Store large inserts as text blobs (change format 2) 6f8aeb996558

/// The canonical encoding of an array of byte strings, written without

/// building a [`Value`] (large inserts stored as text blobs, spec §6.1).

pub fn encode_byte_strings(items: &[Vec<u8>]) -> Vec<u8> {

    let mut out = Vec::with_capacity(byte_strings_len(items));

    head(&mut out, 4, items.len() as u64);

    for b in items {

        head(&mut out, 2, b.len() as u64);

        out.extend_from_slice(b);

    }

    out

}

/// The length of [`encode_byte_strings`]' output, without encoding.

pub fn byte_strings_len(items: &[Vec<u8>]) -> usize {

    head_len(items.len() as u64)

        + items

            .iter()

            .map(|b| head_len(b.len() as u64) + b.len())

            .sum::<usize>()

}

fn head_len(n: u64) -> usize {

    match n {

        0..=23 => 1,

        24..=0xff => 2,

        0x100..=0xffff => 3,

        0x1_0000..=0xffff_ffff => 5,

        _ => 9,

    }

}

/// The change format writers produce (spec §6.1). Version 2 stores each

/// large insert's lines as a text blob; readers accept 1 and 2, and a

/// change keeps the version it was made in, so its hash never moves.

pub const CHANGE_VERSION: u64 = 2;

/// In a version 2 change, an insert whose lines encode (as a CBOR array of

/// byte strings) to at least this many bytes is stored as a text blob

/// holding exactly that encoding; a shorter one is inline (spec §6.1).

pub const TEXT_BLOB_MIN: usize = 4096;

    }

    /// Whether this insert is stored as a text blob in a change of `version`.

    fn stored_text(&self, version: u64) -> bool {

        matches!(self, Edit::Insert { lines, .. }

            if version >= 2 && cbor::byte_strings_len(lines) >= TEXT_BLOB_MIN)

    fn to_value(&self, version: u64, texts: &mut Option<&mut Vec<StoredText>>) -> Value {

            } if self.stored_text(version) => {

                let content = cbor::encode_byte_strings(lines);

                let blob = Blob::of(&content);

                let r = blob.hash();

                if let Some(t) = texts {

                    t.push(StoredText { blob, content });

                }

                Value::map([

                    (0, Value::Uint(0)),

                    (1, nid(node)),

                    (2, after.to_value()),

                    (3, before.to_value()),

                    (5, Value::Bytes(r.0.to_vec())),

                    (6, Value::Uint(lines.len() as u64)),

                ])

            }

            Edit::Insert {

                node,

                after,

                before,

                lines,

    fn from_value(v: &Value, version: u64, resolve: &mut Resolver) -> Result<Edit, ObjectError> {

                let lines = match (m.get(&4), m.get(&5)) {

                    (Some(inline), None) => {

                        let lines = array(inline, "lines")?

                            .iter()

                            .map(|l| bytes(l, "line").map(|b| b.to_vec()))

                            .collect::<Result<Vec<_>, _>>()?;

                        if version >= 2 && cbor::byte_strings_len(&lines) >= TEXT_BLOB_MIN {

                            return schema("an insert this large is stored as a text blob in a version 2 change");

                        }

                        lines

                    }

                    (None, Some(text)) if version >= 2 => {

                        let text = oref(text, "insert text")?;

                        let count = u32_(field(m, 6, "insert line count")?, "insert line count")?;

                        if count == 0 {

                            return schema("insert with no lines");

                        }

                        // The resolver checks the count (`text_lines`).

                        resolve(&text, count)?

                    }

                    _ => {

                        return schema(

                            "an insert has either its lines or, in a version 2 change, a text blob",

                        )

                    }

                };

    /// The format this change is encoded in: [`CHANGE_VERSION`] for a new

    /// one, whatever it was made in for one read back.

    pub version: u64,

        self.value_with(&mut None)

    }

    fn value_with(&self, texts: &mut Option<&mut Vec<StoredText>>) -> Value {

            (0, Value::Uint(self.version)),

                Value::Array(

                    self.edits

                        .iter()

                        .map(|e| e.to_value(self.version, texts))

                        .collect(),

                ),

    /// The encoding and the text blobs its large inserts are stored as,

    /// which must be stored with it.

    pub fn encode_parts(&self) -> (Vec<u8>, Vec<StoredText>) {

        debug_assert!(

            self.deps.windows(2).all(|w| w[0] < w[1]),

            "deps must be normalized"

        );

        let mut texts = Vec::new();

        let bytes = cbor::encode(&self.value_with(&mut Some(&mut texts)));

        (bytes, texts)

    }

    /// Whether any insert is stored as a text blob.

    pub fn has_stored_text(&self) -> bool {

        self.edits.iter().any(|e| e.stored_text(self.version))

    }

    /// Decode a change that stores no text blob; one that does needs

    /// [`Change::decode_with`] and something to read them from.

