Overnight backlog 2 (2026-09-28 to 2026-09-30)

Andy's brief: usability and features on Oxygenhub, as many features as possible in the VS Code extensions, and a stable, mature oxy client. Work top to bottom, but interleave the three tracks: after each hub or extension item, take the next oxy stability item if one is open. Each item is done when its tests pass, the gate is clean, it is committed with oxy as Andy and pushed to Earth. Log each iteration at the bottom.

Hub (oxygenhub): usability and features

• H1 Dashboard for signed-in users: my repositories, proposals needing me, issues assigned to me, recent activity across repositories I can see (pushes, proposals, issues, releases).
• H2 Empty-repository quickstart: exact commands for this repository (remote add, token, CA download, push) and for starting from nothing.
• H3 Theme switch (dark, light, auto) in the header and under Settings, remembered in the cookie; check every page in light mode.
• H4 Profile and organisation pages: generated identicon avatar, display name, bio, linked keys, repositories, recent activity, organisation members and teams.
• H5 Diff view: split (side by side) toggle remembered per user, collapse per file, hide whitespace changes, intra-line word highlighting.
• H6 Forks: fork button, fork creation (store copy, forked_from), fork list, "propose to upstream" from a fork.
• H7 Stars and watch counts, explore sorting (activity, stars, name) and filtering, repository topics.
• H8 Proposal and issue lists: filters (author, label, target, assignee), sort orders, pagination, counts in tabs.
• H9 File view: file tree sidebar, y for a permalink to the state, line range copy, blame age shading and "blame the state before this change".
• H10 Compare page with bookmark and tag pickers and a "propose this" button.
• H11 Help pages: getting started (install oxy, clone, push, tokens, CA, delegating to the hub), keyboard shortcuts, glossary for people coming from GitHub.
• H12 Password reset and email verification (email when SMTP is set; admin-issued reset link otherwise).
• H13b Uploaded profile pictures and organisation logos (Andy, oxygenhub#11): upload, validate by content, re-encode and crop, identicon fallback, remove.
• H13 Notifications: per-thread mark read, filter by kind and repository, "participating" versus "watching".
• H14 Accessibility and mobile pass: focus styles, skip link, landmarks, responsive tables and tabs, contrast in both themes.
• H15 Organisation webhooks page; admin storage and repository maintenance page (sizes, oxy gc).
• H16 Performance: cache rendered Markdown and highlighted files by object hash; measure the heaviest pages on Earth before and after.
• H17 Issue API: labels, assignees and milestone on create/edit; create labels (oxygenhub#3).
• H18 refs #N in change messages appears on the issue's timeline (oxygenhub#4).
• H19 Projects: boards of issues and proposals across an owner's repositories (oxygenhub#5).
• H21 Projects API: list, create, board, cards and columns over /api/v1 (oxygenhub#15).
• H20 Issue Markdown resolves against the default bookmark, not main (oxygenhub#6).

VS Code (oxygen-vscode, oxygenhub-vscode)

• V1 oxygenhub-vscode: proposal files in native diff editors (target state against projected state through a content provider), with review threads in them.
• V2 oxygenhub-vscode: notifications count in the status bar and an inbox quick pick that opens the item.
• V3 oxygenhub-vscode: completion of #N and @user in the Oxygen commit box and in comments; hover on #N shows the title.
• V4 oxygenhub-vscode: create an issue from the editor selection or a TODO line, with a permalink.
• V5 oxygenhub-vscode: releases view; draft a release from a tag.
• V6 oxygen-vscode: history graph actions for split, squash and rebase (oxy history commands), with confirmation and undo hint.
• V7 oxygen-vscode: commit box polish: amend toggle, message history, signed/unsigned indicator, warning on conflict markers.
• V8 oxygen-vscode: Open on Remote in editor gutter context (line permalinks), copy permalink.
• V9 Both: README screenshots-free walkthroughs, settings documentation, CHANGELOG per release.

oxy: stability and maturity

• O1 Property tests (proptest) that applying the same changes in any order gives the same state, over random edit sequences on several files.
• O2 oxy fsck: verify every object's hash, every change's references and signatures, the op log chain, and report precisely.
• O3 Crash safety audit: every write goes through write_atomic or the store's batch; a test that interrupts commit and push at each step and proves the repository still opens and fscks.
• O4 Benchmarks with thresholds: 10 000 files, 5 000 changes; status, commit, log, blame, push, clone; record numbers in docs.
• O10a Heads at scale (first part of O10): State::maximal compared every pair of heads (quadratic; about 1.5 s per call at 4 500 heads, called three times per commit); now one walk. Commit reuses the snapshot's base state instead of loading it again.
• O10b Parallel snapshot work: rendering the base state's files, building file graphs from a checkpoint, and reading working-copy files now run on every core (rayon).
• O12 log_for_path_in and blame_in rebuild and re-render the whole state on every call, and walk every change: take an already loaded state, stop at the first change touching the path when only the newest is wanted, and benchmark it (found in H16).
• O10c Snapshot cost in the in-memory state: faster graph hashing, no unused predecessor map, inline successor sets, lines moved not copied; OXY_TIMINGS=1 phase timings.
• O10d Skip reading text files whose stat matches a manifest that recorded them equal to the base (racy entries, those modified at or after the manifest was written, are still read); test that no edit is ever missed.
• F1a Priority (Andy, 2026-09-28): dogfood OxygenFlow. Every push to oxygen, oxygenhub, oxygenflow and both extensions lints, tests and builds through OxygenFlow on Earth, with results as checks on OxygenHub. F1a: ephemeral scratch mounts in jobs (ephemeral://tmpfs, ephemeral://disk) so builds have room; make deploy-runner.
• F1b A build image for the runner: a rootfs with the Rust toolchain (stable, rustfmt, clippy), Node, e2fsprogs-free build basics, and every crate of the oxygen, oxygenhub and oxygenflow lock files vendored with cargo pointed at them (jobs have no network); a script that rebuilds it when lock files change; imported on Earth and measured on a real cargo test of oxygen in a microVM.
• F2 oxygen pipeline (.flow/pipeline.kdl): fmt, clippy -D warnings, tests, release build; green on a real push.
• F3 oxygenhub pipeline: needs oxygen alongside (path dependencies), so the job checks out oxygen at a pinned change; fmt, clippy, tests, build.
• F4a oxygenflow's pipeline gains fmt, clippy and tests, with oxygen as its pinned subrepo; oxygenhub builds against the oxygen that oxygenflow pins (one oxy-core), and claims follow subrepos of subrepos.
• F4b Extension pipelines (oxygen-vscode, oxygenhub-vscode): typecheck, bundle, tests and package, offline. Needs the npm packages in the build image, and oxy for oxygen-vscode's tests (built in the job from a pinned oxygen). The hub client tests skip without a hub binary.
• F6a Runner runs several jobs at once within a budget (Earth: 3 jobs, 24 GiB, 8 vCPUs); the hub hands out only jobs that fit the room the runner reports.
• F6b1 Faster Rust jobs, first part: CI builds without debug info or incremental state, set once in each pipeline's rust sandbox env.
• F6b2 A warm dependency cache: the dependencies of each lock file prebuilt in the build image and copied onto the job's scratch disk; measured on oxygenhub.
• F6b3 The same prebuilt dependencies for oxygen and oxygenflow (one image rebuild, all pipelines re-pinned).
• F5 Required checks: each repository's default bookmark requires its pipeline's checks to land, and the work loop pushes and waits for green instead of gating only locally.
• O10e Checkpoint payload version 2: large file graphs as shared blobs named from an index, read and decoded in parallel; readers accept both versions (spec §11). Agreed by Andy on 2026-09-28.
• M1 (metalgear feedback 1, reported by Andy) Bookmarks with / in their names could not be pushed: attestation and checkpoint files are now flat, escaped names (oxygen#12). The hub is pinned to the fix and deployed.
• M2 Flow on/off per repository in the hub (Andy's request; feedback 10): a switch in repository settings for site admins, with hub.toml's [flow] repos as the default; no restart.
• M11 (feedback 12, Andy: urgent) Flow runs numbered per repository, not by the hub-wide id; existing runs renumbered and their check links rewritten by migration 0019 (oxygenhub#23).
• M12 (Andy; feedback 14a) Delete a bookmark on a remote: oxy push REMOTE --delete NAME (a signed, attested deletion the server checks like any update; never the default bookmark), and a delete button on the hub's bookmarks page for writers.
• M13 (feedback 3a) oxy bookmark switch --carry: take uncommitted work to the other bookmark when it applies cleanly there (and bookmark create --switch moving the working copy onto a new bookmark at its base, changes and all).
• M14 (feedback 7a) oxy show's summary lists every path the change touches with its kind (added, modified, removed, renamed, mode), not only additions.
• M15 (feedback 17a) A queued run says where it stands: its jobs' position in the runners' queue, what runs now and what fits the free room (the runner already runs several jobs within its budget; Earth's 5 vCPUs are deliberate after F6a), on the Flow tab, the run page and the API.
• M3 Start a run without moving a bookmark (feedback 9): "Run pipeline" on a state and "Re-run" on a finished run, in the web and the API.
• M4 Guest /dev/fd, /dev/stdin|stdout|stderr links in flow-init (feedback 15), and job variables FLOW_STATE, FLOW_HEADS, FLOW_BOOKMARK, FLOW_RUN, FLOW_REPO (feedback 17).
• M5 Sandbox-level env in pipeline.kdl, and the image's environment kept through flow rootfs import (feedback 16).
• M6 Flow API: GET /repos/{o}/{n}/flow/runs, /flow/runs/{n} with jobs, a job's log; checks by head hash as well as state (feedback 11). JSON 404s under /api/v1 (feedback 13). Per-repository run numbers, or a note (feedback 12).
• M7 Server push errors name the operation and bookmark and log the error chain (feedback 2).
• M8 merge updates a working copy that is clean against the pre-merge base; checkout tells "removed by you" from "not yet written"; bookmark switch --help says what happens to uncommitted work (feedback 3).
• M9a oxy describe naming (tag, else nearest tag + distance + change, else bookmark + change, -dirty, --json), tags accepted where a change is and tag list showing heads (feedback 4); commit -F (6).
• M9b submodule status shows added-but-unpinned and has --json (5, 7); doctor before the first commit (8).
• M10 Hub: say "signed by an unlinked key" on changes and in /api/v1/user, pointing at Settings (feedback 14).
• P1a Text conflicts resolved region by region on OxygenHub (first part of P1, below).
• P1c Name conflicts on the resolver: keep one candidate, which takes the name as a move.
• P1d "Resolve in VS Code": the resolver hands a conflict to oxygen-vscode (a vscode:// URI the extension handles: clone or open, switch to the bookmark, open the file).
• P1e Replace conflicts of binary files: oxy-core cannot yet resolve one by keeping an existing candidate (writing a candidate's bytes counts as no change); make that a resolution, then offer it on the resolver.
• P1 Conflict resolution on OxygenHub (Andy's list, item 1). A resolver page for a conflicted state:
  • Per conflict region: pick a side, several sides, or none; edit freely; tree conflicts too (keep a candidate).
  • Commit the result as a kind = resolution change on the bookmark, through the web-edit path. Signing: sealed when the author next pushes, or "resolve in VS Code" hands off to oxygen-vscode.
  • Shareable link to a conflict.
  • First single-user, then P1b.
• P1b Real-time collaboration on the resolver: presence, live edits merged between viewers (SSE or WebSocket), and whoever is viewing sees the resolution land.
• P2 Function history (item 5; needs no semantic-deps):
  • oxy-core: a history query over a set of atoms (the changes that inserted or deleted any of them, with deleted atoms included).
  • Hub: function boundaries by tree-sitter for the languages we host (Rust, TypeScript, Python, shell).
  • Clicking a function on a file page shows every ChangeId that touched its lines, as a list and a small graph; exact because atoms keep identity across edits and moves.
  • The cross-file semantic graph stays out; noted as future work.
• P3 Swimlanes (item 3):
  • Hub: a bookmark's changes drawn as lanes of independent changes (oxy-core lanes), with dependencies as edges and no merge nodes.
  • P3b: drag and drop on proposal bookmarks only. Dropping a change onto another proposes a squash, dragging a dependent chain proposes a rebase. The hub produces a plan and the author's oxy or oxygen-vscode applies and signs it (V6 has split, squash and rebase). Reordering independent changes means nothing and is not offered.
• P4 Signed Flow receipts:
  • A receipt object type in the Oxygen spec.
  • A runner identity whose key (composite Ed25519 + ML-DSA-65) signs each receipt.
  • Receipts stored in the repository and verified by the hub.
  • Flow output and artifacts, so a release asset links to the receipt that built it.
• P4b Trust dashboard (item 4): per release and asset, a graph of authors' identities and signatures, the runner and its pinned environment, inputs (state, scope hash), and receipts, with a one-click audit view and export.
• P5 Web workspaces (item 2), in parts:
  • P5a: flow-casfs, a read-only FUSE mount of a state from CAS chunks, measured.
  • P5b: "Open in Workspace" on a change. openvscode-server (MIT, unmodified) with oxygen-vscode inside a Firecracker microVM per workspace, the state mounted read-only through casfs with an ephemeral overlay for edits, and commits back through oxy. Boot time measured, aiming under 100 ms for the mount.
  • A fork ("oxycode") only if an extension cannot do what we need; decided with Andy.
• P5c Import microsoft/vscode's full Git history with oxy git import into a local scratch repository (not published): about 130 000 commits as a stress test of import, log, blame and status at scale, recorded in docs/benchmarks.md.
• O10f Load file graphs lazily from a version 2 checkpoint: a state keeps unread graphs by reference and reads one when first needed.
• O10g Render only what a snapshot needs, first part: the manifest records, per file, the key of the base graph it matched, so an unchanged file whose graph is untouched is neither read nor rendered; used by status, log, show, tag and bookmark.
• O10h The same for commit, diff, amend and the other full snapshots: a lazy base that builds only the graphs the change touches; cache materialized states.
• O5 Concurrency: two processes committing, snapshotting and pushing on one repository; locks hold, nothing is lost.
• O6 Error messages audit: every user-facing error says what to do next; oxy doctor checks identity, config, remotes, CA files, hub reachability.
• O7 Shell completions (oxy completions bash|zsh|fish) and man pages generated from clap.
• O8 Git round trip on real history: import a scratch mirror of tetriblox (never the live repo), export it back, compare trees at every commit.
• O11 Line placement found by O8: in 5 of 539 tetriblox commits (all non-merge; e.g. 43de61fac554 src/banked/code_bank_07.c, 021ad78791a2 code_bank_03.c, 2721670b49af code_bank_02.c, 435fbe1d5fac scripts/x16_unchanged.py, d17c19b22748 test/test_memory_guards.py) one line lands elsewhere than in Git with no conflict reported, so an insertion is anchored between atoms that are not adjacent in the base. Reproduce with oxy git verify on a scratch mirror; find which edit of the importer's diff (build_from_entries/text_edits) anchors non-adjacently, add a debug assertion for anchor adjacency, fix, re-verify.
• O9 Portability review for macOS and Windows: path separators, executable bits, case-insensitive file systems, CRLF; tests where it can be exercised on Linux.

