perf: round 7 — photos timeline O(N²)→incremental, range-seek authz duplication, resources row-map clone

Benchmark-gated (equivalence + BEFORE/AFTER; results + reproduce commands in
benches/ROUND7.md):

- Photos timeline re-grouped + re-laid-out the whole accumulated library on
  every 60-item page (both `groups` and `photoRows` were $derived over the
  full list), Σ ≈ O(N²/60) main-thread work during a scroll. Pages arrive
  newest-first so grouping is append-only: the new PhotoTimeline
  (lib/utils/photoTimeline.ts) re-buckets only the fresh page and re-lays-out
  only changed groups, reusing untouched groups' cached rows, falling back to
  a full rebuild on any config/deletion/non-append change. The pure
  buildPhotoRows is the verbatim reference the gate holds it equal to at every
  page. 50×60 drain: 76 500 → 3 000 grouping ops (25.5x), 23.0 → 2.2 ms
  (10.6x).

- Range downloads paid authz + access-notify twice: download_file_impl
  resolves the file via get_file_with_perms, then the Range branch re-ran
  require_file + notify_file_accessed per request. Media/PDF viewers fetch
  exclusively via Range (one request per seek), so every seek in a scrub
  re-authorized an already-cleared file. Now routed through the non-perms
  get_file_range_preloaded (matching the share-landing + WebDAV range paths);
  the unused _with_perms range method is removed. The request-level gate still
  denies before the branch runs (bench asserts member granted, outsider
  denied). Per seek removed: WARM 0.67 µs, COLD 1362.66 µs — a grant-cascade
  drive-resolve query per seek for a shared-drive recipient on a cold cache.

- /api/folders/{id}/resources row→DTO mapping cloned row.name into the DTO
  though the row is owned; folders move it (fixed icons), files compute the
  name-derived icon/category classes first then move it. 500-row page:
  10.004 → 9.004 allocs/row (500 clones removed), output identical.

Deferred with rationale in ROUND7.md: thumbnail ACL-before-304 (security
posture — needs a security review, not a perf tweak), batch_operations
Arc<str>→String widening, list-view O(N²) on smaller lists, and the serial→
join! pairs (decide-by-bench with injected latency, per the round-6 rejection).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aJu9ghvuT8WqC31ZEGTBA

examples/bench_range_seek_authz.rs

@@ -0,0 +1,283 @@
+//! Range-seek per-request authz duplication benchmark.
+//!
+//! `download_file_impl` calls `get_file_with_perms` once (authz + access
+//! notify + metadata) and THEN, in the Range branch, called
+//! `get_file_range_preloaded_with_perms` — which re-ran `require_file`
+//! (authz) + `notify_file_accessed` per request. Media players and PDF
+//! viewers fetch a file *exclusively* through Range requests: a `bytes=0-`
+//! probe then one request per seek. So every seek in a scrub re-authorized a
+//! file the request-level gate had already cleared.
+//!
+//! Round 7 drops the range branch to the non-perms `get_file_range_preloaded`
+//! (the share-landing and WebDAV range paths already do exactly this). This
+//! bench isolates the per-seek `require` that AFTER eliminates, driving the
+//! REAL `PgAclEngine`:
+//!   - WARM: the cache the initial `get_file_with_perms` warmed — each removed
+//!     seek-check was a moka hit + uuid parse (pure CPU/alloc).
+//!   - COLD: a shared-drive recipient whose drive-role cache expired mid-scrub
+//!     (30 s TTL) — each removed seek-check was a full drive-resolve query.
+//!
+//! Safety gate: the surviving request-level gate still authorizes correctly —
+//! the member is granted, a non-member is denied — so removing the per-seek
+//! re-check bypasses nothing.
+//!
+//! Run (needs Postgres up; reads DATABASE_URL from .env):
+//!   cargo run --release --features bench --example bench_range_seek_authz
+//! Tunables (env): BENCH_SEEKS (200), BENCH_POOL (8).
