perf: round 9 — decorator PUT reactivation, session/search/dedup alloc purges, PROPFIND join!, folder-level cascade

Benchmark-gated round (benches/ROUND9.md): every change carries a BEFORE/AFTER bench with equivalence/safety gates; verdicts below are from the committed harnesses on 4 cores / local PG 16. Backend: - Blob decorators (Retry/Cached) now forward put_blob_from_bytes_unsynced + sync_blobs — the trait default had silently reinstated HEAD-before-PUT per chunk on decorated remote stacks, undoing ROUND3 §8. Full production stack: 500 probes -> 0, 1.9x wall at 10 ms RTT (bench_s3_put §3). - NC PROPFIND per-page enrichment triple (favorites / oc:fileid / dead props) overlapped with tokio::join!: 2.07x local, 2.86x at 5 ms RTT (bench_nc_enrich_join, injected-latency decide-by-bench). - Search enrichment consumes its DTOs and carries the interned Arc<str> display fields end-to-end (SearchFileResultDto type change, OpenAPI shape preserved): enrich_file 2.0x, 11.6 -> 2.2 allocs/row; the NC REPORT conversion stops re-running all three classifiers per row (bench_search_enrich). - NC session Arc end-to-end: SharedNcSession extractor (8 -> 0 allocs), Arc<FolderDto> chroot cache (4 -> 0/hit), single shared Arc<CurrentUser> + lazy span render (11 -> 6/build) (bench_nc_session). - Storage micro-pack: atomic create_new chunk writes (2.1x fresh), stream_chunks over the manifest Arc (4097 -> 0 allocs/read incl. the Range path), manifest single-flight (herd 64 -> 1 loads), hex_lower for chunk Content-MD5 (18 -> 1 allocs) (bench_storage_micro). - OCS capabilities memoized into OnceLock<[Bytes;2]>: 237x, 102 -> 0 allocs/poll, byte-identical (bench_capabilities_static). - Drive::is_empty COUNT(*) sum -> EXISTS: 34.4x on a 100k-file drive (bench_drive_is_empty). - favorites/recents row-map ROUND7 port: path/name/blob_hash moved, -2.75 allocs/row (bench_resource_row_map §2). - Folder rows decode binary UUIDs (ROUND6 §10 port): 1.03-1.07x page fetch, honest verdict incl. one noise-band wash documented (bench_folder_uuid_decode). - Authz: file cascade decision decomposed into memoized folder-level decision + direct-grant lookup (ROUND8 deferred item). Cold shared-album first view 592 -> 418 µs/thumb; warm path unchanged; safety gates incl. new direct-grant sibling isolation, revoke-flush re-verified, full integration authz suite green (bench_thumbnail_cascade_cache). Frontend (vitest gates committed beside the code): - resolveLabel/resolveRecipient O(directory) scan -> id-keyed Map: 13.9x (recipients.bench.test.ts). - ResourceList selection-prune effect skips when nothing is selected (100 -> 0 Set builds per drain) and the photos timeline reads a listener-fed mobile flag instead of matchMedia per recompute (listDerives.bench.test.ts). Verification: cargo fmt + clippy --all-features --all-targets -D warnings clean; 524 unit + 554 integration (--cfg integration_tests) tests pass; frontend npm run check clean with 293 vitest tests green. Deferred with rationale in ROUND9.md: CalDAV authz-before-fetch reorder (maintainer sign-off), per-page batched parent resolution, JWT-claims Arc<str>, batch_operations signature widening. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XDc9VtXvskJ6dnMRraSndn
2026-07-18 16:12:04 +00:00
parent 2317d594e3
commit fdf445d2b0
40 changed files with 4279 additions and 346 deletions
@@ -28,12 +28,16 @@ use crate::interfaces::middleware::auth::CurrentUser;
 /// default drive root, so no per-request authorization decision is being
 /// skipped. The drive-marker branch keeps its `get_folder_with_perms`
 /// check on every request.
-static NC_CHROOT_CACHE: LazyLock<moka::sync::Cache<uuid::Uuid, FolderDto>> = LazyLock::new(|| {
-    moka::sync::Cache::builder()
-        .max_capacity(100_000)
-        .time_to_live(Duration::from_secs(30))
-        .build()
-});
+// `Arc<FolderDto>` values: a hit hands back a refcount bump instead of a
+// deep clone of the DTO's ~5 owned Strings (moka's `get` clones `V`), and
+// the same `Arc` then rides inside `NcSession` for the whole request.
+static NC_CHROOT_CACHE: LazyLock<moka::sync::Cache<uuid::Uuid, Arc<FolderDto>>> =
+    LazyLock::new(|| {
+        moka::sync::Cache::builder()
+            .max_capacity(100_000)
+            .time_to_live(Duration::from_secs(30))
+            .build()
+    });

