perf: round 9 — decorator PUT reactivation, session/search/dedup alloc purges, PROPFIND join!, folder-level cascade

Benchmark-gated round (benches/ROUND9.md): every change carries a
BEFORE/AFTER bench with equivalence/safety gates; verdicts below are from
the committed harnesses on 4 cores / local PG 16.

Backend:
- Blob decorators (Retry/Cached) now forward put_blob_from_bytes_unsynced
  + sync_blobs — the trait default had silently reinstated HEAD-before-PUT
  per chunk on decorated remote stacks, undoing ROUND3 §8. Full production
  stack: 500 probes -> 0, 1.9x wall at 10 ms RTT (bench_s3_put §3).
- NC PROPFIND per-page enrichment triple (favorites / oc:fileid / dead
  props) overlapped with tokio::join!: 2.07x local, 2.86x at 5 ms RTT
  (bench_nc_enrich_join, injected-latency decide-by-bench).
- Search enrichment consumes its DTOs and carries the interned Arc<str>
  display fields end-to-end (SearchFileResultDto type change, OpenAPI
  shape preserved): enrich_file 2.0x, 11.6 -> 2.2 allocs/row; the NC
  REPORT conversion stops re-running all three classifiers per row
  (bench_search_enrich).
- NC session Arc end-to-end: SharedNcSession extractor (8 -> 0 allocs),
  Arc<FolderDto> chroot cache (4 -> 0/hit), single shared Arc<CurrentUser>
  + lazy span render (11 -> 6/build) (bench_nc_session).
- Storage micro-pack: atomic create_new chunk writes (2.1x fresh),
  stream_chunks over the manifest Arc (4097 -> 0 allocs/read incl. the
  Range path), manifest single-flight (herd 64 -> 1 loads), hex_lower for
  chunk Content-MD5 (18 -> 1 allocs) (bench_storage_micro).
- OCS capabilities memoized into OnceLock<[Bytes;2]>: 237x, 102 -> 0
  allocs/poll, byte-identical (bench_capabilities_static).
- Drive::is_empty COUNT(*) sum -> EXISTS: 34.4x on a 100k-file drive
  (bench_drive_is_empty).
- favorites/recents row-map ROUND7 port: path/name/blob_hash moved,
  -2.75 allocs/row (bench_resource_row_map §2).
- Folder rows decode binary UUIDs (ROUND6 §10 port): 1.03-1.07x page
  fetch, honest verdict incl. one noise-band wash documented
  (bench_folder_uuid_decode).
- Authz: file cascade decision decomposed into memoized folder-level
  decision + direct-grant lookup (ROUND8 deferred item). Cold shared-album
  first view 592 -> 418 µs/thumb; warm path unchanged; safety gates incl.
  new direct-grant sibling isolation, revoke-flush re-verified, full
  integration authz suite green (bench_thumbnail_cascade_cache).

Frontend (vitest gates committed beside the code):
- resolveLabel/resolveRecipient O(directory) scan -> id-keyed Map: 13.9x
  (recipients.bench.test.ts).
- ResourceList selection-prune effect skips when nothing is selected
  (100 -> 0 Set builds per drain) and the photos timeline reads a
  listener-fed mobile flag instead of matchMedia per recompute
  (listDerives.bench.test.ts).

Verification: cargo fmt + clippy --all-features --all-targets -D warnings
clean; 524 unit + 554 integration (--cfg integration_tests) tests pass;
frontend npm run check clean with 293 vitest tests green.

Deferred with rationale in ROUND9.md: CalDAV authz-before-fetch reorder
(maintainer sign-off), per-page batched parent resolution, JWT-claims
Arc<str>, batch_operations signature widening.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XDc9VtXvskJ6dnMRraSndn