+
+use std::env;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use oxicloud::application::ports::authorization_ports::AuthorizationEngine;
+use oxicloud::domain::services::authorization::{Permission, Resource, Subject};
+use oxicloud::infrastructure::repositories::pg::{
+    FileBlobReadRepository, FolderDbRepository, SubjectGroupPgRepository,
+};
+use oxicloud::infrastructure::services::dedup_service::DedupService;
+use oxicloud::infrastructure::services::local_blob_backend::LocalBlobBackend;
+use oxicloud::infrastructure::services::pg_acl_engine::PgAclEngine;
+use sqlx::PgPool;
+use sqlx::postgres::PgPoolOptions;
+use uuid::Uuid;
+
+fn env_or<T: std::str::FromStr>(key: &str, default: T) -> T {
+    env::var(key)
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(default)
+}
+
+struct Seeded {
+    member: Uuid,
+    outsider: Uuid,
+    drive_id: Uuid,
+    root_folder: Uuid,
+    blob_hash: String,
+    file_id: Uuid,
+}
+
+async fn seed(pool: &PgPool) -> Seeded {
+    let mut tx = pool.begin().await.expect("begin");
+    let member: Uuid = sqlx::query_scalar(
+        "INSERT INTO auth.users (username, email, role)
+         VALUES ('bench_rangeseek', 'bench_rangeseek@bench.invalid', 'user') RETURNING id",
+    )
+    .fetch_one(&mut *tx)
+    .await
+    .expect("seed member");
+    let outsider: Uuid = sqlx::query_scalar(
+        "INSERT INTO auth.users (username, email, role)
+         VALUES ('bench_rangeseek_out', 'bench_rangeseek_out@bench.invalid', 'user') RETURNING id",
+    )
+    .fetch_one(&mut *tx)
+    .await
+    .expect("seed outsider");
+
+    let drive_id: Uuid =
+        sqlx::query_scalar("INSERT INTO storage.drives (kind) VALUES ('shared') RETURNING id")
+            .fetch_one(&mut *tx)
+            .await
+            .expect("seed drive");
+    let root_folder: Uuid = sqlx::query_scalar(
+        "INSERT INTO storage.folders (name, path, lpath, drive_id)
+         VALUES ('Bench Seek', '/Bench Seek', 'x', $1) RETURNING id",
+    )
+    .bind(drive_id)
+    .fetch_one(&mut *tx)
+    .await
+    .expect("seed folder");
+    sqlx::query("UPDATE storage.drives SET root_folder_id = $1 WHERE id = $2")
+        .bind(root_folder)
+        .bind(drive_id)
+        .execute(&mut *tx)
+        .await
+        .expect("stamp root");
+    sqlx::query(
+        "INSERT INTO storage.role_grants
+             (subject_type, subject_id, resource_type, resource_id, role, granted_by)
+         VALUES ('user', $1, 'drive', $2, 'viewer'::storage.grant_role, $1)",
+    )
+    .bind(member)
+    .bind(drive_id)
+    .execute(&mut *tx)
+    .await
+    .expect("seed grant");
+
+    let blob_hash = "benchrangeseek00000000000000000000000000000000000000000000000b3".to_string();
+    sqlx::query("INSERT INTO storage.blobs (hash, size, ref_count) VALUES ($1, 1048576, 1)")
+        .bind(&blob_hash)
+        .execute(&mut *tx)
+        .await
+        .expect("seed blob");
+    let file_id: Uuid = sqlx::query_scalar(
+        "INSERT INTO storage.files (name, folder_id, blob_hash, size, mime_type, drive_id)
+         VALUES ('clip.mp4', $1, $2, 1048576, 'video/mp4', $3) RETURNING id",
+    )
+    .bind(root_folder)
+    .bind(&blob_hash)
+    .bind(drive_id)
+    .fetch_one(&mut *tx)
+    .await
+    .expect("seed file");
+    tx.commit().await.expect("commit");
+    Seeded {
+        member,
+        outsider,
+        drive_id,
+        root_folder,
+        blob_hash,
+        file_id,
+    }
+}
+
+async fn cleanup(pool: &PgPool, s: &Seeded) {
+    let _ = sqlx::query("DELETE FROM storage.role_grants WHERE resource_id = $1")
+        .bind(s.drive_id)
+        .execute(pool)
+        .await;
