diff --git a/.gitignore b/.gitignore
index 6d824ce5..5e0a0fa4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -82,6 +82,9 @@ ios/Frameworks/
 build/
 *.tsbuildinfo
 
+# scripts/benchmark-boot.sh output (per-boot logcat captures + results JSON)
+benchmark-results/
+
 # eslint
 .eslintcache
 
diff --git a/AGENTS.md b/AGENTS.md
index 295fe643..ff8d152b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -113,7 +113,7 @@ Mirrored verbatim from Expo's official [`expo/skills`](https://github.com/expo/s
 - [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — process model, IPC channels and framing, boot handshake, lifecycle state machines, error handling, Sentry observability, alternatives considered.
 - [`docs/BUILD.md`](docs/BUILD.md) — the `build-backend.ts` pipeline, the versioned addon-filename scheme, runtime addon loading, the native-modules source-of-truth model.
 - [`docs/TESTING.md`](docs/TESTING.md) — the seven test layers, the workflows, the merge queue and required checks, the e2e device suite, the secrets/trust boundary.
-- [`docs/BENCHMARKING.md`](docs/BENCHMARKING.md) — measuring the backend's memory footprint: the Sentry gauges that answer the question across the fleet, what they measure and why, including the consent-tier reasoning.
+- [`docs/BENCHMARKING.md`](docs/BENCHMARKING.md) — measuring the backend's memory footprint: the local A/B cold-boot harness (`npm run bench:android`) and the Sentry gauges that answer the same question across the fleet, including the consent-tier reasoning.
 - [`CONTRIBUTING.md`](./CONTRIBUTING.md) — setup, every `npm run` script, per-layer test commands, commit/PR/release conventions.
 
 Open work is tracked in [GitHub issues](https://github.com/digidem/comapeo-core-react-native/issues).
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 67cb5bac..40124843 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -135,6 +135,11 @@ what each one verifies) has a root script:
 | iOS integration      | `npm run test:ios`                                         | needs the integration app prebuilt + a simulator |
 | End-to-end (local)   | `npm run e2e:ios` / `e2e:android`, then `npm run e2e:test` | Release build + Maestro; see below               |
 
+Measuring the backend's memory footprint (comparing two builds on a device,
+and the Sentry gauges that answer the same question across the fleet) is a
+separate exercise from testing: see
+[docs/BENCHMARKING.md](./docs/BENCHMARKING.md) and `npm run bench:android`.
+
 The native/integration commands are slower and platform-specific. The CI
 workflows remain the source of truth for the exact flags and device matrix:
 [ios-tests.yml](.github/workflows/ios-tests.yml),
diff --git a/docs/BENCHMARKING.md b/docs/BENCHMARKING.md
index 13ee2d73..21231a00 100644
--- a/docs/BENCHMARKING.md
+++ b/docs/BENCHMARKING.md
@@ -7,8 +7,14 @@ backend makes it a less attractive victim than the foreground UI. That makes
 "what does this change cost in memory" a question worth being able to answer
 cheaply and repeatedly.
 
-The backend measures its own footprint and reports it across the fleet as
-Sentry gauges, from every install with diagnostics on. The numbers come from
+There are two ways to answer it, and they share one implementation.
+
+| | Where | What it answers |
+|---|---|---|
+| [`scripts/benchmark-boot.sh`](../scripts/benchmark-boot.sh) | one device you control | "Is build B lighter than build A?" — an A/B you run before merging |
+| [Sentry gauges](#the-fleet-view-sentry-gauges) | every install with diagnostics on | "Did it hold up on real devices?" — after shipping |
+
+Both read the same numbers from
 [`backend/lib/memory-snapshot.js`](../backend/lib/memory-snapshot.js).
 
 ## What gets measured, and why those numbers
@@ -39,6 +45,102 @@ Android. On iOS node runs in-process, so the same fields would describe the UI
 too; the reader returns `null` there and only the V8 numbers are reported. The
 platform gate is the filesystem, not a flag that could drift.
 
+## Running an A/B locally
+
+The harness is built for comparing two builds, not for producing absolute
+figures. Emulator numbers do not transfer to a physical device — V8 sizes its
+heap from physical RAM, among other things — but the *difference* between two
+builds measured the same way usually does.
+
+The simple case, when you have two APKs:
+
+```sh
+./scripts/benchmark-boot.sh --ab /tmp/before.apk /tmp/after.apk \
+    --rounds 3 --per-round 5
+```
+
+That runs 15 cold boots of each, alternating which build goes first every
+round, and prints a comparison at the end. If you only have one thing to
+measure, run it twice and compare the files:
+
+```sh
+./scripts/benchmark-boot.sh --label before --iterations 10
+# …change something, rebuild…
+./scripts/benchmark-boot.sh --label after --iterations 10
+node scripts/benchmark-report.mjs benchmark-results/before.json \
+                                  benchmark-results/after.json
+```
+
+With no `--apk` or `--ab` it builds `apps/integration` in Release first.
+Benchmark against Release, never debug: `startForeground` alone is about ten
+times slower in a debug build.
+
+Useful flags: `--device <serial>` (required when more than one is attached),
+`--iterations`, `--rounds` / `--per-round`, `--duration` (seconds to watch each
+boot, default 20), `--abi`, `--skip-build`, `--out`.
+
+Output lands in `benchmark-results/` (gitignored): one JSON per label plus the
+raw per-boot logcat captures under a per-invocation `raw/<timestamp>/`
+directory — the second invocation of a before/after comparison does not
+overwrite the first's captures, which are worth keeping when a run looks
+strange.
+
+### Reading the output
+
+```
+metric                   baseline  candidate     delta       %        p
+-----------------------------------------------------------------------
+Peak RSS (MB)               274.4      261.0     -13.4    -4.9   <0.001
+Anonymous RSS (MB)          103.3       92.5     -10.8   -10.5    0.029
+V8 live heap (MB)            25.4       15.8      -9.6   -37.8   <0.001
+
+per-round medians (peak RSS, MB):
+round      baseline  candidate
+1             274.2      261.2
+2             274.4      261.0
+3             275.1      261.1
+```
+
+Medians, not means: boot measurements are skewed by the occasional scheduling
+stall, and one stalled boot drags a mean around. The p-values are two-sided
+Mann–Whitney U over the individual boots — they say whether *these* boots
+differ, not whether the effect holds on hardware you did not test.
+
+**The per-round table is the one to check first.** A development machine is
+usually doing other things, and host load drifts over the twenty-odd minutes a
+full run takes. If the two builds separate the same way in every round, the
+difference is the build. If the rounds disagree, you measured the machine.
+
+### Things that will bite you
+
+- **Steady-state RSS is bimodal.** By the time the sample is taken, a ~24 MB
+  block has either been released back or not, and which happens varies boot to
+  boot. Peak RSS does not have this problem, which is another reason to lead
+  with it. If you need the settled number, take enough boots to see both modes
+  in each build and compare them mode-for-mode.
