web: drop the status read after Freestyle create and warm the database during auth

web/app/api/vm/[id]/attach-endpoint/route.ts

@@ -1,3 +1,4 @@
+import { preconnectCloudDb } from "../../../../../db/client";
 import { preconnectFreestyle } from "../../../../../services/vms/drivers/freestyle";
 import {
   jsonResponse,
@@ -18,8 +19,9 @@ export async function POST(
   request: Request,
   { params }: { params: Promise<{ id: string }> },
 ): Promise<Response> {
-  // Warm the Freestyle connection while the caller is being verified.
+  // Warm the Freestyle and database connections while the caller is being verified.
   preconnectFreestyle();
+  preconnectCloudDb();
   return withAuthedVmApiRoute(
     request,
     "/api/vm/[id]/attach-endpoint",

web/app/api/vm/route.ts

@@ -2,6 +2,7 @@
 // provider credentials stay behind server-side ownership checks.
 
 import type { Span } from "@opentelemetry/api";
+import { preconnectCloudDb } from "../../../db/client";
 import { preconnectFreestyle } from "../../../services/vms/drivers/freestyle";
 import {
   unauthorized,
@@ -180,8 +181,9 @@ export async function GET(request: Request): Promise<Response> {
 }
 
 export async function POST(request: Request): Promise<Response> {
-  // Warm the Freestyle connection while the caller is being verified.
+  // Warm the Freestyle and database connections while the caller is being verified.
   preconnectFreestyle();
+  preconnectCloudDb();
   return withAuthedVmApiRoute(
     request,
     "/api/vm",

web/db/client.ts

@@ -19,6 +19,8 @@ type CloudDb = ReturnType<typeof createPostgresJsDb>;
 type CloudDbState = {
   db: CloudDb;
   close: () => Promise<void>;
+  /** Opens one pooled connection ahead of the first query; see preconnectCloudDb. */
+  warm: () => Promise<void>;
   key: string;
 };
 
@@ -244,7 +246,15 @@ export function cloudDb(): CloudDb {
     const pool = createAwsRdsIamPool(config);
     attachDatabasePool(pool);
     const db = drizzleNodePg({ client: pool, schema }) as unknown as CloudDb;
-    globalForDb.__cmuxCloudDb = { db, close: () => pool.end(), key };
+    globalForDb.__cmuxCloudDb = {
+      db,
+      close: () => pool.end(),
+      warm: coalesceWarm(async () => {
+        const client = await pool.connect();
+        client.release();
+      }),
+      key,
+    };
     return db;
   }
 
@@ -253,10 +263,52 @@ export function cloudDb(): CloudDb {
     prepare: false,
   });
   const db = createPostgresJsDb(sql);
-  globalForDb.__cmuxCloudDb = { db, close: () => sql.end(), key };
+  globalForDb.__cmuxCloudDb = {
+    db,
+    close: () => sql.end(),
+    warm: coalesceWarm(async () => {
+      await sql`select 1`;
+    }),
+    key,
+  };
   return db;
 }
 
+/**
+ * Runs the warm-up once per process: every caller shares the first attempt's
+ * promise, and a failed attempt is forgotten so the next call can retry. A
+ * burst of requests, authenticated or not, therefore costs one connection,
+ * and a warm process never re-runs the probe query.
+ */
+function coalesceWarm(run: () => Promise<void>): () => Promise<void> {
+  let inFlight: Promise<void> | null = null;
+  return () => {
+    inFlight ??= run().catch((error: unknown) => {
+      inFlight = null;
+      throw error;
+    });
+    return inFlight;
+  };
+}
+
+/**
+ * Open a database connection before a route needs one. A cold invocation
+ * paid ~95 ms of TCP+TLS plus an STS round trip for the RDS IAM token inside
+ * the first query (`pg-pool.connect` on the create span); a route fires this
+ * while it is still verifying the caller so that cost overlaps auth instead
+ * of following it. Best effort, never awaited for correctness, and after the
+ * first success a no-op for the life of the process, so calling it ahead of
+ * auth cannot amplify an unauthenticated burst beyond one pooled connection.
+ */
+export function preconnectCloudDb(): void {
+  try {
+    cloudDb();
+    void globalForDb.__cmuxCloudDb?.warm().catch(() => undefined);
+  } catch {
+    // No database configured (tests, offline builds): the first query reports it.
+  }
+}
+
 /**
  * Runs the small database probe used by the coderouter health endpoint.
  *

