perf: add deterministic synthetic benchmark corpus

.github/workflows/performance-evidence.yml

@@ -0,0 +1,106 @@
+name: Performance Evidence
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/performance-evidence.yml'
+      - 'benchmarks/**'
+      - 'src/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'tsconfig.json'
+      - 'vite.config.ts'
+  schedule:
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
+jobs:
+  packed-artifact-smoke:
+    name: packed-artifact-${{ matrix.profile }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(github.event_name == 'pull_request' && '{"include":[{"profile":"small","samples":3}]}' || '{"include":[{"profile":"small","samples":25},{"profile":"medium","samples":25},{"profile":"large","samples":25},{"profile":"stress","samples":25}]}') }}
+    steps:
+      - name: Checkout exact pull-request head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify exact checkout
+        shell: bash
+        env:
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          actual_head="$(git rev-parse HEAD)"
+          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: pnpm
+
+      - name: Install immutable dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packed library
+        run: pnpm build
+
+      - name: Produce bounded packed-artifact smoke evidence
+        shell: bash
+        run: |
+          set -euo pipefail
+          corpus_dir="${RUNNER_TEMP}/inkspan-benchmark-corpus"
+          package_dir="${RUNNER_TEMP}/inkspan-package"
+          evidence_dir="${RUNNER_TEMP}/inkspan-performance-evidence"
+
+          rm -rf "$corpus_dir" "$package_dir" "$evidence_dir"
+          node benchmarks/generate-corpus.mjs --output "$corpus_dir"
+
+          mkdir -p "$package_dir"
+          pnpm pack --pack-destination "$package_dir"
+          mapfile -t packages < <(find "$package_dir" -maxdepth 1 -type f -name '*.tgz' -print)
+          test "${#packages[@]}" -eq 1
+          package="${packages[0]}"
+          package_sha256="$(sha256sum "$package" | cut -d' ' -f1)"
+          source_sha="$(git rev-parse HEAD)"
+          runtime_id="node-$(node -p 'process.versions.node')"
+
+          node benchmarks/run-current-suite.mjs \
+            --input "$corpus_dir/${{ matrix.profile }}.md" \
+            --html-input "$corpus_dir/${{ matrix.profile }}.html" \
+            --revision-input "$corpus_dir/${{ matrix.profile }}.envelope.json" \
+            --package-tarball "$package" \
+            --package-sha256 "$package_sha256" \
+            --profile "${{ matrix.profile }}" \
+            --samples "${{ matrix.samples }}" \
+            --source-commit-sha "$source_sha" \
+            --runtime-id "$runtime_id" \
+            --reference-hardware-id github-actions-ubuntu-24.04-x64 \
+            --resulting-input "$corpus_dir/${{ matrix.profile }}.changed.envelope.json" \
+            --output "$evidence_dir"
+
+      - name: Upload bounded performance evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0
+        with:
+          name: performance-${{ matrix.profile }}-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ runner.temp }}/inkspan-performance-evidence
+          if-no-files-found: error
+          retention-days: 5

