perf: round 13 — grouped-view virtualization, notification/login query narrowing, HTTP dedup, locale precompute

Benchmark-gated (BEFORE/AFTER + equivalence/safety gate per change), same
discipline as rounds 2-12. Full write-up in benches/ROUND13.md.

Shipped:
- V1 Grouped views windowed (files route + ResourceList). The grid arm was
  the last unwindowed path (trash is grouped-by-default in grid): each
  swimlane now feeds its own VirtualList, outer container a flex stack.
  vitest gate: 800-item grouped grid mounts <120 .file-item (was 800).
- Q1 get_users_by_ids drops the <=512 KiB avatar image + ui_preferences
  JSONB (notification path never reads them). 30-member fan-out 8.60 ->
  0.25 ms (34.3x), ~7.7 MB off the wire.
- Q2 Login provisioning is_empty() -> SELECT EXISTS for calendar + address
  book (every login). 0.193 -> 0.170 ms, widens with owned-row count.
- Q3 Recent-access prunes only when the upsert inserted (RETURNING xmax=0)
  — a re-access can't grow the set. 0.567 -> 0.324 ms (1.75x).
- L1 Locale supported-codes precomputed once vs rebuilt per anonymous
  request. 616 -> 17.3 ns (35.7x), 18 -> 1 allocs.
- H1 Duplicate /api TraceLayer removed (global stack already wraps it).
  1.86 -> 1.42 us/request, -6 allocs.
- H2 client_ip span field: borrow-only ClientIpDisplay vs owned String.
  187 -> 173 ns, -1 alloc.

Not shipped (discipline): the "media hooks read the blob 3x" lead was a
correctness bug, not a perf dup — the raw-path metadata/faces readers
resolve only for local+unencrypted+single-chunk blobs and silently produce
nothing otherwise. Flagged for maintainers; routing through read_blob_bytes
is a correctness fix (perf-neutral-to-negative), not a benchmark-gated
perf change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfidAJD5AHw23jtvBUNamB

src/interfaces/middleware/locale.rs

@@ -64,9 +64,15 @@ impl FromRequestParts<Arc<AppState>> for RequestLocale {
             .get(axum::http::header::ACCEPT_LANGUAGE)
             .and_then(|v| v.to_str().ok())
         {
-            let supported_owned: Vec<String> =
-                registry.iter().map(|l| l.as_str().to_string()).collect();
-            let supported: Vec<&str> = supported_owned.iter().map(String::as_str).collect();
+            // Borrow the precomputed supported-codes list (materialized
+            // once at registry build) instead of rebuilding N heap Strings
+            // per anonymous request (benches/ROUND13.md §L1). Only the
+            // `&[&str]` view the crate needs is built here.
+            let supported: Vec<&str> = registry
+                .supported_codes()
+                .iter()
+                .map(String::as_str)
+                .collect();
             if let Some(matched) = accept_language::intersection(header_value, &supported).first()
                 && let Some(locale) = registry.parse(matched)
             {

src/interfaces/middleware/trace_span.rs

@@ -92,7 +92,11 @@ pub struct ClientIpMakeSpan;
 
 impl<B> MakeSpan<B> for ClientIpMakeSpan {
     fn make_span(&mut self, request: &axum::http::Request<B>) -> Span {
-        let ip = super::trusted_proxy::client_ip(request, true);
+        // Borrow-only IP resolution: the span records `client_ip` via `%ip`
+        // (Display), so a `ClientIpDisplay` that renders straight into the
+        // span's field storage avoids the per-request `String` the owned
+        // `client_ip()` allocated (benches/ROUND13.md §H2).
+        let ip = super::trusted_proxy::client_ip_display(request, true);
         let request_id = request
             .headers()
             .get("x-request-id")

src/interfaces/middleware/trusted_proxy.rs

@@ -146,6 +146,82 @@ pub fn client_ip<B>(req: &Request<B>, include_port: bool) -> String {
     client_ip_from_parts(req.headers(), peer, include_port)
 }
 
+/// A resolved client-IP source that borrows from the request instead of
+/// allocating a `String`. [`std::fmt::Display`] renders it directly into the
+/// caller's buffer (the tracing span's field storage), so the per-request
+/// span factory no longer materializes an intermediate `String` on every
+/// request (benches/ROUND13.md §H2). Bytes rendered are identical to
+/// [`client_ip`]/[`client_ip_from_parts`] for all four cases.
+pub enum ClientIpDisplay<'a> {
+    /// Proxy-forwarded client address (borrowed from `X-Forwarded-For` /
+    /// `X-Real-Ip`), already trimmed.
+    Forwarded(&'a str),
+    /// Direct TCP peer, rendered with the port.
+    PeerWithPort(SocketAddr),
+    /// Direct TCP peer, rendered as the bare IP.
+    PeerIp(IpAddr),
+    /// No connection info available.
+    Unknown,
+}
+
+impl std::fmt::Display for ClientIpDisplay<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ClientIpDisplay::Forwarded(s) => f.write_str(s),
+            ClientIpDisplay::PeerWithPort(addr) => write!(f, "{addr}"),
+            ClientIpDisplay::PeerIp(ip) => write!(f, "{ip}"),
+            ClientIpDisplay::Unknown => f.write_str("unknown"),
+        }
+    }
+}
+
+/// Zero-allocation twin of [`client_ip_from_parts`]: resolves the client-IP
+/// source without producing an owned `String`. The returned value borrows
+/// `headers`, so it must be `Display`-rendered before `headers` is dropped
+/// (the span factory does this synchronously).
+pub fn client_ip_display_from_parts<'a>(
+    headers: &'a axum::http::HeaderMap,
+    peer: Option<SocketAddr>,
+    include_port: bool,
+) -> ClientIpDisplay<'a> {
+    if let Some(peer_addr) = peer {
+        if is_trusted_proxy(peer_addr.ip()) {
+            if let Some(xff) = headers.get("x-forwarded-for").and_then(|v| v.to_str().ok())
+                && let Some(ip) = xff
+                    .split(',')
+                    .next()
+                    .map(str::trim)
+                    .filter(|s| !s.is_empty())
+            {
+                return ClientIpDisplay::Forwarded(ip);
+            }
+            if let Some(xri) = headers
+                .get("x-real-ip")
+                .and_then(|v| v.to_str().ok())
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+            {
+                return ClientIpDisplay::Forwarded(xri);
+            }
+        }
+        return if include_port {
+            ClientIpDisplay::PeerWithPort(peer_addr)
+        } else {
+            ClientIpDisplay::PeerIp(peer_addr.ip())
+        };
+    }
+    ClientIpDisplay::Unknown
+}
+
+/// Zero-allocation twin of [`client_ip`] for the request-span factory.
+pub fn client_ip_display<B>(req: &Request<B>, include_port: bool) -> ClientIpDisplay<'_> {
+    let peer: Option<SocketAddr> = req
+        .extensions()
+        .get::<ConnectInfo<SocketAddr>>()
+        .map(|ci| ci.0);
+    client_ip_display_from_parts(req.headers(), peer, include_port)
+}
+
 /// Same as [`client_ip`], but operates on already-extracted parts (headers
 /// plus an optional TCP peer).  Handlers that don't take a full `Request<B>`,
 /// e.g. those that consume the body via `Json<…>`, can still derive a stable