okengine 0.17.2 → 0.18.3

package/src/bench/g03-signal-reconnect.bench.ts

@@ -0,0 +1,254 @@
+/**
+ * G3c — mass reconnect storm + `nextResubscribeDelay` backoff verification
+ * (`src/client/live.ts`: 500 ms floor → 30 s ceiling).
+ *
+ * Part 1 (pure): the backoff sequence clamps to ≥500 ms, doubles, and caps at
+ * exactly 30 000 ms.
+ *
+ * Part 2 (live): boot `load-child serve`, open N SSE subscriber loops with
+ * auto-resubscribe driven by `nextResubscribeDelay`, SIGKILL the server mid-
+ * stream, restart it, and observe the reconnect storm: every client must come
+ * back and every observed backoff must stay within [500, 30 000] ms while
+ * growing monotonically per client until success.
+ *
+ * Run: OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=… OKE_TEST_REDIS_URL=… bun test ./src/bench/g03-signal-reconnect.bench.ts --timeout 180000
+ */
+
+import { describe, expect, test } from "bun:test";
+import { LIVE_PG } from "./lib/infra.ts";
+import { DISCLAIMER, HARDWARE, percentile, writeArtifact } from "./lib/report.ts";
+import {
+  LIVE_RESUBSCRIBE_INITIAL_MS,
+  LIVE_RESUBSCRIBE_MAX_MS,
+  nextResubscribeDelay,
+} from "../client/live.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const PORT = 6672;
+const BASE = `http://127.0.0.1:${PORT}`;
+const SIGNAL = "bench-live";
+const CLIENTS = CAL ? 50 : 200;
+
+type ServeProc = Bun.Subprocess<"ignore", "pipe", "ignore">;
+
+function spawnServe(): ServeProc {
+  return Bun.spawn(["bun", "run", "src/bench/load-child.ts", "serve", String(PORT)], {
+    stdout: "pipe",
+    stderr: "ignore",
+    env: process.env,
+  });
+}
+
+/** One auto-resubscribing SSE client; records every backoff it sleeps. */
+async function reconnectClient(
+  target: string,
+  stop: Promise<void>,
+  delays: number[],
+): Promise<void> {
+  let delay = LIVE_RESUBSCRIBE_INITIAL_MS;
+  let stopped = false;
+  void stop.then(() => {
+    stopped = true;
+  });
+  for (;;) {
+    if (stopped) return;
+    const ac = new AbortController();
+    stop.then(
+      () => ac.abort(),
+      () => ac.abort(),
+    );
+    try {
+      const res = await fetch(target, {
+        signal: ac.signal,
+        headers: { accept: "text/event-stream" },
+      });
+      if (res.body) {
+        const reader = res.body.getReader();
+        for (;;) {
+          const { done } = await reader.read();
+          if (done) break;
+        }
+      }
+    } catch {
+      /* drop — reconnect below */
+    }
+    if (stopped || ac.signal.aborted) return;
+    // Server is down or dropped us: back off, then retry.
+    delays.push(delay);
+    await Bun.sleep(delay);
+    delay = nextResubscribeDelay(delay);
+  }
+}
+
+/** Resolve the ready line's pid from a serve child, then keep draining stdout. */
+async function readReadyPid(proc: ServeProc): Promise<number> {
+  const reader = proc.stdout.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) throw new Error("server died before ready");
+    buf += dec.decode(value, { stream: true });
+    const nl = buf.indexOf("\n");
+    if (nl >= 0) {
+      const line = buf.slice(0, nl).trim();
+      if (line.startsWith("{")) {
+        void (async () => {
+          try {
+            for (;;) {
+              const r = await reader.read();
+              if (r.done) break;
+            }
+          } catch {
+            /* closed */
+          }
+        })();
+        const parsed = JSON.parse(line) as { pid: number };
+        return parsed.pid;
+      }
+    }
+  }
+}
+
+function promiseOf<T>(): { promise: Promise<T>; resolve: (v: T) => void } {
+  let resolve!: (v: T) => void;
+  const promise = new Promise<T>((r) => {
+    resolve = r;
+  });
+  return { promise, resolve };
+}
+
+/** Established server-side sockets on the bench port for one pid. */
+function countConns(pid: number): number {
+  try {
+    const out = Bun.spawnSync([
+      "sh",
+      "-c",
+      `lsof -a -p ${pid} -iTCP:${PORT} -sTCP:ESTABLISHED 2>/dev/null | tail -n +2 | wc -l`,
+    ]);
+    return Number(out.stdout.toString().trim());
+  } catch {
+    return 0;
+  }
+}
+
+describe.skipIf(!process.env.OKE_BENCH || !LIVE_PG)("G3c — reconnect storm + backoff cap", () => {
+  test("nextResubscribeDelay floor/doubling/ceiling (pure)", () => {
+    expect(LIVE_RESUBSCRIBE_INITIAL_MS).toBe(500);
+    expect(LIVE_RESUBSCRIBE_MAX_MS).toBe(30_000);
+    // Floor: any input clamps up to the 500 ms initial before doubling.
