milestone 12: performance bench harness, measured docs, aarch64 tests under qemu and no-dist size assert

build.zig

@@ -109,6 +109,75 @@ pub fn build(b: *std.Build) void {
     });
     test_step.dependOn(&b.addRunArtifact(blocklist_fuzz_tests).step);
 
+    // The bench harness (milestone-12 ruling 1). The measured roots
+    // (matcher.zig, dns_cache.zig, compiler.zig) share files in their relative
+    // import closures (model.zig, types.zig, ...), and a file may belong to
+    // only one module per compilation — separate modules per root cannot link
+    // into one executable. So one staged module: a copy of src/ plus a
+    // generated aggregator root, imported by the bench as `core`. No sqlite,
+    // no mbedTLS: the closure is pure Zig.
+    const bench_stage = b.addWriteFiles();
+    _ = bench_stage.addCopyDirectory(b.path("src"), "src", .{});
+    const bench_core = bench_stage.add("bench_core.zig",
+        \\pub const matcher = @import("src/filter/matcher.zig");
+        \\pub const dns_cache = @import("src/cache/dns_cache.zig");
+        \\pub const compiler = @import("src/filter/compiler.zig");
+        \\pub const model = @import("src/config/model.zig");
+        \\pub const dns_name = @import("src/dns/name.zig");
+        \\pub const dns_types = @import("src/dns/types.zig");
+        \\pub const packet = @import("src/dns/packet.zig");
+        \\
+    );
+    const bench_core_mod = b.createModule(.{
+        .root_source_file = bench_core,
+        .target = target,
+        .optimize = optimize,
+    });
+    const bench_mod = b.createModule(.{
+        .root_source_file = b.path("tools/bench.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    bench_mod.addImport("core", bench_core_mod);
+    const bench_exe = b.addExecutable(.{ .name = "bench", .root_module = bench_mod });
+    const bench_run = b.addRunArtifact(bench_exe);
+    if (b.args) |args| bench_run.addArgs(args);
+    b.step("bench", "Run the performance benchmarks (PLAN §18)").dependOn(&bench_run.step);
+
+    // aarch64 test execution (milestone-12 ruling 6): the plain suite
+    // cross-built for the deploy target and run under qemu-user
+    // (`zig build test-aarch64 -fqemu`). Fuzz artifacts stay native-only, and
+    // -Dintegration stays out (ruling 7): qemu-user's slowdown makes the
+    // wall-clock-budgeted loopback TLS tests a flake source.
+    const aarch64_target = b.resolveTargetQuery(
+        std.Target.Query.parse(.{ .arch_os_abi = "aarch64-linux-musl" }) catch unreachable,
+    );
+    const aarch64_tests = b.addTest(.{
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/tests.zig"),
+            .target = aarch64_target,
+            .optimize = optimize,
+            .link_libc = true,
+        }),
+    });
+    aarch64_tests.linkage = .static;
+    aarch64_tests.root_module.addOptions("build_options", options);
+    aarch64_tests.root_module.linkLibrary(sqliteLibrary(b, aarch64_target, optimize));
+    aarch64_tests.root_module.linkLibrary(mbedtlsLibrary(b, aarch64_target, optimize));
+    aarch64_tests.root_module.addCSourceFile(.{ .file = b.path("src/platform/mbedtls_shim.c") });
+    addMbedtlsThreadingMacros(aarch64_tests.root_module);
+    aarch64_tests.root_module.addAnonymousImport("test_fixtures", .{
+        .root_source_file = b.path("tests/fixtures/fixtures.zig"),
+    });
+    aarch64_tests.root_module.addAnonymousImport("docs_files", .{
+        .root_source_file = b.path("docs/docs.zig"),
+    });
+    aarch64_tests.root_module.addAnonymousImport("web_assets", .{ .root_source_file = web_assets });
+    const aarch64_run = b.addRunArtifact(aarch64_tests);
+    aarch64_run.skip_foreign_checks = true;
+    b.step("test-aarch64", "Run the test suite for aarch64-linux-musl (use -fqemu)")
+        .dependOn(&aarch64_run.step);
+
     const cross = b.step("cross", "Build static musl executables for every deploy target");
     for (cross_targets) |triple| {
         const query = std.Target.Query.parse(.{ .arch_os_abi = triple }) catch |err| {