update perf 2.4.0, pickup other dev changes

site/dolt/src/content/products/hosted/api/v1/README.md

@@ -61,6 +61,10 @@ See [Authentication](/products/hosted/api/v1/authentication) for how to create a
 | **POST** | `/api/v1/deployments/{owner}/{deployment}/backups` | [Take a backup of a deployment](/products/hosted/api/v1/deployment#createDeploymentBackup) |
 | **GET** | `/api/v1/deployments/{owner}/{deployment}/database-version` | [List the versions a deployment can run](/products/hosted/api/v1/deployment#listDeploymentDatabaseVersions) |
 | **POST** | `/api/v1/deployments/{owner}/{deployment}/database-version` | [Roll a deployment's database engine to another version](/products/hosted/api/v1/deployment#updateDeploymentDatabaseVersion) |
+| **GET** | `/api/v1/deployments/{owner}/{deployment}/dolt-credentials` | [Read a deployment's Dolt credentials](/products/hosted/api/v1/deployment#getDeploymentDoltCredentials) |
+| **POST** | `/api/v1/deployments/{owner}/{deployment}/dolt-credentials` | [Issue Dolt credentials for a deployment](/products/hosted/api/v1/deployment#createDeploymentDoltCredentials) |
+| **DELETE** | `/api/v1/deployments/{owner}/{deployment}/dolt-credentials` | [Remove a deployment's Dolt credentials](/products/hosted/api/v1/deployment#deleteDeploymentDoltCredentials) |
+| **POST** | `/api/v1/deployments/{owner}/{deployment}/dolt-credentials/reroll` | [Replace a deployment's Dolt credentials](/products/hosted/api/v1/deployment#rerollDeploymentDoltCredentials) |
 | **POST** | `/api/v1/deployments/{owner}/{deployment}/disable` | [Disable a deployment](/products/hosted/api/v1/deployment#disableDeployment) |
 
 ### Pull request
@@ -135,6 +139,8 @@ Instance changes are also `202`, but there is no per-instance `state` field to p
 
 [Taking a backup](/products/hosted/api/v1/deployment#createDeploymentBackup), [rolling the database version](/products/hosted/api/v1/deployment#updateDeploymentDatabaseVersion), and [rebooting an instance](/products/hosted/api/v1/deployment#rebootDeploymentInstance) return `202` with an [OperationRef](/products/hosted/api/v1/models#model-operationref). Follow its `href`, or pass its `id` to [Get an operation](/products/hosted/api/v1/operation#getOperation), and poll with a delay until `status` is `succeeded` or `failed`. Completion means different things for each action: a version roll waits for every instance to report the requested version, backup completion is inferred from successful backup timestamps, and a reboot succeeds when the platform accepts the request, before the database is necessarily ready. A failed operation does not imply rollback, and a transient HTTP error while polling is not a reason to submit the action again.
 
+[Issuing](/products/hosted/api/v1/deployment#createDeploymentDoltCredentials), [removing](/products/hosted/api/v1/deployment#deleteDeploymentDoltCredentials), or [replacing Dolt credentials](/products/hosted/api/v1/deployment#rerollDeploymentDoltCredentials) also returns `202` with an OperationRef to poll. These credentials let the deployment access private databases on DoltHub. After issuing or replacing them succeeds, [read the public key](/products/hosted/api/v1/deployment#getDeploymentDoltCredentials) and add it to the appropriate DoltHub account. After removal succeeds, that read returns `404`. Replacement can temporarily leave instances with different credentials, and a failed operation does not roll back changes.
+
 Deployment names are unique within an owner, which makes creates idempotent by name: retrying after an ambiguous failure returns `409 Conflict` rather than provisioning a second deployment.
 
 > **Creating a deployment incurs cost.** Disabling one tears down its instances and their storage — [take a backup first](/products/hosted/api/v1/deployment#createDeploymentBackup) and confirm completion if you want the data.

site/dolt/src/content/products/hosted/api/v1/deployment.md

@@ -879,6 +879,220 @@ curl -X POST 'https://hosted.doltdb.com/api/v1/deployments/{owner}/{deployment}/
 
