v3: a performance pass over both halves — indexed queries, streamed files, cached previews, and feeds that stop re-rendering on every tick — a review turned up whole-file reads, unindexed scans and render storms; each fix comes with a test. Database: migration 0016 adds the indexes the hot queries lacked — dumps by created_at, (user_id, created_at) and slug, votes by (user_id, created_at), playlists by slug, users by lower(username) for @mentions, and the child side of every cascading foreign key (comment replies, a user's comments, follows both ways, chat messages, invites, reset tokens); the feeds, dump and playlist pages, upvotes and follower fan-out all plan as index searches now, with no temp-table sort. SQLite runs in WAL with synchronous=NORMAL and a busy timeout, and a transaction() helper wraps the multi-row writes (a dump and its categories, category sets, backlinks, attachment links, playlist reorders, follower notifications) so they commit once instead of once a row. Lists no longer run a COUNT(*) per page: they fetch limit + 1 rows and hasMore comes from the extra one; total stays only on search, the one place it's shown. Files: /api/files read the whole upload (up to 50 MB) for every range request a player makes while seeking; api/lib/serve-file.ts streams the requested bytes from disk, with an ETag and 304s, and serves avatars, attachments, covers and thumbnails too. File and thumbnail URLs carry the file's version (size and last change), so the current one is cached for a year and anything else revalidates — a same-size replacement used to stay stale, and a video's still was cached immutable forever under a URL that never changed. Feeds showed image dumps at full size: /api/thumbnails now makes a 960px preview with ffmpeg (GIFs and unreadable images go out as they are), one run per output however many cards ask at once, and ffmpeg is probed once per process instead of spawned per request. Uploads stream to disk; replacing a file writes beside it and renames over, a hard link keeping the old one for rollback instead of holding both in memory; generated stills and previews go when the file is replaced or the dump deleted, and a custom thumbnail with its dump. Outbound: fetchWithTimeout's deadline now covers the body — a server that answered at once and then dripped could hold a create open indefinitely — and pages are read to 4 MB at most; metadata is cached five minutes so the create form's preview and the post that follows share one fetch (refresh-metadata still goes to the page); proxied images sit in a 32 MB LRU. Broadcasts serialize once rather than per socket, and index.html is kept in memory until the file changes. Frontend: currentTime lived in PlayerContext, so every card re-rendered — and re-parsed its Markdown — four times a second while anything played; the playhead has its own PlayerTimeContext now. The socket context is split three ways (feed, chat via useWSChat, presence via useWSPresence), so typing, presence and chat messages leave the feeds alone. DumpCard, JournalCard and Markdown are memoized; card images use the server preview and load lazily; the feed cache is written when the page is left rather than after every pause in scrolling; the theme context value is memoized.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/dump-service.ts

@@ -13,7 +13,9 @@ import {
   dumpApiToRow,
   dumpRowToApi,
   isDumpRow,
+  transaction,
 } from "../model/db.ts";
+import { type Page, pageOf } from "../lib/pagination.ts";
 import {
   fetchRichContent,
   isValidHttpUrl,
@@ -97,25 +99,26 @@ export async function createUrlDump(
   const isPrivate = request.isPrivate ?? false;
   const slug = makeSlug(title, dumpId);
 
-  db.prepare(
-    `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, url, url_canonical, rich_content, is_private)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);`,
-  ).run(
-    dumpId,
-    "url",
-    title,
-    slug,
-    request.comment ?? null,
-    userId,
-    createdAt.toISOString(),
-    request.url,
-    canonicalizeUrl(request.url),
-    richContent ? JSON.stringify(richContent) : null,
-    isPrivate ? 1 : 0,
-  );
-
   const categoryIds = [...new Set(request.categoryIds ?? [])];
-  setDumpCategories(dumpId, categoryIds);
+  transaction(() => {
+    db.prepare(
+      `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, url, url_canonical, rich_content, is_private)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);`,
+    ).run(
+      dumpId,
+      "url",
+      title,
+      slug,
+      request.comment ?? null,
+      userId,
+      createdAt.toISOString(),
+      request.url,
+      canonicalizeUrl(request.url),
+      richContent ? JSON.stringify(richContent) : null,
+      isPrivate ? 1 : 0,
+    );
+    setDumpCategories(dumpId, categoryIds);
+  });
 
