Backlog: O10e done (oxygen#4); OxygenFlow dogfooding F1-F5 first, then O10f and O10g b037ade16953

- [ ] F1 **Priority (Andy, 2026-09-28): dogfood OxygenFlow.** Every push to oxygen, oxygenhub, oxygenflow and both extensions lints, tests and builds through OxygenFlow on Earth, with results as checks on OxygenHub. F1: a build sandbox for the runner: a rootfs with the Rust toolchain (stable, rustfmt, clippy) and Node, resource limits that fit a cargo build, and dependencies without open network (a crate and npm cache or vendoring); measured on Earth.

- [ ] F2 oxygen pipeline (.flow/pipeline.kdl): fmt, clippy -D warnings, tests, release build; green on a real push.

- [ ] F3 oxygenhub pipeline: needs oxygen alongside (path dependencies), so the job checks out oxygen at a pinned change; fmt, clippy, tests, build.

- [ ] F4 Extension pipelines (oxygen-vscode, oxygenhub-vscode): typecheck, bundle, tests (with oxy, and the hub binary for the hub client tests), package; and oxygenflow's own pipeline gains cargo fmt, clippy and tests.

- [ ] F5 Required checks: each repository's default bookmark requires its pipeline's checks to land, and the work loop pushes and waits for green instead of gating only locally.

- [x] O10e Checkpoint payload version 2: large file graphs as shared blobs named from an index, read and decoded in parallel; readers accept both versions (spec §11). Agreed by Andy on 2026-09-28.

- [ ] O10f Load file graphs lazily from a version 2 checkpoint: a state keeps unread graphs by reference and reads one when first needed.

- [ ] O10g Render only what a snapshot needs: the manifest records, per file, the graph blob it matched, so an unchanged file whose graph is untouched since the checkpoint is neither read nor rendered; cache materialized states.

- 2026-09-28 O10e done (oxygen#4, closed by the change). Spec §11, Draft 0.8j.

  - **Format.** Payload version 2: a file graph encoded in 2 KiB or more is a blob of its own, named from an index; smaller ones stay inline. Blobs are content addressed, so unchanged files are shared between checkpoints.

  - **Compatibility.** Readers accept both versions; writers produce version 2. gc keeps the graph blobs, fsck checks them against a full load in the payload's own version, and shallow-clone bundles carry them.

  - **Speed.** The first cut was slower than version 1, because it read 10 000 blobs one at a time. So the store gained `get_many`, which reads loose objects in parallel and packed ones in parallel after one index pass, and the graphs are decoded in parallel.

  - **Result at 10 000 files, 216 changes** (the same binary reading both versions, alternated, medians): load through a checkpoint 615 ms (v1) to 342 ms (v2). The index is 2.4 MB against a 62 MB v1 payload. A second checkpoint after a one-file edit took 0.63 s against 1.08 s.

  - **Tests.** Unit tests for the v2 round trip, determinism, missing blobs and unknown versions, and `get_many` over loose, packed and missing objects. A repository test covers a large file's graph blob through gc, fsck, a shared second checkpoint, the shallow bundle, an old v1 checkpoint still loading, and a lost blob failing loudly.

  - Gates green for oxygen and oxygenhub; release binary rebuilt; hub redeployed.

  - **Andy:** oxy older than this cannot read checkpoints written from now on. Rebuild every copy, as ~/.local/bin/oxy already is.

  - **New priority from Andy:** dogfood OxygenFlow on every push (F1–F5, ahead of O10f and O10g).

    - The runner is live on Earth, but only oxygenflow has a pipeline, of light shell jobs in a 256 MiB, one-CPU Alpine microVM.

    - No Rust or Node sandbox exists yet.