Upgrade Bun to 1.4 and measure test plus backend wins

[HMarzban]

Goal

Raise the monorepo Bun floor from 1.3.7 to 1.4.0. Measure what 1.4 changes on this repo. Then keep only the test and runtime APIs that win on our machines.

Facts (2026-08-21)

• Latest stable is Bun 1.4.0, published 20 August 2026. No 1.4.x patch yet. Release · Blog
• Root engines.bun is >=1.3.7. README and docs/self-hosting/README.md say the same.
• CI setup-bun defaults to latest. Docker uses oven/bun:1-slim. Those may already pull 1.4 once Oven publishes the tag.
• bun-types is still ^1.3.13 / ^1.3.14.
• bun test runs on hocuspocus, email-templates, floating-popover, and hyperlink units. Jest and Cypress stay on Node or the browser.
• Official Bun 1.4 claims (quote only; not our numbers): idle CPU down 5×; memory down up to 35%; Linux start 50% faster; Bun.serve peak 45 MB → 36 MB (−20%). Source: bun.com/blog/bun-v1.4
• --parallel, --isolate, --shard, and --changed landed in 1.3.13. 1.4 adds --timings and isolate bug fixes. Test parallel docs
• Keep the metascraper 5.50.6 pin until bun -e "await import('metascraper')" succeeds on 1.4.0. The 1.4 post does not claim a require(esm) fix for mime@4.
• Do not export default a Hono app. Bun still auto-serves that on :3000.
• Do not treat 1.4 as unlocking @hocuspocus v4. The v4 Node crossws adapter still throws when "Bun" in globalThis.
• Do not replace Prisma, BullMQ, or ioredis with Bun.SQL, Bun.cron, or Bun.redis on this ticket.

What to build

A measured upgrade. Not a rewrite.

1. Soak 1.4.0 locally and in CI. Confirm Docker 1-slim is 1.4.
2. Smoke: REST, WS, and worker start; import('metascraper'); Prisma engines (NODE_MODULE_VERSION 147); Redis TLS names; pad persist (document:saved).
3. Raise engines.bun, bun-types, README, self-hosting, and AGENTS.md floors in the same change.
4. On the bun test suites only: try --isolate, then --parallel, then --timings plus --shard if CI time drops.
5. Profile hocuspocus with --cpu-prof-md / --heap-prof-md only if RSS or idle CPU improves versus 1.3.14. Consider process.on("memoryPressure") only after that profile.
6. Re-check idleTimeout default and the ws maxPayload ignore. Keep explicit idleTimeout: 60 unless 1.4 changes the hazard.

Out of scope

• Moving Jest or Cypress onto bun test.
• Experimental HTTP/3 on Bun.serve.
• Isolated linker or lockfileVersion: 2 unless bun install forces it. Existing bun.lock stays hoisted.
• @hocuspocus v4.

Acceptance criteria

• Local bun --version is 1.4.0 or newer. make dest-local starts REST on :4000 with no second listener on :3000.
• cd apps/hocuspocus.server && bun -e "await import('metascraper')" is recorded. Keep or drop the 5.50.6 overrides from that result, not from the blog.
• Prisma and Redis still work. Note any ERR_TLS_CERT_ALTNAME_INVALID and the fix (servername).
• Root engines.bun, catalog bun-types, README, docs/self-hosting/README.md, and AGENTS.md name the new floor.
• hocuspocus bun test is green on 1.4. The PR records whether --parallel, --isolate, or --timings stayed.
• One before/after note for REST idle RSS or a bun test wall-clock. Official Bun numbers are not a substitute.

Blocked by

None. Can wait for the product v2.0.0 tag if the maintainer wants that first. Does not depend on the Next 16 ticket.