perf: round 9 — decorator PUT reactivation, session/search/dedup alloc purges, PROPFIND join!, folder-level cascade

Benchmark-gated round (benches/ROUND9.md): every change carries a
BEFORE/AFTER bench with equivalence/safety gates; verdicts below are from
the committed harnesses on 4 cores / local PG 16.

Backend:
- Blob decorators (Retry/Cached) now forward put_blob_from_bytes_unsynced
  + sync_blobs — the trait default had silently reinstated HEAD-before-PUT
  per chunk on decorated remote stacks, undoing ROUND3 §8. Full production
  stack: 500 probes -> 0, 1.9x wall at 10 ms RTT (bench_s3_put §3).
- NC PROPFIND per-page enrichment triple (favorites / oc:fileid / dead
  props) overlapped with tokio::join!: 2.07x local, 2.86x at 5 ms RTT
  (bench_nc_enrich_join, injected-latency decide-by-bench).
- Search enrichment consumes its DTOs and carries the interned Arc<str>
  display fields end-to-end (SearchFileResultDto type change, OpenAPI
  shape preserved): enrich_file 2.0x, 11.6 -> 2.2 allocs/row; the NC
  REPORT conversion stops re-running all three classifiers per row
  (bench_search_enrich).
- NC session Arc end-to-end: SharedNcSession extractor (8 -> 0 allocs),
  Arc<FolderDto> chroot cache (4 -> 0/hit), single shared Arc<CurrentUser>
  + lazy span render (11 -> 6/build) (bench_nc_session).
- Storage micro-pack: atomic create_new chunk writes (2.1x fresh),
  stream_chunks over the manifest Arc (4097 -> 0 allocs/read incl. the
  Range path), manifest single-flight (herd 64 -> 1 loads), hex_lower for
  chunk Content-MD5 (18 -> 1 allocs) (bench_storage_micro).
- OCS capabilities memoized into OnceLock<[Bytes;2]>: 237x, 102 -> 0
  allocs/poll, byte-identical (bench_capabilities_static).
- Drive::is_empty COUNT(*) sum -> EXISTS: 34.4x on a 100k-file drive
  (bench_drive_is_empty).
- favorites/recents row-map ROUND7 port: path/name/blob_hash moved,
  -2.75 allocs/row (bench_resource_row_map §2).
- Folder rows decode binary UUIDs (ROUND6 §10 port): 1.03-1.07x page
  fetch, honest verdict incl. one noise-band wash documented
  (bench_folder_uuid_decode).
- Authz: file cascade decision decomposed into memoized folder-level
  decision + direct-grant lookup (ROUND8 deferred item). Cold shared-album
  first view 592 -> 418 µs/thumb; warm path unchanged; safety gates incl.
  new direct-grant sibling isolation, revoke-flush re-verified, full
  integration authz suite green (bench_thumbnail_cascade_cache).

Frontend (vitest gates committed beside the code):
- resolveLabel/resolveRecipient O(directory) scan -> id-keyed Map: 13.9x
  (recipients.bench.test.ts).
- ResourceList selection-prune effect skips when nothing is selected
  (100 -> 0 Set builds per drain) and the photos timeline reads a
  listener-fed mobile flag instead of matchMedia per recompute
  (listDerives.bench.test.ts).

Verification: cargo fmt + clippy --all-features --all-targets -D warnings
clean; 524 unit + 554 integration (--cfg integration_tests) tests pass;
frontend npm run check clean with 293 vitest tests green.

Deferred with rationale in ROUND9.md: CalDAV authz-before-fetch reorder
(maintainer sign-off), per-page batched parent resolution, JWT-claims
Arc<str>, batch_operations signature widening.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XDc9VtXvskJ6dnMRraSndn

src/interfaces/nextcloud/session.rs

@@ -3,8 +3,9 @@
 //! Bundles WHO the caller is, the raw wire username they presented,
 //! and (for path-scoped endpoints) WHERE they're confined to. Built
 //! by `basic_auth_middleware` and stashed in request extensions as
-//! `Arc<NcSession>`; handlers extract it via the [`FromRequestParts`]
-//! impl below — just declare `session: NcSession` in the signature.
+//! `Arc<NcSession>`; handlers extract it via [`SharedNcSession`]
+//! (derefs to `NcSession`) — declare `session: SharedNcSession` in
+//! the signature.
 //!
 //! ## Source of truth
 //!
@@ -46,9 +47,13 @@ use crate::interfaces::middleware::auth::CurrentUser;
 
