net-mesh-cli 0.27.2__tar.gz → 0.27.3__tar.gz

net_mesh_cli-0.27.3/.config/nextest.toml

@@ -0,0 +1,19 @@
+# cargo-nextest configuration.
+#
+# Retries for timing-sensitive integration suites.
+#
+# Several suites here exercise the reliable-stream transport over loopback UDP
+# and/or spawn `net` CLI subprocesses that stand up full mesh nodes. They are
+# correct but inherently timing-sensitive: under a full-workspace run the CPU
+# is oversubscribed, so grant/ACKs can slip past the transport retransmit
+# budget and a data stream resets ("holder reset stream (retransmit
+# exhausted)"), or a second-resolution token expires before a subscribe
+# handshake lands. Each passes in isolation and at moderate load.
+#
+# nextest re-runs a failed test in a FRESH, isolated process. A load flake
+# passes on the re-run; a genuine logic bug fails all attempts — so retries
+# absorb saturation noise without masking real regressions. CI already runs
+# with `--no-fail-fast`, so this only changes the per-test outcome, not the
+# matrix.
+[profile.default]
+retries = 2

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/Cargo.lock

@@ -412,9 +412,9 @@ dependencies = [
 
 [[package]]
 name = "block-buffer"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
 ]
@@ -1140,7 +1140,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.0",
+ "block-buffer 0.12.1",
  "const-oid 0.10.2",
  "crypto-common 0.2.2",
 ]
@@ -2319,7 +2319,7 @@ dependencies = [
 
 [[package]]
 name = "net-aggregator-daemon"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "assert_cmd",
  "blake3",
@@ -2341,7 +2341,7 @@ dependencies = [
 
 [[package]]
 name = "net-cli"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "assert_cmd",
  "clap",
@@ -2369,7 +2369,7 @@ dependencies = [
 
 [[package]]
 name = "net-compute-ffi"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "bytes",
  "dashmap",
@@ -2384,7 +2384,7 @@ dependencies = [
 
 [[package]]
 name = "net-deck"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "bytes",
  "chrono",
@@ -2402,7 +2402,7 @@ dependencies = [
 
 [[package]]
 name = "net-deck-ffi"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "futures",
  "net-mesh",
@@ -2414,7 +2414,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "arc-swap",
  "async-nats",
@@ -2445,6 +2445,7 @@ dependencies = [
  "redis",
  "reed-solomon-erasure",
  "regex",
+ "ring",
  "semver",
  "serde",
  "serde_json",
@@ -2462,7 +2463,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh-sdk"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2485,7 +2486,7 @@ dependencies = [
 
 [[package]]
 name = "net-mesh-sdk-macros"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2494,7 +2495,7 @@ dependencies = [
 
 [[package]]
 name = "net-meshdb-ffi"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "futures",
  "net-mesh",
@@ -2506,7 +2507,7 @@ dependencies = [
 
 [[package]]
 name = "net-meshos-ffi"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "bytes",
  "net-mesh",
@@ -2517,7 +2518,7 @@ dependencies = [
 
 [[package]]
 name = "net-node"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -2540,7 +2541,7 @@ dependencies = [
 
 [[package]]
 name = "net-python"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "async-trait",
  "bytes",
@@ -2553,7 +2554,7 @@ dependencies = [
  "postcard",
  "pyo3",
  "pyo3-async-runtimes",
- "pyo3-build-config",
+ "pyo3-build-config 0.29.0",
  "serde_json",
  "tokio",
  "zeroize",
@@ -2561,7 +2562,7 @@ dependencies = [
 
 [[package]]
 name = "net-rpc-ffi"
-version = "0.27.2"
+version = "0.27.3"
 dependencies = [
  "async-trait",
  "bytes",
@@ -3141,7 +3142,7 @@ dependencies = [
  "libc",
  "once_cell",
  "portable-atomic",
- "pyo3-build-config",
+ "pyo3-build-config 0.28.3",
  "pyo3-ffi",
  "pyo3-macros",
 ]
@@ -3169,6 +3170,15 @@ dependencies = [
  "target-lexicon",
 ]
 
+[[package]]
+name = "pyo3-build-config"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
+dependencies = [
+ "target-lexicon",
+]
+
 [[package]]
 name = "pyo3-ffi"
 version = "0.28.3"
@@ -3176,7 +3186,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e"
 dependencies = [
  "libc",
- "pyo3-build-config",
+ "pyo3-build-config 0.28.3",
 ]
 