+- **The compile cache is only wiped when adb runs as root.** The wipe exists
+  so that swapping APKs doesn't leave one build paying for a
+  `NODE_COMPILE_CACHE` the other wrote, but app cache directories are
+  private, so it only works after `adb root` (emulators, userdebug builds).
+  With root, measured boots are cold-cache — the worst case, and the one that
+  matters for a process that may be killed at startup. Without it the harness
+  prints a warning and the boots are warm-cache; the memory numbers are still
+  valid, but treat the timing comparison with suspicion, especially right
+  after swapping APKs.
+- **The first boot after each install is discarded** — it faults the freshly
+  written APK in.
+- **`VmSize` is not a footprint.** A V8 build with pointer compression reserves
+  a 4 GB cage per isolate, which never becomes resident. The harness does not
+  report it for exactly this reason.
+
+### Without root
+
+The harness works unmodified on a production device: the boot timings come
+from the module's `[comapeo.*]` lifecycle crumbs in logcat, and peak RSS, RSS
+and the heap breakdown come from the backend's own `[comapeo.memory] boot`
+log line, which reads `/proc/self` and needs no privilege. The only thing
+root buys is the compile-cache wipe above.
+
 ## The fleet view: Sentry gauges
 
 The same snapshot feeds four gauges, emitted once about three seconds after
@@ -77,7 +179,7 @@ question worth asking of it.
 It only separates builds that carry different revisions, though. A libnode
 built from an unmerged branch reports whatever tag it was based on, so two such
 builds are indistinguishable by this attribute — locally that does not matter
-(you know which APK you installed), but anything shipped to devices for
+(the harness knows which APK it installed), but anything shipped to devices for
 comparison needs its own revision. Bump the nodejs-mobile tag before a staged
 rollout you intend to measure.
 
diff --git a/package.json b/package.json
index 62988cdc..b0b76b49 100644
--- a/package.json
+++ b/package.json
@@ -73,6 +73,8 @@
     "prebackend:build": "npm run backend:install",
     "backend:build": "node ./scripts/build-backend.ts",
     "backend:test": "npm --prefix backend test",
+    "bench:android": "./scripts/benchmark-boot.sh",
+    "bench:report": "node ./scripts/benchmark-report.mjs",
     "e2e:ios": "npm --prefix apps/e2e run build:ios",
     "e2e:android": "npm --prefix apps/e2e run build:android",
     "e2e:test": "maestro test maestro/e2e.yaml"
diff --git a/scripts/benchmark-boot.sh b/scripts/benchmark-boot.sh
new file mode 100755
index 00000000..dd10a917
--- /dev/null
+++ b/scripts/benchmark-boot.sh
@@ -0,0 +1,273 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Cold-boot benchmark for the embedded Node backend on Android.
+#
+# Measures what the `:ComapeoCore` foreground-service process costs to start:
+# peak RSS, settled RSS, the V8 heap breakdown, and launch → `started` →
+# `ready` timings — all read from the module's `[comapeo.*]` lifecycle crumbs
+# and the backend's own `[comapeo.memory] boot` log line, so no root is
+# needed for the numbers. Built for comparing two builds of anything that
+# changes the backend's footprint — a different libnode.so, a dependency
+# bump, a lazy import — not for absolute numbers. Run --help for usage.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+APP_DIR="$PROJECT_ROOT/apps/integration"
+
+PKG="com.comapeo.core.integration"
+ACTIVITY=".MainActivity"
+ABI="arm64-v8a"
+
+LABEL="current"
+ITERATIONS=5
+DURATION=20
+ROUNDS=3
+PER_ROUND=5
+DEVICE=""
+APK=""
+AB_A=""
+AB_B=""
+OUT_DIR="$PROJECT_ROOT/benchmark-results"
+SKIP_BUILD=0
+
+usage() {
+  cat <<'EOF'
+Cold-boot benchmark for the embedded Node backend on Android.
+
+Single series — measure whatever is installed (or install one APK first):
+  ./scripts/benchmark-boot.sh --label before --iterations 10
+  ./scripts/benchmark-boot.sh --label after --apk /tmp/after.apk
+  node scripts/benchmark-report.mjs benchmark-results/before.json \
+                                    benchmark-results/after.json
+
+Interleaved A/B — alternates blocks between two APKs, which is the only
+honest way to run this on a machine that is doing other work:
+  ./scripts/benchmark-boot.sh --ab /tmp/before.apk /tmp/after.apk \
+      --rounds 3 --per-round 5
+
+Options:
+  --label <name>        series label for a single-series run (default: current)
+  --iterations <n>      boots in a single-series run (default: 5)
+  --ab <a.apk> <b.apk>  interleaved A/B between two APKs
+  --rounds <n>          A/B rounds (default: 3)
+  --per-round <n>       boots per build per round (default: 5)
+  --duration <s>        seconds to watch each boot (default: 20)
+  --device <serial>     adb device (required when several are attached)
+  --apk <path>          install this APK before the run
+  --abi <abi>           ABI for the Release build (default: arm64-v8a)
+  --out <dir>           results directory (default: benchmark-results)
+  --skip-build          measure what is already installed
+
+With no --apk/--ab it builds the integration app in Release first (debug
+start-up is ~10x slower and not representative — see CONTRIBUTING.md).
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --label)      LABEL="$2"; shift 2 ;;
+    --iterations) ITERATIONS="$2"; shift 2 ;;
+    --duration)   DURATION="$2"; shift 2 ;;
+    --device)     DEVICE="$2"; shift 2 ;;
+    --apk)        APK="$2"; shift 2 ;;
+    --ab)
+      [ $# -ge 3 ] || { echo "Error: --ab takes two APK paths." >&2; exit 1; }
+      AB_A="$2"; AB_B="$3"; shift 3 ;;
+    --rounds)     ROUNDS="$2"; shift 2 ;;
+    --per-round)  PER_ROUND="$2"; shift 2 ;;
+    --abi)        ABI="$2"; shift 2 ;;
+    --out)        OUT_DIR="$2"; shift 2 ;;
+    --skip-build) SKIP_BUILD=1; shift ;;
+    -h|--help)    usage; exit 0 ;;
+    *) echo "Unknown option: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+# The interactive shell aliases `adb` to a multi-device picker that ignores
+# -s and blocks on stdin; go straight to the binary.
+ADB=(command adb)
+[ -n "$DEVICE" ] && ADB=(command adb -s "$DEVICE")
+
+# Run ids ("<label>-r<round>-<n>") reach the device shell unquoted, so keep
+# every label to a safe character set.
