perf(workshops): cache show pages and their sanitized renders

[mroderick]

Summary

Workshop show pages were the app's top allocation consumer — 28% of all allocations (p50 ~7,348 allocations and 8 queries per render) — because the page had no caching at all. They now ship with: conditional GET (304s) for anonymous visitors, fragment caching of the static sections, and the description render cached with sanitization inside the fragment (the issue's "cache the sanitized HTML" variant — the description stays raw HTML in the database, so there is no write-path invariant and no backfill migration).

Profile	Before	After	Change
Anonymous repeat visit (conditional GET)	14,610 (full render)	7,429 (304)	−49%
Anonymous first render (fragment miss)	14,610	13,431	−8%
Logged-in visit (fragments hit)	15,007	13,826	−8%

Measured against the production data: top-10 most-requested workshop show URLs from 3 days of canonical logs (including one virtual workshop), served from a codebar_production_dump clone, base commit vs this branch, GC.stat(:total_allocated_objects) medians of 5 runs per URL via a throwaway probe (not committed). Logged-in figures include the fragment-hit path; the 304 range is the etag computation itself (workshop + host/address + sponsors + organisers queries), which is what keeps conditional GETs honest after a sponsor or organiser change. Absolute numbers differ from production; relative profile transfers.

Fixes #2951.

Design decisions

• Conditional GET is anonymous-only. The actions section is per-user, so fresh_when runs behind !logged_in? and logged-in members always get a full render. The ETag mirrors the fragment keys (workshop + host/address + sponsors + organisers + locale + bump token), because those records mutate without touching workshops.updated_at — without them a sponsor or organiser change would leave repeat anonymous visitors on a stale 304.
• Description renders are cached with sanitization inside. sanitize(@workshop.description) runs on cache miss only, keyed on the workshop — the issue's "cache the sanitized HTML" variant rather than sanitize-on-write. Storage keeps the raw authoring HTML (nothing is irreversibly rewritten, no data migration), the sanitizer stays at the render boundary so bulk writers bypassing Rails remain safe, and a future allowlist widening re-renders old descriptions correctly.
• 304 halts the action. fresh_when renders a 304 without halting, and the virtual-workshop render after it raised DoubleRenderError; return if performed? fixes a latent 500 the new virtual-path spec exposed.

Testing

• Full suite: 1,567 examples, 0 failures; rubocop clean on changed files.
• New request specs: anonymous 200 → 304 conditional flow (in-person and virtual), ETag rotation after a host-sponsor change (200, not 304), fragment caching proven by query-count reduction, virtual-path fragment keys, and a hostile stored description (<script> + bold) rendered sanitized with the raw source preserved.
• Model specs unchanged for existing behavior; the sanitize-on-write and backfill-migration specs were removed along with that approach.

Post-Deploy Monitoring & Validation

• payload.allocations p50 for WorkshopsController#show on the Codebar requests dashboard should drop materially; sum by (controller) (count_over_time({app="planner", controller="WorkshopsController"} | json | payload_status >= 500 [5m])) for 5xx regressions.
• Conditional GET live check: curl -s -o /dev/null -D - https://www.codebar.io/workshops/<known-id> captures the ETag; repeat with If-None-Match must return 304. Repeat after a description edit to confirm the ETag rotates (200 with new content).
• Rollback trigger: support reports of stale sponsor/venue content or stale descriptions after edits — the etag/fragment keys rotate on the records that changed, so a report should name the workshop id; code revert is safe (old views re-sanitize at render and the un-migrated raw descriptions render identically).

Unapplied review findings

From code-review run 20260927-232127-ad7e4667 (verdict: Ready with fixes):

• P2 — the data-migration reviewer's backfill concerns (irreversibility, snapshot/verification) — resolved by dropping the backfill migration in this rework; descriptions are sanitized at render time inside the fragment, and the pre-existing DB content is untouched.