A bare repository's default bookmark is its host's to protect 8c30d814f2cc

    /// at `old_state`, is never the bookmark a non-bare repository has

    /// checked out (a bare one's default is its host's to protect, see

    /// `oxy_server::Backend::default_bookmark`), and under a policy needs

    /// an attestation by a key that may update it.

        if !self.is_bare() && u.name == self.config.bookmark {

                "{:?} is this repository's default bookmark (checked out there) and cannot be deleted",

    fn default_bookmark(&self, name: &str) -> Option<String> {

        self.open(name).ok().map(|r| r.config.bookmark.clone())

    }

/// `oxy push --delete` over HTTP: a bare repository's bookmark goes, and

/// its default (the served repository's own bookmark) is refused by the

/// backend (spec §16.4).

#[test]

fn bookmarks_are_deleted_over_http_but_never_the_default() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    let hosted = Repo::init_bare(&served.join("lib")).unwrap();

    let base = start(&served, vec![]);

    let work = root.join("work");

    let client = Repo::clone(&format!("{base}/lib"), &work).unwrap();

    write(&work, "a.txt", b"a\n");

    client.commit("a", &[]).unwrap();

    assert!(client.push("origin", false).unwrap()[0].ok);

    client.bookmark_create("feature/x", None).unwrap();

    assert!(client.push_bookmark("origin", "feature/x", false).unwrap()[0].ok);

    let r = client.push_delete("origin", "feature/x").unwrap();

    assert!(r[0].ok, "{r:?}");

    assert!(!hosted.view().unwrap().bookmarks.contains_key("feature/x"));

    let r = client.push_delete("origin", "main").unwrap();

    assert!(

        !r[0].ok && r[0].reason.contains("default bookmark"),

        "{r:?}"

    );

    assert!(hosted.view().unwrap().bookmarks.contains_key("main"));

}

**Deleting a reference.** An update whose `new_state` is the zero ObjectRef deletes the bookmark (`oxy push REMOTE --delete NAME`). The bookmark MUST exist at `old_state`. A server MUST refuse to delete its default bookmark: in a bare repository that is the host's to name (the reference server's is the repository's configured bookmark, a forge's its default-bookmark setting), and in a non-bare repository it is the checked-out bookmark. The update is attested like any other: under a policy the attestation is required and its key MUST be authorized for the reference. The deletion's attestation stays the reference's latest, so an older attestation cannot be replayed to bring the bookmark back. The first attestation of a reference the remote does not list takes the client's clock in milliseconds as its serial, which is past the serial of any deleted namesake; later ones increment it. Changes of a deleted bookmark stay until unreachable (§21).