+safe_label() { printf '%s' "$1" | tr -c 'A-Za-z0-9._-' '_'; }
+LABEL="$(safe_label "$LABEL")"
+
+# ---------------------------------------------------------------
+# Device
+# ---------------------------------------------------------------
+
+ensure_device() {
+  command -v adb >/dev/null 2>&1 || {
+    echo "Error: adb not found. Install Android platform-tools." >&2
+    exit 1
+  }
+  local count
+  count=$("${ADB[@]}" devices | grep -cE '\sdevice$' || true)
+  if [ "$count" -eq 0 ]; then
+    echo "Error: no device. Boot one first, e.g. 'emulator -avd Pixel_7a_API_34 &'." >&2
+    exit 1
+  fi
+  if [ "$count" -gt 1 ] && [ -z "$DEVICE" ]; then
+    echo "Error: $count devices attached; pass --device <serial>." >&2
+    "${ADB[@]}" devices >&2
+    exit 1
+  fi
+}
+
+# The compile-cache wipe before each boot needs a root shell (app data dirs
+# are private). Without it the wipe silently no-ops and measured boots are
+# warm-cache, so say so up front instead of letting the run overclaim.
+check_cache_wipe() {
+  if "${ADB[@]}" shell 'id' 2>/dev/null | grep -q 'uid=0'; then
+    echo "==> compile cache: wiped before each boot (cold-cache boots)"
+  else
+    echo "==> WARNING: adb shell is not root, so the compile-cache wipe is a no-op" >&2
+    echo "    and measured boots are warm-cache. Run 'adb root' first (emulator or" >&2
+    echo "    userdebug build) for the cold-cache boots docs/BENCHMARKING.md describes." >&2
+  fi
+}
+
+# ---------------------------------------------------------------
+# Build
+# ---------------------------------------------------------------
+
+build_release_apk() {
+  echo "==> building apps/integration (Release, $ABI)"
+  (cd "$APP_DIR/android" && ./gradlew :app:assembleRelease \
+    "-PreactNativeArchitectures=$ABI" --console=plain -q)
+  APK="$APP_DIR/android/app/build/outputs/apk/release/app-release.apk"
+}
+
+install_apk() {
+  echo "==> installing $(basename "$1")"
+  "${ADB[@]}" install -r "$1" >/dev/null
+}
+
+# ---------------------------------------------------------------
+# Runs
+# ---------------------------------------------------------------
+
+run_boot() {
+  local id="$1"
+  printf '  %-24s' "$id"
+  "${ADB[@]}" shell "sh /data/local/tmp/benchmark-sample.sh $PKG $ACTIVITY $id $DURATION" \
+    | tr -d '\r'
+}
+
+# Runs $2 boots labelled "$1-r$3-<n>", discarding a warm-up first.
+run_block() {
+  local label="$1" count="$2" round="$3"
+  # The first boot after an install faults the freshly written APK in and is
+  # not representative; measure after it. It only needs to reach `ready`
+  # (~2s), not the memory sample, so don't watch it for the full duration.
+  "${ADB[@]}" shell "sh /data/local/tmp/benchmark-sample.sh $PKG $ACTIVITY warmup 8" \
+    >/dev/null 2>&1
+  local i
+  for i in $(seq 1 "$count"); do
+    run_boot "$label-r$round-$i"
+  done
+}
+
+# ---------------------------------------------------------------
+
+echo "╔════════════════════════════════════════════╗"
+echo "║  CoMapeo backend cold-boot benchmark       ║"
+echo "╚════════════════════════════════════════════╝"
+
+ensure_device
+check_cache_wipe
+
+if [ -z "$APK" ] && [ -z "$AB_A" ] && [ "$SKIP_BUILD" -eq 0 ]; then
+  build_release_apk
+fi
+
+mkdir -p "$OUT_DIR"
+"${ADB[@]}" shell 'rm -rf /data/local/tmp/comapeo-bench'
+"${ADB[@]}" push "$SCRIPT_DIR/lib/benchmark-sample.sh" \
+  /data/local/tmp/benchmark-sample.sh >/dev/null
+"${ADB[@]}" shell 'chmod 755 /data/local/tmp/benchmark-sample.sh'
+# Animations skew the activity launch that starts the service. These are
+# device-wide settings, so save what was there and put it back on the way out
+# — including on Ctrl-C, which is how a long run usually ends.
+ANIM_KEYS=(window_animation_scale transition_animation_scale animator_duration_scale)
+ANIM_SAVED=()
+for key in "${ANIM_KEYS[@]}"; do
+  ANIM_SAVED+=("$("${ADB[@]}" shell "settings get global $key" 2>/dev/null | tr -d '\r' || true)")
+done
+
+restore_animations() {
+  local i value
+  for i in "${!ANIM_KEYS[@]}"; do
+    value="${ANIM_SAVED[$i]}"
+    if [ -z "$value" ] || [ "$value" = "null" ]; then
+      value="1.0"
+    fi
+    "${ADB[@]}" shell "settings put global ${ANIM_KEYS[$i]} $value" >/dev/null 2>&1 || true
+  done
+}
+trap restore_animations EXIT
+
+for key in "${ANIM_KEYS[@]}"; do
+  "${ADB[@]}" shell "settings put global $key 0" >/dev/null 2>&1 || true
+done
+
+if [ -n "$AB_A" ]; then
+  # Label each series after its APK so the report names the builds rather than
+  # "a" and "b", and fall back when both files share a basename.
+  LABEL_A="$(safe_label "$(basename "$AB_A" .apk)")"
+  LABEL_B="$(safe_label "$(basename "$AB_B" .apk)")"
+  if [ "$LABEL_A" = "$LABEL_B" ]; then LABEL_A="a-$LABEL_A"; LABEL_B="b-$LABEL_B"; fi
+
+  echo "==> interleaved A/B: $ROUNDS rounds x $PER_ROUND boots per build"
+  echo "    baseline  $LABEL_A  ($AB_A)"
+  echo "    candidate $LABEL_B  ($AB_B)"
+  for r in $(seq 1 "$ROUNDS"); do
+    # Alternate which build goes first each round so a drift in host load
+    # cannot line up with one of them.
+    if [ $((r % 2)) -eq 1 ]; then
+      order=("$LABEL_A|$AB_A" "$LABEL_B|$AB_B")
+    else
+      order=("$LABEL_B|$AB_B" "$LABEL_A|$AB_A")
+    fi
+    for entry in "${order[@]}"; do
+      install_apk "${entry#*|}"
+      run_block "${entry%%|*}" "$PER_ROUND" "$r"
+    done
+  done
+  LABELS=("$LABEL_A" "$LABEL_B")
+else
+  [ -n "$APK" ] && install_apk "$APK"
+  echo "==> $ITERATIONS boots, label '$LABEL'"
+  run_block "$LABEL" "$ITERATIONS" 1
+  LABELS=("$LABEL")
+fi
+
+echo "==> collecting"
+# One raw directory per invocation: the documented before/after workflow is
+# two invocations, and the second must not destroy the first's captures.
