOUT_MS, idle_timeout_ms=GIT_MUTATION_TIMEOUT_MS)
+        except GitCommandError as error:
+            run.steps.append(OperationStepResult(label, OperationStatus.FAILED, before=old_oid or None, after=new_oid or None, effect="left unchanged", diagnostic=error.diagnostic, full_ref=tracking_ref))
+            run.trace.append_event(operation_id, "status", tracking_ref + ": not updated (" + error.diagnostic.cause + ")")
+            return False
+        run.steps.append(OperationStepResult(label, OperationStatus.SUCCESS, before=old_oid or None, after=new_oid or None, effect="changed", full_ref=tracking_ref))
+        run.trace.append_event(operation_id, "status", tracking_ref + ": " + (new_oid if new_oid else "deleted"))
+        return True
+
+    def _read_porcelain(self, run: TransportRun) -> None:
+        """Read native per-ref status, including the '(delete)' source used for deletion."""
+        run.porcelain_flag_by_ref.clear()
+        run.porcelain_summary_by_ref.clear()
+        field_count = 3
+        for record in bytes(run.output).splitlines():
+            fields = record.split(b"\t")
+            if len(fields) != field_count:
+                continue
+            flag, mapping, summary = fields
+            _source, separator, full_ref = mapping.partition(b":")
+            if separator:
+                name = full_ref.decode("utf-8", "surrogateescape")
+                run.porcelain_flag_by_ref[name] = flag.decode("ascii", "replace")
+                run.porcelain_summary_by_ref[name] = summary.decode("utf-8", "replace")
+
+    def _observed_oid_by_ref(self, run: TransportRun) -> dict[str, str]:
+        """Match complete destination refs independently of server output order and glob matching."""
+        oid_by_ref = {}
+        selected_ref_set = set(dict(run.push_batches[run.batch_index]))
+        for record in bytes(run.output).splitlines():
+            oid, separator, full_ref = record.partition(b"\t")
+            name = full_ref.decode("utf-8", "surrogateescape")
+            if separator and name in selected_ref_set:
+                oid_by_ref[name] = oid.decode("ascii")
+        return oid_by_ref
+
+    def _push_status(self, run: TransportRun, fallback: OperationStatus) -> OperationStatus:
+        """Keep incomplete batches and failures visible while preserving observed successes."""
+        status_set = {result.status for result in run.ref_results}
+        if OperationStatus.UNKNOWN in status_set or fallback == OperationStatus.UNKNOWN:
+            return OperationStatus.UNKNOWN
+        if OperationStatus.PARTIAL in status_set or OperationStatus.SUCCESS in status_set and (status_set != {OperationStatus.SUCCESS} or fallback != OperationStatus.SUCCESS):
+            return OperationStatus.PARTIAL
+        if status_set and status_set != {OperationStatus.SUCCESS}:
+            return next(iter(status_set)) if len(status_set) == 1 else OperationStatus.FAILED
+        return fallback
+
+    def fetch(self, request: TransportRequest) -> TransportRun:
+        """Freeze the requested remotes and retain their shared owner until every reread ends."""
+        request = self._scoped_request(request)
+        operation = request.operation
+        previous = self.run_by_id.get(operation.operation_id)
+        if previous is not None:
+            return previous
+        trace = OperationTrace(operation.operation_id, self.runner, self.log, header=ConsoleHeader(REPOSITORY_HEADER_LABEL, operation.context.repository_dir))
+        run = TransportRun(request, trace, helper_override=self.authentication.helper_commands)
+        self.run_by_id[operation.operation_id] = run
+        if self.closed or not self.is_current(operation) or not self.repository_operation.reserve(operation):
+            cause = self._reservation_refusal(operation)
+            QTimer.singleShot(0, self, lambda: self._fail(run, cause, OperationStatus.REFUSED))
+            return run
+        if request.snapshot is not None:
+            QTimer.singleShot(0, self, lambda: self._prepared(run, request.snapshot, None))
+            return run
+        self.remote.worktree_service.run(operation.context, operation.git_filename,
+                                        self.remote.capture(operation.context, operation.git_filename, operation.generation),
+                                        lambda snapshot, error: self._prepared(run, snapshot, error), operation_id=operation.operation_id)
+        return run
+
+    def cancel(self, operation_id: str) -> None:
+        """Stop network work while retaining ownership through actual exit and rereading."""
