46 milliseconds. That is how long the bootstrap of one large application took before the framework even started, in a trace I pulled this week. A good share of it was autoloading.
require vendor/autoload.php looks like a constant of nature. With plain PSR-4 rules it is a loop: every class load walks the prefixes and asks the filesystem whether a file exists. A few thousand classes on a cold request, and the loop becomes a number you can see in a flame graph.
The fixes are old, documented, and still skipped on half of the projects I meet.
composer dump-autoload --optimize
composer dump-autoload --classmap-authoritative
Optimize builds a classmap: known classes resolve with one array lookup. Authoritative goes further. A class not in the map is treated as not on disk, composer does not even check. That kills the filesystem probing completely, but it is only safe when the deploy artifact is immutable. Anything that generates classes at runtime into autoloaded paths becomes invisible. Know your build before you enable it. There is also --apcu for caching lookups when authoritative is not an option.
Two more things from the same trace. A legacy library bundled its own autoloader, so we had two registered, and every miss paid twice. And opcache did not help at all. It caches compiled files, not the search for them.
After the flags: 46 ms became about 30. Not heroic for one web request. But the same constant sits in front of every CLI worker start, every cron job, every test run. Thousands of small payments a day.
I have had those two flags in my notes since 2016. This is the first project where I actually checked they were on.