Hold the working-copy lock through every working-copy write 6caacfff1d4f

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

pub use workspace::{FileLock, SnapshotLock, WorkingCopyLock, WorkspaceInfo};

    /// heads (it may then have several), a change beats a deletion, a

    /// workspace changed by both is an error (only one of them matches the

    /// files on disk), and otherwise this process's value wins for remote

        // Two operations that both replaced one workspace's working copy

        // cannot both be right: the files on disk match only one of them.

        // The working-copy lock keeps this from happening; should it happen

        // anyway, this operation is not recorded.

            |_, _| {

                fail(

                    "another oxy process changed this working copy at the same time; \

                     this command was not recorded: check `oxy status` and run it again",

                )

            },

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

        let _wc = self.lock_working_copy()?;

    // The working-copy lock: re-entrant in a thread; a lock whose process

    // is gone is taken over, and a live process's is not, however old.

    let again = repo.lock_working_copy().unwrap();

    drop(again);

    let age = |p: &Path| fs::File::open(p).unwrap().set_modified(old).unwrap();

    fs::write(&lock_path, std::process::id().to_string()).unwrap();

    age(&lock_path);

    assert!(

        !super::workspace::lock_is_stale(&lock_path),

        "a live process keeps its lock"

    );

    fs::write(&lock_path, "4294967295").unwrap();

    age(&lock_path);

}

#[test]

fn operations_that_both_replace_a_working_copy_are_not_merged() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "a.txt", b"a\n");

    let a = repo.commit("a", &[]).unwrap();

    write(root, "b.txt", b"b\n");

    repo.commit("b", &[]).unwrap();

    let (x, op) = repo.head_op().unwrap();

    let ws = *op.view.workspaces.keys().next().unwrap();

    let mut one = op.view.clone();

    one.workspaces.insert(ws, a);

    let mut two = op.view.clone();

    two.workspaces.insert(ws, ObjectRef([7; 32]));

    let first = repo.record_op(&[x], "one", one).unwrap();

    let e = repo.record_op(&[x], "two", two).unwrap_err();

    assert!(

        e.to_string()

            .contains("changed this working copy at the same time"),

        "{e}"

    );

    assert_eq!(

        repo.head_op().unwrap().0,

        first,

        "the second is not recorded"

    );

}

/// Metalgear, 2026-09-29 (oxygen#36): a status run while a bookmark switch

/// rewrote the working copy recorded the half-written files as edits, and

/// its view replaced the switch's.

#[test]

fn a_snapshot_during_a_switch_never_records_the_switch_as_edits() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path().to_path_buf();

    let mut repo = Repo::init(&root).unwrap();

    write(&root, "keep.txt", b"keep\n");

    repo.commit("base", &[]).unwrap();

    repo.bookmark_create("small", None).unwrap();

    for i in 0..300 {

        write(

            &root,

            &format!("many/f{i}.txt"),

            format!("file {i}\n").as_bytes(),

        );

    }

    repo.commit("many", &[]).unwrap();

    let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));

    let watcher = {

        let (root, stop) = (root.clone(), stop.clone());

        std::thread::spawn(move || {

            let r = Repo::open(&root).unwrap();

            let mut ran = 0;

            while !stop.load(std::sync::atomic::Ordering::Relaxed) {

                if r.snapshot_status("oxy status").is_ok() {

                    ran += 1;

                }

            }

            ran

        })

    };

    for i in 0..20 {

        let to = if i % 2 == 0 { "small" } else { "main" };

        repo.bookmark_switch(to, false).unwrap();

    }

    stop.store(true, std::sync::atomic::Ordering::Relaxed);

    assert!(watcher.join().unwrap() > 0, "the watcher snapshotted");

    // Back on main, clean, with every file where main has it.

    let repo = Repo::open(&root).unwrap();

    let s = repo.snapshot_status("oxy status").unwrap();

    assert!(s.statuses.is_empty(), "{:?}", statuses(&s));

    assert!(s.wc.edits.is_empty() && s.wc.tree_ops.is_empty());

    assert_eq!(s.wc.deps, repo.bookmark_heads().unwrap());

    assert!(root.join("many/f299.txt").exists());

/// A lock file, taken by creating it exclusively and released on drop: a

/// workspace's working-copy lock, the operation head's lock. A stale one,

/// whose process is gone (or, where that cannot be told, older than a

/// minute), is taken over.

