From c73fb26f1e59b2d893c0c8b4ca17c7abc315e12a Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 30 May 2026 22:37:37 -0700
Subject: [PATCH 1/7] pack-objects: honor a ".baddeltas" marker in try_delta()

When considering an object pair for delta compression, try_delta()
short-circuits (skipping a real delta search) when both objects came
from the same on-disk pack and neither is stored there as a delta.
The reasoning is that an earlier pack-objects run already had the
chance to try this pair and chose not to delta either against the
other, so trying again is unlikely to find anything new.

That heuristic is correct only if the source pack was actually built by
something that did a real delta search.  That may not be the case if the
pack was written by `git fast-import` (which only does a basic delta
comparison for objects in the pack it writes), the bulk_checkin
framework when streaming large blobs straight into a pack, or
pack-objects with --window=0.

Add a `.baddeltas` sidecar marker, parallel to `.keep`, `.promisor`,
and `.mtimes`, that lets a producer flag its output pack as one whose
delta layout should not be trusted by this skip.

For context on the underlying delta skip and earlier discussions of a
similar marker, see Jeff King's analysis on the list:

  https://lore.kernel.org/git/20231009202149.GA3281325@coredump.intra.peff.net/

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 Documentation/gitformat-pack.adoc |  27 +++++++
 builtin/pack-objects.c            |   6 ++
 packfile.c                        |  15 +++-
 packfile.h                        |   3 +-
 t/meson.build                     |   1 +
 t/t5337-pack-baddeltas.sh         | 124 ++++++++++++++++++++++++++++++
 6 files changed, 171 insertions(+), 5 deletions(-)
 create mode 100755 t/t5337-pack-baddeltas.sh

diff --git a/Documentation/gitformat-pack.adoc b/Documentation/gitformat-pack.adoc
index 3416edceab82e9..1ea5e66e54618c 100644
--- a/Documentation/gitformat-pack.adoc
+++ b/Documentation/gitformat-pack.adoc
@@ -12,6 +12,7 @@ SYNOPSIS
 $GIT_DIR/objects/pack/pack-*.{pack,idx}
 $GIT_DIR/objects/pack/pack-*.rev
 $GIT_DIR/objects/pack/pack-*.mtimes
+$GIT_DIR/objects/pack/pack-*.baddeltas
 $GIT_DIR/objects/pack/multi-pack-index
 
 DESCRIPTION
@@ -357,6 +358,32 @@ All 4-byte numbers are in network byte order.
     and a checksum of all of the above (each having length according
     to the specified hash function).
 
+== pack-*.baddeltas files
+
+The optional `.baddeltas` file is an empty marker sitting alongside a
+`pack-*.pack` (and its `.idx`).  It signals to `git pack-objects` that
+the delta layout of the pack should not be trusted: even when two
+objects appear together in the same pack and neither is stored as a
+delta, the next packing run should still call out to its delta search
+routine for the pair instead of assuming a prior pack-objects already
+considered (and rejected) the pair.
+
+This is intended for producers that intentionally skip delta search
+when writing a pack (for example, processes that bulk-import objects
+or aggregate multiple existing packs without recomputing deltas).
+Without this marker, the same-pack delta skip in `git pack-objects`
+would silently inherit those producers' lack of delta search into
+future repacks.
+
+The contents of the file are currently ignored.  Producers should
+write an empty file; consumers must tolerate (and ignore) any
+content.
+
+The marker only affects whether `git pack-objects` will attempt to
+compute new deltas for object pairs that share the marked pack.  It
+does not disable reuse of existing on-disk deltas, nor does it affect
+multi-pack-index, bitmap, or pack reuse for transfer.
+
 == multi-pack-index (MIDX) files have the following format:
 
 The multi-pack-index files refer to multiple pack-files and loose objects.
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index fe9fbecb30e100..c6baa24c56b9e7 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -2794,9 +2794,15 @@ static int try_delta(struct unpacked *trg, struct unpacked *src,
 	 * be considered, as even if we produce a suboptimal delta against
 	 * it, we will still save the transfer cost, as we already know
 	 * the other side has it and we won't send src_entry at all.
+	 *
+	 * If the source pack carries a ".baddeltas" marker, we treat its
+	 * existing delta layout as untrusted: even if the two objects are
+	 * in the same pack and neither is a delta, we have no reason to
+	 * believe a previous packing run actually considered the pair.
 	 */
 	if (reuse_delta && IN_PACK(trg_entry) &&
 	    IN_PACK(trg_entry) == IN_PACK(src_entry) &&
+	    !IN_PACK(trg_entry)->has_bad_deltas &&
 	    !src_entry->preferred_base &&
 	    trg_entry->in_pack_type != OBJ_REF_DELTA &&
 	    trg_entry->in_pack_type != OBJ_OFS_DELTA)
diff --git a/packfile.c b/packfile.c
index 89366abfe32386..45427e927d53e5 100644
--- a/packfile.c
+++ b/packfile.c
@@ -451,7 +451,9 @@ void close_pack(struct packed_git *p)
 
 void unlink_pack_path(const char *pack_name, int force_delete)
 {
-	static const char *exts[] = {".idx", ".pack", ".rev", ".keep", ".bitmap", ".promisor", ".mtimes"};
+	static const char *exts[] = {".idx", ".pack", ".rev", ".keep",
+				     ".bitmap", ".promisor", ".mtimes",
+				     ".baddeltas"};
 	int i;
 	struct strbuf buf = STRBUF_INIT;
 	size_t plen;
@@ -807,10 +809,10 @@ struct packed_git *add_packed_git(struct repository *r, const char *path,
 		return NULL;
 
 	/*
-	 * ".promisor" is long enough to hold any suffix we're adding (and
+	 * ".baddeltas" is long enough to hold any suffix we're adding (and
 	 * the use xsnprintf double-checks that)
 	 */
-	alloc = st_add3(path_len, strlen(".promisor"), 1);
+	alloc = st_add3(path_len, strlen(".baddeltas"), 1);
 	p = alloc_packed_git(r, alloc);
 	memcpy(p->pack_name, path, path_len);
 
@@ -837,6 +839,10 @@ struct packed_git *add_packed_git(struct repository *r, const char *path,
 	if (!access(p->pack_name, F_OK))
 		p->is_cruft = 1;
 
+	xsnprintf(p->pack_name + path_len, alloc - path_len, ".baddeltas");
+	if (!access(p->pack_name, F_OK))
+		p->has_bad_deltas = 1;
+
 	xsnprintf(p->pack_name + path_len, alloc - path_len, ".pack");
 	if (stat(p->pack_name, &st) || !S_ISREG(st.st_mode)) {
 		free(p);
@@ -1019,7 +1025,8 @@ static void prepare_pack(const char *full_name, size_t full_name_len,
 	    ends_with(file_name, ".bitmap") ||
 	    ends_with(file_name, ".keep") ||
 	    ends_with(file_name, ".promisor") ||
-	    ends_with(file_name, ".mtimes"))
+	    ends_with(file_name, ".mtimes") ||
+	    ends_with(file_name, ".baddeltas"))
 		string_list_append(data->garbage, full_name);
 	else
 		report_garbage(PACKDIR_FILE_GARBAGE, full_name);
diff --git a/packfile.h b/packfile.h
index 49d6bdecf6ea18..a2cee4b1f055f4 100644
--- a/packfile.h
+++ b/packfile.h
@@ -33,7 +33,8 @@ struct packed_git {
 		 do_not_close:1,
 		 pack_promisor:1,
 		 multi_pack_index:1,
-		 is_cruft:1;
+		 is_cruft:1,
+		 has_bad_deltas:1;
 	unsigned char hash[GIT_MAX_RAWSZ];
 	struct revindex_entry *revindex;
 	const uint32_t *revindex_data;
diff --git a/t/meson.build b/t/meson.build
index 2af8d0127991db..3516913411dc5c 100644
--- a/t/meson.build
+++ b/t/meson.build
@@ -629,6 +629,7 @@ integration_tests = [
   't5333-pseudo-merge-bitmaps.sh',
   't5334-incremental-multi-pack-index.sh',
   't5335-compact-multi-pack-index.sh',
+  't5337-pack-baddeltas.sh',
   't5351-unpack-large-objects.sh',
   't5400-send-pack.sh',
   't5401-update-hooks.sh',
diff --git a/t/t5337-pack-baddeltas.sh b/t/t5337-pack-baddeltas.sh
new file mode 100755
index 00000000000000..8c1a11e1067af3
--- /dev/null
+++ b/t/t5337-pack-baddeltas.sh
@@ -0,0 +1,124 @@
+#!/bin/sh
+
+test_description='`.baddeltas` sidecar disables the same-pack try_delta() skip'
+
+. ./test-lib.sh
+
+# Two similar but distinct blobs.  The contents are deliberately large
+# enough and similar enough that a real delta search will find a useful
+# delta between them.
+generate_blobs () {
+	{
+		printf "header\n" &&
+		i=0 &&
+		while test $i -lt 200
+		do
+			printf "line %d padding-padding-padding-padding\n" $i &&
+			i=$((i + 1)) || return 1
+		done
+	} >a &&
+	{
+		printf "header\n" &&
+		i=0 &&
+		while test $i -lt 200
+		do
+			printf "line %d padding-padding-padding-padding\n" $i &&
+			i=$((i + 1)) || return 1
+		done &&
+		printf "tail-line\n"
+	} >b
+}
+
+# Build a pack from the two blobs without doing any delta search, and
+# echo the basename of the resulting .pack file (the last "pack-*.pack"
+# in objects/pack).
+build_input_pack () {
+	A=$(git hash-object -w a) &&
+	B=$(git hash-object -w b) &&
+	printf "%s\n%s\n" "$A" "$B" |
+	git pack-objects --window=0 .git/objects/pack/pack >/dev/null &&
+	git prune-packed &&
+	basename "$(ls -t .git/objects/pack/pack-*.pack | head -1)"
+}
+
+# Count delta entries in a pack idx.  "git verify-pack -v" prints one
+# line per object with 5 fields for non-delta entries (oid, type, size,
+# size-in-pack, offset) and 7 fields for delta entries (... depth
+# base-oid).
+count_deltas () {
+	git verify-pack -v "$1" |
+	awk 'NF == 7 { n++ } END { print n + 0 }'
+}
+
+# Repack just the two blobs from the existing pack into a fresh pack
+# with prefix "out".  Echo the basename of the resulting .pack file.
+repack_blobs () {
+	A=$(git hash-object a) &&
+	B=$(git hash-object b) &&
+	rm -f .git/objects/pack/out-*.pack \
+	      .git/objects/pack/out-*.idx \
+	      .git/objects/pack/out-*.rev &&
+	printf "%s\n%s\n" "$A" "$B" |
+	git pack-objects .git/objects/pack/out >/dev/null &&
+	basename "$(ls .git/objects/pack/out-*.pack)"
+}
+
+test_expect_success 'set up two similar blobs' '
+	git init repo &&
+	(
+		cd repo &&
+		generate_blobs
+	)
+'
+
+test_expect_success 'without .baddeltas, same-pack pair is skipped' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		input_pack=$(build_input_pack) &&
+		test 0 -eq "$(count_deltas .git/objects/pack/${input_pack%.pack}.idx)" &&
+		out_pack=$(repack_blobs) &&
+		test 0 -eq "$(count_deltas .git/objects/pack/${out_pack%.pack}.idx)"
+	)
+'
+
+test_expect_success 'with .baddeltas, same-pack pair gets reconsidered' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		input_pack=$(build_input_pack) &&
+		test 0 -eq "$(count_deltas .git/objects/pack/${input_pack%.pack}.idx)" &&
+		>.git/objects/pack/${input_pack%.pack}.baddeltas &&
+		out_pack=$(repack_blobs) &&
+		test 1 -le "$(count_deltas .git/objects/pack/${out_pack%.pack}.idx)"
+	)
+'
+
+test_expect_success '.baddeltas does not trigger garbage warnings' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		input_pack=$(build_input_pack) &&
+		>.git/objects/pack/${input_pack%.pack}.baddeltas &&
+		git count-objects -v 2>warnings &&
+		! grep -i garbage warnings
+	)
+'
+
+test_expect_success '.baddeltas is removed by git repack -d' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		input_pack=$(build_input_pack) &&
+		>.git/objects/pack/${input_pack%.pack}.baddeltas &&
+		git repack -ad &&
+		test_path_is_missing .git/objects/pack/${input_pack%.pack}.baddeltas &&
+		test_path_is_missing .git/objects/pack/$input_pack
+	)
+'
+
+test_done

From eee4074aa81e4260896716050bc93f01b1bd99fc Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 30 May 2026 22:40:13 -0700
Subject: [PATCH 2/7] pack-objects: add a --mark-bad-deltas option

The previous patch taught pack-objects to honor a `.baddeltas` sidecar
marker that tells the same-pack delta skip in try_delta() to fall
through to a real delta search.  Add a `--mark-bad-deltas` option that
writes such a marker alongside each output pack.

The flag is incompatible with `--stdout`, since the marker lives next
to the output pack in `$GIT_DIR/objects/pack` and `--stdout` has no
on-disk output to mark.  When pack-objects splits its output across
multiple packs (with `--max-pack-size`), a marker is written for each
resulting pack inside the existing per-pack output loop, between
stage_tmp_packfiles() and rename_tmp_packfile_idx() so the marker is
in place before the `.idx` anchor becomes visible.

Document the option, and extend t5335 to cover both the producer side
(marker is written and disables the same-pack skip for the resulting
pack) and the `--stdout` incompatibility.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 Documentation/git-pack-objects.adoc |  8 +++++++
 builtin/pack-objects.c              | 24 +++++++++++++++++++++
 t/t5337-pack-baddeltas.sh           | 33 +++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+)

diff --git a/Documentation/git-pack-objects.adoc b/Documentation/git-pack-objects.adoc
index 8a27aa19fd3f1f..6a6c6ec76932b6 100644
--- a/Documentation/git-pack-objects.adoc
+++ b/Documentation/git-pack-objects.adoc
@@ -143,6 +143,14 @@ options which imply `--revs`.
 	have an mtime older than `<approxidate>`. If unspecified (and
 	given `--cruft`), then no objects are eliminated.
 