 ---
 
+## Read a deployment's Dolt credentials {#getDeploymentDoltCredentials}
+<span class="api-method" style="background:#29E3C1">GET</span> <code class="api-path">/api/v1/deployments/{owner}/{deployment}/dolt-credentials</code>
+
+Returns the public half of the Dolt credentials the deployment uses to authenticate to DoltHub, so it can clone from and push to private databases. The private key is held by the deployment's instances and is never returned here.
+
+These are not the deployment's SQL username and password, and not a way to connect to the deployment. They are a `dolt creds` key pair belonging to the deployment itself, and the public key is what you add to a DoltHub account to let the deployment in.
+
+`404` when the deployment has no credentials, which is the state it starts in.
+
+Requires admin on the deployment.
+
+
+**Parameters**
+
+| Name | In | Type | Required | Description |
+|------|----|------|----------|-------------|
+| `owner` | path | string | yes | The user or organization that owns the deployment. 3–32 characters of letters, digits, hyphens, and underscores. |
+| `deployment` | path | string | yes | The deployment name, unique within the owner. 3–32 characters of letters, digits, hyphens, and underscores. |
+
+**Example request**
+
+```sh
+curl -X GET 'https://hosted.doltdb.com/api/v1/deployments/{owner}/{deployment}/dolt-credentials' \
+  -H 'Authorization: Bearer YOUR_TOKEN'
+```
+
+**Responses**
+
+| Status | Description | Schema |
+|--------|-------------|--------|
+| `200` | The deployment's Dolt credentials. | [`DoltCredentials`](/products/hosted/api/v1/models#model-doltcredentials) |
+| `400` | The request was malformed or failed input validation. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `401` | Authentication credentials were missing or invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `403` | Authenticated, but not permitted to perform this action. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `404` | The requested resource does not exist. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `405` | The HTTP method is not supported for this resource. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `422` | The request was well-formed but semantically invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `500` | An unexpected server error occurred. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `503` | The service is temporarily unavailable. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+
+**Example response `200`**
+
+```json
+{
+  "data": {
+    "key_id": "qi54ma4nlm0dvvhbrgv2p0lqmgs1kgnd",
+    "public_key": "7pnjqfqgqgqfhs5rgkcbhjqgxzqfnkqfhs5rgkcbhjqgxzqfnkqa"
+  }
+}
+```
+
+---
+
+## Issue Dolt credentials for a deployment {#createDeploymentDoltCredentials}
+<span class="api-method" style="background:#6DB0FC">POST</span> <code class="api-path">/api/v1/deployments/{owner}/{deployment}/dolt-credentials</code>
+
+Generates a `dolt creds` key pair, hands the private half to the deployment's instances, and records the public half. Use it once; to replace an existing key pair use `POST .../dolt-credentials/reroll`, which removes the old key in the same pass.
+
+The work is queued, so this returns `202` with an operation to poll. The operation does not carry the key: read `GET .../dolt-credentials` once it succeeds.
+
+
+Requires admin on the deployment, which must be `started`.
+
+
+**Parameters**
+
+| Name | In | Type | Required | Description |
+|------|----|------|----------|-------------|
+| `owner` | path | string | yes | The user or organization that owns the deployment. 3–32 characters of letters, digits, hyphens, and underscores. |
+| `deployment` | path | string | yes | The deployment name, unique within the owner. 3–32 characters of letters, digits, hyphens, and underscores. |
+
+**Example request**
+
+```sh
+curl -X POST 'https://hosted.doltdb.com/api/v1/deployments/{owner}/{deployment}/dolt-credentials' \
+  -H 'Authorization: Bearer YOUR_TOKEN' \
+  -H 'Content-Type: application/json'
+```
+
+**Responses**
+
+| Status | Description | Schema |
+|--------|-------------|--------|
+| `202` | The request to issue credentials was accepted and queued. | [`OperationRef`](/products/hosted/api/v1/models#model-operationref) |
+| `400` | The request was malformed or failed input validation. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `401` | Authentication credentials were missing or invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `403` | Authenticated, but not permitted to perform this action. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `404` | The requested resource does not exist. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `405` | The HTTP method is not supported for this resource. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `409` | The request conflicts with the current state of the resource (e.g. it already exists). | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `422` | The request was well-formed but semantically invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `500` | An unexpected server error occurred. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `503` | The service is temporarily unavailable. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+
+**Example response `202`**
+
+```json
+{
+  "data": {
+    "id": "3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72",
+    "href": "https://hosted.doltdb.com/api/v1/operations/3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72"
+  }
+}
+```
+
+---
+
+## Remove a deployment's Dolt credentials {#deleteDeploymentDoltCredentials}
