Checkpoint payload version 2: large file graphs as shared blobs named from an index, read in parallel (loose and packed) and decoded in parallel; version 1 still read; gc, fsck and shallow-clone bundles carry the graph blobs (spec 11, Draft 0.8j) afaba5f1306d

        let (blob, payload_len) = self.store_checkpoint_payload(state)?;

        Ok((r, payload_len))

    /// Store `state` as a version 2 payload (spec §11): the graphs of large

    /// files as blobs of their own, shared with earlier checkpoints when

    /// unchanged, and the index naming them. Returns the index blob and its size.

    pub(crate) fn store_checkpoint_payload(&self, state: &State) -> Result<(ObjectRef, usize)> {

        let graphs = state.checkpoint_file_graphs();

        for (_, enc) in &graphs {

            if enc.len() >= crate::state::INLINE_GRAPH_LIMIT {

                self.store_blob(enc)?;

            }

        }

        let index = state.checkpoint_index(&graphs, Repo::blob_ref);

        Ok((self.store_blob(&index)?, index.len()))

    }

    /// The graph blobs a checkpoint's payload names (none for version 1).

    pub(crate) fn checkpoint_graph_blobs(&self, cp: &Checkpoint) -> Result<Vec<ObjectRef>> {

        let payload = self.read_blob(&cp.payload)?;

        Ok(State::checkpoint_graph_refs(&payload)?)

    }

    /// Decode a checkpoint's payload, reading its graph blobs from the store.

    pub(crate) fn state_from_checkpoint(&self, payload: &[u8]) -> Result<State> {

        Ok(State::from_checkpoint(payload, |refs| {

            self.read_blobs(refs).map_err(|e| {

                crate::objects::ObjectError::Schema(format!("checkpoint graph blobs: {e}"))

            })

        })?)

    }

                    let (blob, _) = self.store_checkpoint_payload(&state)?;

        for g in self.checkpoint_graph_blobs(&cp)? {

            for c in Blob::decode(&self.store.get_typed(&g, ObjectType::Blob)?)?.chunks {

                bundle.objects.push(self.store.get(&c)?);

            }

            bundle.objects.push(self.store.get(&g)?);

        }

                self.state_from_checkpoint(&payload)?

            if let Err(e) = self.state_from_checkpoint(&payload) {

                rep.error(Some(r), format!("checkpoint payload does not decode: {e}"));

            // The payload must be what the named changes produce, in its own version.

            let version = crate::cbor::decode(&payload).ok().and_then(|v| {

                crate::objects::map(&v, "payload").ok().and_then(|m| {

                    m.get(&0)

                        .and_then(|x| crate::objects::uint(x, "version").ok())

                })

            });

            let expected = |full: &State| {

                if version == Some(crate::state::CHECKPOINT_INDEX_VERSION) {

                    full.checkpoint_index(&full.checkpoint_file_graphs(), Repo::blob_ref)

                } else {

                    full.checkpoint_payload()

                }

            };

                    Ok(full) if expected(&full) != payload => {

                // A version 2 payload's graph blobs and their chunks.

                for g in self.checkpoint_graph_blobs(&cp).unwrap_or_default() {

                    keep.insert(g);

                    if let Ok(b) = self.store.get_typed(&g, ObjectType::Blob) {

                        keep.extend(Blob::decode(&b)?.chunks);

                    }

                }

    /// Read many blobs at once (checkpoint graphs): the blob objects, then

    /// all their chunks, are read in parallel; a blob the store lacks goes

    /// through [`Repo::read_blob`], which may fetch it lazily.

    pub fn read_blobs(&self, refs: &[ObjectRef]) -> Result<Vec<Vec<u8>>> {

        let mut blobs: Vec<Option<Blob>> = Vec::with_capacity(refs.len());

        for (r, got) in refs.iter().zip(self.store.get_many(refs)) {

            blobs.push(match got {

                Ok((ObjectType::Blob, body)) => Some(Blob::decode(&body)?),

                Ok((ty, _)) => return fail(format!("{} is a {ty:?}, not a blob", r.short(12))),

                Err(crate::store::StoreError::NotFound(_)) => None,

                Err(e) => return Err(e.into()),

            });