+    expect(nextResubscribeDelay(0)).toBe(1000); // max(0, 500) * 2
+    expect(nextResubscribeDelay(250)).toBe(1000); // clamped to floor first
+    expect(nextResubscribeDelay(500)).toBe(1000);
+    // Ceiling: never exceeds 30 s even from large inputs.
+    expect(nextResubscribeDelay(20_000)).toBe(30_000);
+    expect(nextResubscribeDelay(30_000)).toBe(30_000);
+  });
+
+  test("backoff sequence stays within [500ms floor, 30s ceiling]", () => {
+    let d = LIVE_RESUBSCRIBE_INITIAL_MS;
+    const seq: number[] = [d];
+    for (let i = 0; i < 12; i++) {
+      d = nextResubscribeDelay(d);
+      seq.push(d);
+      expect(d).toBeGreaterThanOrEqual(LIVE_RESUBSCRIBE_INITIAL_MS);
+      expect(d).toBeLessThanOrEqual(LIVE_RESUBSCRIBE_MAX_MS);
+    }
+    expect(seq[1]).toBe(1000);
+    expect(seq.at(-1)).toBe(30_000);
+  });
+
+  test(
+    `${CLIENTS} clients survive SIGKILL + restart via capped backoff`,
+    async () => {
+      const servers: ServeProc[] = [];
+      try {
+        let server = spawnServe();
+        servers.push(server);
+        let serverPid = await readReadyPid(server);
+
+        const target = `${BASE}/_oke/live/${SIGNAL}`;
+        const allDelays: number[][] = Array.from({ length: CLIENTS }, () => []);
+        const stop = promiseOf<void>();
+        const clients = Array.from({ length: CLIENTS }, (_, i) =>
+          reconnectClient(target, stop.promise, allDelays[i]!),
+        );
+
+        // Give everyone a live connection first.
+        await Bun.sleep(CAL ? 2_000 : 4_000);
+        expect(countConns(serverPid)).toBeGreaterThan(CLIENTS * 0.5);
+
+        // Abrupt kill — no graceful close, every socket drops at once.
+        server.kill();
+        await server.exited.catch(() => {});
+
+        await Bun.sleep(CAL ? 1_000 : 2_000); // clients enter backoff
+
+        // Restart; the storm should land within ≤ a few backoff rounds.
+        server = spawnServe();
+        servers.push(server);
+        serverPid = await readReadyPid(server);
+
+        const settleMs = CAL ? 8_000 : 35_000;
+        await Bun.sleep(settleMs);
+
+        // Count re-established sockets while clients are still connected.