        Self::decode_with(bytes, &mut |r, _| {

            schema(format!(

                "text blob {} needs a store to read it from",

                r.short(12)

            ))

        })

    }

    /// Decode a change, reading each stored insert's lines with `resolve`

    /// (given the text blob and the line count the insert claims).

    pub fn decode_with(bytes: &[u8], resolve: &mut Resolver) -> Result<Change, ObjectError> {

        Self::from_value_with(&v, resolve)

        Self::from_value_with(v, &mut |r, _| {

            schema(format!(

                "text blob {} needs a store to read it from",

                r.short(12)

            ))

        })

    }

    fn from_value_with(v: &Value, resolve: &mut Resolver) -> Result<Change, ObjectError> {

        let version = uint(field(m, 0, "version")?, "version")?;

        if !(1..=CHANGE_VERSION).contains(&version) {

            return schema(format!("unsupported change format version {version}"));

        }

            version,

                .map(|e| Edit::from_value(e, version, resolve))

/// Reads a stored insert's lines, given the text blob and the line count

/// the insert claims; [`text_lines`] reads and checks a blob's content.

pub type Resolver<'a> = dyn FnMut(&ObjectRef, u32) -> Result<Vec<Vec<u8>>, ObjectError> + 'a;

/// A large insert's lines as stored (spec §6.1): the blob and its content,

/// the canonical CBOR array of the lines' byte strings.

#[derive(Debug, Clone, PartialEq, Eq)]

pub struct StoredText {

    pub blob: Blob,

    pub content: Vec<u8>,

}

/// The lines a text blob's `content` holds, checked against the rules for

/// one: canonical, as many as the insert claims, and not short enough to

/// have been inline.

pub fn text_lines(content: &[u8], count: u32) -> Result<Vec<Vec<u8>>, ObjectError> {

    if content.len() < TEXT_BLOB_MIN {

        return schema(format!(

            "a text blob of {} bytes is short enough to be inline",

            content.len()

        ));

    }

    let v = cbor::decode(content)?;

    let lines = array(&v, "text blob")?

        .iter()

        .map(|l| bytes(l, "line").map(|b| b.to_vec()))

        .collect::<Result<Vec<_>, _>>()?;

    if lines.len() != count as usize {

        return schema(format!(

            "a text blob holds {} lines, the insert says {count}",

            lines.len()

        ));

    }

    Ok(lines)

}

    /// The blob for `content`: its chunks as content-defined chunking cuts

    /// them (spec §13.2).

    pub fn of(content: &[u8]) -> Blob {

        Blob {

            length: content.len() as u64,

            chunks: crate::chunk::chunks(content)

                .into_iter()

                .map(|c| hash_object(ObjectType::Chunk, c))

                .collect(),

        }

    }

            version: crate::objects::CHANGE_VERSION,

            m.insert(0, Value::Uint(3));

    }

    fn big_lines(n: usize) -> Vec<Vec<u8>> {

        (0..n)

            .map(|i| format!("line {i} of a large insert\n").into_bytes())

            .collect()

    }

    fn with_insert(mut c: Change, lines: Vec<Vec<u8>>) -> Change {

        c.edits[0] = Edit::Insert {

            node: NodeId([7; 16]),

            after: AtomRef::Start,

            before: AtomRef::End,

            lines,

        };

        c

    }

    #[test]

    fn large_inserts_are_stored_as_text_blobs() {

        assert!(

            !sample_change().has_stored_text(),

            "a small insert stays inline"

