Change format 3: text blobs hold the lines' bytes 0f93f49ce059

    /// Whether splitting [`Lines::bytes`] by the line rule gives these lines

    /// back: every line but the last ends in a newline and none holds

    /// another. Every insert oxy makes is so, and such lines are stored as

    /// their bytes alone (spec §7.4).

    pub fn is_split_form(&self) -> bool {

        let buf = &self.0.buf;

        let mut start = 0usize;

        for (i, &end) in self.0.ends.iter().enumerate() {

            let line = &buf[start..end as usize];

            if line.is_empty() {

                return false;

            }

            let last = i + 1 == self.0.ends.len();

            let body = if last && !line.ends_with(b"\n") {

                line

            } else if line.ends_with(b"\n") {

                &line[..line.len() - 1]

            } else {

                return false;

            };

            if body.contains(&b'\n') {

                return false;

            }

            start = end as usize;

        }

        true

    }

        assert!(l.is_split_form());

        assert!(!Lines::from(vec![b"a".to_vec(), b"b\n".to_vec()]).is_split_form());

        assert!(!Lines::from(vec![b"a\nb\n".to_vec()]).is_split_form());

        assert!(!Lines::from(vec![Vec::new()]).is_split_form());

        assert!(Lines::from(vec![b"a\n".to_vec(), b"end".to_vec()]).is_split_form());

/// large insert's lines as a text blob holding a CBOR array of them;

/// version 3 holds the lines' bytes themselves when splitting them by the

/// line rule gives them back. Readers accept 1 to 3, and a change keeps

/// the version it was made in, so its hash never moves.

pub const CHANGE_VERSION: u64 = 3;

/// How a text blob holds an insert's lines (spec §7.4).

#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]

pub enum TextForm {

    /// A CBOR array of the lines' byte strings: version 2.

    Cbor,

    /// The lines' bytes, split again by the line rule: version 3.

    Raw,

    /// A CBOR array in a version 3 change, for lines the line rule would

    /// not split back (marked by key 7): never for lines it would.

    CborFallback,

}

    /// one, and its form (see [`Change::value_with`], which works them out).

    fn to_value(&self, stored: Option<(ObjectRef, TextForm)>) -> Value {

                Some((r, form)),

            ) => {

                let mut fields = vec![

                    (0, Value::Uint(0)),

                    (1, nid(node)),

                    (2, after.to_value()),

                    (3, before.to_value()),

                    (5, Value::Bytes(r.0.to_vec())),

                    (6, Value::Uint(lines.len() as u64)),

                ];

                if form == TextForm::CborFallback {

                    fields.push((7, Value::Uint(1)));

                }

                Value::map(fields)

            }

                        let form = match (version, m.get(&7)) {

                            (2, None) => TextForm::Cbor,

                            (_, None) => TextForm::Raw,

                            (3.., Some(Value::Uint(1))) => TextForm::CborFallback,

                            _ => return schema("unknown text blob form"),

                        };

                        resolve(&text, count, form)?

    fn stored_texts(&self, sink: &mut TextSink) -> Vec<Option<(ObjectRef, TextForm)>> {

        let mut refs: Vec<Option<(ObjectRef, TextForm)>> = vec![None; self.edits.len()];

                    };

                    let form = text_form(self.version, lines);

                    let content = match form {

                        TextForm::Raw => lines.bytes().to_vec(),

                        TextForm::Cbor | TextForm::CborFallback => cbor::encode_byte_strings(lines),

                        form,

                refs[*i] = Some((t.blob.hash(), t.form));

        Self::decode_with(bytes, &mut |r, _, _| {

        Self::from_value_with(v, &mut |r, _, _| {

pub type Resolver<'a> = dyn FnMut(&ObjectRef, u32, TextForm) -> Result<Lines, ObjectError> + 'a;

    /// A stored insert: its text blob, line count, and the blob's form.

    Blob(ObjectRef, u32, TextForm),

        return Edit::from_value(&Value::Map(fields), version, &mut |text, count, form| {

            texts.push(TextRef::Blob(*text, count, form));

    pub form: TextForm,

/// The form a change of `version` stores these lines in.

fn text_form(version: u64, lines: &Lines) -> TextForm {

    match version {

        ..=2 => TextForm::Cbor,

        _ if lines.is_split_form() => TextForm::Raw,

        _ => TextForm::CborFallback,

    }

}

pub fn text_lines(content: &[u8], count: u32, form: TextForm) -> Result<Lines, ObjectError> {

    let lines = match form {

        TextForm::Raw => Lines::split(content),

        TextForm::Cbor | TextForm::CborFallback => array_lines(&cbor::decode(content)?)?,

    };

    // One encoding per change: the size rule and the form are both fixed

    // by the lines.

    if cbor::byte_strings_len(&lines) < TEXT_BLOB_MIN {

    if form == TextForm::CborFallback && lines.is_split_form() {

        return schema("these lines are stored as their bytes in a version 3 change");

    }

            m.insert(0, Value::Uint(4));

        // Version 3: the lines' bytes themselves.

        assert_eq!(texts[0].form, TextForm::Raw);

        assert_eq!(texts[0].content, lines.bytes());

        let d = Change::decode_with(&bytes, &mut |r, n, form| {

            assert_eq!(form, TextForm::Raw);

            text_lines(&texts[0].content, n, form)

        // Version 2 held the same lines as a CBOR array, and still reads.

