perf: round 9 — decorator PUT reactivation, session/search/dedup alloc purges, PROPFIND join!, folder-level cascade

Benchmark-gated round (benches/ROUND9.md): every change carries a
BEFORE/AFTER bench with equivalence/safety gates; verdicts below are from
the committed harnesses on 4 cores / local PG 16.

Backend:
- Blob decorators (Retry/Cached) now forward put_blob_from_bytes_unsynced
  + sync_blobs — the trait default had silently reinstated HEAD-before-PUT
  per chunk on decorated remote stacks, undoing ROUND3 §8. Full production
  stack: 500 probes -> 0, 1.9x wall at 10 ms RTT (bench_s3_put §3).
- NC PROPFIND per-page enrichment triple (favorites / oc:fileid / dead
  props) overlapped with tokio::join!: 2.07x local, 2.86x at 5 ms RTT
  (bench_nc_enrich_join, injected-latency decide-by-bench).
- Search enrichment consumes its DTOs and carries the interned Arc<str>
  display fields end-to-end (SearchFileResultDto type change, OpenAPI
  shape preserved): enrich_file 2.0x, 11.6 -> 2.2 allocs/row; the NC
  REPORT conversion stops re-running all three classifiers per row
  (bench_search_enrich).
- NC session Arc end-to-end: SharedNcSession extractor (8 -> 0 allocs),
  Arc<FolderDto> chroot cache (4 -> 0/hit), single shared Arc<CurrentUser>
  + lazy span render (11 -> 6/build) (bench_nc_session).
- Storage micro-pack: atomic create_new chunk writes (2.1x fresh),
  stream_chunks over the manifest Arc (4097 -> 0 allocs/read incl. the
  Range path), manifest single-flight (herd 64 -> 1 loads), hex_lower for
  chunk Content-MD5 (18 -> 1 allocs) (bench_storage_micro).
- OCS capabilities memoized into OnceLock<[Bytes;2]>: 237x, 102 -> 0
  allocs/poll, byte-identical (bench_capabilities_static).
- Drive::is_empty COUNT(*) sum -> EXISTS: 34.4x on a 100k-file drive
  (bench_drive_is_empty).
- favorites/recents row-map ROUND7 port: path/name/blob_hash moved,
  -2.75 allocs/row (bench_resource_row_map §2).
- Folder rows decode binary UUIDs (ROUND6 §10 port): 1.03-1.07x page
  fetch, honest verdict incl. one noise-band wash documented
  (bench_folder_uuid_decode).
- Authz: file cascade decision decomposed into memoized folder-level
  decision + direct-grant lookup (ROUND8 deferred item). Cold shared-album
  first view 592 -> 418 µs/thumb; warm path unchanged; safety gates incl.
  new direct-grant sibling isolation, revoke-flush re-verified, full
  integration authz suite green (bench_thumbnail_cascade_cache).

Frontend (vitest gates committed beside the code):
- resolveLabel/resolveRecipient O(directory) scan -> id-keyed Map: 13.9x
  (recipients.bench.test.ts).
- ResourceList selection-prune effect skips when nothing is selected
  (100 -> 0 Set builds per drain) and the photos timeline reads a
  listener-fed mobile flag instead of matchMedia per recompute
  (listDerives.bench.test.ts).

Verification: cargo fmt + clippy --all-features --all-targets -D warnings
clean; 524 unit + 554 integration (--cfg integration_tests) tests pass;
frontend npm run check clean with 293 vitest tests green.

Deferred with rationale in ROUND9.md: CalDAV authz-before-fetch reorder
(maintainer sign-off), per-page batched parent resolution, JWT-claims
Arc<str>, batch_operations signature widening.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XDc9VtXvskJ6dnMRraSndn

src/infrastructure/services/cached_blob_backend.rs

@@ -187,22 +187,48 @@ impl BlobStorageBackend for CachedBlobBackend {
         };
         Box::pin(async move {
             let size = inner.put_blob_from_bytes(&hash, data.clone()).await?;
-            // Also cache locally (best-effort): write bytes to cache path
-            let dest = self_ref.cached_path(&hash);
-            if let Some(parent) = dest.parent() {
-                let _ = fs::create_dir_all(parent).await;
-            }
-            let _ = fs::write(&dest, &data).await;
-            let data_len = data.len() as u64;
-            let mut idx = self_ref.index.lock().await;
-            if let Some(old) = idx.put(hash, CacheEntry { size: data_len }) {
-                self_ref.current_size.fetch_sub(old.size, Ordering::Relaxed);
-            }
-            self_ref.current_size.fetch_add(data_len, Ordering::Relaxed);
+            self_ref.cache_bytes_write_through(hash, &data).await;
             Ok(size)
         })
     }
 
+    // Without this override the trait default would re-route the CDC chunk
+    // write through `put_blob_from_bytes` above, whose inner (synced) call
+    // pays the remote exists-probe per chunk. The local write-through cache
+    // population is kept identical — post-upload readers (thumbnail/EXIF/
+    // face hooks) hit the cache instead of re-fetching from the remote.
+    fn put_blob_from_bytes_unsynced(
+        &self,
+        hash: &str,
+        data: Bytes,
+    ) -> Pin<Box<dyn std::future::Future<Output = Result<u64, DomainError>> + Send + '_>> {
+        let inner = self.inner.clone();
+        let hash = hash.to_string();
+        let self_ref = CachedRef {
+            cache_dir: self.cache_dir.clone(),
+            max_cache_bytes: self.max_cache_bytes,
+            index: self.index.clone(),
+            current_size: self.current_size.clone(),
+            inflight: self.inflight.clone(),
+        };
+        Box::pin(async move {
+            let size = inner
+                .put_blob_from_bytes_unsynced(&hash, data.clone())
+                .await?;
+            self_ref.cache_bytes_write_through(hash, &data).await;
+            Ok(size)
+        })
+    }
+
+    // The durability barrier must reach the backend that buffered the
+    // unsynced writes; the local cache copy is disposable and needs none.
+    fn sync_blobs(
+        &self,
+        hashes: &[String],
+    ) -> Pin<Box<dyn std::future::Future<Output = Result<(), DomainError>> + Send + '_>> {
+        self.inner.sync_blobs(hashes)
+    }
+
     fn get_blob_stream(
         &self,
         hash: &str,
@@ -437,6 +463,24 @@ impl CachedRef {
         self.cache_dir.join(prefix).join(format!("{hash}.blob"))
     }
 
+    /// Best-effort write-through cache population shared by both blob-bytes
+    /// PUT paths. Deliberately no eviction sweep here — the byte budget is
+    /// enforced on read-miss inserts (`insert_into_cache_static`), matching
+    /// the historical write-path behavior.
+    async fn cache_bytes_write_through(&self, hash: String, data: &Bytes) {
+        let dest = self.cached_path(&hash);
+        if let Some(parent) = dest.parent() {
+            let _ = fs::create_dir_all(parent).await;
+        }
+        let _ = fs::write(&dest, data).await;
+        let data_len = data.len() as u64;
+        let mut idx = self.index.lock().await;
+        if let Some(old) = idx.put(hash, CacheEntry { size: data_len }) {
+            self.current_size.fetch_sub(old.size, Ordering::Relaxed);
+        }
+        self.current_size.fetch_add(data_len, Ordering::Relaxed);
+    }
+
     /// Single-flight wrapper around [`Self::fetch_and_cache_static`]: the
     /// first caller for a hash becomes the leader and downloads; concurrent
     /// callers queue on the per-hash gate, then re-check the cache and serve