        );

        let lines = big_lines(500);

        let c = with_insert(sample_change(), lines.clone());

        assert!(c.has_stored_text());

        let (bytes, texts) = c.encode_parts();

        assert_eq!(bytes, c.encode());

        assert!(bytes.len() < 1024, "{}", bytes.len());

        assert_eq!(texts.len(), 1);

        assert_eq!(texts[0].content, cbor::encode_byte_strings(&lines));

        assert_eq!(texts[0].blob, Blob::of(&texts[0].content));

        assert!(Change::decode(&bytes).is_err(), "reading it needs the text");

        let d = Change::decode_with(&bytes, &mut |r, n| {

            assert_eq!(*r, texts[0].blob.hash());

            text_lines(&texts[0].content, n)

        })

        .unwrap();

        assert_eq!(d, c);

        assert_eq!(d.hash(), c.hash());

    }

    #[test]

    fn version_1_changes_keep_their_inline_inserts_and_hashes() {

        let mut c = with_insert(sample_change(), big_lines(500));

        c.version = 1;

        let bytes = c.encode();

        assert!(bytes.len() > TEXT_BLOB_MIN);

        let (again, texts) = c.encode_parts();

        assert!(texts.is_empty());

        assert_eq!(again, bytes);

        let d = Change::decode(&bytes).unwrap();

        assert_eq!(d.version, 1);

        assert_eq!(d.encode(), bytes);

        // The same inline insert in a version 2 change is not canonical.

        let mut v = c.to_value();

        if let Value::Map(m) = &mut v {

            m.insert(0, Value::Uint(2));

        }

        assert!(

            matches!(Change::from_value(&v), Err(ObjectError::Schema(s)) if s.contains("text blob"))

        );

    }

    #[test]

    fn text_blobs_are_checked() {

        let lines = big_lines(500);

        let content = cbor::encode_byte_strings(&lines);

        assert_eq!(content.len(), cbor::byte_strings_len(&lines));

        assert_eq!(

            content,

            cbor::encode(&Value::Array(

                lines.iter().map(|l| Value::Bytes(l.clone())).collect()

            ))

        );

        assert_eq!(text_lines(&content, 500).unwrap(), lines);

        assert!(text_lines(&content, 499).is_err());

        let small = cbor::encode_byte_strings(&[b"x\n".to_vec()]);

        assert!(text_lines(&small, 1).is_err(), "short enough to be inline");

    /// A bundle's value. Each change's text blobs and their chunks (spec

    /// §6.1) are added to its objects when they are not already there, so a

    /// bundle can always be read on its own.

        let mut changes = Vec::with_capacity(b.changes.len());

        let mut texts: Vec<(ObjectType, Vec<u8>)> = Vec::new();

        let mut listed: Option<std::collections::HashSet<ObjectRef>> = None;

        for (c, s) in &b.changes {

            let (bytes, stored) = c.encode_parts();

            for t in stored {

                let listed = listed.get_or_insert_with(|| {

                    b.objects

                        .iter()

                        .map(|(ty, body)| crate::hash::hash_object(*ty, body))

                        .collect()

                });

                if !listed.insert(t.blob.hash()) {

                    continue;

                }

                for chunk in crate::chunk::chunks(&t.content) {

                    if listed.insert(crate::hash::hash_object(ObjectType::Chunk, chunk)) {

                        texts.push((ObjectType::Chunk, chunk.to_vec()));

                    }

                }

                texts.push((ObjectType::Blob, t.blob.encode()));

            }

            changes.push(Value::Array(vec![Value::Bytes(bytes), sigs_value(s)]));

        }

            (0, Value::Array(changes)),

                        .chain(&texts)

        }

        // Stored inserts are read from the bundle's own objects.

        let mut by_ref: Option<std::collections::HashMap<ObjectRef, usize>> = None;

        for c in o::array(field(m, 0, "changes")?, "changes")? {

            let pair = o::array(c, "change entry")?;

            if pair.len() != 2 {

                return Err(schema("change entry: expected [change, sigs]"));

            }

            let change = Change::decode_with(o::bytes(&pair[0], "change")?, &mut |text, count| {

                let by_ref = by_ref.get_or_insert_with(|| {

                    b.objects

                        .iter()

                        .enumerate()

                        .map(|(i, (ty, body))| (crate::hash::hash_object(*ty, body), i))

                        .collect()

                });

                let get =

                    |r: &ObjectRef, want: ObjectType| match by_ref.get(r).map(|i| &b.objects[*i]) {

                        Some((ty, body)) if *ty == want => Ok(body),

                        _ => Err(ObjectError::Schema(format!(

                            "the bundle lacks {} {}",

                            want.name(),

                            r.short(12)