+        run = self.run_by_id.get(operation_id)
+        if run is None or operation_id in self.outcome_by_id:
+            return
+        run.cancelled = True
+        if run.process_id:
+            self.runner.cancel(run.process_id)
+        if run.retry_waiting:
+            QTimer.singleShot(0, self, lambda: self._start_again(run, run.stage, run.launch_arguments))
+        if run.stage == "delete-local":
+            for active in tuple(self.runner.active_by_id.values()):
+                if active.request.operation_id == operation_id:
+                    self.runner.cancel(active.request.request_id)
+            for request in tuple(self.runner.pending_requests):
+                if request.operation_id == operation_id:
+                    self.runner.cancel(request.request_id)
+
+    def close(self) -> None:
+        """Stop owned work and release temporary output only after its processes drain."""
+        self.closed = True
+        for operation_id, run in tuple(self.run_by_id.items()):
+            self.cancel(operation_id)
+            if operation_id in self.outcome_by_id:
+                run.trace.close()
+
+    def _prepared(self, run: TransportRun, snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+        """Freeze the resolved endpoint and account before launching any network process."""
+        if error is not None:
+            self._fail(run, str(error))
+            return
+        try:
+            operation = run.request.operation
+            run.snapshot = run.first_snapshot = snapshot
+            self._check_current(run)
+            if snapshot.context != operation.context or snapshot.git_filename != operation.git_filename or snapshot.generation != operation.generation:
+                raise ValueError("The Fetch selection belongs to an older repository view. Open the menu again.")
+            targets: list[FetchTarget] = []
+            for name in sorted(snapshot.entry_by_name):
+                entry = snapshot.entry_by_name[name]
+                if not entry.active:
+                    run.trace.append_event(operation.operation_id, "status", name + ": skipped (inactive)")
+                    continue
+                if not run.request.prune_all and name != run.request.remote_name:
+                    continue
+                if run.request.prune_all and remote_boolean(snapshot, name, "skipdefaultupdate", aliases=("skipfetchall",)):
+                    run.trace.append_event(operation.operation_id, "status", name + ": skipped (last skipDefaultUpdate/skipFetchAll value is true)")
+                    continue
+                targets.append(self._capture_target(run, name))
+            run.targets = tuple(targets)
+            if not targets:
+                raise ValueError("No active remotes are selected for Fetch. Use Manage remotes to configure a destination or review skipDefaultUpdate/skipFetchAll.")
+            refs = list(operation.scope.refs)
+            for target in targets:
+                refspecs = target.refspecs if not target.error else tuple(value.value for value in field_values(snapshot, target.remote_name, "fetch"))
+                refs.extend(refspec_write_refs(refspecs))
+            scoped = replace(operation, scope=WriteScope.capture(operation.context, tuple(sorted(set(refs)))))
+            if not self.repository_operation.extend(scoped):
+                if self.repository_operation.closed:
+                    raise ValueError(GITPANE_CLOSING_TEXT)
+                raise ValueError(self.repository_operation.policy_diagnostic(scoped) or "The Fetch references are no longer available for writing.")
+            run.request = replace(run.request, operation=scoped)
+            run.trace.append_event(operation.operation_id, "status", "Captured remotes: " + ", ".join(target.remote_name for target in targets))
+            self._next_remote(run)
+        except (ValueError, OSError, RuntimeError) as failure:
+            self._fail(run, str(failure), OperationStatus.CANCELLED if run.cancelled else OperationStatus.FAILED)
+
+    def _capture_target(self, run: TransportRun, name: str) -> FetchTarget:
+        """Prepare every target now while retaining an invalid target's own later refusal."""
+        snapshot = run.snapshot
+        endpoint = ""
+        try:
+            entry = snapshot.entry_by_name[name]
+            if entry.collision or len(entry.fetch_urls) != 1:
+                raise ValueError("Remote " + name + " needs one unambiguous Fetch URL.")
+            endpoint, = entry.fetch_urls
+            if rewrite_url(endpoint, snapshot.values) != endpoint:
+                raise ValueError("The Fetch URL has chained rewrite rules. Configure an unambiguous destination before fetching.")
+            refspecs = fetch_branch_refspecs(snapshot, name)
+            if len(refspecs) != len(field_values(snapshot, name, "fetch")):
+                run.trace.append_event(run.request.operation.operation_id, "status", name + ": tag Fetch refspecs excluded; local tags are preserved.")
+            kind = endpoint_kind(endpoint, self.allow_local_endpoint)
+            command_endpoint, arguments, environment_by_name, selection = endpoint, [], {}, None
+            if kind == HTTPS_ENDPOINT_KIND:
+                # A preview with every helper disabled: the helper itself is checked once, just before the first HTTPS Fetch.
