perf: the gate tail 84.4s→37.2s and the Rust suite 100.2s→48.6s, each measured against a null

Cargo.toml

@@ -548,10 +548,91 @@ yaml-rust2 = "0.11"
 lto = "thin"
 strip = true
 
-# Faster incremental builds for the compile-heavy fmt -> lint -> test hook chain.
+# Faster incremental builds for the compile-heavy fmt -> lint -> test hook chain,
+# and 118 test binaries' worth of bytes off `target/debug` (CLOUD-1211).
+#
+# `debug = 1` was already a REDUCTION — cargo's dev default is `debug = 2`, so
+# line-tables-only was the saving this comment was originally written about, and
+# it was correct as written. What it never accounted for is the POPULATION: one
+# dial for two groups, the library under iteration and ~118 integration test
+# targets nobody attaches a debugger to. Nothing counted the second group's bytes
+# until CLOUD-766 hit a full disk.
+#
+# THREE ARMS MEASURED on this container, 2026-08-30, each a cold
+# `mise run test:cargo` over a cleared `target/debug`. The census counts
+# `target/debug/deps`' extension-less linked binaries — the population
+# `crates/batten/src/prune.rs:262-269` reads:
+#
+#   arm                                  artifacts     bytes      mean   cold wall
+#   debug = 1 (the baseline)                   125   15.53 GB  124.3 MB       231s
+#   debug = 0 (the whole profile)              123    1.60 GB   13.0 MB       264s
+#   debug = 1 + package."*" debug = 0          125    6.82 GB   54.5 MB       217s
+#
+# THE MIDDLE ARM IS NOT ADOPTED, AND REJECTING IT IS THE POINT OF THIS COMMENT.
+# It takes 9.7x off the bytes, which is the largest number here and the reason it
+# was briefly committed. It buys that by dropping debuginfo from the WHOLE dev
+# profile — batten's own code included — so a panicking test reports a backtrace
+# with no line numbers. That is the diagnostic a reader wants most at exactly the
+# moment they need it, and no byte count is worth it.
+#
+# The adopted arm keeps line tables for workspace code and strips the dependency
+# closure, which is where the bytes actually were: 124.3 MB -> 54.5 MB per binary
+# while every `batten` frame keeps its file and line. Nobody steps into gix or
+# regorus while debugging this crate.
+#
+# THE WALL-CLOCK COLUMN IS NOT A FINDING and must not be quoted as one. Three
+# single cold runs at different contention, unpaired and with no null — the 264s
+# in particular was taken while other work shared the box. They disagree in both
+# directions, which is what unpaired readings look like. The byte column is the
+# measured result; the time column is recorded only so nobody re-runs it
+# expecting an answer. The paired warm arm that WOULD decide it could not be
+# taken: at `debug = 1` the tree leaves 6.3 GB against `target-prune`'s 9970 MB
+# floor, so the instrument cannot run in the condition it needs to measure —
+# CLOUD-766's exhaustion arriving inside the experiment.
+#
+# THE CARGO CONSTRAINT, recorded because the row's §3 asked for something cargo
+# cannot express: profiles are per-PACKAGE, not per-target-kind, so "debug off
+# for test targets only" is not sayable. The split below is the nearest thing
+# that preserves this profile's stated reasoning for the code it was written
+# about.
+#
+# The linker claim this row was FILED on is withdrawn and stays recorded so it is
+# not re-proposed: rust-lld has been the default on this host triple since Rust
+# 1.90, this repository pins 1.97.1, and `readelf -p .comment` over a built
+# artifact reports `Linker: LLD 22.1.6`. The build already links with lld.
 [profile.dev]
 debug = 1
 
+# The dependency closure carries no debuginfo and IS optimised. Workspace code
+# above keeps its line tables and stays unoptimised, so rebuilds of the code under
+# iteration are still fast and its backtraces still readable — the split is the
+# whole point, and neither half is a compromise for the other.
+#
+# `opt-level` MEASURED 2026-08-31, and it is the largest single win in this
+# campaign. `batten hook` against this repository's own config — the committed
+# ruleset plus ~20 Rego modules — is dominated by dependency code compiling and
+# evaluating Rego, and unoptimised that work is 6.8x what the shipped binary does:
+#
+#   batten hook, real config     debug 325ms     release 48ms
+#   with deps at opt-level = 2   debug  70ms     (4.6x, near release)
+#
+#   mise run test:cargo, warm    100.189s -> 48.581s     3201 tests, all passing
+#
+# A 2.06x on the whole suite, against CLOUD-1208's measured 0.963-1.012 null. The
+# tests drive the DEBUG binary (`CARGO_BIN_EXE_batten`), so every case that judges
+# a real config paid that 6.8x tax — which is why the binaries the per-case census
+# flags are exactly the policy-evaluating ones (`board_receipts`, `mediated_verbs`,
+# `pipeline_shapes`, `connector_verbs`, and `cli`'s committed-config cases).
+#
+# THE COST, STATED: a cold dependency build goes 217s -> 366s. It is paid ONCE and
+# then cached — dependencies recompile only when they change or this profile does,
+# and CI already carries `Swatinem/rust-cache`. So it is +149s once against -51.6s
+# on every suite run, and the warm edit-test loop a developer sits in pays none of
+# it.
+[profile.dev.package."*"]
+debug = 0
+opt-level = 2
+
 # The profile the distributed single binary is built with: maximal optimization
 # and the smallest artifact. Distinct from `release` (used for local/dev release
 # builds) so day-to-day `cargo build --release` stays fast.