Log

• 2026-09-28 H1 done: signed-in dashboard at / (review queue, own proposals, assigned issues, repositories, activity feed filtered to visible repositories); test dashboard_shows_what_needs_the_viewer; deployed to Earth.
• 2026-09-28 O1 done: crates/oxy-core/tests/commutativity.rs (proptest, 32 cases): diverging clones with random edits, rebuilt in shuffled and random dependency orders, checkpoint round trip, and push in random order to a fresh clone; all give identical checkpoints, heads and trees. About 80% of generated cases conflict. No defects found. Workspace tests all green (oxy-core 129 + new).
• 2026-09-28 H2 done: empty repositories show a quickstart (remote named after the host, e.g. earth; CA download and remote.X.ca when self-signed; token placeholder; push; start from nothing; oxy git import); readers get a plain notice. Tests: empty_repository_shows_a_quickstart and a remote-naming unit test; hub spec §6 row updated; deployed.
• 2026-09-28 O2 done: oxy fsck [--json] (objects, op log through all parents, references and change closure with identities/blobs/chunks/signatures, bookmark states, checkpoints re-derived, ref and tag attestations verified); spec Draft 0.8h §21.1, guide updated. Test fsck_passes_a_sound_repository_and_names_each_fault (corrupt object, missing change, missing blob, broken op head). Clean on oxygen, oxygenhub, oxygen-vscode, oxygenhub-vscode, hellooxy. Release binary rebuilt.
• 2026-09-28 V1 done: hub API GET /proposals/{n}/files and /proposals/{n}/content/{base|head}/{path}, and anchored comments now carry their current line (deployed). oxygenhub-vscode 0.2.0: proposals expand to files, native diff editor per file, View Changes multi-diff, review threads on the projected side; installed in Default and Rust profiles (Developer: Reload Window to pick it up). Tests: hub api test extended; extension pass 6 fail 0 against a real hub.
• 2026-09-28 O3 done: new oxy_core::durable (unique temp, fsync, rename, directory fsync) for every durable write; real bug fixed: inside a write batch the op head moved before the batch (including the new op object) was on disk, so a crash there left an unopenable repository; Store::flush now runs before the head moves. Test stops commit (20 steps) and push (32 steps) at every step: both repos open, fsck clean, command retries. Spec §13.6. Hub rebuilt and redeployed with the fix. Not covered: working-copy file writes during checkout are still plain writes (user files, recoverable by snapshot).
• 2026-09-28 H3 done: header theme switch (dark/light/auto) and Settings → Appearance, theme cookie; auto follows the system live. Light-mode pass by headless Chrome screenshots of dashboard, overview, file, proposal, issue, settings, changes: found and fixed highlighted code drawing boxes in both themes (syntect scope comment colliding with the page .comment class; classes now sy- prefixed) and the band ADMIN link unreadable in light. Test theme_is_chosen_in_settings_and_remembered_in_a_cookie; hub spec §6.1; deployed. The code editor picks its theme at load, not live.
• 2026-09-28 O4 done: harness crates/oxy-core/tests/bench.rs (ignored; run by hand) and docs/benchmarks.md. Full run on disk took 5 h 14 min. Andy: status and commit are slow at scale: at 10 000 files / 5 000 changes a commit averages 3.8 s, a 10-file commit 9.1 s, a clean status 3.0 s, blame 2.9 s, peak memory 1.4 GiB; push 0.8 s, clone 3.4 s, log 0.4 s are fine. Cause: every snapshot loads and materializes the whole base state. New item O10 (moved ahead of O5) fixes it.
• 2026-09-28 V2 done: hub API GET /notifications, POST /notifications/{id}/read, POST /notifications/read (scope user:read; deployed). oxygenhub-vscode 0.3.0: status-bar bell with unread count across hubs, new-notification messages, Open Inbox quick pick that marks read and opens proposals/issues in the editor. Installed in both profiles (Reload Window). Tests: hub api test extended; extension pass 7 fail 0.
• 2026-09-28 O10a done: State::maximal was quadratic in heads (4 500 heads in the benchmark); now one walk, with a property test against the old definition. Commit reuses the snapshot's base. At 10 000 files / 5 000 changes: commit 3.8 s to 0.86 s, 10-file commit 9.1 s to 0.86 s, status 3.0 s to 0.80 s, blame 2.9 s to 0.81 s, memory 1.4 to 1.1 GiB; benchmark run 5 h 14 min to 1 h 12 min. Hub redeployed with it. O10b (manifest fast path, lazy base) remains for the per-file cost.
• 2026-09-28 V3 done: oxygenhub-vscode 0.4.0: # and @ completion in the Oxygen commit box and comment editors, hover on #N; repository from the SCM root. Parsing tested in Node (pass 10, fail 0). Installed in both profiles.
• 2026-09-28 O10b done: rayon for materialize, checkpoint file graphs and working-copy reads. At 10 000 files: clean status about 800 to 460-580 ms, commit 861 to 550-605 ms. Remaining cost is loading the whole base (O10c, needs a checkpoint format change in the spec, so left for Andy to agree). Hub redeployed.
• 2026-09-28 H4 done: /{owner} profile (identicon, display name, bio, location, website, keys, organisations, visible repositories, activity by that person; never the email) and organisation page (description, members and roles, teams with sizes, repositories, activity); /avatar/{name} identicons also in the header and feeds; migration 0008 (bio, website, location) and Settings fields (http(s) websites only); avatar and help reserved. Test profile_and_organisation_pages; screenshot checked; deployed (andymccall profile 200 on Earth).
• 2026-09-28 O5 done. Real bug fixed: concurrent commands overwrote .oxy/ops/head, so the loser's operation (and its commit on the bookmark) vanished; a two-workspace test lost about half its commits every run. The head now moves by compare-and-swap under a short .oxy/ops/lock, and a mover that lost the race records a merge op (two parents, three-way merged view; bookmarks keep both sides' heads), as spec §12.1 described; undo refuses on a moved head. Tests: concurrent two-workspace commits with pushes lose nothing (5/5 runs), deterministic merge of two ops from one parent; two real oxy processes x 25 commits keep all 50 (39 merges). Spec §12.1 updated. Hub redeployed.
• 2026-09-28 H5 done: word-level marks within paired changed lines, ?w=1 hides whitespace-only changes (change, compare, proposal files), collapsible files (over 400 rows start closed), unified/split toggle remembered in a diff cookie, collapse/expand all. Tests: two renderer unit tests and diffs_mark_words_hide_whitespace_and_collapse; split view checked by screenshot; hub spec §6.8.1; deployed.
• 2026-09-28 O6 done: oxy doctor [--offline] [--json] (op log and stale locks, identity object/secret/expiry, author defaults, each remote: plain HTTP, token, CA file, reachability and repository id) with a next step per problem; every failed remote request now carries a hint (untrusted certificate, 401, 403, 404, refused, DNS, timeout) and transport errors no longer repeat the URL; clearer messages for different-repository remotes, pull-first pushes (still contains "pull first", which oxygen-vscode matches), unauthorized keys, and no repository. Tests: hint table and doctor scenarios. Clean on oxygen and oxygenhub checkouts. Spec §21.2, guide. Hub redeployed.
• 2026-09-28 H6 done: fork button and form, Repos::fork (new id, hard-linked objects, bookmarks copied, no policy), migration 0009 forked_from, forks list, "forked from" and fork count on the overview, "propose to upstream" link. Test fork_and_propose_upstream (fork, fsck, clone the fork, push a bookmark, propose upstream, files tab shows it). Hub spec §6.3 row; deployed.
• 2026-09-28 O7 done: oxy completions SHELL (clap_complete) and oxy man [--dir] (clap_mangen 0.3, 104 pages); help text written for 112 bare commands and arguments with a test that every one has help; oh-my-bash plugin loads bash completions; guide section. Tests cli_docs (every shell, pages, argument help on the page). Andy: oxy completions bash > ~/.local/share/bash-completion/completions/oxy to enable.
• 2026-09-28 O7 note: the O7 commit went in before clippy finished (two lints in the new help test); fixed in the next commit. The gate now runs to completion before every commit.
• 2026-09-28 H7 done: stars (toggle, counts), watcher counts on the overview, repository topics in settings (validated) shown as chips, Explore filter by text and topic and sort by activity/stars/name with per-row stars and topics; migration 0010. Tests: topic parsing unit test and stars_topics_and_explore. Gate fully green before commit; deployed.
• 2026-09-28 O8 done. oxy git verify GIT_DIR checks an import commit by commit (content, exec bits, symlinks, pins; conflicts named with their changes; first differing line). On a scratch mirror of tetriblox (539 commits, 208 merges, 880 gitlinks; the live repo was only read by git clone --mirror): import 36 s, tip tree round-trips exactly, and verification found real core bugs that also affect ordinary commits, now fixed: (1) insert after a line, then delete that line, left a delete/insert conflict (deletions now depend on the inserters of the lines right after them); (2) a binary or submodule reverted to an earlier blob lost it, and replacements had no dependency (now depend on the change that set their old blob; causal supersession, legacy records keep the old rule); (3) merges of independently replaced binaries/submodules stayed conflicted (importer resolves to the merge's blob). Mismatching commits went from 50+ (verification stopped early) to 5, now O11. Tests: 3 regressions (sequential insert/delete, binary revert, Git binary merge + verify). Spec Draft 0.8i §8.1, §9.3, §23. Hub redeployed.