                        ))),

                    };

                let blob = crate::objects::Blob::decode(get(text, ObjectType::Blob)?)?;

                let mut content = Vec::with_capacity(blob.length as usize);

                for chunk in &blob.chunks {

                    content.extend_from_slice(get(chunk, ObjectType::Chunk)?);

                }

                crate::objects::text_lines(&content, count)

            })?;

            b.changes.push((change, sigs_from(&pair[1])?));

        }

        for a in o::array(field(m, 1, "attests")?, "attests")? {

            b.attests.push(attest_from(a)?);

        // Structure only: the text blobs are checked with the change graph.

        ObjectType::Change => {

            Change::decode_with(body, &mut |_, _| Ok(vec![Vec::new()])).map(|_| ())

        }

            let c = match self.store.get_change_parts(&h) {

                Ok((c, texts)) => {

                    keep.extend(texts);

                    c

                }

                version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

        Blob::of(content)

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

#[test]

fn large_text_files_travel_and_survive_gc_as_text_blobs() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin_path = root.join("origin");

    Repo::init(&origin_path).unwrap();

    let origin_url = origin_path.to_string_lossy().to_string();

    let a = Repo::clone(&origin_url, &root.join("a")).unwrap();

    let big: String = (0..5000).map(|i| format!("line {i}\n")).collect();

    write(&root.join("a"), "big.txt", big.as_bytes());

    write(&root.join("a"), "small.txt", b"small\n");

    let h1 = a.commit("large", &[]).unwrap();

    let (_, body) = a.store().get(&h1).unwrap();

    assert!(body.len() < 2048, "the change is {} bytes", body.len());

    assert!(a.push("origin", false).unwrap()[0].ok);

    // A clone reads the text from the blobs that came with the change.

    let b = Repo::clone(&origin_url, &root.join("b")).unwrap();

    assert_eq!(fs::read(root.join("b/big.txt")).unwrap(), big.as_bytes());

    // An edit in the middle of the stored insert is an ordinary change.

    let edited = big.replace("line 2500\n", "line 2500, edited\n");

    write(&root.join("b"), "big.txt", edited.as_bytes());

    let h2 = b.commit("edit", &[]).unwrap();

    assert!(b.store().get_change(&h2).unwrap().edits.len() <= 2);

    assert!(b.push("origin", false).unwrap()[0].ok);

    assert!(a.pull("origin").unwrap().checked_out);

    assert_eq!(fs::read(root.join("a/big.txt")).unwrap(), edited.as_bytes());

    assert_eq!(

        a.fsck().unwrap().errors(),

        0,

        "{:?}",

        a.fsck().unwrap().problems

    );

    // With zero retention gc keeps the text blobs of every kept change.

    let mut a = Repo::open(&root.join("a")).unwrap();

    a.config.set("core.op-retention", "0").unwrap();

    a.save_config().unwrap();

    let a = Repo::open(&root.join("a")).unwrap();

    a.gc(true).unwrap();

    let a = Repo::open(&root.join("a")).unwrap();

    assert_eq!(a.store().get_change(&h1).unwrap().message, "large");

    assert_eq!(

        a.fsck().unwrap().errors(),

        0,

        "{:?}",

        a.fsck().unwrap().problems

    );

    // And a clone of the packed repository reads them from its packs.

    let c = Repo::clone(&root.join("a").to_string_lossy(), &root.join("c")).unwrap();

    assert_eq!(fs::read(root.join("c/big.txt")).unwrap(), edited.as_bytes());

    drop(c);

}

            version: crate::objects::CHANGE_VERSION,

            version: crate::objects::CHANGE_VERSION,

use crate::objects::{Blob, Change, ObjectError, StateObject};

    #[error("a {kind} object of {size} bytes is larger than the {limit} bytes an object may be; nothing was stored. A change this large adds or touches too many files at once: commit it in parts (a directory at a time)")]

    /// Store a change and the text blobs (and their chunks) its large

    /// inserts are stored as (spec §6.1).

        let (bytes, texts) = c.encode_parts();

        for t in texts {

            self.put_text(&t)?;

        }

        self.put(ObjectType::Change, &bytes)

