perf,feat: v0.10.6 JSON.stringify fast-path, HTTP dispatch, source maps, fs/readline

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.10.5"
+version = "0.10.6"
 edition = "2021"
 authors = ["Slice Runtime Team"]
 license = "MIT OR Apache-2.0"

README.md

@@ -12,45 +12,45 @@
 ## Verified Benchmark Overview (Linux `x86_64` Docker & Windows `x86_64`)
 
 <!-- BENCHMARK_SUMMARY_START -->
-> **Latest Verified Benchmark Report:** **[`tests/reports/latest.md`](./tests/reports/latest.md)** (Archive: [`bench_v0.10.5_20261109_202907Z_a0c723e.md`](./tests/reports/bench_v0.10.5_20261109_202907Z_a0c723e.md))  
-> **Provenance:** Slice `v0.10.5` (`a0c723e`) · Generated `2026-11-09T20:29:07Z` · Environment: `Linux x86_64 Docker (io_uring SQPOLL + WRPKRU)`  
+> **Latest Verified Benchmark Report:** **[`tests/reports/latest.md`](./tests/reports/latest.md)** (Archive: [`bench_v0.10.5_20261109_225249Z_47bfa6b.md`](./tests/reports/bench_v0.10.5_20261109_225249Z_47bfa6b.md))  
+> **Provenance:** Slice `v0.10.6` (`47bfa6b`) · Generated `2026-11-09T22:52:49Z` · Environment: `Linux x86_64 Docker (io_uring SQPOLL + WRPKRU)`  
 > **Scorecard Across All 33 Production Workloads:** Beats **Deno (`v2.9.8`)** on **33/33**, **Node.js (`v27.0.0-alpha.0.0.0`)** on **33/33**, **Bun (`v1.4.4`)** on **30/33** cold one-shot, and **all 3 runtimes on 33/33 workloads in `--warm` pooled execution**.
 
 #### 1. Core Architecture, HTTP Throughput & 1,000-Tenant MicroVM Density
 
-| Metric | Slice (`v0.10.5` `SLICEBC\x01`) | Bun (`v1.4.4`) | Deno (`v2.9.8`) | Node.js (`v27.0.0-alpha.0.0.0`) | Slice Advantage |
+| Metric | Slice (`v0.10.6` `SLICEBC\x01`) | Bun (`v1.4.4`) | Deno (`v2.9.8`) | Node.js (`v27.0.0-alpha.0.0.0`) | Slice Advantage |
 | :--- | :---: | :---: | :---: | :---: | :--- |
-| **In-Process Isolate Cold Start (`P50` / `P99`)** | **`1.24 us` / `1.61 us`** | N/A (Process/VM) | N/A (Process/VM) | N/A (Process/VM) | **~120,000x faster than 125ms Firecracker VM** |
-| **1,000-Tenant MicroVM Swarm (Boot + Exec)** | **`1.51 ms` (`10.07 MB` RSS)** | > 5,000 ms | > 15,000 ms | > 30,000 ms | **> 3,900x faster / ~32,000x denser** |
+| **In-Process Isolate Cold Start (`P50` / `P99`)** | **`1.05 us` / `1.80 us`** | N/A (Process/VM) | N/A (Process/VM) | N/A (Process/VM) | **~120,000x faster than 125ms Firecracker VM** |
+| **1,000-Tenant MicroVM Swarm (Boot + Exec)** | **`1.37 ms` (`9.70 MB` RSS)** | > 5,000 ms | > 15,000 ms | > 30,000 ms | **> 3,900x faster / ~32,000x denser** |
 | **500-Module Monorepo Cold Boot (`stat()` Calls)** | **`3.41 ms` (`0 stat()`)** | `12.72 ms` (`500+ stat`) | `41.80 ms` (`500+ stat`) | `70.38 ms` (`1,500+ stat`) | **`3.7x` faster than Bun / `20.6x` Node.js** |
-| **HTTP/1.1 Keep-Alive Throughput (`16k` Reqs)** | **`148,407 req/s`** (Tier-0)<br>**`145,839 req/s`** (Tier-1) | `97,987 req/s` | `100,099 req/s` | `55,977 req/s` | **`1.51x` (`Tier-0`) / `1.49x` (`Tier-1`) vs `Bun.serve`** |
-| **Peak Process Memory (`Max RSS` Across Suite)** | **`13.38 – 21.50 MB`** | `27.25 – 41.00 MB` | `45.47 – 61.39 MB` | `69.90 – 92.50 MB` | **`2.0x–2.3x` less than Bun / `4.3x–6.8x` less than Node** |
+| **HTTP/1.1 Keep-Alive Throughput (`16k` Reqs)** | **`137,020 req/s`** (Tier-0)<br>**`125,831 req/s`** (Tier-1) | `72,924 req/s` | `87,455 req/s` | `45,868 req/s` | **`1.88x` (`Tier-0`) / `1.73x` (`Tier-1`) vs `Bun.serve`** |
+| **Peak Process Memory (`Max RSS` Across Suite)** | **`13.25 – 21.75 MB`** | `25.88 – 40.83 MB` | `45.47 – 62.24 MB` | `70.03 – 92.88 MB` | **`2.0x–2.3x` less than Bun / `4.3x–6.8x` less than Node** |
 | **Multi-Tenant Security Containment** | **`5 / 5 PASS`** (OCap+SES+Fuel+DLP) | `0 / 5` (Ambient) | `2 / 5` (Coarse CLI) | `0 / 5` (Ambient) | **Hardware & Language Zero-Trust Isolation** |
 