        }

        let chunk_refs: Vec<ObjectRef> = blobs

            .iter()

            .flatten()

            .flat_map(|b| b.chunks.iter().copied())

            .collect();

        let mut chunks = self.store.get_many(&chunk_refs).into_iter();

        let mut out = Vec::with_capacity(refs.len());

        for (r, blob) in refs.iter().zip(blobs) {

            match blob {

                None => out.push(self.read_blob(r)?),

                Some(b) => {

                    let mut content = Vec::with_capacity(b.length as usize);

                    for c in &b.chunks {

                        match chunks.next() {

                            Some(Ok((ObjectType::Chunk, body))) => content.extend(body),

                            Some(Ok(_)) => return fail(format!("{} is not a chunk", c.short(12))),

                            Some(Err(e)) => return Err(e.into()),

                            None => return fail("chunk list ended early"),

                        }

                    }

                    out.push(content);

                }

            }

        }

        Ok(out)

    }

/// Version 2 checkpoints (spec §11): a large file's graph is a blob of its

/// own, kept by gc, checked by fsck, shared by the next checkpoint when the

/// file is unchanged, and loading through the checkpoint equals a full load.

#[test]

fn checkpoints_keep_large_graphs_as_blobs_of_their_own() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap().with_home(root.join("home"));

    let long: String = (0..300)

        .map(|i| format!("line {i} of a long file\n"))

        .collect();

    write(root, "long.txt", long.as_bytes());

    write(root, "short.txt", b"short\n");

    repo.commit("base", &[]).unwrap();

    let (r1, _, _) = repo.checkpoint().unwrap();

    let cp1 = crate::objects::Checkpoint::decode(

        &repo.store().get_typed(&r1, ObjectType::Checkpoint).unwrap(),

    )

    .unwrap();

    let graphs1 = repo.checkpoint_graph_blobs(&cp1).unwrap();

    assert_eq!(graphs1.len(), 1, "only the long file's graph is a blob");

    // gc keeps the graph blob; fsck finds the checkpoint sound.

    repo.gc(true).unwrap();

    assert!(repo.store().has(&graphs1[0]));

    let report = repo.fsck().unwrap();

    assert_eq!(report.errors(), 0, "{:?}", report.problems);

    // Loading through the checkpoint equals a full load.

    write(root, "short.txt", b"short, edited\n");

    repo.commit("edit the short file", &[]).unwrap();

    let heads = repo.bookmark_heads().unwrap();

    let fast = repo.load_state(&heads).unwrap();

    let full = repo.load_state_full(&heads).unwrap();

    assert_eq!(fast.checkpoint_payload(), full.checkpoint_payload());

    // The next checkpoint shares the unchanged long file's graph.

    let (r2, _, _) = repo.checkpoint().unwrap();

    let cp2 = crate::objects::Checkpoint::decode(

        &repo.store().get_typed(&r2, ObjectType::Checkpoint).unwrap(),

    )

    .unwrap();

    assert_eq!(repo.checkpoint_graph_blobs(&cp2).unwrap(), graphs1);

    // A shallow clone's bundle carries the graph blob with the checkpoint.

    let bundle = repo.checkpoint_bundle_for(&heads).unwrap();

    assert!(bundle.objects.iter().any(|(t, body)| *t == ObjectType::Blob

        && crate::hash::hash_object(ObjectType::Blob, body) == graphs1[0]));

    // A version 1 checkpoint written by an older oxy still loads.

