Function serve_with_selection 

pub fn serve_with_selection<R: Repository + ?Sized>(
    repository: &ValidatedRepository<'_, '_, R>,
    request: Request<'_>,
    storage: &mut SelectionStorage<'_>,
    output: &mut impl Write,
) -> Result<Response>

Serve independent refs, tags and multiple wanted IDs with caller-owned selection storage. Accept only advertised ref/peeled/HEAD IDs, rejecting arbitrary or merely reachable wants. Select the exact union before writing ACKs or pack. Present commit haves exclude their complete reachable history; unknown and non-commit haves are ignored. Requests are stateless: clients replay wants and acknowledged haves each round. No-done rounds only negotiate. Absolute/relative-depth shallow requests and blob filters use the same graph budget. Shallow haves never imply complete history. Errors invalidate all output; selection failures produce no output at all.

Requests must contain a complete, bounded body and the upload-pack media type. Absolute deepen requests may have an initial v0 shallow-list probe without done; that probe consumes the same graph budget as the eventual pack. Relative probes from full clients only flush an empty boundary list and need no graph work slots, read/parse scratch or structural-read budget. A client must replay its shallow IDs and negotiation state on each request. ACK-only rounds validate client boundaries through the repository index and need no graph work slots, read/parse scratch or structural-read budget. Boundary output must fit the host’s response/control budget. The streaming encoder prepares these packets before exposing HTTP success metadata.

Blob filters preserve explicitly wanted blobs but do not grant permission to request unadvertised promised objects. Partial clones currently need --no-checkout. Time/exclusion deepening and other filter families return Unsupported; malformed options and invalid shallow IDs return InvalidRequest. Scratch/slot exhaustion returns BufferTooSmall, and graph read exhaustion returns LimitExceeded. A buffered host can replace a failed response with write_upload_error; a failed stream must be cancelled/closed.