+--mark-bad-deltas::
+	Write a `.baddeltas` marker file alongside each output pack.  The
+	marker signals that objects within the pack have not been fully
+	delta-searched against other objects within the same pack and
+	that future repacking should consider them.  Any deltas that do
+	exist within this pack can still be reused, however.
+	Incompatible with `--stdout`.
+
 --window=<n>::
 --depth=<n>::
 	These two options affect how the objects contained in
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index c6baa24c56b9e7..2ac48c517cefa7 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -43,6 +43,7 @@
 #include "pack-mtimes.h"
 #include "parse-options.h"
 #include "pkt-line.h"
+#include "path.h"
 #include "blob.h"
 #include "tree.h"
 #include "path-walk.h"
@@ -211,6 +212,7 @@ static int keep_unreachable, unpack_unreachable, include_tag;
 static timestamp_t unpack_unreachable_expiration;
 static int pack_loose_unreachable;
 static int cruft;
+static int mark_bad_deltas;
 static int shallow = 0;
 static timestamp_t cruft_expiration;
 static int local;
@@ -1459,6 +1461,23 @@ static void write_pack_file(void)
 					    &pack_idx_opts, hash,
 					    &idx_tmp_name);
 
+			if (mark_bad_deltas) {
+				size_t tmpname_len = tmpname.len;
+				int fd;
+
+				strbuf_addstr(&tmpname, "baddeltas");
+				fd = xopen(tmpname.buf,
+					   O_WRONLY | O_CREAT | O_TRUNC, 0444);
+				if (close(fd))
+					die_errno(_("unable to close '%s'"),
+						  tmpname.buf);
+				if (adjust_shared_perm(the_repository,
+						       tmpname.buf))
+					die_errno(_("unable to make '%s' readable"),
+						  tmpname.buf);
+				strbuf_setlen(&tmpname, tmpname_len);
+			}
+
 			if (write_bitmap_index) {
 				size_t tmpname_len = tmpname.len;
 
@@ -5091,6 +5110,8 @@ int cmd_pack_objects(int argc,
 		  N_("unpack unreachable objects newer than <time>"),
 		  PARSE_OPT_OPTARG, option_parse_unpack_unreachable),
 		OPT_BOOL(0, "cruft", &cruft, N_("create a cruft pack")),
+		OPT_BOOL(0, "mark-bad-deltas", &mark_bad_deltas,
+			 N_("write a .baddeltas marker alongside the output pack(s)")),
 		OPT_CALLBACK_F(0, "cruft-expiration", NULL, N_("time"),
 		  N_("expire cruft objects older than <time>"),
 		  PARSE_OPT_OPTARG, option_parse_cruft_expiration),
@@ -5284,6 +5305,9 @@ int cmd_pack_objects(int argc,
 	if (!pack_to_stdout && thin)
 		die(_("--thin cannot be used to build an indexable pack"));
 
+	die_for_incompatible_opt2(mark_bad_deltas, "--mark-bad-deltas",
+				  pack_to_stdout, "--stdout");
+
 	die_for_incompatible_opt2(keep_unreachable, "--keep-unreachable",
 				  unpack_unreachable, "--unpack-unreachable");
 	if (!rev_list_all || !rev_list_reflog || !rev_list_index)
diff --git a/t/t5337-pack-baddeltas.sh b/t/t5337-pack-baddeltas.sh
index 8c1a11e1067af3..5dfe5aaabd447b 100755
--- a/t/t5337-pack-baddeltas.sh
+++ b/t/t5337-pack-baddeltas.sh
@@ -121,4 +121,37 @@ test_expect_success '.baddeltas is removed by git repack -d' '
 	)
 '
 
+test_expect_success 'pack-objects --mark-bad-deltas writes .baddeltas' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		A=$(git hash-object -w a) &&
+		B=$(git hash-object -w b) &&
+		printf "%s\n%s\n" "$A" "$B" |
+			git pack-objects --window=0 --mark-bad-deltas \
+				.git/objects/pack/pack >/dev/null &&
+		pack=$(basename "$(ls .git/objects/pack/pack-*.pack)") &&
+		test_path_is_file .git/objects/pack/${pack%.pack}.baddeltas &&
+		test 0 -eq "$(count_deltas .git/objects/pack/${pack%.pack}.idx)" &&
+		git prune-packed &&
+
+		out_pack=$(repack_blobs) &&
+		test 1 -le "$(count_deltas .git/objects/pack/${out_pack%.pack}.idx)"
+	)
+'
+
+test_expect_success 'pack-objects --mark-bad-deltas is incompatible with --stdout' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		A=$(git hash-object -w a) &&
+		printf "%s\n" "$A" >in &&
+		test_must_fail git pack-objects --mark-bad-deltas --stdout \
+			<in >/dev/null 2>err &&
+		test_grep "cannot be used together" err
+	)
+'
+
 test_done

From b1b9f2664a353ec3d5dca7b4ec0e3b6c35a7c0c8 Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 30 May 2026 15:49:09 -0700
Subject: [PATCH 3/7] pack-objects: skip --stdin-packs hint walk when delta
 search is off

pack-objects performs a somewhat expensive revision walk (which really
ought to be part of the progress output, but that's an issue for another
time) to:

  * fill in the namehash of objects, to improve the delta selection
    process;

  * with --stdin-packs=follow, pull in objects that live in unknown
    packs to close the set under reachability.

However, if we are not using --stdin-packs=follow and delta searches are
disabled (--window=0 or --depth=0), then this walk is unnecessary.

In a repository with about 35 million objects, running

  git pack-objects --stdin-packs --window=0 --delta-base-offset \
                   --no-write-bitmap-index <out>

over a list of 316 packs took 176s and 8.2 GiB of RSS, almost all
of which was spent in the revision walk.  Skipping the walk drops
the same invocation to 0.32s and 154 MiB of RSS, while producing an
identically sized pack with the same objects.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 builtin/pack-objects.c        |  22 ++++++--
 t/t5331-pack-objects-stdin.sh | 100 ++++++++++++++++++++++++++++++++++
 2 files changed, 116 insertions(+), 6 deletions(-)

diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index 2ac48c517cefa7..01e6da2d02032b 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -4082,6 +4082,7 @@ static void read_stdin_packs(enum stdin_packs_mode mode, int rev_list_unpacked)
 {
 	int prev_fetch_if_missing = fetch_if_missing;
 	struct rev_info revs;
+	int need_walk;
 
 	/*
 	 * The revision walk may hit objects that are promised, only. As the
@@ -4099,7 +4100,14 @@ static void read_stdin_packs(enum stdin_packs_mode mode, int rev_list_unpacked)
 	 * That may cause us to avoid populating all of the namehash fields of
 	 * all included objects, but our goal is best-effort, since this is only
 	 * an optimization during delta selection.
+	 *
+	 * However, the walk is only needed for delta selection (which
+	 * consumes the namehash) and for STDIN_PACKS_MODE_FOLLOW (which
+	 * uses the walk to discover additional reachable objects); skip
+	 * it when neither applies.
 	 */
+	need_walk = (window && depth) || mode == STDIN_PACKS_MODE_FOLLOW;
+
 	revs.no_kept_objects = 1;
 	revs.keep_pack_cache_flags |= KEPT_PACK_IN_CORE;
 	revs.blob_objects = 1;
@@ -4122,12 +4130,14 @@ static void read_stdin_packs(enum stdin_packs_mode mode, int rev_list_unpacked)
 	if (rev_list_unpacked)
 		add_unreachable_loose_objects(&revs);
 
-	if (prepare_revision_walk(&revs))
-		die(_("revision walk setup failed"));
-	traverse_commit_list(&revs,
-			     show_commit_pack_hint,
-			     show_object_pack_hint,
-			     &mode);
+	if (need_walk) {
+		if (prepare_revision_walk(&revs))
+			die(_("revision walk setup failed"));
+		traverse_commit_list(&revs,
+				     show_commit_pack_hint,
+				     show_object_pack_hint,
+				     &mode);
+	}
 
 	release_revisions(&revs);
 
diff --git a/t/t5331-pack-objects-stdin.sh b/t/t5331-pack-objects-stdin.sh
index c74b5861af322f..0ecf8ebeeaf48b 100755
--- a/t/t5331-pack-objects-stdin.sh
+++ b/t/t5331-pack-objects-stdin.sh
@@ -520,4 +520,104 @@ test_expect_success '--stdin-packs with !-delimited pack without follow' '
 	)
 '
 
+test_expect_success '--stdin-packs skips rev walk when delta search is off' '
+	test_when_finished "rm -fr repo" &&
+	git init repo &&
+	(
+		cd repo &&
+
+		for c in A B C D
+		do
+			test_commit "$c" || return 1
+		done &&
+
+		A="$(echo A | git pack-objects --revs $packdir/pack)" &&
+		B="$(echo A..B | git pack-objects --revs $packdir/pack)" &&
+		C="$(echo B..C | git pack-objects --revs $packdir/pack)" &&
+		D="$(echo C..D | git pack-objects --revs $packdir/pack)" &&
+		git prune-packed &&
+
+		cat >in <<-EOF &&
+		pack-$B.pack
+		^pack-$C.pack
+		pack-$D.pack
+		EOF
+
+		# In STANDARD mode (no "=follow"), the rev walk only
+		# fills in namehash hints used during delta selection,
+		# so it is unnecessary when delta search is disabled by
+		# --window=0 or --depth=0. The trace2 counter
+		# "stdin_packs_hints" is incremented only when the walk
+		# populates a hint, so seeing a value of zero implies
+		# that the walk was skipped.
+		Pdef=$(GIT_TRACE2_EVENT="$(pwd)/walk-def.event" \
+			git pack-objects --stdin-packs $packdir/pack <in) &&
+		! grep "\"key\":\"stdin_packs_hints\",\"value\":\"0\"" walk-def.event &&
+
+		Pw0=$(GIT_TRACE2_EVENT="$(pwd)/walk-w0.event" \
+			git pack-objects --stdin-packs --window=0 $packdir/pack <in) &&
+		grep "\"key\":\"stdin_packs_hints\",\"value\":\"0\"" walk-w0.event &&
+
+		Pd0=$(GIT_TRACE2_EVENT="$(pwd)/walk-d0.event" \
+			git pack-objects --stdin-packs --depth=0 $packdir/pack <in) &&
+		grep "\"key\":\"stdin_packs_hints\",\"value\":\"0\"" walk-d0.event &&
+
+		# All three runs must produce the same object set
+		# (those in the included packs B and D, since the
+		# walk plays no role in STANDARD mode beyond hints).
+		objects_in_packs $B $D >expect &&
+		objects_in_packs $Pdef >actual &&
+		test_cmp expect actual &&
+		objects_in_packs $Pw0 >actual &&
+		test_cmp expect actual &&
+		objects_in_packs $Pd0 >actual &&
+		test_cmp expect actual
+	)
+'
+
+test_expect_success '--stdin-packs=follow walks even with delta search off' '
+	test_when_finished "rm -fr repo" &&
+	git init repo &&
+	(
+		cd repo &&
+
+		for c in A B C D
+		do
+			test_commit "$c" || return 1
+		done &&
+
+		A="$(echo A | git pack-objects --revs $packdir/pack)" &&
+		B="$(echo A..B | git pack-objects --revs $packdir/pack)" &&
+		C="$(echo B..C | git pack-objects --revs $packdir/pack)" &&
+		D="$(echo C..D | git pack-objects --revs $packdir/pack)" &&
+		git prune-packed &&
+
+		cat >in <<-EOF &&
+		pack-$B.pack
+		^pack-$C.pack
+		pack-$D.pack
+		EOF
+
+		# In FOLLOW mode, the walk also pulls in objects that
+		# live outside the included packs (here, in pack A) to
+		# close the set under reachability, so the walk must
+		# run regardless of --window/--depth.
+		objects_in_packs $A $B $D >expect &&
+
+		Pdef=$(git pack-objects --stdin-packs=follow $packdir/pack <in) &&
+		objects_in_packs $Pdef >actual &&
+		test_cmp expect actual &&
+
+		Pw0=$(git pack-objects --stdin-packs=follow --window=0 \
+			$packdir/pack <in) &&
+		objects_in_packs $Pw0 >actual &&
+		test_cmp expect actual &&
+
+		Pd0=$(git pack-objects --stdin-packs=follow --depth=0 \
+			$packdir/pack <in) &&
+		objects_in_packs $Pd0 >actual &&
+		test_cmp expect actual
+	)
+'
+
 test_done

From 2a2fcb482af3f77da3e17bc0de6103f2baa2199d Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 6 Jun 2026 11:44:37 -0700
Subject: [PATCH 4/7] pack-objects: add --emit-input-{packs,loose} plumbing
 options

If a process desires to work on packs other than what pack-objects is
working with, there is currently no way to do so.  Callers cannot simply
enumerate the packs before calling pack-objects, because that leaves a
race between their enumeration and pack-objects' enumeration; large
repositories push often enough to make losing that race inevitable.

Address this issue by adding an --emit-input-packs option to
pack-objects to allow it to provide a way to inform the caller which
packs it will be working with.  This will allow us to then operate on
packs other than those ones.

Similarly, add an --emit-input-loose option to allow pack-objects to
provide a way to inform the caller which objects it will be working
with.  This one could be avoided by the external caller just enumerating
objects on its own, because even though doing so has the exact same kind
of race involved, losing the race means the caller adds the loose object
to another pack and deletes it, which doesn't prevent pack-objects from
successfully also packing that same loose object itself.  The only
unfortunate side-effect is that the object will appear in multiple
packs, giving us some duplication.  However, we can cut down on how many
objects get temporarily duplicated using this --emit-input-loose option.

Both options write to <file>.tmp first and then rename, so the file
appears atomically and a reader either sees the previous contents (if
any) or the complete new contents, never a partial write.