 [[package]]
@@ -3199,7 +3209,7 @@ checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
+ "pyo3-build-config 0.28.3",
  "quote",
  "syn 2.0.117",
 ]
@@ -3933,9 +3943,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "snow"

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/Cargo.toml

@@ -3,7 +3,7 @@ members = [".", "sdk", "cli", "aggregator-daemon"]
 
 [package]
 name = "net-mesh"
-version = "0.27.2"
+version = "0.27.3"
 edition = "2021"
 description = "High-performance, schema-agnostic, backend-agnostic event bus"
 license = "Apache-2.0"
@@ -71,6 +71,7 @@ redis = ["dep:redis"]
 jetstream = ["dep:async-nats"]
 net = [
     "dep:chacha20poly1305",
+    "dep:ring",
     "dep:snow",
     "dep:getrandom",
     "dep:dashmap",
@@ -225,6 +226,19 @@ arc-swap = "1.7.1"
 
 # Net adapter (optional)
 chacha20poly1305 = { version = "0.10", optional = true }
+# Packet-path AEAD (RFC 8439 ChaCha20-Poly1305) — CRYPTO SPIKE
+# (2026-06-11). The RustCrypto chacha20poly1305 stack pays ~700 ns
+# of per-MESSAGE fixed cost in poly1305 0.8's AVX2 backend
+# (Poly1305::new re-derives the r^1..r^4 key powers per call),
+# dominating small-packet encrypt/decrypt (975 ns at 64 B vs
+# ~0.47 ns/B marginal). ring's asm implementation has both low
+# fixed cost and higher bulk rate. Wire format is unchanged —
+# both implement RFC 8439, so ciphertexts are byte-identical and
+# mixed-version meshes interoperate (pinned by the cross-impl
+# round-trip tests in crypto.rs). chacha20poly1305 stays for the
+# IdentityEnvelope XChaCha sealed-box and as the cross-impl test
+# oracle.
+ring = { version = "0.17", optional = true }
 snow = { version = "0.10.0", optional = true }
 getrandom = { version = "0.4.2", optional = true }
 dashmap = { version = "6", optional = true }

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: net-mesh-cli
-Version: 0.27.2
+Version: 0.27.3
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/README.md

@@ -1394,3 +1394,15 @@ Note: handshake relay no longer consumes a subprotocol ID — it rides as a rout
 ## License
 
 Apache-2.0
+
+### Third-party license notice
+
+The default `net` feature links [`ring`](https://crates.io/crates/ring)
+for the packet-path ChaCha20-Poly1305 AEAD. *ring* is distributed
+under an ISC-style license together with notices for portions
+derived from BoringSSL and OpenSSL/SSLeay; see the
+[ring LICENSE](https://github.com/briansmith/ring/blob/main/LICENSE)
+for the full text. Binary distributions that bundle the compiled
+library (the published Python wheels, npm prebuilds, Go FFI static
+libraries, and release binaries) include *ring*'s object code and
+should retain that notice alongside their own license files.

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/aggregator-daemon/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "net-aggregator-daemon"
-version = "0.27.2"
+version = "0.27.3"
 edition = "2021"
 description = "Long-running daemon that hosts net-mesh AggregatorRegistry + aggregator groups"
 license = "Apache-2.0"
@@ -18,14 +18,14 @@ path = "src/main.rs"
 [dependencies]
 # Substrate primitives — aggregator + lifecycle + registry +
 # RPC service all live behind the SDK's `net` feature surface.
-net-sdk = { package = "net-mesh-sdk", version = "0.27.2", path = "../sdk", default-features = false, features = [
+net-sdk = { package = "net-mesh-sdk", version = "0.27.3", path = "../sdk", default-features = false, features = [
     "net",
     "nat-traversal",
 ] }
 # Direct dep on the underlying crate so the binary can reach
 # the typed surfaces the SDK doesn't re-export (AggregatorConfig,
 # LifecycleGroup, etc).
-net = { package = "net-mesh", version = "0.27.2", path = ".." }
+net = { package = "net-mesh", version = "0.27.3", path = ".." }
 
 # Argv parsing.
 clap = { version = "4", features = ["derive", "env"] }

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/benches/ingestion.rs

@@ -3,7 +3,8 @@
 use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use serde_json::json;
 
-use net::config::BackpressureMode;
+use net::bus::EventBus;
+use net::config::{BackpressureMode, EventBusConfig};
 use net::event::{InternalEvent, RawEvent};
 use net::shard::ShardManager;
 use net::timestamp::TimestampGenerator;
@@ -159,12 +160,115 @@ fn bench_batch_pop(c: &mut Criterion) {
     group.finish();
 }
 