+                selection = self.authentication.account_for_endpoint(endpoint, snapshot.context)
+                command_endpoint, arguments = self.authentication.command_configuration(endpoint, snapshot.context, selection=selection, helper_commands=PREVIEW_HELPER_COMMANDS)
+                arguments.extend(isolated_http_arguments(command_endpoint))
+            elif kind == SSH_ENDPOINT_KIND:
+                arguments, environment_by_name = self.ssh.command_configuration()
+            return FetchTarget(name, endpoint, command_endpoint, refspecs, tuple(arguments), environment_by_name, selection, kind)
+        except (ValueError, OSError, RuntimeError) as error:
+            return FetchTarget(name, endpoint, error=str(error))
+
+    def _next_remote(self, run: TransportRun) -> None:
+        """Start exactly the next frozen remote after the preceding effects have been observed.
+
+        A credential manager refusal ends only the HTTPS remotes of the Fetch, each on its own red line, without a second
+        search; SSH and local remotes are still fetched, and the Fetch ends failed, or partial when another remote was
+        fetched.
+        """
+        try:
+            self._check_current(run)
+            if run.target_index == len(run.targets):
+                if run.helper_refusal:
+                    self._finish(run, OperationStatus.FAILED, self._cause_diagnostic(run, run.helper_refusal), run.snapshot)
+                    return
+                self._finish(run, OperationStatus.SUCCESS, snapshot=run.snapshot)
+                return
+            target = run.targets[run.target_index]
+            run.remote_name, run.endpoint, run.command_endpoint = target.remote_name, target.endpoint, target.command_endpoint
+            run.arguments, run.environment_by_name = [], {**target.environment_by_name, **TRANSPORT_TRACE_ENVIRONMENT_BY_NAME}
+            run.selection, run.kind = target.selection, target.kind
+            if target.error:
+                raise ValueError(target.error)
+            operation = run.request.operation
+            run.trace.append_event(operation.operation_id, "status", "Fetching remote " + run.remote_name)
+            if target.kind == HTTPS_ENDPOINT_KIND and run.helper_refusal:
+                self._refuse_remote(run, target)
+                return
+
+            def launch(_value: object, failure: Exception | None) -> None:
+                """Start the captured endpoint, after the credential manager search when this remote is the first HTTPS one."""
+                try:
+                    if failure is not None and run.helper_refusal:
+                        self._refuse_remote(run, target)
+                        return
+                    if failure is not None:
+                        raise ValueError(str(failure))
+                    # The mappings already stay inside the remote's namespace; their syntax is Git's to judge, and the
+                    # native fetch refuses an invalid one itself before contacting the server or writing anything.
+                    run.arguments = self._network_arguments(run, target)
+                    self._start(run, "fetch", ["-c", "fetch.pruneTags=false", "fetch", "--progress", "--prune" if run.request.prune_all else "--no-prune", "--no-tags", "--no-prune-tags",
+                                               "--no-recurse-submodules", "--refmap=", "--", run.command_endpoint, *target.refspecs])
+                except (OSError, ValueError, RuntimeError) as launch_error:
+                    self._fail(run, str(launch_error), OperationStatus.CANCELLED if run.cancelled else OperationStatus.FAILED)
+
+            if target.kind == HTTPS_ENDPOINT_KIND and run.verified_helper_commands is None:
+                self.remote.worktree_service.run(operation.context, operation.git_filename, self._prepare_network(run), launch, operation_id=operation.operation_id)
+                return
+            launch(None, None)
+        except (ValueError, OSError, RuntimeError) as failure:
+            self._fail(run, str(failure), OperationStatus.CANCELLED if run.cancelled else OperationStatus.FAILED)
+
+    def _refuse_remote(self, run: TransportRun, target: FetchTarget) -> None:
+        """End one HTTPS remote of a Fetch on the credential manager refusal without stopping the other remotes.
+
+        An SSH or local remote never depends on the credential manager, so the Fetch goes on with the next remote. No
+        process ran for the refused remote, so nothing changed for it. The refused remote's red line reads as a refusal
+        before launch, as for Push; its result stays failed.
+        """
+        operation = run.request.operation
+        diagnostic = self._cause_diagnostic(run, run.helper_refusal)
+        run.trace.append_diagnostic(operation.operation_id, "error", diagnostic, OperationStatus.REFUSED)
+        run.remote_results.append(FetchResult(target.remote_name, target.endpoint, OperationStatus.FAILED, "unchanged", diagnostic))
+        run.trace.append_event(operation.operation_id, "status", target.remote_name + ": " + OperationStatus.FAILED.value)
+        run.target_index += 1
+        self._next_remote(run)
+
+    def _reservation_refusal(self, operation: OperationIntent) -> str:
+        """Say why a transport could not reserve its repository, naming a running operation only when one really holds it.