 #[derive(Debug, thiserror::Error)]
 pub enum NextcloudAuthError {
@@ -184,13 +188,19 @@ pub async fn basic_auth_middleware(
            // request would appear in the logs with `user_id=-`,
            // making it harder to correlate WebDAV / OCS activity to
            // a specific principal.
-            tracing::Span::current().record("user_id", user_id.to_string());
-            let current_user = CurrentUser {
+            // `field::display` renders lazily into the subscriber's buffer —
+            // no per-request `to_string` (mirrors the JWT path since ROUND5).
+            tracing::Span::current().record("user_id", tracing::field::display(user_id));
+            // One shared identity: the same `Arc` serves the
+            // `Arc<CurrentUser>` extension AND `NcSession.user` (the old
+            // code built the struct, cloned it for the extension, then
+            // moved the original — 2-3 String allocs per request).
+            let current_user = Arc::new(CurrentUser {
                id: user_id,
                username: uname,
                email,
                role,
-            };
+            });

            // ── Resolve chroot from the Basic Auth drive marker ─────
            // No marker → caller's default personal drive's root folder
@@ -226,9 +236,10 @@ pub async fn basic_auth_middleware(
                                        .folder_service
                                        .get_folder(&root_id.to_string())
                                        .await
-                                        .ok();
+                                        .ok()
+                                        .map(Arc::new);
                                    if let Some(f) = &fetched {
-                                        NC_CHROOT_CACHE.insert(root_id, f.clone());
+                                        NC_CHROOT_CACHE.insert(root_id, Arc::clone(f));
                                    }
                                    fetched
                                }
@@ -242,7 +253,8 @@ pub async fn basic_auth_middleware(
                    .folder_service
                    .get_folder_with_perms(folder_id, current_user.id)
                    .await
-                    .ok(),
+                    .ok()
+                    .map(Arc::new),
            };
            if chroot.is_none() {
                tracing::warn!(
@@ -253,25 +265,20 @@ pub async fn basic_auth_middleware(
                return Err(NextcloudAuthError::Unauthorized);
            }

-            request
-                .extensions_mut()
-                .insert(Arc::new(current_user.clone()));
+            // Record from the local before it moves into the session —
+            // the old code re-read the just-inserted extension and paid a
+            // `to_string` for the span value.
+            if let Some(c) = &chroot {
+                tracing::Span::current().record("chroot_id", tracing::field::display(&c.id));
+            }
+            request.extensions_mut().insert(Arc::clone(&current_user));
            request.extensions_mut().insert(Arc::new(
                crate::interfaces::nextcloud::session::NcSession {
                    user: current_user,
-                    raw_username: raw_username.clone(),
+                    raw_username,
                    chroot,
                },
            ));
-            tracing::Span::current().record(
-                "chroot_id",
-                request
-                    .extensions()
-                    .get::<Arc<crate::interfaces::nextcloud::session::NcSession>>()
-                    .and_then(|s| s.chroot.as_ref())
-                    .map(|c| c.id.to_string())
-                    .unwrap_or_default(),
-            );
            Ok(next.run(request).await)
        }
        Err(_) => {
@@ -35,20 +35,51 @@ fn ocs_err(statuscode: u16, message: &str) -> serde_json::Value {
 }

 pub async fn handle_capabilities_v1(State(state): State<Arc<AppState>>) -> Response {
-    let payload = capabilities_payload(&state, 1);
    tracing::info!("[NC] capabilities v1 requested, returning payload");
-    Json(payload).into_response()
+    capabilities_response(&state, 1)
 }

