The object store runs on any Store: a directory today, a bucket next 648189388f1a

B1 of plan B (#68): store::Store keeps its API and puts every disk
touch behind a strata::Store backend plus a scratch directory for
what must be on this disk (a pack being streamed out, the derived
metas cache). The keys are the directory layout as it was, so
.oxy/objects is a LocalStore with the same files, stats, reads and
syncs: a loose object is one file, a packed one is one ranged read of
the pack, a small batch of loose objects is written with its syncs
batched (put_many_new), and a finished pack is linked into place, not
copied (put_new_file). The trait gains stat and modification times,
which gc's grace period reads.

Signatures, seal and receipt entries become one write-once key each
(sig/, seal/, receipt/ under the object), so two writers of a shared
store never lose each other's; the one-list-per-object files older
stores hold are still read, and pruning takes both. A signer's later
signature replaces its earlier one.

Store::open_on(backend, scratch) opens a store on anything; under
OXY_STORE_BACKEND=memory every store opens in memory, and the whole
oxy-core suite passes that way too (the tests that tamper with files
step aside). The store tests run on both.

refs #68

Author: Andy McCall @andymccall <[email protected]>
When: 1 month ago · 2026-10-04 11:50 UTC
Signature: ✔ signed by Andy McCall
Hash: 648189388f1aa19590d8e4e476c38aedc52a3be95d2e6b51250c68c579e4840c
Depends on: 135212de5370 192fad1e46a2 1983686fb7a7 2b872d074ddb 387335ff7f4d 4dcb8c0916b7 5b1114a04905 5b9c6ad45f6e 6f8aeb996558 75167672ebcd 86e1824f2d0b 8d80356371c5 8e1194860efa 8f10a07a1dbe 982864068a59 9ae4d15a0e4b a17fc622ca43 a5f76c79666c a70dce536476 a9f686edf60b afaba5f1306d b30a880fa409 ba160f60219e cdb5beba7f05 ce14f0d68b15 d02e545dc265 d77e1702d770 da652d6392d8 fc1a466a1e66 ff0af1ee299d
Depended on by: 795b8b502ded 544d0541a7e5 c6cec7822aff ef7d4ea6f33b 767ac6cd0545 7e0e8e5ad882 a67914bced23 092457020692 3a4b3e018326 454236d1108d dd21fd82687d
In bookmarks: agents-in-readme bare-hashes carried-not-removed carry-identical doctor-trust identical-sides keyless-tags main merge-remote-bookmark only-help-103 paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state switch-says
In tags: v0.10.0 v0.11.0 v0.4.0 v0.4.1 v0.4.2 v0.4.3 v0.4.4 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
Edits: 183 atoms, 0 tree operations, 5 files

