Oxicloud/benches/ROUND27.md

Round 27 — NextCloud PROPFIND oc:id per-row buffer (alloc), contact JSONB write direct-serialize (alloc)

Two behaviour-preserving allocation cuts from the ROUND25/26 backlog, each behind a counting-allocator BEFORE/AFTER gate that exit(1)s ("GATE FAIL … rollback") unless AFTER allocates strictly fewer than BEFORE.

Reproduce:

RUSTFLAGS="-C target-cpu=x86-64-v3" \
  cargo run --release --features bench --example bench_round27_micro

---

[H1] NextCloud PROPFIND: per-row oc:id String → one reused buffer per page

The streaming PROPFIND page loops built oc:id as a fresh String per child — format_oc_id(id, svc) = format!("{:08}{}", id, instance_id) — then passed oc_id.as_deref() into write_{file,folder}_response. The sibling per-row costs (href, etag, dates) were already reduced to a reused buffer / borrowed events (ROUND19 §M6, ROUND20 §C1); oc:id was explicitly left as the last per-row String (ROUND20 deferred). AFTER adds format_oc_id_into(&mut out, id, svc) (the 0-alloc form) and computes into one oc_buf reused across the page, alongside the existing href buffer — 1 String/row → 0 (amortized to one buffer per page). The write functions still take Option<&str>, so their signatures don't change; the emitted oc:id bytes are identical.

Scoped to the two PROPFIND page loops (the hot directory-listing path — the most common NextCloud operation). The lower-traffic REPORT/trashbin sites and the single-emit self-response sites are left as format_oc_id (see Not shipped).

arm	ns/op	allocs/op
BEFORE	34 185.3	1 000.00
AFTER	14 484.9	2.00

998 → 0 per-row allocs (2 amortized buffers for the whole page), 2.36× wall over a 500-row page. Gate: AFTER allocs/op strictly lower. Equivalence: the oc:id bytes from the reused buffer match format_oc_id for every id.

[P2] Contact create/update: throwaway serde_json::Value DOM → Json(&dtos) direct serialize

contact_pg_repository::{create,update}_contact built a throwaway serde_json::Value per JSONB column (serde_json::to_value(&email_dtos) etc.) and bound that — sqlx re-serializes the Value to JSONB bytes at encode time, so the flow was DTOs → Value DOM (alloc) → bytes, the tree discarded. AFTER binds sqlx::types::Json(&dtos), whose Encode runs serde_json::to_writer on the borrowed value straight into the JSONB buffer — no intermediate DOM. This is the write-side twin of the read-side ROUND23 §J1 fix. The old .unwrap_or(JsonValue::Null) fallback was effectively dead (serializing a Vec<plain-struct> can't fail).

arm	ns/op	allocs/op
BEFORE	781.8	21.00
AFTER	167.0	2.00

21 → 2 allocs (the whole Value DOM removed), 4.68× wall for a 3-entry column. Gate: AFTER allocs/op strictly lower.

Key-order note (behaviour-preserving, verified). serde_json::to_value backs the object with a sorted Map, so the BEFORE path emitted keys alphabetically (email,is_primary,type) while direct serialize keeps struct order (email,type,is_primary). This is not an observable change: Postgres normalizes JSONB key order on store, so both inputs land as the identical stored value — confirmed via psql ('{…alpha…}'::jsonb = '{…struct…}'::jsonb → t, both normalizing to {"type":…,"email":…,"is_primary":…}) — and the read path decodes by field name (ROUND23 §J1's Json<Vec<Dto>>), so the round-tripped Contact is identical. The contact etag is computed from the domain entity before the write, not from the stored JSONB, so it is unaffected. The benchmark's equivalence gate asserts the two serializations decode back to the same DTOs.

---

Not shipped — carried forward

• format_oc_id_into for the REPORT + trashbin loops. The four REPORT emit loops (report_handler) share the identical per-row-String shape and would take the same buffer treatment; the trashbin per-item writer (write_trash_item_response) would need the buffer threaded through its signature. Lower traffic than PROPFIND; deferred to keep this round's diff PROPFIND-local.
• S3 read zero-copy forward — needs a MinIO/stub ByteStream fixture.
• Frontend folder-listing cache — the dead getCachedFolder/cacheFolder SWR cache. A pure-frontend revival only saves latency (instant paint on revisit) because the /api/folders/{id}/resources feed carries no ETag, so the background revalidate still refetches the full body; the bandwidth win needs a backend /resources ETag + conditional 304, plus SWR wiring that respects the route's cursor pagination. A dedicated backend+frontend pass.

Environment / methodology

• Counting global allocator (examples/bench_round27_micro.rs), no Postgres. Each section is BEFORE (replica of the shipped-before shape) vs AFTER (replica of the shipped-after shape, which the source now matches), with a value-equivalence assertion (H1: identical oc:id bytes; P2: identical serialized JSONB) and a GATE FAIL … rollback exit(1) if AFTER doesn't allocate fewer than BEFORE.
• Built with RUSTFLAGS="-C target-cpu=x86-64-v3" (the checked-in .cargo/config.toml pins target-cpu=native, which SIGILLs on this host).
• Verified beyond the bench: cargo fmt --all --check clean, cargo clippy --features bench -- -D warnings clean, cargo test --lib --features bench green.