Git import: one node per directory path, and no placement out of sight a87c7b9d563a

        // Graphs (by key) and blobs already found equal to a Git blob.

        let mut verified_graphs: HashMap<[u8; 32], String> = HashMap::new();

        let mut verified_blobs: HashMap<ObjectRef, String> = HashMap::new();

            // History only: a file whose graph (by key) or blob was already

            // found equal to this Git blob is not built, rendered or read

            // again; the rest are.

            let mut state = self.load_state_history(&heads)?;

            let view = state.tree().view();

            let mut conflicted: Vec<String> =

                view.conflicts.iter().map(|c| format!("{c:?}")).collect();

            let mut need: Vec<NodeId> = Vec::new();

            for (path, (mode, sha)) in &tree {

                let Some(e) = view.entries.get(path) else {

                };

                if mode != "160000"

                    && mode != "120000"

                    && e.kind == NodeKind::File

                    && !e.mode.opaque

                {

                    let known = state

                        .graph_key(&e.node)

                        .is_some_and(|k| verified_graphs.get(&k) == Some(sha));

                    if !known {

                        need.push(e.node);

            // A graph's key is known only before it is built.

            let keys: HashMap<NodeId, [u8; 32]> = need

                .iter()

                .filter_map(|n| Some((*n, state.graph_key(n)?)))

                .collect();

            let need_set: HashSet<NodeId> = need.iter().copied().collect();

            self.load_graphs_of(&mut state, &need)?;

                let Some(e) = view.entries.get(path) else {

                    "160000" => {

                        let blobs = state.live_blobs(&e.node);

                        match (e.kind, blobs.as_slice()) {

                            (NodeKind::Subrepo, [b]) => {

                                let pin = crate::subrepo::Pin::decode(&self.read_blob(b)?)?;

                                if !matches!(&pin, crate::subrepo::Pin::Git { sha: s, .. } if s == sha)

                                {

                                    differ(format!("{short}: {path} pins another commit"));

                                }

                            (kind, _) => differ(format!(

                                "{short}: {path} is not one submodule pin: {kind:?} with {} pins",

                                blobs.len()

                            )),

                    }

                        let blobs = state.live_blobs(&e.node);

                        match (e.kind, blobs.as_slice()) {

                            (NodeKind::Symlink, [b]) if self.read_blob(b)? == target => {}

                        if e.mode.exec != (mode == "100755") {

                            differ(format!("{short}: {path} executable bit differs"));

                        }

                        if e.kind == NodeKind::File && !e.mode.opaque {

                            if !need_set.contains(&e.node) {

                                // Known equal: skipped when the graphs were chosen.

                            let (have, m) = state.render_file(&e.node);

                            if m.is_conflicted() {

                                let who: Vec<String> = state

                                    .conflict_regions(&e.node)

                                    .contributors

                                    .iter()

                                    .filter_map(|h| state.get(h))

                                    .map(|m| {

                                        let sha = m

                                            .message

                                            .lines()

                                            .rev()

                                            .find_map(|l| l.strip_prefix("Git-Commit: "))

                                            .unwrap_or("?");

                                        format!(

                                            "{} {:?}",

                                            &sha[..12.min(sha.len())],

                                            m.message.lines().next().unwrap_or("")

                                        )

                                    })

                                    .collect();

                                conflicted.push(format!("{path} between {}", who.join(" and ")));

                            }

                            let want = cat.read(sha)?;

                            if have != want {

                                differ(format!(

                                    "{short}: {path} differs: {}",

                                    first_difference(&have, &want)

                                ));

                            } else if !m.is_conflicted() {

                                if let Some(k) = keys.get(&e.node) {

                                    verified_graphs.insert(*k, sha.clone());

                                }

                            }

                            continue;

                        }

                        let blobs = state.live_blobs(&e.node);

                        let [b] = blobs.as_slice() else {

                            differ(format!("{short}: {path} is not one file"));

                            continue;

                        if verified_blobs.get(b) == Some(sha) {

                            continue;

                        if self.read_blob(b)? != cat.read(sha)? {

                            differ(format!("{short}: {path} differs"));

                        } else {

                            verified_blobs.insert(*b, sha.clone());

            if !conflicted.is_empty() {

                differ(format!(

                    "{short}: the state is conflicted: {}",

                    conflicted.join("; ")