Browse the tree at this change

hide whitespace changes

modified crates/oxy-core/src/repo/tests.rs +13 −3

modified crates/oxy-core/src/store.rs +828 −575

modified crates/oxy-core/src/strata.rs +230 −47

modified crates/oxy-strata/src/lib.rs +1 −0

modified docs/stores.md +17 −7

		…	3965 unchanged lines
3966	3966
3967	3967		#[test]
3968	3968		fn fsck_passes_a_sound_repository_and_names_each_fault() {
	3969	+	// Files on disk are what this tests: tampering with them, and the
	3970	+	// directory store's crash points.
	3971	+	if std::env::var_os("OXY_STORE_BACKEND").is_some() {
	3972	+	return;
	3973	+	}
3969	3974		hermetic();
3970	3975		let dir = tempfile::tempdir().unwrap();
3971	3976		let root = dir.path();
		…	105 unchanged lines
4077	4082		/// accept the same operation again.
4078	4083		#[test]
4079	4084		fn crash_at_every_step_of_commit_and_push_leaves_sound_repositories() {
	4085	+	// Files on disk are what this tests: tampering with them, and the
	4086	+	// directory store's crash points.
	4087	+	if std::env::var_os("OXY_STORE_BACKEND").is_some() {
	4088	+	return;
	4089	+	}
4080	4090		use crate::durable::failpoint;
4081	4091		hermetic();
4082	4092		let dir = tempfile::tempdir().unwrap();
		…	767 unchanged lines
4850	4860		)
4851	4861		.unwrap();
4852	4862		let graph = repo2.checkpoint_graph_blobs(&cp).unwrap()[0];
4853		-	fs::remove_file(repo2.store().path_for(&graph)).unwrap();
	4863	+	repo2.store().remove_loose_for_test(&graph).unwrap();
4854	4864		assert!(repo2.load_state(&repo2.bookmark_heads().unwrap()).is_err());
4855	4865		assert!(repo2.fsck().unwrap().errors() > 0, "fsck reports it");
4856	4866		}
		…	1300 unchanged lines
6157	6167		})
6158	6168		.find(\|r\| content(r).windows(12).any(\|w\| w == b"other line 1"))
6159	6169		.unwrap();
6160		-	fs::remove_file(repo.store().path_for(&other_text)).unwrap();
	6170	+	repo.store().remove_loose_for_test(&other_text).unwrap();
6161	6171		let mut hist = repo.load_state_history(&[h2]).unwrap();
6162	6172		repo.load_graphs_of(&mut hist, &[big_node]).unwrap();
6163	6173		assert!(repo
		…	409 unchanged lines
6573	6583		let Some(crate::objects::TextRef::Blob(b, _, _)) = texts.first().copied() else {
6574	6584		panic!("a stored text")
6575	6585		};
6576		-	fs::remove_file(repo.store().path_for(&b)).unwrap();
	6586	+	repo.store().remove_loose_for_test(&b).unwrap();
6577	6587		let rep = repo.fsck().unwrap();
6578	6588		assert!(rep.errors() > 0);
6579	6589		assert!(
		…	402 unchanged lines

		…	340 unchanged lines
341	341		key.starts_with(prefix).then(\|\| Entry {
342	342		key: key.to_string(),
343	343		size: m.size,
	344	+	modified_ms: u64::try_from(m.last_modified.timestamp_millis()).ok(),
344	345		})
345	346		})
346	347		.collect();
		…	90 unchanged lines

		…	89 unchanged lines
90	90		- `strata::conformance(store, prefix)` exercises any store under a
91	91		probe prefix and leaves it empty: every implementation runs it in its
92	92		tests, and `oxy remote check` runs it against a remote.
93		-	- The working repository's own `.oxy/` store is not behind the
94		-	trait: it is read and written directly, as before, so nothing on the
95		-	local path changes or slows. A store is what a remote is kept on.
	93	+	- Since 2026-10-04 (oxygen#68, B1) the repository's own object store
	94	+	is behind the trait too: `.oxy/objects` is a `LocalStore` with the
	95	+	same keys a bucket would hold (`loose/`, `pack-*`, `nocompress/`,
	96	+	`sig/`, `seal/`, `receipt/`), and the pack code reads a packed
	97	+	object with one ranged read. A directory store is as fast as the
	98	+	files were: the same stats, reads and syncs, with a batch of loose
	99	+	objects synced together. What must be on this disk, a pack being
	100	+	streamed out and the derived `metas` cache, lives in a scratch
	101	+	directory, which for a directory store is the store itself.
96	102		- The `object_store` crate (Apache Arrow) for S3 and GCS: one API
97	103		for both, mature credential chains, multipart uploads, and conditional
98	104		puts. Azure is in the same crate, so it comes nearly free later.
		…	2 unchanged lines
101	107		is missing? The client sends packs, never loose objects.
102	108		- A local cache of fetched objects, which is always correct because
103	109		objects never change.
104		-	- The working repository stays local. A bucket is a remote. Running
105		-	a repository from a bucket (no local `.oxy/`) is out of scope here;
106		-	it is what the virtual working copy (§8) is for.
	110	+	- The working repository stays local for now. A bucket is a remote.
	111	+	Running a repository from a bucket is plan B (oxygen#68): a `Repo`
	112	+	opened over a bucket store with a local cache in front, so the hub
	113	+	holds no copy of its own and the data lives where its owner chose.
	114	+	B1 (the store over the trait) is done; B2 is the caching store and
	115	+	the references by compare-and-swap.
107	116
108	117		## 4. Layout in the bucket (as built, 2026-10-03)
109	118
		…	104 unchanged lines
214	223		## 8. Order of work (done)
215	224
216	225		1. ✔ The `Store` trait in oxy-core, with a directory store and an
217		-	in-memory one; the working repository's own store left as it was.
	226	+	in-memory one; the working repository's own store left as it was,
	227	+	then (B1, 2026-10-04) put behind the trait with the same layout.
218	228		2. ✔ The bucket layout and the store remote, tested with no network.
219	229		3. ✔ S3, GCS and Azure stores, in `crates/oxy-strata`, verified
220	230		against the real services.
		…	29 unchanged lines