+/// PERF_AUDIT bench-coverage-gap #1 — drives
+/// [`EventBus::ingest_raw`] with 1/2/4/8 producer threads. The
+/// bus-level hot path the existing single-threaded `bench_shard`
+/// can't see lives here: the bus-side `events_ingested` counter
+/// (striped per PERF_AUDIT §1.1+§1.2) plus the dynamic-scaling
+/// metrics collector subsampling (§1.3) all run on each
+/// `ingest_raw`. Multi-producer contention is the regime where
+/// the striped-counter fix shows up — under a single producer
+/// the cache line never bounces, so the pre-fix vs post-fix
+/// numbers look identical.
+///
+/// Bench shape:
+///   - Pool of 256 pre-built [`RawEvent`] templates with distinct
+///     payloads, cloned per push (a refcount bump; no JSON
+///     re-serialization). The pool matters: `RawEvent` caches the
+///     xxh3 hash of its bytes for shard routing, so a single
+///     template would pin EVERY event to one shard and the bench
+///     would measure that shard's mutex instead of the bus layer.
+///   - `BackpressureMode::DropOldest` so a saturated ring never
+///     stalls a producer.
+///   - 16-shard bus so producers route to distinct shards
+///     statistically — the bench measures contention on the
+///     bus-level counter, NOT per-shard mutex contention (the
+///     dynamic-scaling regime is a separate axis the audit
+///     covers under §1.3 / §1.4).
+fn bench_event_bus_ingest_raw_concurrent(c: &mut Criterion) {
+    let mut group = c.benchmark_group("event_bus_ingest_raw_concurrent");
+
+    const EVENTS_PER_BATCH: u64 = 8_192;
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .build()
+        .expect("tokio runtime for bench setup");
+
+    for &producers in &[1usize, 2, 4, 8] {
+        group.throughput(Throughput::Elements(EVENTS_PER_BATCH));
+        group.bench_with_input(
+            BenchmarkId::new("producers", producers),
+            &producers,
+            |b, &producers| {
+                // One bus per producer-count benchmark (not per
+                // `b.iter` sample — bus setup is far too heavy for
+                // that). 16 shards × 64 K capacity gives the drain
+                // workers plenty of headroom against the 8 K events
+                // per sample, and DropOldest means a transiently
+                // saturated ring evicts instead of stalling a
+                // producer mid-sample.
+                let config = EventBusConfig::builder()
+                    .num_shards(16)
+                    .ring_buffer_capacity(65_536)
+                    .backpressure_mode(BackpressureMode::DropOldest)
+                    .build()
+                    .unwrap();
+                let bus = std::sync::Arc::new(
+                    runtime
+                        .block_on(EventBus::new(config))
+                        .expect("EventBus::new for bench"),
+                );
+                // Distinct payloads → distinct cached hashes →
+                // statistical spread across the 16 shards. A single
+                // template would route every event to ONE shard
+                // (RawEvent pre-computes its routing hash) and
+                // serialize all producers on that shard's mutex.
+                let templates: Vec<RawEvent> = (0..256)
+                    .map(|i| RawEvent::from_str(&format!(r#"{{"i":{i}}}"#)))
+                    .collect();
+
+                b.iter(|| {
+                    let per_thread = EVENTS_PER_BATCH as usize / producers;
+                    std::thread::scope(|scope| {
+                        for t in 0..producers {
+                            let bus = std::sync::Arc::clone(&bus);
+                            let templates = &templates;
+                            scope.spawn(move || {
+                                // Stagger each producer's start
+                                // offset so threads don't push the
+                                // same template (= same shard) in
+                                // lockstep.
+                                let mut idx = t * 31;
+                                for _ in 0..per_thread {
+                                    let _ = bus.ingest_raw(templates[idx & 255].clone());
+                                    idx = idx.wrapping_add(1);
+                                }
+                            });
+                        }
+                    });
+                });
+
+                // EventBus::shutdown consumes `self`, so we can't
+                // call it through the Arc handle. Drop the Arc and
+                // rely on the bus's `Drop` to tear down background
+                // workers. The runtime stays alive across
+                // iterations to amortize its setup cost.
+                drop(bus);
+            },
+        );
+    }
+
+    group.finish();
+}
+
 criterion_group!(
     benches,
     bench_shard,
     bench_timestamp,
     bench_event_creation,
     bench_batch_pop,
+    bench_event_bus_ingest_raw_concurrent,
 );
 
 criterion_main!(benches);

