Phase 10: hardening and ops

Implements PLAN.md Phase 10.

Simplified Sliding Sync (MSC4186) is served at the unstable
org.matrix.simplified_msc3575 endpoint and advertised in /versions. Lists
are sorted by activity and filtered by DM, invite, encryption, room type,
space and tag; room subscriptions, required_state with wildcards, $ME and
$LAZY, and the to_device, e2ee, account_data, receipts and typing
extensions are supported. Per-connection state is kept in memory and an
unknown pos answers M_UNKNOWN_POS.

Threads and relations: m.relates_to is indexed on roomserver_events
(migration 0012), /relations (with recursion) and /threads are served, and
every event a timeline read returns carries its m.thread, m.replace and
m.reference summaries in unsigned.m.relations. Notifications carry a
thread ID (migration 0013): threaded receipts clear only their thread, and
sync reports unread_thread_notifications when the filter asks.

Spaces: /hierarchy walks a space breadth first, asking other servers about
rooms this one is not in through the new federation hierarchy endpoint;
room_summary describes one room. /search runs on FTS5 (sqlite, pocketbase)
or tsvector (postgres), bounded to what each user may see, with context,
profiles, state, grouping and paging.

The PocketBase driver is real: the sqlite schema and store on an embedded
PocketBase app's database, with media in its filesystem, local or S3
(database.pocketbase.s3). It runs the full storage test suite.

Ops: OpenTelemetry tracing over OTLP/HTTP (tracing.*), with server spans
per route, component spans, and trace propagation on federation, push and
application service calls. New metrics for persisted events, waiting
syncs, sliding sync connections and the database pool, with a Grafana
dashboard. deploy/ adds a Compose setup (PostgreSQL, Prometheus, Grafana,
Jaeger) and a Helm chart; cmd/warp-loadtest loads a server and reports
request and delivery latencies.

The load tester found a long-standing bug, fixed here: on a server where
no account data had been written, every incremental /sync re-sent the push
rules and returned at once, and an all-zero token was taken for an initial
sync, so long polls became busy loops.

The PostgreSQL migrations and search dialect compile but were not run
against a live PostgreSQL in this change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/storage/sqlite/migrations/0012_relations_search.sql

@@ -0,0 +1,61 @@
+-- Phase 10: relations (threads, edits, reactions, references) and
+-- full-text search.
+
+-- content.m.relates_to of each event, written out so that "the children of
+-- this event" is an index lookup. Both are '' for an event that relates to
+-- nothing, and are cleared when the event is redacted: the redaction
+-- algorithm strips the content they came from.
+ALTER TABLE roomserver_events ADD COLUMN relates_to_id TEXT NOT NULL DEFAULT '';
+ALTER TABLE roomserver_events ADD COLUMN rel_type TEXT NOT NULL DEFAULT '';
+
+-- The events already stored. Only a relation with both fields a string
+-- counts, which is the rule the roomserver applies to new events.
+UPDATE roomserver_events SET
+    relates_to_id = json_extract(event_json, '$.content."m.relates_to".event_id'),
+    rel_type      = json_extract(event_json, '$.content."m.relates_to".rel_type')
+WHERE redacted_by = ''
+  AND json_type(event_json, '$.content."m.relates_to".event_id') = 'text'
+  AND json_type(event_json, '$.content."m.relates_to".rel_type') = 'text';
+
+-- /relations, the bundled summaries and /threads all start from a parent
+-- and read its children in stream order.
+CREATE INDEX IF NOT EXISTS roomserver_events_relations_idx
+    ON roomserver_events (room_id, relates_to_id, rel_type, stream_ordering);
+
+-- The full-text index /search reads: one row per searchable event, keyed by
+-- the event's stream ordering as its rowid, which is unique across the
+-- server and is what a redaction finds the row by. Outliers are not here:
+-- an event joins the index when it joins a timeline.
+--
+-- unicode61 with diacritics removed matches "cafe" against "café", which is
+-- what a user searching a chat history expects.
+CREATE VIRTUAL TABLE IF NOT EXISTS roomserver_event_search USING fts5(
+    body,
+    room_id    UNINDEXED,
+    event_id   UNINDEXED,
+    search_key UNINDEXED,
+    sender     UNINDEXED,
+    event_type UNINDEXED,
+    tokenize = 'unicode61 remove_diacritics 2'
+);
+
+INSERT INTO roomserver_event_search (rowid, body, room_id, event_id, search_key, sender, event_type)
+SELECT stream_ordering, json_extract(event_json, '$.content.body'), room_id, event_id,
+       'content.body', sender, event_type
+FROM roomserver_events
+WHERE event_type = 'm.room.message' AND NOT outlier AND redacted_by = ''
+  AND json_type(event_json, '$.content.body') = 'text';
+
+INSERT INTO roomserver_event_search (rowid, body, room_id, event_id, search_key, sender, event_type)
+SELECT stream_ordering, json_extract(event_json, '$.content.name'), room_id, event_id,
+       'content.name', sender, event_type
+FROM roomserver_events
+WHERE event_type = 'm.room.name' AND NOT outlier AND redacted_by = ''
+  AND json_type(event_json, '$.content.name') = 'text';
+
+INSERT INTO roomserver_event_search (rowid, body, room_id, event_id, search_key, sender, event_type)
+SELECT stream_ordering, json_extract(event_json, '$.content.topic'), room_id, event_id,
+       'content.topic', sender, event_type
+FROM roomserver_events
+WHERE event_type = 'm.room.topic' AND NOT outlier AND redacted_by = ''
+  AND json_type(event_json, '$.content.topic') = 'text';