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

		…	9 unchanged lines
10	10		//! a directory. Two writers can therefore share a store with no lock
11	11		//! server: the loser of a race reads again, merges, and tries again.
12	12		//!
13		-	//! The working repository (`.oxy/`) is not a `Store`; it is read and
14		-	//! written directly, as before. A store is what a remote is kept on.
15		-	//! This module holds the trait, a directory store, an in-memory store
16		-	//! for tests, and the conformance check every store must pass. Cloud
17		-	//! stores live in a crate of their own, because of what they pull in.
	13	+	//! A repository's own objects (`.oxy/objects`, see [`crate::store`]) are
	14	+	//! kept on a store too, a directory one, with the same keys a bucket
	15	+	//! would hold; a remote is a store as well. This module holds the trait,
	16	+	//! a directory store, an in-memory store for tests, and the conformance
	17	+	//! check every store must pass. Cloud stores live in a crate of their
	18	+	//! own, because of what they pull in.
18	19
19	20		use std::collections::BTreeMap;
20	21		use std::fs;
		…	17 unchanged lines
38	39		pub struct Entry {
39	40		pub key: String,
40	41		pub size: u64,
	42	+	/// When the object was written, in wall milliseconds, where the store
	43	+	/// knows (garbage collection's grace period reads it).
	44	+	pub modified_ms: Option<u64>,
41	45		}
42	46
43	47		#[derive(Debug, thiserror::Error)]
		…	71 unchanged lines
115	119		fn list(&self, prefix: &str) -> Result<Vec<Entry>>;
116	120		/// Remove an object; fine when it is already gone.
117	121		fn delete(&self, key: &str) -> Result<()>;
	122	+	/// One object's listing entry without listing its neighbours; `None`
	123	+	/// when there is none.
	124	+	fn stat(&self, key: &str) -> Result<Option<Entry>> {
	125	+	Ok(self.list(key)?.into_iter().find(\|e\| e.key == key))
	126	+	}
	127	+	/// Write several objects that do not exist yet; one that does is left
	128	+	/// as it is, which is not an error (objects are named by content). A
	129	+	/// store that can batch its syncs does; this does them one at a time.
	130	+	fn put_many_new(&self, objects: &[(String, Vec<u8>)]) -> Result<()> {
	131	+	for (key, bytes) in objects {
	132	+	match self.put_new(key, bytes) {
	133	+	Ok(()) \| Err(Error::Exists(_)) => {}
	134	+	Err(e) => return Err(e),
	135	+	}
	136	+	}
	137	+	Ok(())
	138	+	}
	139	+	/// `put_new` of a file's contents: a store on the same disk can move
	140	+	/// the file into place instead of copying it.
	141	+	fn put_new_file(&self, key: &str, path: &Path) -> Result<()> {
	142	+	self.put_new(key, &fs::read(path)?)
	143	+	}
118	144
119	145		// ---- references: one small record, updated by compare-and-swap
120	146
		…	89 unchanged lines
210	236		self.list_dir(&entry.path(), &key, prefix, out)?;
211	237		}
212	238		} else if ty.is_file() && key.starts_with(prefix) {
	239	+	let meta = entry.metadata()?;
213	240		out.push(Entry {
214	241		key,
215		-	size: entry.metadata()?.len(),
	242	+	size: meta.len(),
	243	+	modified_ms: modified_ms(&meta),
216	244		});
217	245		}
218	246		}
		…	34 unchanged lines
253	281		std::thread::sleep(Duration::from_millis(10));
254	282		}
255	283		Err(e) => return Err(e.into()),
	284	+	}
	285	+	}
	286	+	}
	287	+	}
	288	+
	289	+	/// A file's modification time as wall milliseconds.
	290	+	fn modified_ms(meta: &fs::Metadata) -> Option<u64> {