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/benches/net.rs

@@ -228,7 +228,8 @@ fn bench_packet_build(c: &mut Criterion) {
     group.finish();
 }
 
-/// Benchmark encryption/decryption (via PacketBuilder which uses XChaCha20-Poly1305).
+/// Benchmark encryption/decryption (via PacketBuilder — ChaCha20-Poly1305
+/// IETF, 12-byte template+counter nonces; see crypto::PacketCipher).
 fn bench_encryption(c: &mut Criterion) {
     let mut group = c.benchmark_group("net_encryption");
 
@@ -253,6 +254,96 @@ fn bench_encryption(c: &mut Criterion) {
         );
     }
 
+    // Decomposition: the raw AEAD call alone — crate-level
+    // `ChaCha20Poly1305::encrypt_in_place_detached` with a
+    // template nonce and a 56-byte AAD (the size
+    // `NetHeader::aad()` produces), isolating cipher cost from
+    // the builder's framing / header / buffer work in `encrypt/N`
+    // above. The gap between `encrypt/N` and `raw_aead/N` is the
+    // builder's overhead; the raw fixed cost at small sizes is
+    // the crate's per-message setup (one ChaCha block to derive
+    // the one-time Poly1305 key, plus poly1305 0.8's per-message
+    // AVX2 key-power precomputation — amortized only on multi-KB
+    // payloads).
+    {
+        use chacha20poly1305::{
+            aead::{AeadInPlace, KeyInit},
+            ChaCha20Poly1305,
+        };
+        let cipher = ChaCha20Poly1305::new((&key).into());
+        let aad = [0x42u8; 56];
+        // Prefix-filled template, exactly `PacketCipher`'s shape:
+        // the 4-byte session prefix is derived ONCE at construction
+        // (any non-zero stand-in works — AEAD timing is independent
+        // of nonce VALUES); per call the template is copied and only
+        // the counter bytes 4..12 are overwritten, mirroring
+        // `nonce_from_counter` instruction-for-instruction.
+        let nonce_template: [u8; 12] = [0x12, 0x34, 0x56, 0x78, 0, 0, 0, 0, 0, 0, 0, 0];
+        for payload_size in [64usize, 256, 1024, 4096].iter() {
+            let mut buf = vec![0x42u8; *payload_size];
+            let mut counter = 0u64;
+            // Cheap clone (key schedule state) so each size's move
+            // closure owns its instance.
+            let cipher = cipher.clone();
+            group.throughput(Throughput::Bytes(*payload_size as u64));
+            group.bench_with_input(
+                BenchmarkId::new("raw_aead", payload_size),
+                payload_size,
+                move |b, _| {
+                    b.iter(|| {
+                        // Counter bump keeps (key, nonce) pairs
+                        // unique across iterations.
+                        counter = counter.wrapping_add(1);
+                        let mut nonce = nonce_template;
+                        nonce[4..12].copy_from_slice(&counter.to_le_bytes());
+                        let tag = cipher
+                            .encrypt_in_place_detached((&nonce).into(), &aad, &mut buf)
+                            .expect("AEAD encrypt cannot fail on valid inputs");
+                        std::hint::black_box(tag)
+                    });
+                },
+            );
+        }
+    }
+
+    // ring's RFC 8439 implementation — the backend `PacketCipher`
+    // uses post-spike. `raw_aead` above stays as the RustCrypto
+    // reference so the cipher-vs-cipher fixed/marginal profile is
+    // visible side by side in every run.
+    {
+        use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305};
+        let aad = [0x42u8; 56];
+        // Same prefix-filled template shape as `raw_aead` above —
+        // see the comment there.
+        let nonce_template: [u8; 12] = [0x12, 0x34, 0x56, 0x78, 0, 0, 0, 0, 0, 0, 0, 0];
+        for payload_size in [64usize, 256, 1024, 4096].iter() {
+            let unbound = UnboundKey::new(&CHACHA20_POLY1305, &key).expect("32-byte key");
+            let cipher = LessSafeKey::new(unbound);
+            let mut buf = vec![0x42u8; *payload_size];
+            let mut counter = 0u64;
+            group.throughput(Throughput::Bytes(*payload_size as u64));
+            group.bench_with_input(
+                BenchmarkId::new("raw_ring", payload_size),
+                payload_size,
+                move |b, _| {
+                    b.iter(|| {
+                        counter = counter.wrapping_add(1);
+                        let mut nonce = nonce_template;
+                        nonce[4..12].copy_from_slice(&counter.to_le_bytes());
+                        let tag = cipher
+                            .seal_in_place_separate_tag(
+                                Nonce::assume_unique_for_key(nonce),
+                                Aad::from(&aad),
+                                &mut buf,
+                            )
+                            .expect("seal cannot fail on valid inputs");
+                        std::hint::black_box(tag)
+                    });
+                },
+            );
+        }
+    }
+
     group.finish();
 }
 