                ));

            }

            for (path, e) in &view.entries {

                if e.kind != NodeKind::Dir

        if seed.is_some() {

            b.retire_stray_placements();

        }

    /// For a Git import, the base's dead directories by where they were

    /// (see `ensure_dir`), worked out when first needed.

    dead_dirs: Option<HashMap<(NodeId, String), (NodeId, crate::tree::OpKey)>>,

            dead_dirs: None,

    /// A dead directory last placed at (`parent`, `name`) in the base.

    fn revivable_dir(

        &mut self,

        parent: NodeId,

        name: &str,

    ) -> Option<(NodeId, crate::tree::OpKey)> {

        let base = self.base;

        self.dead_dirs

            .get_or_insert_with(|| base.tree().dead_dirs())

            .get(&(parent, name.to_string()))

            .copied()

    }

            let known = self.dir_nodes.get(&prefix).copied();

            let revive = match known {

                Some(_) => None,

                None if self.node_seed.is_some() => self.revivable_dir(parent, comp),

                None => None,

            };

            parent = match (known, revive) {

                (Some(n), _) => n,

                (None, Some((node, old))) => {

                    // Git has no identity for a directory: one that comes

                    // back where it was is the same directory, brought back

                    // with a move, so lines of history that placed files in

                    // it before and after agree (oxygen#30).

                    self.tree_ops.push(TreeOp::Move {

                        node,

                        old: OpRef {

                            change: old.0,

                            index: old.1,

                        },

                        parent,

                        name: comp.to_string(),

                    });

                    self.dir_nodes.insert(prefix.clone(), node);

                    node

                }

                (None, None) => {

    }

    /// For a Git import: a node the commit keeps is in one place, the one

    /// its tree names, so any other live placement it has in the base goes;

    /// and a node the tree cannot show at all (an orphan) goes too. Such a

    /// placement is out of sight, under a directory another line of history

    /// removed, where no diff of the tree would ever reach it (oxygen#30).

    fn retire_stray_placements(&mut self) {

        let mut retired: HashSet<(ChangeHash, u32)> = HashSet::new();

        let mut placed: BTreeSet<NodeId> = BTreeSet::new();

        for op in &self.tree_ops {

            match op {

                TreeOp::Move { node, old, .. } => {

                    retired.insert((old.change, old.index));

                    placed.insert(*node);

                }

                TreeOp::RemoveNode { placement, .. } => {

                    retired.insert((placement.change, placement.index));

                }

                TreeOp::AddNode { .. } | TreeOp::SetMode { .. } => {}

            }

        }

        // Nodes kept where they were: what the base's tree view shows and

        // this change neither moves nor removes.

        let mut kept: HashMap<NodeId, (ChangeHash, u32)> = HashMap::new();

        for e in self.base_snapshot.tree.entries.values() {

            if !retired.contains(&e.placement) {

                kept.insert(e.node, e.placement);

            }

        }

        // Only a node with several live placements can have a stray one,

        // and the tree view names each as a conflict.

        let multi: BTreeSet<NodeId> = self

            .base_snapshot

            .tree

            .conflicts

            .iter()

            .filter_map(|c| match c {

                crate::tree::TreeConflict::MultiPlacement { node, .. } => Some(*node),

                _ => None,

            })

            .collect();

        let mut extra = Vec::new();

        // A node whose only placements are under a directory another line

        // removed (an orphan) is nowhere the tree can show, and Git's tree

        // has no such path: it goes.

        for c in &self.base_snapshot.tree.conflicts {

            let crate::tree::TreeConflict::Orphan { node, .. } = c else {

                continue;

            };

            if kept.contains_key(node) || placed.contains(node) {

                continue;

            }

            for (k, _) in self.base.tree().live_placements(node) {

                if retired.insert(k) {

                    extra.push(TreeOp::RemoveNode {

                        node: *node,

                        placement: op_ref(k),

                    });

                }

            }

        }

        for node in placed

            .iter()

            .chain(multi.iter().filter(|n| kept.contains_key(*n)))

        {

            for (k, _) in self.base.tree().live_placements(node) {

                if retired.contains(&k) || kept.get(node) == Some(&k) {

                    continue;

                }

                retired.insert(k);

                extra.push(TreeOp::RemoveNode {

                    node: *node,

                    placement: op_ref(k),

                });

            }

        }

        if !extra.is_empty() {

            self.resolves = true;

            self.tree_ops.extend(extra);

        }

/// oxygen#30 (vscode): a directory deleted in one line of history and made

/// again was a second node for one Git path, so a file moved into it on

/// another line, where the first node still stood, ended up in two places.

