OpenUSS fast-path performance improvement notes

Scope
Read-only review findings for the daemon file-access fast path. Use this as the working checklist for manual optimization.

Highest-impact findings
1. Clean-cache hits intentionally still do Behaviour Shield work before allowing the blocked open.
   - daemon/src/scangroup/filesystem_worker.rs:122-156 submits to Behaviour Shield before handling CleanCacheHit.
   - daemon/src/behaviour_shield/event.rs:64-79 and 113-127 can clone path/types and duplicate the fanotify fd with fcntl().
   - Constraint: do not move Behaviour Shield after clean-cache allow. Behaviour Shield reasons about the accessing process and must be able to block that process before access is allowed.

2. The global FileFilter mutex covers too much hot-path work.
   - daemon/src/scangroup/filesystem_worker.rs:58-120 locks FileFilter across watched glob matching, cache invalidation, fstat(), ignored/exclusion checks, and cache lookup.
   - daemon/src/scangroup/file_filter.rs:1027-1050 fingerprints the fd with fstat().
   - Optimization target: compute fd fingerprint before taking the filter lock; split immutable matching config from mutable clean-cache state.

3. Every permission-event miss loads full process info before binary exclusion checks.
   - daemon/src/scangroup/filesystem_worker.rs:241-268 calls ProcessInfo::load_from_pid().
   - daemon/src/queue/process_info.rs:62-85 reads /proc/<pid>/comm, /proc/<pid>/cmdline, and /proc/<pid>/exe.
   - Current decision: not a first-pass target because binary exclusions are expected to exist in normal deployments.

4. Held permission scans always take an extra deferred-worker hop.
   - daemon/src/scangroup/filesystem_worker.rs:342-350 queues held events to DeferredScanQueue.
   - daemon/src/scangroup/deferred_scan.rs:387-464 later pushes to SHM.
   - Optimization target: try a zero/very-short direct priority SHM push when scanner is healthy; fall back to deferred retry only on contention.

5. Scanner fd handoff is serialized through one socket lock.
   - daemon/src/engine/engine.rs:810-829 uses fd_socket_lock around fd request/receive.
   - Optimization target: per-scanner-thread sockets or sharded fd maps/sockets.

6. ClamAV scan setup is per file.
   - daemon/src/engine/clamav_engine.rs:428-441 rebuilds scan settings, a HashSet, and a Tokio runtime per scan.
   - Optimization target: reuse one runtime per scanner thread, precompute immutable ClamScanSettings, and reuse scratch state.