+
+        A window refreshed after the request was captured, for instance, gets that reason rather than a guess between
+        the two.
+        """
+        if self.closed:
+            return TRANSPORT_CLOSED_TEXT
+        return self.repository_operation.refusal_cause(operation)
+
+    def _check_current(self, run: TransportRun) -> None:
+        """Reject queued work when authority or the captured config source changes."""
+        self.repository_operation.validate(run.request.operation)
+        if run.cancelled or self.closed or not self.is_current(run.request.operation):
+            raise ValueError("The transport was cancelled or its repository session is no longer current.")
+        if run.delete_current is not None and not run.delete_current():
+            raise ValueError("The deletion form or its captured local branch is no longer current.")
+        if run.snapshot is not None and config_signature(run.snapshot.context, run.snapshot.values) != run.snapshot.signature:
+            raise ValueError("Remote configuration changed. Reread the destination before sending.")
+        if run.snapshot is not None:
+            current_state = reference_signature(run.snapshot.context)
+            if run.request.tag_refs:
+                # Newly created loose tags must not join or interrupt the frozen selection.
+                # Existing records remain byte-for-byte checked, including packed refs.
+                captured_filename_set = set()
+                for filename, *_metadata in run.snapshot.reference_state:
+                    captured_filename_set.add(filename)
+                for full_ref, _oid in run.request.tag_refs:
+                    captured_filename_set.add(os.path.join(run.snapshot.context.common_git_dir, *full_ref.split("/")))
+                tag_dir = os.path.join(run.snapshot.context.common_git_dir, "refs", "tags") + os.sep
+                retained_records = []
+                for record in current_state:
+                    filename, *_metadata = record
+                    if filename in captured_filename_set or not filename.startswith(tag_dir):
+                        retained_records.append(record)
+                current_state = tuple(retained_records)
+            if current_state != run.snapshot.reference_state:
+                raise ValueError("Repository references changed. Reread before sending.")
+        if run.request.mode in ("push", "delete") and run.request.push_target is not None:
+            target = self.capture_push_target(run.snapshot, run.request.remote_name, run.request.endpoint)
+            if target != run.request.push_target:
+                raise ValueError("The Push account or tool changed. Reread destination before sending.")
+        target = self._network_target(run)
+        if target is not None and target.kind == HTTPS_ENDPOINT_KIND:
+            self._check_https_launch(run, target)
+
+    def _start(self, run: TransportRun, stage: str, arguments: list[str], *, retry: bool = False) -> None:
+        """Attach the existing supervised SSH bridge to each separately identified process.
+
+        Every start, a retry included, runs the capture checks first and again just before Git starts. A ``retry`` keeps
+        the count of the step's retries; any other start begins a new step.
+        """
+        if run.kind == HTTPS_ENDPOINT_KIND and not run.verified_helper_commands:
+            raise ValueError(CREDENTIAL_MANAGER_NOT_SEARCHED_TEXT)
+        check = self._check_observation if stage in OBSERVATION_STAGE_SET else self._check_current
+        check(run)
+        operation = run.request.operation
+        run.stage = stage
+        run.launch_arguments = list(arguments)
+        if not retry:
+            run.credential_read_retry_count = 0
+        run.output.clear()
+        run.process_id = uuid.uuid4().hex
+
+        def validate_launch() -> None:
+            """Record that native deletion could start only after all capture checks pass."""
+            check(run)
+            if stage == "delete":
+                run.delete_started = True
+        request = ProcessRequest(run.process_id, operation.git_filename, [*run.arguments, *arguments], operation.context.repository_dir,
+                                 GIT_TRANSPORT_TIMEOUT_MS, session_id=operation.session_id or operation.operation_id,
+                                 idle_timeout_ms=TRANSPORT_IDLE_TIMEOUT_MS, environment_by_name=run.environment_by_name,
+                                 operation=(DELETE_REMOTE_TAG_OPERATION if run.request.source_ref.startswith(TAG_PREFIX) else DELETE_REMOTE_BRANCH_OPERATION) if run.request.mode == "delete" else "Push" if run.request.mode == "push" else "Fetch",
+                                 profile=NETWORK_PROFILE, operation_id=operation.operation_id,
+                                 before_start=validate_launch)
+        if run.kind == SSH_ENDPOINT_KIND:
+            request = self.ssh.prompt(request, context=operation.context, generation=operation.generation,
+                                      is_current=lambda: not run.cancelled and self.is_current(operation))
+        self.runner.start(request)
+
+    def _check_observation(self, run: TransportRun) -> None:
+        """Permit post-send reads after closure only while their frozen routing stays exact."""