        let mut v2 = c.clone();

        v2.version = 2;

        let (b2, t2) = v2.encode_parts();

        assert_eq!(t2[0].form, TextForm::Cbor);

        assert_eq!(t2[0].content, cbor::encode_byte_strings(&lines));

        let d2 = Change::decode_with(&b2, &mut |_, n, form| text_lines(&t2[0].content, n, form))

            .unwrap();

        assert_eq!(d2, v2);

        // Lines the line rule would not split back stay a CBOR array,

        // marked; and a marked array of lines that would is refused.

        let odd: Lines = (0..500)

            .map(|i| format!("no newline {i}").into_bytes())

            .collect();

        let c3 = with_insert(sample_change(), odd.clone());

        let (b3, t3) = c3.encode_parts();

        assert_eq!(t3[0].form, TextForm::CborFallback);

        let d3 = Change::decode_with(&b3, &mut |_, n, form| text_lines(&t3[0].content, n, form))

            .unwrap();

        assert_eq!(d3, c3);

        let marked = cbor::encode_byte_strings(&lines);

        assert!(text_lines(&marked, 500, TextForm::CborFallback).is_err());

                    TextRef::Blob(r, n, form) => {

                        text_lines(&stored[0].content, *n, *form).unwrap()

        );

        assert_eq!(text_lines(&content, 500, TextForm::Cbor).unwrap(), lines);

        assert!(text_lines(&content, 499, TextForm::Cbor).is_err());

        assert_eq!(

            text_lines(lines.bytes(), 500, TextForm::Raw).unwrap(),

            lines

        assert!(text_lines(lines.bytes(), 501, TextForm::Raw).is_err());

        assert!(

            text_lines(&small, 1, TextForm::Cbor).is_err(),

            "short enough to be inline"

        );

        assert!(

            text_lines(b"x\n", 1, TextForm::Raw).is_err(),

            "short enough to be inline"

        );

            let change = Change::decode_with(encoded, &mut |text, count, form| {

                crate::objects::text_lines(&content, count, form)

            Change::decode_with(body, &mut |_, _, _| Ok(crate::lines::Lines::default())).map(|_| ())

                    if let crate::objects::TextRef::Blob(r, _, _) = t {

                if let crate::objects::TextRef::Blob(r, _, _) = t {

            crate::objects::TextRef::Blob(r, _, _) => Some(*r),

            TextRef::Blob(r, _, _) => Some(*r),

                            Some(TextRef::Blob(_, count, form)) => {

                                crate::objects::text_lines(&content, count, form)?

        let decoded = Change::decode_with(&bytes, &mut |text, count, form| match self

            .read_text(text)

        {

                crate::objects::text_lines(&content, count, form)

  version   [0]: 1, 2 or 3

Writers produce version 3. The versions differ only in how an `Insert` holds its lines (§7.4): a version 1 change carries every inserted line inline; versions 2 and 3 store each large insert as a **text blob** beside it, so no change grows with the size of the files it adds, and differ in what the text blob holds. Readers MUST accept all three. A change keeps the version it was made in: rewriting its encoding would change its hash and invalidate its signatures.

Edit = Insert  { node: NodeId, after: AtomRef, before: AtomRef, lines: [bytes] | text: ObjectRef, count: u32, cbor?: 1 }

- **Text blobs.** In a version 2 or 3 change, an insert whose lines encode as a canonical CBOR array of byte strings to at least 4096 bytes MUST be stored as `text` and `count`: `text` is a blob (§13.2) holding the lines, and `count` is the number of lines, at least 1. In version 2 the blob's content is exactly that CBOR array. In version 3 it is the lines' bytes, joined, when splitting those bytes by the line rule (every line but the last ends in a newline and holds no other; §7.3) gives the lines back, as every insert a snapshot makes does; otherwise it is the CBOR array and the insert carries `cbor: 1` (key 7). A reader rejects a version 3 insert marked `cbor` whose lines the line rule would split back. The joined form stores a file's text as its bytes, so a text blob shares chunks with any blob of the same content and carries no per-line framing (a tenth of a tree's compressed text). A shorter insert MUST be inline. The rule is deterministic, so a change has one encoding and one hash, and identical inserts share their text blob. A reader rejects an inline insert that should have been stored, a text blob shorter than 4096 bytes, and a text blob whose lines do not number `count`. A text blob and its chunks belong to their change: they are carried with it by every transfer (§16.3), kept with it by garbage collection (§21), and checked with it by `fsck`. A change cannot be read without them, so they are never withheld from a partial clone (§13.5).

*Changelog.* Draft 0.8r (2026-09-29): change format version 3, text blobs as the lines' bytes (§6.1, §7.4); `oxy gc` repacks into one pack at a higher compression level (§13.4); an import brings a deleted directory back rather than making a second node for its path, and retires a kept node's other placements (§23); graph keys at commit, lazy text in history-only loads, and a clean `status` from the manifest (§12.4); a parent checkout never moves a subrepo's bookmark backwards, and the pin is read from the nested working copy (§7.8); `bookmark create --upto/--only` (§10.1); the working-copy lock covers every command that writes the working copy; a workspace changed by two concurrent operations is an error (§12.1). Draft 0.8q (2026-09-29): change format version 2 stores large inserts as text blobs, so a change does not grow with the files it adds (§6.1, §7.4); no object may exceed 1 GiB (§13.2). Draft 0.8p (2026-09-29): Git import derives new NodeIds from the commit, making imports deterministic (§23). Draft 0.8o (2026-09-29): execution receipts, the `receipt` object and attestation (§14.6). Draft 0.8n (2026-09-29): line history, `oxy log -L` (§27). Draft 0.8m (2026-09-29): resolving replace conflicts (§9.3). Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).