Fix a cache leak, a coarse watcher, and two claims that were not true

support/cache.rs never added a key to its LRU order — `touch` only moved
keys it already had — so MAX_PER_PROVIDER evicted nothing and the map grew
one entry per distinct query per provider for the life of the daemon. Five
tests pin the bound now, and the leak is proven: without the fix the new
bound test holds 48 entries where it should hold 16.

oxyd/watch.rs compared mtimes in whole seconds, so a same-length edit saved
twice inside one second looked like no change at all — a settings save that
silently does nothing. Milliseconds now, in both signatures.

provider/process.rs's `run_sync` and its `shell_command_sync` helper were
dead (every probe goes through the async `check`), and `run_sync` would
have deadlocked on a child writing more than a pipe buffer, since nothing
drained stdout until the child had exited. Removed.

Two comments claimed more than the code does: frecency's boost is added to
the finished score, after the tier clamp, so a row within 9000 of its
ceiling can cross into the next tier — reachable (a substring row at the
top fuzzy band outranks a prefix row at local 0) and the script adds it the
same way, so it is parity, not a port bug. Pins really are clamped, by
contrast. Comments and the porting doc now say exactly that.

Also: availability's recheck subtracted two wall-clock readings without
saturating (a backwards clock jump panics a debug build), and logfile's
rotation gained three tests — including the second rotation, which has to
replace .old rather than fail.

Author: Anonymous

core/crates/oxy-core/src/provider/process.rs

@@ -82,17 +82,6 @@ fn shell_command(body: &str) -> Command {
     cmd
 }
 
-/// The same environment for the blocking `std::process::Command` callers.
-fn shell_command_sync(body: &str) -> std::process::Command {
-    let mut cmd = std::process::Command::new("bash");
-    cmd.arg("-c").arg(body);
-    if let Some(env) = &*LOGIN_ENV.read().unwrap() {
-        cmd.envs(env.iter().map(|(k, v)| (k.as_str(), v.as_str())));
-    }
-    cmd.env("OXY_PLUGIN_ID", &*PLUGIN_ID);
-    cmd
-}
-
 /// What a run left behind: stdout, the exit code when the wait returned one,
 /// and whether the deadline killed it — the `code`/`timeout` fields the
 /// event log reports, which `Option<String>` could not carry.
@@ -183,35 +172,6 @@ pub async fn check(body: &str) -> bool {
     }
 }
 
-/// Command for the availability probe at load and for `oxy test` preflight.
-pub fn run_sync(body: &str, timeout: Duration) -> Option<String> {
-    let child = shell_command_sync(body)
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::null())
-        .spawn()
-        .ok()?;
-    let start = std::time::Instant::now();
-    let mut out = child;
-    loop {
-        match out.try_wait() {
-            Ok(Some(_)) => {
-                let mut buf = Vec::new();
-                use std::io::Read;
-                out.stdout.take()?.read_to_end(&mut buf).ok()?;
-                return Some(String::from_utf8_lossy(&buf).into_owned());
-            }
-            Ok(None) if start.elapsed() < timeout => {
-                std::thread::sleep(Duration::from_millis(5));
-            }
-            _ => {
-                let _ = out.kill();
-                return None;
-            }
-        }
-    }
-}
-
 /// Parse a script's stdout into rows: a JSON array, or one object per line.
 pub fn parse(text: &str) -> Vec<Value> {
     crate::model::row::parse_rows(text)

core/crates/oxy-core/src/state/frecency.rs

@@ -12,7 +12,14 @@ use crate::model::row::Row;
 /// Half-life in days: a launch is worth half as much a week after you made it.
 const HALF_LIFE_DAYS: f64 = 7.0;
 const DAY_MS: f64 = 86_400_000.0;
-/// The most a boost can move a row inside its tier. It never crosses one.
+/// The most a boost adds. Unlike a pin — which is clamped to the row's own
+/// tier in `pins_apply` — this is added to the *finished* score, after the
+/// tier clamp in `rank::score`. So a row already within 9000 of its tier's
+/// ceiling can edge past the next tier's floor: a substring row at the top
+/// fuzzy band (local 91 646) plus a full boost outranks a prefix row at
+/// local 0, and a used prefix row can outrank a `forced` one. The script's
+/// `Frecency.js` adds it exactly the same way, so this is parity — changing
+/// it means changing both builds, not fixing a port.
 const MAX_BOOST: i64 = 9000;
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]

core/crates/oxy-core/src/support/availability.rs

@@ -39,7 +39,7 @@ impl Availability {
         match self.store.get(check) {
             None => None,
             Some(e) if e.ok => Some(true),
-            Some(e) if now_ms() - e.at < RECHECK_MS => Some(false),
+            Some(e) if now_ms().saturating_sub(e.at) < RECHECK_MS => Some(false),
             Some(_) => None,
         }
     }

