[helly25]

Stream line input into one caller-owned buffer so capable VFS backends avoid allocating and initializing a temporary string for each read. Preserve the existing line, binary-detection, error-draining and legacy-stream contracts.

AG;DR

Implementation

• content::ScanLines owns one uninitialized 64 KiB stack buffer and observes only the prefix returned by ReadInto. Oversized counts fail before constructing a view.
• Recheck capability on every read. Incapable reads retain their owning string through processing. Propagate capable-read errors without retrying after input may have advanced.
• Preserve binary-sniff boundaries, final-line behavior, visitor stop and late-error draining. No VFS/public CLI interface, worker, lock, pool, exception or safety-policy change.
• Add eleven scanner regression cases and a manual serial diagnostic for both legacy and capable streams. Index that manual target for normal clang-tidy.
• Publish both complete platform datasets and the detailed qualification report, with explicit release-site mappings. Narrow large-file-hook exceptions to these two benchmark datasets.
• Retain all wider optimization candidates. Link the detailed reports from the performance index instead of growing its nearly-full Markdown API request; retain the completed perf: batch sustained listing output with a lazy bounded buffer #1156 child independently of broader O18.

Measured decision

Select stack storage. At 100,000 files, corrected matching-invocation confirmation gives these broad/deep geometric means of elapsed ratios against the unchanged baseline. Below one means less elapsed time. Every underlying point is the arithmetic mean of its fastest seven of nine measured rounds, after one discarded warmup.

Host	Configuration	Request 1	Request 3	Request 10
Linux	Full	0.8208	0.8740	0.9339
Linux	Minimal	0.8199	0.8733	0.9390
Mac	Full	0.9506	0.9978	1.0059
Mac	Minimal	0.9355	0.9947	0.9957

Linux pins the process to the recorded logical CPU allowance matching its worker request. Mac records worker requests and does not claim CPU affinity. Drogon exposes ten KVM guest CPUs on a Ryzen 9950X host; guest affinity does not prove host physical-core pinning. The Mac is an 18-CPU M5 Pro with 64 GiB memory. These are separate host populations.

This is not a universal gain. Preserve the Linux legacy-kernel costs (about 8 ns / 25% for 256-byte input; 0.14-0.18 us / 1.9-2.4% for 128 KiB). Two Mac large confirmation cases are about 1.6-2% slower, and the full/10-worker aggregate is 0.6% slower. Separate small-image studies retain worst aggregate cells of 1.0204 on Mac and 1.0253 on Linux. All slower raw observations remain included, without copied-control division or cohort pooling.

The lazy overwrite heap alternative remains unselected: it adds allocation and does not consistently improve the complete kernel/engine populations. Its source, correctness checks and adverse data remain retained. O07's earlier rejected cursor/fallback implementations also remain separate.

Measurement coverage and controls

• Original native campaigns: 180 cells / 10,680 checked invocations on each host; full/minimal shipping ThinLTO CLIs, broad/deep RAM-filesystem trees, 100/100,000 files, requests 1/3/10, and actual 100/10,000-member TAR line scans.
• Corrected confirmation: 121 cells / 4,780 calls on Mac; 109 / 4,300 on Linux, selected by the recorded rule covering all small cases, all primary large streaming cases and original adverse/control-drift cases.
• Fixed small-image studies: all 90 small cases / 5,400 calls per host, three ordinary copies per variant, matching basenames and equal-length paired paths, equally weighted image means.
• Unchanged engine diagnostic: 48 cases x four images x ten rounds on each host, retaining its original 1/4-worker-request contract.
• Serial scanner diagnostic: 32 legacy/direct, empty/short/large, chunk-limit and stopped-visitor cases x four images x ten rounds on each host. It has no filesystem/source-open cost and is not shipping CLI elapsed time.

Each native invocation has an independent recipe-derived filename/line/count/metadata oracle; archive filters exclude the raw container. All warmups, excluded rounds, raw benchmark JSON fields and adverse points remain available. Native fork/exec/wait timing excludes Python validation. Builds, lint and heavy analysis do not overlap accepted timings on the same host.

The original cohort gives one baseline image two invocations per round. Its copied control, and Linux's first balanced cohort, also use a different executable basename. XFF uses that basename as an implicit config selector, so those controls cannot establish a physical-backing cause. Keep those cohorts with their limitations; the corrected confirmation gives each image one invocation and preserves xff/xff_full. Kernel timings exclude program initialization and do not dispatch through XFF's invocation selector.

Separate all-nine paired diagnostics are not confidence intervals for the fastest-seven estimator, are not corrected for multiple comparisons and do not establish population or hardware-independent confidence.