• 2026-09-28 H8 done: open counts on the Proposals and Issues tabs (from the repository lookup), issue author: filter and sorts (newest/oldest/updated/comments), proposal filter (author:, label:, target:, words) with labels shown and sorts (updated/newest/oldest), 25-per-page pager keeping filter and sort. Test lists_filter_sort_page_and_count; spec §6.3 rows; deployed.
• 2026-09-28 O9 done: portable::Platform (detected, overridable in tests); no exec bits: snapshot keeps the recorded bit (it was recording a mode change on every Windows snapshot); no symlinks: a plain file holding the target stays the symlink (spec §7.7 required it, the code converted it); checkout lists case collisions and Windows-invalid names on affected platforms and oxy doctor does everywhere; CRLF already handled by the eol attribute; separators verified (components joined with /). Tests simulate Windows and macOS. Follow-up: normalise \ in paths typed on Windows command lines. Spec §7.7. Hub redeployed.
• 2026-09-28 V4 done: oxygenhub-vscode 0.5.0 "New Issue from Selection" (context menu): quotes the selection under a permalink (head-pinned when single-headed and saved), TODO/FIXME lines suggest the title and can be annotated TODO(#N), then the issue opens; line-range links. Tests pass 13 fail 0. Installed in both profiles.
• 2026-09-28 O11 done: root cause in text_edits: similar's capture_diff_slices runs a Compact hook that slides deletions along equal lines and can leave an insertion with an earlier old index, anchoring a block one line early (a brace on the wrong side). Now uses the diff with only the Replace hook. Randomized replay test (2 000 repetitive files; fails on the old code). tetriblox scratch import verifies all 539 commits, 95 585 files. Note: that commit also picked up Andy's new docs/xenon_spec.md and fix.py, fix2.py, format_xenon.py from the working copy; left for Andy to decide.
• 2026-09-28 UI request from Andy (between items): repository page centred with the sidebar, README as wide as the file table, clone command in the top bar; repository, organisation and account settings get a sticky list of sections on the left and equal-width boxes. Screenshot-checked, deployed.
• 2026-09-28 V5 done: oxygenhub-vscode 0.6.0 Releases view (releases per repository with latest/pre-release, assets with size and downloads, source archives) and Draft Release…: pick an unreleased tag, title from the tag message, notes generated from the changes since the newest full release's tag, pre-release suggested from the tag name. End-to-end test tags with oxy and releases through the client. Tests pass 15 fail 0; extension spec §8.2. Installed in both profiles.
• 2026-09-28 H9 done: file page tree sidebar (path expanded, 200 per directory then "N more", hidden under 900 px); state addresses h1+h2 (sorted full hashes, at most 32) so any state has a permalink; y on file and tree pages switches to it; a line-range bar with Copy lines and Copy permalink; blame shaded in ten age steps and each run links "blame before this change" (the state of its dependencies). Tests: view unit tests (sidebar order and limit, state addresses) and browse end to end. Hub spec §6.3, §6.6, §6.13. Deployed; health ok.
• 2026-09-28 Requests from Andy (between items):
  • OxygenHub naming. The name is written OxygenHub everywhere people read it (hub, both extensions: oxygenhub-vscode 0.6.1, oxygen-vscode 0.7.1).
  • OxygenFlow M0, built and running on Earth. Xenon was renamed to OxygenFlow, in the separate oxygenflow repository. It has:
    • flow-core: KDL pipeline, validation with lines, canonical CBOR, receipts, runner API types
    • flow-init, as the guest's PID 1
    • the Firecracker microVM tier
    • flow check/run/rootfs/runner
    • a microVM conformance test
  • Hub side. Pushes start runs, a runner API with repo-scoped read-only job tokens, jobs mirrored as flow/<job> checks, and a Flow tab with the SVG job graph and live logs. Hub spec §13.2; migration 0011; tests/flow.rs.
  • Earth. Firecracker v1.17.0, kernel 6.1.155 and the Alpine 3.24.2 rootfs, pinned in ~claude/flow. flow-runner.service is hardened. hub.toml gained [flow] limited to andymccall/* (backed up as hub.toml.before-flow).
  • Result. oxygenflow's own pipeline passes (runs 1 and 2). Andy's spec is committed, renamed to OxygenFlow, with a README.
  • oxy-core. tls_client_config is public.
• 2026-09-28 Flow state stamps instead of CI badges (oxygenhub#1, closed by the change):
  • /flow/stamp/{ref} is an SVG of the newest run of exactly that state, with receipt hashes in its metadata. For bookmarks and tags it redirects to the stamp of the current state.
  • In READMEs, [![flow](.flow/stamp)](.flow/run) resolves against the state being viewed.
  • Fixed oxygenhub#2 on the way: README images pointed at the HTML file page. There is now a /raw/{ref}/{path} route.
  • The oxygenflow README shows its stamp (oxygenflow#1).
  • From now on every item gets an issue on Earth and its commits say closes/refs #N.
  • Gaps the workflow exposed became H17 to H20 (oxygenhub#3 to #6).
• 2026-09-28 H10 done (oxygenhub#7, closed by the change):
  • The compare page has base and head pickers (bookmarks and tags in a datalist; any change or state can be typed), a swap link, /compare?base=&head= as the form target, and /compare alone comparing the newest other bookmark against the default.
  • Propose this shows for writers when both sides are bookmarks and head has changes; it becomes "proposal #N is open" when one exists.
  • Tests in browse and proposals. Hub spec §6.3. Deployed.
• 2026-09-28 H11 done (oxygenhub#8, closed by the change):
  • /help is a sectioned page with getting started, identity and key linking, pushing, cloning, proposals, delegating to the hub, pipelines and state stamps, the keyboard, and a GitHub glossary.
  • Every command carries this hub's address, remote name and certificate step.
  • It is linked from the band, the footer and the ? sheet.
  • Browse test; hub spec §6.3. Deployed.
• 2026-09-28 H12 done (oxygenhub#9, closed by the change). Spec §5.1.1 first.
  • Account links. 32 random bytes, stored as a BLAKE3 hash, single use and expiring. Migration 0012.
  • Verification. Sent on registration and on every address change (48 h). It only verifies the address it was sent to. Settings shows the status and can resend: one every 2 minutes per address, 10 an hour per account.
  • Reset by email. By username or verified email (1 h, one every 2 minutes). The answer is identical whether or not anything matched, and mail goes out in the background so timing leaks nothing.
  • Reset by an administrator. From /admin (24 h, shown once, audited).
  • Using a reset link. It rotates the session salt (every session ends) and voids other links. TOTP stays on; banned accounts are refused.
  • Mail. A shared mail module with file:// for development. Notification mail only goes to verified addresses.
  • Tests. tests/recovery.rs covers the whole flow through a file mailbox.
  • Earth. Earth has no SMTP, so resets there go through the admin link. Existing addresses count as unverified until verified.
• 2026-09-28 H13 done (oxygenhub#10, closed by the change):
  • Notifications record their thread, repository and reason (participating or watching) and can be marked done. Migration 0013 backfills threads and repositories from the URLs.
  • The inbox shows one row per thread, with updates and new counts.
  • Filters: inbox, unread and done views, reason, kind family and repository, with counts.
  • Per-thread read, unread and done. Done threads return when a new event arrives.
  • Opening a row marks its thread read.
  • notify::add takes a struct.
  • Tests extended in tests/issues.rs. Hub spec §10.
  • The API keeps per-item read; per-thread actions in the API are a follow-up for the VS Code inbox.
• 2026-09-28 Andy asked for uploaded profile pictures and organisation logos: added as H13b (oxygenhub#11), taken next.
• 2026-09-28 H13b done (oxygenhub#11, closed by the change):
  • Upload a picture under Settings › Profile › Picture, or an organisation logo under its settings (owners only).
  • PNG, JPEG or WebP, recognised by content; at most 5 MiB and 8 000 px a side.
  • Every upload is decoded, centre-cropped, scaled to 400×400 and re-encoded (PNG if it has transparency, JPEG otherwise), so uploaded bytes are never served.
  • /avatar/{name} serves the picture with an ETag, falling back to the identicon; Remove restores the identicon.
  • Avatar CSS no longer pixelates photos.
  • Unit tests for processing and refusals; end-to-end test in tests/accounts.rs. Hub spec §6.3. Deployed.
  • This machine's disk filled up (0 bytes free) during the build. I removed the regenerable target/debug/incremental caches of oxygenhub and oxygen (33 GB) and build with CARGO_INCREMENTAL=0 from now on.
• 2026-09-28 H14 done (oxygenhub#12, closed by the change):
  • Keyboard and screen readers: a focus ring on everything focusable; a skip link to <main id="main">; named landmarks (Account, Site, Repository and Settings navigation); aria-current on the current tab.
  • Contrast: WCAG AA in both themes, enforced by tests/contrast.rs over the CSS variables.
    • Light theme: mute, acc, ok, now and the string, function and comment syntax colours adjusted.
    • Dark theme: comment colour adjusted.
    • Text no longer uses --dim.
  • Under 760 px: tab bars scroll on one line, the tree drops its message column, wide content scrolls inside its panel, sectioned pages stack, and the header search hides.
  • Checked at 390 px on Earth. Hub spec §6.13.
• 2026-09-28 H15 done (oxygenhub#13, closed by the change):
  • Organisation webhooks. A Webhooks section in organisation settings: add, ping, enable or disable, delete, deliveries and redeliver.
