diff --git a/README.md b/README.md
index e986228f..1fdcdd4f 100644
--- a/README.md
+++ b/README.md
@@ -614,6 +614,32 @@ dl blooop/devlaunch stop         # Stop workspace
 - **Fast Autocomplete**: Completion cache for ~3ms response time (vs ~700ms without cache)
 - **One Round-Trip Per Question**: every `devpod` call costs ~0.45s, far more than `dl` itself, so a command reads the workspace list at most once — and `dl <ws> -- <cmd>` skips the extra round-trip that names an interactive prompt, since a one-shot command has none
 
+## Measuring launch time
+
+Set `DEVLAUNCH_TIMING=1` and a `dl` command ends with one summary on stderr,
+naming each subprocess round trip and the total. Unset (or `0`) records nothing
+and prints nothing.
+
+```bash
+$ DEVLAUNCH_TIMING=1 dl myws -- true
+dl-timing: devpod status 0.412s
+dl-timing: devpod ssh 0.583s
+dl-timing: devpod ssh 1.102s
+dl-timing: total 2.201s (in-process, excluding interpreter startup)
+```
+
+For before/after numbers, `scripts/bench_launch.py` runs a command N times and
+reports the median — one command per side of a change:
+
+```bash
+python scripts/bench_launch.py -n 5 -- dl-next owner/repo -- true   # warm launch
+```
+
+(`pixi run bench -n 5 -- ...` in the devcontainer.) It reports no median if any
+run fails, so a broken launch cannot pass as a fast one. See `bench_launch.py
+--help` for `--before` — the per-run reset that makes a *cold* median cold —
+and for why its wall clock and `dl-timing: total` are not the same quantity.
+
 ## Worktree Backend
 
 For git repositories, devlaunch uses an efficient worktree backend by default:
diff --git a/devlaunch/dl.py b/devlaunch/dl.py
index 991cd159..a5e5085b 100644
--- a/devlaunch/dl.py
+++ b/devlaunch/dl.py
@@ -36,7 +36,7 @@
 from urllib.parse import urlparse
 from urllib.request import url2pathname
 
-from . import devpod_ssh, disk_usage, gh_auth, tools, tty_session, workspace_state
+from . import devpod_ssh, disk_usage, gh_auth, timing, tools, tty_session, workspace_state
 from .completion import install_completions
 from .workspace_id import TARGET_LENGTH, WorkspaceId, slug, source_workspace_id, validate_ref_name
 from .worktree.config import get_worktree_config
@@ -1394,13 +1394,14 @@ def _git_ls_remote(owner_repo: str, *args: str) -> Optional[str]:
     """
     url = f"git@github.com:{owner_repo}.git"
     try:
-        result = subprocess.run(
-            ["git", "ls-remote", url, *args],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=5,
-        )
+        with timing.span("git ls-remote"):
+            result = subprocess.run(
+                ["git", "ls-remote", url, *args],
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=5,
+            )
         if result.returncode == 0 and result.stdout.strip():
             return result.stdout
     except (OSError, subprocess.SubprocessError, subprocess.TimeoutExpired):
@@ -1533,13 +1534,16 @@ def run_devpod(
     cmd = ["devpod"] + args
     logging.debug("Running: %s", " ".join(cmd))
     try:
-        if capture:
+        # Timed by subcommand, not full argv: the summary should name each
+        # round trip (status, ssh, up...) without leaking workspace ids into it.