/// An import now brings the directory back rather than make a new one.

#[test]

fn git_import_brings_a_directory_back_rather_than_making_a_second() {

    hermetic();

    if std::process::Command::new("git")

        .arg("--version")

        .output()

        .is_err()

    {

        eprintln!("git not installed; skipping");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let g = root.join("src.git");

    fs::create_dir_all(&g).unwrap();

    let git = |args: &[&str]| -> String {

        let out = std::process::Command::new("git")

            .arg("-C")

            .arg(&g)

            .args([

                "-c",

                "user.name=Grace",

                "-c",

                "[email protected]",

                "-c",

                "commit.gpgsign=false",

            ])

            .args(args)

            .output()

            .unwrap();

        assert!(

            out.status.success(),

            "git {args:?}: {}",

            String::from_utf8_lossy(&out.stderr)

        );

        String::from_utf8_lossy(&out.stdout).trim().to_string()

    };

    git(&["init", "-q", "-b", "main"]);

    write(&g, "d/a.txt", b"a\n");

    write(&g, "c/x.txt", b"x\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "base"]);

    // One line: move x into d while d still stands.

    git(&["checkout", "-qb", "side"]);

    git(&["mv", "c/x.txt", "d/x.txt"]);

    git(&["commit", "-qm", "x into d"]);

    // The other: d goes, comes back, and x moves into it too.

    git(&["checkout", "-q", "main"]);

    git(&["rm", "-q", "d/a.txt"]);

    git(&["commit", "-qm", "d goes"]);

    write(&g, "d/b.txt", b"b\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "d comes back"]);

    git(&["mv", "c/x.txt", "d/x.txt"]);

    git(&["commit", "-qm", "x into d again"]);

    git(&["merge", "-q", "--no-edit", "side"]);

    let repo = Repo::init(&root.join("o")).unwrap();

    repo.import_git(&g, "main").unwrap();

    let v = repo.verify_git_import(&g, "main").unwrap();

    assert!(v.mismatches.is_empty(), "{:?}", v.mismatches);

    let st = repo

        .load_state_history(&repo.bookmark_heads().unwrap())

        .unwrap();

    let view = st.tree().view();

    assert!(view.conflicts.is_empty(), "{:?}", view.conflicts);

    // The directory is the one the first commit made.

    // Commits made in one second tie on time: find the first by its message.

    let first = repo

        .log()

        .unwrap()

        .into_iter()

        .find(|e| e.change.message.starts_with("base"))

        .unwrap();

    let base = repo

        .load_state_history(&[first.hash])

        .unwrap()

        .tree()

        .view();

    assert_eq!(view.entries["d"].node, base.entries["d"].node);

}

/// oxygen#30, the rest: a placement left under a directory another line

/// removed is out of sight, so no diff reaches it; the merge that settles

/// where the file is retires it.

#[test]

fn git_import_merge_retires_a_placement_under_a_removed_directory() {

    hermetic();

    if std::process::Command::new("git")

        .arg("--version")

        .output()

        .is_err()

    {

        eprintln!("git not installed; skipping");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let g = root.join("src.git");

    fs::create_dir_all(&g).unwrap();

    let run = |args: &[&str]| {

        std::process::Command::new("git")

            .arg("-C")

            .arg(&g)

            .args([

                "-c",

                "user.name=Grace",

                "-c",

                "[email protected]",

                "-c",

                "commit.gpgsign=false",

            ])

            .args(args)

            .output()

            .unwrap()

    };

    let git = |args: &[&str]| {

        let out = run(args);

        assert!(

            out.status.success(),

            "git {args:?}: {}",

            String::from_utf8_lossy(&out.stderr)

        );

    };

    git(&["init", "-q", "-b", "main"]);

    write(&g, "c/x.txt", b"x\n");

    write(&g, "keep.txt", b"k\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "base"]);