	291	+	meta.modified()
	292	+	.ok()
	293	+	.and_then(\|t\| t.duration_since(std::time::UNIX_EPOCH).ok())
	294	+	.map(\|d\| d.as_millis() as u64)
	295	+	}
	296	+
	297	+	impl LocalStore {
	298	+	/// Link `tmp` into `path`, create-only; the directory is synced and
	299	+	/// `tmp` removed either way. `Exists` when the name is taken.
	300	+	fn link_into_place(&self, key: &str, tmp: &Path, path: &Path) -> Result<()> {
	301	+	let linked = fs::hard_link(tmp, path);
	302	+	let _ = fs::remove_file(tmp);
	303	+	match linked {
	304	+	Ok(()) => {
	305	+	if let Some(dir) = path.parent() {
	306	+	crate::durable::sync_dir(dir)?;
	307	+	}
	308	+	Ok(())
	309	+	}
	310	+	Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
	311	+	Err(Error::Exists(key.to_string()))
256	312		}
	313	+	Err(e) => Err(e.into()),
	314	+	}
	315	+	}
	316	+
	317	+	/// Create `path`'s directory, syncing the first directory that was
	318	+	/// made so its entry is durable too.
	319	+	fn ensure_dir(&self, path: &Path) -> Result<()> {
	320	+	let Some(dir) = path.parent() else {
	321	+	return Ok(());
	322	+	};
	323	+	if dir.is_dir() {
	324	+	return Ok(());
	325	+	}
	326	+	let mut made = dir.to_path_buf();
	327	+	while let Some(parent) = made.parent() {
	328	+	if parent.is_dir() \|\| parent == self.root {
	329	+	break;
	330	+	}
	331	+	made = parent.to_path_buf();
	332	+	}
	333	+	fs::create_dir_all(dir)?;
	334	+	if let Some(parent) = made.parent() {
	335	+	crate::durable::sync_dir(parent)?;
257	336		}
	337	+	Ok(())
258	338		}
259	339		}
260	340
261	341		impl Store for LocalStore {
262	342		fn describe(&self) -> String {
263	343		self.root.display().to_string()
	344	+	}
	345	+
	346	+	fn stat(&self, key: &str) -> Result<Option<Entry>> {
	347	+	match fs::metadata(self.path(key)?) {
	348	+	Ok(m) if m.is_file() => Ok(Some(Entry {
	349	+	key: key.to_string(),
	350	+	size: m.len(),
	351	+	modified_ms: modified_ms(&m),
	352	+	})),
	353	+	Ok(_) => Ok(None),
	354	+	Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
	355	+	Err(e) => Err(e.into()),
	356	+	}
	357	+	}
	358	+
	359	+	/// Every file written and synced (on every core), then each linked
	360	+	/// into place and each directory synced once: durable when this
	361	+	/// returns, as one at a time would be, with far fewer waits.
	362	+	fn put_many_new(&self, objects: &[(String, Vec<u8>)]) -> Result<()> {
	363	+	use rayon::prelude::*;
	364	+	let mut todo: Vec<(PathBuf, PathBuf, &[u8])> = Vec::new();
	365	+	for (key, bytes) in objects {
	366	+	let path = self.path(key)?;
	367	+	if path.exists() \|\| todo.iter().any(\|(p, ..)\| *p == path) {
	368	+	continue;
	369	+	}
	370	+	self.ensure_dir(&path)?;
	371	+	todo.push((path.clone(), self.temp_beside(&path), bytes));
	372	+	}
	373	+	if todo.is_empty() {
	374	+	return Ok(());
	375	+	}
	376	+	crate::durable::step("write loose objects")?;
	377	+	todo.par_iter()
	378	+	.try_for_each(\|(_, tmp, bytes)\| -> io::Result<()> {
	379	+	let mut f = fs::File::create(tmp)?;
	380	+	f.write_all(bytes)?;
	381	+	f.sync_all()
	382	+	})?;
	383	+	crate::durable::step("rename loose objects")?;
	384	+	let mut dirs: std::collections::BTreeSet<PathBuf> = std::collections::BTreeSet::new();
	385	+	for (path, tmp, _) in &todo {
	386	+	let linked = fs::hard_link(tmp, path);
	387	+	let _ = fs::remove_file(tmp);
	388	+	match linked {
	389	+	Ok(()) => {
	390	+	if let Some(d) = path.parent() {
	391	+	dirs.insert(d.to_path_buf());
	392	+	}