+    let _ = sqlx::query("DELETE FROM storage.files WHERE drive_id = $1")
+        .bind(s.drive_id)
+        .execute(pool)
+        .await;
+    let _ = sqlx::query("DELETE FROM storage.drives WHERE id = $1")
+        .bind(s.drive_id)
+        .execute(pool)
+        .await;
+    let _ = sqlx::query("DELETE FROM storage.folders WHERE id = $1")
+        .bind(s.root_folder)
+        .execute(pool)
+        .await;
+    let _ = sqlx::query("DELETE FROM storage.blobs WHERE hash = $1")
+        .bind(&s.blob_hash)
+        .execute(pool)
+        .await;
+    let _ = sqlx::query("DELETE FROM auth.users WHERE id IN ($1, $2)")
+        .bind(s.member)
+        .bind(s.outsider)
+        .execute(pool)
+        .await;
+}
+
+fn fresh_engine(pool: &Arc<PgPool>) -> Arc<PgAclEngine> {
+    let folder_repo = Arc::new(FolderDbRepository::new(pool.clone()));
+    let backend = Arc::new(LocalBlobBackend::new(std::path::Path::new(
+        "/tmp/bench-rangeseek-blobs",
+    )));
+    let dedup = Arc::new(DedupService::new(backend, pool.clone(), pool.clone()));
+    let file_repo = Arc::new(FileBlobReadRepository::new(
+        pool.clone(),
+        dedup,
+        folder_repo.clone(),
+    ));
+    let group_repo = Arc::new(SubjectGroupPgRepository::new(pool.clone()));
+    Arc::new(PgAclEngine::new(
+        pool.clone(),
+        folder_repo,
+        file_repo,
+        group_repo,
+    ))
+}
+
+/// The per-seek check the range branch used to run (verbatim: uuid parse +
+/// `authz.require`, exactly `require_file`'s body).
+async fn seek_require(engine: &Arc<PgAclEngine>, caller: Uuid, file_id: Uuid) -> bool {
+    engine
+        .require(
+            Subject::User(caller),
+            Permission::Read,
+            Resource::File(file_id),
+        )
+        .await
+        .is_ok()
+}
+
+#[tokio::main(flavor = "multi_thread")]
+async fn main() {
+    dotenvy::dotenv().ok();
+    let url = env::var("DATABASE_URL")
+        .or_else(|_| env::var("OXICLOUD_DB_CONNECTION_STRING"))
+        .expect("set DATABASE_URL — the dev Postgres URL");
+    let seeks: usize = env_or("BENCH_SEEKS", 200);
+    let pool_size: u32 = env_or("BENCH_POOL", 8);
+
+    let pool = Arc::new(
+        PgPoolOptions::new()
+            .max_connections(pool_size)
+            .min_connections(pool_size)
+            .acquire_timeout(Duration::from_secs(10))
+            .connect(&url)
+            .await
+            .expect("connect Postgres"),
+    );
+
+    let s = seed(&pool).await;
+
+    // ── Safety gate: the surviving request-level gate authorizes correctly ──
+    let gate = fresh_engine(&pool);
+    let member_ok = seek_require(&gate, s.member, s.file_id).await;
+    let outsider_denied = !seek_require(&gate, s.outsider, s.file_id).await;
+    if !member_ok || !outsider_denied {
+        eprintln!(
+            "SAFETY GATE FAILED: member_ok={member_ok} outsider_denied={outsider_denied} \
+             (the single request-level authz must still grant the member and deny the outsider)"
+        );
+        cleanup(&pool, &s).await;
+        std::process::exit(1);
+    }
+
+    println!("\n#################################################################");
+    println!("# range-seek authz duplication: per-seek require (BEFORE) vs 0 (AFTER)");
+    println!("# seeks/scrub={seeks}  (member of a shared drive, viewer grant)");
+    println!("#################################################################\n");
+    println!("| {:<26} | {:>10} | {:>12} |", "arm", "wall ms", "µs/seek");
+
+    // WARM: one require warms owner_cache + drive_role_cache (as the handler's
+    // get_file_with_perms does), then the scrub's per-seek re-checks are moka
+    // hits — pure CPU/alloc the AFTER path removes.
