perf(wasm): reduce browser transfer size and verify package identity

[chaliy]

What changed

Reduce first-visit browser package transfer size with a dedicated size/throughput-balanced Rust profile. Keep the full command set, jq, Terminal, and resource policies. Ship source/tool/profile identity and a verifiable WASM hash in build-info.json.

CI and npm publication now gate the same 24-case GNU Bash sample, raw/gzip/Brotli budgets, package integration suite, and npm archive contract. Add bounded browser/runtime measurement scripts and retained raw evidence.

Why

The brush-web studies found a large published/source compatibility gap and network-dominated mobile startup. npm 0.18.2 identifies the September 22 release, while the study's source is 269 commits newer. Rebuilding the exact release reproduces npm's identical five failures in our sample; this is unreleased interpreter work, not a divergent published feature configuration.

Before / After

Same current source, Rust 1.95.0, bindgen 0.2.128, Terminal enabled, Binaryen 125. Original opt-3/thin-LTO versus selected opt-s/fat-LTO:

Measure	Before	After
Brotli bytes, JS + WASM	2,468,453	2,125,682 (-13.9%)
gzip bytes	3,570,277	2,973,501 (-16.7%)
Raw bytes	9,519,539	7,668,904 (-19.4%)
Fast 4G package prompt median, 5 trials	3,285.1 ms	2,919.5 ms
Slow 4G package prompt median, 5 trials	16,177.1 ms	14,250.7 ms
Current-source GNU Bash sample	24/24	24/24

Published npm and rebuilt v0.18.2 both pass 19/24 with identical five failures. These 24 cases are a bounded regression sample, not a rerun of the study's three large-corpus percentages.

Methodology, raw samples, attribution, and runtime tradeoff. Timings are exploratory on a development host; byte and semantic gates are deterministic. This page measures the package without brush-web's framework/renderer/worker overhead.

Validation: just pre-pr; strict all-feature Clippy; just test (HTTP/default + serialized failpoints); 70 browser package tests; 24-case compatibility; compressed-size gate; 165 script tests; actual npm-pack/extract/execute smoke.

Post-merge verification: merged c34c6f0da08f6319b4d060cf1fc078564d5c1914 has the identical tree to the tested head. A clean rebuild at that exact commit passes all 70 package tests, 24/24 GNU Bash cases, and size budgets. Its WASM SHA-256 exactly matches the measured selected artifact. All 43 PR checks passed. npm remains 0.18.2 at 567511386572d4c4b9f649ab1da97aad53b9f341; just check-nightly still blocks release.

Risk

• Low/medium: code generation changes only for the browser package. Native release settings are unchanged.
• Selected profile's arithmetic sample is ~12% slower (44.24 → 49.49 ms for 20,000 iterations); substitution/jq/text samples stay close. Rejected opt-z despite more transfer savings because arithmetic slowed ~50%.
• No npm publication in this PR. just check-nightly currently fails the release contract: Advisory Audit in one of the last three nightly runs is red. npm still serves 0.18.2; merged code is distinct from published-artifact proof.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	8683411	Commit Preview URL Branch Preview URL	Oct 15 2026, 02:50 PM