    // One line renames the file within c; the other moves it out of c,

    // which goes.

    git(&["checkout", "-qb", "side"]);

    git(&["mv", "c/x.txt", "c/y.txt"]);

    git(&["commit", "-qm", "rename within c"]);

    git(&["checkout", "-q", "main"]);

    fs::create_dir_all(g.join("n")).unwrap();

    git(&["mv", "c/x.txt", "n/x.txt"]);

    git(&["commit", "-qm", "move out of c"]);

    // Git cannot merge the two renames; the merge keeps n/x.txt.

    let _ = run(&["merge", "-q", "side"]);

    let _ = run(&[

        "rm",

        "-q",

        "--cached",

        "--ignore-unmatch",

        "c/y.txt",

        "c/x.txt",

    ]);

    let _ = std::fs::remove_dir_all(g.join("c"));

    write(&g, "n/x.txt", b"x\n");

    git(&["add", "-A"]);

    git(&["commit", "-qm", "merge: keep n/x.txt"]);

    let repo = Repo::init(&root.join("o")).unwrap();

    repo.import_git(&g, "main").unwrap();

    let v = repo.verify_git_import(&g, "main").unwrap();

    assert!(v.mismatches.is_empty(), "{:?}", v.mismatches);

    let st = repo

        .load_state_history(&repo.bookmark_heads().unwrap())

        .unwrap();

    let view = st.tree().view();

    assert!(view.conflicts.is_empty(), "{:?}", view.conflicts);

    assert!(view.entries.contains_key("n/x.txt"));

}

/// oxygen#30, orphans: a file added on one line into a directory the other

/// line removed is placed where the tree cannot show it; Git's merge keeps

/// the file, and the import's merge leaves exactly one of it.

#[test]

fn git_import_merge_leaves_no_orphan_behind() {

    hermetic();

    if std::process::Command::new("git")

        .arg("--version")

        .output()

        .is_err()

    {

        eprintln!("git not installed; skipping");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let g = root.join("src.git");

    fs::create_dir_all(&g).unwrap();

    let git = |args: &[&str]| {

        let out = std::process::Command::new("git")

            .arg("-C")

            .arg(&g)

            .args([

                "-c",

                "user.name=Grace",

                "-c",

                "[email protected]",

                "-c",

                "commit.gpgsign=false",

            ])

            .args(args)

            .output()

            .unwrap();

        assert!(

            out.status.success(),

            "git {args:?}: {}",

            String::from_utf8_lossy(&out.stderr)

        );

    };

    git(&["init", "-q", "-b", "main"]);

    write(&g, "d/f.txt", b"f\n");

    write(&g, "keep.txt", b"k\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "base"]);

    git(&["checkout", "-qb", "side"]);

    write(&g, "d/new.txt", b"new\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "add into d"]);

    git(&["checkout", "-q", "main"]);

    git(&["rm", "-q", "d/f.txt"]);

    git(&["commit", "-qm", "d goes"]);

    git(&["merge", "-q", "--no-edit", "side"]);

    let repo = Repo::init(&root.join("o")).unwrap();

    repo.import_git(&g, "main").unwrap();

    let v = repo.verify_git_import(&g, "main").unwrap();

    assert!(v.mismatches.is_empty(), "{:?}", v.mismatches);

    let st = repo

        .load_state_history(&repo.bookmark_heads().unwrap())

        .unwrap();

    let view = st.tree().view();

    assert!(view.conflicts.is_empty(), "{:?}", view.conflicts);

    assert!(view.entries.contains_key("d/new.txt"));

}

    /// Directories no longer placed anywhere, by the (parent, name) they

    /// were last placed at, with that placement: what an import can bring

    /// back rather than make a second node for one Git path.

    pub fn dead_dirs(&self) -> HashMap<(NodeId, String), (NodeId, OpKey)> {

        let mut out: HashMap<(NodeId, String), (NodeId, OpKey)> = HashMap::new();

        for (k, p) in &self.placements {

            if self.kind(&p.node) != Some(NodeKind::Dir)

                || self.placement_live(k)

                || !self.live_placements(&p.node).is_empty()

            {

                continue;

            }

            let slot = out

                .entry((p.parent, p.name.clone()))