    let state = repo.load_state_full(&heads).unwrap();

    let old = repo.store_blob(&state.checkpoint_payload()).unwrap();

    let cp_old = crate::objects::Checkpoint {

        heads: cp2.heads.clone(),

        count: cp2.count,

        payload: old,

    };

    let r_old = repo

        .store()

        .put(ObjectType::Checkpoint, &cp_old.encode())

        .unwrap();

    repo.install_checkpoint("main", &r_old).unwrap();

    assert_eq!(

        repo.load_state(&heads).unwrap().checkpoint_payload(),

        full.checkpoint_payload()

    );

    assert_eq!(repo.fsck().unwrap().errors(), 0);

    // A lost graph blob fails the load loudly rather than dropping the

    // file, and fsck reports it (a fresh repository, objects still loose).

    let dir2 = tempfile::tempdir().unwrap();

    let root2 = dir2.path();

    let repo2 = Repo::init(root2).unwrap().with_home(root2.join("home"));

    write(root2, "long.txt", long.as_bytes());

    repo2.commit("base", &[]).unwrap();

    let (r, _, _) = repo2.checkpoint().unwrap();

    let cp = crate::objects::Checkpoint::decode(

        &repo2.store().get_typed(&r, ObjectType::Checkpoint).unwrap(),

    )

    .unwrap();

    let graph = repo2.checkpoint_graph_blobs(&cp).unwrap()[0];

    fs::remove_file(repo2.store().path_for(&graph)).unwrap();

    assert!(repo2.load_state(&repo2.bookmark_heads().unwrap()).is_err());

    assert!(repo2.fsck().unwrap().errors() > 0, "fsck reports it");

}

/// Checkpoint payload version 2 (spec §11): file graphs by reference.

pub const CHECKPOINT_INDEX_VERSION: u64 = 2;

/// A file graph encoded in fewer bytes stays inline in a version 2 index.

pub const INLINE_GRAPH_LIMIT: usize = 2048;

    /// Serialize the whole state in payload version 1: change metadata,

    /// tree, file graphs, replaces, all in one value (spec §11).

        let mut nodes: Vec<&NodeId> = self.files.keys().collect();

        nodes.sort();

        let files = Value::Array(

            nodes

                .into_iter()

                .map(|n| Value::Array(vec![Value::Bytes(n.0.to_vec()), self.files[n].to_value()]))

                .collect(),

        );

        cbor::encode(&self.payload_value(o::FORMAT_VERSION, files))

    }

    /// Each file graph encoded on its own, by node, for a version 2 payload

    /// (spec §11): the graphs of large files become blobs of their own.

    pub fn checkpoint_file_graphs(&self) -> Vec<(NodeId, Vec<u8>)> {

        use rayon::prelude::*;

        let mut nodes: Vec<(&NodeId, &FileGraph)> = self.files.iter().collect();

        nodes.sort_by_key(|(n, _)| **n);

        nodes

            .into_par_iter()

            .map(|(n, g)| (*n, cbor::encode(&g.to_value())))

            .collect()

    }

    /// The payload version 2 index for the graphs of

    /// [`State::checkpoint_file_graphs`]: a graph encoded in fewer than

    /// [`INLINE_GRAPH_LIMIT`] bytes is kept inline, a larger one is named by

    /// `blob_of` (the ObjectRef of the blob holding its encoding).

    pub fn checkpoint_index(

        &self,

        graphs: &[(NodeId, Vec<u8>)],

        mut blob_of: impl FnMut(&[u8]) -> ObjectRef,

    ) -> Vec<u8> {

        let files = Value::Array(

            graphs

                .iter()

                .map(|(n, enc)| {

                    let entry = if enc.len() < INLINE_GRAPH_LIMIT {

                        cbor::decode(enc).expect("an encoded graph decodes")

                    } else {

                        Value::Bytes(blob_of(enc).0.to_vec())

                    };

                    Value::Array(vec![Value::Bytes(n.0.to_vec()), entry])

                })

                .collect(),

        );

        cbor::encode(&self.payload_value(CHECKPOINT_INDEX_VERSION, files))

    }

    /// The payload map around `files`: changes, tree and replaces as in version 1.

    fn payload_value(&self, version: u64, files: Value) -> Value {

        Value::map([

            (0, Value::Uint(version)),

        ])

    /// Decode a version 1 payload (the whole state in one value). A

    /// version 2 payload needs its graph blobs: use [`State::from_checkpoint`].