+        with timing.span(" ".join(cmd[:2])):
+            if capture:
+                # nosec B603 - using list form, not shell=True; no command injection risk
+                return subprocess.run(
+                    cmd, capture_output=True, text=True, check=False, env=env, stdin=stdin_file
+                )
             # nosec B603 - using list form, not shell=True; no command injection risk
-            return subprocess.run(
-                cmd, capture_output=True, text=True, check=False, env=env, stdin=stdin_file
-            )
-        # nosec B603 - using list form, not shell=True; no command injection risk
-        return subprocess.run(cmd, check=False, env=env, stdin=stdin_file)
+            return subprocess.run(cmd, check=False, env=env, stdin=stdin_file)
     except FileNotFoundError as e:
         raise DevpodNotInstalled(DEVPOD_MISSING_MESSAGE) from e
 
@@ -1557,22 +1561,25 @@ def run_devpod_session(
     """
     cmd = ["devpod"] + args
     logging.debug("Running: %s", " ".join(cmd))
-    # nosec B603 - using list form, not shell=True; no command injection risk
-    with subprocess.Popen(
-        cmd,
-        stderr=subprocess.PIPE,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-        env=env,
-    ) as proc:
-        # proc.stderr is a pipe because PIPE was asked for, but Popen's type
-        # cannot express that, so the narrowing happens here rather than by
-        # widening filter_devpod_stderr to a None it would have no answer for.
-        pipe = proc.stderr
-        remote_status = (
-            devpod_ssh.filter_devpod_stderr(pipe, sys.stderr) if pipe is not None else None
-        )
+    # The span covers the whole session: what the summary names is the round
+    # trip the user waited on, not just the process spawn.
+    with timing.span(" ".join(cmd[:2])):
+        # nosec B603 - using list form, not shell=True; no command injection risk
+        with subprocess.Popen(
+            cmd,
+            stderr=subprocess.PIPE,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            env=env,
+        ) as proc:
+            # proc.stderr is a pipe because PIPE was asked for, but Popen's type
+            # cannot express that, so the narrowing happens here rather than by
+            # widening filter_devpod_stderr to a None it would have no answer for.
+            pipe = proc.stderr
+            remote_status = (
+                devpod_ssh.filter_devpod_stderr(pipe, sys.stderr) if pipe is not None else None
+            )
     return devpod_ssh.interpret(proc.returncode, remote_status)
 
 
@@ -2019,8 +2026,9 @@ def run_ssh(args: List[str], env: Optional[Dict[str, str]] = None) -> subprocess
     """
     logging.debug("Running: %s", " ".join(args))
     try:
-        # nosec B603 B607 - list form, not shell=True; no command injection risk
-        return subprocess.run(list(args), check=False, env=env)
+        with timing.span("ssh"):
+            # nosec B603 B607 - list form, not shell=True; no command injection risk
+            return subprocess.run(list(args), check=False, env=env)
     except FileNotFoundError as e:
         raise SshNotInstalled(SSH_MISSING_MESSAGE) from e
 
@@ -2361,6 +2369,10 @@ def main(argv: Optional[List[str]] = None) -> int:
     # a caller that drives main() twice (a test, a shell wrapper) must not have
     # the first command's view of devpod answer the second command's questions.
     invalidate_workspace_list_cache()
+    # Timing is per-command, like the workspace-list snapshot: begin() here so
+    # a second main() in the same process starts a fresh summary, emit() in the
+    # finally so the summary lands on stderr however the command ended.
+    timing.begin()
     try:
         return _run_cli(argv)
     except MissingBinary as e:
@@ -2369,6 +2381,8 @@ def main(argv: Optional[List[str]] = None) -> int:
     except UnreadableWorkspaceList as e:
         print(f"error: {e}", file=sys.stderr)
         return UNREADABLE_WORKSPACE_LIST_EXIT_CODE
+    finally:
+        timing.emit()
 
 
 def _run_cli(argv: Optional[List[str]] = None) -> int:
diff --git a/devlaunch/gh_auth.py b/devlaunch/gh_auth.py
index 85cd3f27..f234bbf5 100644
--- a/devlaunch/gh_auth.py
+++ b/devlaunch/gh_auth.py
@@ -27,6 +27,7 @@
 import tempfile
 from typing import Dict, Iterator, List, Optional, Tuple
 
+from devlaunch import timing
 from devlaunch.xdg import config_home
 
 # The variable set inside the container. gh consults it before its config file.
@@ -64,17 +65,18 @@ def _token_from_gh_cli() -> Optional[str]:
     if not shutil.which("gh"):
         return None
     try:
-        # nosec B603 B607 - list form, not shell=True; no command injection risk
-        result = subprocess.run(
-            ["gh", "auth", "token"],
-            capture_output=True,
-            text=True,
-            check=False,
-            # gh must not eat stdin that belongs to the command `dl` was asked
-            # to run, and must not leave the terminal in a state of its own.