+        if run.snapshot is None or config_signature(run.snapshot.context, run.snapshot.values) != run.snapshot.signature:
+            raise ValueError("Remote configuration changed after Push. The original endpoint could not be verified.")
+
+    def _process_finished(self, result: ProcessResult) -> None:
+        """Let the trace flush its final fragments before interpreting the native result."""
+        run = self.run_by_id.get(result.request.operation_id)
+        if run is not None and run.process_id == result.request.request_id:
+            run.process_id = ""
+            QTimer.singleShot(0, self, lambda: self._advance(run, result))
+
+    def _advance(self, run: TransportRun, result: ProcessResult) -> None:
+        """Retain the network outcome, including a failure, and reread the local references before the next remote.
+
+        A step that failed only because the credential manager could not read back a secret is started again first, and
+        that attempt is never interpreted as the step's result.
+        """
+        if self._retry_after_credential_read_failure(run, result):
+            return
+        if run.request.mode == "push":
+            self._advance_push(run, result)
+            return
+        if run.request.mode == "delete":
+            self._advance_delete(run, result)
+            return
+        diagnostic = None
+        if result.status != ProcessStatus.SUCCESS:
+            diagnostic = GitCommandError(result).diagnostic
+        run.steps.append(OperationStepResult(run.remote_name + ": " + run.stage, operation_status(result.status), process_status=result.status, diagnostic=diagnostic, return_code=result.return_code))
+        operation = run.request.operation
+        run.stage = "rereading"
+
+        def reread(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Publish observed local refs even when the network command was interrupted."""
+            if error is not None:
+                self._fail(run, "Fetch finished, but its references could not be reread: " + str(error), OperationStatus.UNKNOWN)
+                return
+            if not self._compatible_reread(run.snapshot, snapshot):
+                self._fail(run, "Remote configuration changed during Fetch; review the observed references.", OperationStatus.UNKNOWN, snapshot)
+                return
+            effect = "changed" if run.snapshot.references != snapshot.references else "unchanged"
+            run.steps.append(OperationStepResult(run.remote_name + ": Reread references", OperationStatus.SUCCESS, before=run.snapshot.references, after=snapshot.references, effect=effect))
+            status = OperationStatus.PARTIAL if result.status == ProcessStatus.FAILED and effect == "changed" else operation_status(result.status)
+            run.remote_results.append(FetchResult(run.remote_name, run.endpoint, status, effect, diagnostic))
+            run.trace.append_event(operation.operation_id, "status", run.remote_name + ": " + status.value + " (" + ("up to date" if effect == "unchanged" else "references changed") + ")")
+            run.snapshot = snapshot
+            run.target_index += 1
+            if status != OperationStatus.SUCCESS or run.cancelled:
+                self._finish(run, OperationStatus.CANCELLED if run.cancelled else status, diagnostic, snapshot)
+                return
+            self._next_remote(run)
+
+        self.remote.worktree_service.run(operation.context, operation.git_filename,
+                                        self.remote.capture(operation.context, operation.git_filename, operation.generation), reread, operation_id=operation.operation_id)
+
+    def _retry_after_credential_read_failure(self, run: TransportRun, result: ProcessResult) -> bool:
+        """Start the failed step again after a pause when its secret read failed and the step is safe to repeat; tell whether it will.
+
+        The console and the ``--log`` file say each retry; the failed attempt keeps its output there. The pause is a
+        single-shot timer, so the window never waits.
+        """
+        if run.cancelled or self.closed or run.stage not in CREDENTIAL_READ_RETRY_STAGE_SET:
+            return False
+        if not credential_read_retry_due(result, run.credential_read_retry_count):
+            return False
+        run.credential_read_retry_count += 1
+        run.retry_waiting = True
+        run.trace.append_event(run.request.operation.operation_id, "status", credential_read_retry_text(run.credential_read_retry_count))
+        stage, arguments = run.stage, run.launch_arguments
+        QTimer.singleShot(CREDENTIAL_READ_RETRY_DELAY_MS, self, lambda: self._start_again(run, stage, arguments))
+        return True
+
+    def _start_again(self, run: TransportRun, stage: str, arguments: list[str]) -> None:
+        """Start a step again once its pause is over, or end the operation when it was cancelled or GitPane is closing meanwhile.
