Optimization backlog — beyond the night's perf commits

Synced read-only from /home/synnet/mirrors/synvirt-product/docs/night/20260611/OPTIMIZE-BACKLOG.md. Edit at the source, not here.

Optimization backlog — beyond the night’s perf commits

Prioritized. Each entry: the measured/observed signal + the proposed fix.

1. Inventory peer round-trips on every poll. Post-parallelization the document still costs one mesh GetInventory per peer per request (~250 ms p50 with 2 peers). Add a 2 s event-invalidated cache of peer host-nodes (invalidate on VM lifecycle events arriving over the mesh, plus TTL) → sidebar polls become ~30 ms. Needs the freshness test the night rules demand.
2. PAM cold path still serializes bursts. The 60 s verified-credential cache kills steady-state cost, but the FIRST burst after expiry pays yescrypt once per distinct credential serialized behind PAM_LOCK. Pre-warm on session-cookie issuance or extend TTL with sliding renewal.
3. virsh per-call spawn (~12 ms each on metal, more nested). A persistent virsh stdin session (echo-marker protocol per command, respawn-on-anomaly, spawn-per-call fallback) would amortize libvirt connects: VM list on a 50-VM host ≈ 9 batches × spawn → 1 session. Medium risk (prompt parsing, zombie sessions) — prototype behind a local-only feature flag first.
4. cargo-machete / cargo bloat / cargo tree -d pass. Not run tonight (time-boxed out by the feature load). Expect duplicate rustls-adjacent versions worth deduplicating and a few unused deps; binary ~size win.
5. Release profile experiment. lto=“thin”→“fat” + codegen-units=1 + strip on synvirt-daemon: measure cold-start + size; keep only what wins. (NO panic=“abort” per the night rules.)
6. UI bundle (index 493 kB / 160 kB gz). ~70% framework floor (vue+router+pinia+headlessui+i18n). Wins left: vue-i18n runtime-only build + precompiled messages (−55 kB source), HomeView stays eager by design. Re-evaluate after the framework majors bump.
7. /api/v1/host/usage at 23 k rps is unauthenticated — see BUGS-FOUND #1; whichever way the auth decision lands, add a micro-cache (it reads /proc on every hit).
8. Cluster Health identity fan-out duplicates the guardian tick’s probes (both hit /node/identity per member). Share one probe cache (5 s TTL) between health, guardian, and the hostname guard.