                .or_insert((p.node, *k));

            // The newest placement, by key: the same answer in any order.

            if *k > slot.1 {

                *slot = (p.node, *k);

            }

        }

        out

    }

    /// Every placement `node` ever had, live or not, with the changes that

    /// retired it (none while live).

    pub fn placement_history(&self, node: &NodeId) -> Vec<(OpKey, &Placement, Vec<ChangeHash>)> {

        self.placements_of

            .get(node)

            .into_iter()

            .flatten()

            .filter_map(|k| {

                let p = self.placements.get(k)?;

                let by = self

                    .deleted_placements

                    .get(k)

                    .map(|d| d.iter().copied().collect())

                    .unwrap_or_default();

                Some((*k, p, by))

            })

            .collect()

    }

- [x] H1 **Importer name conflict** (oxygen#30): the 5 000-commit

- 2026-09-30 **H1 done** (oxygen#30). Three causes, each from Git having no identity for a directory:

  - a directory deleted and made again became a second node;

  - a placement under a removed directory was out of reach;

  - orphans could not be seen.

  - The fix: an import revives the directory, and a merge retires a kept node's other placements and every orphan. There is a Git-built test for each cause; each reproduces the vscode symptom without its fix. Spec §23.

  - The vscode slice now verifies: all 1 747 commits and 3.3 million files.

  - `oxy git verify` is cached by graph key and blob: 115 s instead of 1 400 s.

### Git import: the vscode slice (2026-09-30, oxygen#30)

The 1 747-commit vscode slice (to merge 0babb4299131) had one file as a

name conflict at every commit from that merge on: 51 verify differences.

There were three causes, all from Git having no identity for a directory:

- a directory deleted on one line and made again got a second node for

  the same path;

- a placement left under a directory another line removed was out of

  sight, so no merge could retire it;

- a file whose only placements were under removed directories (an

  orphan) could not be seen either.

Now an import brings a directory back rather than making a second node,

and a merge retires a kept node's other placements and every orphan.

`oxy git verify` built and rendered every file of every commit and read

every Git blob; it now loads each commit's history and builds only the

files whose graph (by key) or blob it has not already found equal to

that Git blob.

| vscode slice, 1 747 commits | Before | After |

|---|---:|---:|

| Import | 128.6 s | 132.1 s |

| Differences | 51 | none: 3 327 291 files compared |

| Verify | 1 369 to 1 444 s, 832 MB | 114.6 s, 441 MB |

- **Directories.** Git gives a directory no identity: its path is all it is. An import therefore never makes a second node for a directory path: when a commit needs a directory where the parent's state has none, and the parent's history has a directory last placed at that (parent, name) and now placed nowhere, the change brings that node back with a `Move` from its last placement (the newest by operation key when there are several). Otherwise lines of history that placed files in the directory before it was deleted and after it came back would place them in two different directories, a conflict Git never had. Likewise a node the commit keeps is in exactly the one place its tree names: any other live placement it has in the parents' union (one left under a directory another line removed is out of sight, and no diff of the tree would reach it) is retired by the commit's change, and so is every live placement of a node the union cannot show at all (an orphan, whose only placements are under removed directories): Git's tree has no path for it.

*Changelog.* Draft 0.8r (2026-09-29): an import brings a deleted directory back rather than making a second node for its path, and retires a kept node's other placements (§23); graph keys at commit, lazy text in history-only loads, and a clean `status` from the manifest (§12.4); a parent checkout never moves a subrepo's bookmark backwards, and the pin is read from the nested working copy (§7.8); `bookmark create --upto/--only` (§10.1); the working-copy lock covers every command that writes the working copy; a workspace changed by two concurrent operations is an error (§12.1). Draft 0.8q (2026-09-29): change format version 2 stores large inserts as text blobs, so a change does not grow with the files it adds (§6.1, §7.4); no object may exceed 1 GiB (§13.2). Draft 0.8p (2026-09-29): Git import derives new NodeIds from the commit, making imports deterministic (§23). Draft 0.8o (2026-09-29): execution receipts, the `receipt` object and attestation (§14.6). Draft 0.8n (2026-09-29): line history, `oxy log -L` (§27). Draft 0.8m (2026-09-29): resolving replace conflicts (§9.3). Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).