+RAW_DIR="$OUT_DIR/raw/$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$RAW_DIR"
+if ! "${ADB[@]}" pull /data/local/tmp/comapeo-bench "$RAW_DIR" >/dev/null; then
+  echo "Error: adb pull failed. The captures are still on the device under" >&2
+  echo "/data/local/tmp/comapeo-bench — pull them manually and run" >&2
+  echo "scripts/benchmark-collect.mjs against that directory." >&2
+  exit 1
+fi
+
+for label in "${LABELS[@]}"; do
+  node "$SCRIPT_DIR/benchmark-collect.mjs" \
+    --raw "$RAW_DIR/comapeo-bench" \
+    --label "$label" \
+    --out "$OUT_DIR/$label.json"
+done
+
+echo
+echo "==> results in $OUT_DIR"
+if [ "${#LABELS[@]}" -eq 2 ]; then
+  node "$SCRIPT_DIR/benchmark-report.mjs" \
+    "$OUT_DIR/${LABELS[0]}.json" "$OUT_DIR/${LABELS[1]}.json"
+else
+  node "$SCRIPT_DIR/benchmark-report.mjs" "$OUT_DIR/${LABELS[0]}.json"
+fi
diff --git a/scripts/benchmark-collect.mjs b/scripts/benchmark-collect.mjs
new file mode 100755
index 00000000..af944545
--- /dev/null
+++ b/scripts/benchmark-collect.mjs
@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+
+// Turns the raw per-boot artefacts pulled off the device by
+// scripts/benchmark-boot.sh into one results JSON per labelled series.
+//
+// Usage:
+//   node scripts/benchmark-collect.mjs --raw <dir> --label <label> --out <file>
+//
+// The raw directory holds, per boot id: <id>.log (logcat -v epoch) and
+// <id>.meta (host-side launch timestamp + pid).
+
+import fs from "node:fs";
+import path from "node:path";
+import { parseArgs } from "node:util";
+
+import { bootDurations, parseLogcat, parseRunId } from "./lib/benchmark-core.mjs";
+
+const { values } = parseArgs({
+  options: {
+    raw: { type: "string" },
+    label: { type: "string" },
+    out: { type: "string" },
+  },
+});
+for (const key of ["raw", "label", "out"]) {
+  if (!values[key]) {
+    console.error(`Missing required --${key}`);
+    process.exit(1);
+  }
+}
+const { raw, label, out } = values;
+
+function readIfPresent(file) {
+  try {
+    return fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+/** Boot ids for this label, in run order: `<label>-r<round>-<index>`. */
+const entries = fs
+  .readdirSync(raw)
+  .filter((name) => name.endsWith(".meta"))
+  .map((name) => name.replace(/\.meta$/, ""))
+  .map((id) => ({ id, ...parseRunId(id, label) }))
+  .filter((entry) => entry.round !== undefined)
+  .sort((a, b) => a.round - b.round || a.index - b.index);
+
+const runs = entries.map(({ id, round, index }) => {
+  const meta = Object.fromEntries(
+    (readIfPresent(path.join(raw, `${id}.meta`)) ?? "")
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => line.split("=")),
+  );
+  const logcat = readIfPresent(path.join(raw, `${id}.log`)) ?? "";
+  const { milestones, memory } = parseLogcat(logcat);
+  const t0 = Number(meta.t0_epoch);
+  const durations = Number.isFinite(t0) ? bootDurations(milestones, t0) : {};
+
+  // A boot with no `ready` never got the backend up; a boot with no memory
+  // snapshot got there but died (or stalled) before reporting. Both are
+  // failures for comparison purposes, and both are worth surfacing rather
+  // than quietly averaging away.
+  const failed = durations.ready === undefined || !memory;
+
+  return { id, label, round, index, failed, durations, memory };
+});
+
+const failures = runs.filter((run) => run.failed);
+if (failures.length) {
+  console.warn(
+    `==> ${label}: ${failures.length}/${runs.length} boots did not reach a memory sample (${failures
+      .map((run) => run.id)
+      .join(", ")})`,
+  );
+}
+
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(
+  out,
+  `${JSON.stringify({ label, capturedAt: new Date().toISOString(), runs }, null, 2)}\n`,
+);
+console.log(`==> ${label}: ${runs.length - failures.length} usable boots → ${out}`);
diff --git a/scripts/benchmark-report.mjs b/scripts/benchmark-report.mjs
new file mode 100755
index 00000000..a45786a3
--- /dev/null
+++ b/scripts/benchmark-report.mjs
@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+// Prints a benchmark results file, or compares two of them.
+//
+// Usage:
+//   node scripts/benchmark-report.mjs benchmark-results/after.json
+//   node scripts/benchmark-report.mjs benchmark-results/before.json \
+//                                     benchmark-results/after.json
+//
+// Reports medians rather than means: boot measurements are skewed by the
+// occasional scheduling stall, and one stalled boot would drag a mean around.
+// The p-values are two-sided Mann–Whitney U over the individual boots — they
+// say whether these two sets of boots differ, not whether the effect holds on
+// hardware you did not test.
+
+import fs from "node:fs";
+
+import {
+  METRICS,
+  compare,
+  perRoundMedians,
+  summarise,
+} from "./lib/benchmark-core.mjs";
+
+const files = process.argv.slice(2);
+if (files.length === 0 || files.length > 2) {
+  console.error("Usage: benchmark-report.mjs <results.json> [<results.json>]");
+  process.exit(1);
+}
+
+const series = files.map((file) => {
+  const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+  return { file, ...parsed, summary: summarise(parsed.runs) };
+});
+
+const num = (value, digits = 1) =>
+  value == null ? "—" : value.toFixed(digits);
+const pad = (text, width) => String(text).padStart(width);
+const padEnd = (text, width) => String(text).padEnd(width);
+
+function header(entry) {
+  const { summary } = entry;
+  const runtime = summary.runtime ? `nodejs-mobile ${summary.runtime}` : "runtime unknown";
+  const failed = summary.failed ? `, ${summary.failed} failed` : "";
+  return `${entry.label}: ${summary.count} boots${failed} · ${runtime}`;
+}
+
+if (series.length === 1) {
+  const [only] = series;
+  console.log(`\n${header(only)}\n`);
+  console.log(padEnd("metric", 22) + pad("median", 10) + pad("sd", 9) + pad("n", 5));
+  console.log("-".repeat(46));
+  for (const metric of METRICS) {
+    const stats = only.summary.metrics[metric.key];
+    if (!stats || stats.median == null) continue;
+    console.log(
+      padEnd(`${metric.label} (${metric.unit})`, 22) +
+        pad(num(stats.median, metric.unit === "s" ? 2 : 1), 10) +
+        pad(num(stats.stdev, 2), 9) +
+        pad(stats.n, 5),
+    );
+  }
+  console.log();
+  process.exit(0);
+}
+
+const [baseline, candidate] = series;
+console.log(`\nbaseline  ${header(baseline)}`);
+console.log(`candidate ${header(candidate)}\n`);
+
+const rows = compare(baseline.summary, candidate.summary);
+console.log(
+  padEnd("metric", 22) +
+    pad("baseline", 11) +
+    pad("candidate", 11) +
+    pad("delta", 10) +
+    pad("%", 8) +
+    pad("p", 9),
+);
+console.log("-".repeat(71));
+for (const row of rows) {
+  if (row.baseline == null && row.candidate == null) continue;
+  const digits = row.unit === "s" ? 2 : 1;
+  console.log(
+    padEnd(`${row.label} (${row.unit})`, 22) +
+      pad(num(row.baseline, digits), 11) +
+      pad(num(row.candidate, digits), 11) +
+      pad(num(row.delta, digits), 10) +
+      pad(num(row.percent, 1), 8) +
+      pad(row.p == null ? "—" : row.p < 0.001 ? "<0.001" : row.p.toFixed(3), 9),
+  );
+}
+
+// Per-round medians are the check that matters on a busy machine: if the two
+// builds separate the same way in every round, the difference is the build
+// and not drift in host load across the session.
