perf(frontend): split vendor chunks for #994 + fail-closed Null raises + gap evidence

[seonghobae]

Scope

• perf(frontend): profile and reduce the 552.82 kB production application chunk #994 principal chunk composition repair without raising the warning threshold
• Null adjudication/image fail-closed raises with coverage (drop 2 pragmas)
• Gap-baseline bundle evidence
• current buyer-path evidence acceptance RED

Current exact authority

• protected base: main@83eba56149eb802cd63642c507c324c9976ec78e
• exact head: dbe5ac54228162e3ad5a9c92460006fb5e49e935
• state: open / Draft / intentionally RED

Historical bundle RED → source GREEN

• Issue perf(frontend): profile and reduce the 552.82 kB production application chunk #994 reproduced a principal application chunk at 552.82 kB minified / 162.30 kB gzip on the fix: verify dashboard accessibility and enforce frontend coverage #983 line; protected-base reproduction was 551.27 / 161.88 kB.
• Source head cf7b822919da9e1535f41b9adfa3f24026a7a348 split stable React/auth dependencies through Vite 8 rolldownOptions.output.manualChunks, reducing the principal chunk to 297.96 / 87.08 kB and removing the large-chunk warning without changing chunkSizeWarningLimit.
• Total JavaScript remained about 618 kB; the change is composition/cache-boundary work, not a claim that total transfer or buyer latency was reduced.
• Local source verification recorded frontend lint/530 tests/build and 44 touched backend tests GREEN. Hosted Tests on this Draft were skipped; predecessor/local results do not become protected acceptance.

Current acceptance finding and executable RED

Current-head review 5166756984 verified a remaining #994 acceptance defect: the issue requires durable current-head cold buyer-path evidence, but the PR retained the browser/performance probes only in local results.tsv experiments. The committed gap baseline has bundle sizes and test counts but not the required cold authenticated Board/Dashboard/Customer Master/Lineage-or-ontology/cited-evidence JavaScript transfer, parse/compile, main-thread/DOM-runtime, applicable p95, method/environment, and limitations record.

RED c55775a34fe5f1b5883ff4128f8f06c4e8e278aa added tests/test_frontend_delivery_performance_evidence.py, requiring a durable sanitized docs/evidence/frontend-delivery-performance-20260910.md record. Follow-up dbe5ac54228162e3ad5a9c92460006fb5e49e935 repaired the RED harness itself so an absent artifact fails with an explicit assertion rather than an incidental FileNotFoundError, accepts equivalent parse/compile and main-thread terminology, and treats the issue's Lineage/ontology path without inventing a stricter dual-destination requirement. The product/evidence RED intentionally remains: the evidence file is absent at this head.

Do not satisfy the RED with invented numbers or local-only output. Collect/reconstruct the measurements on the exact implementation tree and commit the sanitized evidence with measured revision, method/environment, cold-cache buyer paths, JavaScript transfer, parse/compile/main-thread/DOM observations, p95 handling, and explicit limitations.

Both test commits are ordinary direct descendants of the implementation head; no force push or destructive rebase occurred. Fresh search found no open PR directly based on autoresearch/994-bundle-20260910, so there is no current descendant-restack obligation.

Other retained changes

• lineageweave/adjudication_client.py, lineageweave/image_content.py: Null clients remain fail-closed; coverage pragmas removed.
• tests/test_adjudication_client.py, tests/test_image_content.py: direct fail-closed coverage.
• docs/product-technical-gap-baseline.md: historical before/after bundle-size observation.

Guardrails / promotion

No warning-threshold increase, provider/model change, cross-service SQL, coverage/test-denominator weakening, source-copy of a canonical owner, or gate bypass is authorized. Keep Draft until the buyer-path evidence RED is causally GREEN, then require fresh exact-head repository Tests, Security/SAST/CodeQL, applicable authenticated browser/a11y/performance evidence, code-current docs, and qualifying independent current-head approval before normal merge/release.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head acceptance finding for #994: the chunk split itself is measurable and the warning is gone, but the PR does not retain the buyer-path evidence that #994 explicitly requires before GREEN. The PR body says cold-load/OIDC/MCP probes live only in local results.tsv experiments, while the committed gap baseline records bundle byte counts and test counts but not the required cold authenticated Board/Dashboard/Customer Master/Lineage-or-ontology/cited-evidence transfer, parse/compile/main-thread/DOM-runtime observations or applicable p95. Local-only experiment output cannot serve as immutable review/release evidence. Keep this PR Draft. Add a durable, sanitized current-head evidence record (or an equivalent code-current performance record) with the measured implementation/tree identity, method/environment, required buyer paths, cold-cache transfer and main-thread/runtime observations, and applicable p95/limitations; do not invent missing browser measurements and do not raise the warning threshold. This is a valid evidence/acceptance defect, not a request to undo the manualChunks repair.