+    {
+        let engine = fresh_engine(&pool);
+        seek_require(&engine, s.member, s.file_id).await; // warm
+        let t = Instant::now();
+        for _ in 0..seeks {
+            std::hint::black_box(seek_require(&engine, s.member, s.file_id).await);
+        }
+        let el = t.elapsed();
+        println!(
+            "| {:<26} | {:>10.2} | {:>12.2} |",
+            "BEFORE per-seek (WARM)",
+            el.as_secs_f64() * 1e3,
+            el.as_secs_f64() * 1e6 / seeks as f64
+        );
+    }
+
+    // COLD: a fresh engine per seek models a cross-drive recipient or a
+    // drive-role-cache entry that expired mid-scrub (30 s TTL) — each removed
+    // re-check was a full grant-cascade drive-resolve query.
+    {
+        let t = Instant::now();
+        for _ in 0..seeks {
+            let engine = fresh_engine(&pool);
+            std::hint::black_box(seek_require(&engine, s.member, s.file_id).await);
+        }
+        let el = t.elapsed();
+        println!(
+            "| {:<26} | {:>10.2} | {:>12.2} |",
+            "BEFORE per-seek (COLD)",
+            el.as_secs_f64() * 1e3,
+            el.as_secs_f64() * 1e6 / seeks as f64
+        );
+    }
+
+    println!(
+        "| {:<26} | {:>10.2} | {:>12.2} |",
+        "AFTER per-seek (removed)", 0.0, 0.0
+    );
+
+    cleanup(&pool, &s).await;
+    println!("\n(AFTER runs zero per-seek authz: the request-level get_file_with_perms");
+    println!(" already authorized + recorded the access. WARM = the moka/CPU cost removed");
+    println!(" per seek; COLD = the drive-resolve query removed per seek when the cache");
+    println!(" isn't warm. notify_file_accessed (a throttled hook call) is likewise");
+    println!(" removed per seek. Safety gate: member granted, outsider denied.)");
+}

examples/bench_resource_row_map.rs

@@ -0,0 +1,282 @@
+//! `/api/folders/{id}/resources` row→DTO mapping micro-alloc benchmark.
+//!
+//! The listing maps each `FolderResourceRow` into a `FolderResourceItemDto`.
+//! BEFORE cloned `row.name` into the DTO (`name: row.name.clone()`) even
+//! though the row is owned by the mapping closure — one avoidable `String`
+//! heap alloc per listed folder/file. AFTER computes the name-derived icon /
+//! category classes first (they borrow `&row.name`), then MOVES `row.name`
+//! into the DTO — the same output, one fewer alloc per row.
+//!
+//! Run:
+//!   cargo run --release --features bench --example bench_resource_row_map
+//! Tunables (env): BENCH_ROWS (500).
+
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::env;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Instant;
+
+use chrono::{DateTime, TimeZone, Utc};
+use oxicloud::application::dtos::display_helpers::{
+    category_for, format_file_size, icon_class_for, icon_special_class_for, intern_display,
+    intern_mime,
+};
+use oxicloud::application::dtos::file_dto::FileDto;
+use oxicloud::application::dtos::folder_dto::{FolderDto, FolderResourceRow};
+use oxicloud::domain::entities::file::File;
+use uuid::Uuid;
+
+static ALLOC_CALLS: AtomicU64 = AtomicU64::new(0);
+
+struct CountingAlloc;
+
+unsafe impl GlobalAlloc for CountingAlloc {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        ALLOC_CALLS.fetch_add(1, Ordering::Relaxed);
+        unsafe { System.alloc(layout) }
+    }
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        unsafe { System.dealloc(ptr, layout) }
+    }
+    unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
+        ALLOC_CALLS.fetch_add(1, Ordering::Relaxed);
+        unsafe { System.realloc(ptr, layout, new_size) }
+    }
+    unsafe fn alloc_zeroed(&self, layout: Layout) -> *mut u8 {
+        ALLOC_CALLS.fetch_add(1, Ordering::Relaxed);
+        unsafe { System.alloc_zeroed(layout) }
+    }
+}
+
+#[global_allocator]
+static GLOBAL: CountingAlloc = CountingAlloc;
+
+fn env_or<T: std::str::FromStr>(key: &str, default: T) -> T {
+    env::var(key)
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(default)
+}
+
+fn rows(n: usize) -> Vec<FolderResourceRow> {
+    let ts: DateTime<Utc> = Utc.timestamp_opt(1_700_000_000, 0).unwrap();
+    (0..n)
+        .map(|i| {
+            let is_folder = i % 4 == 0;
+            FolderResourceRow {
+                resource_type: if is_folder { "folder" } else { "file" }.to_string(),
+                id: Uuid::new_v4(),
+                name: if is_folder {
+                    format!("Folder {i:05}")
+                } else {
+                    format!("document-{i:05}.pdf")
+                },
+                parent_id: Some(Uuid::new_v4()),
+                mime_type: if is_folder {
+                    None
+                } else {
+                    Some("application/pdf".to_string())
+                },
+                size: if is_folder { -1 } else { 4096 },
+                created_at: ts,
+                modified_at: ts,
+                drive_id: Uuid::new_v4(),
+                blob_hash: if is_folder {
+                    None
+                } else {
+                    Some("a".repeat(64))
+                },
+                sort_str: format!("row {i}"),
+                type_order: 0,
+                folder_first: if is_folder { 0 } else { 1 },
+            }
+        })
+        .collect()
+}
+
+/// (name, icon_class, category) triple extracted from each produced DTO — the
+/// fields the move-vs-clone touches. Used for the equivalence gate.
