perf(build): stop recompressing unchanged dashboard assets on build-script reruns #4342

Priority / finding

P2 · confirmed repeated work in the source; wall-time impact still needs measurement.

crates/tracedecay-cli/build.rs at 4a7b39b correctly caches the frontend build using its inputs fingerprint and a digest-addressed bundle. However, its cached return paths still call EmbeddedDashboard::staged, which calls from_sources. That function reads every asset, runs GzEncoder with Compression::best(), decompresses the result into another Vec to compare the bytes, and rewrites the gzip file whenever compression wins. packaged follows the same preparation path.

The header explicitly notes that Rust-only edits can rerun the script through source-provenance tracking. Thus 'frontend build cache hit' does not mean 'dashboard preparation cache hit'. Recompressing and immediately round-tripping identical assets on that path is avoidable work, and unconditional rewrites create unnecessary output churn.

Preferred implementation

1. Measure cold embed and a rerun with identical dashboard bytes but changed Rust provenance. Record compression calls, bytes processed/written, and CPU/wall time; do not confuse frontend compile time with gzip time.
2. Prefer moving gzip preparation into the existing dashboard asset-production action so the shipping Bazel graph caches it independently of Rust provenance. Use existing bundle/build-support ownership; do not introduce another cache daemon or generic artifact framework.
3. Where the supported build-script path must retain preparation, make compressed outputs immutable per (verified bundle digest, compression format/settings version), and reuse a fully validated completed set. Use the existing staging/promotion mechanism if suitable rather than a second partial-publication protocol.
4. Perform the compression round-trip validation when producing that set, not on every caller's cache hit. Keep digest/manifest validation needed to detect missing or corrupted cached bytes; never equate directory existence with valid content.
5. Write generated glue and payloads only when their bytes differ. Retain identity encoding when gzip is larger, and retain correct MIME/encoding metadata.
6. Remove the unconditional Compression::best/decode/rewrite path from warm embedding. Keep source-provenance updates independent; the binary must still reflect the Rust source being built.

Acceptance and regression coverage

• The controlled warm rerun performs no gzip encoding or unchanged payload writes; actual bytes and HTTP-decoded responses match the baseline.
• One dashboard asset change invalidates the appropriate prepared bundle; a Rust-only change does not invalidate compressed payloads.
• Missing/truncated/corrupt preparation never silently serves stale or invalid bytes; repair or fail closed with a useful error.
• Two supported build invocations cannot observe a partially published compressed bundle.
• Font/image identity assets, incompressible text, nested asset names and empty files are tested.
• Existing bundle digest/cache-tag and release packaging tests continue to pass; generated output remains deterministic.
• Report before/after measurements for the shipping build path and any deliberately retained developer path.

Coordination / scope

#4206 owns the choice of shipping build authority; #4197/#4218 own retiring the unpublished crate distribution lane. Do not expand deprecated paths merely to optimize them: delete their redundant preparation branch if that retirement lands first. This issue owns only reusable dashboard compression/embedding work, not a new Cargo/Bazel parity system.

Static review only; no build timing or compression benchmark was executed while filing.