+
+        Whichever comes first, the end of the pause or the cancel, decides; the other does nothing. A cancelled step that
+        only read the server after a send leaves the send's result unknown.
+        """
+        if not run.retry_waiting:
+            return
+        run.retry_waiting = False
+        if run.cancelled or self.closed:
+            self._fail(run, SharedText.CREDENTIAL_READ_RETRY_CANCELLED.value, OperationStatus.UNKNOWN if stage in OBSERVATION_STAGE_SET else OperationStatus.CANCELLED)
+            return
+        try:
+            self._start(run, stage, arguments, retry=True)
+        except (ValueError, OSError, RuntimeError) as failure:
+            if stage in OBSERVATION_STAGE_SET:
+                self._fail(run, "Outcome unknown. Remote observation failed: " + str(failure), OperationStatus.UNKNOWN)
+                return
+            self._fail(run, str(failure), OperationStatus.CANCELLED if run.cancelled else OperationStatus.REFUSED)
+
+    def _compatible_reread(self, before: RemoteSnapshot, after: RemoteSnapshot) -> bool:
+        """Allow newly added remotes without appending them or accepting changed captured settings."""
+        if before.signature == after.signature:
+            return True
+        before_identity, _before_records = before.signature
+        after_identity, _after_records = after.signature
+        if before_identity != after_identity:
+            return False
+        extra_name_set = set(after.entry_by_name) - set(before.entry_by_name)
+        if not extra_name_set:
+            return False
+        retained_values = []
+        for value in after.values:
+            if value.key.startswith("remote.") and value.key.removeprefix("remote.").rsplit(".", 1)[0] in extra_name_set:
+                continue
+            retained_values.append(value)
+        return tuple(retained_values) == before.values
+
+    def _fail(self, run: TransportRun, cause: str, status: OperationStatus = OperationStatus.FAILED, snapshot: RemoteSnapshot | None = None) -> None:
+        """Retain a filtered refusal or incomplete result; the only automatic retry, of a failed secret read, happens before.
+
+        The ``--log`` file keeps the full diagnostic block; the console shows one line, ``Not started:``, ``Cancelled:`` or
+        ``Failed:`` followed by the cause, according to ``status``.
+        """
+        operation = run.request.operation
+        diagnostic = self._cause_diagnostic(run, cause)
+        run.trace.append_diagnostic(operation.operation_id, "error", diagnostic, status)
+        self._finish(run, status, diagnostic, snapshot)
+
+    def _cause_diagnostic(self, run: TransportRun, cause: str) -> PreparedDiagnostic:
+        """Build the diagnostic of a transport that ended on ``cause`` without a Git process to explain it."""
+        operation = run.request.operation
+        return Diagnostic(transport_console_label(run.request), operation.context.repository_dir, operation.git_filename, [], cause).prepare()
+
+    def _refresh_required(self, run: TransportRun, status: OperationStatus, final_snapshot: RemoteSnapshot | None) -> bool:
+        """Tell whether the views must read the repository again, and answer no only when nothing can have changed.
+
+        That takes a Fetch or Push that fully succeeded with every remote and every reference observed unchanged, no
+        remote-tracking or upstream write of its own, and a final capture identical to the operation's first one: a
+        server that says "up to date" can still leave a repaired tracking branch, or another tool may have changed
+        the repository meanwhile. Deletion, failures, partial or unknown results always read again.
+        """
+        if run.request.mode not in ("fetch", "push") or status != OperationStatus.SUCCESS or final_snapshot is None or run.first_snapshot is None:
+            return True
+        if not run.remote_results:
+            return True
+        for result in run.remote_results:
+            if result.status != OperationStatus.SUCCESS or result.effect != "unchanged":
+                return True
+        if run.request.mode == "push":
+            if not run.ref_results:
+                return True
+            for result in run.ref_results:
+                if result.status != OperationStatus.SUCCESS or result.effect != "unchanged":
+                    return True
+            for step in run.steps:
+                if step.operation in (TRACKING_UPDATE_OPERATION, TRACKING_DELETE_OPERATION):
+                    return True
+                # A link step that never started Git, or that Git refused, wrote nothing; an unknown one may have written.
+                if step.operation == SharedText.UPSTREAM_LINK_STEP.value and step.status in (OperationStatus.SUCCESS, OperationStatus.UNKNOWN):
+                    return True
+        return not unchanged_observation(run.first_snapshot, final_snapshot)
+
+    def _end_line(self, run: TransportRun, status: OperationStatus, diagnostic: PreparedDiagnostic | None) -> ConsoleLine:
+        """Return the console line that ends a transport, such as ``Push: done`` in green, in place of the bare status the log keeps.