Permission event path
1. Kernel blocks the caller and emits FAN_OPEN_PERM or FAN_OPEN_EXEC_PERM.
2. Fanotify reader reads raw events: daemon/src/filesystem_events/fanotify_monitor.rs:192-221.
3. Event is normalized into FilesystemEvent with Vec<EventType>: daemon/src/filesystem_events/fanotify_monitor.rs:42-71 and 206-212.
4. Event is sent through unbounded std::sync::mpsc: daemon/src/filesystem_events/fanotify_monitor.rs:188-221.
5. Scan-group responder receives it: daemon/src/scangroup/filesystem_worker.rs:43-49.
6. PermissionEventGuard is created for fail-closed cleanup: daemon/src/scangroup/permission.rs:4-35.
7. FileFilter is locked: daemon/src/scangroup/filesystem_worker.rs:58-61.
8. Watched-path glob matching runs: daemon/src/scangroup/file_filter.rs:359-378.
9. Write/modify/replacement events invalidate in-memory clean cache: daemon/src/scangroup/filesystem_worker.rs:72-90.
10. Close-write events enqueue cache-warmer work: daemon/src/scangroup/filesystem_worker.rs:91-102.
11. Permission-event fd is fingerprinted with fstat(): daemon/src/scangroup/filesystem_worker.rs:104-107 and daemon/src/scangroup/file_filter.rs:1027-1050.
12. Scan decision checks ignored globs, system paths, file-only exclusions, clean-cache entry, fingerprint, and rescan interval: daemon/src/scangroup/file_filter.rs:435-488.
13. FileFilter is dropped: daemon/src/scangroup/filesystem_worker.rs:120.
14. Behaviour Shield submission happens before cache-hit allow: daemon/src/scangroup/filesystem_worker.rs:122-143.
15. If decision is CleanCacheHit, stats are updated and fanotify is allowed: daemon/src/scangroup/filesystem_worker.rs:147-156.
16. If decision is Skip, fanotify is allowed: daemon/src/scangroup/filesystem_worker.rs:158-167.
17. If scan is required, own-process bypass is checked: daemon/src/scangroup/filesystem_worker.rs:170-196.
18. FileScanRequest is built: daemon/src/scangroup/filesystem_worker.rs:198-239.
19. Process info is loaded from /proc: daemon/src/scangroup/filesystem_worker.rs:241-263 and daemon/src/queue/process_info.rs:62-85.
20. Binary exclusions are checked: daemon/src/scangroup/filesystem_worker.rs:264-274 and daemon/src/scangroup/exclusion.rs:231-245.
21. Cache miss stats and possible cache-warmer trigger happen: daemon/src/scangroup/filesystem_worker.rs:276-282.
22. If access_prevention=false, event is allowed immediately and scan is deferred: daemon/src/scangroup/filesystem_worker.rs:284-299.
23. If unblock_nonexecs=true and event is not exec, event is allowed immediately and scan is deferred: daemon/src/scangroup/filesystem_worker.rs:301-318.
24. Non-permission notification events stop here; close-write/background scanning is cache-warmer responsibility: daemon/src/scangroup/filesystem_worker.rs:320-327.
25. Held permission scan is marked fd-handoff-required and queued to deferred worker: daemon/src/scangroup/filesystem_worker.rs:329-350.
26. Deferred worker pops the request: daemon/src/scangroup/deferred_scan.rs:372-405.
27. Held fanotify fd is duplicated: daemon/src/scangroup/deferred_scan.rs:436-444 and 494-510.
28. Request is inserted into request_map: daemon/src/scangroup/deferred_scan.rs:447-451.
29. Handoff fd is inserted into fd_handoff_fds: daemon/src/scangroup/deferred_scan.rs:453-459.
30. Request is pushed to SHM queue with 10 ms timeout: daemon/src/scangroup/deferred_scan.rs:461-489.
31. Scanner child thread pops from SHM: daemon/src/engine/engine.rs:337-347.
32. Scanner child asks parent for the fd over Unix socket: daemon/src/engine/engine.rs:769-807 and 810-929.
33. Parent broker sends fd with SCM_RIGHTS: daemon/src/scangroup/scanner_child.rs:264-326.
34. Scanner fingerprints opened fd: daemon/src/engine/engine.rs:803-807.
35. Scanner runs all configured scanners: daemon/src/engine/engine.rs:492-533.
36. ClamAV scanner maps/scans fd: daemon/src/engine/clamav_engine.rs:416-494.
37. Scan result is pushed to result queue: daemon/src/engine/engine.rs:418-448.
38. Result worker pops result: daemon/src/scangroup/result_worker.rs:42-61.
39. Result worker matches result to original request: daemon/src/scangroup/result_worker.rs:53-61.
40. Clean result identity is verified against permission fingerprint: daemon/src/scangroup/result_worker.rs:68-90.
41. Held scan errors are requeued without answering access: daemon/src/scangroup/result_worker.rs:92-111.
42. Non-malicious held access is allowed: daemon/src/scangroup/result_worker.rs:113-119.
43. Clean cache is updated if generation/epoch still matches: daemon/src/scangroup/result_worker.rs:139-167 and daemon/src/scangroup/cache_identity.rs:29-39.
44. Malicious result applies configured action: daemon/src/scangroup/result_worker.rs:174-184 and 226-434.