    }

    fn put_text(&self, t: &crate::objects::StoredText) -> Result<ObjectRef> {

        let r = t.blob.hash();

        if self.has(&r) {

            return Ok(r);

        }

        for c in crate::chunk::chunks(&t.content) {

            self.put_chunk(c)?;

        }

        self.put(ObjectType::Blob, &t.blob.encode())

        Ok(self.get_change_parts(r)?.0)

    }

    /// A change and the objects its stored inserts are made of: each text

    /// blob and its chunks, which travel and are kept with it.

    pub fn get_change_parts(&self, r: &ObjectRef) -> Result<(Change, Vec<ObjectRef>)> {

        let bytes = self.get_typed(r, ObjectType::Change)?;

        let mut parts = Vec::new();

        let mut failed = None;

        let decoded = Change::decode_with(&bytes, &mut |text, count| match self.read_text(text) {

            Ok((blob, content)) => {

                parts.push(*text);

                parts.extend(blob.chunks);

                crate::objects::text_lines(&content, count)

            }

            Err(e) => {

                let why = e.to_string();

                failed = Some(e);

                Err(ObjectError::Schema(format!(

                    "text blob {}: {why}",

                    text.short(12)

                )))

            }

        });

        match (decoded, failed) {

            (Ok(c), _) => Ok((c, parts)),

            (Err(_), Some(StoreError::NotFound(t))) => Err(StoreError::Corrupt(

                *r,

                format!("its text blob {} is missing", t.short(12)),

            )),

            (Err(e), _) => Err(StoreError::Corrupt(*r, e.to_string())),

        }

    }

    fn read_text(&self, r: &ObjectRef) -> Result<(Blob, Vec<u8>)> {

        let blob = Blob::decode(&self.get_typed(r, ObjectType::Blob)?)?;

        let mut content = Vec::with_capacity(blob.length as usize);

        for c in &blob.chunks {

            content.extend(self.get_typed(c, ObjectType::Chunk)?);

        }

        Ok((blob, content))

    }

}

#[cfg(test)]

mod text_tests {

    use super::*;

    use crate::objects::{AtomRef, Edit, CHANGE_VERSION};

    fn large_change() -> Change {

        let mut c = crate::objects::tests::sample_change();

        assert_eq!(c.version, CHANGE_VERSION);

        c.edits[0] = Edit::Insert {

            node: crate::ids::NodeId([7; 16]),

            after: AtomRef::Start,

            before: AtomRef::End,

            lines: (0..2000)

                .map(|i| format!("line {i}\n").into_bytes())

                .collect(),

        };

        c

    }

    #[test]

    fn a_large_insert_is_stored_beside_its_change_and_read_back() {

        let dir = tempfile::tempdir().unwrap();

        let s = Store::open(dir.path()).unwrap();

        let c = large_change();

        let r = s.put_change(&c).unwrap();

        assert_eq!(r, c.hash());

        let (_, body) = s.get(&r).unwrap();

        assert!(

            body.len() < 1024,

            "the change holds a reference, not {} bytes of lines",

            body.len()

        );

        let (back, parts) = s.get_change_parts(&r).unwrap();

        assert_eq!(back, c);

        // The text blob and its chunk.

        assert_eq!(parts.len(), 2);

        for p in &parts {

            assert!(s.has(p));

        }

        // Storing it again writes nothing new.

        let n = s.list().unwrap().len();

        s.put_change(&c).unwrap();

        assert_eq!(s.list().unwrap().len(), n);

    }

    #[test]

    fn a_change_whose_text_blob_is_missing_is_reported_not_misread() {

        let dir = tempfile::tempdir().unwrap();

        let s = Store::open(dir.path()).unwrap();

        let c = large_change();

        let r = s.put_change(&c).unwrap();

        let (_, parts) = s.get_change_parts(&r).unwrap();

        fs::remove_file(s.path_for(&parts[0])).unwrap();

        let e = s.get_change(&r).unwrap_err();

        assert!(

            matches!(&e, StoreError::Corrupt(h, why) if *h == r && why.contains("missing")),

            "{e}"