+const rounds = new Set(baseline.runs.concat(candidate.runs).map((run) => run.round));
+if (rounds.size > 1) {
+  console.log("\nper-round medians (peak RSS, MB):");
+  console.log(padEnd("round", 10) + pad("baseline", 11) + pad("candidate", 11));
+  const a = perRoundMedians(baseline.runs, "peakRss");
+  const b = perRoundMedians(candidate.runs, "peakRss");
+  for (const round of [...rounds].sort((x, y) => x - y)) {
+    console.log(
+      padEnd(round, 10) +
+        pad(num(a.find((r) => r.round === round)?.median), 11) +
+        pad(num(b.find((r) => r.round === round)?.median), 11),
+    );
+  }
+}
+console.log();
diff --git a/scripts/lib/benchmark-core.mjs b/scripts/lib/benchmark-core.mjs
new file mode 100644
index 00000000..6d15ab37
--- /dev/null
+++ b/scripts/lib/benchmark-core.mjs
@@ -0,0 +1,308 @@
+// Pure parsing + statistics core for scripts/benchmark-boot.sh.
+//
+// No network, no filesystem, no process state: it takes captured text and
+// returns plain objects, so it is unit-testable from fixtures
+// (scripts/lib/benchmark-core.test.mjs). The I/O shell lives in
+// scripts/benchmark-boot.sh (device orchestration) and
+// scripts/benchmark-report.mjs (reading results, printing tables).
+//
+// The two contracts it parses are stable logging surfaces of the Android
+// module, and breaking either should break these tests:
+//
+//   - `logCrumb` renders "[<category>] <message> {<attrs>}"
+//     (android/src/main/java/com/comapeo/core/log.kt), which is how the
+//     control-frame and lifecycle milestones appear.
+//   - the backend prints one "[comapeo.memory] boot {json}" line a few
+//     seconds after `ready` (backend/index.js). That line carries `VmHWM`
+//     read from inside the process, which is why a boot benchmark does not
+//     need root to get the peak RSS that matters.
+
+// ── Boot milestones ─────────────────────────────────────────────
+
+/**
+ * Milestones in boot order, all structured `[comapeo.*]` crumbs emitted by
+ * the Android module — free-text log messages are not stable surfaces and
+ * are deliberately not matched. `pattern` matches the message part of a
+ * logcat line; the first occurrence wins, because a retry after a failed
+ * boot should not silently redefine t0.
+ */
+export const BOOT_MILESTONES = [
+  { key: "fgsCreate", pattern: /\[comapeo\.fgs\] ComapeoCoreService\.onCreate/ },
+  { key: "nodeStart", pattern: /\[comapeo\.boot\] start\(\)/ },
+  { key: "started", pattern: /\[comapeo\.control\] received: started/ },
+  { key: "ready", pattern: /\[comapeo\.control\] received: ready/ },
+];
+
+/** `logcat -v epoch` prefixes each line with "  <sec>.<ms> <pid> <tid> <level> <tag>: ". */
+const EPOCH_LINE = /^\s*(\d+\.\d+)\s+\d+\s+\d+\s+[VDIWEF]\s+[^:]+:\s?(.*)$/;
+
+const MEMORY_LINE = /\[comapeo\.memory\] boot (\{.*\})\s*$/;
+
+/**
+ * Extracts boot milestone timestamps and the backend's boot memory snapshot
+ * from an epoch-formatted logcat capture.
+ *
+ * @param {string} text Output of `logcat -v epoch`.
+ * @returns {{
+ *   milestones: Record<string, number>,
+ *   memory: object | null,
+ * }}
+ */
+export function parseLogcat(text) {
+  /** @type {Record<string, number>} */
+  const milestones = {};
+  let memory = null;
+
+  for (const line of text.split("\n")) {
+    const match = EPOCH_LINE.exec(line);
+    if (!match) continue;
+    const epoch = Number(match[1]);
+    const message = match[2];
+
+    for (const { key, pattern } of BOOT_MILESTONES) {
+      if (milestones[key] === undefined && pattern.test(message)) {
+        milestones[key] = epoch;
+      }
+    }
+
+    const mem = MEMORY_LINE.exec(message);
+    if (mem && !memory) {
+      try {
+        memory = JSON.parse(mem[1]);
+      } catch {
+        // A truncated line loses the snapshot, never the run.
+      }
+    }
+  }
+
+  return { milestones, memory };
+}
+
+/**
+ * Seconds from launch to each milestone. `t0` is the host-side timestamp
+ * taken immediately before `am start`, so `fgsCreate` includes process
+ * creation — which is part of what a boot costs.
+ *
+ * @param {Record<string, number>} milestones
+ * @param {number} t0 Epoch seconds at `am start`.
+ */
+export function bootDurations(milestones, t0) {
+  /** @type {Record<string, number>} */
+  const out = {};
+  for (const { key } of BOOT_MILESTONES) {
+    if (milestones[key] !== undefined) out[key] = milestones[key] - t0;
+  }
+  return out;
+}
+
+// ── Run ids ─────────────────────────────────────────────────────
+
+/**
+ * Parses a run id of the exact form `<label>-r<round>-<index>` for the given
+ * label. Returns null for any other id — including one whose label merely
+ * starts with `label`, so `app` never absorbs `app-release`'s runs.