    • Repository and organisation webhooks now share one module (web/webhooks.rs) and one template macro.
    • Every action checks that the hook belongs to the scope it is managed from.
  • Storage. /admin/storage lists each repository's size, loose objects and packs. Maintenance runs oxy gc (grace period kept, write lock held) on one repository or all, and is audited.
  • Tested in tests/accounts.rs. Hub spec §6.3, §12.2. Deployed.
  • Earth's repositories can be maintained from /admin/storage now; I have not run it on Andy's data.
• 2026-09-28 H16 done (oxygenhub#14, closed by the change). Measured on Earth first (oxygenhub/docs/performance.md).
  • The raw bytes of heavy files took 5 ms, but their pages took 196 to 428 ms: syntax highlighting, Markdown rendering, and above all the file's "last change", found by log_for_path_in rebuilding the state and reading every change on each view.
  • Now cached, in memory-bounded LRUs keyed by content or by (state, path): rendered Markdown, highlighted files, last change and blame. Labels are still computed fresh.
  • ?plain=1 takes the lean path.
  • Warm views: spec.md 196 → 8 ms, repo/mod.rs 400 → 18 ms, state.rs 317 → 14 ms, blame 428 → 23 ms.
  • Unit test for the LRU; browse test checks the second view hits the cache. Hub spec §16.3.
  • Follow-up for oxy-core: log_for_path_in should reuse a loaded state instead of rebuilding it.
• 2026-09-28 O12 done (oxygen#1, closed by the change; the first issue in the oxygen repository):
  • oxy-core has log_of(state), log_for_path_of(state, path, limit) and blame_of(state, tree, path). They find the path in the tree view alone, with no full render, and the walk stops at limit.
  • log_for_path_in and blame_in wrap them and load once instead of twice.
  • Test history_and_blame_of_a_loaded_state_match_the_full_walk; gate green; release binary rebuilt.
  • The hub uses them for last change, blame and tree rows.
  • Cold file pages on Earth: 196/400/317/428 ms (before any caching) → 146/256/121/88 ms; warm 8–24 ms (oxygenhub/docs/performance.md).
• 2026-09-28 H17 done (oxygenhub#3, closed by the change):
  • POST /issues takes labels, assignees and a milestone (triage). Unknown names are refused before anything is created.
  • New PATCH /issues/{n}: title and body for the author or triage; the whole label set, assignees and milestone for triage; each change goes on the timeline.
  • POST /labels creates or changes a label and DELETE /labels/{name} removes it (triage).
  • hub-api types IssueEdit and NewLabel; TS regenerated (the extension's copy follows with its next change). Test api_issue_triage_and_labels; hub spec §12.1.
  • Dogfooding:
    • Each Earth repository now has the labels bug, feature, performance, accessibility, security and gap.
    • Every issue so far is labelled.
    • The work log's issue helper sets labels from now on.
• 2026-09-28 H18 done (oxygenhub#4, closed by the change):
  • Any bare #N in a pushed change's message, on any bookmark, adds "referenced by change on " to that issue's or proposal's timeline, with the hash linked.
  • closes #N still records only "closed by change"; owner/name#N from other repositories is left alone.
  • refs::references has a unit test; the issues end-to-end test covers issue and proposal timelines. Hub spec §8.
  • From now on, the refs #N lines in work commits show on the Earth issues.
• 2026-09-28 H19 done (oxygenhub#5, closed by the change). Spec §8.2 first.
  • Projects belong to a person or organisation: /projects/{owner} and /projects/{owner}/{n} ("projects" is now a reserved name).
  • Columns start as Backlog, Doing and Done; they can be added, renamed, moved and removed (their cards go to the first column; the last column stays).
  • Cards are issues or proposals of the owner's repositories (by repo#N, or #N with a repository picked) or notes. Each can be on a project only once. They move, reorder and are removed without JavaScript.
  • Visibility: public or private (owner, organisation members and admins). Cards from repositories the viewer cannot read are not shown at all.
  • A closed project is read-only; deleting one leaves the issues.
  • Issue and proposal pages list their projects; profiles and organisation pages link to them.
  • Migration 0015. Test project_boards plus reference parsing. Screenshot-checked on a scratch hub.
  • The screenshot tool now disables the browser cache (an earlier shot had served a stale style.css).
  • Gap found: no projects API → H21 (oxygenhub#15).
• 2026-09-28 H20 done (oxygenhub#6, closed by the change): relative links and images in issue, comment and proposal Markdown resolve against the repository's default bookmark; release notes resolve against the release's tag. Test issue_markdown_follows_the_default_bookmark.
• 2026-09-28 Webhooks, from Andy's report (oxygenhub#16 and #17, closed by the change):
  • Why Discord got nothing. Every delivery, ping included, was the OxygenHub envelope, which Discord rejects ("Cannot send an empty message").
  • Formats. Hooks now have a format: oxygenhub, discord (an embed with the event's summary; mentions disabled so user text cannot ping) or slack. It is picked from the URL; migration 0016 switched existing Discord and Slack hooks.
  • Settings.
    • The URL is masked (long path segments and query cut short, since chat webhooks keep a token there; the audit log records the same masked form) and wraps inside the panel.
    • The table shows the last delivery result.
    • Each hook has an edit form; a blank URL or secret keeps the current one.
  • Also found. Issues opened, commented on, closed or reopened in the web interface emitted no webhook events at all; now they do.
  • Tests. Unit tests for the formats and masking; end-to-end test webhook_formats_editing_and_web_issue_events. Hub spec §12.2.
• 2026-09-28 H21 done (oxygenhub#15, closed by the change):
  • /api/v1/projects/{owner}: list and create.
  • /api/v1/projects/{owner}/{n}: the board as the caller may see it, and PATCH.
  • /cards: add a reference or note; columns by id or name.
  • /cards/{id}: move or remove.
  • The pages and the API share rights_of, board_columns and add_card. hub-api types added; TS regenerated. Test api_projects. Hub spec §12.1.
• 2026-09-28 Repository overview, from Andy's review (oxygenhub#18, closed by the change):
  • The heads and conflicts strips sit inside the main column.
  • Clone is a button beside search: a popup with a selectable command, copy, and the bare URL.
  • Contributors box: authors counted from the state's changes, linked to hub accounts through linked keys; unsigned changes with no author show as "Unattributed changes".
  • Languages box: bytes per language (an extension table plus syntect), with Linguist's colours. Prose, lock files and vendored paths are left out; under 1% folds into Other.
  • A public, internal or private badge by the repository name.
  • Tests in browse.rs and a unit test for detection. Screenshot-checked on Earth.
  • Andy's key is not linked to his account yet (Settings › Keys), so his contributor entry is not a link.
• 2026-09-28 V6 done (oxygen-vscode#1, closed by the change). oxygen-vscode 0.8.0:
  • The History graph's change picker, and a right-click menu on its rows (webview context menus), offer:
    • Split for heads with several files: pick files; they become the first change.
    • Squash into a dependency, picked when there are several.
    • Rebase onto a bookmark, or a change or tag typed in.
  • Each asks first, then shows oxy's summary with an Undo button (oxy undo).
  • Client methods split, squash and rebase, tested against the real oxy with undo. check green (9 tests); packaged and installed into the Rust profile.
• 2026-09-28 V7 done (oxygen-vscode#2, closed by the change). oxygen-vscode 0.9.0:
  • Amend mode (pencil or close icon in the Source Control title bar): Ctrl+Enter amends; the box starts from the last change's message.
  • Previous Commit Messages: remembered per repository in workspace state, 30 kept.
  • Signing indicator: the placeholder says signed, sealed at push, or unsigned, read from oxy identity show at most every 30 s.
  • Conflict marker warning on commit, commit-selected and amend: files oxy reports with markers left, plus any changed text file with lines opening or closing a conflict (Oxygen's or Git's). The dialog can open the first one.
  • Pure logic in src/commitbox.ts with unit tests; identity() tested against the real oxy. check green (14 tests); installed into the Rust profile.
• 2026-09-28 V8 done (oxygen-vscode#3, closed by the change). oxygen-vscode 0.10.0 and oxygenhub-vscode 0.6.2:
  • The line-number gutter (editor/lineNumber/context) and the editor context menu offer Open on Remote, Copy Remote Link and Copy Permalink.
  • The link covers the clicked line or the selection (#L10-L20).
  • A permalink uses OxygenHub's state address: the bookmark's heads, sorted and joined with +. Checked live: an 11-head address for oxygen/README.md opens with 200 on Earth.
  • A note appears when uncommitted edits may shift the lines, or when remote links point past unpushed changes.
  • stateSpec and linkedLines are unit-tested; the hub extension keeps + readable (tested) and its API types are brought up to date (issue editing, labels, projects). Both checks green; both installed into the Rust profile.
• 2026-09-28 V9 done (oxygen-vscode#4, closed by the change):
  • Both READMEs rewritten as walkthroughs by task, each claim checked against the code:
    • Oxygen: commit, conflicts, sync, history rewriting, bisect, line links, trust.
    • OxygenHub: propose, review, land, issues, releases, notifications.