   const dump: Dump = {
     id: dumpId,
@@ -176,28 +179,30 @@ export async function createFileDump(
   const dedupedCategoryIds = [...new Set(categoryIds)];
 
   await Deno.mkdir(DUMPS_DIR, { recursive: true });
-  const data = new Uint8Array(await file.arrayBuffer());
 
   try {
-    await Deno.writeFile(`${DUMPS_DIR}/${dumpId}`, data);
+    // Streamed to disk rather than copied into one more 50 MB buffer first.
+    await Deno.writeFile(`${DUMPS_DIR}/${dumpId}`, file.stream());
 
-    db.prepare(
-      `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, file_name, file_mime, file_size, is_private)
+    transaction(() => {
+      db.prepare(
+        `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, file_name, file_mime, file_size, is_private)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);`,
-    ).run(
-      dumpId,
-      "file",
-      finalTitle,
-      slug,
-      comment ?? null,
-      userId,
-      createdAt.toISOString(),
-      file.name,
-      file.type,
-      file.size,
-      isPrivate ? 1 : 0,
-    );
-    setDumpCategories(dumpId, dedupedCategoryIds);
+      ).run(
+        dumpId,
+        "file",
+        finalTitle,
+        slug,
+        comment ?? null,
+        userId,
+        createdAt.toISOString(),
+        file.name,
+        file.type,
+        file.size,
+        isPrivate ? 1 : 0,
+      );
+      setDumpCategories(dumpId, dedupedCategoryIds);
+    });
   } catch (err) {
     // Roll back the file if DB insert fails
     await Deno.remove(`${DUMPS_DIR}/${dumpId}`).catch(() => {});
@@ -232,6 +237,29 @@ export async function createFileDump(
   return dump;
 }
 
+/**
+ * A file dump's version as the app puts it in file and thumbnail URLs
+ * (`?v=`): it changes whenever the file can have. Mirrored by
+ * `dumpFileVersion` in src/utils/urls.ts.
+ */
+export function dumpFileVersion(
+  dump: Pick<Dump, "fileSize" | "createdAt" | "updatedAt">,
+): string {
+  return `${dump.fileSize ?? 0}-${
+    (dump.updatedAt ?? dump.createdAt).getTime()
+  }`;
+}
+
+/** Files generated from a dump's upload (see api/routes/thumbnails.ts):
+ * dropped when it's replaced or gone, so they're made again from the new one. */
+async function removeGeneratedThumbnails(dumpId: string): Promise<void> {
+  await Promise.all(
+    [`${dumpId}.jpg`, `${dumpId}.preview.jpg`, `${dumpId}.preview.png`].map(
+      (name) => Deno.remove(`${THUMBNAILS_DIR}/${name}`).catch(() => {}),
+    ),
+  );
+}
+
 // Internal fetch — no privacy check. Use only when ownership is already enforced.
 function fetchDump(idOrSlug: string): Dump {
   const row = UUID_RE.test(idOrSlug)
@@ -296,23 +324,16 @@ export function listDumps(
   page: number,
   limit: number,
   requestingUserId?: string,
-): { items: Dump[]; total: number } {
+): Page<Dump> {
   const offset = (page - 1) * limit;
   // Show public dumps + the requesting user's own private dumps
   const rows = requestingUserId
     ? db.prepare(
       `SELECT ${SELECT_COLS} FROM dumps WHERE (is_private = 0 OR user_id = ?) ORDER BY created_at DESC LIMIT ? OFFSET ?;`,
-    ).all(requestingUserId, limit, offset)
+    ).all(requestingUserId, limit + 1, offset)
     : db.prepare(
       `SELECT ${SELECT_COLS} FROM dumps WHERE is_private = 0 ORDER BY created_at DESC LIMIT ? OFFSET ?;`,
-    ).all(limit, offset);
-  const totalRow = requestingUserId
-    ? db.prepare(
-      `SELECT COUNT(*) as count FROM dumps WHERE (is_private = 0 OR user_id = ?);`,
-    ).get(requestingUserId) as { count: number } | undefined
-    : db.prepare(
-      `SELECT COUNT(*) as count FROM dumps WHERE is_private = 0;`,
-    ).get() as { count: number } | undefined;
+    ).all(limit + 1, offset);
 
   if (!rows || !rows.every(isDumpRow)) {
     throw new APIException(
@@ -324,7 +345,7 @@ export function listDumps(
 
   const items = rows.map(dumpRowToApi);
   attachCategoryIds(items);
-  return { items, total: totalRow?.count ?? 0 };
+  return pageOf(items, limit);
 }
 