web/services/vms/drivers/freestyle.ts

@@ -951,7 +951,7 @@ export class FreestyleProvider implements VMProvider {
               // A size-less image boots at its snapshot's resources and only a
               // grow-only resize raises them. Size first so the machine the
               // daemon comes up on is the one that was sold.
-              await this.growToRequestedSize(fs, vm, vmId, options.memoryMb, span);
+              await this.growToRequestedSize(fs, vm, vmId, options.memoryMb, span, data.resources);
             }
             // The baked supervisor is already bringing the daemon up; the only
             // per-machine input it needs is the model-plane env file.
@@ -1005,8 +1005,11 @@ export class FreestyleProvider implements VMProvider {
     vmId: string,
     memoryMb: number | undefined,
     span: Parameters<typeof setSpanAttributes>[0],
+    // The create response already describes the machine; a caller without
+    // it (an older row being re-sized) pays one status read instead.
+    currentResources?: VmResources,
   ): Promise<void> {
-    const current = (await fs.vms.get(vmId)).resources;
+    const current = currentResources ?? (await fs.vms.get(vmId)).resources;
     const target = freestyleTargetResources(memoryMb ?? PLAN_MACHINE_MEMORY_MB);
     const request = freestyleResizeRequest(current, target);
     setSpanAttributes(span, {

web/tests/vm-freestyle-provider.test.ts

@@ -142,6 +142,59 @@ describe("Freestyle platform contract", () => {
     ]);
   });
 
+  test("create sizes from the create response and never re-reads the machine", async () => {
+    // vms.create already returns the machine's resources; a status read after
+    // it cost ~100 ms on every prod create for nothing. A size-less image is
+    // the one path that still grows the machine, and it grows from the create
+    // response; a sized image boots at its shape and is neither read nor grown.
+    const createResponse = (fake: ReturnType<typeof fakeFreestyle>, gets: string[], resizes: unknown[]) => {
+      const vm = fake.client.vms.ref(VM_ID);
+      vm.resize = (async (request: unknown) => {
+        resizes.push(request);
+      }) as never;
+      fake.client.vms.create = async (options: unknown) => {
+        fake.creates.push(options);
+        return {
+          vm,
+          vmId: VM_ID,
+          data: {
+            publicIpv6: "2602:f75c:0:1::2a",
+            vpcs: [{ ipv4: "10.4.0.7", ipv6: "fd00:4::7" }],
+            resources: { cpu: 2, memory: 4096, storage: 16384 },
+          },
+        } as never;
+      };
+      fake.client.vms.get = async (id: string) => {
+        gets.push(id);
+        throw new Error("create must not read the machine it just created");
+      };
+    };
+    const sizeless = fakeFreestyle({ probeExit: 0 });
+    const sizelessGets: string[] = [];
+    const sizelessResizes: unknown[] = [];
+    createResponse(sizeless, sizelessGets, sizelessResizes);
+    await providerWith(sizeless).create({
+      image: "sh-image",
+      network: { id: "vpc-test-1" },
+      memoryMb: 20480,
+    } as never);
+    expect(sizelessGets).toEqual([]);
+    expect(sizelessResizes).toHaveLength(1);
+
+    const sized = fakeFreestyle({ probeExit: 0 });
+    const sizedGets: string[] = [];
+    const sizedResizes: unknown[] = [];
+    createResponse(sized, sizedGets, sizedResizes);
+    await providerWith(sized).create({
+      image: "sh-image",
+      network: { id: "vpc-test-1" },
+      memoryMb: 20480,
+      imageSize: { name: "lgx", cpu: 12, memoryMb: 24576, storageMb: 98304 },
+    } as never);
+    expect(sizedGets).toEqual([]);
+    expect(sizedResizes).toEqual([]);
+  });
+
   test("network addresses persist from the create response, absent without a network", () => {
     expect(
       freestyleNetworkAddressMetadata({