Depth 0 takes no change, and a checkpoint is gathered in parallel (refs #137) f3811eb20bea

## Unreleased

- **A shallow clone of a big repository works, and quickly (#137).** `oxy clone --depth 0` of the VS Code history failed after eleven minutes ("object … not found"): the blobs of the state's binary files are named only by the changes that set them, which a depth-0 clone does not take, so nothing brought them. They are now fetched with the checkpoint (in parts), or left to be fetched on read under `--max-blob`. The checkpoint itself was stored object by object, each written loose and flushed (57,498 objects at 27 a second); it is now stored in one batch, as a fetch's objects are.

- **A push no longer passes a proxy's request limit (#133).** A push to a hub behind Cloudflare, which takes at most 100 MB in one request, was refused `HTTP 413` with Cloudflare's HTML page printed raw: parts of a long push were about 256 MiB, and one change's blobs went in one request however many there were. Parts are now about 64 MiB (`push.batch-bytes`), a part whose blobs pass that sends them first in parts of objects alone, an HTML error page is shown by its title, and a 413 says how to push in smaller parts.

- **A keyless agent's grant survives its owner's key rotation (#135).** Every delegation an owner adds or removes renews their identity, and a repository that names the newest key as `author.key` read every change their agent sealed as INVALID ("key … is neither the author nor a delegate"), and its pushes were refused, because the agent's grant was signed by the owner's earlier key. A grant by a key the author's identity was rotated or renewed from now counts when it was made before that rotation; one an old key made after it does not.

- **A tag can be withdrawn, by a signed withdrawal (oxygenhub#301).** There was no way to remove a tag anywhere: a mistaken release tag stayed for good. `oxy tag delete NAME [-r REASON]` records an `untag` attestation naming the tag's state, signed like a tag (a ten-minute keyless key too), and the next `oxy push` sends it to a remote that still has the tag; `oxy push --delete tags/NAME` does both at once. A receiver under a policy accepts it only from a key that may create the tag, keeps it beside the tag's creation, and lists withdrawn tags in its refs answer (key 8), so a `fetch` withdraws the tag there too (`tag v1 was withdrawn on origin, and here`). A withdrawn name is never used again, so a tag name never names two states. `oxy-server`'s `Backend` gains `vet_tag_withdrawal` (OxygenHub refuses while a release uses the tag), and `Repo::host_tag_create` and `host_tag_withdrawal` let a host make or withdraw a tag for a signed-in user. The wire change is additive, but an older server refuses a withdrawal (wrong attestation kind), and an older client keeps a withdrawn tag.

        )

    }

    fn checkpoint(&self, heads: &[ChangeHash]) -> Result<Bundle> {

    }

    fn shallow(&self, heads: &[ChangeHash], depth: u32) -> Result<Vec<ChangeHash>> {

        wire::decode_hashes(&self.call(

    /// when it matches, otherwise one is made and, when `heads` are the

    /// bookmark's, kept.

    pub fn checkpoint_bundle_for(&self, heads: &[ChangeHash]) -> Result<Bundle> {

        let wanted = StateObject::new(heads.to_vec()).heads;

        let bookmark = self.config.bookmark.clone();

        let current = self.bookmark_heads()?;

                }

            }

        };

        let cp = Checkpoint::decode(&self.store.get_typed(&r, ObjectType::Checkpoint)?)?;

        let mut bundle = Bundle::default();

        for c in Blob::decode(&self.store.get_typed(&cp.payload, ObjectType::Blob)?)?.chunks {

            bundle.objects.push(self.store.get(&c)?);

        }

        bundle.objects.push(self.store.get(&cp.payload)?);

            }

        }

        bundle.objects.push((ObjectType::Checkpoint, cp.encode()));

        Ok(bundle)

    }

        let mut done: BTreeSet<ChangeHash> = have.clone();

        done.extend(boundary.iter().copied());

        // Iterative post-order DFS.

        let mut stack: Vec<(ChangeHash, bool)> = want.iter().rev().map(|h| (*h, false)).collect();

        while let Some((h, expanded)) = stack.pop() {

            if done.contains(&h) {

                continue;

            }

            if !self.store.has(&h) {

                return fail(format!("change {} is not in this repository", h.short(12)));

            }

            if expanded {

            // Changes are not individually re-verified here: the bookmark's

            // attestation (checked below) binds its whole state, and the

            // receiver of the push verified the added changes at that time.

            let imported = {

                let _t = crate::timing::phase("fetch: import");

            };

            if max_blob.is_some() {

                self.register_missing_blobs(&imported, remote_name)?;

            }

            for h in &r.heads {

                    return fail(format!("remote did not send head {}", h.short(12)));

                }

            }

            return Ok(0);

        }

        // Base: the remote's checkpoint of exactly these heads.

        // In one batch: a big state's checkpoint is tens of thousands of

        // graph blobs and chunks, which stored one by one were each written

        // loose and flushed (a VS Code clone ran at 27 objects a second).

            .iter()

            .map(|(ty, body)| (*ty, body.as_slice()))

            .collect();

        let batch = self.store.begin_batch()?;

        let stored = self.store.put_many(&objects);

        batch.finish()?;

        let cp_ref = objects

            .iter()

            .zip(stored?)

            return fail(format!("{remote_name} sent no checkpoint"));

        };

        self.install_checkpoint(&bookmark, &cp_ref)?;

        // The blobs of the state's opaque files come with no change when the

        // window holds none of the changes that set them (#137): fetch them

        // now, or under `filter.max-blob` leave them to be fetched on read.

                return fail(format!("{remote_name} did not send blob {}", b.short(12)));

            }

        }

        if self.config.max_blob.is_some() {

            self.register_missing_blobs(&imported, remote_name)?;

        }

                reason: "already up to date".into(),

            }]);

        }

        for h in &remote_heads {

                return fail(format!(

                    "the remote has change {} which you do not; pull first (`oxy pull {remote_name}`), then push again",

                    h.short(12)

        }

        if !force {

            let closure = self.closure_in_store(&local_heads)?;

                return fail(format!("not a fast-forward: remote head {} is not in your state; pull first or use --force", h.short(12)));

            }

        }

            .unwrap()

    };

    assert_eq!(lazy.read_blob(&blob).unwrap(), png, "fetched on read");

}

#[test]

                let heads = wire::decode_hashes(&body)?;

                let lock = self.lock_for(name);

                let _guard = lock.lock().unwrap();

            }

            Endpoint::Shallow => {

                let (heads, depth) = wire::decode_shallow(&body)?;

What this says:

- A depth-0 clone is five times slower than Git's full clone and fifteen

- `--max-blob 0` without a mount is slower, not faster: the checkout then

  fetches every binary file's blob one request at a time. Lazy contents

  only pay with a mount that reads them when asked.

- **Sparse** repositories hold the full change graph but only materialize the listed paths: the working copy contains nothing else, files outside the filter are neither reported nor removed, and changes touching other paths are stored and applied to the graph. A sparse clone sets `max-blob` to zero unless a size is given, so blobs outside the filter are fetched only if the filter later widens (§13.5). `oxy sparse PATH..` changes the filter of a clean working copy and re-checks it out.

- **Lazy blobs** are fetched via `objects` on first read. `oxy status` and `oxy commit` MUST NOT need them.

- Thin clients (§22) always use `depth = 0`: a checkpoint plus zero history.

Servers MUST honour `filter` on `negotiate`, `fetch`, and `checkpoint`.