A verified clean check restamps the manifest; checkout keeps directory times (refs #41) 0389c3e82f6c

        let recording = crate::timing::phase("checkout: record");

        drop(recording);

        let _t = crate::timing::phase("checkout: manifest");

        // The directories the new tree has, with any the old manifest kept

        // that still exist (holding only ignored files, say), statted now,

        // after the writes: the next check then need not list the tree. A

        // directory written just now is within the racy window, so for a

        // moment the check lists anyway.

        if !old_manifest.dirs.is_empty() {

            let mut dirs: BTreeSet<String> =

                old_manifest.dirs.iter().map(|(d, _)| d.clone()).collect();

            dirs.insert(String::new());

            for p in entries.keys() {

                let mut at = p.as_str();

                while let Some((parent, _)) = at.rsplit_once('/') {

                    if !dirs.insert(parent.to_string()) {

                        break;

                    }

                    at = parent;

                }

            }

            use rayon::prelude::*;

            let root = &self.root;

            let dirs: Vec<(String, u128)> = dirs

                .into_par_iter()

                .filter_map(|d| {

                    let m = fs::metadata(root.join(&d)).ok().filter(|m| m.is_dir())?;

                    Some((d, prompt::mtime_ns(&m)))

                })

                .collect();

            let mut dirs = dirs;

            dirs.sort_unstable();

            *self.walked_dirs.borrow_mut() = Some((dirs, old_manifest.nested.clone()));

        }

    /// The directories a manifest check listed, for its restamp only.

    pub(crate) listed_dirs: std::cell::RefCell<Option<WalkedDirs>>,

            listed_dirs: Default::default(),

            listed_dirs: Default::default(),

                    listed_dirs: Default::default(),

                    listed_dirs: Default::default(),

/// Now, in nanoseconds since the epoch.

fn now_ns() -> u128 {

    std::time::SystemTime::now()

        .duration_since(UNIX_EPOCH)

        .map(|d| d.as_nanos())

        .unwrap_or(0)

}

        let started = now_ns();

        }

        // Verified clean. Entries or directories within the racy window of

        // the manifest's time were hashed or listed just now; restamped with

        // the time this check began, the next check can trust them, as

        // Git restamps its index (anything changed within two seconds of

        // that time is still racy by the same rule).

        // A check that had to list the tree leaves the directories it

        // listed: kept, the next check need not list.

        let window = 2_000_000_000;

        let listed = self.listed_dirs.take();

        let racy = m.dirs.iter().any(|(_, t)| t + window >= m.written_ns)

            || m.entries

                .values()

                .any(|e| e.mtime_ns + window >= m.written_ns);

        if (racy || (m.dirs.is_empty() && listed.is_some())) && started > m.written_ns {

            let (dirs, nested) = listed.unwrap_or_else(|| (m.dirs.clone(), m.nested.clone()));

            self.restamp_manifest(&m, conflicted, uncommitted, started, &dirs, &nested);

    }

    /// Rewrite the manifest with a new time and directory list, its entries

    /// unchanged.

    fn restamp_manifest(

        &self,

        m: &Manifest,

        conflicted: bool,

        uncommitted: bool,

        written_ns: u128,

        dirs: &[(String, u128)],

        nested: &[String],

    ) {

        let _t = crate::timing::phase("status: restamp the manifest");

        let mut rows = m.entries.iter().map(|(p, e)| (p.as_str(), e.clone()));

        let bytes = encode_manifest(conflicted, uncommitted, written_ns, dirs, nested, &mut rows);

        self.manifest_cache.take();

        let _ = write_cache(&self.manifest_path(), &bytes);

            // A complete list of the directories, each timed before it was

            // read, for a restamp to keep (see `clean_by_manifest`).

            *self.listed_dirs.borrow_mut() = Some((

                listing.dirs.clone(),

                listing.nested.iter().map(|d| self.rel_path(d)).collect(),

            ));

/// oxygen#41: a clean check that verified racy entries restamps the

/// manifest, so later checks can trust them, and a same-size rewrite

/// straight afterwards is still found: entries within two seconds of the

/// new time stay racy.

#[test]

fn a_verified_clean_check_restamps_the_manifest_safely() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "a.txt", b"one\n");

    repo.commit("one", &[]).unwrap();

    let before = repo.read_manifest().unwrap().unwrap().2.written_ns;

    assert!(repo.clean_by_manifest().unwrap());

    let after = repo.read_manifest().unwrap().unwrap().2.written_ns;

    assert!(after > before, "restamped");

    write(root, "a.txt", b"two\n");

    assert!(

        !repo.clean_by_manifest().unwrap(),

        "a same-size rewrite is still seen"

    );

}

### Checkout, first measurement against Git (2026-10-02, oxygen#41)

`~/bench/checkout-vs-git.sh`: to the first state (1 001 files differ) and

back, oxy, Git and tuned Git alternating, three each (load average 1.6).

| | oxy | Git | Git, tuned |

|---|---:|---:|---:|

| to the first state | 0.65 to 0.71 s | 0.26 to 0.27 s | 0.24 to 0.26 s |

| and back | 0.71 to 0.73 s | 0.23 to 0.26 s | 0.23 to 0.24 s |

Where a checkout's time goes: the manifest check 134 ms (listing: see

below), planning 67 ms, the 1 001 texts read from the store (134 ms) or

their graphs built (141 ms) going back, writing 65 to 82 ms, recording

115 to 143 ms, the manifest 45 ms.

Found on the way, now fixed: a manifest written by a checkout kept no

directory times, and directories a checkout had just written stayed

within the racy window of the manifest's time for good, so every status

after a checkout listed the tree. A clean check that verified the tree

now restamps the manifest with the time it began, keeping the

directories it listed (Git restamps its index the same way): the first

status after a checkout takes 0.15 s, the ones after it 0.10 s again.