v3: a performance pass over both halves — indexed queries, streamed files, cached previews, and feeds that stop re-rendering on every tick — a review turned up whole-file reads, unindexed scans and render storms; each fix comes with a test. Database: migration 0016 adds the indexes the hot queries lacked — dumps by created_at, (user_id, created_at) and slug, votes by (user_id, created_at), playlists by slug, users by lower(username) for @mentions, and the child side of every cascading foreign key (comment replies, a user's comments, follows both ways, chat messages, invites, reset tokens); the feeds, dump and playlist pages, upvotes and follower fan-out all plan as index searches now, with no temp-table sort. SQLite runs in WAL with synchronous=NORMAL and a busy timeout, and a transaction() helper wraps the multi-row writes (a dump and its categories, category sets, backlinks, attachment links, playlist reorders, follower notifications) so they commit once instead of once a row. Lists no longer run a COUNT(*) per page: they fetch limit + 1 rows and hasMore comes from the extra one; total stays only on search, the one place it's shown. Files: /api/files read the whole upload (up to 50 MB) for every range request a player makes while seeking; api/lib/serve-file.ts streams the requested bytes from disk, with an ETag and 304s, and serves avatars, attachments, covers and thumbnails too. File and thumbnail URLs carry the file's version (size and last change), so the current one is cached for a year and anything else revalidates — a same-size replacement used to stay stale, and a video's still was cached immutable forever under a URL that never changed. Feeds showed image dumps at full size: /api/thumbnails now makes a 960px preview with ffmpeg (GIFs and unreadable images go out as they are), one run per output however many cards ask at once, and ffmpeg is probed once per process instead of spawned per request. Uploads stream to disk; replacing a file writes beside it and renames over, a hard link keeping the old one for rollback instead of holding both in memory; generated stills and previews go when the file is replaced or the dump deleted, and a custom thumbnail with its dump. Outbound: fetchWithTimeout's deadline now covers the body — a server that answered at once and then dripped could hold a create open indefinitely — and pages are read to 4 MB at most; metadata is cached five minutes so the create form's preview and the post that follows share one fetch (refresh-metadata still goes to the page); proxied images sit in a 32 MB LRU. Broadcasts serialize once rather than per socket, and index.html is kept in memory until the file changes. Frontend: currentTime lived in PlayerContext, so every card re-rendered — and re-parsed its Markdown — four times a second while anything played; the playhead has its own PlayerTimeContext now. The socket context is split three ways (feed, chat via useWSChat, presence via useWSPresence), so typing, presence and chat messages leave the feeds alone. DumpCard, JournalCard and Markdown are memoized; card images use the server preview and load lazily; the feed cache is written when the page is left rather than after every pause in scrolling; the theme context value is memoized.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/pagination.ts

@@ -22,3 +22,20 @@ export function parsePagination(
   );
   return { page, limit };
 }
+
+/** One page of a list, and whether another follows. */
+export interface Page<T> {
+  items: T[];
+  hasMore: boolean;
+}
+
+/**
+ * Turns rows fetched with `LIMIT limit + 1` into a page: the extra row, if it
+ * came back, is dropped and says there's a next page. No COUNT(*) over the
+ * whole list just to know that.
+ */
+export function pageOf<T>(rows: T[], limit: number): Page<T> {
+  return rows.length > limit
+    ? { items: rows.slice(0, limit), hasMore: true }
+    : { items: rows, hasMore: false };
+}