  • Each README has a Settings table.
  • Every CHANGELOG entry is dated from the history.
  • test/docs.test.mjs in both fails if a setting is missing from the README or the newest CHANGELOG entry is not the package version. Both checks green (18 tests each).
• 2026-09-28 O10c done (oxygen#2, closed by the change), after splitting it.
  • Measured first. New OXY_TIMINGS=1 phase timings, documented in the guide. At 10 000 files and 200 changes, loading the base state was about 790 of 1 230 ms. A checkpoint did not help: decoding it took 680 ms, like replaying the history, since both build the same in-memory graphs.
  • Fixed without a format change:
    • A seeded fast hasher for the graph maps (fasthash.rs, tested).
    • The predecessor map was written for every line and read nowhere; it is removed.
    • An inline edge set replaces a BTreeSet per vertex.
    • Lines are moved in with one lookup each.
  • Result. Both builds run alternately on the same load, medians: clean status 0.96 s to 0.52 s, one-file commit 0.99 s to 0.51 s, peak memory 657 MB to 239 MB (docs/benchmarks.md).
  • Gates green for oxygen and oxygenhub; release binary rebuilt; hub redeployed.
  • The rest is split into:
    • O10d: skip reading files that are clean by the manifest; next.
    • O10e: per-file checkpoints, a spec §25 format change. Andy: this one waits for your agreement.
  • Also this iteration: V6 to V8 had been installed into the Rust profile only; now into the default profile too, as the loop asks.
• 2026-09-28 O10d done (oxygen#3, closed by the change):
  • A text file whose size and mtime match the manifest (outside the 2 s racy window), and whose recorded hash equals the base's rendering of it, takes the base's bytes instead of being read.
  • At 10 000 files, a clean status opens none of the files (checked with strace).
  • With a warm cache the walk falls only from about 75 to 56 ms, since traversal and stat remain. The gain is larger on a cold cache or a slow disk.
  • Test stat_cache_takes_unchanged_text_from_the_base_and_misses_no_edit, using unreadable files to prove what is and is not read:
    • an older uncommitted edit is always read, never replaced by the base;
    • a same-size edit made just now is caught by the racy window;
    • after a commit the edits become the base.
  • Spec §12.4. Gate green; release binary rebuilt. The hub (bare repositories) is unaffected.
  • Next is O10e, which waits for Andy's agreement to change the checkpoint format.
• 2026-09-28 O10e done (oxygen#4, closed by the change). Spec §11, Draft 0.8j.
  • Format. Payload version 2: a file graph encoded in 2 KiB or more is a blob of its own, named from an index; smaller ones stay inline. Blobs are content addressed, so unchanged files are shared between checkpoints.
  • Compatibility. Readers accept both versions; writers produce version 2. gc keeps the graph blobs, fsck checks them against a full load in the payload's own version, and shallow-clone bundles carry them.
  • Speed. The first cut was slower than version 1, because it read 10 000 blobs one at a time. So the store gained get_many, which reads loose objects in parallel and packed ones in parallel after one index pass, and the graphs are decoded in parallel.
  • Result at 10 000 files, 216 changes (the same binary reading both versions, alternated, medians): load through a checkpoint 615 ms (v1) to 342 ms (v2). The index is 2.4 MB against a 62 MB v1 payload. A second checkpoint after a one-file edit took 0.63 s against 1.08 s.
  • Tests. Unit tests for the v2 round trip, determinism, missing blobs and unknown versions, and get_many over loose, packed and missing objects. A repository test covers a large file's graph blob through gc, fsck, a shared second checkpoint, the shallow bundle, an old v1 checkpoint still loading, and a lost blob failing loudly.
  • Gates green for oxygen and oxygenhub; release binary rebuilt; hub redeployed.
  • Andy: oxy older than this cannot read checkpoints written from now on. Rebuild every copy, as ~/.local/bin/oxy already is.
  • New priority from Andy: dogfood OxygenFlow on every push (F1–F5, ahead of O10f and O10g).
    • The runner is live on Earth, but only oxygenflow has a pipeline, of light shell jobs in a 256 MiB, one-CPU Alpine microVM.
    • No Rust or Node sandbox exists yet.
• 2026-09-28 F1a done (oxygenflow#2, closed by the change). Andy said go ahead with the Earth work for F1.
  • Mounts. Jobs may now declare up to 4 ephemeral scratch mounts:
    • ephemeral://tmpfs uses guest memory; ephemeral://disk is a fresh sparse ext4 disk per job, attached as vdc onward.
    • Targets are clean paths strictly under /src or /tmp and may not nest; sizes run from 16 MiB to 64 GiB. Other sources and settings are refused as not in M0.
    • Mounts are part of the canonical job (field 6, only when present, so existing pipeline hashes are unchanged) and of the receipt environment.
    • flow-init creates mount points owned by the job's user.
  • Deployment. make deploy-runner builds flow and the static flow-init, installs them under /home/claude/flow keeping .prev copies, re-pins flow-init in flow.toml and restarts flow-runner.
  • Checked on Earth with flow run in a real microVM (no hub involved): the job (uid 1001) owns the mounts, a 2 GiB disk took a 300 MiB write, a 64 MiB tmpfs refused 100 MiB, and scratch was cleaned. The next real push of oxygenflow passed on the new runner.
  • Tests: 2 new flow-core tests (parsing, refusals, hash stability) and a runner test for guest device numbering. Gates green for oxygenflow and oxygenhub; hub redeployed (it validates pipelines with flow-core).
  • Andy also confirmed that only he and I use oxy, so there is no need for backward compatibility before the release.
• 2026-09-28 F1b done (oxygenflow#3 and oxygen#6, closed by the changes).
  • The build image (oxygenflow/images/rust):
    • Rust 1.97.1 with rustfmt and clippy, and Node 24.21.0 (SHA-256 checked).
    • Every crate of the oxygen, oxygenhub and oxygenflow lock files, vendored, with cargo pointed at them via /.cargo/config.toml and offline = true.
    • Toolchain binaries are linked into /usr/local/bin, so no rustup is needed at run time.
    • build.sh builds it; Docker is only a file-system builder on the workstation (Andy agreed). Imported on Earth as cas://blob/3ba0779a55b1d66fce10adf5a01585624c9aab089f590d228368c38fd3e65a46 (2.2 GiB).
    • Rebuild it when a Cargo.lock changes.
  • Running oxygen's gate in it found three real problems:
    • flow-init called glibc's execvpe, which searches PID 1's own (empty) PATH rather than the job's, so programs outside /bin and /usr/bin were not found. It now resolves them itself (tested).
    • Tests serving on 127.0.0.1 need a loopback interface. network "loopback" (already in the spec) is now in M0: flow-init brings up lo, with still no device leaving the guest (tested).
    • oxygen's git_import_reproduces_trees only passed where git has a user identity, because one merge lacked -c user.name. Fixed; it now also asserts the merge started.
  • Result: oxygen's full gate (fmt, clippy -D warnings, every test) passes in a microVM on Earth in 135 s cold, with 8 GiB, 4 CPUs and a 24 GiB disk mount.
  • Runner and hub redeployed; Earth scratch cleaned.
• 2026-09-28 Andy agreed the order for his five ideas: F2–F5 first, then conflict resolution (P1, P1b), function history (P2), swimlanes (P3), signed receipts and the trust dashboard (P4, P4b), then web workspaces (P5, P5c).
  • Decisions from the discussion:
    • Web workspaces start from openvscode-server unmodified, not a VS Code fork.
    • Hub-side history rewrites are plans applied and signed by the author's client, only on proposal bookmarks.
    • Function history uses atom identity rather than the semantic-deps hook.
  • Andy asked the loop to carry straight through all of it.
• 2026-09-28 F2 done (oxygen#6, closed by the change).
  • The pipeline (.flow/pipeline.kdl) runs on every push to oxygen:
    • fmt in a small sandbox (1 GiB, 1 CPU, isolated);
    • then clippy -D warnings, test --workspace and a release build, each with --locked in the build image (8 GiB, 4 CPU, loopback) with a 24 GiB scratch disk for target/.
  • First run (#6, passed): fmt 13 s, clippy 46 s, test 1 min 37 s, build 2 min 7 s; 4 min 44 s end to end. The runner runs one job at a time.
  • The jobs show as checks on the change. Required checks come with F5.
  • The run shows "site token" as its pusher: Andy asked why pushes are not attributed to him. They use the site push token from hub.toml, set up before accounts existed.
    • Waiting on Andy for a personal access token (Settings › Tokens, repo:write) to put in every repository's earth remote.
    • Then, with his OK, remove the site token from hub.toml.
• 2026-09-28 Pushes now use a personal access token for Andy's account in every repository's earth remote, not the site push token, so the hub records them as andymccall. The site token stays in hub.toml until Andy agrees to remove it.
• 2026-09-28 F3 done (oxygenhub#19, oxygenflow#4, oxygen#8, closed by the changes). Andy chose pinned subrepos.
  • Subrepos. oxygenhub pins oxygen and oxygenflow as subrepos in deps/ and builds against them.
    • make pins pulls them to main on Earth; the next commit records the new pins.
    • A Cargo paths override that kept local builds on the sibling checkouts warned that it will become a hard error, so there is none: local, CI and deploy all build the pins.
  • OxygenFlow.
    • Claims list the state's pinned Oxygen subrepos that the pusher can read, and the job token may read those (and nothing else).
    • The runner fetches and exports each at its path, inside the scope hash.
