267 lines
13 KiB
Markdown
267 lines
13 KiB
Markdown
|
# Round 3 — listing/timeline SQL shapes, auth herd, blob-cache stampede, spool I/O, DTO allocs
|
||
|
|
|
||
|
|
Twelve benchmark-gated changes. Rule of the round (same as ROUND2): every
|
||
|
|
change ships with a BEFORE/AFTER benchmark; an AFTER that doesn't beat its
|
||
|
|
BEFORE gets rolled back — none did. Equivalence gates (byte-identical
|
||
|
|
output / identical row sequences) guard every behavior-preserving rewrite.
|
||
|
|
|
||
|
|
Measured on 4 cores / 15 GiB, local PostgreSQL 16 (fsync off), release
|
||
|
|
profile. Reproduce any row with the command in its section.
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
|
||
|
|
| # | change | key metric | before → after |
|
||
|
|
|--:|---|---|---|
|
||
|
|
| 1 | Web-UI listing keyset pushdown | ms/page p50, 20k-entry folder | 26.6 → 1.30 (**19.5x**) |
|
||
|
|
| 2 | Photos timeline LATERAL top-N | ms/page p50, 50k-photo library | 97.4 → 1.61 (**55.7x**) |
|
||
|
|
| 3 | PROPFIND subfolder keyset | full walk, 5k dirs | 79.7 → 17.9 ms (**4.5x**) |
|
||
|
|
| 4 | Basic-auth single-flight | herd CPU, 8 conns | 2620 → 300 ms (**8.7x**) |
|
||
|
|
| 5 | Blob-cache miss single-flight | remote fetches / wall | 16 → 1, 519 → 188 ms (**2.8x**) |
|
||
|
|
| 6 | Chunk-assembly read buffer 512K | wall / read syscalls | 251 → 109 ms (**2.3x**), 2580 → 340 |
|
||
|
|
| 7 | Chunk-spool BufWriter 512K | wall / write syscalls | 877 → 158 ms (**5.6x**), 12800 → 400 |
|
||
|
|
| 8 | S3/Azure unsynced PUT (no HEAD) | wall / requests, 500 chunks | 1604 → 868 ms (**1.8x**), 1000 → 500 |
|
||
|
|
| 9 | DTO mapping interning | allocs/row file / folder | 11.0 → 4.0, 11.8 → 1.0 |
|
||
|
|
| 10 | CardDAV REPORT dead work | 5k contacts, getetag | 55.7 → 5.7 ms (**9.8x**) |
|
||
|
|
| 11 | Search-cache byte weigher | retained RSS worst case | ~298 MiB → 31.9 MiB (bounded) |
|
||
|
|
| 12 | Drop aws-config/aws-smithy-types | dep-graph nodes | 1728 → 1646 |
|
||
|
|
|
||
|
|
Frontend (gated by vitest, `frontend/src/lib/utils/formatDate.bench.test.ts`):
|
||
|
|
cached `Intl.DateTimeFormat` — 20k dates 2612 → 50.6 ms (**51.6x**), output
|
||
|
|
identity asserted across locales.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## [1] Web-UI folder listing — whole-folder rescan → per-branch keyset — 19.5x
|
||
|
|
|
||
|
|
`list_resources_paged` (SPA files view) applied its keyset cursor OUTSIDE
|
||
|
|
the folders/files UNION-ALL on computed columns (`sort_str = LOWER(name)`,
|
||
|
|
`folder_first`), so Postgres re-scanned and top-N-sorted every remaining
|
||
|
|
row of the folder on every page (EXPLAIN: Seq Scan, 17,999 rows removed by
|
||
|
|
filter, 29 ms / 565 buffers per 200-row page on a 20k-file folder).
|
||
|
|
|
||
|
|
Now the cursor is pushed into each branch as a sargable row-value
|
||
|
|
comparison on base columns (`(LOWER(name), id) > ($str, $id)`), constants
|
||
|
|
folded per branch in Rust (a cursor in the file group drops the folder
|
||
|
|
branch outright), each branch pre-sorts + pre-limits, and the outer query
|
||
|
|
merges ≤ 2·limit rows. Two new expression indexes (migration
|
||
|
|
`20260918000000`): `idx_files_folder_lname (folder_id, LOWER(name), id)`
|
||
|
|
and `idx_folders_parent_lname (parent_id, LOWER(name), id)`, both partial
|
||
|
|
on `NOT is_trashed`.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_listing_keyset
|
||
|
|
# full drain, 20k files + 300 dirs, 200/page total ms p50/pg p99/pg
|
||
|
|
# name OLD/no-idx 2717.2 26.57 33.55
|
||
|
|
# name OLD/idx (indexes alone don't help) 2786.8 27.83 35.62
|
||
|
|
# name NEW/idx 139.6 1.30 1.81 19.5x
|
||
|
|
# modified_at OLD → NEW (no dedicated index) 1653.4 → 1367.5 1.2x
|
||
|
|
```
|
||
|
|
|
||
|
|
Equivalence: the drained `(type, id)` sequence is asserted identical across
|
||
|
|
all modes and both sort orders; the example exits 1 on mismatch.