 #[derive(Debug, Clone)]
 pub struct NcSession {
-    pub user: CurrentUser,
+    /// Shared with the `Arc<CurrentUser>` request extension — one identity
+    /// build per request instead of a clone per consumer.
+    pub user: Arc<CurrentUser>,
     pub raw_username: String,
-    pub chroot: Option<FolderDto>,
+    /// Shared with `NC_CHROOT_CACHE` (markerless branch) — a cache hit is
+    /// an `Arc` bump, not a `FolderDto` deep-clone.
+    pub chroot: Option<Arc<FolderDto>>,
 }
 
 impl NcSession {
@@ -56,7 +61,7 @@ impl NcSession {
     /// without one. Documents the invariant that every NC route
     /// today is path-scoped — if this fires, route wiring is wrong.
     pub fn require_chroot(&self) -> Result<&FolderDto, AppError> {
-        self.chroot.as_ref().ok_or_else(|| {
+        self.chroot.as_deref().ok_or_else(|| {
             AppError::internal_error(
                 "NcSession: path-scoped handler reached without a chroot — route wiring bug",
             )
@@ -101,10 +106,13 @@ fn extract_url_user(path: &str) -> Option<String> {
     urlencoding::decode(user_seg).ok().map(|s| s.into_owned())
 }
 
-/// Axum extractor: pulls the `Arc<NcSession>` that
-/// `basic_auth_middleware` stashed in request extensions and clones
-/// it (cheap — one `Arc` increment, no field copy) into an owned
-/// `NcSession` for handler use.
+/// Axum extractor: the shared handle to the request's [`NcSession`].
+///
+/// Derefs to `NcSession`, so handler bodies read `session.user`,
+/// `session.require_chroot()`, … unchanged. Extraction is one `Arc`
+/// refcount increment — the previous extractor deep-cloned the whole
+/// session (`CurrentUser` + `raw_username` + chroot `FolderDto`, ~8-9
+/// `String` allocs) on every authenticated NC request.
 ///
 /// On path-scoped DAV routes (`/remote.php/dav/{files,uploads,
 /// trashbin}/{user}/…`), the URL `{user}` segment is cross-checked
@@ -113,14 +121,33 @@ fn extract_url_user(path: &str) -> Option<String> {
 /// (`get_folder_with_perms`) is what actually prevents cross-user
 /// access. It just surfaces malformed requests early (403) instead
 /// of silently letting them through.
-impl<S: Send + Sync> FromRequestParts<S> for NcSession {
+#[derive(Debug, Clone)]
+pub struct SharedNcSession(Arc<NcSession>);
+
+impl SharedNcSession {
+    /// Wrap an already-shared session (used by the bench harness; the
+    /// middleware inserts the `Arc` into request extensions directly).
+    pub fn from_arc(session: Arc<NcSession>) -> Self {
+        Self(session)
+    }
+}
+
+impl std::ops::Deref for SharedNcSession {
+    type Target = NcSession;
+
+    fn deref(&self) -> &NcSession {
+        &self.0
+    }
+}
+
+impl<S: Send + Sync> FromRequestParts<S> for SharedNcSession {
     type Rejection = Response;
 
     async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
         let session = parts
             .extensions
             .get::<Arc<NcSession>>()
-            .map(|arc| (**arc).clone())
+            .cloned()
             .ok_or_else(|| StatusCode::UNAUTHORIZED.into_response())?;
 
         if let Some(url_user) = extract_url_user(parts.uri.path())
@@ -129,6 +156,6 @@ impl<S: Send + Sync> FromRequestParts<S> for NcSession {
             return Err(StatusCode::FORBIDDEN.into_response());
         }
 
-        Ok(session)
+        Ok(Self(session))
     }
 }