 pub async fn handle_capabilities_v2(State(state): State<Arc<AppState>>) -> Response {
-    let payload = capabilities_payload(&state, 2);
    tracing::info!("[NC] capabilities v2 requested, returning payload");
-    Json(payload).into_response()
+    capabilities_response(&state, 2)
+}
+
+/// Pre-serialized capabilities bodies, `[v1, v2]`. The payload is
+/// process-invariant (pure config: base URL + emulated NC version), yet
+/// every desktop/mobile client polls it periodically — the old handler
+/// re-built the ~40-node `json!` tree, re-read `OXICLOUD_BASE_URL` from
+/// the environment and re-serialized on every poll. Now that work runs
+/// once; a poll is a `Bytes` refcount bump.
+static CAPABILITIES_BODIES: std::sync::OnceLock<[bytes::Bytes; 2]> = std::sync::OnceLock::new();
+
+fn capabilities_response(state: &AppState, ocs_version: u8) -> Response {
+    let bodies = CAPABILITIES_BODIES.get_or_init(|| {
+        let base_url = state.core.config.base_url();
+        let emulated = state.core.config.nextcloud.emulated_version;
+        let version_string = state.core.config.nextcloud.version_string();
+        [1u8, 2u8].map(|v| {
+            bytes::Bytes::from(
+                serde_json::to_vec(&capabilities_payload(
+                    &base_url,
+                    emulated,
+                    &version_string,
+                    v,
+                ))
+                .expect("static capabilities JSON serializes"),
+            )
+        })
+    });
+    let body = bodies[usize::from(ocs_version != 1)].clone();
+    (
+        [(axum::http::header::CONTENT_TYPE, "application/json")],
+        body,
+    )
+        .into_response()
 }

 pub async fn handle_user_info(
    State(state): State<Arc<AppState>>,
-    session: crate::interfaces::nextcloud::session::NcSession,
+    session: crate::interfaces::nextcloud::session::SharedNcSession,
 ) -> Response {
    let quota: (i64, i64) = match state.storage_usage_service.as_ref() {
        Some(service) => match service.get_user_storage_info(session.user.id).await {
@@ -530,11 +561,19 @@ fn empty_search_response() -> Json<serde_json::Value> {
    }))
 }

-fn capabilities_payload(state: &AppState, ocs_version: u8) -> serde_json::Value {
+/// Build the capabilities JSON tree from its three config inputs. Public
+/// only under the `bench` feature caller path via
+/// [`capabilities_payload_for_bench`]; production reaches it once through
+/// the [`CAPABILITIES_BODIES`] init.
+fn capabilities_payload(
+    base_url: &str,
+    emulated_version: (u32, u32, u32),
+    version_string: &str,
+    ocs_version: u8,
+) -> serde_json::Value {
    let statuscode = if ocs_version == 1 { 100 } else { 200 };
-    let base_url = state.core.config.base_url();
-    let (nc_major, nc_minor, nc_micro) = state.core.config.nextcloud.emulated_version;
-    let nc_version_str = state.core.config.nextcloud.version_string();
+    let (nc_major, nc_minor, nc_micro) = emulated_version;
+    let nc_version_str = version_string;

    json!({
        "ocs": {
@@ -602,6 +641,19 @@ fn capabilities_payload(state: &AppState, ocs_version: u8) -> serde_json::Value
    })
 }

+/// Bench-only public wrapper (feature = "bench") over the private payload
+/// builder so `examples/bench_capabilities_static.rs` can A/B the
+/// rebuild-per-poll flow against the memoized bytes.
+#[cfg(feature = "bench")]
+pub fn capabilities_payload_for_bench(
+    base_url: &str,
+    emulated_version: (u32, u32, u32),
+    version_string: &str,
+    ocs_version: u8,
+) -> serde_json::Value {
+    capabilities_payload(base_url, emulated_version, version_string, ocs_version)
+}
+
 fn extract_basic_password(headers: &axum::http::HeaderMap) -> Option<String> {
    let value = headers
        .get(axum::http::header::AUTHORIZATION)?
@@ -10,9 +10,7 @@ use quick_xml::{
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

-use crate::application::dtos::display_helpers::{
-    category_for, format_file_size, icon_class_for, icon_special_class_for,
-};
+use crate::application::dtos::display_helpers::format_file_size;
 use crate::application::dtos::file_dto::FileDto;
 use crate::application::dtos::folder_dto::FolderDto;
 use crate::application::dtos::search_dto::SearchCriteriaDto;
@@ -401,15 +399,16 @@ fn file_dto_from_search(fr: &crate::application::dtos::search_dto::SearchFileRes
        name: fr.name.clone(),
        path: fr.path.clone(),
        size: fr.size,
-        mime_type: fr.mime_type.clone().into(),
+        // Interned `Arc<str>` carried through from enrichment — refcount
+        // bumps; the old code re-ran all three display classifiers and
+        // re-allocated each value per converted search row.
+        mime_type: fr.mime_type.clone(),
        folder_id: fr.folder_id.clone(),
        created_at: fr.created_at,
        modified_at: fr.modified_at,
-        icon_class: icon_class_for(&fr.name, &fr.mime_type).to_string().into(),
-        icon_special_class: icon_special_class_for(&fr.name, &fr.mime_type)
-            .to_string()
-            .into(),
-        category: category_for(&fr.name, &fr.mime_type).to_string().into(),
+        icon_class: fr.icon_class.clone(),
+        icon_special_class: fr.icon_special_class.clone(),
+        category: fr.category.clone(),
        size_formatted: format_file_size(fr.size),
        sort_date: None,
        content_hash: fr.blob_hash.clone(),
@@ -420,6 +419,16 @@ fn file_dto_from_search(fr: &crate::application::dtos::search_dto::SearchFileRes
    }
 }

