test(middleware): benchmark bounded JSON timeout responses

[DeliciousBuding]

Summary

Closes #2331
Refs #2256 (E-P2-4 only; FileStore and SQLite remain unmeasured).

Adds one benchmark file, no production changes. It serializes the real Hub success envelope and custom-agent model at declared row/prompt sizes (including config.MaxPageLimit), then compares no timeout, buffered Timeout and TimeoutStream. Status, complete headers and bytes are verified before timing; the timed sink does not retain another response-sized buffer.

Measurement / decision

Full methodology, all 90 raw samples, medians and ranges.

• Local Ubuntu 24.04/WSL2, linux/amd64, Go 1.26.5, i7-14700HX; serial requests, GOMAXPROCS 1 and 4, 5 repetitions per case.
• Response sizes: 28,772 / 287,522 / 2,207,522 bytes.
• Buffered overhead versus the identical TimeoutStream serialization: approximately 11–18 / 65–70 / 353–515 microseconds per response; additional allocated bytes roughly 34 KB / 296–323 KB / 2.21–3.35 MB. Allocated bytes are not RSS or peak live heap; GC/pool behavior affects the result.
• Retain buffered Timeout. This measures a declared payload cost, not production pressure, and the streaming control does not preserve all-or-nothing deadline responses. No pooling algorithm, pagination limit, runtime configuration, or semantic change is justified by this measurement alone.

Validation

• Existing TestTimeout* plus all benchmark cases: Linux -race smoke passes.
• Formal benchmark: -run '^$' -bench '^BenchmarkTimeoutJSONResponses$' -benchtime=1s -count=5 -cpu=1,4 -benchmem passes (90 samples, no race instrumentation).
• go vet ./internal/middleware, staticcheck 2026.1 and git diff --check pass.
• All seven required CI gates passed; final-head Linux race smoke also passed. No timing threshold or additional CI job added.

No database/network workload, live credentials/data, deployment, L3/L4 or concurrent-client throughput claim.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 9d2e79cf-ee50-4f3d-885f-26e332b6b683

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DeliciousBuding]

Final-head verification at 1669ef3323d7e543c1a9999fce46e0e49b9f4e8d (2026-09-06):

• Final complete-header comparison is included in the Linux race smoke: GOMAXPROCS=4 CGO_ENABLED=1 go test -p 2 -race ./internal/middleware -run '^TestTimeout' -bench '^BenchmarkTimeoutJSONResponses$' -benchtime=1x -count=1 -benchmem -timeout=5m — PASS (11.884 s). Race-instrumented numbers are correctness smoke only, not additional performance samples.
• Live branch protection requires validate, go-edge, go-hub, windows-go, windows-frontend, backend-required, frontend-required; all seven are present and SUCCESS. Strict/up-to-date merge state is CLEAN. No unresolved review threads. The automated review skip is not treated as a code review.
• The previously published 90 non-race measurement samples remain the performance evidence. No production code, deployment, or Timeout semantics changed.