perf T4-W1: usage-error paths on authed commands pay a full session bootstrap first — `libby archive` with no --all/--title measured 2596 ms vs 26 ms for help

[JavaGT]

Measured (median of 9 spawns, this machine, 2026-09-11, valid cached session present)

invocation	median
libby help	26.1 ms
libby where	25.7 ms
libby archive (no --all/--title)	2596 ms — exits 2 with "Specify what to archive" only AFTER a full session bootstrap

libby borrow/return/hold/unhold with a missing id sit on the same path.

Root cause

• bin/libby.mjs:341-343 runs buildConfig + authenticate for every authed command before the archive branch rejects a missing target (bin/libby.mjs:447-455) and before borrow/return/hold/unhold validate their title id (bin/libby.mjs:351-356).
• Cached-session authenticate performs a network round trip: verify() = GET /chip/sync (src/auth.mjs:60, src/auth.mjs:150-157) — that round trip is the whole ~2.5 s.
• The unknown-command gate (bin/libby.mjs:243-244: "a typo must never mint chips or authenticate") already establishes the principle — arg validation belongs behind the same line.

Fix shape (smallest)

Hoist cheap arg validation above buildConfig/authenticate:

• archive: require --title <id> or --all (else usage + exit 2)
• borrow/return/hold/unhold: require <id> (else usage + exit 2)

Valid invocations behave identically — they still authenticate and sync.

Acceptance

1. BEFORE/AFTER spawn table (median of 9, interleaved with libby help): libby archive (no flags) and libby borrow (no id) within noise of libby help; zero network on the error path.
2. Hermetic spawn pins in test/cli-lazy.test.mjs proving the error path exits 2 with the usage message before any session/auth work (the pin must fail if validation is reordered back behind authenticate).
3. node --test test/cli-lazy.test.mjs green; full node --test green.
4. No changes outside bin/libby.mjs + test/cli-lazy.test.mjs (+ docs only if a usage pin text is documented there).

Related: #11 (init --help runs the wizard), #12 (evaluate skipping the cached-session verify round trip — the 2.5 s every authed invocation pays even when it does proceed).

[JavaGT]

Claimed — implementing now, will land on main with evidence.

[JavaGT]

Fixed on main: 8558af7 (report a433f86, perf/lanes/T4-W1-report.md).

Validation hoisted above buildConfig/authenticate in bin/libby.mjs main(): archive without --all/--title and borrow/return/hold/unhold without an id now exit 2 with the byte-identical usage messages before any config/auth work; in-branch checks kept as defense in depth. Valid invocations unchanged.

Measured (median of 9, interleaved base-vs-after, Apple M4 / Node 26.7.0): libby archive (no flags) 2785.3 ms → 28.9 ms; libby help reference 50.4/25.2 ms. Error path does zero network.

Pins in test/cli-lazy.test.mjs (hermetic): no-target archive/borrow with config flags + nonexistent --session → exit 2 + usage, session file never created. Pins FAIL on base 23bd9b7 and pass after. Focused 6 pass / 0 fail; full suite 89 pass / 0 fail.

[JavaGT]

review round 1 addressed: c174a38

[JavaGT]

review round 2 addressed: 2ab7719

[JavaGT]

Landed + hostile-review APPROVED (round 3). Commits: 8558af7 (validation hoist), c174a38 + 2ab7719 (review-round test hardening), a433f86 (report: perf/lanes/T4-W1-report.md).

Measured (spawnSync median of 9, interleaved vs base 23bd9b7, real cached session): libby archive no-flags 2596 ms → 24.9-28.9 ms (at the libby help floor); libby borrow no-id 24.6 ms. Error paths exit 2 with zero network; valid invocations byte-for-byte unchanged. src/ untouched — dispatch-order only.

Tests: pins cover archive + all of borrow/return/hold/unhold, network-denial preload (test/helpers/deny-net.mjs) makes any ordering regression fail deterministically in ~45 ms with zero network (regression experiment performed and reverted). Focused 6/0; full suite 91/0. Review trail: round 1 MINOR (coverage + hermeticity) → c174a38; round 2 MINOR (deny-set honesty) → 2ab7719; round 3 APPROVED (GPT 5.6 Luna via opencode2).