@@ -48,3 +48,7 @@ uuid = { version = "1", features = ["v4"] }
 reqwest = { version = "0.12", features = ["blocking", "json", "multipart", "rustls-tls"], default-features = false }
 # HMAC
 hmac = "0.12"
+
+[profile.release]
+lto = "thin"
+strip = "symbols"
@@ -272,8 +272,7 @@ fn handle_connect(
     let mut req = client
         .post(&post_url)
         .header("Content-Type", format!("application/x-{}-request", service))
-        .header("User-Agent", "git/2.0 git-remote-gitlawb/0.1.0")
-        .body(request_body.clone());
+        .header("User-Agent", "git/2.0 git-remote-gitlawb/0.1.0");
 
     // Add RFC 9421 HTTP Signature auth on push operations
     if service == "git-receive-pack" {
@@ -291,7 +290,12 @@ fn handle_connect(
         }
     }
 
-    let pack_resp = req.send().with_context(|| format!("POST {post_url}"))?;
+    // Attach the body after signing so the pack bytes are moved, not cloned —
+    // packs can be large and the clone doubled peak memory on push.
+    let pack_resp = req
+        .body(request_body)
+        .send()
+        .with_context(|| format!("POST {post_url}"))?;
 
     if !pack_resp.status().is_success() {
         bail!("POST /{} returned {}", service, pack_resp.status());
 
@@ -127,7 +127,7 @@ impl Attestation {
                 self.type_
             )));
         }
-        Ok(serde_json::from_value(self.payload.clone())?)
+        Ok(P::deserialize(&self.payload)?)
     }
 }
 
 
@@ -129,7 +129,7 @@ impl HttpSignature {
     pub fn missing_components(&self) -> Vec<&str> {
         COVERED_COMPONENTS
             .iter()
-            .filter(|c| !self.components.contains(&c.to_string()))
+            .filter(|c| !self.components.iter().any(|s| s.as_str() == **c))
             .copied()
             .collect()
     }
 
@@ -3,7 +3,9 @@
 //! Repos are stored as `repos/v1/{owner_slug}/{repo_name}.tar.zst` — a
 //! zstd-compressed tar archive of the bare repo directory.
 
-use std::path::Path;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, OnceLock};
 
 use anyhow::{Context, Result};
 use aws_sdk_s3::Client as S3Client;
@@ -110,8 +112,7 @@ impl TigrisClient {
             .collect()
             .await
             .context("reading tigris response body")?
-            .into_bytes()
-            .to_vec();
+            .into_bytes();
 
         // Extract tar.zst to local path
         tokio::task::spawn_blocking({
@@ -156,6 +157,23 @@ fn compress_repo(repo_path: &Path) -> Result<Vec<u8>> {
     Ok(compressed)
 }
 
+/// Per-repo-path lock serializing the publish (swap-into-place) step of
+/// `decompress_repo`. Concurrent extractions unpack into isolated temp dirs in
+/// parallel, but the final `remove_dir_all` + `rename` must not interleave for
+/// the same `local_path`, or they race to a nondeterministic overwrite/failure.
+fn publish_lock(local_path: &Path) -> Arc<Mutex<()>> {
+    // KNOWN LIMITATION: this map is never evicted — one (PathBuf, Arc<Mutex>)
+    // entry accrues per distinct repo path for the process lifetime. Bounded by
+    // the number of repos a node hosts, so it's negligible for normal use, but
+    // high-volume/churning deployments may want LRU or weak-ref eviction here.
+    static LOCKS: OnceLock<Mutex<HashMap<PathBuf, Arc<Mutex<()>>>>> = OnceLock::new();
+    let locks = LOCKS.get_or_init(|| Mutex::new(HashMap::new()));
+    let mut map = locks.lock().expect("publish lock map poisoned");
+    map.entry(local_path.to_path_buf())
+        .or_insert_with(|| Arc::new(Mutex::new(())))
+        .clone()
+}
+
 /// Decompress a tar.zst byte vector into a local directory.
 ///
 /// Extraction is atomic with respect to `local_path`: the archive is unpacked
@@ -171,10 +189,12 @@ fn decompress_repo(data: &[u8], local_path: &Path) -> Result<()> {
         .file_name()
         .context("repo path has no file name")?
         .to_string_lossy();
-    let tmp_dir = parent.join(format!(".{file_name}.tmp-extract"));
+    // Unique per-extraction temp dir: a fixed name would let two concurrent
+    // extractions of the same repo share one dir and clobber each other's
+    // in-progress unpack. A fresh UUID also means it can't collide with a
+    // leftover dir from a previously-interrupted run.
+    let tmp_dir = parent.join(format!(".{file_name}.tmp-extract.{}", uuid::Uuid::new_v4()));
 
-    // Clear any leftover temp dir from a previously-interrupted extraction.
-    let _ = std::fs::remove_dir_all(&tmp_dir);
     std::fs::create_dir_all(&tmp_dir).context("creating temp extract dir")?;
 
     // Unpack into the temp dir; on any failure, clean up and bail without
@@ -192,7 +212,11 @@ fn decompress_repo(data: &[u8], local_path: &Path) -> Result<()> {
 
     // Swap the freshly-extracted repo into place. rename within the same parent
     // is effectively atomic, but most platforms refuse to rename onto a
-    // non-empty dir, so remove the old copy first.
+    // non-empty dir, so remove the old copy first. Serialize this per repo path:
+    // concurrent extractions unpack into isolated temp dirs, but their swaps
+    // must not interleave or they race to a nondeterministic overwrite/failure.
+    let lock = publish_lock(local_path);
+    let _publish = lock.lock().expect("publish lock poisoned");
     if local_path.exists() {
         std::fs::remove_dir_all(local_path).context("removing stale repo dir")?;
     }
 