Since these options exist only to support the handshake between repack
and the upcoming pack-aggregate builtin, and are not meant for end
users, they are currently undocumented.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 builtin/pack-objects.c | 71 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index 01e6da2d02032b..c5758116504496 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -213,6 +213,8 @@ static timestamp_t unpack_unreachable_expiration;
 static int pack_loose_unreachable;
 static int cruft;
 static int mark_bad_deltas;
+static const char *emit_input_packs_path;
+static const char *emit_input_loose_path;
 static int shallow = 0;
 static timestamp_t cruft_expiration;
 static int local;
@@ -5040,6 +5042,62 @@ static int parse_stdin_packs_mode(const struct option *opt, const char *arg,
 	return 0;
 }
 
+static void emit_input_packs_to_file(const char *path)
+{
+	struct strbuf tmp = STRBUF_INIT;
+	struct packed_git *p;
+	FILE *fp;
+
+	strbuf_addf(&tmp, "%s.tmp", path);
+	fp = fopen(tmp.buf, "w");
+	if (!fp)
+		die_errno(_("unable to write '%s'"), tmp.buf);
+	repo_for_each_pack(the_repository, p) {
+		/* Exclude alternates */
+		if (!p->pack_local)
+			continue;
+		fprintf(fp, "%s\n", pack_basename(p));
+	}
+	if (fclose(fp))
+		die_errno(_("unable to write '%s'"), tmp.buf);
+	if (rename(tmp.buf, path))
+		die_errno(_("unable to rename '%s' to '%s'"), tmp.buf, path);
+	strbuf_release(&tmp);
+}
+
+static int emit_input_loose_cb(const struct object_id *oid,
+			       const char *path UNUSED,
+			       void *data)
+{
+	FILE *fp = data;
+	fprintf(fp, "%s\n", oid_to_hex(oid));
+	return 0;
+}
+
+static void emit_input_loose_to_file(const char *path)
+{
+	struct strbuf tmp = STRBUF_INIT;
+	FILE *fp;
+
+	strbuf_addf(&tmp, "%s.tmp", path);
+	fp = fopen(tmp.buf, "w");
+	if (!fp)
+		die_errno(_("unable to write '%s'"), tmp.buf);
+	/*
+	 * Note: for_each_loose_file_in_source() walks only the local
+	 * source (sources->next is skipped), thus excluding
+	 * alternates and matching the "p->pack_local" check in
+	 * emit_input_packs_to_file().
+	 */
+	for_each_loose_file_in_source(the_repository->objects->sources,
+				      emit_input_loose_cb, NULL, NULL, fp);
+	if (fclose(fp))
+		die_errno(_("unable to write '%s'"), tmp.buf);
+	if (rename(tmp.buf, path))
+		die_errno(_("unable to rename '%s' to '%s'"), tmp.buf, path);
+	strbuf_release(&tmp);
+}
+
 int cmd_pack_objects(int argc,
 		     const char **argv,
 		     const char *prefix,
@@ -5137,6 +5195,14 @@ int cmd_pack_objects(int argc,
 			 N_("ignore packs that have companion .keep file")),
 		OPT_STRING_LIST(0, "keep-pack", &keep_pack_list, N_("name"),
 				N_("ignore this pack")),
+		OPT_STRING(0, "emit-input-packs", &emit_input_packs_path,
+			   N_("file"),
+			   N_("write basenames of input packs to <file> "
+			      "(plumbing, undocumented)")),
+		OPT_STRING(0, "emit-input-loose", &emit_input_loose_path,
+			   N_("file"),
+			   N_("write OIDs of input loose objects to <file> "
+			      "(plumbing, undocumented)")),
 		OPT_INTEGER(0, "compression", &pack_compression_level,
 			    N_("pack compression level")),
 		OPT_BOOL(0, "keep-true-parents", &grafts_keep_true_parents,
@@ -5400,6 +5466,11 @@ int cmd_pack_objects(int argc,
 			    the_repository);
 	prepare_packing_data(the_repository, &to_pack);
 
+	if (emit_input_packs_path)
+		emit_input_packs_to_file(emit_input_packs_path);
+	if (emit_input_loose_path)
+		emit_input_loose_to_file(emit_input_loose_path);
+
 	if (progress && !cruft)
 		progress_state = start_progress(the_repository,
 						_("Enumerating objects"), 0);

From 5c8c20449b1f62219e5cd2f580e234f750c1428a Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 6 Jun 2026 12:31:11 -0700
Subject: [PATCH 5/7] pack-aggregate: introduce a builtin for cheap object/pack
 aggregation

On busy servers it is possible for the object directory to accumulate
many loose objects and many small push packs while a long-running
maintenance pass is still working.  Until that pass finally finishes,
unrelated git operations end up scanning more files in
`objects/` and `objects/pack/` than is healthy, which shows up as
visible latency on otherwise quick commands.

Introduce a new plumbing builtin, `git pack-aggregate`, intended to
be spawned by `git repack` and run in a loop alongside the normal
repacking process.  Each cycle does two things in order:

  1. Bundle local loose objects (minus any in `--exclude-loose-file`)
     into a new pack with `pack-objects --window=0 --mark-bad-deltas
     --delta-base-offset --no-write-bitmap-index`, and unlink the
     loose copies on success.

  2. Aggregate small local packs (minus any in `--exclude-pack-file`,
     minus packs in the multi-pack-index, minus packs carrying
     `.keep`, `.promisor`, `.mtimes`, or `.bitmap` sidecars) into a
     single new pack the same way, then unlink the source packs.

Both steps copy the existing on-disk representation of each object
through unchanged: no delta search, no bitmap or commit-graph update,
no object recompression.  The output pack lands with a `.baddeltas`
marker so a subsequent thorough repack knows it should reconsider
intra-pack deltas in that pack.  The roll-up pack produced in step 1
is naturally a candidate for step 2 of the same cycle and is normally
folded in.

`git pack-aggregate` takes no locks of its own, much like `git repack`.
Callers that need serialization (typically `git gc`, or a server-side
maintenance driver) must arrange it themselves.

The integration with `git repack` (gated on a new `repack.aggregate`
config and `--aggregate` CLI flag) is left for a follow-on patch.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 Documentation/git-pack-aggregate.adoc | 115 +++++
 Documentation/meson.build             |   1 +
 Makefile                              |   1 +
 builtin.h                             |   1 +
 builtin/pack-aggregate.c              | 636 ++++++++++++++++++++++++++
 command-list.txt                      |   1 +
 git.c                                 |   1 +
 meson.build                           |   1 +
 t/meson.build                         |   1 +
 t/t5336-pack-aggregate.sh             | 222 +++++++++
 10 files changed, 980 insertions(+)
 create mode 100644 Documentation/git-pack-aggregate.adoc
 create mode 100644 builtin/pack-aggregate.c
 create mode 100755 t/t5336-pack-aggregate.sh