+        const reconnected = countConns(serverPid);
+
+        stop.resolve();
+        await Promise.race([Promise.all(clients), Bun.sleep(10_000)]);
+
+        const flat = allDelays.flat();
+        const minD = flat.length ? Math.min(...flat) : -1;
+        const maxD = flat.length ? Math.max(...flat) : -1;
+
+        const latencies = allDelays.map((d, i) => ({
+          client: i,
+          attempts: d.length,
+        }));
+        const activeClients = latencies.filter((l) => l.attempts > 0).length;
+
+        const issues: string[] = [];
+        if (minD < LIVE_RESUBSCRIBE_INITIAL_MS) issues.push(`backoff below floor: ${minD}ms`);
+        if (maxD > LIVE_RESUBSCRIBE_MAX_MS) issues.push(`backoff above ceiling: ${maxD}ms`);
+        if (reconnected < CLIENTS * 0.9) {
+          issues.push(`only ${reconnected}/${CLIENTS} sockets re-established after restart`);
+        }
+
+        const metrics: Record<string, number> = {
+          clients: CLIENTS,
+          backoffSamples: flat.length,
+          backoffMinMs: minD,
+          backoffMaxMs: maxD,
+          backoffP99Ms: percentile(flat, 99),
+          clientsThatRetried: activeClients,
+          socketsReconnected: reconnected,
+        };
+        console.log("[G3c] metrics:", JSON.stringify(metrics));
+
+        const path = await writeArtifact({
+          group: "G3c-signal-reconnect",
+          hardware: HARDWARE,
+          disclaimer: DISCLAIMER,
+          command:
+            "OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=$DATABASE_URL OKE_TEST_REDIS_URL=$OKE_TEST_REDIS_URL bun test ./src/bench/g03-signal-reconnect.bench.ts --timeout 180000",
+          metrics,
+          issues,
+          fixes: [],
+          remeasured: null,
+        });
+        console.log(`[G3c] artifact: ${path}`);
+
+        expect(minD).toBeGreaterThanOrEqual(LIVE_RESUBSCRIBE_INITIAL_MS);
+        expect(maxD).toBeLessThanOrEqual(LIVE_RESUBSCRIBE_MAX_MS);
+        expect(reconnected).toBeGreaterThanOrEqual(CLIENTS * 0.5);
+      } finally {
+        for (const s of servers) {
+          s.kill();
+          await s.exited.catch(() => {});
+        }
+      }
+    },
+    CAL ? 40_000 : 120_000,
+  );
+});

package/src/bench/g03-signal-sse-memory.bench.ts

@@ -0,0 +1,191 @@
+/**
+ * G3b — SSE subscriber memory + fd growth, with the G12 doctor-fd re-verify.
+ *
+ * Boots `load-child serve`, attaches 100 SSE subscribers via
+ * `load-child flood-sse`, holds, scales to 500 total, and samples RSS + open
+ * fds every 5 s for ≥60 s (`lib/rss-sampler.ts`). Cross-checks G12's
+ * `estimatePeakFds` per-subscriber constant against observed server-side fd
+ * growth; a >20% delta is recorded in `issues` (and fixed in
+ * `src/cli/doctor-fd.ts`).
+ *
+ * Run: OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=… OKE_TEST_REDIS_URL=… bun test ./src/bench/g03-signal-sse-memory.bench.ts --timeout 240000
+ */
+
+import { describe, expect, test } from "bun:test";
+import { estimatePeakFds, FD_COST_PER_SUBSCRIBER } from "../cli/doctor-fd.ts";
+import { LIVE_PG, waitFor } from "./lib/infra.ts";
+import { rssSlopeMbPerMin, startSampler } from "./lib/rss-sampler.ts";
+import { DISCLAIMER, HARDWARE, writeArtifact } from "./lib/report.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const PORT = 6671;
+const BASE = `http://127.0.0.1:${PORT}`;
+const SIGNAL = "bench-live";
+const FIRST_WAVE = 100;
+const SECOND_WAVE = 400;
+const HOLD_MS = CAL ? 8_000 : 30_000;
+
+interface Ready {
+  ready: boolean;
+  pid: number;
+  port: number;
+}
+
+type Server = Bun.Subprocess<"ignore", "pipe", "pipe">;
+
+function spawnChild(args: string[]): Server {
+  return Bun.spawn(["bun", "run", "src/bench/load-child.ts", ...args], {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env,
+  });
+}
+
+/** Read the first JSON stdout line (the ready line), then keep draining. */
+async function readReady(proc: Server): Promise<Ready> {
+  const reader = proc.stdout.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) throw new Error("child exited before ready line");
+    buf += dec.decode(value, { stream: true });
+    const nl = buf.indexOf("\n");
+    if (nl >= 0) {
+      const line = buf.slice(0, nl).trim();
+      if (line.startsWith("{")) {
+        void (async () => {
+          try {
+            for (;;) {
+              const r = await reader.read();
+              if (r.done) break;
+            }
+          } catch {
+            /* closed */
+          }
+        })();
+        return JSON.parse(line) as Ready;
+      }
+    }
+  }
+}
+
+describe.skipIf(!process.env.OKE_BENCH || !LIVE_PG)("G3b — SSE memory + fd growth", () => {
+  test(
+    `${FIRST_WAVE}→${FIRST_WAVE + SECOND_WAVE} SSE subs — RSS/fd sampling + G12 fd cross-check`,
+    async () => {
+      const server = spawnChild(["serve", String(PORT)]);
+      let serverPid = -1;
+      let flood1: Server | undefined;
+      let flood2: Server | undefined;
+      try {
+        const ready = await readReady(server);
+        serverPid = ready.pid;
+        expect(ready.ready).toBe(true);
+
+        const sampler = startSampler(serverPid, 5_000);
+        await Bun.sleep(3_000); // settle baseline
+
+        // Wave 1: 100 subscribers.