        State::from_checkpoint(bytes, |_| {

            Err(ObjectError::Schema(

                "a version 2 checkpoint needs its graph blobs".into(),

            ))

        })

    }

    /// Decode a checkpoint payload of either version (spec §11). For

    /// version 2, `load` returns the contents of the named graph blobs, in

    /// order; the graphs are then decoded in parallel.

    pub fn from_checkpoint(

        bytes: &[u8],

        load: impl FnOnce(&[ObjectRef]) -> Result<Vec<Vec<u8>>, ObjectError>,

    ) -> Result<State, ObjectError> {

        use rayon::prelude::*;

        let version = o::uint(o::field(m, 0, "version")?, "version")?;

        if version != o::FORMAT_VERSION && version != CHECKPOINT_INDEX_VERSION {

            return Err(ObjectError::Schema(format!(

                "checkpoint payload version {version} is not supported"

            )));

        }

        let mut st = State::payload_common(m)?;

        let entries = o::array(o::field(m, 3, "files")?, "files")?;

        let mut parsed: Vec<(NodeId, &Value)> = Vec::with_capacity(entries.len());

        for f in entries {

            let e = o::array(f, "file")?;

            if e.len() != 2 {

                return Err(ObjectError::Schema("file: expected [node, graph]".into()));

            }

            let node = NodeId::from_slice(o::bytes(&e[0], "node")?)

                .ok_or_else(|| ObjectError::Schema("node: expected 16 bytes".into()))?;

            parsed.push((node, &e[1]));

        }

        // Version 2 names large graphs by blob: fetch those in one batch.

        let mut fetched: HashMap<NodeId, Vec<u8>> = HashMap::new();

        if version == CHECKPOINT_INDEX_VERSION {

            let wanted: Vec<(NodeId, ObjectRef)> = parsed

                .iter()

                .filter(|(_, e)| matches!(e, Value::Bytes(_)))

                .map(|(n, e)| Ok((*n, o::oref(e, "graph blob")?)))

                .collect::<Result<_, ObjectError>>()?;

            if !wanted.is_empty() {

                let refs: Vec<ObjectRef> = wanted.iter().map(|(_, r)| *r).collect();

                let contents = {

                    let _t = crate::timing::phase("load:   graph blobs read");

                    load(&refs)?

                };

                if contents.len() != refs.len() {

                    return Err(ObjectError::Schema("graph blobs: wrong count".into()));

                }

                fetched.extend(wanted.iter().map(|(n, _)| *n).zip(contents));

            }

        } else if parsed.iter().any(|(_, e)| matches!(e, Value::Bytes(_))) {

            return Err(ObjectError::Schema(

                "a version 1 payload holds graphs inline".into(),

            ));

        }

        // File graphs are independent; decode and build them in parallel.

        let graphs = parsed

            .par_iter()

            .map(|(node, entry)| {

                let graph = match fetched.get(node) {

                    Some(bytes) => FileGraph::from_value(&cbor::decode(bytes)?)?,

                    None => FileGraph::from_value(entry)?,

                };

                Ok((*node, graph))

            })

            .collect::<Result<Vec<_>, ObjectError>>()?;

        st.files.extend(graphs);

        Ok(st)

    }

    /// The graph blobs a payload names: empty for version 1.