diff --git a/Documentation/git-pack-aggregate.adoc b/Documentation/git-pack-aggregate.adoc
new file mode 100644
index 00000000000000..0848dde6d64208
--- /dev/null
+++ b/Documentation/git-pack-aggregate.adoc
@@ -0,0 +1,115 @@
+git-pack-aggregate(1)
+=====================
+
+NAME
+----
+git-pack-aggregate - Periodically roll up loose objects and small packs
+into a single pack without doing any delta compression or search
+
+SYNOPSIS
+--------
+[verse]
+'git pack-aggregate' (--once | --loop) [--interval=<seconds>]
+                   [--min-loose=<n>] [--min-packs=<n>]
+                   [--exclude-pack-file=<path>]
+                   [--exclude-loose-file=<path>]
+                   [--parent-pipe-fd=<n>]
+
+DESCRIPTION
+-----------
+
+`git pack-aggregate` watches `$GIT_DIR/objects` for loose objects and
+small packfiles that have accumulated since the last cycle, and
+periodically rolls them up into a single new pack.  Each cycle has two
+steps:
+
+1. Bundle local loose objects (minus any listed in
+   `--exclude-loose-file`) into a new pack and unlink the loose copies.
+2. Aggregate small local packs (minus any listed in
+   `--exclude-pack-file`, or those referenced by the multi-pack-index,
+   or those carrying a `.keep`, `.promisor`, `.mtimes`, or `.bitmap`
+   sidecar) into another new pack and unlink the source packs.  The
+   pack written in step 1 is naturally a candidate here and will
+   normally be folded into the step-2 output.
+
+No delta search is performed, no bitmaps or commit-graphs are updated,
+and no objects are recompressed; the existing on-disk representation
+of each object is copied through unchanged.  Both new packs are
+written with `pack-objects --window=0 --mark-bad-deltas`, so each one
+ships with a `.baddeltas` sidecar (see linkgit:gitformat-pack[5]).  A
+subsequent thorough repack (linkgit:git-repack[1]) honors that marker
+and reconsiders intra-pack deltas at that time.
+
+The purpose of this command is to keep `objects/` from accumulating
+large numbers of loose objects or small packs while a long-running
+repack is in flight, so unrelated `git` operations are not slowed down
+by readdir cost in a sprawling object directory.  Used together with
+`repack.aggregate` (see linkgit:git-repack[1]), `git repack` will spawn
+this command for the duration of its own work.
+
+`git pack-aggregate` takes no locks of its own.  It mirrors
+linkgit:git-repack[1] in this regard: callers that need serialization
+must arrange it themselves (for example by running under `git gc`).
+The exclusion files supplied via `--exclude-pack-file` and
+`--exclude-loose-file` are the only mechanism by which a concurrent
+`pack-objects` or `git repack` declares "do not touch these inputs".
+
+OPTIONS
+-------
+
+--once::
+	Run a single cycle and exit.  Exactly one of `--once` or
+	`--loop` is required.
+
+--loop::
+	Run cycles forever, sleeping `--interval` seconds between
+	cycles.  Stops on `SIGTERM`, `SIGHUP`, or `SIGINT`.
+
+--interval=<seconds>::
+	Number of seconds to sleep between the end of one cycle and the
+	start of the next.  Defaults to 60.  Only meaningful with
+	`--loop`.
+
+--min-loose=<n>::
+	Skip step 1 if fewer than `<n>` loose objects (after applying
+	`--exclude-loose-file`) are present.  Defaults to 5.
+
+--min-packs=<n>::
+	Skip step 2 if fewer than `<n>` aggregatable packs (after
+	applying all exclusions) are present.  Defaults to 5.
+
+--exclude-pack-file=<path>::
+	Read a list of pack basenames (one per line) from `<path>` and
+	never touch any of those packs.  Lines may name a basename with
+	or without a `.pack` or `.idx` suffix; the suffix is stripped.
+	Blank lines and lines beginning with `#` are ignored.  When
+	`git pack-aggregate` is spawned by a long-running `git repack`,
+	this file is populated by that `pack-objects` itself via
+	`--emit-input-packs`, and may contain a conservative superset
+	of the packs it will actually consume (such as in `--geometric`
+	mode).
+
+--exclude-loose-file=<path>::
+	Read a list of loose object IDs (one per line) from `<path>`
+	and never pack or unlink any of those loose objects.  Blank
+	lines and lines beginning with `#` are ignored.  When `git
+	pack-aggregate` is spawned by a long-running `git repack`, this
+	file is populated by that `pack-objects` itself via
+	`--emit-input-loose`.
+
+--parent-pipe-fd=<n>::
+	An inherited pipe file descriptor whose write end the parent
+	process holds open.  When the parent exits the pipe is closed
+	and `git pack-aggregate` exits at the next cycle boundary,
+	without waiting out the remainder of `--interval`.  This is an
+	internal plumbing option used by `git repack` to keep its
+	companion aggregator from outliving it.
+
+SEE ALSO
+--------
+linkgit:git-repack[1], linkgit:git-pack-objects[1],
+linkgit:gitformat-pack[5]
+
+GIT
+---
+Part of the linkgit:git[1] suite
diff --git a/Documentation/meson.build b/Documentation/meson.build
index f4854f802d455f..c1c7d2bf1ea68b 100644
--- a/Documentation/meson.build
+++ b/Documentation/meson.build
@@ -99,6 +99,7 @@ manpages = {
   'git-name-rev.adoc' : 1,
   'git-notes.adoc' : 1,
   'git-p4.adoc' : 1,
+  'git-pack-aggregate.adoc' : 1,
   'git-pack-objects.adoc' : 1,
   'git-pack-refs.adoc' : 1,
   'git-patch-id.adoc' : 1,
diff --git a/Makefile b/Makefile
index b31ecb07564a73..d6776db1df84fc 100644
--- a/Makefile
+++ b/Makefile
@@ -1450,6 +1450,7 @@ BUILTIN_OBJS += builtin/multi-pack-index.o
 BUILTIN_OBJS += builtin/mv.o
 BUILTIN_OBJS += builtin/name-rev.o
 BUILTIN_OBJS += builtin/notes.o
+BUILTIN_OBJS += builtin/pack-aggregate.o
 BUILTIN_OBJS += builtin/pack-objects.o
 ifndef WITH_BREAKING_CHANGES
 BUILTIN_OBJS += builtin/pack-redundant.o
diff --git a/builtin.h b/builtin.h
index 4e47a4ebd30ba3..8fdd14b49360cf 100644
--- a/builtin.h
+++ b/builtin.h
@@ -224,6 +224,7 @@ int cmd_multi_pack_index(int argc, const char **argv, const char *prefix, struct
 int cmd_mv(int argc, const char **argv, const char *prefix, struct repository *repo);
 int cmd_name_rev(int argc, const char **argv, const char *prefix, struct repository *repo);
 int cmd_notes(int argc, const char **argv, const char *prefix, struct repository *repo);
+int cmd_pack_aggregate(int argc, const char **argv, const char *prefix, struct repository *repo);
 int cmd_pack_objects(int argc, const char **argv, const char *prefix, struct repository *repo);
 int cmd_pack_redundant(int argc, const char **argv, const char *prefix, struct repository *repo);
 int cmd_patch_id(int argc, const char **argv, const char *prefix, struct repository *repo);
diff --git a/builtin/pack-aggregate.c b/builtin/pack-aggregate.c
new file mode 100644
index 00000000000000..e6bbee47967a93
--- /dev/null
+++ b/builtin/pack-aggregate.c
@@ -0,0 +1,636 @@
+#define USE_THE_REPOSITORY_VARIABLE
+
+#include "builtin.h"
+#include "gettext.h"
+#include "hash.h"
+#include "hex.h"
+#include "midx.h"
+#include "object-file.h"
+#include "odb.h"
+#include "oid-array.h"
+#include "packfile.h"
+#include "parse-options.h"
+#include "path.h"
+#include "repository.h"
+#include "run-command.h"
+#include "sigchain.h"
+#include "strbuf.h"
+#include "string-list.h"
+#include "strmap.h"
+#include "strvec.h"
+#include "wrapper.h"
+
+static const char *const pack_aggregate_usage[] = {
+	N_("git pack-aggregate (--once | --loop) [--interval=<seconds>]\n"
+	   "                  [--min-loose=<n>] [--min-packs=<n>]\n"
+	   "                  [--exclude-pack-file=<path>]\n"
+	   "                  [--exclude-loose-file=<path>]\n"
+	   "                  [--parent-pipe-fd=<n>]"),
+	NULL
+};
+
+static volatile sig_atomic_t stop_signaled;
+static volatile sig_atomic_t active_child_pid;
+static int parent_pipe_fd = -1;
+
+static void term_handler(int sig)
+{
+	stop_signaled = 1;
+	/*
+	 * Best-effort forward to an in-flight pack-objects so it
+	 * doesn't keep running after we have been asked to stop.
+	 * The check-and-signal is racy with finish_command() in the
+	 * main thread; the worst case is signaling a pid we no longer
+	 * own (kill() returns ESRCH and we ignore it).
+	 */
+	if (active_child_pid > 0)
+		kill(active_child_pid, sig);
+}
+
+static int is_hex(const char *s, size_t len)
+{
+	while (len--)
+		if (!isxdigit(*s++))
+			return 0;
+	return 1;
+}
+
+static int looks_like_pack_basename(const char *name, size_t hexsz)
+{
+	static const char prefix[] = "pack-";
+	size_t plen = strlen(prefix);
+	size_t nlen = strlen(name);
+
+	/* Does this look like "pack-<hex>" with no extension? */
+	if (nlen != plen + hexsz || strncmp(name, prefix, plen))
+		return 0;
+	return is_hex(name + plen, hexsz);
+}
+
+static int has_sidecar(const char *packdir, const char *basename,
+		       const char *ext)
+{
+	struct strbuf buf = STRBUF_INIT;
+	struct stat st;
+	int ret;
+
+	strbuf_addf(&buf, "%s/%s.%s", packdir, basename, ext);
+	ret = !lstat(buf.buf, &st);
+	strbuf_release(&buf);
+	return ret;
+}
+
+static int has_protective_sidecar(const char *packdir, const char *basename)
+{
+	/*
+	 * Ignore packs with sidecars that mean "don't touch me". .baddeltas
+	 * is intentionally absent: rolling those up is the point.
+	 */
+	static const char *exts[] = {
+		"keep", "promisor", "mtimes", "bitmap", NULL
+	};
+	int i;
+
+	for (i = 0; exts[i]; i++)
+		if (has_sidecar(packdir, basename, exts[i]))
+			return 1;
+	return 0;
+}
+
+static int has_idx(const char *packdir, const char *basename)
+{
+	return has_sidecar(packdir, basename, "idx");
+}
+
+static void load_exclusions_from_file(const char *path, struct strset *set)
+{
+	FILE *fp;
+	struct strbuf line = STRBUF_INIT;
+
+	fp = fopen(path, "r");
+	if (!fp)
+		die_errno(_("could not open exclude file '%s'"), path);
+
+	while (strbuf_getline_lf(&line, fp) != EOF) {
+		strbuf_trim(&line);
+		if (!line.len || line.buf[0] == '#')
+			continue;
+		strbuf_strip_suffix(&line, ".pack");
+		strbuf_strip_suffix(&line, ".idx");
+		strset_add(set, line.buf);
+	}
+	strbuf_release(&line);
+	fclose(fp);
+}
+
+/*
+ * Re-read the multi-pack-index (and any incremental layers) and
+ * populate `set` with the basenames of every referenced pack.  The
+ * strset is cleared first so this is safe to call once per cycle.
+ */
+static int refresh_midx_exclusions(struct repository *repo,
+				   struct strset *set)
+{
+	struct multi_pack_index *m;
+	int had_midx = 0;
+
+	strset_clear(set);
+
+	odb_reprepare(repo->objects);
+	m = get_multi_pack_index(repo->objects->sources);
+	for (; m; m = m->base_midx) {
+		uint32_t i;
+		had_midx = 1;
+		for (i = 0; i < m->num_packs; i++) {
+			struct strbuf base = STRBUF_INIT;
+			strbuf_addstr(&base, m->pack_names[i]);
+			strbuf_strip_suffix(&base, ".idx");
+			strbuf_strip_suffix(&base, ".pack");
+			strset_add(set, base.buf);
+			strbuf_release(&base);
+		}
+	}
+	return had_midx;
+}
+
+/* ---------- loose-object pre-pass ---------- */
+
+struct loose_scan {
+	struct strset *exclude;
+	struct oid_array *oids;
+	struct string_list *paths;
+};
+
+static int loose_scan_cb(const struct object_id *oid, const char *path,
+			 void *cb_data)
+{
+	struct loose_scan *data = cb_data;
+
+	if (strset_contains(data->exclude, oid_to_hex(oid)))
+		return 0;
+	oid_array_append(data->oids, oid);
+	string_list_append(data->paths, path);
+	return 0;
+}
+
+static int run_pack_objects_loose(const char *packtmp, struct oid_array *oids,
+				  struct strbuf *out_hash)
+{
+	struct child_process cmd = CHILD_PROCESS_INIT;
+	struct strbuf line = STRBUF_INIT;
+	FILE *in, *out;
+	size_t i;
+	int ret;
+
+	strvec_pushl(&cmd.args,
+		     "pack-objects",
+		     "--window=0",
+		     "--mark-bad-deltas",
+		     "--delta-base-offset",
+		     "--no-write-bitmap-index",
+		     "--quiet",
+		     packtmp,
+		     NULL);
+	cmd.git_cmd = 1;
+	cmd.in = -1;
+	cmd.out = -1;
+
+	if (start_command(&cmd))
+		return -1;
+	active_child_pid = cmd.pid;
+
+	/*
+	 * The order is "write all stdin, then read all stdout".  This
+	 * is only safe because --quiet bounds pack-objects's stdout to
+	 * a single short pack-hash line, which fits in the pipe buffer;
+	 * pack-objects can therefore drain its stdin without blocking
+	 * on stdout writes back to us.
+	 */
+	in = xfdopen(cmd.in, "w");
+	for (i = 0; i < oids->nr; i++)
+		fprintf(in, "%s\n", oid_to_hex(&oids->oid[i]));
+	if (fclose(in))
+		warning_errno(_("could not close pack-objects input"));
+
+	/*
+	 * Capture the first line as the pack hash, then drain to EOF so
+	 * pack-objects observes a clean close on its stdout and we never
+	 * end up in finish_command() with bytes left in the pipe.
+	 */
+	out = xfdopen(cmd.out, "r");
+	while (strbuf_getline_lf(&line, out) != EOF) {
+		if (!out_hash->len)
+			strbuf_addbuf(out_hash, &line);
+	}
+	fclose(out);
+
+	ret = finish_command(&cmd);
+	active_child_pid = 0;
+	strbuf_release(&line);
+	return ret;
+}
+
+static void unlink_loose_paths(const struct string_list *paths)
+{
+	size_t i;
+
+	for (i = 0; i < paths->nr; i++) {
+		const char *p = paths->items[i].string;
+		if (unlink(p) < 0 && errno != ENOENT)
+			warning_errno(_("could not unlink loose object '%s'"),
+				      p);
+	}
+}
+
+/* ---------- pack aggregation ---------- */
+
+struct pack_scan {
+	const char *packdir;
+	struct strset *file_exclude;
+	struct strset *midx_exclude;
+	struct string_list *candidates;
+	size_t hexsz;
+};
+
+static void pack_scan_cb(const char *full_path UNUSED,
+			 size_t full_path_len UNUSED,
+			 const char *file_name, void *cb_data)
+{
+	struct pack_scan *data = cb_data;
+	struct strbuf base = STRBUF_INIT;
+
+	if (!ends_with(file_name, ".pack"))
+		return;
+	strbuf_addstr(&base, file_name);
+	strbuf_setlen(&base, base.len - strlen(".pack"));
+
+	if (!looks_like_pack_basename(base.buf, data->hexsz))
+		goto out;
+	if (strset_contains(data->file_exclude, base.buf))
+		goto out;
+	if (strset_contains(data->midx_exclude, base.buf))
+		goto out;
+	if (has_protective_sidecar(data->packdir, base.buf))
+		goto out;
+	if (!has_idx(data->packdir, base.buf))
+		goto out;
+
+	string_list_append(data->candidates, base.buf);
+out:
+	strbuf_release(&base);
+}
+
+static int run_pack_objects_packs(const char *packtmp,
+				  const struct string_list *bases,
+				  struct strbuf *out_hash)
+{
+	struct child_process cmd = CHILD_PROCESS_INIT;
+	struct strbuf line = STRBUF_INIT;
+	FILE *in, *out;
+	size_t i;
+	int ret;
+
+	strvec_pushl(&cmd.args,
+		     "pack-objects",
+		     "--stdin-packs",
+		     "--window=0",
+		     "--mark-bad-deltas",
+		     "--delta-base-offset",
+		     "--no-write-bitmap-index",
+		     "--quiet",
+		     packtmp,
+		     NULL);
+	cmd.git_cmd = 1;
+	cmd.in = -1;
+	cmd.out = -1;
+
+	if (start_command(&cmd))
+		return -1;
+	active_child_pid = cmd.pid;
+
+	/* See run_pack_objects_loose() for why write-then-read is safe. */
+	in = xfdopen(cmd.in, "w");
+	for (i = 0; i < bases->nr; i++)
+		fprintf(in, "%s.pack\n", bases->items[i].string);
+	if (fclose(in))
+		warning_errno(_("could not close pack-objects input"));
+
+	out = xfdopen(cmd.out, "r");
+	while (strbuf_getline_lf(&line, out) != EOF) {
+		if (!out_hash->len)
+			strbuf_addbuf(out_hash, &line);
+	}
+	fclose(out);
+
+	ret = finish_command(&cmd);
+	active_child_pid = 0;
+	strbuf_release(&line);
+	return ret;
+}
+
+/*
+ * pack-objects writes its output as <packtmp>-<hash>.<ext>; rename it
+ * into place as <packdir>/pack-<hash>.<ext>.  .idx is renamed last so
+ * a concurrent reader scanning the pack directory never sees a .idx
+ * without its companion .pack.
+ */
+static void install_pack(const char *packtmp, const char *packdir,
+			 const char *hash)
+{
+	static const char *exts[] = {
+		".pack", ".rev", ".baddeltas", ".idx"
+	};
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(exts); i++) {
+		struct strbuf src = STRBUF_INIT;
+		struct strbuf dst = STRBUF_INIT;
+		struct stat st;
+
+		strbuf_addf(&src, "%s-%s%s", packtmp, hash, exts[i]);
+		strbuf_addf(&dst, "%s/pack-%s%s", packdir, hash, exts[i]);