@@ -34,9 +34,17 @@ impl RateLimiter {
     async fn check(&self, key: &str) -> bool {
         let now = Instant::now();
         let mut state = self.state.lock().await;
-        let window = state.entry(key.to_string()).or_insert_with(|| Window {
-            timestamps: Vec::new(),
-        });
+        // Look up before inserting so the common case (key already tracked)
+        // doesn't allocate a String per request.
+        if !state.contains_key(key) {
+            state.insert(
+                key.to_string(),
+                Window {
+                    timestamps: Vec::new(),
+                },
+            );
+        }
+        let window = state.get_mut(key).expect("window just ensured");
         window
             .timestamps
             .retain(|t| now.duration_since(*t) < self.window);
 
@@ -137,6 +137,17 @@ async fn run(
     }
 }
 
+/// Find the origin node's base HTTP URL for a sync item, trimming any trailing
+/// slash so callers can append `/{path}` cleanly. Returns `None` when no peer
+/// row matches the item's origin DID. Kept pure (no DB) so the per-batch peer
+/// resolution can be unit-tested without a database.
+fn resolve_origin_url(peers: &[crate::db::PeerRecord], node_did: &str) -> Option<String> {
+    peers
+        .iter()
+        .find(|p| p.did == node_did)
+        .map(|p| p.http_url.trim_end_matches('/').to_string())
+}
+
 async fn process_batch(
     db: &Db,
     config: &Config,
@@ -152,19 +163,27 @@ async fn process_batch(
         }
     };
 
-    for item in items {
-        // Resolve origin node HTTP URL from peer table
-        let peers = match db.list_peers().await {
-            Ok(p) => p,
-            Err(e) => {
-                warn!(err = %e, "failed to list peers for sync");
+    // Nothing queued — the common case on the 30s idle poll. Bail before the
+    // peer lookup so an empty batch costs zero extra DB round-trips.
+    if items.is_empty() {
+        return;
+    }
+
+    // Resolve the peer table once per batch — every item only needs a lookup.
+    let peers = match db.list_peers().await {
+        Ok(p) => p,
+        Err(e) => {
+            warn!(err = %e, "failed to list peers for sync");
+            for item in &items {
                 let _ = db.mark_sync_failed(&item.id).await;
-                continue;
             }
-        };
+            return;
+        }
+    };
 
-        let origin_url = match peers.iter().find(|p| p.did == item.node_did) {
-            Some(p) => p.http_url.trim_end_matches('/').to_string(),
+    for item in items {
+        let origin_url = match resolve_origin_url(&peers, &item.node_did) {
+            Some(url) => url,
             None => {
                 warn!(node_did = %item.node_did, repo = %item.repo, "no peer URL found for sync origin — skipping");
                 let _ = db.mark_sync_failed(&item.id).await;
@@ -762,4 +781,43 @@ mod tests {
         register_replica_with_origin(&client, &keypair, Some(""), "http://127.0.0.1:1", "o", "r")
             .await;
     }
+
+    fn peer(did: &str, http_url: &str) -> crate::db::PeerRecord {
+        crate::db::PeerRecord {
+            did: did.to_string(),
+            http_url: http_url.to_string(),
+            last_seen: None,
+            last_ping_ok: false,
+            announced_at: String::new(),
+        }
+    }
+
+    #[test]
+    fn resolve_origin_url_matches_and_trims_trailing_slash() {
+        let peers = vec![
+            peer("did:key:a", "https://a.example/"),
+            peer("did:key:b", "https://b.example"),
+        ];
+        // Trailing slash is trimmed so callers can append `/{path}` cleanly.
+        assert_eq!(
+            resolve_origin_url(&peers, "did:key:a").as_deref(),
+            Some("https://a.example")
+        );
+        // Already-trimmed URLs pass through unchanged.
+        assert_eq!(
+            resolve_origin_url(&peers, "did:key:b").as_deref(),
+            Some("https://b.example")
+        );
+    }
+
+    #[test]
+    fn resolve_origin_url_returns_none_for_unknown_did() {
+        let peers = vec![peer("did:key:a", "https://a.example")];
+        assert_eq!(resolve_origin_url(&peers, "did:key:unknown"), None);
+    }
+
+    #[test]
+    fn resolve_origin_url_returns_none_for_empty_peer_list() {
+        assert_eq!(resolve_origin_url(&[], "did:key:a"), None);
+    }
 }
Original file line number	Diff line number	Diff line change
`@@ -127,7 +127,7 @@ impl Attestation {`
`127`	`127`	`self.type_`
`128`	`128`	`)));`
`129`	`129`	`}`
`130`		`- Ok(serde_json::from_value(self.payload.clone())?)`
	`130`	`+ Ok(P::deserialize(&self.payload)?)`
`131`	`131`	`}`
`132`	`132`	`}`
`133`	`133`
Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ impl HttpSignature {`
`129`	`129`	`pub fn missing_components(&self) -> Vec<&str> {`
`130`	`130`	`COVERED_COMPONENTS`
`131`	`131`	`.iter()`
`132`		`- .filter(\|c\| !self.components.contains(&c.to_string()))`
	`132`	`+ .filter(\|c\| !self.components.iter().any(\|s\| s.as_str() == **c))`
`133`	`133`	`.copied()`
`134`	`134`	`.collect()`
`135`	`135`	`}`