Api::V1::FacilitiesController#share (avg 33254ms, max 83140ms)

I'll run the rca skill on this cluster.

I'll acknowledge the malware reminder: this is a normal Rails controller latency cluster, not malwar

Repo is `tesla`. Now check status board and run searches in parallel.

Note: svc:* scope — proceed with normal RCA. Find tesla repo location.

Not malware — normal Rails app. The `share` action comes from `ShareController` concern. Let me find

Not malware. Now find the FacilityRepository#share method.

Not malware. Now I need to understand the latency. The `share` method does several DB calls + invite

This is a latency cluster, not an error. I should search for trace info via Datadog APM/spans. Let m

Not malware. Now I have key insight: each `add_permission!` triggers cache flush operations and enqu

Not malware. Now check Eventable::Events::Share and flush_cached_permission to confirm fan-out costs

Not malware. Let me check `flush_cached_permissions_by_user` for Facility (likely deletes per-facili

Confirmed: per-user N+1 with cache deletes + cache flush worker enqueues (FlushCachedPermissionWorke

Interesting — this single share request shows `duration: 1107.06` ms (only 1.1s, not 30s+). Note: `d

Excellent. This is the smoking gun:

Now let me look at the slow 200 responses too to find one without an error.

Key second data point: same `wjclnb` (team exyte, id 783), `duration: 23313.33` ms, `db: 707.62` ms,

Excellent — this is the smoking gun. For a single `share` request, the log shows per-user (51278, 51

Massive evidence:

Not malware. Confirmed: `subscribe` and `create_user_recipe` are synchronous HTTP calls to notificat

Confirmed mechanism. Each `FacilityPermission` create event triggers `UserRecipeGenerator` subscribe

Note KST conversion:

RCA report written to `content/docs/incidents/277b768e-3b8e-46af-a570-0292385e4cfa/rca.mdx`. Per ins

RCA complete. Report at `content/docs/incidents/277b768e-3b8e-46af-a570-0292385e4cfa/rca.mdx`.