+
+		if (!stat(src.buf, &st)) {
+			if (chmod(src.buf, st.st_mode & ~(S_IWUSR | S_IWGRP | S_IWOTH)))
+				warning_errno(_("could not make '%s' read-only"),
+					      src.buf);
+			if (rename(src.buf, dst.buf))
+				die_errno(_("renaming '%s' to '%s' failed"),
+					  src.buf, dst.buf);
+		} else if (errno != ENOENT) {
+			die_errno(_("could not stat '%s'"), src.buf);
+		}
+		strbuf_release(&src);
+		strbuf_release(&dst);
+	}
+}
+
+static void unlink_consumed_packs(const char *packdir,
+				  const struct string_list *bases,
+				  const char *keep_basename)
+{
+	static const char *exts[] = {
+		"pack", "idx", "rev", "baddeltas", NULL
+	};
+	size_t i;
+
+	for (i = 0; i < bases->nr; i++) {
+		const char *base = bases->items[i].string;
+		int j;
+
+		/*
+		 * Recheck protective sidecars: a .keep (or similar) may
+		 * have appeared between scan and now, in which case the
+		 * pack must stay.
+		 */
+		if (has_protective_sidecar(packdir, base))
+			continue;
+		/*
+		 * Never unlink the pack we just installed.  Aggregating
+		 * packs whose union equals one of the inputs (e.g. one
+		 * input is a strict superset of the others) can yield a
+		 * byte-identical output, which lands at the same final
+		 * name as that input.  In that case, we do not want the
+		 * file serving as both input and output to be deleted.
+		 */
+		if (keep_basename && !strcmp(base, keep_basename))
+			continue;
+
+		for (j = 0; exts[j]; j++) {
+			struct strbuf fname = STRBUF_INIT;
+			strbuf_addf(&fname, "%s/%s.%s", packdir, base,
+				    exts[j]);
+			if (unlink(fname.buf) < 0 && errno != ENOENT)
+				warning_errno(_("could not unlink '%s'"),
+					      fname.buf);
+			strbuf_release(&fname);
+		}
+	}
+}
+
+static int do_one_cycle(struct repository *repo, const char *packdir,
+			struct strset *pack_exclude,
+			struct strset *loose_exclude,
+			struct strset *midx_exclude,
+			int min_loose, int min_packs)
+{
+	struct oid_array loose_oids = OID_ARRAY_INIT;
+	struct string_list loose_paths = STRING_LIST_INIT_DUP;
+	struct loose_scan loose_data = {
+		.exclude = loose_exclude,
+		.oids = &loose_oids,
+		.paths = &loose_paths,
+	};
+	struct string_list candidates = STRING_LIST_INIT_DUP;
+	struct pack_scan pack_data = {
+		.packdir = packdir,
+		.file_exclude = pack_exclude,
+		.midx_exclude = midx_exclude,
+		.candidates = &candidates,
+		.hexsz = repo->hash_algo->hexsz,
+	};
+	struct strbuf loose_hash = STRBUF_INIT;
+	struct strbuf packs_hash = STRBUF_INIT;
+	char *packtmp_loose = NULL;
+	char *packtmp_packs = NULL;
+	int ret = 0;
+
+	/*
+	 * Step 1: bundle local loose objects (minus excluded ones) into
+	 * a single new pack and remove the on-disk loose copies.  The
+	 * resulting pack picks up a .baddeltas marker thanks to
+	 * --mark-bad-deltas, and is in turn a candidate for the pack
+	 * aggregation step below.
+	 */
+	for_each_loose_file_in_source(repo->objects->sources,
+				      loose_scan_cb, NULL, NULL, &loose_data);
+	if ((int)loose_oids.nr >= min_loose && !stop_signaled) {
+		packtmp_loose = mkpathdup("%s/.tmp-%d-loose-pack",
+					  packdir, (int)getpid());
+		if (run_pack_objects_loose(packtmp_loose, &loose_oids,
+					   &loose_hash)) {
+			ret = error(_("pack-objects failed during "
+				      "loose-object rollup"));
+			goto out;
+		}
+		if (loose_hash.len) {
+			install_pack(packtmp_loose, packdir, loose_hash.buf);
+			unlink_loose_paths(&loose_paths);
+		}
+	}
+
+	if (stop_signaled)
+		goto out;
+
+	/*
+	 * Step 2: aggregate small packs into a single bigger pack.  The
+	 * freshly-installed loose-rollup pack from step 1 is picked up
+	 * naturally by the directory scan below (it has no protective
+	 * sidecars and isn't in any exclusion set).  Re-read the MIDX
+	 * just before scanning so a pack added to a MIDX between cycles
+	 * is honored.
+	 */
+	refresh_midx_exclusions(repo, midx_exclude);
+	for_each_file_in_pack_dir(repo_get_object_directory(repo),
+				  pack_scan_cb, &pack_data);
+
+	if ((int)candidates.nr < min_packs)
+		goto out;
+
+	packtmp_packs = mkpathdup("%s/.tmp-%d-pack",
+				  packdir, (int)getpid());
+	if (run_pack_objects_packs(packtmp_packs, &candidates,
+				   &packs_hash)) {
+		ret = error(_("pack-objects failed during "
+			      "pack aggregation"));
+		goto out;
+	}
+	if (packs_hash.len) {
+		struct strbuf output_base = STRBUF_INIT;
+		install_pack(packtmp_packs, packdir, packs_hash.buf);
+		strbuf_addf(&output_base, "pack-%s", packs_hash.buf);
+		unlink_consumed_packs(packdir, &candidates, output_base.buf);
+		strbuf_release(&output_base);
+	}
+
+out:
+	free(packtmp_loose);
+	free(packtmp_packs);
+	strbuf_release(&loose_hash);
+	strbuf_release(&packs_hash);
+	string_list_clear(&candidates, 0);
+	oid_array_clear(&loose_oids);
+	string_list_clear(&loose_paths, 0);
+	return ret;
+}
+
+static void interruptible_sleep(unsigned int seconds)
+{
+	struct pollfd pfd;
+	int timeout_ms;
+
+	if (stop_signaled)
+		return;
+
+	if (parent_pipe_fd < 0) {
+		unsigned int remaining = seconds;
+		while (remaining > 0 && !stop_signaled)
+			remaining = sleep(remaining);
+		return;
+	}
+
+	/*
+	 * Watch the parent pipe so we wake immediately if the process
+	 * that spawned us exits.  POLLHUP is reported in revents
+	 * regardless of whether it appears in events, so we leave
+	 * events==0; any of POLLHUP/POLLERR/POLLNVAL/POLLIN means the
+	 * other end of the pipe is gone and we should stop.
+	 */
+	pfd.fd = parent_pipe_fd;
+	pfd.events = 0;
+	timeout_ms = (seconds > INT_MAX / 1000) ? INT_MAX
+					       : (int)(seconds * 1000);
+
+	while (!stop_signaled) {
+		int ret;
+		pfd.revents = 0;
+		ret = poll(&pfd, 1, timeout_ms);
+		if (ret < 0) {
+			if (errno == EINTR)
+				continue;
+			break;
+		}
+		if (ret == 0)
+			break;
+		if (pfd.revents & (POLLHUP | POLLERR | POLLNVAL | POLLIN)) {
+			stop_signaled = 1;
+			break;
+		}
+	}
+}
+
+int cmd_pack_aggregate(int argc, const char **argv,
+		       const char *prefix, struct repository *repo)
+{
+	const char *exclude_pack_file = NULL;
+	const char *exclude_loose_file = NULL;
+	int interval = 60;
+	int min_packs = 5;
+	int min_loose = 5;
+	int once = 0;
+	int loop = 0;
+	struct option options[] = {
+		OPT_BOOL(0, "once", &once,
+			 N_("run a single cycle and exit")),
+		OPT_BOOL(0, "loop", &loop,
+			 N_("loop forever, sleeping --interval seconds "
+			    "between cycles")),
+		OPT_INTEGER(0, "interval", &interval,
+			    N_("seconds to sleep between cycles "
+			       "(default 60)")),
+		OPT_INTEGER(0, "min-loose", &min_loose,
+			    N_("skip loose-object rollup if fewer "
+			       "candidates (default 5)")),
+		OPT_INTEGER(0, "min-packs", &min_packs,
+			    N_("skip pack aggregation if fewer "
+			       "candidates (default 5)")),
+		OPT_STRING(0, "exclude-pack-file", &exclude_pack_file,
+			   N_("file"),
+			   N_("file listing pack basenames never to "
+			      "touch")),
+		OPT_STRING(0, "exclude-loose-file", &exclude_loose_file,
+			   N_("file"),
+			   N_("file listing loose object OIDs never to "
+			      "touch")),
+		OPT_INTEGER(0, "parent-pipe-fd", &parent_pipe_fd,
+			    N_("inherited fd of a pipe whose write end "
+			       "the parent holds; EOF triggers exit")),
+		OPT_END(),
+	};
+	struct strset pack_exclude = STRSET_INIT;
+	struct strset loose_exclude = STRSET_INIT;
+	struct strset midx_exclude = STRSET_INIT;
+	char *packdir;
+	int ret = 0;
+
+	argc = parse_options(argc, argv, prefix, options,
+			     pack_aggregate_usage, 0);
+	if (argc > 0)
+		usage_with_options(pack_aggregate_usage, options);
+	if (once == loop)
+		die(_("exactly one of --once or --loop is required"));
+	if (interval < 1)
+		die(_("--interval must be at least 1"));
+	if (min_loose < 1)
+		die(_("--min-loose must be at least 1"));
+	if (min_packs < 1)
+		die(_("--min-packs must be at least 1"));
+
+	packdir = mkpathdup("%s/pack", repo_get_object_directory(repo));
+
+	if (exclude_pack_file)
+		load_exclusions_from_file(exclude_pack_file, &pack_exclude);
+	if (exclude_loose_file)
+		load_exclusions_from_file(exclude_loose_file, &loose_exclude);
+
+	sigchain_push(SIGTERM, term_handler);
+	sigchain_push(SIGHUP, term_handler);
+	sigchain_push(SIGINT, term_handler);
+
+	do {
+		if (stop_signaled)
+			break;
+		ret = do_one_cycle(repo, packdir, &pack_exclude,
+				   &loose_exclude, &midx_exclude,
+				   min_loose, min_packs);
+		if (ret || once || stop_signaled)
+			break;
+		interruptible_sleep((unsigned int)interval);
+	} while (!stop_signaled);
+
+	strset_clear(&pack_exclude);
+	strset_clear(&loose_exclude);
+	strset_clear(&midx_exclude);
+	free(packdir);
+	return ret ? 1 : 0;
+}
diff --git a/command-list.txt b/command-list.txt
index 21b802c42026b3..95fc35c2e8dc7c 100644
--- a/command-list.txt
+++ b/command-list.txt
@@ -148,6 +148,7 @@ git-mv                                  mainporcelain           worktree
 git-name-rev                            plumbinginterrogators
 git-notes                               mainporcelain
 git-p4                                  foreignscminterface
+git-pack-aggregate                      plumbingmanipulators
 git-pack-objects                        plumbingmanipulators
 git-pack-redundant                      plumbinginterrogators
 git-pack-refs                           ancillarymanipulators
diff --git a/git.c b/git.c
index 36f08891ef5476..23b009ac062212 100644
--- a/git.c
+++ b/git.c
@@ -617,6 +617,7 @@ static struct cmd_struct commands[] = {
 	{ "mv", cmd_mv, RUN_SETUP | NEED_WORK_TREE },
 	{ "name-rev", cmd_name_rev, RUN_SETUP },
 	{ "notes", cmd_notes, RUN_SETUP },
+	{ "pack-aggregate", cmd_pack_aggregate, RUN_SETUP },
 	{ "pack-objects", cmd_pack_objects, RUN_SETUP },
 #ifndef WITH_BREAKING_CHANGES
 	{ "pack-redundant", cmd_pack_redundant, RUN_SETUP | NO_PARSEOPT | DEPRECATED },
diff --git a/meson.build b/meson.build
index 064fe2e2f1f4e5..cf7184fc02d5db 100644
--- a/meson.build
+++ b/meson.build
@@ -656,6 +656,7 @@ builtin_sources = [
   'builtin/mv.c',
   'builtin/name-rev.c',
   'builtin/notes.c',
+  'builtin/pack-aggregate.c',
   'builtin/pack-objects.c',
   'builtin/pack-refs.c',
   'builtin/patch-id.c',
diff --git a/t/meson.build b/t/meson.build
index 3516913411dc5c..f4916175b69b66 100644
--- a/t/meson.build
+++ b/t/meson.build
@@ -629,6 +629,7 @@ integration_tests = [
   't5333-pseudo-merge-bitmaps.sh',
   't5334-incremental-multi-pack-index.sh',
   't5335-compact-multi-pack-index.sh',
+  't5336-pack-aggregate.sh',
   't5337-pack-baddeltas.sh',
   't5351-unpack-large-objects.sh',
   't5400-send-pack.sh',
diff --git a/t/t5336-pack-aggregate.sh b/t/t5336-pack-aggregate.sh
new file mode 100755
index 00000000000000..ec4e2c8207668b
--- /dev/null
+++ b/t/t5336-pack-aggregate.sh
@@ -0,0 +1,222 @@
+#!/bin/sh
+
+test_description='`git pack-aggregate` rolls up small packs and loose objects'
+
+. ./test-lib.sh
+
+# Build N tiny packs in objects/pack/, each containing one distinct
+# blob.  Echoes the basenames (without .pack) one per line.
+build_n_packs () {
+	n=$1 &&
+	mkdir -p .git/objects/pack &&
+	i=0 &&
+	while test $i -lt "$n"
+	do
+		blob=$(echo "content-$i-$$" | git hash-object -w --stdin) &&
+		echo "$blob" |
+		git pack-objects --window=0 .git/objects/pack/pack \
+			>pack_hash &&
+		hash=$(cat pack_hash) &&
+		test -n "$hash" &&
+		test_path_is_file .git/objects/pack/pack-${hash}.pack &&
+		git prune-packed &&
+		echo "pack-$hash" &&
+		i=$((i + 1)) || return 1
+	done
+}
+
+# Create N loose objects in the repository.  Echoes the OIDs one per
+# line.
+build_n_loose () {
+	n=$1 &&
+	i=0 &&
+	while test $i -lt "$n"
+	do
+		echo "loose-$i-$$" | git hash-object -w --stdin &&
+		i=$((i + 1)) || return 1
+	done
+}
+
+count_packs () {
+	ls .git/objects/pack/pack-*.pack 2>/dev/null | wc -l
+}
+
+count_baddeltas () {
+	ls .git/objects/pack/pack-*.baddeltas 2>/dev/null | wc -l
+}
+
+count_loose () {
+	find .git/objects \
+		-type f \
+		-name '[0-9a-f]*' \
+		-not -path '.git/objects/pack/*' \
+		-not -path '.git/objects/info/*' |
+	wc -l
+}
+
+test_expect_success 'setup an empty repo' '
+	git init repo
+'
+
+test_expect_success '--once requires either --once or --loop' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		test_must_fail git pack-aggregate 2>err &&
+		grep "exactly one of --once or --loop" err
+	)
+'
+
+test_expect_success '--once below --min-packs is a no-op for packs' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 3 >/dev/null &&
+		test 3 -eq "$(count_packs)" &&
+		git pack-aggregate --once --min-loose=1000 &&
+		test 3 -eq "$(count_packs)" &&
+		test 0 -eq "$(count_baddeltas)"
+	)
+'
+
+test_expect_success '--once aggregates above --min-packs' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >packs.txt &&
+		test 5 -eq "$(count_packs)" &&
+		git pack-aggregate --once \
+			--min-loose=1000 --min-packs=5 &&
+		test 1 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_expect_success '--exclude-pack-file protects listed packs' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 6 >packs.txt &&
+		head -n 2 packs.txt >exclude.txt &&
+		git pack-aggregate --once \
+			--min-loose=1000 --min-packs=4 \
+			--exclude-pack-file=exclude.txt &&
+		while read name
+		do
+			test_path_is_file \
+				.git/objects/pack/${name}.pack || return 1
+		done <exclude.txt &&
+		# 2 excluded + 1 aggregate = 3 packs total.
+		test 3 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'sidecar-marked packs are skipped' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 6 >packs.txt &&
+		first=$(head -n 1 packs.txt) &&
+		>.git/objects/pack/${first}.keep &&
+		git pack-aggregate --once \
+			--min-loose=1000 --min-packs=4 &&
+		test_path_is_file .git/objects/pack/${first}.pack &&
+		test_path_is_file .git/objects/pack/${first}.keep &&
+		# 1 kept + 1 aggregate = 2 packs total.
+		test 2 -eq "$(count_packs)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'aggregate re-rolls up .baddeltas packs' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >/dev/null &&
+		git pack-aggregate --once \
+			--min-loose=1000 --min-packs=5 &&
+		test 1 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		# Now add more small packs and aggregate again.  The
+		# previous .baddeltas pack should NOT be protected (we
+		# want to keep rolling them up).
+		build_n_packs 4 >/dev/null &&
+		test 5 -eq "$(count_packs)" &&
+		git pack-aggregate --once \
+			--min-loose=1000 --min-packs=5 &&
+		test 1 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'aggregates loose objects above --min-loose' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_loose 5 >/dev/null &&
+		test 5 -eq "$(count_loose)" &&
+		git pack-aggregate --once \
+			--min-loose=1 --min-packs=1000 &&
+		test 0 -eq "$(count_loose)" &&
+		test 1 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_expect_success '--exclude-loose-file protects listed loose objects' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_loose 5 >loose.txt &&
+		head -n 2 loose.txt >exclude.txt &&
+		git pack-aggregate --once \
+			--min-loose=1 --min-packs=1000 \
+			--exclude-loose-file=exclude.txt &&
+		while read oid
+		do
+			dir=$(echo "$oid" | cut -c1-2) &&
+			rest=$(echo "$oid" | cut -c3-) &&
+			test_path_is_file \
+				.git/objects/${dir}/${rest} || return 1
+		done <exclude.txt &&
+		test 2 -eq "$(count_loose)" &&
+		test 1 -eq "$(count_packs)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'loose then pack aggregation in one cycle' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_loose 5 >/dev/null &&
+		build_n_packs 5 >/dev/null &&
+		test 5 -eq "$(count_loose)" &&
+		test 5 -eq "$(count_packs)" &&
+		git pack-aggregate --once \
+			--min-loose=1 --min-packs=5 &&
+		# Step 1 creates one pack from the loose objects, then
+		# step 2 sweeps that pack plus the five existing ones
+		# into a single aggregate.
+		test 0 -eq "$(count_loose)" &&
+		test 1 -eq "$(count_packs)" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_done