@@ -2356,16 +2447,34 @@ fn bench_capability_fold_scaling(c: &mut Criterion) {
     for node_count in [1000, 5000, 10000, 50000].iter() {
         let fold = Fold::<CapabilityFold>::with_sweep_interval(Duration::ZERO);
         for i in 0..*node_count {
-            let caps = sample_capability_set(i as u64);
+            let mut caps = sample_capability_set(i as u64);
+            // Fixed-cardinality discovery target: exactly 100 nodes
+            // carry this tag at EVERY fleet size. `query_tag_rare`
+            // below isolates indexed-lookup cost from result
+            // materialization — `query_tag`'s "inference" rides on
+            // half the fleet (`sample_capability_set` tags every
+            // even index), so its per-query growth with node_count
+            // is the result set, not the index.
+            if i < 100 {
+                caps = caps.add_tag("rare-fixed");
+            }
             let ann =
                 CapabilityAnnouncement::new(i as u64, EntityId::from_bytes([0u8; 32]), 1, caps);
             capability_bridge::apply_legacy_announcement(&fold, ann)
                 .expect("apply legacy announcement in fixture");
         }
 
+        // Throughput is per MATCH, not per query: a query that
+        // returns half the fleet is information-theoretically
+        // O(matches), so per-query wall time grows linearly with
+        // node_count by fixture construction. Per-match throughput
+        // is the metric that's comparable across sizes —
+        // 2026-06-11 service-discovery feedback read the per-query
+        // growth as "linear scan" when the linear factor was the
+        // result set, not the lookup.
         let tag_filter = CapabilityFilter::new().require_tag("inference");
-
-        group.throughput(Throughput::Elements(1));
+        let tag_matches = capability_bridge::find_nodes_matching(&fold, &tag_filter).len() as u64;
+        group.throughput(Throughput::Elements(tag_matches.max(1)));
         group.bench_with_input(
             BenchmarkId::new("query_tag", node_count),
             node_count,
@@ -2378,7 +2487,9 @@ fn bench_capability_fold_scaling(c: &mut Criterion) {
             .require_tag("inference")
             .require_gpu()
             .with_min_memory(70);
-
+        let complex_matches =
+            capability_bridge::find_nodes_matching(&fold, &complex_filter).len() as u64;
+        group.throughput(Throughput::Elements(complex_matches.max(1)));
         group.bench_with_input(
             BenchmarkId::new("query_complex", node_count),
             node_count,
@@ -2386,6 +2497,27 @@ fn bench_capability_fold_scaling(c: &mut Criterion) {
                 b.iter(|| capability_bridge::find_nodes_matching(&fold, &complex_filter));
             },
         );
+
+        // The fleet-scale discovery shape: constant match
+        // cardinality (100) while node_count scales. With the
+        // inverted `by_tag` index + the single-constraint borrowed
+        // fast path this should hold roughly flat as node_count
+        // grows; growth here would mean the index itself (not
+        // result materialization) is degrading.
+        let rare_filter = CapabilityFilter::new().require_tag("rare-fixed");
+        let rare_matches = capability_bridge::find_nodes_matching(&fold, &rare_filter).len() as u64;
+        assert_eq!(
+            rare_matches, 100,
+            "rare-tag fixture must stay fixed-cardinality across fleet sizes"
+        );
+        group.throughput(Throughput::Elements(rare_matches));
+        group.bench_with_input(
+            BenchmarkId::new("query_tag_rare", node_count),
+            node_count,
+            |b, _| {
+                b.iter(|| capability_bridge::find_nodes_matching(&fold, &rare_filter));
+            },
+        );
     }
 
     group.finish();

{net_mesh_cli-0.27.2 → net_mesh_cli-0.27.3}/benches/origin_cache_bench.rs

@@ -12,10 +12,11 @@
 //!
 //! Run: `cargo bench --bench origin_cache_bench --features net`
 
-use criterion::{black_box, criterion_group, criterion_main, BatchSize, Criterion};
+use criterion::{criterion_group, criterion_main, BatchSize, Criterion};
 use dashmap::DashMap;
 use lru::LruCache;
 use parking_lot::Mutex;
+use std::hint::black_box;
 use std::num::NonZeroUsize;
 use std::sync::Arc;