+        flood1 = spawnChild(["flood-sse", BASE, SIGNAL, String(FIRST_WAVE)]);
+        const ok100 = await waitFor(async () => countSse(serverPid) >= FIRST_WAVE, 30_000);
+        await Bun.sleep(HOLD_MS / 2);
+        const fdsAt100 = avgFds(sampler.samples());
+
+        // Wave 2: scale to 500 total.
+        flood2 = spawnChild(["flood-sse", BASE, SIGNAL, String(SECOND_WAVE)]);
+        const ok500 = await waitFor(
+          async () => countSse(serverPid) >= FIRST_WAVE + SECOND_WAVE - 5,
+          60_000,
+        );
+        await Bun.sleep(HOLD_MS);
+
+        const all = [...sampler.samples()];
+        const rssSlope = rssSlopeMbPerMin(all);
+        const fdsAt500 = avgFds(all, 4);
+        const addedSubs = SECOND_WAVE;
+        const observed = Math.max(0, (fdsAt500 - fdsAt100) / addedSubs);
+
+        await sampler.stop();
+
+        // G12 cross-check: compare the formula's per-subscriber fd constant
+        // against observed server-side fd growth per added subscriber.
+        const baseNoManifest = estimatePeakFds(null);
+        const g12PerSub = FD_COST_PER_SUBSCRIBER;
+
+        const denom = observed < 0.05 ? 0.05 : observed;
+        const deltaPct = Number((((g12PerSub - denom) / denom) * 100).toFixed(1));
+
+        const issues: string[] = [];
+        if (!ok100) issues.push(`wave-1 did not reach ${FIRST_WAVE} concurrent SSE (server side)`);
+        if (!ok500) {
+          issues.push(`wave-2 did not reach ~${FIRST_WAVE + SECOND_WAVE} concurrent SSE`);
+        }
+        if (Math.abs(deltaPct) > 20) {
+          issues.push(
+            `G12 fd cross-check OFF: estimatePeakFds budgets ${g12PerSub} fds/subscriber, observed ${observed.toFixed(2)} (delta ${deltaPct}%) — constants need reconciliation`,
+          );
+        }
+
+        const metrics: Record<string, number> = {
+          targetSubscribers: FIRST_WAVE + SECOND_WAVE,
+          fdsAt100Avg: Number(fdsAt100.toFixed(1)),
+          fdsAt500Avg: Number(fdsAt500.toFixed(1)),
+          fdsPerSubscriberObserved: Number(observed.toFixed(2)),
+          g12EstimateFdsPerSubscriber: g12PerSub,
+          g12DeltaPct: deltaPct,
+          g12EstimatedNeedNoManifest: baseNoManifest,
+          rssSlopeMbPerMinFullRun: rssSlope,
+          rssMaxMb: Number(Math.max(...all.map((s) => s.rssMb)).toFixed(1)),
+          samples: all.length,
+        };
+        console.log("[G3b] metrics:", JSON.stringify(metrics));
+
+        const path = await writeArtifact({
+          group: "G3b-signal-sse-memory",
+          hardware: HARDWARE,
+          disclaimer: DISCLAIMER,
+          command:
+            "OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=$DATABASE_URL OKE_TEST_REDIS_URL=$OKE_TEST_REDIS_URL bun test ./src/bench/g03-signal-sse-memory.bench.ts --timeout 240000",
+          metrics,
+          issues,
+          fixes: [],
+          remeasured: null,
+        });
+        console.log(`[G3b] artifact: ${path}`);
+
+        expect(all.length).toBeGreaterThanOrEqual(CAL ? 3 : 10);
+        expect(fdsAt500).toBeGreaterThan(fdsAt100);
+      } finally {
+        flood1?.kill();
+        flood2?.kill();
+        server.kill();
+        await server.exited.catch(() => {});