|
||
|
|
|
||
|
|
## [2] Photos timeline — full-library scan → per-drive LATERAL top-N — 55.7x
|
||
|
|
|
||
|
|
`list_media_files` claimed `idx_files_media_timeline_by_drive` let LIMIT
|
||
|
|
stop the scan early; EXPLAIN refuted it — the folders/file_metadata joins
|
||
|
|
and the global sort sat ABOVE the `drive_id IN (grants)` nested loop, so
|
||
|
|
every page fed the ENTIRE media library through the join into a top-N
|
||
|
|
heapsort. Now the accessible drive ids materialise once, a
|
||
|
|
`CROSS JOIN LATERAL (… ORDER BY media_sort_date DESC LIMIT k)` per drive
|
||
|
|
does one bounded index scan each, and the joins run on the k emitted rows
|
||
|
|
only.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_photos_timeline
|
||
|
|
# 10 pages of 100, 50k photos, 3 drives total ms p50 ms/page
|
||
|
|
# OLD 1032.1 97.41
|
||
|
|
# NEW 18.5 1.61 55.7x
|
||
|
|
```
|
||
|
|
|
||
|
|
Equivalence: page-by-page id sequences asserted identical (seed uses
|
||
|
|
strictly distinct capture dates so ties can't mask reordering).
|
||
|
|
|
||
|
|
## [3] PROPFIND subfolder paging — LIMIT/OFFSET + COUNT(*) OVER() → keyset — 4.5x
|
||
|
|
|
||
|
|
The exact quadratic shape PROPFIND-PAGING fixed for files still applied to
|
||
|
|
sub-folders on both DAV surfaces: every page window-aggregated and
|
||
|
|
re-scanned all N sub-folders, and the total was only used for `has_next`.
|
||
|
|
New `FolderRepository::list_folders_batch` (keyset `name > $last`, served
|
||
|
|
by the existing `idx_folders_unique_name`, no migration) wired into both
|
||
|
|
streaming PROPFIND walkers via `list_folders_batch_with_perms` (same
|
||
|
|
per-batch authz as before).
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_folder_keyset
|
||
|
|
# full walk, 5k dirs, 500/page total ms p50 ms/page
|
||
|
|
# OFFSET 79.7 6.54
|
||
|
|
# KEYSET 17.9 1.64 4.5x
|
||
|
|
```
|
||
|
|
|
||
|
|
## [4] Basic-auth cache — thundering herd → single-flight — 8.7x CPU
|
||
|
|
|
||
|
|
Every DAV/NC request authenticates via `verify_basic_auth`. On a cache
|
||
|
|
miss each concurrent caller independently ran the full slow path — an
|
||
|
|
Argon2id verification (m=64 MiB, t=3, p=2 ≈ 290 ms CPU here) apiece. DAV
|
||
|
|
sync clients hold 4-8 parallel connections, so every TTL expiry (300 s)
|
||
|
|
fanned out K verifications: a recurring p99 spike + CPU/RAM burst.