    • Hub test claims_carry_pinned_subrepos_and_the_job_token_reads_only_those.
  • oxy fix. submodule add probed URLs without OXY_TOKEN and OXY_CA, so a hub with its own CA, or a private repository, fell back to git. It now reports the Oxygen error too.
  • Formatting. cargo fmt --all in oxygenhub also formats the path dependencies in deps/, with the hub's style, since oxygen has no rustfmt.toml. The pipeline and the loop's hub gate use cargo fmt -p oxygenhub -p hub-api.
  • First run (#12, pushed as andymccall, passed): fmt 5 s, clippy 1 min 49 s, test 4 min 1 s, release build 8 min 26 s. The runner runs one job at a time → F6.
  • Also this iteration: removed fix.py, fix2.py and format_xenon.py from oxygen (Andy's request, oxygen#7). Answered Andy's VS Code question: the extension is installed in both profiles and only shows in an Oxygen repository.
• 2026-09-28 F4a done (oxygenflow#5, oxygenhub#19, closed or referenced by the changes).
  • Pinning. oxygenflow pins oxygen at deps/oxygen, with make pins and a README note.
  • oxygenflow's pipeline adds fmt (this workspace only), clippy -D warnings and tests on the build image, before its summary. First run #14: all 8 jobs passed.
  • The hub's layout had to change. oxygenflow's flow-core now points at its own deps/oxygen, so the hub keeping a second oxygen pin would give Cargo two different oxy-core packages. The hub now pins only oxygenflow and builds against deps/oxygenflow/deps/oxygen.
    • The chain for newer code: push oxygen, then make pins in oxygenflow and push it, then make pins in oxygenhub.
  • Nested subrepos. Hub claims follow subrepos of subrepos, parents first, joined paths, up to 3 deep, with the same read check. The hub test covers a pin inside a pin.
  • Result. oxygenhub run #15 fetched deps/oxygenflow and deps/oxygenflow/deps/oxygen and passed: fmt 2 s, clippy 1 min 37 s, test 3 min 44 s, build 6 min 25 s.
  • Also fixed for Andy: oxy identity export failed in a new repository, because identity lookups ignored the key directory. It now falls back to it, checked against the key, and the help names the file it writes (oxygen#9).
• 2026-09-28 F4b done (oxygen-vscode#5, closed by the change; oxygenhub-vscode references it).
  • Image. The build image (now 85c744e5…) also carries an npm cache of both extensions' lock files. npm ci --offline --cache /opt/npm-cache installs from it read-only; checked locally before building.
    • oxygen, oxygenhub and oxygenflow still pin the previous image 3ba0779a…; they move on their next re-pin.
    • Rebuild the image when a package-lock.json or Cargo.lock changes.
  • oxygen-vscode pins oxygen as deps/oxygen (kept out of the .vsix). Its check job builds oxy from the pin on a scratch disk and runs typecheck, bundle and the 18 tests against it; then package.
  • oxygenhub-vscode: check and package. Its hub-client tests skip in the VM, since there is no hub binary there.
  • First runs: package failed in both, because a job starts from a fresh workspace and had no dist/. It now builds first.
  • Green: oxygen-vscode #21 (check 1 min 8 s, package 6 s), oxygenhub-vscode #22 (check 7 s, package 5 s). oxygenflow #20 passed all 8 jobs.
  • All five repositories are now linted, tested and built by OxygenFlow on every push.
• 2026-09-28 F5 done (oxygenhub#20, referenced by the changes).
  • Required checks over the API. They could only be set from the settings page, so the hub gained GET and PUT /api/v1/repos/{o}/{n}/checks/required (admins, the whole list, audited). Tested; TS regenerated; hub deployed.
  • Required checks set on every repository:
    • oxygen and oxygenhub: flow/fmt, clippy, test, build;
    • oxygenflow: flow/fmt, clippy, test, summary;
    • both extensions: flow/check, package.
    • Proposals cannot land on main without them.
  • Waiting for green.
    • oxy push --json now reports the state each bookmark was pushed to (tested).
    • New flow wait <repo URL> <state> follows that state's checks on the hub against the required ones: exit 0 passed, 1 failed (a failed check, or a skipped required one), 2 at the time limit. Unit-tested.
    • First real use: it followed oxygenflow's own run for the change that adds it, 8 checks from queued to passed, and exited 0.
  • From now on the loop pushes and waits with flow wait after the local gate, and a red run is fixed before an item counts as done. Recorded in my working notes; Andy's loop prompt file is unchanged.
  • F1 to F5 (dogfooding) are done. F6 (faster runs) is next in the F group; then P1 and the rest.
• 2026-09-28 O10f done (oxygen#10, closed by the change; OxygenFlow run green, followed with flow wait).
  • History-only states. Repo::load_state_history keeps changes and tree but builds no file graph.
    • From a version 2 checkpoint, graphs stay as pending blob refs or inline values.
    • By replay, each change's edits wait per file.
    • load_graphs builds the graphs asked for, in one blob batch, identical to a full load (tested against full payloads, by replay and from a checkpoint with later changes).
    • An unloaded graph panics with a clear message rather than reading as empty, and materialize refuses a history-only state (both tested).
  • Used by log, log_state, log_for_path_in and blame_in (one graph).
  • At 10 000 files: the log's state load 270 → 37 ms, oxy log 0.89 → about 0.7–0.8 s. The rest is the working-copy snapshot the log takes first (O10g). CLI blame works from the snapshot, so it is unchanged (0.6 s).
  • Andy asked:
    • Why his pushes show "site token": his repositories metalgear, rstar-api and snake-oxy use hub.toml's site push token (c085…). Told him to make his own personal token and set it with oxy config remote.earth.token. Removing the site token waits for his OK.
    • The oxy equivalent of git-flow: bookmarks and oxy merge (a union, no merge change), proposals, tags. Answered.
• 2026-09-28 F6a done (oxygenflow#6, oxygenhub#21, closed by the changes).
  • The runner runs up to max_jobs jobs at once within a memory and vCPU budget (flow.toml).
    • It reports its free room when it claims, and the hub hands out only a job whose sandbox fits; a lone job may use the whole budget.
    • Preparing workspaces stays one at a time: shared repository caches, and the first clone's token in the environment.
    • Unit-tested budget; the hub was deployed before the runner.
  • Measured honestly: parallel Rust jobs are slower on Earth's 4 cores. Oxygen's run took 345 s with clippy beside test and build (clippy 46 s → 1 min 53 s, build 2 min 7 s → 4 min 49 s), against 284 s one at a time.
    • Earth's budget is therefore max_jobs 3, 24 GiB and 5 vCPUs: one 4-vCPU Rust job at a time, with 1-vCPU and short jobs beside it.
    • The real speed-up is F6b (prebuilt dependencies, release without debug info).
  • Found on the way: OxygenFlow log appends failed with HTTP 500 "database is locked", losing log lines.
    • Cause: the hub's write transactions were deferred and read before writing, which SQLite fails at once whatever the busy timeout.
    • All 9 now begin IMMEDIATE (db::begin_write). A test of 16 concurrent appends fails with the old code and passes now.
    • Deployed; the next oxygenhub run passed with no new lock errors in the runner's log.
  • Andy asked whether an oh command, like GitHub's gh, should be its own repository. Recommended a crate in the oxygenhub workspace, since it shares hub-api and can test against a real hub. Asked where in the backlog he wants it; no answer yet.
• 2026-09-28 O10g, first part, done (oxygen#11, closed by the change; OxygenFlow run green, followed with flow wait). Spec §12.4, Draft 0.8k.
  • Graph keys. State::graph_key hashes a file's node, its checkpoint graph (blob, inline value or none) and the set of later changes that edited it. Equal keys mean equal graphs, and so equal renderings.
    • A test caught my first version, which left the node out: two files edited only by the same change got the same key.
  • What the manifest records. Per text file found equal to the base's unconflicted rendering, the key it matched.
    • When a file's stat and key both still match, the snapshot neither reads nor renders it.
    • .oxyattributes files are always read. When any of them is added, removed, edited or changed in the base, nothing is skipped.
  • Repo::snapshot_status gives a partial snapshot: a history-only base with only the other graphs built, and a Snapshot.unrendered list.
    • Used by status, log, show, tag, bookmark create/set, the default head, and pull --json.
    • snapshot (commit, diff, amend…) still builds the whole base. Its graphs now load in parallel.
  • Tests: 3 new; 157 core tests pass, clippy is clean.
  • At 10 000 files: a clean status takes 0.22 s instead of 0.55 s, and 51 MB instead of 259 MB. Log takes 0.38 s instead of about 0.75 s. Diff and commit are unchanged at about 0.57 s.
  • Split: O10h (a lazy base for commit and diff, and cached materialized states) is added to the backlog.
• 2026-09-28 Metalgear feedback. Andy's other project reports what it finds in ~/oxygen_feedback.md; I watch it and act on it. Its items are M1 to M10, placed ahead of P.
  • M1 done (oxygen#12). Pushing a bookmark with / in its name failed with "No such file or directory".
    • Cause: reference attestations and checkpoint pointers are files named after the bookmark, and nothing created the subdirectory.
    • They are now one flat file each, with / escaped (%2F), so feature and feature/x coexist.
    • A test pushes and checkpoints both.
    • Pinned through oxygenflow into oxygenhub and deployed. All three OxygenFlow runs are green.