core/crates/oxy-core/src/support/cache.rs

@@ -52,12 +52,18 @@ struct Bucket {
 }
 
 impl Bucket {
+    /// Move a key to the front of the LRU order, adding it if it is new. A
+    /// key reaches `entries` only through `put`, so the first touch of a key
+    /// is what puts it in the order — without that, eviction never sees it
+    /// and the map grows past `MAX_PER_PROVIDER` for the life of the daemon.
     fn touch(&mut self, key: &str) {
-        if let Some(at) = self.keys.iter().position(|k| k == key)
-            && at > 0
-        {
-            let key = self.keys.remove(at).unwrap();
-            self.keys.push_front(key);
+        match self.keys.iter().position(|k| k == key) {
+            Some(0) => {}
+            Some(at) => {
+                let key = self.keys.remove(at).unwrap();
+                self.keys.push_front(key);
+            }
+            None => self.keys.push_front(key.to_string()),
         }
     }
 }
@@ -148,3 +154,73 @@ impl Cache {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Arc;
+
+    fn rows(n: usize) -> SharedRows {
+        Arc::new(
+            (0..n)
+                .map(|i| Arc::new(crate::model::row::Row::new(format!("k{i}"), "t")))
+                .collect(),
+        )
+    }
+
+    /// The bound the module promises: a daemon up for days must not hold one
+    /// entry per query it has ever seen.
+    #[test]
+    fn a_provider_holds_at_most_max_per_provider_answers() {
+        let mut cache = Cache::default();
+        for i in 0..(MAX_PER_PROVIDER * 3) {
+            cache.put("gh", &format!("q{i}"), rows(1), 60_000, 7);
+        }
+        assert_eq!(cache.entries(), MAX_PER_PROVIDER);
+        // The most recent ones are the ones kept: the oldest was evicted.
+        assert!(cache.get("gh", "q0", 7).is_none());
+        let newest = format!("q{}", MAX_PER_PROVIDER * 3 - 1);
+        assert!(cache.get("gh", &newest, 7).is_some());
+    }
+
+    #[test]
+    fn a_hit_refreshes_the_lru_order() {
+        let mut cache = Cache::default();
+        for i in 0..MAX_PER_PROVIDER {
+            cache.put("gh", &format!("q{i}"), rows(1), 60_000, 7);
+        }
+        // Touch the oldest, then add one: the touched key survives, the
+        // second-oldest is the one evicted.
+        assert!(cache.get("gh", "q0", 7).is_some());
+        cache.put("gh", "fresh", rows(1), 60_000, 7);
+        assert!(cache.get("gh", "q0", 7).is_some(), "q0 was refreshed");
+        assert!(cache.get("gh", "q1", 7).is_none(), "q1 was the coldest");
+    }
+
+    #[test]
+    fn ttl_zero_stores_nothing() {
+        let mut cache = Cache::default();
+        cache.put("vol", "q", rows(2), 0, 7);
+        assert_eq!(cache.entries(), 0);
+    }
+
+    #[test]
+    fn a_stamp_mismatch_is_a_miss() {
+        let mut cache = Cache::default();
+        cache.put("gh", "q", rows(1), 60_000, 7);
+        assert!(cache.get("gh", "q", 7).is_some());
+        assert!(cache.get("gh", "q", 8).is_none());
+        // The stale read still serves it, which is what keeps a reload from
+        // blanking the card while the new definition answers.
+        assert!(cache.get_stale("gh", "q", 7).is_some());
+    }
+
+    #[test]
+    fn providers_do_not_share_keys() {
+        let mut cache = Cache::default();
+        cache.put("gh", "same", rows(3), 60_000, 7);
+        cache.put("pr", "same", rows(1), 60_000, 7);
+        assert_eq!(cache.get("gh", "same", 7).unwrap().len(), 3);
+        assert_eq!(cache.get("pr", "same", 7).unwrap().len(), 1);
+    }
+}

core/crates/oxy-core/src/support/rank.rs

@@ -4,6 +4,12 @@
 //! The tier is the kind of match, and it always wins. `local` breaks ties
 //! inside a tier and is where a provider's own bias lives, so a bias can
 //! reorder equals but can never lift a weak match above a strong one.
+//!
+//! Two things add to the score after that clamp, and only one of them keeps
+//! the rule: a pin is clamped to the row's own tier (`pins_apply`), while
+//! frecency is added to the finished number (`frecency_apply`) and can carry
+//! a row within 9000 of its ceiling past the next tier's floor. The script
+//! does both the same way, so the difference is parity, not a port bug.
 
