fix: high-concurrency ECR hardening -- streams, memory, commit-gate

Cargo.toml

@@ -17,10 +17,12 @@ aws-sdk-ecrpublic = { version = "1", default-features = false, features = ["beha
 clap = { version = "4", default-features = false, features = ["derive", "std", "help", "usage", "error-context"] }
 google-cloud-auth = { version = "1.10", default-features = false }
 bytes = { version = "1", default-features = false }
+fastrand = { version = "2", default-features = false, features = ["std"] }
 hex = { version = "0.4", default-features = false, features = ["alloc"] }
 http = { version = "1", default-features = false }
 schemars = { version = "1.2", default-features = false, features = ["derive", "std"] }
 futures-util = { version = "0.3", default-features = false }
+pin-project-lite = { version = "0.2", default-features = false }
 serde = { version = "1", default-features = false, features = ["derive", "alloc"] }
 serde_json = { version = "1", default-features = false, features = ["alloc"] }
 serde_yaml = { package = "serde_yaml_ng", version = "0.10", default-features = false }
@@ -102,3 +104,10 @@ strip = true
 lto = true
 codegen-units = 1
 panic = "abort"
+
+# Release-equivalent codegen with symbols preserved for `samply` /
+# flamegraph work. Use via `cargo {test,build} --profile profiling`.
+[profile.profiling]
+inherits = "release"
+debug = "full"
+strip = false

crates/ocync-distribution/CLAUDE.md

@@ -57,10 +57,10 @@ When `auth_type` IS set in config, it overrides detection. Valid values: `ecr`,
 
 ## Upload protocol quirks
 
-- Default: POST + streaming PUT with `Transfer-Encoding: chunked` (2 requests/blob).
-- GHCR: multi-PATCH chunked broken (last PATCH overwrites previous). Client falls back to POST + single PATCH + PUT (3 requests/blob).
-- GAR: no chunked uploads. Client buffers full blob, monolithic PUT.
-- ACR: known ~20 MB streaming PUT body limit. Chunked PATCH fallback not yet implemented.
+- Default: POST + streaming PUT with `Transfer-Encoding: chunked` (2 requests/blob). Streaming PUT body is gated by a per-`RegistryClient` semaphore (`streaming_blob_sem`, default cap 64) to stay under the per-h2-connection `SETTINGS_MAX_CONCURRENT_STREAMS` budget (100-128 across major registries probed 2026-06-01).
+- GHCR: multi-PATCH chunked broken (last PATCH overwrites previous). Client falls back to POST + single PATCH + PUT (3 requests/blob), `blob_push_stream_ghcr`.
+- GAR: no chunked uploads. Client buffers full blob, monolithic PUT, `blob_push_stream_gar`.
+- ACR: ~20 MB streaming PUT body limit. Client buffers the full blob, verifies digest, then uploads in 16 MB PATCH chunks (OCI `{start}-{end}` Content-Range, NOT RFC 7233) followed by a finalize PUT, `blob_push_stream_acr`. Zero-byte blobs (e.g. signature empty-config) skip the PATCH loop and go straight to finalize PUT. Each PATCH response's `Location` header is checked against the initiate host to prevent cross-host credential forwarding via a compromised proxy.
 
 ## Cross-repo mount
 
@@ -96,6 +96,18 @@ Provider names:
 
 `build_registry_client` (`src/cli/mod.rs`) calls `ocync_distribution::install_crypto_provider()` at the top -- production main does this too, but the dispatch entry point is also reached from tests that bypass main, so the install must be idempotent there.
 
+## Perf-harness test hooks on `RegistryClientBuilder`
+
+Three `#[doc(hidden)] pub` builder methods exist on `RegistryClientBuilder` solely for in-repo perf and A/B harnesses (primarily `crates/ocync-sync/tests/perf_profile.rs`):
+
+- `allow_invalid_certs(bool)` -- terminates TLS at a `testcontainers` `registry:2` with a self-signed cert.
+- `force_http1(bool)` -- compares HTTP/2 vs HTTP/1.1 throughput.
+- `http2_adaptive_window(bool)` -- A/Bs HTTP/2 adaptive flow-control window sizing.
+
+These are **intentionally retained**. They look unused from a production-code grep because production code never reaches them (no CLI flag, no env var, no config setting). Removing them as "dead code" deletes load-bearing diagnostic infrastructure: any future perf investigation that needs to reproduce the HTTP/2 stall investigation (or any successor) would have to re-introduce the same plumbing from scratch.
+
+If you're tempted to delete them, search `tests/perf_profile.rs` first -- it references all three by name.
+
 ## Commands
 
 ```bash

crates/ocync-distribution/Cargo.toml

@@ -30,6 +30,7 @@ futures-util = { version = "0.3", default-features = false }
 google-cloud-auth.workspace = true
 http.workspace = true
 hex.workspace = true
+pin-project-lite.workspace = true
 regex-lite = { version = "0.1", default-features = false }
 reqwest = { workspace = true, features = ["http2", "rustls-no-provider", "stream", "json"] }
 rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs"] }