  • M2 done (oxygenhub#22, Andy's request). Settings → OxygenFlow has on, off or site default (hub.toml's [flow] repos), and needs no restart.
    • Site administrators change it; repository admins only see it.
    • Audited as repo.flow; migration 0018.
    • Two tests; hub gate green; deployed; run green.
  • Andy asked urgently to enable Flow for doomsdayone/metalgear.
    • My edit of hub.toml on Earth was refused by the permission check, so I did not make it.
    • The line "doomsdayone/metalgear" is now in [flow] repos, added outside this loop, and run #37 there passed.
    • From now on the new setting does this without editing hub.toml.
• 2026-09-28 M11 done (oxygenhub#23; Andy asked for it urgently). Flow runs are numbered per repository.
  • Run list, run page (/flow/{number}), live view, stamp and check links all use the number.
  • Migration 0019 numbered the existing runs per repository in creation order and rewrote the links of existing flow checks.
  • I tried it first on a read-only copy of Earth's runs and checks: 160 of 185 links changed, and every link names a run of its own repository.
  • Live: metalgear's run is #1, oxygen's #1 to #19. Hub run green.
• 2026-09-29 M12 done (oxygen#13, oxygenhub#24; Andy asked, and feedback 14a).
  • oxy push REMOTE --delete NAME sends an update to the zero state.
    • Checked like any update: the bookmark must exist at old_state, and a policy needs an authorized key.
    • The deletion's attestation stays the bookmark's latest, so an old one cannot be replayed to bring it back.
    • So a bookmark new to a remote starts its serial at the clock in milliseconds.
    • The local bookmark is kept.
  • The default bookmark is never deleted.
    • A non-bare repository protects its checked-out bookmark.
    • For a bare one, the host says which is the default through Backend::default_bookmark: oxy serve uses the configured bookmark, the hub its setting.
  • Hub: a DELETE button (with a confirmation) for writers on every bookmark but the default. It goes through the same checks, is logged on the pushes page and sent to webhooks as a push.
  • Tests: core, HTTP and hub, one each. Spec §16.4 (Draft 0.8l) and hub spec updated. Deployed; all three OxygenFlow runs green.
  • metalgear's flow-first-run can now be deleted; I left that to its project.
  • Feedback file: new items 3a and 7a became M13 (bookmark switch --carry) and M14 (oxy show summary lists every kind).
• 2026-09-29 M14 done (oxygen#14). oxy show's summary names every file the change touches: an M line for each edited file without a tree operation, and renames with their full new path. Tests updated; run green.
• 2026-09-29 M13 done (oxygen#15).
  • oxy bookmark switch NAME --carry takes uncommitted work along (edits, additions, removals, renames).
    • It needs every touched path to be the same in NAME's state as in the working copy's base, so the same edits apply there.
    • Otherwise it refuses, changes nothing, and names the paths.
  • bookmark create feat && bookmark switch feat --carry moves work onto a new bookmark.
  • The switch help and spec §10.1 say what happens to uncommitted work, which also answers part of feedback 3.
  • One test; run green.
• 2026-09-29 M3 done (oxygenhub#25; feedback 9).
  • Web: writers get RUN PIPELINE on the Flow tab (a bookmark's current state) and RE-RUN on a finished run's page.
  • API: POST /api/v1/repos/{o}/{n}/flow/runs and …/runs/{n}/rerun, with repo:write. They answer 201 with the number and url, or 409 with the reason.
  • A new run's checks replace the old ones for that state.
  • Runs record what started them (migration 0020), and the run page says "pushed by", "started by" or "re-run of #N by".
  • Pushes and both new paths share flow::start_run.
  • One hub test; gate green; deployed; run green.
• 2026-09-29 M4 done (oxygenflow#7; feedback 15 and 17).
  • /dev links. flow-init adds /dev/fd, /dev/stdin, /dev/stdout and /dev/stderr into /proc/self/fd.
  • Job variables. Claims carry the run's state hash, bookmark and number. The runner adds FLOW_REPO, FLOW_STATE, FLOW_HEADS, FLOW_BOOKMARK, FLOW_RUN and FLOW_JOB to the job's environment, so they are in its receipt too.
    • flow run sets FLOW_JOB and FLOW_RUN=local.
    • A pipeline's own value wins; unknown values are left out.
  • Tests: unit tests for both, and the hub test checks the claim's new fields. Hub and runner deployed (runner with .prev copies).
  • Proved in a real microVM on Earth: < <(echo …) works, the links are there, and the variables arrive.
• 2026-09-29 "database is locked" again (oxygenflow#8).
  • At 00:40 and 01:01, during oxygenhub runs, log appends and a claim got HTTP 500 after the 5 s busy timeout, and the runner dropped those log lines.
  • It was not the hub restarting (up since 00:51) nor the WAL (4 MB). Most likely a commit stalled while the release build saturated Earth's disk. Not proven.
  • Runner: tries 5xx answers again after 1, 2 and 4 s; a 4xx is final. Tested against a fake hub.
  • Hub: busy timeout 30 s.
  • No lock errors in the runs since, including a full oxygenhub run.
• 2026-09-29 M5 done (oxygenflow#9; feedback 16).
  • Sandbox env. A sandbox takes an env block that every job in it starts from; a job's own env overrides it.
    • It is canonical field 6, only when set, so existing pipelines keep their hashes.
  • Image environment. flow rootfs import --env NAME=value writes the image's own environment to /etc/flow/env: what a Dockerfile's ENV sets and docker export loses. It is covered by the image's hash.
  • Layers in flow-init: PATH and HOME, then the image's environment, then the job's. The program is found in the resulting PATH.
  • Tests for parsing, precedence, hashing, layering and --env checks.
  • Hub pinned and deployed, since it parses pipelines. Runner deployed.
  • Proved in a microVM on Earth: a program found only through the sandbox's PATH ran, with the job's value winning. The image layer is unit-tested; nothing was re-imported on Earth.
• 2026-09-29 M6 done (oxygenhub#26; feedback 11 and 13; run numbering was M11).
  • GET /api/v1/repos/{o}/{n}/flow/runs, /flow/runs/{n} (with its jobs) and /flow/runs/{n}/jobs/{job}/log?after=seq, typed in hub-api.
  • /checks/{state} also takes heads joined with +, a single head, or a bookmark.
  • Unknown /api/v1 routes answer with a JSON problem.
  • Found on the way: two flow tests raced the checks a run reports just after it is recorded, and one failed in a full run. They now wait for the checks.
  • Deployed and tried live: oxygen's runs #28 and #27 listed, and the JSON 404. Hub run green.
• 2026-09-29 M7 done (oxygen#16; feedback 2).
  • A refused update's reason names the reference and the step: reading or storing its attestation. One helper now checks and stores attestations for updates and deletions.
  • The protocol server prefixes failures with the operation and repository (refs of lib: …) and logs them, along with every refused reference. The hub's journal gets the same lines.
  • The server's own storage failing answers 500, not 400.
  • HTTP test with an attestation store that cannot be written. Spec §16.4.
  • Pinned through oxygenflow into the hub and deployed. All three runs green.
• 2026-09-29 M8 done (oxygen#17; feedback 3).
  • Not reproduced exactly: a switch then merge, and an emptied directory, both behaved. So I fixed the two gaps the report points at.
  • Merge: a working copy without changes now follows it, whichever state it sat on. It previously also had to sit exactly on the bookmark's old heads, the likely cause of the lagging working copy.
  • Checkout refusals name each changed path and how ("removed b.txt" means in the base but not on disk), and offer --carry. It shares Repo::checkout_carry with bookmark switch --carry.
  • One test; spec §10.1. Run green.
• 2026-09-29 M9a done (oxygen#18; feedback 4 and 6). M9 was split into M9a and M9b.
  • oxy describe without -m names the working copy as git describe does: v0.1.0, v0.1.0-2-8c5ea12a, or develop-8c5ea12a, with -dirty for uncommitted work and --json for the parts. With -m it still changes a head's message, so the VS Code extension is unaffected.
  • Tags with one head name their change (oxy show v0.1.0), and tag list shows heads rather than the state hash.
  • oxy commit -F FILE|-.
  • CLI test; spec §10.1 and §12.3. Run green.
• 2026-09-29 M9b done (oxygen#19; feedback 5, 7 and 8).
  • submodule status lists a subrepo registered but not committed yet as added, with the pin the next commit records (committed: false in --json, which already existed).
  • Doctor is OK with a user identity a new repository has not stored yet while its secret key is there: "stored with your first signed change".
  • One test; spec §7.8. Run green.
• 2026-09-29 M10 done (oxygenhub#27; feedback 14).
  • A change signed by a key no account has linked is tagged "key not linked" on its page, with a link to Settings → Keys for signed-in viewers.
  • The API's change author carries a note saying so.
  • One hub test; spec updated; deployed; run green.
  • Every item from the metalgear feedback is now done (M1 to M14; item 18 needed nothing). I keep watching the file.
• 2026-09-29 M15 done (oxygenhub#28; feedback 17a).
  • A waiting run shows its place in line on the Flow tab. Its page adds the jobs running now and those queued ahead, and the API gives queue_position.
  • Other repositories' jobs are named only when public; otherwise they are counted.
  • A unit test for the order, privacy and ordinals, and an end-to-end test.
  • Deployed; live, the hub's run #17 reported queue_position 4. Run green.
  • The runner's parallelism stays within Earth's 5-vCPU budget, deliberate after F6a.
• 2026-09-29 F6b1 done (oxygenhub#29). F6b was split into F6b1 and F6b2.

