[aarambh-darshan]

Summary

Second optimization pass over the post-audit codebase, working through the
AUDIT_FINDINGS.md Round-2 backlog (O1–O27) identified after the first
benchmark report. 22 of 27 items resolved; the rest are deferred with
reasons documented in the tracker.

Highlights

Core dispatch

• ErasedHandler::call(&self) — dispatch fast path no longer allocates a
  boxed handler per request (O2)
• Per-handler layer stacks folded once after with_state — nested routes
  with middleware no longer rebuild N boxed services per request (O3)
• MethodRouter.layers behind an Arc — router clone is allocation-free (O8)
• Path-param keys interned on a route's first match; 404/fallback sentinel
  labels become LazyLock statics (O5, O4)

Middleware

• Compression negotiates from the borrowed header before the handler runs;
  absent/empty Accept-Encoding = zero work; allocation-free negotiator and
  fixed candidate lists (O12, O25)
• Trace: latency formatting + span records skipped when the span is gated
  off; span fields borrow instead of allocating; static version table (O13)
• Request-id builds one HeaderValue per request instead of two plus a string
  clone (O11); CORS derives its constant header values at construction —
  allocation-free preflights (O15)
• Four synchronous-only services drop their per-request Box::pin (O16),
  including a two-variant future for the body-limit rejection path

Static / extractors / observe

• Serve root canonicalized once instead of per request; duplicate stat
  removed — up to 3 fewer blocking-pool hops per file (O19, O20)
• to_bytes_limited returns single-frame bodies zero-copy (O24)
• Metrics layer: slim in-flight guard holding the gauge handle directly;
  stack-buffer status labels (O21)
• Logging/OTel: route label skipped when the span is gated off; request-id
  HeaderValue built once; duplicate OTel set_attribute calls removed (O22, O23)
• JSON/Form content-type fast paths; SSE normalization skips allocations when
  no CR present (O26)

Deferred (documented in tracker)

• O1 — Handler-trait state-by-ref migration is breaking; the Arc'd-state
  clone at StateBound remains until then (Arc idiom documented at
  the call site)
• O7/O10/O17/O18 — micro/inherent; reasons in AUDIT_FINDINGS.md

Verification

Full gates on rustc 1.98.0 (same as CI):

cargo clippy --workspace --all-features -- -D warnings   ✅ 0 errors
cargo fmt --all -- --check                               ✅
cargo test  --workspace --all-features                   ✅ 171 passed / 0 failed

Re-run the benchmark suite after merging to refresh BENCHMARK_REPORT.md.