Sources, validation and size

Original runtime sources are baseline main cc30ffd2f85cd32fb902750af5023b6596889faf, stack 4cd48ae6d7a2f83a824b85ec7f87c8baedb29eba, and heap 01689b4d83cac401edba8258a75dbee8eb475d09. The identical serial diagnostic is built at signed revisions 7e4ef7909d27a78fa782e0d098196dd5c4fde7b5, f4290d429a1c58dc3b8e8941a8fdf2540954965f, and 74650ad5697b2f19e15dd268e6ee6722cdfcf0c5 respectively. Do not relabel those earlier binaries as later documentation heads.

Implementation head f429 passes all 344 configured release test targets on both hosts, fresh four-suite affected release checks, and eight fresh affected suites under ASan/TSan on both hosts and MSan on Linux. Actual scoped clang-tidy and normal signing/hooks pass. Actual full/minimal f429 shipping outputs are byte-identical to the original stack images on both hosts, with independent configured-executable queries and ThinLTO link proofs. Rebuilding and querying the final 44c30 head proves all four shipping outputs remain byte-identical to those measured f429 images.

The first CI run found a missing report page mapping. The mapping-only fix f0f2963124e853801c1fbd347b51fa159a68ca1f passes the complete required Test workflow 42634678865, including release-site rendering, coverage, clang-tidy, sanitizers, platform suites, benchmarks and done.

Current report/data head is 44c30c221f268c7fa9169ba978178713d1f2b876. It changes no C++ source. Normal commit and push hooks pass. Its complete 344-target configured release test set passes on both hosts using valid unchanged-input Bazel test-cache results, followed by four freshly executed affected suites per host. Tracked source hashes remain unchanged during verification. Fresh local release-site generation, real Markdown rendering and link validation also pass, with both published data copies verified against their original hashes. Its own complete Test workflow 42660056761 and final done check pass, including both platforms, sanitizers, coverage, clang-tidy, site tests and all benchmark aggregation. Earlier results do not substitute for these current-head checks.

Actual configured shipping image changes before stripping/compression: Mac full/minimal -576/-176 bytes; Linux +2,288/+2,296 bytes. These are build outputs, not tagged release assets.

Durable evidence and remaining scope

Complete report and datasets preserve the contracts, source/build identities and all populations. Both datasets' 45,540 native observations and stored estimators were independently checked against their raw rounds. The structured JSON bundles preserve parsed values and original file hashes/lengths; byte-exact original files, signed source bundles, binaries, complete logs and link actions are in durable capsules on drogon under /home/marcus/Documents/.

• Mac capsule: 31,917,717 bytes, SHA-256 5725b6217259db7c1ef2b5e22741fd2717416ea17cde26fa026d44df16572f6d; all 409 manifest entries verified again after transfer.
• Linux capsule: 59,565,583 bytes, SHA-256 d76fc9a95beed63cb9f3d05707234dbe7d5e1d2a5a64068e3da46034c96a679a; all 394 entries verified again in durable storage.

Bazel caches/toolchain downloads, generated full sites and RAM fixture mounts are excluded. Completed owned Mac RAM volumes detach with ownership checks; borrowed Linux fixtures remain intact.

The change is limited to the direct-scanner child. EP/JC preparation and scheduling, broader O18 byte admission/overlap, archive locator/admission work and the remaining retained candidates stay open. Separate TODOs preserve the explicit thin-LTO indexing build defect and archive-member invariant/validated-TAR opportunities; this PR adds no workaround or archive-policy change.

[github-actions]

Benchmark preview

Advisory: changes over 15% are warnings, not merge failures. Positive reference-adjusted change means slower; negative means faster.

linux

Performance overview

WARNING: 2 comparison(s) exceed the 15% slowdown threshold. Advisory only.

Merged baseline: cc30ffd; run 42616527237, attempt 1; mean of fastest 7/9 runs.

Compatible comparisons: 360/360; unavailable: 0.

Population	Comparisons	Typical change	Faster	Within threshold	Slower
All matched cases	360	-0.5%	10	348	2

Largest regressions:

Task	Tree	Workers	Files	Reference	Change
content-absent_marker	deep	3	100	rg	+15.7%
name-txt	broad	3	10,000	rg	+15.2%
files	broad	3	10	rg	+14.8%
files	deep	3	100	rg	+13.5%
name-txt	deep	3	100	rg	+13.3%

Typical change is an equal-weight geometric mean of reference-adjusted XFF/main factors. Negative is faster; positive is slower. These correlated cases are not a significance test.

Interactive preview | CI run

Tested merge f8f2ed6717; PR #1157 head f0f2963124.

macos

Performance overview

No compatible merged baseline comparisons are available; regression status is unknown. Advisory only.

Merged baseline: unavailable.

Compatible comparisons: 0/360; unavailable: 360.

Population	Comparisons	Typical change	Faster	Within threshold	Slower
All matched cases	0	n/a	0	0	0

Typical change is an equal-weight geometric mean of reference-adjusted XFF/main factors. Negative is faster; positive is slower. These correlated cases are not a significance test.

Interactive preview | CI run

Tested merge f8f2ed6717; PR #1157 head f0f2963124.