-            stdin=subprocess.DEVNULL,
-            timeout=_GH_TIMEOUT_SECONDS,
-        )
+        with timing.span("gh auth token"):
+            # nosec B603 B607 - list form, not shell=True; no command injection risk
+            result = subprocess.run(
+                ["gh", "auth", "token"],
+                capture_output=True,
+                text=True,
+                check=False,
+                # gh must not eat stdin that belongs to the command `dl` was asked
+                # to run, and must not leave the terminal in a state of its own.
+                stdin=subprocess.DEVNULL,
+                timeout=_GH_TIMEOUT_SECONDS,
+            )
     except (OSError, subprocess.SubprocessError) as e:
         logging.warning(
             "Could not read a GitHub token from gh (%s), so this workspace opens "
diff --git a/devlaunch/timing.py b/devlaunch/timing.py
new file mode 100644
index 00000000..e40652e5
--- /dev/null
+++ b/devlaunch/timing.py
@@ -0,0 +1,91 @@
+"""Env-gated wall-clock timing for dl's subprocess round trips.
+
+Set ``DEVLAUNCH_TIMING=1`` and every dl process ends with one summary on
+stderr: a ``dl-timing: <label> <seconds>s`` line per recorded subprocess call,
+then a ``total`` for the whole command. Unset (or ``0``) records nothing and
+prints nothing — the hot path must not pay for its own thermometer, so the off
+state is a single ``None`` check. stderr because stdout is parsed by the
+completion machinery, and one summary at the end rather than a line per event,
+so the numbers land after the command's own output, not interleaved with it.
+"""
+
+import contextlib
+import os
+import sys
+import time
+from dataclasses import dataclass, field
+from typing import Iterator, List, Optional, TextIO, Tuple
+
+ENV_VAR = "DEVLAUNCH_TIMING"
+
+# `total` runs from the top of main(), so it is a smaller quantity than the wall
+# time an outside stopwatch (`scripts/bench_launch.py`) reports for the same
+# command: interpreter startup and this package's imports happen before main().
+# The two get quoted side by side, so each line carries its epoch.
+TOTAL_EPOCH = "in-process, excluding interpreter startup"
+
+
+@dataclass
+class _Recorder:
+    """One dl process's records: a start instant and the spans since."""
+
+    started: float
+    entries: List[Tuple[str, float]] = field(default_factory=list)
+
+
+# On/off is this one optional recorder, not a flag plus fields that would have
+# to agree with it: off, there is nothing to hold.
+_recorder: Optional[_Recorder] = None
+
+
+def begin() -> None:
+    """Start recording iff DEVLAUNCH_TIMING asks for it.
+
+    Called once at the top of main(), replacing any recorder left from an
+    earlier main() in the same process, so one command's spans never leak into
+    the next command's summary.
+    """
+    global _recorder  # pylint: disable=global-statement
+    if os.environ.get(ENV_VAR, "").strip() in ("", "0"):
+        _recorder = None
+        return
+    _recorder = _Recorder(started=time.perf_counter())
+
+
+@contextlib.contextmanager
+def _record(recorder: _Recorder, label: str) -> Iterator[None]:
+    """Time the block, recording in ``finally`` and re-raising: a spawn that
+    failed still took time, and dropping it would make the parts add up to
+    less than the total."""
+    start = time.perf_counter()
+    try:
+        yield
+    finally:
+        recorder.entries.append((label, time.perf_counter() - start))
+
+
+def span(label: str):
+    """Time one subprocess round trip as *label*; when timing is off, hand back
+    the stdlib no-op instead — no clock read, nothing recorded."""