frontend/src/lib/api/endpoints/recipients.bench.test.ts

@@ -0,0 +1,141 @@
+import { describe, expect, it } from 'vitest';
+
+/**
+ * Benchmark gate for the O(1) contact index behind `resolveLabel` /
+ * `resolveRecipient` (recipients.ts).
+ *
+ * Audit finding: both resolvers ran `contactCache.find((x) => x.id === id)`
+ * — a linear scan over the WHOLE system address book — once per rendered
+ * grant row / lane header on /shared, and the page re-renders on every
+ * infinite-scroll page and role change. Cost per frame: O(rows × directory
+ * size) — ~150k comparisons for 30 rows in a 5 000-user org. The fix builds
+ * a `Map<id, Contact>` once per cache identity (exactly like the existing
+ * `groupCache`) and looks up O(1).
+ *
+ * Gates: (1) labels identical to the linear scan for present AND absent
+ * ids; (2) comparison count collapses from rows×C to ~C (one index build);
+ * (3) resolving a full page against a 5 000-contact directory is ≥10x
+ * faster with the index.
+ */
+
+interface Contact {
+	id: string;
+	full_name?: string;
+	email?: string;
+}
+
+function contactLabel(c: Contact): { label: string; email?: string } {
+	return { label: c.full_name || c.email || c.id, email: c.email };
+}
+
+function directory(n: number): Contact[] {
+	return Array.from({ length: n }, (_, i) => ({
+		id: `user-${i}`,
+		full_name: `User Number ${i}`,
+		email: `user${i}@example.com`
+	}));
+}
+
+/** BEFORE — verbatim resolver shape: linear `.find` per call. */
+function makeBefore(cache: Contact[], counter: { cmp: number }) {
+	return (id: string): string => {
+		let found: Contact | undefined;
+		for (const x of cache) {
+			counter.cmp++;
+			if (x.id === id) {
+				found = x;
+				break;
+			}
+		}
+		return found ? contactLabel(found).label : id;
+	};
+}
+
+/** AFTER — the shipped shape: identity-memoized Map index, O(1) get. */
+function makeAfter(cache: Contact[], counter: { cmp: number }) {
+	let contactById: Map<string, Contact> | null = null;
+	let source: Contact[] | null = null;
+	const index = () => {
+		if (!contactById || source !== cache) {
+			contactById = new Map(
+				cache.map((c) => {
+					counter.cmp++;
+					return [c.id, c] as const;
+				})
+			);
+			source = cache;
+		}
+		return contactById;
+	};
+	return (id: string): string => {
+		const c = index().get(id);
+		return c ? contactLabel(c).label : id;
+	};
+}
+
+describe('resolveLabel contact index (benchmark gate)', () => {
+	const C = 5_000;
+	const contacts = directory(C);
+	// A /shared page: 30 rows, most present, some unknown (revoked users).
+	const rowIds = [
+		...Array.from({ length: 26 }, (_, i) => `user-${i * 137}`),
+		'ghost-1',
+		'ghost-2',
+		'user-4999',
+		'ghost-3'
+	];
+
+	it('labels identical to the linear scan for present and absent ids', () => {
+		const before = makeBefore(contacts, { cmp: 0 });
+		const after = makeAfter(contacts, { cmp: 0 });
+		for (const id of rowIds) {
+			expect(after(id), id).toBe(before(id));
+		}
+		// Absent ids fall back to the raw id in both.
+		expect(after('ghost-1')).toBe('ghost-1');
+	});
+
+	it('comparison count collapses from rows×C to one index build (~C)', () => {
+		const beforeCounter = { cmp: 0 };
+		const before = makeBefore(contacts, beforeCounter);
+		for (const id of rowIds) before(id);
+		// Linear scans: each present id walks ~id-position entries, absent
+		// ids walk the full directory.
+		expect(beforeCounter.cmp).toBeGreaterThan(C * 3);
+
+		const afterCounter = { cmp: 0 };
+		const after = makeAfter(contacts, afterCounter);
+		for (const id of rowIds) after(id);
+		// One index build (C inserts), zero comparisons per lookup after.
+		expect(afterCounter.cmp).toBe(C);
+
+		// A SECOND render frame re-uses the index: zero additional work.
+		for (const id of rowIds) after(id);
+		expect(afterCounter.cmp).toBe(C);
+	});
+
+	it('resolving a page against a 5k directory is ≥10x faster with the index', () => {
+		const frames = 50;
+
+		const before = makeBefore(contacts, { cmp: 0 });
+		const t0 = performance.now();
+		for (let f = 0; f < frames; f++) {
+			for (const id of rowIds) before(id);
+		}
+		const beforeMs = performance.now() - t0;
+
+		const after = makeAfter(contacts, { cmp: 0 });
+		const t1 = performance.now();
+		for (let f = 0; f < frames; f++) {
+			for (const id of rowIds) after(id);
+		}
+		const afterMs = performance.now() - t1;
+
+		console.log(
+			`resolveLabel ${frames} frames × ${rowIds.length} rows @ C=${C}: ` +
+				`before ${beforeMs.toFixed(1)} ms, after ${afterMs.toFixed(1)} ms ` +
+				`(${(beforeMs / afterMs).toFixed(1)}x)`
+		);
+		expect(afterMs).toBeLessThan(beforeMs / 10);
+	});
+});

frontend/src/lib/api/endpoints/recipients.ts

@@ -134,10 +134,26 @@ export async function ensureResolvers(): Promise<void> {
 	await Promise.all([systemContacts(), loadGroups()]);
 }
 
