Don't auto-forward branches when the repo was switched during the fetch

PostFetchRefresh's refresh is the only background refresh carrying a
Then callback, and Then callbacks are not generation-guarded: when the
background fetch's refresh crossed a repo switch, the callback still
ran — in the new repo — and auto-forwarded the new repo's branches
because the old repo's fetch had completed. That was harmless in
practice (the update-ref call compares against the expected old value,
and it only does what the next fetch's auto-forward would do anyway),
but mutating refs in a repo whose fetch never happened is not an action
the user took. Skip the auto-forward when the repo generation changed
since the fetch started.

The generation is captured by the fetch's callers before the fetch
runs, not by PostFetchRefresh itself: the background fetch doesn't
block repo switching and is a network call, so by the time
PostFetchRefresh runs a switch may already have happened — a capture
there (or the one the refresh itself takes) would compare against the
new repo's generation and let the auto-forward through. For the manual
fetch the capture point makes no difference, since a foreground
operation blocks repo switching for its entire duration.

This deliberately guards only this call site rather than making Then
callbacks generation-guarded in general: a Then is an arbitrary
callback, and whether it is safe to skip on a repo switch is a decision
for the author of the call site.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkg/gui/background.go

@@ -232,9 +232,14 @@ func (self *BackgroundRoutineMgr) goEvery(interval time.Duration, stop, retrigge
 }
 
 func (self *BackgroundRoutineMgr) backgroundFetch() (err error) {
+	// Captured before the fetch, not after: the fetch is a network call during
+	// which the user may switch repos, and the post-fetch refresh needs to be
+	// able to tell (see PostFetchRefresh).
+	fetchGeneration := self.gui.c.State().GetRepoGeneration()
+
 	err = self.gui.git.Sync.FetchBackground()
 
-	return self.gui.helpers.BranchesHelper.PostFetchRefresh(err, true)
+	return self.gui.helpers.BranchesHelper.PostFetchRefresh(err, true, fetchGeneration)
 }
 
 func (self *BackgroundRoutineMgr) triggerImmediateFetch() {

pkg/gui/controllers/files_controller.go

@@ -1527,6 +1527,7 @@ func (self *FilesController) onClickMain(opts gocui.ViewMouseBindingOpts) error
 }
 
 func (self *FilesController) fetch() error {
+	fetchGeneration := self.c.State().GetRepoGeneration()
 	return self.c.WithWaitingStatus(self.c.Tr.FetchingStatus, func(task gocui.Task) error {
 		self.c.LogAction("Fetch")
 		err := self.c.Git().Sync.Fetch(task)
@@ -1535,7 +1536,7 @@ func (self *FilesController) fetch() error {
 			return errors.New(self.c.Tr.PassUnameWrong)
 		}
 
-		return self.c.Helpers().BranchesHelper.PostFetchRefresh(err, false)
+		return self.c.Helpers().BranchesHelper.PostFetchRefresh(err, false, fetchGeneration)
 	})
 }
 

pkg/gui/controllers/helpers/branches_helper.go

@@ -392,7 +392,11 @@ func (self *BranchesHelper) deleteRemoteBranches(remoteBranches []*models.Remote
 	return nil
 }
 
-func (self *BranchesHelper) PostFetchRefresh(fetchErr error, background bool) error {
+// fetchGeneration must be the repo generation from when the fetch started,
+// captured by the caller before running the fetch: the background fetch
+// doesn't block repo switching and is a network call, so the window in which
+// the user can switch repos spans the whole fetch, not just this refresh.
+func (self *BranchesHelper) PostFetchRefresh(fetchErr error, background bool, fetchGeneration int) error {
 	scope := []types.RefreshableView{
 		types.BRANCHES, types.COMMITS, types.REMOTES, types.TAGS, types.PULL_REQUESTS,
 	}
@@ -410,6 +414,12 @@ func (self *BranchesHelper) PostFetchRefresh(fetchErr error, background bool) er
 			if fetchErr != nil {
 				return nil
 			}
+			// Then callbacks are not generation-guarded, so check explicitly:
+			// if the repo was switched since the fetch started, don't forward
+			// this repo's branches on the strength of another repo's fetch.
+			if self.c.State().GetRepoGeneration() != fetchGeneration {
+				return nil
+			}
 			err := self.AutoForwardBranches(background)
 			if background && err != nil {
 				// The background poller discards this return value, so surface