🤖 perf: desktop cold-start A/B runner and dispatch job

[ThomasK33]

Summary

Adds the desktop cold-start A/B runner for the first-load JS plan (T3, Refs #5971) and a workflow_dispatch job that runs it on CI. It measures the xum:app-shell-ready mark from #5981 in the Electron renderer. No src/ change and no user-visible change.

Background

The T3 code-splitting PRs must show that they do not slow down Electron startup. The plan's desktop protocol (D2) uses the mark's startTime, measured on cold launches with base and head interleaved. This dev host has no display server, so the measurement of record runs on a CI runner under xvfb-run.

Implementation

• scripts/perf/desktopColdStartStats.ts (pure): launchPlan alternates 2 warm-ups per arm, then runs pairs in ABBA order (base-head, head-base, ...) so order effects cancel. pairedRelativeDelta returns the mean per-pair relative delta (head − base)/base, its sd, and the one-sided 95% half-width and upper bound. It uses a one-sided t table (t = 1.729 at 19 df), not the two-sided table in benchStats.ts.
• scripts/perf/desktopColdStart.ts launches each built tree's own Electron the same way the load-dist e2e harness does (XUM_E2E=1 XUM_E2E_LOAD_DIST=1, mock AI). Before every launch it copies a seeded root fresh to one fixed path, because config.json holds absolute paths. It reads exactly one mark per launch and fails the run on any launch failure, with no retries. It prints a per-launch table and the summary, or --json.
• The runner runs under Node (node --import tsx), not Bun. Under Bun 1.3.12, Playwright's _electron.launch never finishes the websocket upgrade to Electron's debugger, so every launch hangs. Remote UAT showed this. bun x playwright test also runs under Node.
• Only the result goes to stdout. Electron's lazy binary download logs to stdout, so the script sends console.log to stderr, which keeps --json output valid.
• .github/workflows/desktop-cold-start.yml: dispatch only (inputs base_sha, head_sha, pairs). Permissions are contents: read, checkout uses persist-credentials: false, and the action SHAs are copied from perf-profiles.yml. Inputs reach shell steps only through env: and are checked with a regex. The job builds head at the workspace root and base in a git worktree, runs the runner under xvfb-run -a, and uploads cold-start.json. The runner comes from the head tree, so head_sha must contain this PR.

Validation

• GitHub can dispatch a workflow only once it is on the default branch, so this job cannot run before merge. After merge I will dispatch one same-SHA A/A run (base = head = main, 20 pairs) and post its mean delta and half-width on perf: xum server first load downloads and parses about 9.8 MB of JavaScript #5971. If the half-width is at most 2.5%, D2 gates later PRs. If it is wider, D2 is information and D1 gates.
• Local run on this host at c048aa4 (the two later commits change only cleanup and the entry guard), under a private virtual display, with a built tree in both arms and 3 pairs. The text and --json runs both exited 0. Both runs made 10 launches in the order bw hw bw hw b0 h0 h1 b1 b2 h2 (b/h = base/head arm, w = warm-up, digit = pair index). A recompute matched stats, and no temp dir was left behind. --pairs 1 exits 2.

index	arm	pair	mark ms	wall ms
0	base	warmup	1487.9	3282
1	head	warmup	1364.6	3064
2	base	warmup	1520.1	3231
3	head	warmup	1413.3	3142
4	base	0	1386.2	3081
5	head	0	1376.4	3128
6	head	1	1418.2	3146
7	base	1	1378.2	3102
8	base	2	1442.9	3157
9	head	2	1466.9	3167

n=3  mean delta 1.29%  one-sided 95% upper bound 4.38%
half-width 3.09% (<= 2.5%: no)
median mark ms: base 1386.2, head 1418.2

• Remote UAT on Coder Agents (3 rounds, one chat). Round 1 found the Bun hang. Round 2 found a temp-dir leak on an uncaught Playwright timeout. Round 3 passed on 5753377: --pairs 3 --json gives 10 launches in ABBA order with stats that match a recompute. Eight --timeout-ms runs from 1 to 200 ms each exit 1 in about 1 s, with no temp dir or Electron process left. Bad input exits 2. A run with two trees whose Electron binary must first be downloaded keeps stdout valid JSON.
• Known Low follow-ups (not fixed here, they need more than the 300-line budget allows): Playwright's own uncaught timeout stack names no launch index (stderr progress lines show the last finished launch). SIGTERM to the node process alone does not stop a run. tsx comes in only transitively (through e2e), not as a direct dependency. The base tree's Electron can download before a bad head tree is rejected.
• make lint-actions (actionlint and zizmor) and make static-check pass. check-react-compiler still prints 23/24 hot components compile (1 known skipped).

Risks

None for the product. The workflow runs only on manual dispatch, with read-only permissions.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T01:14:25.463199Z	5753377	PR opened
🔒 Security Review	✅ Completed 2026-10-10T01:20:21.376232Z	5753377	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.