+type Probe = (String, std::sync::Arc<str>, std::sync::Arc<str>);
+
+/// BEFORE — verbatim: `name: row.name.clone()` in both branches.
+fn map_before(rows: Vec<FolderResourceRow>) -> Vec<Probe> {
+    rows.into_iter()
+        .map(|row| {
+            if row.resource_type == "folder" {
+                let resource_id = row.id.to_string();
+                let dto = FolderDto {
+                    etag: resource_id.clone(),
+                    id: resource_id,
+                    name: row.name.clone(),
+                    path: String::new(),
+                    parent_id: row.parent_id.map(|u| u.to_string()),
+                    drive_id: row.drive_id,
+                    created_at: row.created_at.timestamp() as u64,
+                    modified_at: row.modified_at.timestamp() as u64,
+                    is_root: false,
+                    icon_class: intern_display("fas fa-folder"),
+                    icon_special_class: intern_display("folder-icon"),
+                    category: intern_display("Folder"),
+                    created_by: None,
+                    updated_by: None,
+                };
+                (dto.name, dto.icon_class, dto.category)
+            } else {
+                let mime = row
+                    .mime_type
+                    .as_deref()
+                    .unwrap_or("application/octet-stream");
+                let size_bytes = row.size.max(0) as u64;
+                let modified_at_u = row.modified_at.timestamp() as u64;
+                let content_hash = row.blob_hash.clone().unwrap_or_default();
+                let etag = if content_hash.is_empty() {
+                    String::new()
+                } else {
+                    File::compute_etag(&content_hash, modified_at_u)
+                };
+                let dto = FileDto {
+                    id: row.id.to_string(),
+                    name: row.name.clone(),
+                    path: String::new(),
+                    size: size_bytes,
+                    mime_type: intern_mime(mime),
+                    folder_id: row.parent_id.map(|u| u.to_string()),
+                    created_at: row.created_at.timestamp() as u64,
+                    modified_at: row.modified_at.timestamp() as u64,
+                    icon_class: intern_display(icon_class_for(&row.name, mime)),
+                    icon_special_class: intern_display(icon_special_class_for(&row.name, mime)),
+                    category: intern_display(category_for(&row.name, mime)),
+                    size_formatted: format_file_size(size_bytes),
+                    sort_date: None,
+                    content_hash,
+                    etag,
+                    created_by: None,
+                    updated_by: None,
+                };
+                (dto.name, dto.icon_class, dto.category)
+            }
+        })
+        .collect()
+}
+
+/// AFTER — icons/category first (borrow `&row.name`), then move `row.name`.