	393	+	}
	394	+	Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {}
	395	+	Err(e) => return Err(e.into()),
	396	+	}
	397	+	}
	398	+	dirs.par_iter()
	399	+	.try_for_each(\|d\| crate::durable::sync_dir(d))?;
	400	+	Ok(())
264	401		}
265	402
	403	+	/// The file is linked into place when it is on this file system,
	404	+	/// else copied; it is removed either way.
	405	+	fn put_new_file(&self, key: &str, file: &Path) -> Result<()> {
	406	+	let path = self.path(key)?;
	407	+	if path.exists() {
	408	+	let _ = fs::remove_file(file);
	409	+	return Err(Error::Exists(key.to_string()));
	410	+	}
	411	+	self.ensure_dir(&path)?;
	412	+	match fs::hard_link(file, &path) {
	413	+	Ok(()) => {
	414	+	let _ = fs::remove_file(file);
	415	+	if let Some(dir) = path.parent() {
	416	+	crate::durable::sync_dir(dir)?;
	417	+	}
	418	+	Ok(())
	419	+	}
	420	+	Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
	421	+	let _ = fs::remove_file(file);
	422	+	Err(Error::Exists(key.to_string()))
	423	+	}
	424	+	Err(_) => {
	425	+	// Another file system: copy beside the name, then link.
	426	+	let tmp = self.temp_beside(&path);
	427	+	let copied = (\|\| {
	428	+	let mut src = fs::File::open(file)?;
	429	+	let mut dst = fs::File::create(&tmp)?;
	430	+	io::copy(&mut src, &mut dst)?;
	431	+	dst.sync_all()
	432	+	})();
	433	+	let _ = fs::remove_file(file);
	434	+	copied?;
	435	+	self.link_into_place(key, &tmp, &path)
	436	+	}
	437	+	}
	438	+	}
	439	+
266	440		fn has(&self, key: &str) -> Result<bool> {
267	441		Ok(self.path(key)?.is_file())
268	442		}
		…	33 unchanged lines
302	476		let path = self.path(key)?;
303	477		if path.exists() {
304	478		return Err(Error::Exists(key.to_string()));
305		-	}
306		-	if let Some(dir) = path.parent() {
307		-	fs::create_dir_all(dir)?;
308	479		}
	480	+	self.ensure_dir(&path)?;
309	481		// Written beside its name, then linked into it: the link fails if
310	482		// the name was taken meanwhile, and a reader never sees a part.
311	483		let tmp = self.temp_beside(&path);
		…	2 unchanged lines
314	486		f.write_all(bytes)?;
315	487		f.sync_all()
316	488		})();
317		-	let linked = written.and_then(\|()\| fs::hard_link(&tmp, &path));
318		-	let _ = fs::remove_file(&tmp);
319		-	match linked {
320		-	Ok(()) => {
321		-	if let Some(dir) = path.parent() {
322		-	crate::durable::sync_dir(dir)?;
323		-	}
324		-	Ok(())
325		-	}
326		-	Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
327		-	Err(Error::Exists(key.to_string()))
328		-	}
329		-	Err(e) => Err(e.into()),
	489	+	if let Err(e) = written {
	490	+	let _ = fs::remove_file(&tmp);
	491	+	return Err(e.into());
330	492		}
	493	+	self.link_into_place(key, &tmp, &path)
331	494		}
332	495
333	496		fn list(&self, prefix: &str) -> Result<Vec<Entry>> {
		…	47 unchanged lines
381	544		/// cloud stores' do.
382	545		#[derive(Default)]
383	546		pub struct MemoryStore {
384		-	objects: Mutex<BTreeMap<String, Vec<u8>>>,
	547	+	objects: Mutex<BTreeMap<String, (Vec<u8>, u64)>>,
385	548		}
386	549
	550	+	fn now_ms() -> u64 {
	551	+	std::time::SystemTime::now()
	552	+	.duration_since(std::time::UNIX_EPOCH)
	553	+	.map(\|d\| d.as_millis() as u64)
	554	+	.unwrap_or(0)
	555	+	}
	556	+
387	557		impl MemoryStore {
388	558		pub fn new() -> MemoryStore {
389	559		MemoryStore::default()
390	560		}
391	561
392		-	fn map(&self) -> std::sync::MutexGuard<'_, BTreeMap<String, Vec<u8>>> {