+    recorder = _recorder
+    if recorder is None:
+        return contextlib.nullcontext()
+    return _record(recorder, label)
+
+
+def emit(stream: Optional[TextIO] = None) -> None:
+    """Write the summary and stop recording; silent if recording never began.
+
+    *stream* defaults to sys.stderr resolved now, not at import, so capture
+    fixtures and redirections see the output.
+    """
+    global _recorder  # pylint: disable=global-statement
+    recorder = _recorder
+    _recorder = None
+    if recorder is None:
+        return
+    out = stream if stream is not None else sys.stderr
+    total = time.perf_counter() - recorder.started
+    for label, seconds in recorder.entries:
+        print(f"dl-timing: {label} {seconds:.3f}s", file=out)
+    print(f"dl-timing: total {total:.3f}s ({TOTAL_EPOCH})", file=out)
diff --git a/pyproject.toml b/pyproject.toml
index 476981b6..87587564 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -90,6 +90,8 @@ lint = { depends-on = ["ruff-lint", "ty", "pylint"] }
 style = { depends-on = ["format", "lint"] }
 commit-format = "git commit -a -m'autoformat code' || true"
 test = "pytest"
+# Median wall time of a command over N runs; see "Measuring launch time" in README.md.
+bench = "python scripts/bench_launch.py"
 # Needs a real Docker daemon and a real devpod. Inside this repo's devcontainer
 # that daemon is the container's own, via the docker-in-docker feature; on an
 # ephemeral CI runner or a machine you do not mind writing to, it is the host's.
diff --git a/scripts/bench_launch.py b/scripts/bench_launch.py
new file mode 100755
index 00000000..664419fb
--- /dev/null
+++ b/scripts/bench_launch.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Run a command N times and report the median wall time (ticket #140).
+
+The repeatable half of the timing instrument: a before/after perf comparison is
+this script run once on each side of a change. Stdlib only, on purpose — the
+instrument must not cost the project a dependency. See --help for the two
+traps: cold medians, and which clock each number is on.
+"""
+
+import argparse
+import shlex
+import statistics
+import subprocess
+import sys
+import time
+from typing import List, Optional
+
+EPILOG = """\
+warm:  bench_launch.py -n 5 -- dl-next owner/repo -- true
+cold:  XDG_CACHE_HOME=/tmp/dl-bench/cache bench_launch.py -n 5 \\
+         --before 'dl-next owner/repo delete' -- dl-next owner/repo -- true
+
+A cold median needs the reset per *run*: delete once and bench five times and
+runs 2..5 are warm, so the median is a warm number under a cold label. Scope
+XDG_CACHE_HOME (that variable only, see dev.sh) so the reset deletes the
+bench's own workspace, not one you are using. A failed reset stops with no
+median, like a failed run: a run whose starting condition was never
+established is not a measurement of it.
+
+This clock starts outside the process, so it includes interpreter startup and
+imports; dl's own `dl-timing: total` starts inside main() and excludes them
+(on `dl --version`: 0.001s total against a 0.056s median here). Quote one
+instrument on both sides of a change.
+"""
+
+
+def bench(n: int, command: List[str], before: Optional[List[str]] = None) -> int:
+    """Run *command* *n* times, print each wall time and the median.
+
+    Returns 0 after n clean runs, otherwise the exit code of the first run --
+    or untimed *before* reset -- that failed.