+<span class="api-method" style="background:#EF5350">DELETE</span> <code class="api-path">/api/v1/deployments/{owner}/{deployment}/dolt-credentials</code>
+
+Removes the key pair from the deployment's instances and clears the recorded public key. Anything on DoltHub that trusted that public key stops letting the deployment in.
+
+The work is queued, so this returns `202` with an operation to poll rather than `204`. `GET .../dolt-credentials` answers `404` once it succeeds.
+
+
+`404` when the deployment has no credentials to remove. Requires admin on the deployment.
+
+
+**Parameters**
+
+| Name | In | Type | Required | Description |
+|------|----|------|----------|-------------|
+| `owner` | path | string | yes | The user or organization that owns the deployment. 3–32 characters of letters, digits, hyphens, and underscores. |
+| `deployment` | path | string | yes | The deployment name, unique within the owner. 3–32 characters of letters, digits, hyphens, and underscores. |
+
+**Example request**
+
+```sh
+curl -X DELETE 'https://hosted.doltdb.com/api/v1/deployments/{owner}/{deployment}/dolt-credentials' \
+  -H 'Authorization: Bearer YOUR_TOKEN'
+```
+
+**Responses**
+
+| Status | Description | Schema |
+|--------|-------------|--------|
+| `202` | The removal was queued. | [`OperationRef`](/products/hosted/api/v1/models#model-operationref) |
+| `400` | The request was malformed or failed input validation. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `401` | Authentication credentials were missing or invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `403` | Authenticated, but not permitted to perform this action. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `404` | The requested resource does not exist. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `405` | The HTTP method is not supported for this resource. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `422` | The request was well-formed but semantically invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `500` | An unexpected server error occurred. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `503` | The service is temporarily unavailable. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+
+**Example response `202`**
+
+```json
+{
+  "data": {
+    "id": "3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72",
+    "href": "https://hosted.doltdb.com/api/v1/operations/3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72"
+  }
+}
+```
+
+---
+
+## Replace a deployment's Dolt credentials {#rerollDeploymentDoltCredentials}
+<span class="api-method" style="background:#6DB0FC">POST</span> <code class="api-path">/api/v1/deployments/{owner}/{deployment}/dolt-credentials/reroll</code>
+
+Issues a new `dolt creds` key pair and requests removal of the old one in the same per-instance update. This is not an atomic change across the deployment: instances can temporarily disagree, and a failed operation does not roll back changes.
+
+The new public key has to be added to DoltHub before the deployment can reach private databases again, so expect a gap between this succeeding and access being restored.
+
+The work is queued, so this returns `202` with an operation to poll. Read `GET .../dolt-credentials` once it succeeds for the new public key.
+
+
+`404` when the deployment has no credentials to replace; use `POST` to issue the first pair. Requires admin on the deployment.
+
+
+**Parameters**
+
+| Name | In | Type | Required | Description |
+|------|----|------|----------|-------------|
+| `owner` | path | string | yes | The user or organization that owns the deployment. 3–32 characters of letters, digits, hyphens, and underscores. |
+| `deployment` | path | string | yes | The deployment name, unique within the owner. 3–32 characters of letters, digits, hyphens, and underscores. |
+
+**Example request**
+
+```sh
+curl -X POST 'https://hosted.doltdb.com/api/v1/deployments/{owner}/{deployment}/dolt-credentials/reroll' \
+  -H 'Authorization: Bearer YOUR_TOKEN' \
+  -H 'Content-Type: application/json'
+```
+
+**Responses**
+
+| Status | Description | Schema |
+|--------|-------------|--------|
+| `202` | The replacement was queued. | [`OperationRef`](/products/hosted/api/v1/models#model-operationref) |
+| `400` | The request was malformed or failed input validation. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `401` | Authentication credentials were missing or invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `403` | Authenticated, but not permitted to perform this action. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `404` | The requested resource does not exist. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `405` | The HTTP method is not supported for this resource. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `422` | The request was well-formed but semantically invalid. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `500` | An unexpected server error occurred. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+| `503` | The service is temporarily unavailable. | [`Problem`](/products/hosted/api/v1/models#model-problem) |
+
+**Example response `202`**
+
+```json
+{
+  "data": {
+    "id": "3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72",
+    "href": "https://hosted.doltdb.com/api/v1/operations/3f2a9c14-8e7b-4d21-9a05-6c3e1b8f4d72"
+  }
+}
+```
+
+---
+
 ## Read a deployment's logs {#getDeploymentLogs}
 <span class="api-method" style="background:#29E3C1">GET</span> <code class="api-path">/api/v1/deployments/{owner}/{deployment}/logs</code>
 