From 4a2a3988bfbbb7abdda09ce2dfc7b80978815f5e Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Sat, 6 Jun 2026 12:41:37 -0700
Subject: [PATCH 6/7] repack: optionally spawn pack-aggregate to keep
 objects/packs tidy

On a busy server hosting a large repository, `git repack` routinely
takes long enough for thousands of packs and tens of thousands of loose
objects to accumulate before it finishes.  Every subsequent git
operation pays the price: each pack lookup walks the longer list, and
each loose-object miss has to consult more sources.

Wire `git repack` to optionally drive `git pack-aggregate` as a
background side process, controlled by `repack.aggregate` config
or the equivalent `--aggregate` / `--no-aggregate` command-line
options.  Default off.

When enabled:

  * Create a small tempdir under `objects/` for two exclude files.
  * Pass `--emit-input-packs=<tmp>/packs --emit-input-loose=<tmp>/loose`
    to the main pack-objects so it records exactly which inputs it
    has committed to.
  * Launch `git pack-aggregate --loop --exclude-pack-file=<tmp>/packs
    --exclude-loose-file=<tmp>/loose` once the emit files exist.
  * Drop a `.keep` marker on every pack written by the main repacking
    work, so the aggregator does not roll it up.

pack-aggregate keeps running through the cruft pack-objects subprocess
and through `write_midx_included_packs()`; it is SIGTERM'd only when it
comes time to delete redundant packs and objects.

Finally, unlink the recorded `.keep` markers after pack-aggregate has
been shut down.

Add a few environment variables to simplify testing:
  * `GIT_TEST_PACK_AGGREGATE_INTERVAL`
  * `GIT_TEST_PACK_AGGREGATE_MIN_PACKS`
  * `GIT_TEST_PACK_AGGREGATE_MIN_LOOSE`

`git repack` itself takes no locks, and neither does the aggregator
we spawn; serialization across maintenance runs is the caller's
responsibility (typically `git gc` or a server-side maintenance
driver).  This matches the prior behavior of `git repack`.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 Documentation/config/repack.adoc |  10 +
 Documentation/git-repack.adoc    |  12 +
 builtin/repack.c                 | 447 ++++++++++++++++++++++++++++++-
 t/t5336-pack-aggregate.sh        | 211 +++++++++++++++
 4 files changed, 679 insertions(+), 1 deletion(-)

diff --git a/Documentation/config/repack.adoc b/Documentation/config/repack.adoc
index 4c22a499f6216c..9fd250870eb0a4 100644
--- a/Documentation/config/repack.adoc
+++ b/Documentation/config/repack.adoc
@@ -64,3 +64,13 @@ repack.midxNewLayerThreshold::
 When the tip layer has fewer packs than this threshold, those packs are
 excluded from the geometric repack entirely, and are thus left
 unmodified. Must be at least 1. Defaults to 8.
+
+repack.aggregate::
+	If set to true, linkgit:git-repack[1] will spawn a background
+	linkgit:git-pack-aggregate[1] for the duration of its main
+	pack-objects run.  The aggregator rolls up small packs and
+	loose objects that arrive after pack-objects has enumerated
+	its inputs, preventing them from accumulating in
+	`objects/pack/` and slowing other Git operations on busy
+	servers.  Defaults to false.  Can be overridden on the
+	command line with `--aggregate` or `--no-aggregate`.
diff --git a/Documentation/git-repack.adoc b/Documentation/git-repack.adoc
index 72c42015e23f94..d140c68d40a99d 100644
--- a/Documentation/git-repack.adoc
+++ b/Documentation/git-repack.adoc
@@ -12,6 +12,7 @@ SYNOPSIS
 'git repack' [-a] [-A] [-d] [-f] [-F] [-l] [-n] [-q] [-b] [-m]
 	[--window=<n>] [--depth=<n>] [--threads=<n>] [--keep-pack=<pack-name>]
 	[--write-midx[=<mode>]] [--name-hash-version=<n>] [--path-walk]
+	[--[no-]aggregate]
 
 DESCRIPTION
 -----------
@@ -300,6 +301,16 @@ created for any new pack(s) without disturbing the existing chain.
 	Pass the `--path-walk` option to the underlying `git pack-objects`
 	process. See linkgit:git-pack-objects[1] for full details.
 
+--aggregate::
+--no-aggregate::
+	Spawn a background linkgit:git-pack-aggregate[1] for the
+	duration of the main pack-objects run.  The aggregator rolls
+	up small packs and loose objects that arrive after
+	pack-objects has enumerated its inputs, preventing them from
+	accumulating in `objects/pack/` and slowing other Git
+	operations on busy servers.  Overrides the
+	`repack.aggregate` configuration variable.  Off by default.
+
 CONFIGURATION
 -------------
 
@@ -324,6 +335,7 @@ SEE ALSO
 --------
 linkgit:git-pack-objects[1]
 linkgit:git-prune-packed[1]
+linkgit:git-pack-aggregate[1]
 
 GIT
 ---
diff --git a/builtin/repack.c b/builtin/repack.c
index 1524a9c13ad5b8..23d8e4fdcc1064 100644
--- a/builtin/repack.c
+++ b/builtin/repack.c
@@ -4,6 +4,7 @@
 #include "builtin.h"
 #include "config.h"
 #include "environment.h"
+#include "gettext.h"
 #include "parse-options.h"
 #include "path.h"
 #include "run-command.h"
@@ -15,6 +16,10 @@
 #include "promisor-remote.h"
 #include "repack.h"
 #include "shallow.h"
+#include "dir.h"
+#include "strbuf.h"
+#include "strvec.h"
+#include "wrapper.h"
 
 #define ALL_INTO_ONE 1
 #define LOOSEN_UNREACHABLE 2
@@ -29,11 +34,13 @@ static int use_delta_islands;
 static int run_update_server_info = 1;
 static char *packdir, *packtmp_name, *packtmp;
 static int midx_must_contain_cruft = 1;
+static int aggregate_opt = -1;
 
 static const char *const git_repack_usage[] = {
 	N_("git repack [-a] [-A] [-d] [-f] [-F] [-l] [-n] [-q] [-b] [-m]\n"
 	   "[--window=<n>] [--depth=<n>] [--threads=<n>] [--keep-pack=<pack-name>]\n"
-	   "[--write-midx[=<mode>]] [--name-hash-version=<n>] [--path-walk]"),
+	   "[--write-midx[=<mode>]] [--name-hash-version=<n>] [--path-walk]\n"
+	   "[--[no-]aggregate]"),
 	NULL
 };
 
@@ -109,6 +116,10 @@ static int repack_config(const char *var, const char *value,
 								      ctx->kvi);
 		return 0;
 	}
+	if (!strcmp(var, "repack.aggregate")) {
+		aggregate_opt = git_config_bool(var, value);
+		return 0;
+	}
 	return git_default_config(var, value, ctx, cb);
 }
 
@@ -132,12 +143,383 @@ static int option_parse_write_midx(const struct option *opt, const char *arg,
 	return 0;
 }
 