+    """
+    durations = []
+    for i in range(1, n + 1):
+        if before is not None:
+            # nosec B603 - list form, not shell=True; the reset is the user's own argv
+            reset = subprocess.run(before, check=False)
+            if reset.returncode != 0:
+                print(
+                    f"reset before run {i}/{n} exited {reset.returncode}; "
+                    "no median over runs whose starting state was not established",
+                    file=sys.stderr,
+                )
+                return reset.returncode
+        start = time.perf_counter()
+        # nosec B603 - list form, not shell=True; the command is the user's own argv
+        result = subprocess.run(command, check=False)
+        elapsed = time.perf_counter() - start
+        if result.returncode != 0:
+            print(
+                f"run {i}/{n} exited {result.returncode}; no median over a failing command",
+                file=sys.stderr,
+            )
+            return result.returncode
+        print(f"run {i}/{n}: {elapsed:.3f}s")
+        durations.append(elapsed)
+    median = statistics.median(durations)
+    print(f"median of {n}: {median:.3f}s (wall clock, including interpreter startup)")
+    return 0
+
+
+def positive_int(text: str) -> int:
+    """A run count there is a median of: one or more."""
+    value = int(text)
+    if value < 1:
+        raise argparse.ArgumentTypeError(f"need at least one run, got {value}")
+    return value
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Run a command N times and report the median wall time.",
+        epilog=EPILOG,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("-n", type=positive_int, default=5, help="number of runs (default: 5)")
+    parser.add_argument(
+        "--before",
+        metavar="RESET",
+        help=(
+            "shell-quoted command to run before each timed run, untimed; "
+            "use it to re-establish a cold launch's starting state every run"
+        ),
+    )
+    parser.add_argument(
+        "command",
+        nargs=argparse.REMAINDER,
+        metavar="-- command...",
+        help="the command to time, after a `--`",
+    )
+    args = parser.parse_args(argv)
+    command = args.command[1:] if args.command[:1] == ["--"] else args.command
+    if not command:
+        parser.error("no command given; usage: bench_launch.py -n 5 -- dl <ws> -- true")
+    before = shlex.split(args.before) if args.before else None
+    if args.before and not before:
+        parser.error("--before given an empty command")
+    return bench(args.n, command, before)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/conftest.py b/test/conftest.py
index 80832625..5494c435 100644
--- a/test/conftest.py
+++ b/test/conftest.py
@@ -20,7 +20,7 @@
 # Import fixtures from the fixtures package to make them available to all tests
 # Note: pytest automatically discovers fixtures in conftest.py
 # noqa: E402 - imports must come after sys.path modification
-from devlaunch import dl, gh_auth  # noqa: E402
+from devlaunch import dl, gh_auth, timing  # noqa: E402
 from fixtures.git_fixtures import (  # noqa: E402
     isolated_devlaunch_env,
     local_git_repo,
@@ -146,6 +146,19 @@ def fresh_clone_manager():
     dl.invalidate_clone_manager()
 
 
+@pytest.fixture(autouse=True)
+def timing_switch_off(monkeypatch):
+    """Start every test with the timing switch off, whatever the shell says.
+
+    DEVLAUNCH_TIMING makes dl append a timing summary to stderr, and a good few
+    tests assert stderr is empty. The developers this instrument exists for are
+    the ones who will have it exported when they run the suite, so the suite
+    scrubs it rather than going red in their shell. A test that wants the switch
+    on sets it itself.
+    """
+    monkeypatch.delenv(timing.ENV_VAR, raising=False)
+
+
 def pytest_configure():
     """Scope this run's devpod state.
 
diff --git a/test/test_timing.py b/test/test_timing.py
new file mode 100644
index 00000000..fb1e61d1
--- /dev/null
+++ b/test/test_timing.py
@@ -0,0 +1,194 @@
+# pylint: disable=redefined-outer-name
+"""Pin the env-gated wall-clock timing summary and its bench harness (#140).
+
+`DEVLAUNCH_TIMING=1` makes every dl process end with one stderr summary naming
+each subprocess round trip and the total wall time; unset, dl must write no
+timing output at all. Pinned at the same boundaries as test_devpod_spawn_counts:
+the CLI entry point on one side, the subprocess module on the other.
+"""
+
+import io
+import re
+import shlex
+import subprocess
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from devlaunch import gh_auth, timing
+from devlaunch.dl import main, remote_branch_exists, run_ssh
+from test_devpod_spawn_counts import DevpodSpawns
+
+# The `total` line carries a trailing note naming which clock it is; the
+# per-round-trip lines do not, so the note is optional here.