 /**
@@ -548,11 +569,24 @@ export async function replaceFileDump(
   }
   if (categoryIds !== undefined) assertCategoriesExist(categoryIds);
 
-  const data = new Uint8Array(await file.arrayBuffer());
+  // The new file is written beside the old one and renamed over it (atomic: a
+  // reader sees one or the other). A hard link keeps the old one reachable so
+  // a failed update can put it back, without holding either in memory.
   const filePath = `${DUMPS_DIR}/${dumpId}`;
-  // Read old file contents so we can restore on DB failure
-  const oldData = await Deno.readFile(filePath).catch(() => null);
-  await Deno.writeFile(filePath, data);
+  const tmpPath = `${filePath}.${crypto.randomUUID()}.tmp`;
+  const backupPath = `${tmpPath}.old`;
+  await Deno.mkdir(DUMPS_DIR, { recursive: true });
+  try {
+    await Deno.writeFile(tmpPath, file.stream());
+  } catch (err) {
+    await Deno.remove(tmpPath).catch(() => {});
+    throw err;
+  }
+  const hadOld = await Deno.link(filePath, backupPath).then(
+    () => true,
+    () => false,
+  );
+  await Deno.rename(tmpPath, filePath);
 
   const now = new Date();
   const finalTitle = title?.trim() || dump.title;
@@ -561,30 +595,35 @@ export async function replaceFileDump(
     : dump.slug;
   const finalPrivate = isPrivate ?? dump.isPrivate;
   try {
-    db.prepare(
-      `UPDATE dumps SET title = ?, slug = ?, file_name = ?, file_mime = ?, file_size = ?, comment = ?, is_private = ?, updated_at = ? WHERE id = ?;`,
-    ).run(
-      finalTitle,
-      newSlug ?? null,
-      file.name,
-      file.type,
-      file.size,
-      comment ?? null,
-      finalPrivate ? 1 : 0,
-      now.toISOString(),
-      dumpId,
-    );
+    transaction(() => {
+      db.prepare(
+        `UPDATE dumps SET title = ?, slug = ?, file_name = ?, file_mime = ?, file_size = ?, comment = ?, is_private = ?, updated_at = ? WHERE id = ?;`,
+      ).run(
+        finalTitle,
+        newSlug ?? null,
+        file.name,
+        file.type,
+        file.size,
+        comment ?? null,
+        finalPrivate ? 1 : 0,
+        now.toISOString(),
+        dumpId,
+      );
+      if (categoryIds !== undefined) {
+        setDumpCategories(dumpId, [...new Set(categoryIds)]);
+      }
+    });
   } catch (err) {
-    // Roll back the file to its previous contents on DB failure
-    if (oldData) await Deno.writeFile(filePath, oldData).catch(() => {});
+    // Put the previous file back on DB failure
+    if (hadOld) await Deno.rename(backupPath, filePath).catch(() => {});
     else await Deno.remove(filePath).catch(() => {});
     throw err;
   }
+  if (hadOld) await Deno.remove(backupPath).catch(() => {});
+  await removeGeneratedThumbnails(dumpId);
 
   if (categoryIds !== undefined) {
-    const ids = [...new Set(categoryIds)];
-    setDumpCategories(dumpId, ids);
-    dump.categoryIds = ids;
+    dump.categoryIds = [...new Set(categoryIds)];
   } else {
     attachCategoryIds([dump]);
   }
@@ -616,15 +655,12 @@ export function getDumpsByUser(
   page: number,
   limit: number,
   includePrivate: boolean,
-): { items: Dump[]; total: number } {
+): Page<Dump> {
   const offset = (page - 1) * limit;
   const privacyFilter = includePrivate ? "" : " AND is_private = 0";
   const rows = db.prepare(
     `SELECT ${SELECT_COLS} FROM dumps WHERE user_id = ?${privacyFilter} ORDER BY created_at DESC LIMIT ? OFFSET ?;`,
-  ).all(userId, limit, offset);
-  const totalRow = db.prepare(
-    `SELECT COUNT(*) as count FROM dumps WHERE user_id = ?${privacyFilter};`,
-  ).get(userId) as { count: number } | undefined;
+  ).all(userId, limit + 1, offset);
   if (!rows.every(isDumpRow)) {
     throw new APIException(
       APIErrorCode.SERVER_ERROR,
@@ -634,7 +670,7 @@ export function getDumpsByUser(
   }
   const items = rows.map(dumpRowToApi);
   attachCategoryIds(items);
-  return { items, total: totalRow?.count ?? 0 };
+  return pageOf(items, limit);
 }
 