    pub fn checkpoint_graph_refs(bytes: &[u8]) -> Result<Vec<ObjectRef>, ObjectError> {

        let v = cbor::decode(bytes)?;

        let m = o::map(&v, "checkpoint payload")?;

        let mut out = Vec::new();

        for f in o::array(o::field(m, 3, "files")?, "files")? {

            if let Some(entry @ Value::Bytes(_)) = o::array(f, "file")?.get(1) {

                out.push(o::oref(entry, "graph blob")?);

            }

        }

        Ok(out)

    }

    /// Changes, tree and replaces of a payload of either version.

    fn payload_common(m: &BTreeMap<u64, Value>) -> Result<State, ObjectError> {

    }

    /// Version 2 payloads (spec §11): small graphs inline, large ones by

    /// blob; the state read back is the same as from version 1.

    #[test]

    fn checkpoint_index_round_trip_matches_version_1() {

        let mut st = State::new();

        let small = NodeId::random();

        let big = NodeId::random();

        let add = |node: NodeId, name: &str| TreeOp::AddNode {

            node,

            kind: NodeKind::File,

            mode: Mode::TEXT,

            parent: NodeId::ROOT,

            name: name.into(),

        };

        let big_lines: Vec<Vec<u8>> = (0..400)

            .map(|i| format!("line {i} of a long file\n").into_bytes())

            .collect();

        let h1 = st

            .add(change(

                vec![],

                vec![add(small, "small"), add(big, "big")],

                vec![

                    Edit::Insert {

                        node: small,

                        after: AtomRef::Start,

                        before: AtomRef::End,

                        lines: vec![b"x\n".to_vec()],

                    },

                    Edit::Insert {

                        node: big,

                        after: AtomRef::Start,

                        before: AtomRef::End,

                        lines: big_lines,

                    },

                ],

            ))

            .unwrap();

        st.add(change(

            vec![h1],

            vec![],

            vec![Edit::Delete {

                node: big,

                atoms: vec![AtomRange {

                    change: h1,

                    from: 3,

                    to: 7,

                }],

            }],

        ))

        .unwrap();

        let graphs = st.checkpoint_file_graphs();

        let mut blobs: HashMap<ObjectRef, Vec<u8>> = HashMap::new();

        let index = st.checkpoint_index(&graphs, |enc| {

            let r = crate::hash::hash_object(crate::hash::ObjectType::Blob, enc);

            blobs.insert(r, enc.to_vec());

            r

        });

        assert_eq!(blobs.len(), 1, "only the large graph is a blob of its own");

        assert_eq!(

            State::checkpoint_graph_refs(&index).unwrap(),

            blobs.keys().copied().collect::<Vec<_>>()

        );

        assert!(

            State::checkpoint_graph_refs(&st.checkpoint_payload())

                .unwrap()

                .is_empty(),

            "version 1 names none"

        );

        assert!(index.len() < st.checkpoint_payload().len());

        let back = State::from_checkpoint(&index, |refs| {

            refs.iter()

                .map(|r| {

                    blobs

                        .get(r)

                        .cloned()

                        .ok_or_else(|| ObjectError::Schema("missing".into()))

                })

                .collect()

        })

        .unwrap();

        assert_eq!(

            back.checkpoint_payload(),

            st.checkpoint_payload(),

            "the same state as version 1"

        );

        assert_eq!(

            back.materialize().files["big"].content,

            st.materialize().files["big"].content

        );

        // Deterministic: the same state gives the same index.

        assert_eq!(

            back.checkpoint_index(&back.checkpoint_file_graphs(), |enc| {

                crate::hash::hash_object(crate::hash::ObjectType::Blob, enc)

            }),

            index

        );

        // A missing graph blob is an error, not an empty file.

        assert!(

            State::from_checkpoint(&index, |_| Err(ObjectError::Schema("gone".into()))).is_err()

        );

        assert!(

            State::from_checkpoint_payload(&index).is_err(),

            "version 2 needs its blobs"

        );

        // Version 1 payloads still read, and unknown versions do not.