+      }
+
+      expect(serverPid).toBeGreaterThan(0);
+    },
+    CAL ? 90_000 : 200_000,
+  );
+});
+
+/** Established TCP connections to the bench port held by the server pid. */
+function countSse(pid: number): number {
+  try {
+    const out = Bun.spawnSync([
+      "sh",
+      "-c",
+      `lsof -a -p ${pid} -iTCP:${PORT} -sTCP:ESTABLISHED 2>/dev/null | tail -n +2 | wc -l`,
+    ]);
+    return Number(out.stdout.toString().trim());
+  } catch {
+    return 0;
+  }
+}
+
+/** Average open-fd count over the most recent `n` non-zero samples. */
+function avgFds(samples: readonly { fds: number }[], n = 4): number {
+  const win = samples.slice(-n).filter((s) => s.fds > 0);
+  if (win.length === 0) return 0;
+  return win.reduce((a, s) => a + s.fds, 0) / win.length;
+}

package/src/bench/g04-auth-vault-hotpath.bench.ts

@@ -0,0 +1,170 @@
+/**
+ * G4 — auth / vault hot path (pure CPU, no infra).
+ *
+ *   • `authenticateApiKey` at 1k → 10k → 50k iterations (in-memory store)
+ *   • raw HMAC-SHA-256 verify (`hashApiKeySecret`) isolated
+ *   • A/B: boot-bag `vaultRuntime.read` vs request-time `fx.vault.get`
+ *     over ≥10k reads each → added p99 of the fx wrapper
+ *
+ * Run: bun test ./src/bench/g04-auth-vault-hotpath.bench.ts
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+  authenticateApiKey,
+  createApiKey,
+  createApiKeyStore,
+  hashApiKeySecret,
+} from "../auth/api-keys.ts";
+import { createVaultRuntime } from "../elements/vault/runtime.ts";
+import { vault } from "../elements/vault/declare.ts";
+import { createFx } from "../kernel/fx.ts";
+import { DISCLAIMER, HARDWARE, summarize, writeArtifact } from "./lib/report.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const AUTH_ITERS: readonly number[] = CAL ? [1_000] : [1_000, 10_000, 50_000];
+const VAULT_READS = CAL ? 2_000 : 20_000;
+const SECRET_NAME = "OKE_BENCH_G4_SECRET";
+
+/** Time an async op `iters` times; returns per-op latency samples in ms. */
+async function timeLoop(iters: number, op: () => Promise<unknown>): Promise<number[]> {
+  const samples: number[] = new Array(iters);
+  for (let i = 0; i < iters; i += 1) {
+    const s = performance.now();
+    await op();
+    samples[i] = performance.now() - s;
+  }
+  return samples;
+}
+
+describe.skipIf(!process.env.OKE_BENCH)("G4 — auth/vault hot path", () => {
+  test(
+    "authenticateApiKey + HMAC sweep",
+    async () => {
+      const store = createApiKeyStore();
+      const creatorScopes = new Set(["read", "write"]);
+      const created = await createApiKey(store, {
+        plane: "user" as never,
+        name: "bench-key",
+        scopes: ["read"],
+        creatorId: "bench",
+        creatorScopes,
+      });
+
+      const metrics: Record<string, number> = {};
+      const issues: string[] = [];
+
+      // Raw HMAC verify (the inner hash of every auth attempt).
+      const hmac = await timeLoop(AUTH_ITERS[0]!, () => hashApiKeySecret(created.secret));
+      const hmacS = summarize(hmac);
+      metrics["hmac.p50Ms"] = hmacS.p50Ms;
+      metrics["hmac.p99Ms"] = hmacS.p99Ms;
+      metrics["hmac.opsPerSec"] = hmacS.opsPerSec;
+
+      // Full authenticateApiKey (hash + scan + persist no-op).