 export function getVotedDumpsByUser(
@@ -642,11 +678,9 @@ export function getVotedDumpsByUser(
   page: number,
   limit: number,
   requestingUserId: string | null,
-): { items: Dump[]; total: number } {
+): Page<Dump> {
   const offset = (page - 1) * limit;
   const dumpCols = SELECT_COLS_ALIASED;
-
-  let totalRow: { count: number } | undefined;
   let rows: unknown[];
 
   if (requestingUserId === userId) {
@@ -657,12 +691,7 @@ export function getVotedDumpsByUser(
        INNER JOIN votes v ON d.id = v.dump_id
        WHERE v.user_id = ? AND (d.is_private = 0 OR d.user_id = ?)
        ORDER BY v.created_at DESC LIMIT ? OFFSET ?;`,
-    ).all(userId, userId, limit, offset);
-    totalRow = db.prepare(
-      `SELECT COUNT(*) as count FROM dumps d
-       INNER JOIN votes v ON d.id = v.dump_id
-       WHERE v.user_id = ? AND (d.is_private = 0 OR d.user_id = ?);`,
-    ).get(userId, userId) as { count: number } | undefined;
+    ).all(userId, userId, limit + 1, offset);
   } else {
     rows = db.prepare(
       `SELECT ${dumpCols}
@@ -670,12 +699,7 @@ export function getVotedDumpsByUser(
        INNER JOIN votes v ON d.id = v.dump_id
        WHERE v.user_id = ? AND d.is_private = 0
        ORDER BY v.created_at DESC LIMIT ? OFFSET ?;`,
-    ).all(userId, limit, offset);
-    totalRow = db.prepare(
-      `SELECT COUNT(*) as count FROM dumps d
-       INNER JOIN votes v ON d.id = v.dump_id
-       WHERE v.user_id = ? AND d.is_private = 0;`,
-    ).get(userId) as { count: number } | undefined;
+    ).all(userId, limit + 1, offset);
   }
 
   if (!rows.every(isDumpRow)) {
@@ -687,7 +711,7 @@ export function getVotedDumpsByUser(
   }
   const items = rows.map(dumpRowToApi);
   attachCategoryIds(items);
-  return { items, total: totalRow?.count ?? 0 };
+  return pageOf(items, limit);
 }
 
 export async function refreshDumpMetadata(dumpId: string): Promise<Dump> {
@@ -705,7 +729,9 @@ export async function refreshDumpMetadata(dumpId: string): Promise<Dump> {
   // over a dump that already has good metadata would silently destroy it and
   // rename the dump to its bare hostname, so bail out instead — the caller
   // surfaces the error and nothing is lost.
-  const { ok, content: richContent } = await tryFetchRichContent(dump.url);
+  const { ok, content: richContent } = await tryFetchRichContent(dump.url, {
+    fresh: true,
+  });
   if (!ok) {
     throw new APIException(
       APIErrorCode.SERVER_ERROR,
@@ -767,7 +793,11 @@ export async function deleteDump(dumpId: string): Promise<void> {
   }
 
   if (dump.kind === "file") {
-    await Deno.remove(`${DUMPS_DIR}/${dumpId}`).catch(() => {});
+    await Deno.remove(`${DUMPS_DIR}/${dump.id}`).catch(() => {});
+    await removeGeneratedThumbnails(dump.id);
+  }
+  if (dump.thumbnailMime) {
+    await Deno.remove(`${THUMBNAILS_DIR}/${dump.id}-custom`).catch(() => {});
   }
 
   broadcastDumpDeleted(dumpId);