site/dolt/src/content/products/hosted/api/v1/models.md

@@ -370,6 +370,16 @@ What a deployment's database engine is running and the versions it can be upgrad
 
 ---
 
+## DoltCredentials {#model-doltcredentials}
+The public half of the `dolt creds` key pair a deployment authenticates to DoltHub with. The private half lives on the deployment's instances and is never returned.
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `key_id` | `string` | yes | The key pair's identifier, which is what DoltHub lists the credential under. |
+| `public_key` | `string` | yes | The public key, to be added to the DoltHub account whose private databases the deployment should reach. |
+
+---
+
 ## UpdateDatabaseVersionRequest {#model-updatedatabaseversionrequest}
 The version to roll the deployment's database engine to.
 

site/dolt/src/content/reference/sql/benchmarks/correctness.md

@@ -55,7 +55,7 @@ AND col3 IN (3,9,0))))) OR col4 <= 4.25 OR ((col3 = 5))) OR (((col0 >
 0)) AND col0 > 6 AND (col4 >= 6.56)))
 ```
 
-Here are Dolt's sqllogictest results for version `2.3.5`.  Tests that
+Here are Dolt's sqllogictest results for version `2.4.0`.  Tests that
 did not run could not complete due to a timeout earlier in the run.
 <!-- START___DOLT___CORRECTNESS_RESULTS_TABLE -->
 | Results |  Count  |

site/dolt/src/content/reference/sql/benchmarks/latency.md

@@ -33,41 +33,41 @@ attempt to run as many queries as possible in a fixed 2 minute time
 window. The `Dolt` and `MySQL` columns show the median latency in 
 milliseconds (ms) of each query during that 2 minute time window.
 
-The Dolt version is `2.3.5`.
+The Dolt version is `2.4.0`.
 
 <!-- START___DOLT___LATENCY_RESULTS_TABLE -->
 |       Read Tests        | MySQL  |  Dolt  | Multiple |
 |:-----------------------:|:------:|:------:|:--------:|
-|  covering\_index\_scan  | 16.71  |  2.3   |   0.14   |
-|      groupby\_scan      | 134.9  | 65.65  |   0.49   |
-|       index\_join       |  3.43  |  1.93  |   0.56   |
-|    index\_join\_scan    |  4.25  |  1.32  |   0.31   |
-|       index\_scan       | 344.08 | 204.11 |   0.59   |
+|  covering\_index\_scan  | 16.71  |  2.35  |   0.14   |
+|      groupby\_scan      | 134.9  | 64.47  |   0.48   |
+|       index\_join       |  3.36  |  1.96  |   0.58   |
+|    index\_join\_scan    |  4.25  |  1.37  |   0.32   |
+|       index\_scan       | 344.08 | 200.47 |   0.58   |
 |   oltp\_point\_select   |  0.19  |  0.26  |   1.37   |
 |    oltp\_read\_only     |  3.68  |  5.09  |   1.38   |
 | select\_random\_points  |  0.36  |  0.52  |   1.44   |
-| select\_random\_ranges  |  0.38  |  0.65  |   1.71   |
+| select\_random\_ranges  |  0.39  |  0.67  |   1.72   |
 |       table\_scan       | 344.08 | 204.11 |   0.59   |
-|   types\_table\_scan    | 759.88 | 467.3  |   0.61   |
+|   types\_table\_scan    | 759.88 | 458.96 |   0.6    |
 | reads\_mean\_multiplier |        |        |   0.84   |
 
 |       Write Tests        | MySQL | Dolt  | Multiple |
 |:------------------------:|:-----:|:-----:|:--------:|
-|   oltp\_delete\_insert   | 7.84  | 6.21  |   0.79   |
-|       oltp\_insert       |  4.1  | 3.13  |   0.76   |
-|    oltp\_read\_write     |  8.9  | 11.24 |   1.26   |
-|   oltp\_update\_index    | 4.33  |  3.3  |   0.76   |
-| oltp\_update\_non\_index |  4.1  | 3.02  |   0.74   |
+|   oltp\_delete\_insert   | 8.28  | 6.21  |   0.75   |
+|       oltp\_insert       | 4.18  | 3.19  |   0.76   |
+|    oltp\_read\_write     | 9.06  | 11.45 |   1.26   |
+|   oltp\_update\_index    | 4.41  | 3.36  |   0.76   |
+| oltp\_update\_non\_index | 4.18  | 3.07  |   0.73   |
 |    oltp\_write\_only     | 5.18  | 6.32  |   1.22   |
-|  types\_delete\_insert   | 8.28  | 6.79  |   0.82   |
-| writes\_mean\_multiplier |       |       |   0.91   |
+|  types\_delete\_insert   | 8.58  | 6.79  |   0.79   |
+| writes\_mean\_multiplier |       |       |   0.9    |
 
 |    TPC-C TPS Tests    | MySQL | Dolt  | Multiple |
 |:---------------------:|:-----:|:-----:|:--------:|
-|  tpcc-scale-factor-1  | 96.87 | 52.38 |   1.85   |
-| tpcc\_tps\_multiplier |       |       |   1.85   |
+|  tpcc-scale-factor-1  | 96.45 | 53.18 |   1.81   |
+| tpcc\_tps\_multiplier |       |       |   1.81   |
 
-| Overall Mean Multiple | 1.20 |
+| Overall Mean Multiple | 1.18 |
 |:---------------------:|:----:|
 <!-- END___DOLT___LATENCY_RESULTS_TABLE -->
 <br/>