+
+        A partial result says which part did not happen, and is red like any result that is not a success.
+        """
+        label = transport_console_label(run.request)
+        tone = run.trace.end_tone(status, failure_reported=diagnostic is not None)
+        if status != OperationStatus.PARTIAL:
+            return ConsoleLine(operation_end_text(label, status), tone)
+        return ConsoleLine(self._partial_end_text(run, label), tone)
+
+    def _partial_end_text(self, run: TransportRun, label: str) -> str:
+        """Say which part of a partial transport failed: the side of a deletion, the references not pushed, the remotes not fetched.
+
+        A deletion done on both sides for some references and on one side only for others has no single side to name,
+        so it keeps the generic partial line.
+        """
+        if run.request.mode == "delete":
+            local_deleted = False
+            for step in run.steps:
+                if step.operation in LOCAL_DELETE_OPERATION_SET and step.status == OperationStatus.SUCCESS:
+                    local_deleted = True
+            remote_deleted = unsuccessful_count(run.ref_results) < len(run.ref_results)
+            if local_deleted and not remote_deleted:
+                return DELETED_LOCALLY_ONLY_TEMPLATE.format(label=label)
+            if remote_deleted and not local_deleted:
+                return DELETED_REMOTELY_ONLY_TEMPLATE.format(label=label)
+            return operation_end_text(label, OperationStatus.PARTIAL)
+        if run.request.mode == "push":
+            return NOT_PUSHED_REFS_TEMPLATE.format(label=label, count=unsuccessful_count(run.ref_results), total=len(run.ref_results))
+        return FAILED_REMOTES_TEMPLATE.format(label=label, count=unsuccessful_count(run.remote_results), total=len(run.remote_results))
+
+    def _finish(self, run: TransportRun, status: OperationStatus, diagnostic: PreparedDiagnostic | None = None, snapshot: RemoteSnapshot | None = None) -> None:
+        """Release the common owner only after all native processes and rereads have ended."""
+        operation_id = run.request.operation.operation_id
+        if operation_id in self.outcome_by_id:
+            return
+        server_status = status
+        tag_delete = run.request.mode == "delete" and run.request.source_ref.startswith(TAG_PREFIX)
+        if tag_delete:
+            if not run.local_started:
+                run.steps.append(OperationStepResult(DELETE_LOCAL_TAG_OPERATION, OperationStatus.NOT_STARTED, effect="preparation did not succeed", full_ref=run.request.source_ref))
+            if not any(step.operation == DELETE_REMOTE_TAG_OPERATION for step in run.steps):
+                run.steps.append(OperationStepResult(DELETE_REMOTE_TAG_OPERATION, OperationStatus.UNKNOWN if status == OperationStatus.UNKNOWN else OperationStatus.NOT_STARTED, effect="server deletion did not start", diagnostic=diagnostic,
+                                                     full_ref=run.request.destination_ref))
+            if status != OperationStatus.SUCCESS and any(step.operation == DELETE_LOCAL_TAG_OPERATION and step.status == OperationStatus.SUCCESS for step in run.steps):
+                status = OperationStatus.PARTIAL
+        if not tag_delete and run.request.mode == "delete" and run.delete_local is not None and not run.local_started:
+            run.local_started = True
+            if status == OperationStatus.SUCCESS:
+                run.stage = "delete-local"
+
+                def completed(outcome: OperationOutcome | None, error: Exception | None) -> None:
+                    """Retain the known remote success even when local deletion fails or is cancelled."""