        );

| **Status** | Draft 0.8q |

| **Format version** | 1 (changes: 2) |

| **Date** | 2026-09-29 |

| `Edit` | Map with key 0 = variant tag: 0 `Insert`, 1 `Delete`, 2 `Replace`; key 1 = node id; `Insert` adds 2 after, 3 before, and either 4 lines (array of byte strings) or, in a version 2 change, 5 text (the text blob's ObjectRef) and 6 count (the number of lines); `Delete` adds 2 atom ranges; `Replace` adds 2 old (bytes or null), 3 new (bytes or null). |

  version   [0]: 1 or 2

  extra     [9]: map                  // reserved; MUST be empty

Writers produce version 2. Versions 1 and 2 differ only in how an `Insert` holds its lines (§7.4): a version 1 change carries every inserted line inline, and a version 2 change stores each large insert as a **text blob** beside it, so no change grows with the size of the files it adds. Readers MUST accept both. A change keeps the version it was made in: rewriting its encoding would change its hash and invalidate its signatures.

Edit = Insert  { node: NodeId, after: AtomRef, before: AtomRef, lines: [bytes] | text: ObjectRef, count: u32 }

- **Text blobs.** In a version 2 change, an insert whose lines encode as a canonical CBOR array of byte strings to at least 4096 bytes MUST be stored as `text` and `count`: `text` is the blob (§13.2) whose content is exactly that encoding, and `count` is the number of lines, at least 1. A shorter insert MUST be inline. The rule is deterministic, so a change has one encoding and one hash, and identical inserts share their text blob. A reader rejects an inline insert that should have been stored, a text blob shorter than 4096 bytes, and a text blob whose lines do not number `count`. A text blob and its chunks belong to their change: they are carried with it by every transfer (§16.3), kept with it by garbage collection (§21), and checked with it by `fsck`. A change cannot be read without them, so they are never withheld from a partial clone (§13.5).

Chunks and blobs are the objects that carry content. Other objects are small in practice; a change holds its tree operations and inserts of under 4096 bytes, with larger inserts stored as text blobs (§7.4). No object may be larger than 1 GiB after encoding: a writer MUST refuse to store one and nothing of it is written.

| `Bundle` | `{0: [[change bytes, [Signature]]], 1: [signed attestation], 2: [[type name, object bytes]], 3: [signed policy]}`; changes in dependency order; objects are chunks, blobs, identities, and states only, and include the text blobs of every change in the bundle and their chunks, so a bundle can be read on its own; key 3 (optional) holds the policies between the receiver's serial and the one sent with a push, ascending |

An object is **reachable** if it is referenced, directly or transitively, from any bookmark, tag, policy, the current operation heads, any operation newer than `core.op-retention`, any workspace's working-copy change, or any checkpoint of a reachable state. `oxy gc` deletes unreachable objects that are older than `core.gc-grace` (default 14 days, to protect concurrent writers) and repacks. Tombstone atoms are never collected independently of their change. Divergent changes are reachable if any of their variants is. A change's text blobs and their chunks are reachable with it (§7.4). A seal is reachable if any change it covers is reachable, and reference attestations are reachable while they are the latest for their reference or are within `core.op-retention`.

`oxy fsck` reads everything and changes nothing. It checks (1) every stored object: header, length, ObjectRef, and that the body decodes as its type; (2) the operation log: every operation reachable from the head through all parents is present and decodes, and no operation's clock is earlier than its parent's (a warning); (3) the current view's bookmarks, tags, remote bookmarks, workspaces and policy, and the dependency closure of every change they name, with each change's author identity, text blobs, blobs and chunks, and each committed change's signature or seal (§14.4); (4) that every bookmark forms a valid state, that every checkpoint restores exactly the state of the changes it names (§11), and that reference and tag attestations carry valid signatures. A change beyond the shallow boundary (§17) may be absent; a blob absent from a partial clone (`filter.max-blob` or a sparse filter) is a warning, not an error. Each problem names the object it concerns. The exit status is 1 when any error is found and 0 otherwise; `--json` gives the counts and problems.

*Changelog.* Draft 0.8q (2026-09-29): change format version 2 stores large inserts as text blobs, so a change does not grow with the files it adds (§6.1, §7.4); no object may exceed 1 GiB (§13.2). Draft 0.8p (2026-09-29): Git import derives new NodeIds from the commit, making imports deterministic (§23). Draft 0.8o (2026-09-29): execution receipts, the `receipt` object and attestation (§14.6). Draft 0.8n (2026-09-29): line history, `oxy log -L` (§27). Draft 0.8m (2026-09-29): resolving replace conflicts (§9.3). Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).