+TIMING_LINE = re.compile(r"^dl-timing: (.+?) \d+\.\d{3}s(?: \(.*\))?$", re.MULTILINE)
+
+
+def timing_labels(stderr: str):
+    """The labels of every timing line in *stderr*, in order."""
+    return TIMING_LINE.findall(stderr)
+
+
+class TestSummaryGate:
+    """Timing lines appear iff DEVLAUNCH_TIMING asks for them."""
+
+    @pytest.mark.parametrize("value", [None, "", "0"])
+    def test_no_timing_output_when_the_switch_is_off(self, value, monkeypatch, capsys):
+        """Unset is the default, and the two ways of writing "off" are off too."""
+        if value is None:
+            monkeypatch.delenv("DEVLAUNCH_TIMING", raising=False)
+        else:
+            monkeypatch.setenv("DEVLAUNCH_TIMING", value)
+        assert main(["--version"]) == 0
+        assert "dl-timing:" not in capsys.readouterr().err
+
+    def test_summary_ends_with_total_when_the_switch_is_on(self, monkeypatch, capsys):
+        monkeypatch.setenv("DEVLAUNCH_TIMING", "1")
+        assert main(["--version"]) == 0
+        assert timing_labels(capsys.readouterr().err) == ["total"]
+
+
+@pytest.fixture
+def spawns():
+    """A devpod stub at the subprocess boundary, background updater disabled."""
+    recorder = DevpodSpawns(["myws"])
+    with patch("devlaunch.dl.subprocess.run", side_effect=recorder):
+        with patch("devlaunch.dl.subprocess.Popen", side_effect=recorder.popen):
+            with patch("devlaunch.dl.update_cache_background"):
+                yield recorder
+
+
+@pytest.mark.usefixtures("spawns")
+class TestDevpodRoundTripsAreNamed:
+    """The summary names each devpod round trip, in the order it happened —
+    the chains from the spawn-count tests, seen as named timings."""
+
+    @pytest.mark.parametrize(
+        "argv, labels",
+        [
+            (["--ls"], ["devpod list"]),
+            (["myws"], ["devpod status", "devpod ssh", "devpod ssh"]),
+        ],
+    )
+    def test_the_chain_is_named_in_order(self, argv, labels, monkeypatch, capsys):
+        monkeypatch.setenv("DEVLAUNCH_TIMING", "1")
+        assert main(argv) == 0
+        assert timing_labels(capsys.readouterr().err) == [*labels, "total"]
+
+
+@pytest.fixture
+def recording(monkeypatch):
+    """An active recorder emitted into a buffer: these tests exercise helpers
+    below main(), so the begin/emit main() does is driven here instead."""
+    monkeypatch.setenv("DEVLAUNCH_TIMING", "1")
+    timing.begin()
+    buffer = io.StringIO()
+    yield buffer
+    timing.emit(buffer)
+
+
+class TestTransportAndGitGhCallsAreNamed:
+    """The other launch chokepoints show up in the summary by name."""