  • The rust sandbox's env (M5) turns off incremental builds and debug info for every job in all three pipelines.

  • The release profile keeps line tables for the binary Earth runs, which is built outside CI.

  • Measured on Earth:

    Job	Before	After
    oxygenhub build	390–495 s	347 s
    oxygenhub test	about 235 s	182 s
    oxygenhub clippy	99 s	97 s
    oxygen test	98 s	84 s
    oxygenflow test	55–66 s	45 s

    The best oxygenhub run was 722 s from push to done.

  • Found on the way: the runner's retry test (M4) failed once in a loaded full run. Its fake hub answered after one read and closed while the client still sent. It now reads whole requests; three full runs passed.

  • Next is F6b2: dependencies prebuilt in the build image.

• 2026-09-29 O10h done (oxygen#20).
  • Commit, working-copy diff, hunks and discard use the partial snapshot. Showing a committed change builds only the graphs of the files it edits (Repo::change_base).
  • Discarding hunks builds the rest before rendering its target.
  • At 10 000 files: diff 0.57 → 0.22 s and commit 0.58 → 0.23 s, each 244 → 52 MB; show 0.53 s.
  • Caching materialized states turned out unnecessary.
  • One test: works with an unreadable unchanged file, and shows a change exactly as a full base renders it. Run green.
• 2026-09-29 F6b2 done (oxygenhub#29 refs; oxygenflow image recipe).

  • Recipe. images/rust/recipe.py writes a workspace's dependency recipe: manifests, the workspace roots path dependencies inherit from, the lock file, real build scripts, and stub targets. Checked to resolve offline with the lock unchanged.

  • Image. It builds oxygenhub's recipe at /src with the pipeline's environment (release, tests, clippy) and keeps /opt/warm/oxygenhub (2.1 GB, image 5.2 GB).

    • It was exported straight to Earth over ssh, since the local scratch quota refused the tarball.
    • Imported as cas://blob/47b614a6….

  • Jobs. .flow/warm-target.sh copies the warm target onto the job's empty disk (8–12 s), then runs cargo. A missing cache or a failed copy falls back to a full build.

  • First run found a bug: the fresh ext4 disk holds lost+found, so the "empty" check skipped the copy. Fixed.

  • Measured on Earth:

    oxygenhub	F6b1	F6b2
    push to green	722 s	320 s
    build	347 s	147 s
    test	182 s	114 s
    clippy	97 s	52 s

    Only the five workspace crates compile, and clippy compiles none.

  • Andy: rebuild the image when a Cargo.lock moves (images/rust/build.sh). Until then only the changed crates compile.

  • I ran git --version once by mistake while checking a pipeline. It touched no repository.

• 2026-09-29 F6b3 done.

  • The build image prebuilds all three workspaces, imported on Earth as cas://blob/169de040…: 14 min to build, 5.7 GB.

  • All three pipelines pin it and start their cargo jobs from /opt/warm/NAME.

  • Measured on Earth:

    Job	Before	After
    oxygen build	128 s	46 s
    oxygen test	84 s	42 s
    oxygen clippy	45 s	13 s
    oxygen, push to done	about 285 s	139 s
    oxygenflow test	45 s	15 s
    oxygenflow clippy	34–54 s	9 s
    oxygenflow, push to done		37 s

    oxygenhub's jobs are as in F6b2 (build 139 s, test 109 s, clippy 48 s).

  • The F group is done.

  • Andy: the workstation had 19 GB free after the image build; Docker's build cache grew. I removed only my own tarball, not the months-old images there.

• 2026-09-29 P1a done (oxygenhub#30; Andy's item 1, first part). P1 was split into P1a, P1c and P1b.
  • /{owner}/{name}/resolve/{bookmark}/{path} parses a conflicted text file's markers into plain text and regions, with each side's change.
  • Per region, keep one side, every side, none, or your own text (a deletion side keeps the deletion); regions are linkable (#region-N).
  • It commits through the delegate as a web edit, a resolution change depending on every contributor.
  • It refuses if the bookmark moved since the page loaded; malformed markers go to the plain editor, which stays offered.
  • The change page tags resolutions. The web edit's follow-ups are shared (after_web_commit).
  • Parser and assembly unit tests; the edits test resolves a real conflict through the page.
  • Deployed; hub run green.
  • Next: P1c (tree conflicts, VS Code hand-off), then P1b (live collaboration).
• 2026-09-29 P1c done (oxygenhub#31).
  • Name conflicts (several files want one name, shown as NAME.oxy-conflict-N) resolve on the resolver by keeping one candidate.
    • Its content goes to the name and every candidate is removed, which the snapshot records as a move of the kept file: identity kept, and the test checks the change's file kind is renamed.
    • It commits as a resolution, refused if the bookmark moved.
  • The conflicts page links name conflicts and gives their full path (it gave the bare name).
  • Directory and link name conflicts stay with clients.
  • Deployed; hub run green.
  • Added: P1d (resolve in VS Code) and P1e (binary replace conflicts need a core change first: writing a candidate's bytes counts as no change today).
• 2026-09-29 P1d done (oxygenhub#32; oxygen-vscode 0.11.0).
  • The resolver pages link to vscode://oxygen.oxygen-vscode/resolve?url=…&bookmark=…&path=… (encoded).
  • The extension finds the open checkout with that remote, or offers to clone it, asks before switching bookmark, pulls, and opens the file with its conflict lenses. Bad URLs, bookmarks and paths are refused.
  • Parsing and matching are in src/handoff.ts, with tests; npm run check passes (ℹ fail 0).
  • Installed in both profiles; hub deployed; both runs green.
  • Fixed on the way: P1c's name-conflict test found the kept candidate by the first occurrence of a word anywhere on the page, which failed now and then. It now reads the candidates' previews; six passes in a row.
• 2026-09-29 P1e done (oxygen#21, hub refs; Draft 0.8m).
  • Core. A change that writes an opaque file with a replace conflict settles it when the caller names the path.
    • One Replace goes from each live blob to the chosen one, depending on each change that made a candidate live, so all are superseded (§9.3).
    • Hosted edits name the paths the user writes. A plain snapshot never settles one, since a checkout writes a candidate at the path.
  • Hub. The resolver offers a binary file's versions, each labelled with its change. Keeping one commits the resolution, and the conflicts page links them.
  • Tests. A core test (conflict via merge, snapshot leaves it, keeping a candidate or new bytes settles it) and a hub end-to-end test (five passes in a row).
  • Pinned and deployed; all three runs green.
  • P1 is complete apart from P1b (live collaboration).
• 2026-09-29 P1b done (oxygenhub#33).
  • Everyone on the same resolver page shares an in-memory room per repository, bookmark and path, over server-sent events at /…/resolve-live/….
    • Presence: who else is resolving.
    • Choices are shared as they are made, the last one for a region winning; text is shared a moment after typing stops. A newcomer gets them so far.
    • When someone commits, the others see it land, with a link, and their form is disabled.
  • Writers only, choices checked, CSRF on shared choices; a room ends with its last viewer.
  • Tests: a unit test for rooms, and the edits test follows a real event stream (snapshot, another tab's choice, a refused bad choice, the landing); three passes in a row. The browser script is checked only for syntax.
  • Deployed; hub run green.
  • P1 (conflict resolution on OxygenHub) is complete.