 use std::sync::Arc;
 

core/crates/oxyd/src/logfile.rs

@@ -60,3 +60,55 @@ pub(crate) fn append_log(path: &Path, line: &str) {
         let _ = f.write_all(line.as_bytes());
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Two generations, and the second rotation has to *replace* `.old`
+    /// rather than fail: on Windows a rename onto an existing file is the
+    /// case worth checking, and this runs on both platforms.
+    #[test]
+    fn rotation_keeps_two_generations() {
+        let dir = std::env::temp_dir().join(format!("oxyd-log-test-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("oxy.log");
+        let old = dir.join("oxy.log.old");
+
+        std::fs::write(&path, vec![b'x'; 1_048_577]).unwrap();
+        append_log(&path, "one\n");
+        assert!(old.exists(), "the first rotation writes .old");
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "one\n");
+
+        std::fs::write(&path, vec![b'y'; 1_048_577]).unwrap();
+        append_log(&path, "two\n");
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "two\n");
+        let kept = std::fs::read_to_string(&old).unwrap();
+        assert!(kept.starts_with('y'), "the second rotation replaced .old");
+
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_small_file_is_never_rotated() {
+        let dir = std::env::temp_dir().join(format!("oxyd-log-small-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("oxy.log");
+        append_log(&path, "first\n");
+        append_log(&path, "second\n");
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "first\nsecond\n");
+        assert!(!dir.join("oxy.log.old").exists());
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_line_carries_ts_sid_and_ev() {
+        let line = log_line("abc", "prov.done", &json!({"ms": 12}));
+        assert!(line.ends_with('\n'));
+        let v: Value = serde_json::from_str(line.trim()).unwrap();
+        assert_eq!(v["sid"], "abc");
+        assert_eq!(v["ev"], "prov.done");
+        assert_eq!(v["ms"], 12);
+        assert!(v["ts"].as_u64().unwrap() > 0);
+    }
+}

core/crates/oxyd/src/watch.rs

@@ -34,6 +34,9 @@ pub(crate) fn spawn(
 
 /// A single file's change signature — len + mtime, so an edit or a delete
 /// (None metadata → 0) both register. Same fixed-key hasher as `signature`.
+/// The mtime is in **milliseconds**: seconds would miss a same-length edit
+/// saved twice inside one second, which is a save that changes a setting
+/// and looks like nothing happened.
 fn file_signature(path: &Path) -> u64 {
     use std::hash::Hasher;
     let mut h = std::collections::hash_map::DefaultHasher::new();
@@ -44,7 +47,7 @@ fn file_signature(path: &Path) -> u64 {
                 meta.modified()
                     .ok()
                     .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
-                    .map(|d| d.as_secs())
+                    .map(|d| d.as_millis() as u64)
                     .unwrap_or(0),
             );
         }
@@ -78,7 +81,7 @@ fn signature(dir: &Path) -> u64 {
                 meta.modified()
                     .ok()
                     .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
-                    .map(|d| d.as_secs())
+                    .map(|d| d.as_millis() as u64)
                     .unwrap_or(0),
             );
             acc ^= h.finish();

docs/PORTING-BACKLOG.md

@@ -43,9 +43,9 @@ starts from a measured state:
 | fact | value |
 |---|---|
 | Rust files | 100 (37 before the restructure; +3 for `provider/llm/`, +8 for the batch A scaffold) |
-| total lines | 16 562 |
+| total lines | 16 666 |
 | largest file | 600 lines (`provider/worker/state.rs`); nothing above the 800 target |
-| tests | 62 passing (`cargo test --workspace`): 47 engine, 13 LLM, 2 for `util::on_path` |
+| tests | 70 passing (`cargo test --workspace`): 47 engine, 13 LLM, 2 `util::on_path`, 5 cache, 3 logfile |
 | lints | `cargo clippy --workspace --all-targets -- -D warnings` clean; `cargo fmt --check` clean |
 | guards | the file budget and the `model/` layering check in `tests/run.sh`; clippy in CI; `core/.loc-allow` names the three exempt data tables; `core/README.md` is the crate map |
 | extensions | 40 (15 native, 30 script-backed, 27 scripts) — the marketplace was removed |
@@ -1003,7 +1003,7 @@ header, and is the kind of thing a clean rewrite quietly loses.
 
 | rule | where it comes from | what breaks if a port ignores it |
 |---|---|---|
-| A tier is never crossed: pins and frecency reorder *within* a tier only | `support/rank.rs` | a pinned substring outranks a name that starts with what you typed |
+| A **pin** is clamped to its own tier; **frecency** is added to the finished score and is *not* — a heavily-used row near its tier's ceiling can cross into the next band (the script adds it the same way, so this is parity, not a port bug) | `state/pins.rs`, `state/frecency.rs`, `support/rank.rs` | a pinned substring never outranks a name that starts with what you typed; a frecency-boosted one can, in principle, outrank even a `forced` row |
 | The web row is dropped whenever anything real matched; a scoped `?` keeps it | `support/rank.rs` (`merge`) | the fallback row buries the answer, or disappears from `web:` |
 | An empty answer over rows already on screen keeps those rows | `worker/state.rs` (`keep_stale`) | a timeout blanks the card (looks like "no matches") |
 | A nonzero exit that printed rows is not a failure — only a bad exit with *no* rows is | `prov.fail` | a script that warns on stderr stops answering |