server/internal/storage/sqlite/migrations/0013_thread_notifications.sql

@@ -0,0 +1,21 @@
+-- Phase 10: notifications counted per thread.
+--
+-- thread_id is the thread an event that notified a user belongs to: the
+-- root its m.relates_to names when rel_type is m.thread, and '' for an
+-- event on the main timeline. A read receipt for a thread clears that
+-- thread's rows and a receipt for the main timeline clears the '' rows,
+-- which is what lets reading one thread leave the rest of the room unread.
+ALTER TABLE push_notifications ADD COLUMN thread_id TEXT NOT NULL DEFAULT '';
+
+-- The notifications already stored, from the relation 0012 projected onto
+-- their events. A notification whose event has gone stays on the main
+-- timeline, where an unthreaded or main receipt still clears it.
+UPDATE push_notifications SET thread_id = COALESCE((
+    SELECT e.relates_to_id FROM roomserver_events e
+    WHERE e.event_id = push_notifications.event_id AND e.rel_type = 'm.thread'
+), '');
+
+-- A threaded receipt marks one thread's rows read; the per-thread counts a
+-- sync asks for group a room's unread rows by thread.
+CREATE INDEX IF NOT EXISTS push_notifications_thread_idx
+    ON push_notifications (user_id, room_id, thread_id, is_read, event_pos);

server/internal/storage/sqlite/sqlite.go

@@ -49,6 +49,56 @@ var settingsQueries = sqlstore.SettingsQueries{
 	Delete: `DELETE FROM server_settings WHERE setting_key = ?`,
 }
 
+// searchDialect is the full-text index on FTS5. The table cannot be
+// aliased — MATCH and bm25() take its own name — and its rowid is the
+// event's stream ordering. bm25() scores better matches lower, so the rank
+// is its negation.
+var searchDialect = &sqlstore.SearchDialect{
+	Insert: `INSERT INTO roomserver_event_search (rowid, room_id, event_id, search_key, sender, event_type, body)
+		VALUES (?, ?, ?, ?, ?, ?, ?)`,
+	DeleteEvent: `DELETE FROM roomserver_event_search WHERE rowid IN (
+		SELECT stream_ordering FROM roomserver_events WHERE room_id = ? AND event_id = ?)`,
+	DeleteRoom: `DELETE FROM roomserver_event_search WHERE room_id = ?`,
+	From:       `roomserver_event_search`,
+	Name:       `roomserver_event_search`,
+	Position:   `roomserver_event_search.rowid`,
+	Match:      `roomserver_event_search MATCH ?`,
+	Rank:       `-bm25(roomserver_event_search)`,
+	Query:      ftsQuery,
+}
+
+// ftsQuery builds an FTS5 query from a search term: every word, quoted so
+// that nothing in it is read as an operator, and matched as a prefix so
+// that a user who has typed "hel" already finds "hello". Words side by
+// side are ANDed.
+func ftsQuery(term string) string {
+	words := storage.SearchWords(term)
+	for i, w := range words {
+		words[i] = `"` + strings.ReplaceAll(w, `"`, `""`) + `"*`
+	}
+	return strings.Join(words, " ")
+}
+
+// StoreOptions are the sqlstore options for a SQLite database already
+// opened on db: the migrations, statements and error recognition every
+// SQLite-backed driver shares. The PocketBase driver runs on a SQLite file
+// of its own and uses them as they are.
+func StoreOptions(db *sql.DB, log *slog.Logger) sqlstore.Options {
+	return sqlstore.Options{
+		DriverName:    storage.DriverSQLite,
+		DB:            db,
+		Dialect:       dialect,
+		MigrationsFS:  migrationFiles,
+		MigrationsDir: "migrations",
+		Settings:      settingsQueries,
+		// SQLite already uses the `?` placeholders the shared component
+		// stores are written with, so there is nothing to rebind.
+		IsUniqueViolation: isUniqueViolation,
+		Search:            searchDialect,
+		Logger:            log,
+	}
+}
+
 // Database is the SQLite implementation of storage.Database.
 type Database struct {
 	*sqlstore.Store
@@ -86,18 +136,7 @@ func Open(ctx context.Context, cfg storage.Config, log *slog.Logger) (storage.Da
 		return nil, fmt.Errorf("sqlite: connect: %w", err)
 	}
 
-	store, err := sqlstore.New(sqlstore.Options{
-		DriverName:    storage.DriverSQLite,
-		DB:            db,
-		Dialect:       dialect,
-		MigrationsFS:  migrationFiles,
-		MigrationsDir: "migrations",
-		Settings:      settingsQueries,
-		// SQLite already uses the `?` placeholders the shared component
-		// stores are written with, so there is nothing to rebind.
-		IsUniqueViolation: isUniqueViolation,
-		Logger:            log,
-	})
+	store, err := sqlstore.New(StoreOptions(db, log))
 	if err != nil {
 		_ = db.Close()
 		return nil, err