From 1648ec5672af12db6f68746515b3ba67d8374533 Mon Sep 17 00:00:00 2001
From: pleb <git@plebsaber.stream>
Date: Wed, 29 Jul 2026 11:06:21 -0700
Subject: [PATCH] Add a size and packaging guardrail

---
 docs/development.md        | 34 ++++++++++++++++++++++--
 scripts/package-release.sh | 53 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+), 2 deletions(-)

diff --git a/docs/development.md b/docs/development.md
index 8ad7b25..fd363e6 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -76,5 +76,35 @@ nix-build release.nix -A windows -o result-windows
 ```
 
 The packager writes platform-qualified archives and `SHA256SUMS.txt` to
-`dist/`. `scripts/publish-release.sh` uploads those exact assets as a Gitea
-pre-release after the worktree is committed and clean.
+`dist/`. It also writes `SIZE-REPORT.txt`, recording the generated PEQ index,
+the two executables, and both final archives in bytes. Before writing the
+checksums, the packager verifies that each archive contains exactly its binary,
+`README.md`, `LICENSE`, and `config.toml`. This excludes PEQ dumps, SQL/fixture
+inputs, MariaDB data, the generator, and all source files from releases.
+
+Keep the size report with the release/change description. When changing the
+embedded index encoding, compare its archive sizes against the previous report
+and record the Linux `.tar.gz` and Windows `.zip` deltas. Do not add an archive
+size threshold until a stable release baseline has been established.
+
+### PEQ index size audit — 2026-07-29
+
+The following release builds compare pre-PEQ commit `561ace9` with the current
+core mapping implementation (tasks 1–4). The after size includes the embedded
+index and its resolver code.
+
+| Artifact | Before | After | Delta |
+| --- | ---: | ---: | ---: |
+| Generated index | 0 B | 719,199 B | +719,199 B |
+| Linux executable | 6,772,856 B | 7,535,632 B | +762,776 B |
+| Linux `.tar.gz` | 2,871,605 B | 3,010,723 B | +139,118 B |
+| Windows executable | 6,577,369 B | 7,332,144 B | +754,775 B |
+| Windows `.zip` | 2,805,692 B | 2,944,841 B | +139,149 B |
+
+Both archives were inspected after packaging and contained only the platform
+binary, `README.md`, `LICENSE`, and `config.toml`. The compressed distribution
+cost is about 139 KB per platform; retain the JSON encoding until a future
+measurement establishes a material reason to optimize it.
+
+`scripts/publish-release.sh` uploads the archive assets and checksums as a
+Gitea pre-release after the worktree is committed and clean.
diff --git a/scripts/package-release.sh b/scripts/package-release.sh
index 3b93e3e..be0ee83 100755
--- a/scripts/package-release.sh
+++ b/scripts/package-release.sh
@@ -6,6 +6,35 @@ usage() {
   exit 2
 }
 
+file_size() {
+  wc -c < "$1" | tr -d '[:space:]'
+}
+
+expected_archive_contents() {
+  local root=$1 executable=$2
+  printf '%s/\n' "$root"
+  printf '%s/%s\n' "$root" "$executable"
+  printf '%s/%s\n' "$root" README.md
+  printf '%s/%s\n' "$root" LICENSE
+  printf '%s/%s\n' "$root" config.toml
+}
+
+verify_archive_contents() {
+  local archive=$1 root=$2 executable=$3 contents
+  case "$archive" in
+    *.tar.gz) contents=$(tar -tzf "$archive") ;;
+    *.zip) contents=$(zipinfo -1 "$archive") ;;
+    *) echo "Unsupported release archive: $archive" >&2; exit 1 ;;
+  esac
+
+  if ! diff -u \
+    <(expected_archive_contents "$root" "$executable" | sort) \
+    <(printf '%s\n' "$contents" | sort); then
+    echo "Release archive contains unexpected or missing files: $archive" >&2
+    exit 1
+  fi
+}
+
 linux_binary=
 windows_binary=
 while (($#)); do
@@ -22,6 +51,9 @@ done
 version=$(awk -F '"' '$1 ~ /^version = / { print $2; exit }' Cargo.toml)
 [[ -n "$version" ]] || { echo "Could not read the package version." >&2; exit 1; }
 
+index=generated/peq-npc-gender-index.json
+[[ -f "$index" ]] || { echo "Missing generated PEQ index: $index" >&2; exit 1; }
+
 dist=dist
 stage=$(mktemp -d)
 repository_root=$PWD
@@ -49,6 +81,25 @@ cp README.md LICENSE config.toml "$stage/$windows_root/"
   zip -q -r "$repository_root/$dist/${windows_root}.zip" "$windows_root"
 )
 
+linux_archive="$dist/mudmouth-v${version}-x86_64-unknown-linux-gnu.tar.gz"
+windows_archive="$dist/${windows_root}.zip"
+verify_archive_contents "$linux_archive" "mudmouth-v${version}-x86_64-unknown-linux-gnu" mudmouth
+verify_archive_contents "$windows_archive" "$windows_root" mudmouth.exe
+
+size_report="$dist/SIZE-REPORT.txt"
+{
+  echo "Mudmouth release size report"
+  echo
+  printf 'Generated PEQ NPC index: %s bytes\n' "$(file_size "$index")"
+  printf 'Linux executable: %s bytes\n' "$(file_size "$linux_binary")"
+  printf 'Linux .tar.gz: %s bytes\n' "$(file_size "$linux_archive")"
+  printf 'Windows executable: %s bytes\n' "$(file_size "$windows_binary")"
+  printf 'Windows .zip: %s bytes\n' "$(file_size "$windows_archive")"
+  echo
+  echo "Archive contents: verified against the release allowlist (binary, README, LICENSE, config.toml)."
+  echo "PEQ dumps, generator inputs, fixtures, database files, and source code are absent."
+} > "$size_report"
+
 (
   cd "$dist"
   sha256sum -- *.tar.gz *.zip > SHA256SUMS.txt
@@ -56,3 +107,5 @@ cp README.md LICENSE config.toml "$stage/$windows_root/"
 
 printf 'Created release assets in %s:\n' "$dist"
 cat "$dist/SHA256SUMS.txt"
+printf '\n'
+cat "$size_report"