+      for (const iters of AUTH_ITERS) {
+        const samples = await timeLoop(iters, async () => {
+          const row = await authenticateApiKey(store, created.secret);
+          if (!row) throw new Error("authenticateApiKey returned null");
+        });
+        const s = summarize(samples);
+        metrics[`auth.n${iters}.p50Ms`] = s.p50Ms;
+        metrics[`auth.n${iters}.p99Ms`] = s.p99Ms;
+        metrics[`auth.n${iters}.opsPerSec`] = s.opsPerSec;
+      }
+
+      console.log("[G4] auth metrics:", JSON.stringify(metrics));
+
+      // Sanity: wrong secret must not match.
+      expect(await authenticateApiKey(store, "oke_bogus")).toBeNull();
+
+      const path = await writeArtifact({
+        group: "G4-auth",
+        hardware: HARDWARE,
+        disclaimer: DISCLAIMER,
+        command: "OKE_BENCH=1 bun test ./src/bench/g04-auth-vault-hotpath.bench.ts",
+        metrics,
+        issues,
+        fixes: [],
+        remeasured: null,
+      });
+      console.log(`[G4] auth artifact: ${path}`);
+    },
+    CAL ? 60_000 : 180_000,
+  );
+
+  test(
+    "vault boot-bag read vs request-time fx.vault.get",
+    async () => {
+      const vaultRt = createVaultRuntime({
+        secrets: [vault.config(SECRET_NAME, { dev: "bench-value-0123456789" })],
+        allowDevFallbacks: true,
+      });
+      await vaultRt.boot();
+
+      // A: direct boot-bag read (sync).
+      const bootSamples: number[] = [];
+      for (let i = 0; i < VAULT_READS; i += 1) {
+        const s = performance.now();
+        const v = vaultRt.read(SECRET_NAME);
+        if (v !== "bench-value-0123456789") throw new Error("boot-bag read mismatch");
+        bootSamples.push(performance.now() - s);
+      }
+
+      // B: per-request fx.vault.get (capability + effect ledger + redaction hook).
+      const fx = createFx({ flow: "bench.g4", vaultRuntime: vaultRt });
+      const fxBaseline: number[] = [];
+      for (let i = 0; i < VAULT_READS; i += 1) {
+        const s = performance.now();
+        const v = await fx.vault.get(SECRET_NAME);
+        if (v.reveal() !== "bench-value-0123456789") throw new Error("fx read mismatch");
+        fxBaseline.push(performance.now() - s);
+      }
+      // Second fx pass to warm JSC before trusting percentiles.
+      const fxSamples: number[] = [];
+      for (let i = 0; i < VAULT_READS; i += 1) {
+        const s = performance.now();
+        await fx.vault.get(SECRET_NAME);
+        fxSamples.push(performance.now() - s);
+      }
+
+      const a = summarize(bootSamples);
+      const b = summarize(fxSamples);
+      const addedP99Ms = Number((b.p99Ms - a.p99Ms).toFixed(3));
+      const metrics: Record<string, number> = {
+        "bootBag.reads": VAULT_READS,
+        "bootBag.p50Ms": a.p50Ms,
+        "bootBag.p99Ms": a.p99Ms,
+        "bootBag.opsPerSec": a.opsPerSec,
+        "fx.get.reads": VAULT_READS,
+        "fx.get.p50Ms": b.p50Ms,
+        "fx.get.p99Ms": b.p99Ms,
+        "fx.get.opsPerSec": b.opsPerSec,
+        addedP99Ms: addedP99Ms,
+        addedP50Ms: Number((b.p50Ms - a.p50Ms).toFixed(3)),
+      };
+
+      console.log("[G4] vault metrics:", JSON.stringify(metrics));
+      void fxBaseline;
+
+      const issues: string[] = [];
+      if (addedP99Ms > 1) {
+        issues.push(`fx.vault.get adds ${addedP99Ms}ms p99 over boot-bag read (>1ms budget watch)`);
+      }
+
+      const path = await writeArtifact({
+        group: "G4-vault",
+        hardware: HARDWARE,
+        disclaimer: DISCLAIMER,
+        command: "OKE_BENCH=1 bun test ./src/bench/g04-auth-vault-hotpath.bench.ts",
+        metrics,
+        issues,
+        fixes: [],
+        remeasured: null,
+      });
+      console.log(`[G4] vault artifact: ${path}`);
+      expect(b.opsPerSec).toBeGreaterThan(0);
+    },
+    CAL ? 30_000 : 120_000,
+  );
+});