Refuse a bookmark at one head that leaves earlier work out 4fe7d6045860

/// What one state lacks of another: see [`Repo::state_gap`].

#[derive(Debug, Clone, PartialEq, Eq)]

pub struct StateGap {

    /// Changes of the first state recorded before the latest head of the

    /// second but not in it, oldest first: what Git's ancestry would have

    /// included.

    pub earlier: Vec<ChangeHash>,

    /// How many changes of the first state the second lacks altogether.

    pub lacks: usize,

    /// The heads of the second state together with `earlier`: everything

    /// of the first state up to the second's latest head.

    pub upto: Vec<ChangeHash>,

}

    }

    /// What a state at `at` lacks of the state at `from` (spec §10.1). A

    /// state is its heads and what they depend on, not everything recorded

    /// before them, so a bookmark created at one change of a state with

    /// several heads holds much less than someone used to Git expects.

    pub fn state_gap(&self, from: &[ChangeHash], at: &[ChangeHash]) -> Result<StateGap> {

        let mut all = from.to_vec();

        all.extend_from_slice(at);

        let st = self.load_state_history(&all)?;

        let with_closure = |hs: &[ChangeHash]| {

            let mut s: HashSet<ChangeHash> = hs.iter().copied().collect();

            for h in hs {

                s.extend(st.closure(h).iter().copied());

            }

            s

        };

        let from_set = with_closure(from);

        let at_set = with_closure(at);

        let key = |h: &ChangeHash| st.get(h).map(|m| (m.hlc, *h));

        let last = at.iter().filter_map(key).max();

        let missing: Vec<ChangeHash> = from_set

            .iter()

            .filter(|h| !at_set.contains(h))

            .copied()

            .collect();

        let mut earlier: Vec<ChangeHash> = missing

            .iter()

            .filter(|h| matches!((key(h), last), (Some(k), Some(l)) if k < l))

            .copied()

            .collect();

        earlier.sort_by_key(key);

        let mut candidates = at.to_vec();

        candidates.extend_from_slice(&earlier);

        Ok(StateGap {

            lacks: missing.len(),

            upto: st.maximal(&candidates),

            earlier,

        })

pub use bookmarks::{BookmarkInfo, MergeReport, StateGap};

**A state is its heads, not a history.** If you are coming from Git, this

is the one thing to know. A bookmark holds its heads and what they depend

on, and a change depends only on the changes it builds on (the files it

touched), not on everything recorded before it. So on a bookmark with

several heads, a new bookmark at one change can be a much older-looking

tree. `oxy bookmark create NAME CHANGE` refuses when that would leave out

earlier work and lists what it would lack. Then pick one:

```

oxy bookmark create logo 745307b4 --upto  # everything here up to that change, as a Git branch would be

oxy bookmark create logo 745307b4 --only  # just that change and what it depends on

oxy bookmark create logo                  # the whole current state, usually what you want

```

`oxy bookmark switch` says when the bookmark you switch to lacks changes

that the one you left has.

A repository holds any number of bookmarks. Each workspace has a **current bookmark** (`oxy bookmark switch NAME`, recorded per workspace) that its working copy sits on and that `commit`, `log`, `push`, and `pull` act on by default. Switching refuses uncommitted work unless told what to do with it: `--discard` drops it, and `--carry` takes it along when every path it touches is the same in NAME's state as in the working copy's base (so the same edits apply there), refusing and naming the paths otherwise. `oxy bookmark create feat && oxy bookmark switch feat --carry` moves work started on one bookmark onto a new one. `oxy bookmark create NAME [CHANGE..]` names a new state (default: the current working copy's base heads); given CHANGE.., it refuses when the current state has changes recorded before the latest of them that they do not contain, since a state holds its heads' dependency closure and not everything recorded before them, unless `--upto` (the current state's changes up to CHANGE.., as Git ancestry would have it) or `--only` (exactly CHANGE.. and their dependencies) says which is meant, and `bookmark switch` reports how many changes the new state lacks of the old; `set NAME CHANGE..` moves one, `delete NAME` removes it (its changes stay until unreachable, §21), `list` shows all with their heads and the remote-tracking difference, and `oxy merge NAME` unions the named bookmark's heads into the current one, which is the whole of merging in this model: no merge change, conflicts reified (§9); a working copy without changes follows the merge, whichever state it sat on. `oxy checkout NAME` materializes a bookmark without switching to it; with uncommitted work it refuses, naming each changed path and how it changed (a *removed* path is in the working copy's base but not on disk), unless `--discard` or `--carry` (as for switching) says what to do with the work. Bookmark names, then tag names, are resolved before change prefixes wherever a change is expected (a bookmark or tag names a change when its state has one head). For builds, `oxy describe` without `-m` names the working copy as `git describe` does: its base state's tag (`v1.2`), else the nearest tag whose state the base contains with the number of changes it adds and the newest head's ChangeId (`v1.2-3-8c5ea12a`), else the bookmark and that ChangeId (`develop-8c5ea12a`), with `-dirty` when the working copy has uncommitted changes; `--json` gives the parts.

*Changelog.* Draft 0.8r (2026-09-29): `bookmark create --upto/--only` (§10.1); the working-copy lock covers every command that writes the working copy; a workspace changed by two concurrent operations is an error (§12.1). Draft 0.8q (2026-09-29): change format version 2 stores large inserts as text blobs, so a change does not grow with the files it adds (§6.1, §7.4); no object may exceed 1 GiB (§13.2). Draft 0.8p (2026-09-29): Git import derives new NodeIds from the commit, making imports deterministic (§23). Draft 0.8o (2026-09-29): execution receipts, the `receipt` object and attestation (§14.6). Draft 0.8n (2026-09-29): line history, `oxy log -L` (§27). Draft 0.8m (2026-09-29): resolving replace conflicts (§9.3). Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).