 #### 2. Real-Life Workload Summary by Domain (All 33 Workloads Aggregated)
 
 | Workload Domain & Stack Coverage | Suites | Slice Cold `.cas` Avg (Range) | Slice Warm (`--warm`) Avg | Bun `v1.4.4` Avg | Deno `v2.9.8` Avg | Node.js `v27.0.0-alpha.0.0.0` Avg | Category Speedup vs Bun / Node.js |
 | :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |
-| **Core Edge, Auth & Crypto (`Apps 01, 04, 05, 16`)**<br><sub>Multi-file TS, SHA-256/HMAC, JWT/OAuth2, `.env` Auto-DLP</sub> | `4` | **`8.11 ms`** (`6.21–10.65 ms`) | **`2.68 ms`** | `15.18 ms` | `44.73 ms` | `64.32 ms` | **`1.87x Bun` (`5.66x` Warm) / `7.93x Node`** |
-| **NPM Ecosystem, AST & Disk I/O (`Apps 02, 03, 06, 07, 08, 20`)**<br><sub>`semver`, `flatted`, `dlv`/`dset`, `mitt`, 10-Shard JSONL I/O, `Buffer`</sub> | `6` | **`11.85 ms`** (`8.04–14.66 ms`) | **`3.87 ms`** | `17.63 ms` | `51.32 ms` | `67.38 ms` | **`1.49x Bun` (`4.55x` Warm) / `5.69x Node`** |
-| **WinterTC Web Standards, Fetch Mesh & DLP (`Apps 09–14, 17–19`)**<br><sub>`Request`/`Response`, Static CDN `304`, SSE, Live `fetch`, WebCrypto</sub> | `9` | **`15.73 ms`** (`8.35–30.83 ms`) | **`8.25 ms`** | `19.22 ms` | `55.05 ms` | `97.59 ms` | **`1.22x Bun` (`2.33x` Warm) / `6.20x Node`** |
-| **Realtime WebSockets, Workers & Wasm/TSX (`Apps 15, 21–24`)**<br><sub>RFC 6455 WS, `worker_threads` + TCP/UDP, Pure-Rust `wasmi` Wasm, TSX SSR</sub> | `5` | **`14.43 ms`** (`8.93–21.16 ms`) | **`2.79 ms`** | `28.88 ms` | `64.18 ms` | `87.52 ms` | **`2.00x Bun` (`10.35x` Warm) / `6.07x Node`** |
-| **Full-Stack Edge & Node Frameworks (`FW 01–04`)**<br><sub>`Hono v4.6.20`, `itty-router + UnJS Nitro`, `Express/Polka node:http`, `SvelteKit 3.1.1 + Svelte 5.57.3`</sub> | `4` | **`21.84 ms`** (`15.86–36.16 ms`) | **`8.39 ms`** | `33.81 ms` | `60.33 ms` | `101.48 ms` | **`1.55x Bun` (`4.03x` Warm) / `4.65x Node`** |
-| **AI Agent, Multi-Tenant SaaS & Chaos Case Studies (`CS 01–05`)**<br><sub>Depth-4 ToT Agent, MCP Code Mode, 12-Tenant Mesh, Wasm CDR, 48 Payment Sagas</sub> | `5` | **`19.29 ms`** (`13.98–26.48 ms`) | **`7.87 ms`** | `20.04 ms` | `54.98 ms` | `78.81 ms` | **`1.04x Bun` (`2.55x` Warm) / `4.08x Node`** |
+| **Core Edge, Auth & Crypto (`Apps 01, 04, 05, 16`)**<br><sub>Multi-file TS, SHA-256/HMAC, JWT/OAuth2, `.env` Auto-DLP</sub> | `4` | **`8.47 ms`** (`6.55–11.14 ms`) | **`3.30 ms`** | `15.91 ms` | `49.42 ms` | `74.55 ms` | **`1.88x Bun` (`4.82x` Warm) / `8.80x Node`** |
+| **NPM Ecosystem, AST & Disk I/O (`Apps 02, 03, 06, 07, 08, 20`)**<br><sub>`semver`, `flatted`, `dlv`/`dset`, `mitt`, 10-Shard JSONL I/O, `Buffer`</sub> | `6` | **`12.62 ms`** (`7.94–16.55 ms`) | **`3.89 ms`** | `20.07 ms` | `55.22 ms` | `75.47 ms` | **`1.59x Bun` (`5.16x` Warm) / `5.98x Node`** |
+| **WinterTC Web Standards, Fetch Mesh & DLP (`Apps 09–14, 17–19`)**<br><sub>`Request`/`Response`, Static CDN `304`, SSE, Live `fetch`, WebCrypto</sub> | `9` | **`16.64 ms`** (`9.45–30.99 ms`) | **`8.73 ms`** | `21.55 ms` | `61.92 ms` | `110.65 ms` | **`1.29x Bun` (`2.47x` Warm) / `6.65x Node`** |
+| **Realtime WebSockets, Workers & Wasm/TSX (`Apps 15, 21–24`)**<br><sub>RFC 6455 WS, `worker_threads` + TCP/UDP, Pure-Rust `wasmi` Wasm, TSX SSR</sub> | `5` | **`15.94 ms`** (`9.44–23.82 ms`) | **`3.00 ms`** | `33.42 ms` | `74.66 ms` | `100.88 ms` | **`2.10x Bun` (`11.14x` Warm) / `6.33x Node`** |
+| **Full-Stack Edge & Node Frameworks (`FW 01–04`)**<br><sub>`Hono v4.6.20`, `itty-router + UnJS Nitro`, `Express/Polka node:http`, `SvelteKit 3.1.1 + Svelte 5.57.3`</sub> | `4` | **`23.77 ms`** (`16.90–39.32 ms`) | **`9.79 ms`** | `34.46 ms` | `64.80 ms` | `111.20 ms` | **`1.45x Bun` (`3.52x` Warm) / `4.68x Node`** |
+| **AI Agent, Multi-Tenant SaaS & Chaos Case Studies (`CS 01–05`)**<br><sub>Depth-4 ToT Agent, MCP Code Mode, 12-Tenant Mesh, Wasm CDR, 48 Payment Sagas</sub> | `5` | **`21.56 ms`** (`15.33–31.11 ms`) | **`7.29 ms`** | `23.51 ms` | `63.56 ms` | `91.60 ms` | **`1.09x Bun` (`3.22x` Warm) / `4.25x Node`** |
 