api/lib/serve-file.ts

@@ -0,0 +1,154 @@
+import type { Context } from "@oak/oak";
+
+const CHUNK_SIZE = 64 * 1024;
+
+/**
+ * Streams `length` bytes of an open file, from wherever its cursor stands,
+ * and closes it once done or cancelled. The response never holds more than a
+ * chunk of the file in memory — a seek in a 50 MB track reads what it plays.
+ */
+function fileStream(
+  file: Deno.FsFile,
+  length: number,
+): ReadableStream<Uint8Array> {
+  let remaining = length;
+  let closed = false;
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    file.close();
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      if (remaining <= 0) {
+        close();
+        controller.close();
+        return;
+      }
+      const buf = new Uint8Array(Math.min(CHUNK_SIZE, remaining));
+      let n: number | null;
+      try {
+        n = await file.read(buf);
+      } catch (err) {
+        close();
+        controller.error(err);
+        return;
+      }
+      if (n === null) {
+        close();
+        controller.close();
+        return;
+      }
+      remaining -= n;
+      controller.enqueue(buf.subarray(0, n));
+      if (remaining <= 0) {
+        close();
+        controller.close();
+      }
+    },
+    cancel() {
+      close();
+    },
+  });
+}
+
+/** Whether an If-None-Match header names `etag` (weak comparison). */
+function matchesEtag(header: string | null, etag: string): boolean {
+  if (!header) return false;
+  if (header.trim() === "*") return true;
+  const strip = (tag: string) => tag.trim().replace(/^W\//, "");
+  return header.split(",").some((tag) => strip(tag) === strip(etag));
+}
+
+export interface ServeFileOptions {
+  mime: string;
+  cacheControl: string;
+  /** Answer a single `Range: bytes=…` with a 206 (media files). */
+  ranges?: boolean;
+}
+
+/**
+ * Sends a file from disk with an ETag (a 304 when the client already has it)
+ * and, when `ranges` is set, single byte ranges. The body is streamed.
+ *
+ * Returns false, having sent nothing, when the file doesn't exist.
+ */
+export async function serveFile(
+  ctx: Context,
+  path: string,
+  { mime, cacheControl, ranges = false }: ServeFileOptions,
+): Promise<boolean> {
+  let file: Deno.FsFile;
+  let stat: Deno.FileInfo;
+  try {
+    file = await Deno.open(path, { read: true });
+    stat = await file.stat();
+  } catch {
+    return false;
+  }
+
+  const total = stat.size;
+  const mtime = stat.mtime?.getTime() ?? 0;
+  const etag = `W/"${total.toString(36)}-${mtime.toString(36)}"`;
+  const headers = ctx.response.headers;
+  headers.set("Content-Type", mime);
+  headers.set("Cache-Control", cacheControl);
+  headers.set("ETag", etag);
+  if (stat.mtime) headers.set("Last-Modified", stat.mtime.toUTCString());
+  if (ranges) headers.set("Accept-Ranges", "bytes");
+
+  if (matchesEtag(ctx.request.headers.get("If-None-Match"), etag)) {
+    file.close();
+    ctx.response.status = 304;
+    return true;
+  }
+
+  // Only a single byte range is served as one. Anything else — several
+  // ranges, another unit — is a header RFC 9110 lets us ignore, so the whole
+  // file goes out with a 200 rather than a 416 for ranges that were fine.
+  const match = ranges
+    ? ctx.request.headers.get("Range")?.match(/^bytes=(\d*)-(\d*)$/)
+    : null;
+
+  if (!match) {
+    // Explicit: a caller may have tried another file first and left a 404.
+    ctx.response.status = 200;
+    headers.set("Content-Length", String(total));
+    ctx.response.body = fileStream(file, total);
+    return true;
+  }
+
+  // "bytes=a-b", "bytes=a-" (to the end) or "bytes=-n" (the last n bytes).
+  let start: number;
+  let end: number;
+  if (match[1]) {
+    start = parseInt(match[1], 10);
+    end = match[2] ? Math.min(parseInt(match[2], 10), total - 1) : total - 1;
+  } else {
+    const suffix = parseInt(match[2], 10);
+    start = Math.max(total - suffix, 0);
+    end = total - 1;
+    // "bytes=-" and "bytes=-0" name no bytes at all.
+    if (!(suffix > 0)) start = total;
+  }
+
+  if (start > end || start >= total) {
+    file.close();
+    ctx.response.status = 416;
+    headers.set("Content-Range", `bytes */${total}`);
+    return true;
+  }
+
+  const length = end - start + 1;
+  try {
+    await file.seek(start, Deno.SeekMode.Start);
+  } catch (err) {
+    file.close();
+    throw err;
+  }
+  ctx.response.status = 206;
+  headers.set("Content-Range", `bytes ${start}-${end}/${total}`);
+  headers.set("Content-Length", String(length));
+  ctx.response.body = fileStream(file, length);
+  return true;
+}

api/lib/static.ts

@@ -4,17 +4,30 @@ import { emojiToCodepoint } from "./site-icons.ts";
 
 const ICON_VERSION = emojiToCodepoint(SITE_EMOJI);
 
-async function serveIndexHtml(
-  context: Context<Record<string, object>>,
-  root: string,
-) {
-  const filePath = `${root}/index.html`;
-  const raw = await Deno.readTextFile(filePath);
-  const html = raw
+// index.html with its placeholders filled, by root. Kept until the file
+// changes (a rebuild under a running server): a stat per navigation instead of
+// a read and four replaceAll.
+const indexHtml = new Map<string, { mtime: number; html: string }>();
+
+async function loadIndexHtml(root: string): Promise<string> {
+  const path = `${root}/index.html`;
+  const mtime = (await Deno.stat(path)).mtime?.getTime() ?? 0;
+  const cached = indexHtml.get(root);
+  if (cached && cached.mtime === mtime) return cached.html;
+  const html = (await Deno.readTextFile(path))
     .replaceAll("__SITE_NAME__", OG_SITE_NAME)
     .replaceAll("__SITE_EMOJI__", SITE_EMOJI)
     .replaceAll("__ICON_VERSION__", ICON_VERSION)
     .replaceAll("__BANDCAMP_PLAYER__", BANDCAMP_PLAYER);
+  indexHtml.set(root, { mtime, html });
+  return html;
+}
+
+async function serveIndexHtml(
+  context: Context<Record<string, object>>,
+  root: string,
+) {
+  const html = await loadIndexHtml(root);
   context.response.type = "text/html";
   // Always revalidated: it names the hashed chunks of the current build.
   context.response.headers.set("Cache-Control", "no-cache");

api/lib/upload.ts

@@ -1,5 +1,6 @@
 import type { Context } from "@oak/oak";
 import { APIErrorCode, APIException } from "../model/interfaces.ts";
+import { serveFile } from "./serve-file.ts";
 import {
   ALLOWED_IMAGE_MIMES,
   ATTACHMENTS_DIR,
@@ -67,21 +68,13 @@ export async function serveUploadedFile(
   cacheMaxAge = 3600,
   isPrivate = false,
 ): Promise<boolean> {
-  let data: Uint8Array;
-  try {
-    data = await Deno.readFile(filePath);
-  } catch {
-    ctx.response.status = 404;
-    return false;
-  }
-  ctx.response.headers.set("Content-Type", mime);
   ctx.response.headers.set("Content-Disposition", "inline");
   ctx.response.headers.set("X-Content-Type-Options", "nosniff");
-  ctx.response.headers.set(
-    "Cache-Control",
-    `${isPrivate ? "private" : "public"}, max-age=${cacheMaxAge}`,
-  );
   ctx.response.headers.set("Cross-Origin-Resource-Policy", "cross-origin");
-  ctx.response.body = data;
-  return true;
+  const served = await serveFile(ctx, filePath, {
+    mime,
+    cacheControl: `${isPrivate ? "private" : "public"}, max-age=${cacheMaxAge}`,
+  });
+  if (!served) ctx.response.status = 404;
+  return served;
 }