[shreyas-blacksmith]

Summary

After a restart the boot scan only has file timestamps, and on our noatime mounts those cannot tell a blob read a minute ago from one nobody ever asked for, so every pre-existing entry re-entered the index as itemStateBootScanned and the tenant census reported its bytes as unknown (36 h after the last roll, 93% of prod resident bytes were still unknown). This PR carries the in-memory read history over the restart.

Stacked on #71 (same access-state semantics); base switches to patchset when that merges.

Shutdown — main.go calls the new disk.Cache.SaveAccessState() right after servers.Wait() (gRPC/HTTP stopped, index final). It walks the LRU once under c.mu and writes <dir>/access-state.v1:

"BRAS\x01" | u32 writtenAt | u64 count | count × (fnv128a(lookupKey) | u32 lastAccess | u8 accessState)

Only itemStateNew/itemStateTouched entries are written (an untouched boot-scanned entry would come back boot-scanned anyway); 21 B/entry. Key hashing dominates, so the walk feeds batches to one encoder per CPU and a single writer; temp file + fsync + rename. Measured 0.31 s / 40 MB for 2M entries on 8 cores → ~5 s / 670 MB for the 31.7M-entry us-west members, inside the unit's TimeoutStopSec=30.

Boot — loadExistingFiles → consumeAccessState(dir) reads the file into a map[[16]byte]{lastAccess,state}, deletes it (consumed exactly once; a later crash cannot replay a stale copy), and scanDir applies it per file:

if rec, ok := bootAccess.lookup(lookupKey, addedAt /* = mtime */); ok {
    item.lastAccess, item.accessState = rec.lastAccess, rec.state
    metadata.ts = rec.lastAccess   // LRU sort order now follows real recency, not frozen atime
}

lookup refuses records for blobs whose mtime is after writtenAt (created after the file; not about this blob) and clamps lastAccess >= addedAt. Missing/garbage/truncated file → logged, removed, scan proceeds on timestamps as today. The scan's "unexpected file in cache root" check skips the two file names.

Steady state is untouched: no per-request work, no new goroutine, no new config. The new code runs only at the two ends of the process.

Tests: real diskCache restart (read blob → touched with its last read, unread → new, blob written after the save → boot-scanned; census unknown/never-read match; LRU front is the read blob), corrupt file + leftover temp file ignored and removed, lookup guards.

Link to Devin session: https://app.devin.ai/sessions/df6c6655558146b9bafe936b062e49e7
Open in Devin Desktop: https://app.devin.ai/desktop/session/df6c6655558146b9bafe936b062e49e7?variant=devin
Requested by: @shreyas-blacksmith

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[blacksmith-staging]

Restart keeps read history in census

Before, a restart turned both blobs into unknown bytes. After, the unread blob stays never-read, the read one counts as touched, and nothing is unknown.

_Merge-base

_{This PR d73ddde4}

Also checked · 4 match

Blob newer than the save stays unknown
Corrupt state file ignored and removed
LRU order follows restored recency
Save is fast enough for shutdown

_{Proof on d73ddde4 (from 8ed21f27) · Did Proof get it right? Yes · No}

View full Proof report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8ed21f2. Configure here.}