+                    if error is not None:
+                        cause = Diagnostic(DELETE_LOCAL_BRANCH_OPERATION, run.request.operation.context.repository_dir, run.request.operation.git_filename, [], str(error)).prepare()
+                        run.steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.UNKNOWN, diagnostic=cause))
+                        self._finish(run, OperationStatus.PARTIAL, cause)
+                        return
+                    run.steps.extend(outcome.steps)
+                    self._finish(run, outcome.status, outcome.diagnostic or diagnostic)
+                operation = run.request.operation
+                self.remote.worktree_service.run(operation.context, operation.git_filename, run.delete_local(), completed, operation_id=operation_id)
+                return
+            effect = "local deletion could not start" if any(result.status == OperationStatus.SUCCESS for result in run.ref_results) else "remote deletion did not succeed"
+            if run.request.delete_local_refs:
+                success_ref_set = {step.full_ref for step in run.steps if step.operation == DELETE_LOCAL_BRANCH_OPERATION and step.status == OperationStatus.SUCCESS}
+                for full_ref, _oid in run.request.delete_local_refs:
+                    if full_ref not in success_ref_set:
+                        run.steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.NOT_STARTED, effect=effect, full_ref=full_ref))
+            else:
+                run.steps.append(OperationStepResult(DELETE_LOCAL_BRANCH_OPERATION, OperationStatus.NOT_STARTED, effect=effect))
+        if not tag_delete and run.request.mode == "delete" and not run.tracking_checked:
+            run.tracking_checked = True
+            tracking_ref = remote_tracking_ref(run.snapshot, run.request.remote_name, run.request.destination_ref) if run.snapshot is not None else ""
+            old_oid = remote_reference_oid(run.snapshot, tracking_ref) if tracking_ref else ""
+            deleted = any(result.full_ref == run.request.destination_ref and result.status == OperationStatus.SUCCESS for result in run.ref_results)
+            if old_oid and deleted and not self.closed:
+                # Git drops the remote-tracking branch of a branch it deleted on the server; the local deletion steps ran first
+                # because they check the tracking branch they belong to.
+                arguments = ["update-ref", "--no-deref", "-d", tracking_ref, old_oid]
+                operation = run.request.operation
+                self.remote.worktree_service.run(operation.context, operation.git_filename, self._write_tracking(run, TRACKING_DELETE_OPERATION, tracking_ref, old_oid, "", arguments),
+                                                lambda _value, _error: self._finish(run, status, diagnostic, snapshot), operation_id=operation_id)
+                return
+        if run.request.mode == "delete" and not run.ref_results:
+            run.ref_results.append(PushResult(run.request.destination_ref, "", run.request.endpoint, server_status, run.before_oid, effect="not started" if server_status == OperationStatus.REFUSED else "unknown"))
+        run.stage = "finished"
+        # Every local and network continuation has ended: this run drops its answer, while the search keeps its own success for the next operation with the same Git.
+        run.verified_helper_commands = None
+        run.helper_override = None
+        completed_name_set = {result.remote_name for result in run.remote_results}
+        for target in run.targets:
+            if target.remote_name in completed_name_set:
+                continue
+            target_status = status if target.remote_name == run.remote_name else OperationStatus.NOT_STARTED
+            run.remote_results.append(FetchResult(target.remote_name, target.endpoint, target_status, diagnostic=diagnostic if target_status != OperationStatus.NOT_STARTED else None))
+            run.trace.append_event(operation_id, "status", target.remote_name + ": " + target_status.value)
+        if status != OperationStatus.SUCCESS and any(result.status == OperationStatus.SUCCESS for result in run.remote_results):
+            status = OperationStatus.PARTIAL
+        if run.request.mode == "push":
+            completed_ref_set = {result.full_ref for result in run.ref_results}
+            refs = tuple(sorted(run.request.tag_refs)) if run.request.tag_refs else ((run.request.destination_ref, run.request.source_oid),)
+            for full_ref, oid in refs:
+                if full_ref not in completed_ref_set:
+                    current_ref_set = set(dict(run.push_batches[run.batch_index])) if run.batch_index < len(run.push_batches) else set()
+                    ref_status = status if full_ref in current_ref_set or not run.push_batches else OperationStatus.NOT_STARTED
+                    run.ref_results.append(PushResult(full_ref, oid, run.request.endpoint, ref_status, run.before_oid_by_ref.get(full_ref)))
+                    completed_ref_set.add(full_ref)
+                    run.trace.append_event(operation_id, "status", full_ref + ": " + ref_status.value)
+            status = self._push_status(run, status)
+        final_snapshot = snapshot or run.snapshot
+        outcome = TransportOutcome(operation_id, status, tuple(run.steps), diagnostic, run.remote_name, run.endpoint, final_snapshot, tuple(run.remote_results), tuple(run.ref_results),
+                                   run.rejection, self._refresh_required(run, status, final_snapshot), run.selection, tuple(run.server_refusals),
+                                   credential_manager_refusal=run.credential_manager_refusal, upstream_not_linked=run.upstream_not_linked)
+        self.outcome_by_id[operation_id] = outcome
+        run.trace.append_record(operation_id, "status", status.value, self._end_line(run, status, diagnostic))
+        if operation_id in self.repository_operation.active_by_id:
+            self.repository_operation.reconcile(outcome)
+        self.finished.emit(outcome)
+        if self.closed:
+            run.trace.close()