+
+    def test_openssh_transport_is_named(self, recording):
+        done = subprocess.CompletedProcess(["ssh", "myws.devpod"], 0)
+        with patch("devlaunch.dl.subprocess.run", return_value=done):
+            run_ssh(["ssh", "myws.devpod"])
+        timing.emit(recording)
+        assert timing_labels(recording.getvalue()) == ["ssh", "total"]
+
+    def test_gh_token_round_trip_is_named(self, recording, monkeypatch):
+        monkeypatch.setenv(gh_auth.DISABLE_VAR, "0")
+        for var in gh_auth.HOST_TOKEN_VARS:
+            monkeypatch.delenv(var, raising=False)
+        gh_auth.resolve_token.cache_clear()
+        answered = subprocess.CompletedProcess(
+            ["gh", "auth", "token"], 0, stdout="gho_" + "a" * 36 + "\n", stderr=""
+        )
+        with patch("devlaunch.gh_auth.shutil.which", return_value="/usr/bin/gh"):
+            with patch("devlaunch.gh_auth.subprocess.run", return_value=answered):
+                assert gh_auth.resolve_token() is not None
+        gh_auth.resolve_token.cache_clear()
+        timing.emit(recording)
+        assert timing_labels(recording.getvalue()) == ["gh auth token", "total"]
+
+    def test_remote_branch_probe_is_named(self, recording):
+        answered = subprocess.CompletedProcess(
+            ["git", "ls-remote"], 0, stdout="deadbeef\trefs/heads/main\n", stderr=""
+        )
+        with patch("devlaunch.dl.subprocess.run", return_value=answered):
+            assert remote_branch_exists("owner/repo", "main")
+        timing.emit(recording)
+        assert timing_labels(recording.getvalue()) == ["git ls-remote", "total"]
+
+    def test_a_failed_round_trip_is_recorded_and_still_raises(self, recording):
+        """A spawn that raised still took time, and the span must not eat the
+        exception on its way out."""
+        with pytest.raises(RuntimeError):
+            with timing.span("devpod up"):
+                raise RuntimeError("spawn blew up")
+        timing.emit(recording)
+        assert timing_labels(recording.getvalue()) == ["devpod up", "total"]
+
+
+BENCH = Path(__file__).parent.parent / "scripts" / "bench_launch.py"
+FAILING = shlex.join([sys.executable, "-c", "raise SystemExit(3)"])
+
+
+def run_bench(*argv: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [sys.executable, str(BENCH), *argv], capture_output=True, text=True, check=False
+    )
+
+
+class TestBenchHarness:
+    """#140's "Done when": *a contributor can produce a median warm-launch and
+    cold-launch wall time with one documented command*."""
+
+    def test_reports_each_run_and_the_median(self):
+        result = run_bench("-n", "3", "--", sys.executable, "-c", "pass")
+        assert result.returncode == 0
+        assert len(re.findall(r"^run \d+/3: \d+\.\d{3}s$", result.stdout, re.M)) == 3
+        assert re.search(r"^median of 3: \d+\.\d{3}s", result.stdout, re.M)
+
+    @pytest.mark.parametrize(
+        "argv",
+        [
+            pytest.param(["-n", "3", "--", sys.executable, "-c", "raise SystemExit(7)"], id="run"),
+            pytest.param(
+                ["-n", "3", "--before", FAILING, "--", sys.executable, "-c", "pass"], id="reset"
+            ),
+        ],
+    )
+    def test_no_median_over_a_failed_run_or_a_failed_reset(self, argv):
+        """Neither a failing launch nor a run whose cold state was never
+        established is a number to compare against."""
+        result = run_bench(*argv)
+        assert result.returncode != 0
+        assert "median" not in result.stdout
+
+    def test_rejects_a_run_count_below_one(self):
+        """There is no median of nothing, so it refuses rather than dying
+        inside statistics."""
+        result = run_bench("-n", "0", "--", sys.executable, "-c", "pass")
+        assert result.returncode == 2
+        assert "Traceback" not in result.stderr
+
+    def test_the_reset_runs_before_every_timed_run_and_is_not_timed(self, tmp_path):
+        """Delete once and bench N times and runs 2..N are warm, so `--before`
+        resets per run — and the teardown's time is not the launch's."""
+        marker = tmp_path / "resets"
+        reset = shlex.join(
+            [
+                sys.executable,
+                "-c",
+                f"import time; time.sleep(0.2); open({str(marker)!r}, 'a').write('x')",
+            ]
+        )
+        result = run_bench("-n", "2", "--before", reset, "--", sys.executable, "-c", "pass")
+        assert result.returncode == 0, result.stderr
+        assert marker.read_text() == "xx"
+        runs = re.findall(r"^run \d+/2: (\d+\.\d{3})s$", result.stdout, re.M)
+        assert runs and all(float(seconds) < 0.15 for seconds in runs), result.stdout