+/// Bench-only public wrapper (feature = "bench") over the private
+/// search→FileDto conversion so `examples/bench_search_enrich.rs` can
+/// measure and equivalence-gate it.
+#[cfg(feature = "bench")]
+pub fn file_dto_from_search_for_bench(
+    fr: &crate::application::dtos::search_dto::SearchFileResultDto,
+) -> FileDto {
+    file_dto_from_search(fr)
+}
+
 /// Build a `FolderDto` from a search folder result.
 fn folder_dto_from_search(
    sr: &crate::application::dtos::search_dto::SearchFolderResultDto,
@@ -17,7 +17,7 @@ use crate::interfaces::nextcloud::basic_auth_middleware::basic_auth_middleware;
 use crate::interfaces::nextcloud::login_v2_handler;
 use crate::interfaces::nextcloud::ocs_handler;
 use crate::interfaces::nextcloud::preview_handler;
-use crate::interfaces::nextcloud::session::NcSession;
+use crate::interfaces::nextcloud::session::SharedNcSession;
 use crate::interfaces::nextcloud::status_handler;
 use crate::interfaces::nextcloud::trashbin_handler;
 use crate::interfaces::nextcloud::uploads_handler;
@@ -216,7 +216,7 @@ pub fn nextcloud_routes_with_state(state: Arc<AppState>) -> Router<Arc<AppState>
 async fn handle_dav_files(
    State(state): State<Arc<AppState>>,
    Path((_url_user, subpath)): Path<(String, String)>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    webdav_handler::handle_nc_webdav(state, req, session, subpath)
@@ -227,7 +227,7 @@ async fn handle_dav_files(
 async fn handle_dav_files_root(
    State(state): State<Arc<AppState>>,
    Path(_url_user): Path<String>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    webdav_handler::handle_nc_webdav(state, req, session, String::new())
@@ -238,7 +238,7 @@ async fn handle_dav_files_root(
 async fn handle_dav_uploads(
    State(state): State<Arc<AppState>>,
    Path((_url_user, upload_id, rest)): Path<(String, String, String)>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    uploads_handler::handle_nc_uploads(state, req, session, upload_id, rest)
@@ -249,7 +249,7 @@ async fn handle_dav_uploads(
 async fn handle_dav_uploads_root(
    State(state): State<Arc<AppState>>,
    Path((_url_user, upload_id)): Path<(String, String)>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    uploads_handler::handle_nc_uploads(state, req, session, upload_id, String::new())
@@ -279,7 +279,7 @@ async fn handle_legacy_webdav_root(user_ext: AuthUser) -> Response {
 async fn handle_dav_trashbin(
    State(state): State<Arc<AppState>>,
    Path((_url_user, subpath)): Path<(String, String)>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    trashbin_handler::handle_nc_trashbin(state, req, session, subpath)
@@ -290,7 +290,7 @@ async fn handle_dav_trashbin(
 async fn handle_dav_trashbin_root(
    State(state): State<Arc<AppState>>,
    Path(_url_user): Path<String>,
-    session: NcSession,
+    session: SharedNcSession,
    req: Request<Body>,
 ) -> Result<Response, Response> {
    trashbin_handler::handle_nc_trashbin(state, req, session, String::new())
@@ -3,8 +3,9 @@
 //! Bundles WHO the caller is, the raw wire username they presented,
 //! and (for path-scoped endpoints) WHERE they're confined to. Built
 //! by `basic_auth_middleware` and stashed in request extensions as
-//! `Arc<NcSession>`; handlers extract it via the [`FromRequestParts`]
-//! impl below — just declare `session: NcSession` in the signature.
+//! `Arc<NcSession>`; handlers extract it via [`SharedNcSession`]
+//! (derefs to `NcSession`) — declare `session: SharedNcSession` in
+//! the signature.
 //!
 //! ## Source of truth
 //!
@@ -46,9 +47,13 @@ use crate::interfaces::middleware::auth::CurrentUser;

