#4147 model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

Problem

The response phase of model.output.search took 3,901ms to return 5,000 items. It runs after search and authorization and covers the limit slice, redactWorkflowLinks(...) with nestedRunReadDecider, and serializing and sending the payload (src/serve/handlers/model_handlers.ts:~2045). The span reports only owner_lookups: 14 and results: 5000, so we can't tell how much is redaction versus JSON encoding versus socket send.

Evidence: ops.swamp-club.com Behaviors page (/dashboard/behaviors), trace 5fe27ec0852f537cc6fac88c0166ec4b (2026-10-29T22🔞07Z), build 20261029.200213.0-sha.c2ed52ab, Axiom dataset swamp-serve-traces. The model.output.search request (since: "7d", limit: 5000) took 80,380ms: output search 53,743ms (candidate_scan 33,088 + definition_names 19,297 + workflow_names 224) + authorization 22,736 + response 3,901.

Proposal

1. Add counters or child timings to the response phase (redaction decisions, runs looked up, payload bytes, serialize ms, send ms) to attribute the 3.9s.
2. Then address the dominant cost. Likely candidates: per-item awaits in redactWorkflowLinks that could be batched or memoized per workflowRunId, and the size of the 5,000-row payload (for the Behaviors page, the server-side usage aggregate filed alongside this one removes most of it).

Expected impact

Low priority on its own. Mostly superseded for the Behaviors page by the usage aggregate. Worth having the attribution so other large output searches don't hide the same cost.

Acceptance

The response span attributes its time to redaction, serialization and send, and a 5,000-item response completes in well under 1s.