[helly25]

Cached hash values now reach actions and fields without temporary string copies. Plain records use their final storage directly, and escaped output copies printable runs in bulk. This reduces allocation churn and improves repeated hash-field workloads on both macOS and Linux.

AG;DR

Dependency and merge order: #1066 is merged; this PR is synchronized directly onto main. #1068 is the dependent follow-up. The synchronization preserves all runtime/test code and dependency updates; it also fixes the concrete CI deadline below. The cross-platform measurements below predate #1065 and remain historical qualification; this PR’s current-head CI verifies the synchronized configuration.

Implementation and ownership:

• Snapshot::DigestView borrows stable cached map-node bytes; the owning Digest API remains available. Invalidation, transfer, moving and destruction end the public borrow contract.
• Hash actions own their final concatenation before invoking the sink. Equality checks consume the view synchronously. Supplied-snapshot fields borrow; a field using a local snapshot retains its owning digest fallback, including extraction/transform calls.
• Plain rendering avoids a separate path-body string. C-escaping appends contiguous printable runs once, preserving exact control/high bytes, colors, terminators, display cells and tree output. Escape expansion can still grow storage.
• No flags, dependencies, worker changes, locks, cross-file caches, new exception paths or host-I/O routes are added. O22b hash-field binding and O22c2 reusable command/row buffers remain explicitly open.

Qualification:

• Both hosts pass all 325 extension-enabled release suites and eight focused ASan suites. Linux also passes eight focused MSan and eight TSan suites, with FUSE required. The refined fixture is checked in every configuration. Selected-source guards run before validation and after source-swapping diagnostics.
• Per host: 120 native rows, 984 memory runs, 40 native confirmation rows and 126 memory confirmation runs. Four variants distinguish baseline, digest-only, record-only and combined mechanisms; confirmation adds a byte-identical baseline participant. Independent hashlib values and full command output are checked.
• Final memory matrices batch at most eight same-family/same-CPU cases per process, preserving per-case warmup, nine repetitions and fastest-seven selection with rotating participant/block order. This amortizes Google Benchmark 1.9.5’s untimed one-second Mac CPU-frequency metadata fallback. A separate complete Linux case-isolated matrix remains in the evidence.
• Repeated hash fields improve about 7.8% through the whole engine on Linux and 7.4% on Mac. Cached 16-field rendering improves about 32% / 25%; 160-byte raw records about 60% / 34%, and escaped colored records about 72% / 58%.
• Slower controls are retained: tiny colored records cost roughly 6–17 ns more, with large relative percentages on very small baseline times. Native worst cells are about +3.0% Linux and +1.7% Mac. Do not interpret these results as a universal speedup.
• Separate warmed calling-thread ASan diagnostics show cached 16-field rendering dropping from 21 allocation requests to 5, long plain records from 2 to 1, and long escaped colored records from 4 to 2. Requested bytes, release timings and retained/RSS memory are distinct; no peak-memory reduction is claimed.
• Unstripped full CLI: Linux -1,392 bytes, Mac unchanged. No new dependency/license obligations.

docs/benchmarks/digest-and-record-storage-20261103.md links exact lossless source/configuration, all populations, slower controls, diagnostics, correctness logs and rejected prototype evidence. The first combined prototype regressed escaped Linux records and was rejected. Its complete Linux evidence, full Mac native matrix and explicitly partial Mac memory population remain separate; obsolete Mac prototype work was intentionally stopped rather than claiming full validation. The revised bulk-append candidate received full qualification on both hosts.

Real scoped clang-tidy passed on both hosts, including the header-selected Mac consumers and failed-file refinements. Normal enforcing commit/push hooks and this PR’s current-head CI determine readiness; local qualification does not replace those checks. The changelog, performance analysis, TODO subitems, manual benchmark indexing and release-site report mapping are included.

CI deadline recovery:

• The Linux benchmark-build job in run 41560264457 was cancelled because it exceeded its configured 30-minute limit; GitHub's check annotation explicitly reports that deadline. It reached the whole-engine expression measurement after the cold build and preparation measurements. This was not a source/test failure.
• Raise only the Linux benchmark-build limit to 60 minutes, matching macOS. All cases, repetitions, correctness oracles, measurement shard limits and required checks remain intact. The fix is included with the required post-Reuse archive input buffers without per-chunk allocations #1066 synchronization so one fresh run validates the final main-based head.
• Evidence: https://github.com/mboworks/xff/actions/runs/41560264457/job/125669837218 . The cancelled old-base context is not reused or counted as a successful run.