+/*
+ * State for the optional `git pack-aggregate` sidecar that we
+ * launch alongside the main pack-objects when --aggregate is on.
+ */
+struct aggregate_sidecar {
+	struct child_process cmd;
+	char *tmpdir;
+	char *exclude_packs_path;
+	char *exclude_loose_path;
+	/*
+	 * Full paths of the ".keep" marker files we created in this
+	 * repack.  Cleared (and the files unlinked) after the sidecar
+	 * has been reaped, so that pack-aggregate never sees a pack
+	 * lose its marker while it is still running.
+	 */
+	struct string_list installed_keeps;
+	/*
+	 * Write end of a pipe whose read end the aggregator inherits
+	 * (passed via --parent-pipe-fd).  Closing this fd is the
+	 * orphan-detection signal: when repack exits without an
+	 * explicit stop_aggregate_sidecar(), the aggregator sees EOF
+	 * and bails out instead of running unsupervised.
+	 */
+	int parent_pipe_write_fd;
+	int started;
+};
+#define AGGREGATE_KEEP_MARKER_PREFIX "git-repack-aggregate-temporary"
+
+/*
+ * Scan packdir for stale ".keep" markers left behind by previous
+ * crashed repacks: files whose contents begin with our marker
+ * prefix and whose owning pid is no longer running.  Skip anything
+ * we cannot parse (foreign ".keep" files) or whose owner is alive.
+ */
+static void clean_stale_aggregate_keeps(const char *packdir)
+{
+	DIR *dir = opendir(packdir);
+	struct dirent *ent;
+	struct strbuf path = STRBUF_INIT;
+
+	if (!dir)
+		return;
+
+	while ((ent = readdir(dir))) {
+		const char *p;
+		char *end;
+		long pid;
+		int fd;
+		ssize_t n;
+		char buf[256];
+
+		if (!ends_with(ent->d_name, ".keep"))
+			continue;
+
+		strbuf_reset(&path);
+		strbuf_addf(&path, "%s/%s", packdir, ent->d_name);
+
+		fd = open(path.buf, O_RDONLY);
+		if (fd < 0)
+			continue;
+		n = read_in_full(fd, buf, sizeof(buf) - 1);
+		close(fd);
+		if (n <= 0)
+			continue;
+		buf[n] = '\0';
+
+		if (!skip_prefix(buf, AGGREGATE_KEEP_MARKER_PREFIX " pid=", &p))
+			continue;
+		errno = 0;
+		pid = strtol(p, &end, 10);
+		if (errno || end == p || pid <= 0)
+			continue;
+		if (*end != '\n' && *end != '\0')
+			continue;
+
+		/* Send no signal; just check existence of process */
+		if (!kill((pid_t)pid, 0))
+			continue;
+		if (errno != ESRCH)
+			continue;
+
+		if (unlink(path.buf) && errno != ENOENT)
+			warning_errno(_("could not unlink stale "
+					"aggregate .keep marker '%s'"),
+				      path.buf);
+	}
+
+	closedir(dir);
+	strbuf_release(&path);
+}
+
+/*
+ * Drop a ".keep" marker on every newly written pack so that the
+ * aggregator (which respects ".keep") cannot pick up one of the
+ * outputs from the primary repacking work.  We do this BEFORE the
+ * install loop so the marker is in place the moment
+ * generated_pack_install() renames ".idx" into view.
+ *
+ * We use O_CREAT|O_EXCL: if a ".keep" already exists for that
+ * basename (e.g. user-created, or a stale marker we failed to
+ * clean), we leave it alone and do NOT record it for cleanup --
+ * cleanup must only ever unlink markers we ourselves created.
+ */
+static void install_aggregate_keep_markers(struct aggregate_sidecar *sc,
+					   const char *packdir,
+					   const struct string_list *names)
+{
+	struct strbuf path = STRBUF_INIT;
+	struct strbuf content = STRBUF_INIT;
+	size_t i;
+
+	strbuf_addf(&content, "%s pid=%ld\n",
+		    AGGREGATE_KEEP_MARKER_PREFIX, (long)getpid());
+
+	for (i = 0; i < names->nr; i++) {
+		int fd;
+
+		strbuf_reset(&path);
+		strbuf_addf(&path, "%s/pack-%s.keep", packdir,
+			    names->items[i].string);
+
+		fd = open(path.buf, O_WRONLY | O_CREAT | O_EXCL, 0666);
+		if (fd < 0) {
+			if (errno == EEXIST)
+				continue;
+			die_errno(_("could not create aggregate "
+				    ".keep marker '%s'"), path.buf);
+		}
+		if (write_in_full(fd, content.buf, content.len) < 0)
+			die_errno(_("could not write aggregate "
+				    ".keep marker '%s'"), path.buf);
+		close(fd);
+		string_list_append(&sc->installed_keeps, path.buf);
+	}
+
+	strbuf_release(&path);
+	strbuf_release(&content);
+}
+
+/*
+ * Unlink every ".keep" marker we created earlier.  Must be called
+ * AFTER stop_aggregate_sidecar() has reaped pack-aggregate, so that
+ * the aggregator cannot see a pack lose its protective marker while
+ * it is still running.
+ */
+static void remove_aggregate_keep_markers(struct aggregate_sidecar *sc)
+{
+	size_t i;
+
+	for (i = 0; i < sc->installed_keeps.nr; i++) {
+		const char *p = sc->installed_keeps.items[i].string;
+		if (unlink(p) && errno != ENOENT)
+			warning_errno(_("could not unlink aggregate "
+					".keep marker '%s'"), p);
+	}
+	string_list_clear(&sc->installed_keeps, 0);
+}
+
+static int wait_for_emit_files(const char *packs_path,
+			       const char *loose_path,
+			       int pack_objects_out_fd)
+{
+	struct stat st;
+	int waited_ms = 0;
+	int sleep_ms = 20;
+	const int max_wait_ms = 60000;
+	struct pollfd pfd;
+
+	/*
+	 * POLLHUP is reported in revents regardless of whether it
+	 * appears in events, so we leave events==0; a hang-up on
+	 * pack-objects' stdout pipe means it has exited.  pack-objects
+	 * writes its emit files immediately after enumerating its
+	 * inputs and well before producing any output, so during this
+	 * wait there is nothing readable on the pipe to confuse us.
+	 *
+	 * We never waitpid() here: finish_pack_objects_cmd() reaps the
+	 * child later; reaping twice would be incorrect.
+	 */
+	pfd.fd = pack_objects_out_fd;
+	pfd.events = 0;
+
+	while (waited_ms < max_wait_ms) {
+		int ok_packs = (stat(packs_path, &st) == 0);
+		int ok_loose = (stat(loose_path, &st) == 0);
+		int ret;
+		if (ok_packs && ok_loose)
+			return 0;
+		pfd.revents = 0;
+		ret = poll(&pfd, 1, sleep_ms);
+		if (ret < 0 && errno != EINTR)
+			return error_errno(_("poll on pack-objects "
+					     "pipe failed"));
+		if (ret > 0 &&
+		    (pfd.revents & (POLLHUP | POLLERR | POLLNVAL)))
+			return error(_("pack-objects exited before "
+				       "emitting exclude files"));
+		waited_ms += sleep_ms;
+		if (sleep_ms < 200)
+			sleep_ms *= 2;
+	}
+	return error(_("timed out waiting for pack-objects to write "
+		       "exclude files"));
+}
+
+static int start_aggregate_sidecar(struct aggregate_sidecar *sc,
+				   int pack_objects_out_fd)
+{
+	int pp[2];
+	int flags;
+
+	if (wait_for_emit_files(sc->exclude_packs_path,
+				sc->exclude_loose_path,
+				pack_objects_out_fd))
+		return -1;
+
+	/*
+	 * Build the orphan-detection pipe: child inherits the read
+	 * end as --parent-pipe-fd; we keep the write end.  Mark our
+	 * end close-on-exec so the exec'd aggregator does not inherit
+	 * a second writer that would prevent it from seeing EOF when
+	 * we exit.
+	 */
+	if (pipe(pp))
+		return error_errno(_("could not create aggregate "
+				     "parent pipe"));
+	flags = fcntl(pp[1], F_GETFD);
+	if (flags >= 0)
+		fcntl(pp[1], F_SETFD, flags | FD_CLOEXEC);
+
+	strvec_pushl(&sc->cmd.args, "pack-aggregate", "--loop", NULL);
+	strvec_pushf(&sc->cmd.args, "--exclude-pack-file=%s",
+		     sc->exclude_packs_path);
+	strvec_pushf(&sc->cmd.args, "--exclude-loose-file=%s",
+		     sc->exclude_loose_path);
+	strvec_pushf(&sc->cmd.args, "--parent-pipe-fd=%d", pp[0]);
+	/*
+	 * Allow tests (which cannot sit through the default 60s
+	 * aggregator interval) to override --interval, --min-packs,
+	 * and --min-loose without us having to add separate
+	 * pass-through options.
+	 */
+	if (getenv("GIT_TEST_PACK_AGGREGATE_INTERVAL"))
+		strvec_pushf(&sc->cmd.args, "--interval=%s",
+			     getenv("GIT_TEST_PACK_AGGREGATE_INTERVAL"));
+	if (getenv("GIT_TEST_PACK_AGGREGATE_MIN_PACKS"))
+		strvec_pushf(&sc->cmd.args, "--min-packs=%s",
+			     getenv("GIT_TEST_PACK_AGGREGATE_MIN_PACKS"));
+	if (getenv("GIT_TEST_PACK_AGGREGATE_MIN_LOOSE"))
+		strvec_pushf(&sc->cmd.args, "--min-loose=%s",
+			     getenv("GIT_TEST_PACK_AGGREGATE_MIN_LOOSE"));
+	sc->cmd.git_cmd = 1;
+	if (start_command(&sc->cmd)) {
+		close(pp[0]);
+		close(pp[1]);
+		return error(_("could not start git pack-aggregate"));
+	}
+	/*
+	 * The aggregator now has its own copy of pp[0]; the write end
+	 * is what gives us orphan detection, and the parent's read end
+	 * is just a held-open fd.  Free it.
+	 */
+	close(pp[0]);
+	sc->parent_pipe_write_fd = pp[1];
+	sc->started = 1;
+	return 0;
+}
+
+static void stop_aggregate_sidecar(struct aggregate_sidecar *sc)
+{
+	/*
+	 * Close the parent pipe up front: if the aggregator is between
+	 * cycles it will wake from poll() and exit on its own, which
+	 * lets the SIGTERM/wait dance below complete quickly.
+	 */
+	if (sc->parent_pipe_write_fd >= 0) {
+		close(sc->parent_pipe_write_fd);
+		sc->parent_pipe_write_fd = -1;
+	}
+	if (sc->started) {
+		sc->started = 0;
+		if (sc->cmd.pid > 0) {
+			pid_t pid = sc->cmd.pid;
+			int waited_ms = 0;
+			int status;
+			pid_t r;
+
+			kill(pid, SIGTERM);
+			/*
+			 * Wait briefly for graceful exit before reaping;
+			 * pack-aggregate is expected to finish quite quickly,
+			 * so a few seconds should be plenty.
+			 */
+			while (waited_ms < 5000) {
+				r = waitpid(pid, &status, WNOHANG);
+				if (r == pid || (r < 0 && errno != EINTR))
+					break;
+				sleep_millisec(50);
+				waited_ms += 50;
+			}
+			if (r != pid) {
+				kill(pid, SIGKILL);
+				while (waitpid(pid, &status, 0) < 0 &&
+				       errno == EINTR)
+					; /* nothing */
+			}
+			/*
+			 * We never call finish_command() here, so the
+			 * normal cleanup-on-exit list still has us
+			 * registered; explicitly remove ourselves so
+			 * the cleanup handler does not try to reap us
+			 * again.
+			 */
+			sc->cmd.pid = -1;
+			child_process_clear(&sc->cmd);
+		}
+	}
+	if (sc->tmpdir) {
+		struct strbuf path = STRBUF_INIT;
+		strbuf_addstr(&path, sc->tmpdir);
+		remove_dir_recursively(&path, 0);
+		strbuf_release(&path);
+		FREE_AND_NULL(sc->tmpdir);
+	}
+	FREE_AND_NULL(sc->exclude_packs_path);
+	FREE_AND_NULL(sc->exclude_loose_path);
+
+	/*
+	 * Cleanup of the ".keep" markers we dropped on our own
+	 * outputs MUST happen after the sidecar has exited,
+	 * otherwise pack-aggregate could see a pack lose its marker
+	 * and aggregate it out from under us.
+	 */
+	remove_aggregate_keep_markers(sc);
+}
+
+/*
+ * Initialize the aggregator's tempdir and per-file paths.  This is
+ * called before pack-objects starts so the files' paths can be
+ * passed to it via --emit-input-{packs,loose}.  We also opportunistically
+ * sweep any stale ".keep" markers left behind by a previous repack
+ * that crashed; doing this once at init avoids repeated scans.
+ */
+static int init_aggregate_sidecar(struct repository *repo,
+				  struct aggregate_sidecar *sc)
+{
+	struct strbuf tmpl = STRBUF_INIT;
+	char *pdir;
+
+	pdir = mkpathdup("%s/pack", repo_get_object_directory(repo));
+	clean_stale_aggregate_keeps(pdir);
+	free(pdir);
+
+	strbuf_addf(&tmpl, "%s/pack-aggregate.XXXXXX",
+		    repo_get_object_directory(repo));
+	if (!git_mkdtemp(tmpl.buf)) {
+		error_errno(_("could not create pack-aggregate tempdir"));
+		strbuf_release(&tmpl);
+		return -1;
+	}
+	sc->tmpdir = strbuf_detach(&tmpl, NULL);
+	sc->exclude_packs_path = xstrfmt("%s/packs", sc->tmpdir);
+	sc->exclude_loose_path = xstrfmt("%s/loose", sc->tmpdir);
+	return 0;
+}
+
 int cmd_repack(int argc,
 	       const char **argv,
 	       const char *prefix,
 	       struct repository *repo)
 {
 	struct child_process cmd = CHILD_PROCESS_INIT;
+	struct aggregate_sidecar sidecar = {
+		.cmd = CHILD_PROCESS_INIT,
+		.installed_keeps = STRING_LIST_INIT_DUP,
+		.parent_pipe_write_fd = -1,
+	};
 	struct string_list_item *item;
 	struct string_list names = STRING_LIST_INIT_DUP;
 	struct existing_packs existing = EXISTING_PACKS_INIT;
@@ -232,6 +614,8 @@ int cmd_repack(int argc,
 			   N_("pack prefix to store a pack containing pruned objects")),
 		OPT_STRING(0, "filter-to", &filter_to, N_("dir"),
 			   N_("pack prefix to store a pack containing filtered out objects")),
+		OPT_BOOL(0, "aggregate", &aggregate_opt,
+			 N_("run a background pack-aggregate to roll up small packs and loose objects while this repack runs")),
 		OPT_END()
 	};
 
@@ -331,6 +715,23 @@ int cmd_repack(int argc,
 
 	show_progress = !po_args.quiet && isatty(2);
 
+	/*
+	 * If --aggregate is requested, set up a tempdir and tell the
+	 * main pack-objects to write its input pack/loose lists into
+	 * it.
+	 */
+	if (aggregate_opt > 0) {
+		if (init_aggregate_sidecar(repo, &sidecar)) {
+			/* fall through: error already reported */
+			aggregate_opt = 0;
+		} else {
+			strvec_pushf(&cmd.args, "--emit-input-packs=%s",
+				     sidecar.exclude_packs_path);
+			strvec_pushf(&cmd.args, "--emit-input-loose=%s",
+				     sidecar.exclude_loose_path);
+		}
+	}
+
 	strvec_push(&cmd.args, "--keep-true-parents");
 	for (i = 0; i < keep_pack_list.nr; i++)
 		strvec_pushf(&cmd.args, "--keep-pack=%s",
@@ -416,6 +817,37 @@ int cmd_repack(int argc,
 	if (ret)
 		goto cleanup;
 
+	/*
+	 * The main pack-objects is now running.  Once it has
+	 * emitted both exclude files (which it does immediately
+	 * after enumerating its inputs and well before it finishes
+	 * writing its output), we can safely launch the aggregator
+	 * to roll up anything else that lands in objects/ in the
+	 * meantime.
+	 *
+	 * Mark our ends of the pack-objects pipes close-on-exec
+	 * first: start_command() uses plain pipe() (not
+	 * pipe2(O_CLOEXEC)), so without this the aggregator would
+	 * inherit them and pack-objects would never see EOF on stdin
+	 * (which matters for --geometric where we feed it via
+	 * cmd.in).  Test for ">0" rather than ">=0": fd 0 is the
+	 * CHILD_PROCESS_INIT default for cmd.in in the non-geometric
+	 * (no_stdin) path, which is *not* a pipe we own.
+	 */
+	if (aggregate_opt > 0) {
+		if (cmd.in > 0) {
+			int flags = fcntl(cmd.in, F_GETFD);
+			if (flags >= 0)
+				fcntl(cmd.in, F_SETFD, flags | FD_CLOEXEC);
+		}
+		if (cmd.out > 0) {
+			int flags = fcntl(cmd.out, F_GETFD);
+			if (flags >= 0)
+				fcntl(cmd.out, F_SETFD, flags | FD_CLOEXEC);
+		}
+		start_aggregate_sidecar(&sidecar, cmd.out);
+	}
+
 	if (geometry.split_factor) {
 		FILE *in = xfdopen(cmd.in, "w");
 		/*
@@ -562,6 +994,9 @@ int cmd_repack(int argc,
 
 	string_list_sort(&names);
 
+	if (sidecar.started)
+		install_aggregate_keep_markers(&sidecar, packdir, &names);
+
 	odb_close(repo->objects);
 
 	/*
@@ -598,6 +1033,15 @@ int cmd_repack(int argc,
 			goto cleanup;
 	}
 
+	/*
+	 * Cruft has been written, all new packs are installed (and
+	 * ".keep"-marked), and the MIDX writer has read its explicit
+	 * include list; the remaining work is small and fast.  Stop
+	 * the pack-aggregate sidecar now, *before* odb_reprepare() or
+	 * any delete/prune step that might otherwise race it.
+	 */
+	stop_aggregate_sidecar(&sidecar);
+
 	odb_reprepare(repo->objects);
 
 	if (delete_redundant) {
@@ -633,6 +1077,7 @@ int cmd_repack(int argc,
 	}
 
 cleanup:
+	stop_aggregate_sidecar(&sidecar);
 	string_list_clear(&keep_pack_list, 0);
 	string_list_clear(&names, 1);
 	existing_packs_release(&existing);
diff --git a/t/t5336-pack-aggregate.sh b/t/t5336-pack-aggregate.sh
index ec4e2c8207668b..6c30d8498c1bb5 100755
--- a/t/t5336-pack-aggregate.sh
+++ b/t/t5336-pack-aggregate.sh
@@ -219,4 +219,215 @@ test_expect_success 'loose then pack aggregation in one cycle' '
 	)
 '
 