Clean-cache-hit path
1. Fanotify event is read, normalized, and sent to responder: daemon/src/filesystem_events/fanotify_monitor.rs:192-221.
2. Responder locks FileFilter: daemon/src/scangroup/filesystem_worker.rs:58-61.
3. Watched path is checked: daemon/src/scangroup/filesystem_worker.rs:62-70 and daemon/src/scangroup/file_filter.rs:359-378.
4. Permission fd is fingerprinted with fstat(): daemon/src/scangroup/filesystem_worker.rs:104-107 and daemon/src/scangroup/file_filter.rs:1027-1050.
5. Ignored/system/exclusion/cache checks run: daemon/src/scangroup/file_filter.rs:441-488.
6. CleanCacheHit is produced: daemon/src/scangroup/file_filter.rs:473-484.
7. Behaviour Shield event is submitted before allowing: daemon/src/scangroup/filesystem_worker.rs:122-143.
8. Cache-hit stats are recorded: daemon/src/scangroup/filesystem_worker.rs:147-148 and daemon/src/scangroup/stats.rs:235-238.
9. Fanotify allow is sent: daemon/src/scangroup/filesystem_worker.rs:154-156 and daemon/src/scangroup/permission.rs:37-50.

Manual optimization checklist
1. Move fingerprint_fd() outside the FileFilter lock.
2. Replace glob-heavy watched-path matching with exact/prefix fast lanes.
3. Avoid PathBuf normalization on every event in matches_watched_path().
4. Cache process executable path by pid plus process start time if /proc reads show up in profiling.
5. Compute own-process bypass once per event. Done in this pass.
6. Store scanner/draining PIDs in atomics rather than Mutex<Option<i32>>.
7. Try direct SHM push for held permission scans when the scanner queue is healthy. Done: responder attempts one zero-timeout direct push and falls back to deferred retry.
8. Add reserved priority capacity for held permission scans.
9. Consider multiple deferred workers if fd duplication or SHM push becomes a bottleneck.
10. Reduce fd handoff serialization with per-thread sockets or sharded handoff maps.
11. Reuse ClamAV runtime/settings per scanner thread. Runtime reuse done in this pass.
12. Avoid per-scan HashSet allocation in ClamAV unless duplicate matches are possible or all_matches is enabled.
13. Replace Vec<EventType> with a compact bitmask.
14. Minimize stats locking before allow; cache-hit/miss rolling windows currently take a Mutex.
15. Make cache-warmer trigger checks cheaper on misses.
16. Be careful with mark_filesystem=true because it pushes broad filtering into user space.
17. Watch overlap with FileShield, since separate blocking fanotify groups can both hold the same user open.

Other fast paths
- Notification/close-write path: notification fds are closed immediately in the reader thread at daemon/src/filesystem_events/fanotify_monitor.rs:213-218; responder invalidates cache and may enqueue cache warmer at daemon/src/scangroup/filesystem_worker.rs:72-102.
- Early-allow path: access_prevention=false or unblock_nonexecs=true sends allow first, then queues post-festum scan at daemon/src/scangroup/filesystem_worker.rs:284-318.
- Cache-warmer path: close-write or low hit ratio queues background work at daemon/src/scangroup/cache_warmer.rs:162-222; worker scans via child socket without using normal SHM queues at daemon/src/scangroup/cache_warmer.rs:500-596.
- FileShield path: independent fanotify permission loop matches protected paths, resolves exe, and applies allow/block/ask at daemon/src/file_shield/shield.rs:211-419.
- Behaviour Shield path: scan-group responder builds/sends event; expensive process snapshots happen later in its worker at daemon/src/behaviour_shield/shield.rs:156-175.

Suggested first sprint
1. Move fstat/fingerprint out of the FileFilter mutex.
2. Add exact/prefix fast lanes for watched and ignored paths.
3. Profile /proc reads and process-info loading before changing binary-exclusion behavior.
4. Continue ClamAV scan setup work by precomputing scan settings and measuring per-scan allocation costs.