        assert!(State::from_checkpoint(&st.checkpoint_payload(), |_| unreachable!()).is_ok());

        let mut v3 = cbor::decode(&index).unwrap();

        if let Value::Map(m) = &mut v3 {

            m.insert(0, Value::Uint(3));

        }

        assert!(State::from_checkpoint(&cbor::encode(&v3), |_| unreachable!()).is_err());

/// An object read from the store: its type and body.

pub type Object = (ObjectType, Vec<u8>);

        match read_loose_at(&self.path_for(r), r) {

            Some(found) => found,

            None => match self.find_packed(r) {

                Some((i, e)) => self.packs.borrow()[i].read(r, e),

                None => self.pending_get(r).unwrap_or(Err(StoreError::NotFound(*r))),

            },

        }

    }

    /// Many objects at once: loose ones are read and verified in parallel,

    /// the rest (packed, or pending in a batch) one by one. Results are in

    /// the order of `refs`.

    pub fn get_many(&self, refs: &[ObjectRef]) -> Vec<Result<Object>> {

        use rayon::prelude::*;

        let paths: Vec<(ObjectRef, PathBuf)> =

            refs.iter().map(|r| (*r, self.path_for(r))).collect();

        let mut found: Vec<Option<Result<Object>>> =

            paths.par_iter().map(|(r, p)| read_loose_at(p, r)).collect();

        // Packed ones: look them up in order, then read them in parallel.

        let packs = self.packs.borrow();

        let packed: Vec<(usize, usize, PackEntry)> = found

            .enumerate()

            .filter(|(_, f)| f.is_none())

            .filter_map(|(i, _)| {

                packs

                    .iter()

                    .enumerate()

                    .find_map(|(p, pack)| pack.find(&refs[i]).map(|e| (i, p, e)))

            })

            .collect();

        let indexes: &[PackIndex] = &packs;

        let read: Vec<(usize, Result<Object>)> = packed

            .par_iter()

            .map(|(i, p, e)| (*i, indexes[*p].read(&refs[*i], *e)))

            .collect();

        drop(packs);

        for (i, r) in read {

            found[i] = Some(r);

        found

            .into_iter()

            .zip(refs)

            .map(|(f, r)| match f {

                Some(f) => f,

                None => self.get(r),

            })

            .collect()

}

/// A loose object at `path`, verified against `r`; `None` when there is no

/// such file (it may be packed).

fn read_loose_at(path: &Path, r: &ObjectRef) -> Option<Result<Object>> {

    let data = match fs::read(path) {

        Ok(d) => d,

        Err(e) if e.kind() == io::ErrorKind::NotFound => return None,

        Err(e) => return Some(Err(e.into())),

    };

    Some((|| {

        let nul = data

            .iter()

            .position(|&b| b == 0)

            .ok_or_else(|| StoreError::Corrupt(*r, "no header".into()))?;

        let head = std::str::from_utf8(&data[..nul])

            .map_err(|_| StoreError::Corrupt(*r, "header not UTF-8".into()))?;

        let mut parts = head.split(' ');

        let (Some("oxy1"), Some(ty), Some(len), None) =

            (parts.next(), parts.next(), parts.next(), parts.next())

        else {

            return Err(StoreError::Corrupt(*r, format!("bad header {head:?}")));

        };

        let ty = ObjectType::from_name(ty)

            .ok_or_else(|| StoreError::Corrupt(*r, format!("unknown type {ty}")))?;

        let len: usize = len

            .parse()

            .map_err(|_| StoreError::Corrupt(*r, "bad length".into()))?;

        let body = &data[nul + 1..];

        if body.len() != len {

            return Err(StoreError::Corrupt(

                *r,

                format!("length {} != header {len}", body.len()),

            ));

        }

        if hash_object(ty, body) != *r {

            return Err(StoreError::Corrupt(*r, "hash mismatch".into()));

