CAR export

com.atproto.sync.getRepo serves a repo as a CAR file — the backbone of backfill, migration, and verification. evidence here is from zds, a PDS implementation in zig, whose getRepo pass found the naive implementation (dump every block stored for the DID) wrong in two ways.

export by reachability

deleted and superseded records leave stale blocks in storage. a correct full export starts at the latest commit block and walks what's reachable (zat.mst.collectReachableBlocks(root.data_cid_raw, ..., include_records=true), store.zig:2761) — stale CIDs never enter the CAR. zds keeps a regression test for the update/delete-then-export case because the block-scan version passes every happy-path test and only leaks on repos with history.

measured on the reachability implementation: ~1.4ms / 16.8ms / 95.7ms for 100 / 1k / 5k-record repos (docs/getrepo-notes.md, 2026-06-29).

full and incremental exports have different roots

• full export: CAR root = the commit CID
• ?since=<rev>: CAR root = the data (MST root) CID, blocks filtered by repo_rev IS NULL OR repo_rev > ? (store.zig:2706,2744)

the incremental filter only works because blocks keep the rev of their first appearance (see repo-writes).

cap export concurrency away from user traffic

a relay backfilling thousands of repos will happily saturate a small PDS. zds caps concurrent full exports route-locally (ZDS_MAX_CONCURRENT_REPO_EXPORTS, default 4, matching tranquil) and returns RateLimitExceeded past the cap (sync.zig:213) — backfill pressure stays isolated from interactive requests.

serve the CAR raw

application/vnd.ipld.car, no application-layer gzip — the compression cost on the Node reference PDS is a known operator complaint, and CAR blocks are mostly high-entropy CBOR anyway (docs/getrepo-notes.md).

imports are exports in reverse, verified

importRepo runs the CAR through verifyCommitCar(..., expected_did, require_complete_repo=true) against the signing key from the resolved DID document — a partial or unsigned CAR is rejected at the door (repo.zig:409).

sources

• zds — src/atproto/store.zig, src/http/sync.zig, docs/getrepo-notes.md
• sync spec