|
||
|
|
`try_get_with` now coalesces concurrent misses; errors are never cached
|
||
|
|
(brute-force cost preserved), revocation via `invalidate_entries_if`
|
||
|
|
unchanged.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_auth_herd
|
||
|
|
# herd of 8, cold cache wall ms CPU ms verifications
|
||
|
|
# BEFORE (per-caller) 764 2620 9.0
|
||
|
|
# AFTER (single-flight) 311 300 1.0
|
||
|
|
# warm hit p50: 0.6 us
|
||
|
|
```
|
||
|
|
|
||
|
|
## [5] CachedBlobBackend — miss stampede → per-hash single-flight — 16 fetches → 1
|
||
|
|
|
||
|
|
K concurrent cold readers of one blob (video player's parallel Range
|
||
|
|
probes; N clients pulling the same new file) each downloaded the FULL blob
|
||
|
|
from S3/Azure — and raced truncating writes on ONE deterministic `.tmp`
|
||
|
|
path (a torn interleaving could be renamed into the cache). Fixes: a
|
||
|
|
per-hash DashMap gate (leader fetches, waiters re-check and serve
|
||
|
|
locally), plus unique `.{uuid}.tmp` names + error-path cleanup so a
|
||
|
|
corrupt file can never land at the final path.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_blob_cache
|
||
|
|
# 16 cold readers, 32 MiB blob, shared 1 GiB/s link wall ms fetches remote MiB
|
||
|
|
# BEFORE (per-caller) 519 16 512
|
||
|
|
# AFTER (single-flight) 188 1 32
|
||
|
|
# gates: fetch count == 1; BLAKE3 of served + durable cache file == source
|
||
|
|
```
|
||
|
|
|
||
|
|
## [6][7] Upload spool I/O — 64 KiB reads, unbuffered frame writes
|
||
|
|
|
||
|
|
Assembly read (`stream_from_files`, the single read pass over every
|
||
|
|
completed chunked upload) used 64 KiB `ReaderStream` polls — one
|
||
|
|
blocking-pool dispatch + read(2) each — while every other blob path uses
|
||
|
|
256 KiB+. Capacity sweep picked 512 KiB. Chunk-spool writes
|
||
|
|
(`stream_body_to_path`, every chunk PUT on both surfaces) went straight to
|
||
|
|
a bare tokio File — one dispatch + write(2) per ~16-64 KiB HTTP frame; now
|
||
|
|
wrapped in `BufWriter::with_capacity(512 KiB)` like the dedup handler's
|
||
|
|
spool loop.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_upload_spool
|
||
|
|
# [1] read 16 x 10 MiB parts wall ms read syscalls
|
||
|
|
# 64K (BEFORE) 250.8 2580
|
||
|
|
# 256K 125.1 660
|
||
|
|
# 512K (AFTER) 108.8 340 2.3x
|
||
|
|
# 1M 111.3 180
|
||
|
|
# [2] spool 640 x 16 KiB frames x 20 files
|
||
|
|
# bare File (BEFORE) 877.4 12800 syscw
|
||
|
|
# BufWriter 512K (AFTER) 157.9 400 syscw 5.6x
|
||
|
|
```
|
||
|
|
|
||
|
|
## [8] S3/Azure chunk writes — HEAD-before-PUT → unconditional PUT — 1.8x
|
||
|
|
|
||
|
|
Neither remote backend overrode `put_blob_from_bytes_unsynced`, so the
|
||
|
|
dedup settle path (every NEW chunk of every upload) routed through
|
||
|
|
`put_blob_from_bytes` and its "idempotent" HEAD/get_properties probe —
|
||
|
|
2 round-trips per chunk for chunks the dedup layer already knows are new.
|
||
|
|
Content-addressed keys make re-PUTs overwrite-safe, so the new overrides
|
||
|
|
PUT directly. Azure additionally stopped copying every chunk
|
||
|
|
(`data.to_vec()` → `Bytes` into `azure_core::Body`): 0.44 ms + 4 MiB
|
||
|
|
transient alloc per 4 MiB chunk removed.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_s3_put
|
||
|
|
# 500 x 256 KiB chunks, concurrency 8, 10 ms/request stub
|
||
|
|
# BEFORE (HEAD+PUT) 1604 ms 500 HEADs + 500 PUTs
|
||
|
|
# AFTER (PUT only) 868 ms 500 PUTs 1.8x
|
||
|
|
```
|
||
|
|
|
||
|
|
## [9] Entity → DTO mapping — closed-set interning + 1-alloc formatting
|
||
|
|
|
||
|
|
`Arc::<str>::from(&'static str)` always allocates+copies, so every file
|
||
|
|
row paid 4 allocations for values drawn from a ~60-string closed set
|
||
|
|
(icon class, special class, category, mime), plus 2-alloc etag and 2-alloc
|
||
|
|
size formatting; FolderDto additionally built its etag twice and cloned 4
|
||
|
|
Strings it could move. Now: `LazyLock` intern tables (lookup + refcount
|
||
|
|
bump; unknown values fall back to `Arc::from`, same bytes), single-alloc
|
||
|
|
`compute_etag`/`format_file_size`, and `Folder::into_parts()` moves.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_dto_map
|
||
|
|
# 10k rows ns/row allocs/row
|
||
|
|
# File→FileDto BEFORE 1229.2 10.96
|
||
|
|
# File→FileDto AFTER 1004.9 3.96
|
||
|
|
# Folder→FolderDto BEFORE 425.2 11.80
|
||
|
|
# Folder→FolderDto AFTER 204.5 1.00
|
||
|
|
# gate: all DTO fields byte-identical BEFORE vs AFTER (10k files + 10k folders)
|
||
|
|
```
|
||
|
|
|
||
|
|
## [10] CardDAV REPORT — dead double vCard generation + O(N²) scan — 9.8x
|
||
|
|
|
||
|
|
`handle_report` pre-generated a vCard for EVERY contact; the adapter then
|
||
|
|
did a linear uid `find` per contact — O(N²) string compares — and
|
||
|
|
DISCARDED the result (`let _ = vcard`), regenerating on demand inside
|
||
|
|
`write_contact_response` anyway. Pure dead work, deleted; `contact_to_vcard`
|
||
|
|
also switched `push_str(&format!(…))` → `write!` (one temp String per
|
||
|
|
vCard line removed).