+// O(1) id→contact index over `contactCache`, built once per cache identity.
+// `resolveLabel`/`resolveRecipient` run per rendered grant row on /shared —
+// the previous `contactCache.find(...)` linear scan made each render frame
+// O(rows × directory size).
+let contactById: Map<string, Contact> | null = null;
+let contactByIdSource: Contact[] | null = null;
+
+function contactIndex(): Map<string, Contact> | null {
+	if (!contactCache) return null;
+	if (!contactById || contactByIdSource !== contactCache) {
+		contactById = new Map(contactCache.map((c) => [c.id, c]));
+		contactByIdSource = contactCache;
+	}
+	return contactById;
+}
+
 /** Resolve a subject id to a display label using the preloaded caches. */
 export function resolveLabel(type: 'user' | 'group', id: string): string {
 	if (type === 'group') return groupCache?.get(id) ?? id;
-	const c = contactCache?.find((x) => x.id === id);
+	const c = contactIndex()?.get(id);
 	return c ? contactLabel(c).label : id;
 }
 
@@ -146,7 +162,7 @@ export function resolveRecipient(type: 'user' | 'group', id: string): Recipient
 	if (type === 'group') {
 		return { type: 'group', id, label: groupCache?.get(id) ?? id };
 	}
-	const c = contactCache?.find((x) => x.id === id);
+	const c = contactIndex()?.get(id);
 	if (!c) return { type: 'user', id, label: id };
 	const { label, email } = contactLabel(c);
 	return { type: 'user', id, label, sublabel: email };

frontend/src/lib/components/ResourceList.svelte

@@ -256,6 +256,11 @@
 
 	// Drop selection ids that are no longer present after a reload.
 	$effect(() => {
+		// With nothing selected (the common case) every infinite-scroll page
+		// re-fired this effect and built a throwaway O(N) id Set for a loop
+		// that never runs — skip straight out. `selected.size` is reactive,
+		// so the effect re-fires when a selection appears.
+		if (selected.size === 0) return;
 		const ids = new Set(items.map((i) => i.id));
 		let changed = false;
 		for (const id of selected) {