 #[derive(Debug, Clone)]
 pub struct NcSession {
-    pub user: CurrentUser,
+    /// Shared with the `Arc<CurrentUser>` request extension — one identity
+    /// build per request instead of a clone per consumer.
+    pub user: Arc<CurrentUser>,
    pub raw_username: String,
-    pub chroot: Option<FolderDto>,
+    /// Shared with `NC_CHROOT_CACHE` (markerless branch) — a cache hit is
+    /// an `Arc` bump, not a `FolderDto` deep-clone.
+    pub chroot: Option<Arc<FolderDto>>,
 }

 impl NcSession {
@@ -56,7 +61,7 @@ impl NcSession {
    /// without one. Documents the invariant that every NC route
    /// today is path-scoped — if this fires, route wiring is wrong.
    pub fn require_chroot(&self) -> Result<&FolderDto, AppError> {
-        self.chroot.as_ref().ok_or_else(|| {
+        self.chroot.as_deref().ok_or_else(|| {
            AppError::internal_error(
                "NcSession: path-scoped handler reached without a chroot — route wiring bug",
            )
@@ -101,10 +106,13 @@ fn extract_url_user(path: &str) -> Option<String> {
    urlencoding::decode(user_seg).ok().map(|s| s.into_owned())
 }

-/// Axum extractor: pulls the `Arc<NcSession>` that
-/// `basic_auth_middleware` stashed in request extensions and clones
-/// it (cheap — one `Arc` increment, no field copy) into an owned
-/// `NcSession` for handler use.
+/// Axum extractor: the shared handle to the request's [`NcSession`].
+///
+/// Derefs to `NcSession`, so handler bodies read `session.user`,
+/// `session.require_chroot()`, … unchanged. Extraction is one `Arc`
+/// refcount increment — the previous extractor deep-cloned the whole
+/// session (`CurrentUser` + `raw_username` + chroot `FolderDto`, ~8-9
+/// `String` allocs) on every authenticated NC request.
 ///
 /// On path-scoped DAV routes (`/remote.php/dav/{files,uploads,
 /// trashbin}/{user}/…`), the URL `{user}` segment is cross-checked
@@ -113,14 +121,33 @@ fn extract_url_user(path: &str) -> Option<String> {
 /// (`get_folder_with_perms`) is what actually prevents cross-user
 /// access. It just surfaces malformed requests early (403) instead
 /// of silently letting them through.
-impl<S: Send + Sync> FromRequestParts<S> for NcSession {
+#[derive(Debug, Clone)]
+pub struct SharedNcSession(Arc<NcSession>);
+
+impl SharedNcSession {
+    /// Wrap an already-shared session (used by the bench harness; the
+    /// middleware inserts the `Arc` into request extensions directly).
+    pub fn from_arc(session: Arc<NcSession>) -> Self {
+        Self(session)
+    }
+}
+
+impl std::ops::Deref for SharedNcSession {
+    type Target = NcSession;
+
+    fn deref(&self) -> &NcSession {
+        &self.0
+    }
+}
+
+impl<S: Send + Sync> FromRequestParts<S> for SharedNcSession {
    type Rejection = Response;

    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
        let session = parts
            .extensions
            .get::<Arc<NcSession>>()
-            .map(|arc| (**arc).clone())
+            .cloned()
            .ok_or_else(|| StatusCode::UNAUTHORIZED.into_response())?;

        if let Some(url_user) = extract_url_user(parts.uri.path())
@@ -129,6 +156,6 @@ impl<S: Send + Sync> FromRequestParts<S> for NcSession {
            return Err(StatusCode::FORBIDDEN.into_response());
        }