        /// Its heads (default: the working copy's base). A state is its

        /// heads and what they depend on: a change alone may leave out

        /// earlier changes of the current state, which is refused unless

        /// --upto or --only says which is meant

        /// Everything of the current state up to CHANGE..., as a Git

        /// branch at a commit would hold

        #[arg(long, conflicts_with = "only")]

        upto: bool,

        /// Just CHANGE... and what they depend on

        #[arg(long)]

        only: bool,

            BookmarkCmd::Create {

                name,

                changes,

                upto,

                only,

            } => workspace::bookmark_create(&name, &changes, upto, only),

pub fn bookmark_create(name: &str, changes: &[String], upto: bool, only: bool) -> Result<i32> {

        let named = heads_from(&repo, changes)?;

        let (_, wc) = repo.working_copy()?;

        let gap = repo.state_gap(&wc.deps, &named)?;

        if upto {

            Some(gap.upto)

        } else if only || gap.earlier.is_empty() {

            Some(named)

        } else {

            anyhow::bail!(

                "{name} at {} would lack {} of the current state recorded before it:\n{}\n\

                 A state is its heads and what they depend on, not everything recorded before them.\n\

                 Pass --upto for everything of the current state up to {0} (as a Git branch would hold),\n\

                 or --only for just {0} and what it depends on.",

                changes.join(" "),

                plural(gap.earlier.len(), "change"),

                listed_changes(&repo, &gap.earlier)

            );

        }

/// Up to five changes, newest last, as `  #hash subject` lines.

fn listed_changes(repo: &Repo, changes: &[oxy_core::hash::ChangeHash]) -> String {

    let shown = changes.len().min(5);

    let mut lines: Vec<String> = changes[changes.len() - shown..]

        .iter()

        .map(|h| {

            let subject = repo

                .store()

                .get_change(h)

                .map(|c| subject_of(&c.message).to_string())

                .unwrap_or_default();

            format!("  #{} {subject}", h.short(12))

        })

        .collect();

    if changes.len() > shown {

        lines.insert(0, format!("  … and {} earlier", changes.len() - shown));

    }

    lines.join("\n")

}

    let from = repo.config.bookmark.clone();

    let before = repo

        .working_copy()

        .map(|(_, wc)| wc.deps)

        .unwrap_or_default();

    }

    // Say when the new state leaves out work the old one had: a state is

    // its heads and what they depend on, which can be far less than a Git

    // user expects.

    let after = repo

        .working_copy()

        .map(|(_, wc)| wc.deps)

        .unwrap_or_default();

    if let Ok(gap) = repo.state_gap(&before, &after) {

        if gap.lacks > 0 {

            println!(

                "  {} {}",

                ui::note(),

                ui::dim(format!(

                    "{name} lacks {} that {from} has",

                    plural(gap.lacks, "change")

                ))

            );

        }

/// Metalgear, 2026-09-29 (oxygen#37): a bookmark created at one of three

/// independent heads held only that change and what it depends on, and

/// switching to it silently wrote a much older tree.

#[test]

fn a_bookmark_at_one_head_of_several_is_refused_unless_asked_for() {

    let tmp = tempfile::tempdir().unwrap();

    let home = tmp.path().join("home");

    std::fs::create_dir_all(&home).unwrap();

    let r = tmp.path().join("repo");

    assert_eq!(oxy(tmp.path(), &home, &["init", r.to_str().unwrap()]).0, 0);

    for f in ["a", "b", "c"] {

        write(&r, &format!("{f}.txt"), &format!("{f}\n"));

        assert_eq!(oxy(&r, &home, &["commit", "-m", f]).0, 0);

    }

    let bms = json(&r, &home, &["bookmark", "list", "--json"]);

    assert_eq!(

        bms[0]["heads"].as_array().unwrap().len(),

        3,

        "independent: {bms}"

    );

    let log = json(&r, &home, &["log", "--json"]);

    let hash = |m: &str| {

        let c = log["changes"]

            .as_array()

            .unwrap()

            .iter()

            .find(|c| c["message"] == m)

            .unwrap();

        format!("#{}", &c["hash"].as_str().unwrap()[..12])

    };

    let b = hash("b");

    let (code, _, err) = oxy(&r, &home, &["bookmark", "create", "x", &b]);

    assert_ne!(code, 0);

    assert!(

        err.contains("would lack 1 change") && err.contains("--upto") && err.contains("--only"),

        "{err}"

    );

    assert_eq!(

        oxy(&r, &home, &["bookmark", "create", "upto", &b, "--upto"]).0,

        0

    );

    assert_eq!(

        oxy(&r, &home, &["bookmark", "create", "only", &b, "--only"]).0,

        0

    );

    let bms = json(&r, &home, &["bookmark", "list", "--json"]);

    let heads = |n: &str| {

        bms.as_array()

            .unwrap()

            .iter()

            .find(|x| x["name"] == n)

            .unwrap()["heads"]

            .as_array()

            .unwrap()

            .len()

    };

    assert_eq!(heads("upto"), 2, "a and b: {bms}");

    assert_eq!(heads("only"), 1);

    // Switching to the smaller state says what it leaves out.

    let (code, out, err) = oxy(&r, &home, &["bookmark", "switch", "only"]);

    assert_eq!(code, 0, "{err}");

    let out = String::from_utf8_lossy(&out);

    assert!(out.contains("only lacks 2 changes that main has"), "{out}");

    assert!(!r.join("a.txt").exists() && r.join("b.txt").exists());

}