frontend/src/lib/components/listDerives.bench.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'vitest';
+
+/**
+ * Benchmark gates for two per-page derive cleanups (round 9):
+ *
+ * [1] ResourceList's selection-prune `$effect` built an O(N) id `Set` on
+ *     EVERY `items` change (every infinite-scroll page) even when nothing
+ *     was selected — the loop it feeds never runs in that case. The shipped
+ *     guard (`if (selected.size === 0) return`) makes the empty-selection
+ *     page append free while keeping the pruned result byte-identical when
+ *     a selection exists.
+ *
+ * [2] The photos timeline derive called `window.matchMedia(...)` on every
+ *     recompute (every 60-photo page append) for a boolean that changes
+ *     only on viewport-class crossings. The shipped code hoists it into
+ *     state fed by a single MediaQueryList `change` listener.
+ *
+ * Both are modeled as pure replicas of the effect/derive bodies (no jsdom
+ * mounting needed) with instrumentation counters, mirroring the shipped
+ * control flow exactly.
+ */
+
+interface Item {
+	id: string;
+}
+
+const page = (start: number, n: number): Item[] =>
+	Array.from({ length: n }, (_, i) => ({ id: `it-${start + i}` }));
+
+/** BEFORE — verbatim effect body: unconditional Set build. */
+function pruneBefore(items: Item[], selected: Set<string>, counter: { setBuilds: number }) {
+	counter.setBuilds++;
+	const ids = new Set(items.map((i) => i.id));
+	for (const id of [...selected]) {
+		if (!ids.has(id)) selected.delete(id);
+	}
+}
+
+/** AFTER — the shipped body: skip entirely while nothing is selected. */
+function pruneAfter(items: Item[], selected: Set<string>, counter: { setBuilds: number }) {
+	if (selected.size === 0) return;
+	counter.setBuilds++;
+	const ids = new Set(items.map((i) => i.id));
+	for (const id of [...selected]) {
+		if (!ids.has(id)) selected.delete(id);
+	}
+}
+
+describe('selection-prune guard (benchmark gate)', () => {
+	it('empty selection: zero Set builds across a 100-page drain (was 100)', () => {
+		const beforeCounter = { setBuilds: 0 };
+		const afterCounter = { setBuilds: 0 };
+		let items: Item[] = [];
+		for (let p = 0; p < 100; p++) {
+			items = [...items, ...page(p * 50, 50)];
+			pruneBefore(items, new Set(), beforeCounter);
+			pruneAfter(items, new Set(), afterCounter);
+		}
+		expect(beforeCounter.setBuilds).toBe(100);
+		expect(afterCounter.setBuilds).toBe(0);
+	});
+
+	it('active selection: pruned set identical to the unguarded version', () => {
+		const items = page(0, 200);
+		// Selection holds survivors + ids that vanished on reload.
+		const seed = ['it-3', 'it-77', 'gone-1', 'it-150', 'gone-2'];
+		const a = new Set(seed);
+		const b = new Set(seed);
+		pruneBefore(items, a, { setBuilds: 0 });
+		pruneAfter(items, b, { setBuilds: 0 });
+		expect([...b].sort()).toEqual([...a].sort());
+		expect(b.has('gone-1')).toBe(false);
+		expect(b.has('it-3')).toBe(true);
+	});
+});
+
+// ── [2] matchMedia hoist ────────────────────────────────────────────────────
+
+interface MqlStub {
+	matches: boolean;
+	listeners: ((e: { matches: boolean }) => void)[];
+}
+
+function makeMatchMedia(counter: { calls: number }, stub: MqlStub) {
+	return () => {
+		counter.calls++;
+		return {
+			get matches() {
+				return stub.matches;
+			},
+			addEventListener: (_: 'change', fn: (e: { matches: boolean }) => void) => {
+				stub.listeners.push(fn);
+			},
+			removeEventListener: () => {}
+		};
+	};
+}
+
+describe('photos matchMedia hoist (benchmark gate)', () => {
+	it('P recomputes: 1 matchMedia call instead of P, identical booleans', () => {
+		const P = 50;
+		const stub: MqlStub = { matches: false, listeners: [] };
+
+		// BEFORE — the derive body queries per recompute.
+		const beforeCounter = { calls: 0 };
+		const mmBefore = makeMatchMedia(beforeCounter, stub);
+		const beforeValues: boolean[] = [];
+		for (let i = 0; i < P; i++) {
+			beforeValues.push(mmBefore().matches);
+		}
+		expect(beforeCounter.calls).toBe(P);
+
+		// AFTER — one query + listener; recomputes read the state boolean.
+		const afterCounter = { calls: 0 };
+		const mmAfter = makeMatchMedia(afterCounter, stub);
+		const mql = mmAfter();
+		let isMobile = mql.matches;
+		mql.addEventListener('change', (e) => {
+			isMobile = e.matches;
+		});
+		const afterValues: boolean[] = [];
+		for (let i = 0; i < P; i++) {
+			afterValues.push(isMobile);
+		}
+		expect(afterCounter.calls).toBe(1);
+		expect(afterValues).toEqual(beforeValues);
+
+		// A viewport-class crossing propagates through the listener.
+		stub.matches = true;
+		for (const fn of stub.listeners) fn({ matches: true });
+		expect(isMobile).toBe(true);
+	});
+});

frontend/src/routes/photos/+page.svelte

@@ -94,15 +94,27 @@
 	// deps re-fire without an actual append, `sync` sees a non-growing list and
 	// safely full-rebuilds — same output as the pure `buildPhotoRows`.
 	const timeline = new PhotoTimeline();
+	// `mobile` as state fed by one MediaQueryList listener: the derive below
+	// re-runs on every page append, and `window.matchMedia(...)` inside it was
+	// a per-recompute style/layout read that only changes on viewport-class
+	// crossings — now those crossings push the boolean instead.
+	let isMobile = $state(false);
+	$effect(() => {
+		if (typeof window === 'undefined' || typeof window.matchMedia !== 'function') return;
+		const mql = window.matchMedia('(max-width: 768px)');
+		isMobile = mql.matches;
+		const onchange = (e: MediaQueryListEvent) => {
+			isMobile = e.matches;
+		};
+		mql.addEventListener('change', onchange);
+		return () => mql.removeEventListener('change', onchange);
+	});
 	const photoRows = $derived.by<PhotoRow[]>(() =>
 		timeline.sync(visibleItems, {
 			groupMode,
 			layoutMode,
 			width: gridWidth,
-			mobile:
-				typeof window !== 'undefined' &&
-				typeof window.matchMedia === 'function' &&
-				window.matchMedia('(max-width: 768px)').matches,
+			mobile: isMobile,
 			timestampOf: photoTimestamp,
 			labelOf: bucketLabel
 		})