	562	+	fn map(&self) -> std::sync::MutexGuard<'_, BTreeMap<String, (Vec<u8>, u64)>> {
393	563		self.objects.lock().unwrap_or_else(\|p\| p.into_inner())
	564	+	}
	565	+
	566	+	/// Pretend `key` was written `age` ago (for grace-period tests).
	567	+	pub fn age(&self, key: &str, age: Duration) {
	568	+	if let Some(entry) = self.map().get_mut(key) {
	569	+	entry.1 = now_ms().saturating_sub(age.as_millis() as u64);
	570	+	}
394	571		}
395	572		}
396	573
		…	11 unchanged lines
408	585		check_key(key)?;
409	586		self.map()
410	587		.get(key)
411		-	.cloned()
	588	+	.map(\|(b, _)\| b.clone())
412	589		.ok_or_else(\|\| Error::NotFound(key.to_string()))
413	590		}
414	591
		…	15 unchanged lines
430	607		if map.contains_key(key) {
431	608		return Err(Error::Exists(key.to_string()));
432	609		}
433		-	map.insert(key.to_string(), bytes.to_vec());
	610	+	map.insert(key.to_string(), (bytes.to_vec(), now_ms()));
434	611		Ok(())
435	612		}
436	613
		…	2 unchanged lines
439	616		.map()
440	617		.range(prefix.to_string()..)
441	618		.take_while(\|(k, _)\| k.starts_with(prefix))
442		-	.map(\|(k, v)\| Entry {
	619	+	.map(\|(k, (v, t))\| Entry {
443	620		key: k.clone(),
444	621		size: v.len() as u64,
	622	+	modified_ms: Some(*t),
445	623		})
446	624		.collect())
447	625		}
		…	6 unchanged lines
454	632
455	633		fn read_ref(&self, key: &str) -> Result<Option<(Vec<u8>, Version)>> {
456	634		check_key(key)?;
457		-	Ok(self.map().get(key).map(\|b\| (b.clone(), content_version(b))))
	635	+	Ok(self
	636	+	.map()
	637	+	.get(key)
	638	+	.map(\|(b, _)\| (b.clone(), content_version(b))))
458	639		}
459	640
460	641		fn write_ref(&self, key: &str, bytes: &[u8], expected: Option<&Version>) -> Result<Version> {
461	642		check_key(key)?;
462	643		let mut map = self.map();
463		-	let current = map.get(key).map(\|b\| content_version(b));
	644	+	let current = map.get(key).map(\|(b, _)\| content_version(b));
464	645		check_expected(key, current.as_ref(), expected)?;
465		-	map.insert(key.to_string(), bytes.to_vec());
	646	+	map.insert(key.to_string(), (bytes.to_vec(), now_ms()));
466	647		Ok(content_version(bytes))
467	648		}
468	649		}
		…	59 unchanged lines
528	709		passed.push("objects are written once");
529	710
530	711		store.put_new(&key("dir/b"), b"bb")?;
531		-	let listed = store.list(prefix)?;
	712	+	let listed: Vec<(String, u64)> = store
	713	+	.list(prefix)?
	714	+	.into_iter()
	715	+	.map(\|e\| (e.key, e.size))
	716	+	.collect();
532	717		expect(
533		-	listed
534		-	== vec![
535		-	Entry {
536		-	key: key("a"),
537		-	size: a.len() as u64,
538		-	},
539		-	Entry {
540		-	key: key("dir/b"),
541		-	size: 2,
542		-	},
543		-	],
	718	+	listed == vec![(key("a"), a.len() as u64), (key("dir/b"), 2)],
544	719		"list() does not return the two objects, sorted, with their sizes",
545	720		)?;
546	721		expect(
547		-	store.list(&key("dir/"))?
548		-	== vec![Entry {
549		-	key: key("dir/b"),
550		-	size: 2,
551		-	}],
	722	+	store
	723	+	.stat(&key("dir/b"))?
	724	+	.is_some_and(\|e\| e.key == key("dir/b") && e.size == 2)
	725	+	&& store.stat(&key("dir/c"))?.is_none(),
	726	+	"stat() does not describe one object, or describes a missing one",
	727	+	)?;
	728	+	expect(
	729	+	store
	730	+	.list(&key("dir/"))?
	731	+	.into_iter()
	732	+	.map(\|e\| (e.key, e.size))
	733	+	.collect::<Vec<_>>()
	734	+	== vec![(key("dir/b"), 2)],
552	735		"list() of a sub-prefix is wrong",
553	736		)?;
554	737		expect(
		…	181 unchanged lines