+fn map_after(rows: Vec<FolderResourceRow>) -> Vec<Probe> {
+    rows.into_iter()
+        .map(|row| {
+            if row.resource_type == "folder" {
+                let resource_id = row.id.to_string();
+                let dto = FolderDto {
+                    etag: resource_id.clone(),
+                    id: resource_id,
+                    name: row.name,
+                    path: String::new(),
+                    parent_id: row.parent_id.map(|u| u.to_string()),
+                    drive_id: row.drive_id,
+                    created_at: row.created_at.timestamp() as u64,
+                    modified_at: row.modified_at.timestamp() as u64,
+                    is_root: false,
+                    icon_class: intern_display("fas fa-folder"),
+                    icon_special_class: intern_display("folder-icon"),
+                    category: intern_display("Folder"),
+                    created_by: None,
+                    updated_by: None,
+                };
+                (dto.name, dto.icon_class, dto.category)
+            } else {
+                let mime = row
+                    .mime_type
+                    .as_deref()
+                    .unwrap_or("application/octet-stream");
+                let size_bytes = row.size.max(0) as u64;
+                let modified_at_u = row.modified_at.timestamp() as u64;
+                let content_hash = row.blob_hash.clone().unwrap_or_default();
+                let etag = if content_hash.is_empty() {
+                    String::new()
+                } else {
+                    File::compute_etag(&content_hash, modified_at_u)
+                };
+                let icon_class = intern_display(icon_class_for(&row.name, mime));
+                let icon_special_class = intern_display(icon_special_class_for(&row.name, mime));
+                let category = intern_display(category_for(&row.name, mime));
+                let dto = FileDto {
+                    id: row.id.to_string(),
+                    name: row.name,
+                    path: String::new(),
+                    size: size_bytes,
+                    mime_type: intern_mime(mime),
+                    folder_id: row.parent_id.map(|u| u.to_string()),
+                    created_at: row.created_at.timestamp() as u64,
+                    modified_at: row.modified_at.timestamp() as u64,
+                    icon_class,
+                    icon_special_class,
+                    category,
+                    size_formatted: format_file_size(size_bytes),
+                    sort_date: None,
+                    content_hash,
+                    etag,
+                    created_by: None,
+                    updated_by: None,
+                };
+                (dto.name, dto.icon_class, dto.category)
+            }
+        })
+        .collect()
+}
+
+fn main() {
+    let n: usize = env_or("BENCH_ROWS", 500);
+
+    // Equivalence gate: identical (name, icon_class, category) for every row.
+    if map_before(rows(n)) != map_after(rows(n)) {
+        eprintln!("EQUIVALENCE GATE FAILED: mapping output differs");
+        std::process::exit(1);
+    }
+
+    // Warm the string interner so its first-sight allocs sit outside the
+    // measured windows (they're identical for both arms anyway).
+    std::hint::black_box(map_before(rows(n)));
+    std::hint::black_box(map_after(rows(n)));
+
+    let a0 = ALLOC_CALLS.load(Ordering::Relaxed);
+    let t = Instant::now();
+    std::hint::black_box(map_before(rows(n)));
+    let before_ms = t.elapsed().as_secs_f64() * 1e3;
+    let before_allocs = ALLOC_CALLS.load(Ordering::Relaxed) - a0;
+
+    let a1 = ALLOC_CALLS.load(Ordering::Relaxed);
+    let t = Instant::now();
+    std::hint::black_box(map_after(rows(n)));
+    let after_ms = t.elapsed().as_secs_f64() * 1e3;
+    let after_allocs = ALLOC_CALLS.load(Ordering::Relaxed) - a1;
+
+    // Both arms build the same `rows(n)` input inside the timed window, so the
+    // input allocs are equal and cancel in the delta; the difference is the
+    // per-row name clone the AFTER path avoids.
+    println!("\n#################################################################");
+    println!("# resources row→DTO mapping: clone name vs move name");
+    println!("# rows={n}");
+    println!("#################################################################\n");
+    println!(
+        "| {:<20} | {:>12} | {:>10} | {:>14} |",
+        "arm", "allocs", "wall ms", "allocs/row"
+    );
+    println!(
+        "| {:<20} | {:>12} | {:>10.3} | {:>14.3} |",
+        "BEFORE (clone)",
+        before_allocs,
+        before_ms,
+        before_allocs as f64 / n as f64
+    );
+    println!(
+        "| {:<20} | {:>12} | {:>10.3} | {:>14.3} |",
+        "AFTER (move)",
+        after_allocs,
+        after_ms,
+        after_allocs as f64 / n as f64
+    );
+    println!(
+        "\nSaved {} allocs ({:.2}/row) — the per-row name clone removed.",
+        before_allocs.saturating_sub(after_allocs),
+        (before_allocs.saturating_sub(after_allocs)) as f64 / n as f64
+    );
+}