/// A workspace's working-copy lock (spec §12.1), held by everything that

/// reads or writes the working copy and records its working-copy change:

/// snapshot, checkout, bookmark switch, commit, discard, pull. It is

/// re-entrant within a thread, so a checkout that snapshots first holds it

/// once.

pub struct WorkingCopyLock {

    path: PathBuf,

    _file: Option<FileLock>,

}

/// The working-copy lock; its old name.

pub type SnapshotLock = WorkingCopyLock;

thread_local! {

    /// Working-copy locks this thread holds, with their depth.

    static HELD: std::cell::RefCell<HashMap<PathBuf, usize>> = Default::default();

}

impl Drop for WorkingCopyLock {

    fn drop(&mut self) {

        HELD.with(|h| {

            let mut h = h.borrow_mut();

            if let Some(n) = h.get_mut(&self.path) {

                *n -= 1;

                if *n == 0 {

                    h.remove(&self.path);

                }

            }

        });

    }

}

/// Whether the process that wrote a lock file is gone. Where that cannot

/// be told (no `/proc`), a lock older than a minute counts as stale.

pub(crate) fn lock_is_stale(path: &Path) -> bool {

    let old = fs::metadata(path)

        .and_then(|m| m.modified())

        .map(|t| t.elapsed().map(|d| d.as_secs() > 60).unwrap_or(false))

        .unwrap_or(true);

    let proc_fs = Path::new("/proc/self").exists();

    match fs::read_to_string(path)

        .ok()

        .and_then(|s| s.trim().parse::<u32>().ok())

    {

        Some(pid) if proc_fs => !Path::new("/proc").join(pid.to_string()).exists(),

        // Being written this instant, or by something that is not oxy.

        _ => old,

    }

}

        Self::acquire_within(path, busy, std::time::Duration::from_secs(5))

    }

    /// Wait up to `wait` for `path`; `busy` is the error after that.

    pub(crate) fn acquire_within(

        path: PathBuf,

        busy: &str,

        wait: std::time::Duration,

    ) -> Result<FileLock> {

        let until = std::time::Instant::now() + wait;

        loop {

                    if lock_is_stale(&path) {

                    if std::time::Instant::now() >= until {

                        return fail(busy);

                    }

        self.lock_working_copy()

    }

    /// Take this workspace's working-copy lock (spec §12.1), waiting up to

    /// a minute for another process's checkout or snapshot to finish.

    pub fn lock_working_copy(&self) -> Result<WorkingCopyLock> {

        if self.bare {

            // No working copy to guard.

            return Ok(WorkingCopyLock {

                path: dir,

                _file: None,

            });

        }

        let path = dir.join("lock");

        let held = HELD.with(|h| {

            let mut h = h.borrow_mut();

            match h.get_mut(&path) {

                Some(n) => {

                    *n += 1;

                    true

                }

                None => false,

            }

        });

        if held {

            return Ok(WorkingCopyLock { path, _file: None });

        }

        let file = FileLock::acquire_within(

            path.clone(),

            "another oxy process is using this working copy (a checkout or snapshot); try again when it finishes",

            std::time::Duration::from_secs(60),

        )?;

        HELD.with(|h| h.borrow_mut().insert(path.clone(), 1));

        Ok(WorkingCopyLock {

            path,

            _file: Some(file),

        })

| **Status** | Draft 0.8r |

`view` is the complete state of all references and workspaces after the operation. The operation log is a DAG. The head (`.oxy/ops/head`) moves by compare-and-swap under a short lock (`.oxy/ops/lock`), held only while the pointer is written: a process that finds the head is no longer the parent it built on records a merge operation with both as parents, whose view is the three-way merge of the two views against that parent. A reference changed on one side takes that side's value; changed differently on both, a bookmark keeps both sides' heads (it then has several), a change beats a deletion, a tag keeps its first value, remote references and the policy take the later process's value, and a workspace changed by both is an error: the later operation is not recorded, since the files on disk match only one of the two working-copy changes. `oxy undo` refuses when the head moved while it ran.

Because all mutation goes through the operation log and object writes are idempotent, no long-held repository lock is needed: the operation head's lock covers one pointer write. Each workspace has a **working-copy lock** (`.oxy/workspaces/<id>/lock`), held by every command that reads or writes the working copy and replaces its working-copy change (snapshot, checkout, bookmark switch, merge, commit, amend and rewrites, discard, pull), from reading the operation head until its operation is recorded. A snapshot therefore never sees a half-written checkout, and never records one as edits. The lock is re-entrant within a process thread; a waiting command gives up after a minute and says why; a lock whose process is gone is taken over, and where that cannot be told, one older than a minute.

*Changelog.* Draft 0.8r (2026-09-29): the working-copy lock covers every command that writes the working copy; a workspace changed by two concurrent operations is an error (§12.1). Draft 0.8q (2026-09-29): change format version 2 stores large inserts as text blobs, so a change does not grow with the files it adds (§6.1, §7.4); no object may exceed 1 GiB (§13.2). Draft 0.8p (2026-09-29): Git import derives new NodeIds from the commit, making imports deterministic (§23). Draft 0.8o (2026-09-29): execution receipts, the `receipt` object and attestation (§14.6). Draft 0.8n (2026-09-29): line history, `oxy log -L` (§27). Draft 0.8m (2026-09-29): resolving replace conflicts (§9.3). Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).