perf: finish v0.4.0 release evidence and size hardening

[chh-ay]

Summary

• Pack visible-window WASM output into one validated owned buffer, reuse formula entries during window reads, and remove render-state signature string churn.
• Isolate paged admission preflight, remove two unsupported root exports, and enforce the updated public API contract.
• Exclude core source maps from published tarballs; add reproducible attribution, first-paint admission, WASM profile, packed-consumer, and release-artifact checks.
• Add DPR 2 Chromium/WebKit-engine browser projects and repair stale repository contracts exposed by the full suite.

Measured decisions

• Visible-window output allocations: 7 -> 1 per logical read; copied bytes 3,385 -> 3,432 B (+1.4%). Clean product-valid medians are 1.533 / 1.551 ms across the two retained rounds. The deliberately pixel-invalid reuse variant remains labeled only as an upper bound.
• @sheetwrite/core published package: 0 map bytes, 302.8 KiB tarball (-214.7 KiB / -41.5% vs v0.3.1), 1.42 MiB unpacked (-1.29 MiB / -47.5%), and 174 files (-161 / -48.1%).
• WASM post-link profiles: retain -O3; -O2 saved 2.08% Brotli but slowed retained formula paths 5.72-8.46%, while -Os saved 6.72% but slowed them 8.60-11.71%. The store-only probe fails closed on the formula AST/dependency-index boundary, so no unmeasured split ships.
• First-paint clipboard deferral rejected: Vite saved only 2,413 B Brotli / 2.25% and slowed median first paint 67.70 -> 68.45 ms; Next grew 2,461 B Brotli / 1.30% and slowed 99.55 -> 102.75 ms. No production lazy boundary or new public subpath ships.
• Canvas clipping shortcut rejected: controlled rebuilds improved only 2.65%, below the 10% gate. No painter behavior change ships.

Verification

• bun run typecheck && bun run lint && bun test — 1,323 passed, 6 skipped, 0 failed; lint has the existing oversized conformance-corpus warning only.
• Rust/WASM — 175 tests passed; focused core/render suites 119 passed.
• bun run api:check; bun run changeset:status — pass; core and WASM classified as minor, dependent workspaces as patch.
• Packed consumers, Vite/Webpack/Next fixtures, Node ESM, and NodeNext consumers — pass.
• Production docs build and documentation contract check — pass.
• DPR 2 Chromium production canvas test — pass. The local Arch host cannot launch Playwright WebKit because its Ubuntu compatibility libraries are absent; WebKit-engine project wiring is contract-tested and CI installs the required browser dependencies.
• Canonical release verification — pass; six tarballs; locked runtime audit has 0 low/moderate findings; manifest sha512-QJfZogTS0BqnTB/RnjnJJGh0eBMtMOyl8EVlr0N5rMMBpKHdIEzcjPZ+IVdpERYNd1Km0x7jrmnoW/7RDiP9xg==.

Closes #33

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sheetwrite	Ready	Preview	Aug 11, 2026 9:03am