 #### 3. Flagship Real-World Representative Workloads (9 of 33 Highlights)
 
 | # | Flagship Workload | Slice Cold `.cas` | Slice Warm (`--warm`) | Bun `v1.4.4` | Deno `v2.9.8` | Node.js `v27.0.0-alpha.0.0.0` | Speedup vs Bun / Node.js |
 | :- | :--- | :---: | :---: | :---: | :---: | :---: | :--- |
-| **01** | `01-fintech-checkout` (Multi-File TS + SHA-256) | **`6.21 ms`** | **`1.17 ms`** | `14.40 ms` | `38.72 ms` | `59.17 ms` | **`2.32x Bun` (`12.33x` Warm) / `9.53x Node`** |
-| **03** | `03-disk-io-log-pipeline` (10 JSONL Shards Disk I/O) | **`8.04 ms`** | **`2.17 ms`** | `14.43 ms` | `45.77 ms` | `63.28 ms` | **`1.80x Bun` (`6.63x` Warm) / `7.87x Node`** |
-| **14** | `14-federated-api-mesh-dlp` (`bytes` + `dlv` + `dset` + Live `fetch`) | **`15.52 ms`** | **`7.87 ms`** | `22.38 ms` | `56.66 ms` | `112.02 ms` | **`1.44x Bun` (`2.84x` Warm) / `7.22x Node`** |
-| **20** | `20-node-compat-and-edge-router` (`Uint8Array` `Buffer`/Node Core/AST Bundler) | **`11.50 ms`** | **`0.55 ms`** | `22.56 ms` | `55.77 ms` | `71.86 ms` | **`1.96x Bun` (`41.39x` Warm) / `6.25x Node`** |
-| **22** | `22-worker-threads-and-raw-sockets` (3 Worker Threads + TCP/UDP + 5-Ring Sec) | **`21.52 ms`** | **`2.22 ms`** | `57.85 ms` | `113.39 ms` | `103.24 ms` | **`2.73x Bun` (`26.09x` Warm) / `4.88x Node`** |
-| **FW-01** | `FW-01: frameworks/01-hono-edge-microservice` (`hono@4.6.20` + `hono/cookie` + `ms`) | **`16.07 ms`** | **`5.72 ms`** | `19.91 ms` | `53.97 ms` | `99.71 ms` | **`1.26x Bun` (`3.48x` Warm) / `6.29x Node`** |
-| **FW-04** | `FW-04: frameworks/04-sveltekit-edge-ssr` (`@sveltejs/kit@3.1.1` + `svelte@5.57.3` + `devalue@6.0.3`) | **`36.16 ms`** | **`17.02 ms`** | `46.58 ms` | `71.05 ms` | `119.71 ms` | **`1.29x Bun` (`2.74x` Warm) / `3.31x Node`** |
-| **CS-01** | `CS-01: case_studies/01-tot-autonomous-sre-agent` (20 ToT Sandboxes) | **`26.48 ms`** | **`13.12 ms`** | `28.26 ms` | `72.65 ms` | `89.71 ms` | **`1.07x Bun` (`2.15x` Warm) / `3.39x Node`** |