        }

        Ok((ty, body.to_vec()))

    })())

    }

    #[test]

    fn get_many_reads_loose_and_packed_objects_in_order() {

        let dir = tempfile::tempdir().unwrap();

        let s = Store::open(dir.path().join("objects")).unwrap();

        let packed: Vec<ObjectRef> = (0..20)

            .map(|i| {

                s.put(ObjectType::Chunk, format!("packed {i}").as_bytes())

                    .unwrap()

            })

            .collect();

        s.pack_loose().unwrap();

        let loose: Vec<ObjectRef> = (0..20)

            .map(|i| {

                s.put(ObjectType::Chunk, format!("loose {i}").as_bytes())

                    .unwrap()

            })

            .collect();

        let missing = hash_object(ObjectType::Chunk, b"never stored");

        let mut refs: Vec<ObjectRef> = Vec::new();

        for i in 0..20 {

            refs.push(loose[i]);

            refs.push(packed[i]);

        }

        refs.push(missing);

        let got = s.get_many(&refs);

        assert_eq!(got.len(), refs.len());

        for (i, r) in refs.iter().enumerate().take(40) {

            let want = if i % 2 == 0 {

                format!("loose {}", i / 2)

            } else {

                format!("packed {}", i / 2)

            };

            let (ty, body) = got[i].as_ref().unwrap();

            assert_eq!(

                (*ty, body.as_slice()),

                (ObjectType::Chunk, want.as_bytes()),

                "{r:?}"

            );

        }

        assert!(matches!(got[40], Err(StoreError::NotFound(_))));

| **Status** | Draft 0.8j |

**Payload version 2** has the same map with `version` 2, differing only in `files`: `[[node, graph or ref]]`, where a file graph whose encoding (as above) is shorter than 2048 bytes appears inline and a longer one is replaced by the ObjectRef (a byte string) of a blob holding exactly that encoding. Graph blobs are content addressed, so a file unchanged between two checkpoints shares its blob, and a reader can load only the graphs it needs. The rule is deterministic, so version 2 checkpoints are as reproducible as version 1. Writers produce version 2; readers MUST accept both. The checkpoint object is unchanged, and whatever carries a checkpoint (garbage-collection roots, the `checkpoint` fetch of §16.1) carries its graph blobs and their chunks with it. A version 2 payload's graph blobs are part of the checkpoint: one missing makes the checkpoint unusable, and a reader reports it rather than dropping the file.

*Changelog.* Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).

Draft 0.8i (2026-09-28): portability rules for exec bits and path names (§7.7); found by verifying a real Git import commit by commit: deletions depend on the inserters of the lines right after them, and replacements on the change that set their old blob (§8.1); replace records are superseded causally, so a reverted binary keeps its blob (§9.3); merges resolve opaque conflicts to the commit's blob, and `oxy git verify` (§23). Draft 0.8h (2026-09-28): `oxy fsck` (§21.1); durability rules and the operation head as commit point (§13.6); the operation head moves by compare-and-swap and concurrent operations are merged (§12.1); `oxy doctor` (§21.2). Draft 0.8g (2026-09-27): delegates of a rule's identities may sign reference attestations (§14.5); local-path pushes bind unbound repositories like HTTP ones. Draft 0.8f (2026-09-27): challenge signatures (§14.3) for hosts. Draft 0.8e (2026-09-27): anonymous changes (zero author) are authenticated by a seal from any key, so imported and pre-identity history can be pushed under a policy (§14.4). Draft 0.8d (2026-09-27): unbound hosted repositories adopt the first pusher's id (§16.1). Draft 0.8c (2026-09-27): bare repositories (`oxy init --bare`, §12.2: no workspace, no working copy; hosting) and the reference server as an embeddable library (§15.1). Draft 0.8b (2026-09-27): the machine interface for editors (§24): `root`, `cat`, `version`, `hunks`, `discard`, and `--json` on the reporting commands.