Does GCM (or GHASH) only provide 64-bit security against forgeries? In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would be $2^{64}$.

So of course I immediately checked the relevant security theorem (corollary 4):

$$\mathbf{Adv}^{\text{auth}}_{\operatorname{GCM}[\operatorname{Perm}(n),\tau]}(\mathcal A)\leq \frac{0.5(\sigma+q+q'+1)^2}{2^n}+\frac{q'(\ell_A+1)}{2^\tau}$$

with $\sigma$ being the total plaintext size in blocks, $q$ being the total number of encryption queries, $q'$ being the total number of decryption queries, $n$ being the size in bits of the underlying permutation, $\ell_A$ being maximum authenticated input length in blocks and $\tau$ being the tag size in bits.

Now clearly from this we can see that performing $2^{n/2}=2^{64}$ queries yields a strong enough advantage for a break.

Now my question is:
When talking about "n-bits of security" or "needs $2^n$ operations to break", do we usually talk about "online" security, ie queries to an oracle can be done and cost $1$ or "offline" security where no oracles are available or do we need to make this decision depending on the situation?

TL;DR: Does GCM offer 64 or 128 bit security?
According to the references, AES-GCM offers roughly 64-bit authenticity security (i.e., against forgery attacks) for 128-bit block size and long-enough (>=64-bit) tag size. When the number of queries appears in a security bound, "online" security should always be the case (for the bound items involving the number of queries). The word "query" corresponds to an oracle, which cannot be attacked offline.