-| **CS-05** | `CS-05: case_studies/05-time-travel-chaos-fuzzer-payments` (48 Payment Sagas) | **`18.13 ms`** | **`10.31 ms`** | `19.62 ms` | `62.94 ms` | `83.70 ms` | **`1.08x Bun` (`1.90x` Warm) / `4.62x Node`** |
+| **01** | `01-fintech-checkout` (Multi-File TS + SHA-256) | **`6.55 ms`** | **`1.93 ms`** | `15.17 ms` | `42.61 ms` | `74.22 ms` | **`2.32x Bun` (`7.84x` Warm) / `11.33x Node`** |
+| **03** | `03-disk-io-log-pipeline` (10 JSONL Shards Disk I/O) | **`7.94 ms`** | **`1.61 ms`** | `17.73 ms` | `50.10 ms` | `70.81 ms` | **`2.23x Bun` (`11.00x` Warm) / `8.92x Node`** |
+| **14** | `14-federated-api-mesh-dlp` (`bytes` + `dlv` + `dset` + Live `fetch`) | **`15.93 ms`** | **`7.80 ms`** | `24.46 ms` | `61.59 ms` | `122.58 ms` | **`1.54x Bun` (`3.14x` Warm) / `7.70x Node`** |
+| **20** | `20-node-compat-and-edge-router` (`Uint8Array` `Buffer`/Node Core/AST Bundler) | **`12.30 ms`** | **`0.89 ms`** | `25.97 ms` | `64.07 ms` | `88.27 ms` | **`2.11x Bun` (`29.24x` Warm) / `7.17x Node`** |
+| **22** | `22-worker-threads-and-raw-sockets` (3 Worker Threads + TCP/UDP + 5-Ring Sec) | **`24.54 ms`** | **`2.38 ms`** | `68.04 ms` | `134.58 ms` | `116.66 ms` | **`2.86x Bun` (`28.63x` Warm) / `4.90x Node`** |
+| **FW-01** | `FW-01: frameworks/01-hono-edge-microservice` (`hono@4.6.20` + `hono/cookie` + `ms`) | **`16.90 ms`** | **`7.54 ms`** | `22.25 ms` | `61.18 ms` | `110.86 ms` | **`1.32x Bun` (`2.95x` Warm) / `6.56x Node`** |
+| **FW-04** | `FW-04: frameworks/04-sveltekit-edge-ssr` (`@sveltejs/kit@3.1.1` + `svelte@5.57.3` + `devalue@6.0.3`) | **`39.32 ms`** | **`19.71 ms`** | `52.50 ms` | `84.30 ms` | `133.01 ms` | **`1.34x Bun` (`2.66x` Warm) / `3.38x Node`** |
+| **CS-01** | `CS-01: case_studies/01-tot-autonomous-sre-agent` (20 ToT Sandboxes) | **`31.11 ms`** | **`13.13 ms`** | `32.78 ms` | `86.41 ms` | `105.35 ms` | **`1.05x Bun` (`2.50x` Warm) / `3.39x Node`** |
+| **CS-05** | `CS-05: case_studies/05-time-travel-chaos-fuzzer-payments` (48 Payment Sagas) | **`20.77 ms`** | **`9.38 ms`** | `23.26 ms` | `71.21 ms` | `96.48 ms` | **`1.12x Bun` (`2.48x` Warm) / `4.65x Node`** |
 