+
+# ---- repack integration ----
+
+test_expect_success 'repack without --aggregate does not spawn aggregator' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 3 >/dev/null &&
+		GIT_TRACE2_EVENT="$(pwd)/trace.txt" \
+			git repack -d --geometric=2 &&
+		! grep "\"pack-aggregate\"" trace.txt
+	)
+'
+
+test_expect_success 'repack --aggregate spawns and reaps pack-aggregate' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >/dev/null &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+		GIT_TRACE2_EVENT="$(pwd)/trace.txt" \
+			git repack -d --geometric=2 --aggregate &&
+		grep "\"pack-aggregate\"" trace.txt &&
+		# Tempdir should be cleaned up.
+		test -z "$(ls .git/objects | grep pack-aggregate)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'repack.aggregate config enables aggregator' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 3 >/dev/null &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+		GIT_TRACE2_EVENT="$(pwd)/trace.txt" \
+			git -c repack.aggregate=true \
+			repack -d --geometric=2 &&
+		grep "\"pack-aggregate\"" trace.txt
+	)
+'
+
+test_expect_success 'CLI --no-aggregate overrides repack.aggregate=true' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 3 >/dev/null &&
+		GIT_TRACE2_EVENT="$(pwd)/trace.txt" \
+			git -c repack.aggregate=true \
+			repack -d --geometric=2 --no-aggregate &&
+		! grep "\"pack-aggregate\"" trace.txt
+	)
+'
+
+# ---- sidecar lifecycle / .keep marker coverage ----
+
+test_expect_success PERL 'sidecar survives through write_midx_included_packs' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >/dev/null &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+		GIT_TRACE2_EVENT="$(pwd)/trace.txt" \
+			git repack -d --geometric=2 --aggregate \
+				--write-midx &&
+		# Each child subprocess writes its own trace2 "start"
+		# (with argv) and "exit" (with timestamp) events under
+		# its own session id.  Find the exit timestamp of the
+		# multi-pack-index child and the exit timestamp of the
+		# pack-aggregate child by joining via session id.
+		# We cannot rely on the parents '\''child_exit'\'' event
+		# for pack-aggregate because the sidecar teardown uses
+		# kill+waitpid directly rather than finish_command().
+		perl -ne '\''
+			my ($sid)  = /"sid":"([^"]+)"/ or next;
+			my ($time) = /"time":"([^"]+)"/;
+			if (/"event":"start"/) {
+				# Look only at the second argv element (the
+				# subcommand), not any longer argument that
+				# happens to contain "pack-aggregate" as a
+				# substring (e.g. paths under our tempdir).
+				my ($argv) = /"argv":\["[^"]*","([^"]+)"/;
+				if (defined($argv) && $argv eq "multi-pack-index") {
+					$kind{$sid} = "midx";
+				} elsif (defined($argv) && $argv eq "pack-aggregate") {
+					$kind{$sid} = "agg";
+				}
+			} elsif (/"event":"exit"/ && $kind{$sid}) {
+				$exit{$kind{$sid}} //= $time;
+			}
+			END {
+				die "missing midx exit\n" unless $exit{midx};
+				die "missing agg exit\n"  unless $exit{agg};
+				die "ordering wrong: agg=$exit{agg} midx=$exit{midx}\n"
+					unless $exit{agg} gt $exit{midx};
+			}
+		'\'' trace.txt
+	)
+'
+
+test_expect_success '--aggregate preserves pre-existing user .keep files' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >packs.txt &&
+		first=$(head -n 1 packs.txt) &&
+		# A user-created .keep with no marker content must
+		# survive a repack --aggregate untouched.
+		echo "I am a user keep file" \
+			>.git/objects/pack/${first}.keep &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+			git repack -d --geometric=2 --aggregate &&
+		test_path_is_file .git/objects/pack/${first}.keep &&
+		test_path_is_file .git/objects/pack/${first}.pack &&
+		# Content untouched.
+		echo "I am a user keep file" >expect &&
+		test_cmp expect .git/objects/pack/${first}.keep
+	)
+'
+
+test_expect_success '--aggregate cleans up its own .keep markers' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 5 >/dev/null &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+			git repack -d --geometric=2 --aggregate &&
+		# No marker .keep files should remain.  Any .keep that
+		# survives must NOT carry our marker prefix.
+		for f in .git/objects/pack/*.keep
+		do
+			test -e "$f" || continue
+			! grep -q "^git-repack-aggregate-temporary " "$f" \
+				|| return 1
+		done
+	)
+'
+
+test_expect_success 'startup cleans up stale .keep markers from dead pids' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 3 >packs.txt &&
+		# Spawn a short-lived subshell that writes its own pid
+		# to a file, then exits.  That pid is guaranteed dead
+		# by the time we read it.
+		sh -c "echo \$\$" >dead_pid.txt &&
+		dead_pid=$(cat dead_pid.txt) &&
+		test -n "$dead_pid" &&
+		first=$(head -n 1 packs.txt) &&
+		stale=.git/objects/pack/${first}.keep &&
+		printf "git-repack-aggregate-temporary pid=%d\n" \
+			"$dead_pid" >"$stale" &&
+		test_path_is_file "$stale" &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+			git repack -d --geometric=2 --aggregate &&
+		# The stale marker should have been cleaned at startup;
+		# even if its pack was preserved by geometric repack,
+		# the .keep should not still carry the dead-pid marker.
+		if test -e "$stale"
+		then
+			! grep -q "^git-repack-aggregate-temporary " \
+				"$stale"
+		fi
+	)
+'
+
+test_expect_success 'startup leaves live-pid .keep markers alone' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	# Use the test-runner shell pid, which is reliably alive
+	# for the duration of this test.  PID 1 (init) would also
+	# work since our code treats EPERM as "alive".
+	live_pid=$$ &&
+	(
+		cd work &&
+		build_n_packs 3 >packs.txt &&
+		first=$(head -n 1 packs.txt) &&
+		live=.git/objects/pack/${first}.keep &&
+		printf "git-repack-aggregate-temporary pid=%d\n" \
+			"$live_pid" >"$live" &&
+		test_path_is_file "$live" &&
+		GIT_TEST_PACK_AGGREGATE_INTERVAL=1 \
+		GIT_TEST_PACK_AGGREGATE_MIN_PACKS=10 \
+		GIT_TEST_PACK_AGGREGATE_MIN_LOOSE=10 \
+			git repack -d --geometric=2 --aggregate &&
+		test_path_is_file "$live" &&
+		grep -q "pid=${live_pid}" "$live"
+	)
+'
+
 test_done

From 24bdb43f5ba8d2a2f1950366b8016afe90cf7156 Mon Sep 17 00:00:00 2001
From: Elijah Newren <newren@gmail.com>
Date: Wed, 10 Jun 2026 22:07:29 -0700
Subject: [PATCH 7/7] repack: demote .baddeltas packs into geometric rollup

A pack-aggregate run rolls many small packs up into one aggregator
output and writes a sibling `.baddeltas` marker, since the new pack
reuses raw delta-chains from its inputs without any cross-input delta
search.  That marker tells future `pack-objects` runs over the pack to
treat its existing deltas as stale and recompute new ones.

The aggregator deliberately does not install a `.keep` marker on its
output: we want the next opportunity to re-delta its contents to roll up
the pack like any other.  But a `git repack --geometric=N` pass walks
the packs sorted ascending by object count and only rolls up packs below
the geometric split; anything already at the heavy end of the
progression sits above the split and is kept as-is.  Aggregated packs
could potentially be large enough to land there, which may leave a
`.baddeltas` pack above the split for many subsequent geometric passes
resulting in the pack not getting repacked and keeping its stale deltas.

Teach `pack_geometry_split()` to do a post-pass demotion of any
`.baddeltas` packs from the kept region into the rollup region.  The
demotion preserves the ascending sort order of the kept region so that
`pack_geometry_preferred_pack()` continues to return the largest local
kept pack.  Demotion is unconditional: a `.baddeltas` marker is an
explicit "these deltas need redoing" tag from a previous repack step,
and the next geometric pass is the cheapest place to honor it.

`.keep`-marked packs are still excluded from the rollup by the existing
`pack_kept_objects` / `remove_redundant_packs` paths, so a user who
really wants to pin a `.baddeltas` pack in place has that escape hatch.

Add two tests to t5336: one that confirms a `.baddeltas` pack above the
natural split is rolled up and its marker disappears from the resulting
pack, and a control test that confirms a non-`.baddeltas` pack above the
split is still preserved.

Assisted-by: Claude Opus 4.7
Signed-off-by: Elijah Newren <newren@gmail.com>
---
 repack-geometry.c         | 53 +++++++++++++++++++++++++++
 t/t5336-pack-aggregate.sh | 77 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 129 insertions(+), 1 deletion(-)

diff --git a/repack-geometry.c b/repack-geometry.c
index 2064683dcfe1e1..83479b15141495 100644
--- a/repack-geometry.c
+++ b/repack-geometry.c
@@ -187,6 +187,58 @@ static uint32_t compute_pack_geometry_split(struct packed_git **pack, size_t pac
 	return split;
 }
 
+/*
+ * Move any packs marked with a `.baddeltas` sidecar from the kept
+ * region of `pack[]` into the rollup region.  A `.baddeltas` marker
+ * declares that the pack's existing deltas are stale (e.g. because
+ * the pack was assembled by `git pack-aggregate`, which concatenates
+ * input packs without performing a fresh delta search).  We do not
+ * want such packs to sit on the geometric ladder indefinitely:
+ * rolling them up forces the next `pack-objects` invocation to
+ * recompute deltas across their objects, while leaving any
+ * `.keep`-protected pack alone (those are filtered out by
+ * `pack_geometry_init()`).
+ *
+ * Demotion preserves the ascending sort order of the kept region so
+ * that `pack_geometry_preferred_pack()` continues to return the
+ * largest local kept pack.
+ */
+static void demote_bad_delta_packs(struct pack_geometry *geometry)
+{
+	struct packed_git **demoted, **retained;
+	uint32_t d_nr = 0, r_nr = 0, kept_nr;
+
+	if (geometry->split == geometry->pack_nr)
+		return;
+
+	kept_nr = geometry->pack_nr - geometry->split;
+	for (uint32_t k = geometry->split; k < geometry->pack_nr; k++) {
+		if (geometry->pack[k]->has_bad_deltas)
+			d_nr++;
+	}
+	if (!d_nr)
+		return;
+
+	ALLOC_ARRAY(demoted, d_nr);
+	ALLOC_ARRAY(retained, kept_nr - d_nr);
+	d_nr = 0;
+	for (uint32_t k = geometry->split; k < geometry->pack_nr; k++) {
+		if (geometry->pack[k]->has_bad_deltas)
+			demoted[d_nr++] = geometry->pack[k];
+		else
+			retained[r_nr++] = geometry->pack[k];
+	}
+
+	memcpy(&geometry->pack[geometry->split], demoted,
+	       d_nr * sizeof(*geometry->pack));
+	memcpy(&geometry->pack[geometry->split + d_nr], retained,
+	       r_nr * sizeof(*geometry->pack));
+	geometry->split += d_nr;
+
+	free(demoted);
+	free(retained);
+}
+
 void pack_geometry_split(struct pack_geometry *geometry)
 {
 	geometry->split = compute_pack_geometry_split(geometry->pack, geometry->pack_nr,
@@ -194,6 +246,7 @@ void pack_geometry_split(struct pack_geometry *geometry)
 	geometry->promisor_split = compute_pack_geometry_split(geometry->promisor_pack,
 							       geometry->promisor_pack_nr,
 							       geometry->split_factor);
+	demote_bad_delta_packs(geometry);
 	for (uint32_t i = 0; i < geometry->split; i++) {
 		struct packed_git *p = geometry->pack[i];
 		/*
diff --git a/t/t5336-pack-aggregate.sh b/t/t5336-pack-aggregate.sh
index 6c30d8498c1bb5..466847f187f332 100755
--- a/t/t5336-pack-aggregate.sh
+++ b/t/t5336-pack-aggregate.sh
@@ -406,12 +406,17 @@ test_expect_success 'startup cleans up stale .keep markers from dead pids' '
 	)
 '
 
-test_expect_success 'startup leaves live-pid .keep markers alone' '
+test_expect_success !MINGW 'startup leaves live-pid .keep markers alone' '
 	test_when_finished "rm -fr work" &&
 	cp -R repo work &&
 	# Use the test-runner shell pid, which is reliably alive
 	# for the duration of this test.  PID 1 (init) would also
 	# work since our code treats EPERM as "alive".
+	#
+	# !MINGW: on Windows, bash $$ is a virtualized MSYS pid that
+	# does not correspond to a process kill(pid, 0) can see, so
+	# our liveness check would treat it as dead and the marker
+	# would be removed.  Skip this test there.
 	live_pid=$$ &&
 	(
 		cd work &&
@@ -430,4 +435,74 @@ test_expect_success 'startup leaves live-pid .keep markers alone' '
 	)
 '
 
+# ---- geometric .baddeltas demotion ----
+
+# Helper for the geometric tests: pack a single unique blob into its
+# own packfile.  The `tag` parameter must differ between callers so
+# that the blob contents do not collide with one another (otherwise
+# `git pack-objects --stdin-packs` would see the "rollup" objects
+# already present in the kept pack and emit nothing).
+make_unique_pack () {
+	tag=$1 &&
+	blob=$(echo "unique-${tag}-$$" | git hash-object -w --stdin) &&
+	echo "$blob" |
+	git pack-objects --window=0 .git/objects/pack/pack >/dev/null &&
+	git prune-packed
+}
+
+test_expect_success 'geometric repack demotes .baddeltas packs into rollup' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		# Build several small packs and consolidate them into
+		# one larger pack that would normally sit above the
+		# geometric split.
+		build_n_packs 8 >/dev/null &&
+		git repack -d --geometric=2 &&
+		test 1 -eq "$(count_packs)" &&
+		big=$(ls .git/objects/pack/pack-*.pack) &&
+		# Drop a .baddeltas marker on it (simulating an
+		# aggregator output).
+		>"${big%.pack}.baddeltas" &&
+		test 1 -eq "$(count_baddeltas)" &&
+		# Add small packs that are individually far smaller
+		# than the big one; ordinarily the big pack would be
+		# kept above the geometric split.
+		make_unique_pack a &&
+		make_unique_pack b &&
+		make_unique_pack c &&
+		test 4 -eq "$(count_packs)" &&
+		# With the .baddeltas demotion, the big pack is rolled
+		# up despite being above the natural split, and the
+		# resulting pack carries no .baddeltas marker.
+		git repack -d --geometric=2 &&
+		test 1 -eq "$(count_packs)" &&
+		test 0 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
+test_expect_success 'geometric repack leaves non-baddeltas packs above the split alone' '
+	test_when_finished "rm -fr work" &&
+	cp -R repo work &&
+	(
+		cd work &&
+		build_n_packs 8 >/dev/null &&
+		git repack -d --geometric=2 &&
+		test 1 -eq "$(count_packs)" &&
+		# Add small packs; without any .baddeltas marker the
+		# big pack should be preserved above the split.
+		make_unique_pack a &&
+		make_unique_pack b &&
+		make_unique_pack c &&
+		test 4 -eq "$(count_packs)" &&
+		git repack -d --geometric=2 &&
+		# 1 kept big pack + 1 newly-aggregated rollup = 2.
+		test 2 -eq "$(count_packs)" &&
+		test 0 -eq "$(count_baddeltas)" &&
+		git fsck
+	)
+'
+
 test_done