test(perf): time unquotedShellText as min of 3 samples

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@fusengine/harness`. Format: [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [0.1.110] - 2026-10-14
+
+### Changed
+
+- **test(perf): `unquotedShellText` perf check timed as min of 3 samples** (`test/bash-write-lexer-v14.test.ts`, `test/bash-write-lexer-v15.test.ts`) — the 0.1.109 npm publish failed 3 times on GitHub runners (6.0 / 5.85 / 7.3 ms vs the 5 ms budget) with unchanged code: one GC pause or noisy neighbour failed the single-sample check. Min-of-3 keeps the 5 ms bound (an algorithmic blow-up is slow on every sample) and ignores one-off stalls. Budget, warmup, seeds and inputs unchanged. 0.1.110 also ships the 0.1.109 motion fix, which never reached npm.
+
 ## [0.1.109] - 2026-10-14
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fusengine/harness",
-	"version": "0.1.109",
+	"version": "0.1.110",
 	"description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
 	"type": "module",
 	"module": "src/index.ts",

test/bash-write-lexer-v14.test.ts

@@ -134,9 +134,14 @@ test("(perf) unquotedShellText on 20 malformed 2000-char inputs stays under 5ms
   for (let w = 0; w < 10; w++) unquotedShellText(buildToken2000(splitmix32(w + 1)));
   for (let i = 0; i < 20; i++) {
     const input = buildToken2000(rng);
-    const start = performance.now();
-    unquotedShellText(input);
-    expect(performance.now() - start).toBeLessThan(5);
+    // Min of 3 samples: an algorithmic blow-up is slow on every sample, a GC pause hits only one, so this keeps the steady-state complexity bound while ignoring one-off stalls.
+    let best = Infinity;
+    for (let s = 0; s < 3; s++) {
+      const start = performance.now();
+      unquotedShellText(input);
+      best = Math.min(best, performance.now() - start);
+    }
+    expect(best).toBeLessThan(5);
   }
 });
 

test/bash-write-lexer-v15.test.ts

@@ -119,9 +119,14 @@ test("(perf) unquotedShellText on 20 malformed 2000-char inputs stays under 5ms
   for (let w = 0; w < 10; w++) unquotedShellText(buildToken2000(splitmix32(w + 1)));
   for (let i = 0; i < 20; i++) {
     const input = buildToken2000(rng);
-    const start = performance.now();
-    unquotedShellText(input);
-    expect(performance.now() - start).toBeLessThan(5);
+    // Min of 3 samples: an algorithmic blow-up is slow on every sample, a GC pause hits only one, so this keeps the steady-state complexity bound while ignoring one-off stalls.
+    let best = Infinity;
+    for (let s = 0; s < 3; s++) {
+      const start = performance.now();
+      unquotedShellText(input);
+      best = Math.min(best, performance.now() - start);
+    }
+    expect(best).toBeLessThan(5);
   }
 });