1		-	//! Object store (spec §13.1, §13.3, §13.4): loose objects, one file per
2		-	//! object under `objects/loose/<hh>/<rest>`, and packs, `pack-<id>.pack`
3		-	//! with a sorted `pack-<id>.idx`, holding zstd-compressed objects. Reads
4		-	//! check loose objects first, then every pack; every read re-hashes.
	1	+	//! Object store (spec §13.1, §13.3, §13.4): loose objects, one per key
	2	+	//! under `loose/<hh>/<rest>`, and packs, `pack-<id>.pack` with a sorted
	3	+	//! `pack-<id>.idx`, holding zstd-compressed objects. Reads check loose
	4	+	//! objects first, then every pack; every read re-hashes.
5	5		//!
	6	+	//! Everything is kept on a [`crate::strata::Store`] (docs/stores.md): a
	7	+	//! directory, which is what `.oxy/objects` is, or a bucket, which is how a
	8	+	//! repository lives in its owner's region with the hub as one client of
	9	+	//! it. The keys are the same wherever the store is, so a bucket holds
	10	+	//! exactly what a directory would, and a directory store is as fast as
	11	+	//! the files were before there was a trait: a loose object is one file, a
	12	+	//! packed one is one ranged read of the pack. What must be local, the
	13	+	//! pack being streamed out and the derived `metas` cache, lives in a
	14	+	//! scratch directory.
	15	+	//!
6	16		//! Pack file: `OXYPACK1` then entries of
7	17		//! `type u8 \| flags u8 (bit 0: zstd) \| stored_len u32 \| raw_len u32 \| ref 32 \| body`.
8	18		//! Index file: `OXYIDX01` then `count u32` then sorted entries of
9	19		//! `ref 32 \| offset u64 \| stored_len u32 \| raw_len u32 \| type u8 \| flags u8`.
	20	+	//!
	21	+	//! Beside the objects: `nocompress/<hex>` marks a chunk packs keep raw;
	22	+	//! `sig/<hh>/<rest>/<key>` holds one signature over an object, written
	23	+	//! once per signer; `seal/<hh>/<rest>/<attest>` and
	24	+	//! `receipt/<hh>/<rest>/<attest>` index the seals covering a change and
	25	+	//! the receipts on a state. Older stores hold these as one list per
	26	+	//! object (`sigs/`, `seals/`, `receipts/`), which are still read.
10	27
11	28		use crate::attest::Attest;
12	29		use crate::hash::{hash_object, header, ObjectRef, ObjectType};
13	30		use crate::identity::{Identity, Signature};
14	31		use crate::objects::{Blob, Change, ObjectError, StateObject};
15	32		use crate::receipt::Receipt;
	33	+	use crate::strata::{self, Error as BackendError, LocalStore, MemoryStore};
16	34		use rand::RngCore;
17	35		use std::cell::RefCell;
18	36		use std::fs;

The object store runs on any Store: a directory today, a bucket next 648189388f1a

Keyboard