+ *
+ * @param {string} id
+ * @param {string} label
+ * @returns {{ round: number, index: number } | null}
+ */
+export function parseRunId(id, label) {
+  const match = /^(.*)-r(\d+)-(\d+)$/.exec(id);
+  if (!match || match[1] !== label) return null;
+  return { round: Number(match[2]), index: Number(match[3]) };
+}
+
+// ── Statistics ──────────────────────────────────────────────────
+
+/** @param {number[]} values */
+export function median(values) {
+  const sorted = values.filter(Number.isFinite).sort((a, b) => a - b);
+  if (!sorted.length) return null;
+  const mid = sorted.length >> 1;
+  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
+
+/** Sample standard deviation. @param {number[]} values */
+export function stdev(values) {
+  const sample = values.filter(Number.isFinite);
+  if (sample.length < 2) return null;
+  const mean = sample.reduce((a, b) => a + b, 0) / sample.length;
+  const variance =
+    sample.reduce((acc, v) => acc + (v - mean) ** 2, 0) / (sample.length - 1);
+  return Math.sqrt(variance);
+}
+
+/** Abramowitz & Stegun 7.1.26 normal CDF. @param {number} x */
+function normalCdf(x) {
+  const t = 1 / (1 + 0.2316419 * x);
+  const density = 0.3989422804014327 * Math.exp((-x * x) / 2);
+  const poly =
+    t *
+    (0.319381530 +
+      t *
+        (-0.356563782 +
+          t * (1.781477937 + t * (-1.821255978 + t * 1.330274429))));
+  return 1 - density * poly;
+}
+
+/**
+ * Two-sided Mann–Whitney U with tie correction, normal approximation.
+ *
+ * Rank-based on purpose: boot measurements are skewed by the occasional
+ * scheduling stall, so a t-test on a dozen boots would be driven by the
+ * outlier. Returns null when either sample is empty or degenerate.
+ *
+ * @param {number[]} a
+ * @param {number[]} b
+ * @returns {{ u: number, z: number, p: number } | null}
+ */
+export function mannWhitneyU(a, b) {
+  const x = a.filter(Number.isFinite);
+  const y = b.filter(Number.isFinite);
+  if (!x.length || !y.length) return null;
+
+  const all = [
+    ...x.map((v) => ({ v, group: 0 })),
+    ...y.map((v) => ({ v, group: 1 })),
+  ].sort((p, q) => p.v - q.v);
+
+  const ranks = new Array(all.length);
+  const tieGroups = [];
+  let i = 0;
+  while (i < all.length) {
+    let j = i;
+    while (j + 1 < all.length && all[j + 1].v === all[i].v) j++;
+    const rank = (i + j) / 2 + 1;
+    for (let k = i; k <= j; k++) ranks[k] = rank;
+    tieGroups.push(j - i + 1);
+    i = j + 1;
+  }
+
+  let rankSumX = 0;
+  all.forEach((item, index) => {
+    if (item.group === 0) rankSumX += ranks[index];
+  });
+
+  const n1 = x.length;
+  const n2 = y.length;
+  const u = rankSumX - (n1 * (n1 + 1)) / 2;
+  const mu = (n1 * n2) / 2;
+  const n = n1 + n2;
+  if (n < 2) return null;
+  const tieCorrection = tieGroups.reduce((acc, t) => acc + (t ** 3 - t), 0);
+  const sigma = Math.sqrt(
+    ((n1 * n2) / 12) * (n + 1 - tieCorrection / (n * (n - 1))),
+  );
+  if (!sigma) return null;
+  const z = (u - mu) / sigma;
+  return { u, z, p: 2 * (1 - normalCdf(Math.abs(z))) };
+}
+
+// ── Run records ─────────────────────────────────────────────────
+
+/**
+ * The metrics a comparison reports, in display order. `path` addresses a
+ * field of a run record; `scale` converts to the display unit.
+ */
+export const METRICS = [
+  { key: "peakRss", label: "Peak RSS", unit: "MB", scale: 1 / 1048576, path: ["memory", "process", "peakRssBytes"] },
+  { key: "rss", label: "RSS at sample", unit: "MB", scale: 1 / 1048576, path: ["memory", "process", "rssBytes"] },
+  { key: "anon", label: "Anonymous RSS", unit: "MB", scale: 1 / 1048576, path: ["memory", "process", "anonBytes"] },
+  { key: "heapUsed", label: "V8 live heap", unit: "MB", scale: 1 / 1048576, path: ["memory", "heap", "usedBytes"] },
+  { key: "heapPhysical", label: "V8 heap committed", unit: "MB", scale: 1 / 1048576, path: ["memory", "heap", "physicalBytes"] },
+  { key: "heapLimit", label: "V8 heap limit", unit: "MB", scale: 1 / 1048576, path: ["memory", "heap", "limitBytes"] },
+  { key: "external", label: "V8 external", unit: "MB", scale: 1 / 1048576, path: ["memory", "heap", "externalBytes"] },
+  { key: "toStarted", label: "Launch → started", unit: "s", scale: 1, path: ["durations", "started"] },
+  { key: "toReady", label: "Launch → ready", unit: "s", scale: 1, path: ["durations", "ready"] },
+];
+
+/** @param {object} obj @param {string[]} path */
+function pluck(obj, path) {
+  let cursor = obj;
+  for (const key of path) {
+    if (cursor == null || typeof cursor !== "object") return undefined;
+    cursor = cursor[key];
+  }
+  return typeof cursor === "number" ? cursor : undefined;
+}
+
+/**
+ * Median/spread per metric for one series of runs.
+ *
+ * @param {object[]} runs
+ */
+export function summarise(runs) {
+  const usable = runs.filter((run) => !run.failed);
+  return {
+    count: usable.length,
+    failed: runs.length - usable.length,
+    runtime: usable.find((run) => run.memory?.runtime)?.memory?.runtime ?? null,
+    metrics: Object.fromEntries(
+      METRICS.map((metric) => {
+        const values = usable
+          .map((run) => pluck(run, metric.path))
+          .filter((v) => v !== undefined)
+          .map((v) => v * metric.scale);
+        return [
+          metric.key,
+          { median: median(values), stdev: stdev(values), n: values.length, values },
+        ];
+      }),
+    ),
+  };
+}
+
+/**
+ * Compares two summarised series. `p` is omitted where either side has no
+ * samples for that metric — an absent number is reported as absent rather
+ * than as a zero difference.
+ *
+ * @param {ReturnType<typeof summarise>} baseline
+ * @param {ReturnType<typeof summarise>} candidate
+ */
+export function compare(baseline, candidate) {
+  return METRICS.map((metric) => {
+    const a = baseline.metrics[metric.key];
+    const b = candidate.metrics[metric.key];
+    const test = a?.values.length && b?.values.length
+      ? mannWhitneyU(a.values, b.values)
+      : null;
+    const delta =
+      a?.median != null && b?.median != null ? b.median - a.median : null;
+    return {
+      ...metric,
+      baseline: a?.median ?? null,
+      candidate: b?.median ?? null,
+      baselineStdev: a?.stdev ?? null,
+      candidateStdev: b?.stdev ?? null,
+      delta,
+      percent:
+        delta != null && a?.median ? (delta / a.median) * 100 : null,
+      p: test?.p ?? null,
+    };
+  });
+}
+
+/**
+ * Splits interleaved runs into per-round medians for one metric. Non-
+ * overlapping per-round medians are the honest evidence that a difference is
+ * the build and not host-load drift over the session.