benchmarks/README.md

@@ -0,0 +1,86 @@
+# Performance evidence development harness
+
+This harness is research infrastructure, not a published latency or supported
+document-size guarantee. The generated corpus is synthetic and suitable for
+repeatable regression probes and harness contract tests. It does not establish
+buyer-workload performance, real-device input behavior, or the 20 ms target.
+Envelope fixtures contain plain paragraphs; Markdown list, table, and image
+syntax inside those paragraphs is not a rich editor document tree.
+
+The [captured-input identity research record](../docs/doctoring/performance-input-identity.md)
+documents the failure, rejected alternatives and exact-source regression evidence.
+
+## First-invocation accounting
+
+The revision, Markdown/HTML, and autosave latency producers record the first
+operation invocation and every subsequent requested sample, without an
+unrecorded warmup invocation. Each result must pass its scenario checks before
+samples can be published. Module loading and input preparation remain outside
+the timer; autosave queue setup and coalescing-scenario preparation retain
+their existing timer boundaries. This is not process-startup latency.
+
+Markdown/HTML producers also require every measured output to equal the first
+measured output for the same captured input. Empty strings are valid reference
+outputs. A changed result rejects the entire acquisition without publishing
+samples or output content; there is no extra warmup call. Equality is checked
+after the timer and retains one output in memory. Start a fresh baseline after
+this validation change: process state can differ even though the operation's
+timer boundaries and sample schema remain unchanged. Equal outputs alone do
+not prove conversion fidelity; workload-specific correctness checks remain
+required, and a one-sample run cannot establish repeatability.
+
+Samples recorded before this change retain their original meaning. Start a
+new baseline for the new measurement method; a difference between those
+generations is not evidence of a product speedup. Keep each generation's raw
+samples and exact source revision. Office rendering and the separate memory
+settling analysis are unchanged.
+
+Version 2 introduced this first-invocation method. New JavaScript latency samples
+use `contractVersion: 3` and additionally identify the captured input bytes with
+`inputSha256`. The digest is derived before measurement from the same bounded
+read used by the operation, not a caller-supplied claim or a later file read.
+Changed transitions also record `resultingInputSha256` in its distinct resulting
+role. Autosave with no input file hashes the UTF-8 JSON representation of its
+fixed prepared revision-evidence payload (envelope and revision), not a file-mode
+envelope; that input remains synthetic regardless of profile.
+Input digests are workload identifiers, not anonymization or authenticity proofs.
+
+The summarizer preserves these identities in JSON and text. The comparator
+rejects different versions or input identities before calculating a verdict,
+even when document profiles match. Versions 1 and 2 remain readable with their
+original meanings; Office output remains version 1. Do not backfill identities,
+relabel historical samples, or present a cross-generation difference as a
+speedup. Update producers and evidence readers together. The suite inventory and
+corpus locks retain their independent version 1 contracts; published editor APIs
+and timer boundaries are unchanged. This does not establish a real-world corpus.
+
+## Transition scenarios
+
+| Operation | Inputs | Required result | Metric prefix |
+| --- | --- | --- | --- |
+| `transition` | Same captured envelope twice | Unchanged, equal revision digests | `transition-evidence` |
+| `transition-changed` | Explicit previous and resulting envelopes | Changed, unequal revision digests | `transition-changed-evidence` |
+
+The profile suffix remains `small`, `medium`, `large`, or `stress`. Existing
+transition samples retain their no-op meaning. Never compare the two scenarios
+as an optimization result; the comparison tool rejects mismatched metric IDs.
+
+For `measure-revision-evidence.mjs`, append
+`--operation transition-changed --resulting-input <resulting-envelope.json>`
+immediately before `--output`. Other operations reject `--resulting-input`.
+Both inputs use the same bounded, non-symlink file reader. An output cannot
+overwrite either input, including through a hard link. Invalid results publish
+no sample file, and sample output contains neither document content nor paths.
+
+The packed `run-current-suite.mjs` accepts `--resulting-input` immediately before
+`--output`, with or without `--html-input`. It verifies the resulting fixture
+against `changedEnvelopeBytes` and `changedEnvelopeSha256` in `corpus.lock.json`.
+The generator adds one plain paragraph to produce each
+`<profile>.changed.envelope.json`; all earlier fixture bytes and digests remain
+unchanged. Omitting the new flag preserves the earlier suite. The
+`performance-evidence.yml` workflow exercises both transition scenarios.
+
+Commit a clean source checkout and rebuild the package before recording evidence.
+Keep raw samples with the exact source SHA, packed-artifact digest, Node runtime,
+hardware identity, and sample count. A new scenario starts a separate baseline;
+synthetic smoke evidence cannot close the realistic-workload support-envelope gap.