-        Ok(session)
+        Ok(Self(session))
    }
 }
@@ -27,7 +27,7 @@ const HEADER_DAV: HeaderName = HeaderName::from_static("dav");
 pub async fn handle_nc_trashbin(
    state: Arc<AppState>,
    req: Request<Body>,
-    session: crate::interfaces::nextcloud::session::NcSession,
+    session: crate::interfaces::nextcloud::session::SharedNcSession,
    subpath: String,
 ) -> Result<Response<Body>, AppError> {
    let method = req.method().clone();
@@ -110,7 +110,7 @@ async fn session_bytes_so_far(
 pub async fn handle_nc_uploads(
    state: Arc<AppState>,
    req: Request<Body>,
-    session: crate::interfaces::nextcloud::session::NcSession,
+    session: crate::interfaces::nextcloud::session::SharedNcSession,
    upload_id: String,
    rest: String, // chunk name or ".file" or empty
 ) -> Result<Response<Body>, AppError> {
@@ -218,7 +218,7 @@ pub fn nc_href(username: &str, subpath: &str) -> String {
 pub async fn handle_nc_webdav(
    state: Arc<AppState>,
    req: Request<Body>,
-    session: crate::interfaces::nextcloud::session::NcSession,
+    session: crate::interfaces::nextcloud::session::SharedNcSession,
    subpath: String,
 ) -> Result<Response<Body>, AppError> {
    // Validate up-front that we have a chroot — every method below is
@@ -1566,19 +1566,29 @@ fn build_nc_streaming_propfind(
                }
                let batch_len = batch.len();

-                // Per-page enrichment: favorites + oc:fileids, two batch queries.
-                let favs = if let Some(fav) = fav_svc {
-                    let items: Vec<(&str, &str)> =
-                        batch.iter().map(|f| (f.id.as_str(), "file")).collect();
-                    fav.batch_check_favorites(user_id, &items).await.unwrap_or_default()
-                } else {
-                    HashSet::new()
-                };
+                // Per-page enrichment: favorites + oc:fileids + dead props —
+                // three independent reads over the same id batch, overlapped
+                // with `join!` so a page pays ~max(RTT) instead of 3×RTT
+                // (each query still batched per page: DEAD-PROPS.md). The
+                // round-7 deferred "serial pairs" item, adopted for this
+                // per-page triple after the injected-latency A/B in
+                // benches/ROUND9.md showed no local-PG regression.
+                let fav_items: Vec<(&str, &str)> =
+                    batch.iter().map(|f| (f.id.as_str(), "file")).collect();
                let file_uuids: Vec<&str> = batch.iter().map(|f| f.id.as_str()).collect();
-                let (file_id_map, _) = batch_resolve_ids(file_id_svc, &file_uuids, &[]).await;
-                // One batched dead-props query per page, not one per child
-                // (benches/DEAD-PROPS.md).
-                let file_deads = files_dead_props_map(&state.webdav_dead_props, &batch).await;
+                let (favs, (file_id_map, _), file_deads) = tokio::join!(
+                    async {
+                        if let Some(fav) = fav_svc {
+                            fav.batch_check_favorites(user_id, &fav_items)
+                                .await
+                                .unwrap_or_default()
+                        } else {
+                            HashSet::new()
+                        }
+                    },
+                    batch_resolve_ids(file_id_svc, &file_uuids, &[]),
+                    files_dead_props_map(&state.webdav_dead_props, &batch),
+                );

                let mut chunk = Vec::with_capacity(batch_len * 1024);
                {
@@ -1624,18 +1634,23 @@ fn build_nc_streaming_propfind(
                    break;
                }

-                let favs = if let Some(fav) = fav_svc {
-                    let items: Vec<(&str, &str)> =
-                        batch.iter().map(|sf| (sf.id.as_str(), "folder")).collect();
-                    fav.batch_check_favorites(user_id, &items).await.unwrap_or_default()
-                } else {
-                    HashSet::new()
-                };
+                // Same overlapped enrichment triple as the file pages above.
+                let fav_items: Vec<(&str, &str)> =
+                    batch.iter().map(|sf| (sf.id.as_str(), "folder")).collect();
                let folder_uuids: Vec<&str> = batch.iter().map(|sf| sf.id.as_str()).collect();
-                let (_, sub_id_map) = batch_resolve_ids(file_id_svc, &[], &folder_uuids).await;
-                // Batched — see benches/DEAD-PROPS.md.
-                let sub_deads =
-                    folders_dead_props_map(&state.webdav_dead_props, &batch).await;
+                let (favs, (_, sub_id_map), sub_deads) = tokio::join!(
+                    async {
+                        if let Some(fav) = fav_svc {
+                            fav.batch_check_favorites(user_id, &fav_items)
+                                .await
+                                .unwrap_or_default()
+                        } else {
+                            HashSet::new()
+                        }
+                    },
+                    batch_resolve_ids(file_id_svc, &[], &folder_uuids),
+                    folders_dead_props_map(&state.webdav_dead_props, &batch),
+                );

                let mut chunk = Vec::with_capacity(batch.len() * 1024);
                {