+ *
+ * @param {object[]} runs
+ * @param {string} metricKey
+ */
+export function perRoundMedians(runs, metricKey) {
+  const metric = METRICS.find((m) => m.key === metricKey);
+  if (!metric) return [];
+  const rounds = [...new Set(runs.map((run) => run.round))].sort((a, b) => a - b);
+  return rounds.map((round) => ({
+    round,
+    median: median(
+      runs
+        .filter((run) => run.round === round && !run.failed)
+        .map((run) => pluck(run, metric.path))
+        .filter((v) => v !== undefined)
+        .map((v) => v * metric.scale),
+    ),
+  }));
+}
diff --git a/scripts/lib/benchmark-core.test.mjs b/scripts/lib/benchmark-core.test.mjs
new file mode 100644
index 00000000..ee48c8d8
--- /dev/null
+++ b/scripts/lib/benchmark-core.test.mjs
@@ -0,0 +1,209 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import {
+  bootDurations,
+  compare,
+  mannWhitneyU,
+  median,
+  parseLogcat,
+  parseRunId,
+  perRoundMedians,
+  stdev,
+  summarise,
+} from "./benchmark-core.mjs";
+
+// Verbatim shapes from `adb logcat -v epoch` on a Pixel_7a_API_34 emulator
+// running the integration app, trimmed to the lines the parser looks for
+// (plus one free-text line it must ignore).
+const LOGCAT = `
+         1787305093.601 17579 17579 I ComapeoCore: [comapeo.fgs] ComapeoCoreService.onCreate {category=comapeo.fgs}
+         1787305093.744 17579 17579 I ComapeoCore: [comapeo.boot] start() {category=comapeo.boot}
+         1787305093.902 17579 17579 I ComapeoCore: STOPPED → STARTING {from=STOPPED, to=STARTING}
+         1787305095.858 17579 17667 I ComapeoCore: [comapeo.control] received: started {category=comapeo.control}
+         1787305096.193 17579 17667 I ComapeoCore: [comapeo.control] received: ready {category=comapeo.control}
+         1787305101.220 17579 17667 I Comapeo:NodeJS: [comapeo.memory] boot {"runtime":"24.19.0-0","heap":{"usedBytes":26654280,"physicalBytes":39010304,"totalBytes":43155456,"limitBytes":569114624,"externalBytes":10081445},"process":{"rssBytes":218136576,"peakRssBytes":280645632,"anonBytes":81002496,"fileBytes":101486592,"swapBytes":27136000}}
+`;
+
+describe("parseLogcat", () => {
+  it("extracts every boot milestone in epoch seconds", () => {
+    const { milestones } = parseLogcat(LOGCAT);
+    assert.equal(milestones.fgsCreate, 1787305093.601);
+    assert.equal(milestones.nodeStart, 1787305093.744);
+    assert.equal(milestones.started, 1787305095.858);
+    assert.equal(milestones.ready, 1787305096.193);
+  });
+
+  it("ignores free-text lines that are not structured crumbs", () => {
+    const { milestones } = parseLogcat(LOGCAT);
+    assert.deepEqual(
+      Object.keys(milestones).sort(),
+      ["fgsCreate", "nodeStart", "ready", "started"],
+    );
+  });
+
+  it("keeps the first occurrence of a milestone, not the last", () => {
+    const doubled = LOGCAT + LOGCAT.replace(/1787305096\.193/, "1787305199.000");
+    const { milestones } = parseLogcat(doubled);
+    assert.equal(milestones.ready, 1787305096.193);
+  });
+
+  it("parses the backend boot memory snapshot", () => {
+    const { memory } = parseLogcat(LOGCAT);
+    assert.equal(memory.runtime, "24.19.0-0");
+    assert.equal(memory.process.peakRssBytes, 280645632);
+    assert.equal(memory.heap.physicalBytes, 39010304);
+  });
+
+  it("survives a truncated snapshot line", () => {
+    const truncated =
+      '  1787305101.220 1 1 I Comapeo:NodeJS: [comapeo.memory] boot {"runtime":"24.1\n';
+    const { memory } = parseLogcat(truncated);
+    assert.equal(memory, null);
+  });
+
+  it("returns empty results for unrelated output", () => {
+    const { milestones, memory } = parseLogcat("--------- beginning of main\n");
+    assert.deepEqual(milestones, {});
+    assert.equal(memory, null);
+  });
+});
+
+describe("bootDurations", () => {
+  it("measures each milestone from the host-side launch timestamp", () => {
+    const { milestones } = parseLogcat(LOGCAT);
+    const durations = bootDurations(milestones, 1787305093.583);
+    assert.ok(Math.abs(durations.ready - 2.61) < 0.001);
+    assert.ok(Math.abs(durations.started - 2.275) < 0.001);
+    assert.ok(durations.fgsCreate < durations.started);
+  });
+
+  it("omits milestones that never appeared", () => {
+    const durations = bootDurations({ fgsCreate: 10 }, 9);
+    assert.deepEqual(Object.keys(durations), ["fgsCreate"]);
+  });
+});
+
+describe("parseRunId", () => {
+  it("parses round and index for an exact label match", () => {
+    assert.deepEqual(parseRunId("before-r2-14", "before"), { round: 2, index: 14 });
+  });
+
+  it("rejects ids whose label merely starts with the requested label", () => {
+    assert.equal(parseRunId("app-release-r1-2", "app"), null);
+    assert.deepEqual(parseRunId("app-release-r1-2", "app-release"), { round: 1, index: 2 });
+  });
+
+  it("handles a label that itself ends in -r<digits>", () => {
+    assert.deepEqual(parseRunId("app-r1-r2-3", "app-r1"), { round: 2, index: 3 });
+  });
+
+  it("rejects ids that are not <label>-r<round>-<index>", () => {
+    assert.equal(parseRunId("warmup", "warmup"), null);
+    assert.equal(parseRunId("before-r1", "before"), null);
+    assert.equal(parseRunId("before-r1-2x", "before"), null);
+  });
+});
+
+describe("statistics", () => {
+  it("median handles even and odd counts", () => {
+    assert.equal(median([3, 1, 2]), 2);
+    assert.equal(median([4, 1, 3, 2]), 2.5);
+    assert.equal(median([]), null);
+  });
+
+  it("stdev needs at least two samples", () => {