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_carddav_report
|
||
|
|
# N=5000 getetag 55.7 → 5.7 ms 9.8x
|
||
|
|
# N=5000 getetag+address-data 76.2 → 15.3 ms 5.0x
|
||
|
|
# gate: REPORT XML byte-identical BEFORE vs AFTER for all prop sets
|
||
|
|
```
|
||
|
|
|
||
|
|
## [11] Search-results cache — entry count → byte weigher — bounded RSS
|
||
|
|
|
||
|
|
The cache was capped at 1000 ENTRIES with a 300 s TTL; each entry holds up
|
||
|
|
to 500 enriched rows (~10 owned Strings each) and keys include
|
||
|
|
user+query+offset+limit, so every keystroke/page/user minted an entry —
|
||
|
|
~300 MiB of invisible RSS was reachable. Now a byte weigher + 32 MiB
|
||
|
|
budget (`OXICLOUD_SEARCH_CACHE_MAX_BYTES`), same TTL, same read latency.
|
||
|
|
|
||
|
|
```
|
||
|
|
cargo run --release --features bench --example bench_search_cache_mem
|
||
|
|
# 1000 pages x 500 rows retained bytes get() p50
|
||
|
|
# BEFORE (1000 entries) ~298 MiB (9.3x) 155 ns
|
||
|
|
# AFTER (32 MiB weigher) 31.9 MiB 155 ns parity 1.00x
|
||
|
|
```
|
||
|
|
|
||
|
|
## [12] Cargo — drop aws-config + aws-smithy-types
|
||
|
|
|
||
|
|
Both were direct dependencies with ZERO references in the codebase —
|
||
|
|
`S3BlobBackend` builds its client purely from `aws_sdk_s3::config` with
|
||
|
|
static credentials. `aws-config` alone dragged aws-sdk-sso, aws-sdk-ssooidc
|
||
|
|
and aws-sdk-sts into every build. Dependency-graph nodes: 1728 → 1646.
|
||
|
|
`tokio`'s `process` feature (used by the ffmpeg thumbnailer) was only
|
||
|
|
enabled transitively through aws-config's feature unification — it is now
|
||
|
|
declared explicitly.
|
||
|
|
|
||
|
|
## Frontend — cached Intl.DateTimeFormat — 51.6x
|
||
|
|
|
||
|
|
`formatDate` (and four sibling callsites) constructed a fresh
|
||
|
|
`Intl.DateTimeFormat` per call (~131 µs each here) — paid roughly twice
|
||
|
|
per row while rendering/scrolling file lists. Module-scope cache keyed by
|
||
|
|
(locale, options), invalidated on `languagechange`.
|
||
|
|
|
||
|
|
```
|
||
|
|
cd frontend && npx vitest run src/lib/utils/formatDate.bench.test.ts
|
||
|
|
# 20k dates: cached 50.6 ms vs per-call 2612.0 ms (51.6x); output-identity
|
||
|
|
# matrix across en/es/ar/ja and every option shape used by the app
|
||
|
|
```
|
||
|
|
|
||
|
|
## Audited but NOT adopted (for the record)
|
||
|
|
|
||
|
|
- **Fat LTO / panic=abort / OpenAPI LazyLock**: refuted by the verification
|
||
|
|
pass (sub-1% plausible gain, or cold paths; `catch_unwind` shields
|
||
|
|
pdf-extract so panic=abort is off the table).
|
||
|
|
- **Chained clone-on-hit drive caches, localeCompare→Intl.Collator**:
|
||
|
|
measured previously — residual gains are noise or regressions
|
||
|
|
(benches/CHROOT-CACHE.md, benches/NPLUS1-AND-CACHES.md).
|
||
|
|
- **Follow-ups worth a future round** (confirmed real, not yet gated):
|
||
|
|
grouped/swimlane files view is unvirtualized (10k-row DOM); Azure
|
||
|
|
download path buffers whole blobs in RAM (needs an Azurite-gated bench);
|
||
|
|
face-indexing spawns unbounded per-image tasks; WebDAV drive-selector
|
||
|
|
resolution re-runs the grants join per request (cacheable like
|
||
|
|
CHROOT-CACHE); `make_file_path` split→rejoin + NFC copy per listing row.
|