+    assert.equal(stdev([1]), null);
+    assert.ok(Math.abs(stdev([2, 4, 4, 4, 5, 5, 7, 9]) - 2.138) < 0.01);
+  });
+
+  it("mannWhitneyU separates two disjoint samples", () => {
+    const result = mannWhitneyU([1, 2, 3, 4, 5], [11, 12, 13, 14, 15]);
+    assert.ok(result.p < 0.01, `expected a small p, got ${result.p}`);
+  });
+
+  it("mannWhitneyU reports no difference for identical samples", () => {
+    const result = mannWhitneyU([1, 2, 3], [1, 2, 3]);
+    assert.ok(result.p > 0.9);
+  });
+
+  it("mannWhitneyU returns null when a sample is empty", () => {
+    assert.equal(mannWhitneyU([], [1, 2]), null);
+  });
+});
+
+/** @param {number} peak @param {number} ready */
+function run(peak, ready, round = 1) {
+  return {
+    round,
+    durations: { started: ready - 0.3, ready },
+    memory: {
+      runtime: "24.19.0-0",
+      heap: {
+        usedBytes: 25 * 1048576,
+        physicalBytes: 37 * 1048576,
+        totalBytes: 41 * 1048576,
+        limitBytes: 542 * 1048576,
+        externalBytes: 9 * 1048576,
+      },
+      process: {
+        rssBytes: 200 * 1048576,
+        peakRssBytes: peak * 1048576,
+        anonBytes: 100 * 1048576,
+        swapBytes: 26 * 1048576,
+      },
+    },
+  };
+}
+
+describe("summarise", () => {
+  it("reports medians in display units and counts failures separately", () => {
+    const summary = summarise([run(274, 1.9), run(275, 2.0), { failed: true }]);
+    assert.equal(summary.count, 2);
+    assert.equal(summary.failed, 1);
+    assert.equal(summary.runtime, "24.19.0-0");
+    assert.equal(summary.metrics.peakRss.median, 274.5);
+    assert.equal(summary.metrics.toReady.median, 1.95);
+    assert.equal(summary.metrics.heapUsed.median, 25);
+  });
+
+  it("yields a null median for a metric no run captured", () => {
+    const summary = summarise([{ durations: { ready: 2 } }]);
+    assert.equal(summary.metrics.peakRss.median, null);
+    assert.equal(summary.metrics.toReady.median, 2);
+  });
+});
+
+describe("compare", () => {
+  it("reports delta, percent and p per metric", () => {
+    const baseline = summarise([run(274, 1.9), run(275, 1.9), run(274, 2.0)]);
+    const candidate = summarise([run(261, 1.8), run(261, 1.8), run(262, 1.8)]);
+    const rows = compare(baseline, candidate);
+    const peak = rows.find((row) => row.key === "peakRss");
+    assert.equal(peak.baseline, 274);
+    assert.equal(peak.candidate, 261);
+    assert.equal(peak.delta, -13);
+    assert.ok(Math.abs(peak.percent + 4.74) < 0.01);
+    assert.ok(peak.p < 0.1);
+  });
+
+  it("leaves delta and p null where one side has no samples", () => {
+    const rows = compare(summarise([run(274, 1.9)]), summarise([{ failed: true }]));
+    const peak = rows.find((row) => row.key === "peakRss");
+    assert.equal(peak.delta, null);
+    assert.equal(peak.p, null);
+  });
+});
+
+describe("perRoundMedians", () => {
+  it("groups by interleaving round so drift is visible", () => {
+    const rows = perRoundMedians(
+      [run(274, 1.9, 1), run(275, 1.9, 1), run(281, 1.9, 2), run(283, 1.9, 2)],
+      "peakRss",
+    );
+    assert.deepEqual(rows, [
+      { round: 1, median: 274.5 },
+      { round: 2, median: 282 },
+    ]);
+  });
+});
diff --git a/scripts/lib/benchmark-sample.sh b/scripts/lib/benchmark-sample.sh
new file mode 100644
index 00000000..d9213171
--- /dev/null
+++ b/scripts/lib/benchmark-sample.sh
@@ -0,0 +1,69 @@
+#!/system/bin/sh
+# Runs ON THE DEVICE, pushed there by scripts/benchmark-boot.sh. One cold boot
+# of the app, with the artefacts left in /data/local/tmp/comapeo-bench for the
+# host to pull.
+#
+#   usage: benchmark-sample.sh <package> <activity> <run-id> <duration-seconds>
+#
+# Android's shell is mksh with 32-bit arithmetic, so nanosecond epochs must
+# never be subtracted here — timestamps are recorded as strings and
+# differenced on the host.
+
+PKG="$1"
+ACTIVITY="$2"
+RUN="$3"
+DUR="${4:-20}"
+PROC="$PKG:ComapeoCore"
+DIR=/data/local/tmp/comapeo-bench
+
+mkdir -p "$DIR"
+LOG="$DIR/$RUN.log"
+META="$DIR/$RUN.meta"
+rm -f "$LOG" "$META"
+
+am force-stop "$PKG" >/dev/null 2>&1
+# NODE_COMPILE_CACHE lives under cacheDir. Wipe it so every measured boot
+# starts from the same state regardless of which build ran last. Only works
+# when this shell is root; the host warns when it is not.
+rm -rf "/data/data/$PKG/cache/"* 2>/dev/null
+sleep 3
+
+logcat -c 2>/dev/null
+# Everything the collector parses is a `[comapeo.*]` line. The backend's tag
+# (Comapeo:NodeJS) contains a colon, which a tag:priority filterspec cannot
+# express, so filter on the message instead of capturing the whole device log.
+logcat -v epoch -e '\[comapeo\.' > "$LOG" 2>/dev/null &
+LOGPID=$!
+sleep 1
+
+T0=$(date +%s.%N)
+# Older toybox date leaves %N unexpanded; fall back to whole seconds.
+case "$T0" in
+  *N*) T0=$(date +%s); T0_PRECISION=s ;;
+  *)   T0_PRECISION=ns ;;
+esac
+T0S=$(date +%s)
+am start -n "$PKG/$ACTIVITY" >/dev/null 2>&1
+
+# Wait for the backend process to appear.
+PID=""
+while [ -z "$PID" ]; do
+  PID=$(pidof -s "$PROC" 2>/dev/null)
+  [ $(( $(date +%s) - T0S )) -ge "$DUR" ] && break
+  sleep 0.05
+done
+
+# Let the backend reach its boot memory sample (backend/index.js schedules it
+# 3s after `ready`) before we stop watching.
+while [ $(( $(date +%s) - T0S )) -lt "$DUR" ]; do sleep 1; done
+
+{
+  echo "run=$RUN"
+  echo "t0_epoch=$T0"
+  echo "t0_precision=$T0_PRECISION"
+  echo "fgs_pid=$PID"
+} > "$META"
+
+kill "$LOGPID" 2>/dev/null
+sleep 1
+echo "done $RUN pid=$PID"