 *Full 33-workload latency breakdown, standalone binary metrics, peak RSS per app, and historical reports: **[`tests/reports/latest.md`](./tests/reports/latest.md)**.*
 <!-- BENCHMARK_SUMMARY_END -->

crates/slice-cas/src/archive/builder.rs

@@ -14,13 +14,85 @@ use std::path::{Path, PathBuf};
 pub struct CasBuilder {
     entrypoint: String,
     modules: Vec<(String, PathBuf, String, Vec<u8>)>, // (specifier, path, stripped_source, precompiled_bytecode)
+    lockfile_blake3: Option<String>,
+    resolved_dependencies: Vec<(String, String)>,
 }
 
 impl CasBuilder {
     pub fn new(entrypoint: impl Into<String>) -> Self {
         Self {
             entrypoint: entrypoint.into(),
             modules: Vec::new(),
+            lockfile_blake3: None,
+            resolved_dependencies: Vec::new(),
+        }
+    }
+
+    /// Scans `project_path` (or its ancestor directories) for `package.json` and lockfiles
+    /// (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, `bun.lockb`), recording
+    /// deterministic lockfile BLAKE3 provenance and resolved `node_modules/<pkg>/package.json` versions.
+    pub fn scan_project_dependencies(&mut self, project_path: &Path) {
+        let start_dir = if project_path.is_dir() {
+            project_path
+        } else {
+            project_path.parent().unwrap_or(project_path)
+        };
+        let mut cur = Some(start_dir);
+        while let Some(dir) = cur {
+            let pkg_json = dir.join("package.json");
+            if pkg_json.is_file() {
+                for lock_name in [
+                    "package-lock.json",
+                    "pnpm-lock.yaml",
+                    "yarn.lock",
+                    "bun.lock",
+                    "bun.lockb",
+                ] {
+                    let lock_path = dir.join(lock_name);
+                    if lock_path.is_file() {
+                        if let Ok(bytes) = std::fs::read(&lock_path) {
+                            self.lockfile_blake3 =
+                                Some(blake3::hash(&bytes).to_hex().to_string());
+                            break;
+                        }
+                    }
+                }
+                if let Ok(raw) = std::fs::read_to_string(&pkg_json) {
+                    if let Ok(val) = serde_json::from_str::<serde_json::Value>(&raw) {
+                        let mut deps = Vec::new();
+                        for section in ["dependencies", "devDependencies"] {
+                            if let Some(obj) = val.get(section).and_then(|v| v.as_object()) {
+                                for (name, spec_val) in obj {
+                                    let declared =
+                                        spec_val.as_str().unwrap_or("*").to_string();
+                                    let resolved_pkg = dir
+                                        .join("node_modules")
+                                        .join(name)
+                                        .join("package.json");
+                                    let version = std::fs::read_to_string(&resolved_pkg)
+                                        .ok()
+                                        .and_then(|s| {
+                                            serde_json::from_str::<serde_json::Value>(&s).ok()
+                                        })
+                                        .and_then(|v| {
+                                            v.get("version")
+                                                .and_then(|ver| ver.as_str())
+                                                .map(|s| s.to_string())
+                                        })
+                                        .unwrap_or(declared);
+                                    if !deps.iter().any(|(n, _)| n == name) {
+                                        deps.push((name.clone(), version));
+                                    }
+                                }
+                            }
+                        }
+                        deps.sort_by(|a, b| a.0.cmp(&b.0));
+                        self.resolved_dependencies = deps;
+                    }
+                }
+                break;
+            }
+            cur = dir.parent();
         }
     }
 
@@ -49,6 +121,7 @@ impl CasBuilder {
         root_dir: &Path,
         bytecode_compiler_fn: &dyn Fn(&str) -> Vec<u8>,
     ) -> Result<usize> {
+        self.scan_project_dependencies(root_dir);
         let mut count = 0;
         let mut stack = vec![root_dir.to_path_buf()];
 
@@ -318,6 +391,8 @@ impl CasBuilder {
             radix_resolution_map: radix_map,
             blobs,
             source_map_markers,
+            lockfile_blake3: self.lockfile_blake3.clone(),
+            resolved_dependencies: self.resolved_dependencies.clone(),
         };
 
         let header_bytes = serde_json::to_vec(&header)?;

crates/slice-cas/src/archive/mod.rs

@@ -51,4 +51,10 @@ pub struct CasIndexHeader {
     /// Compact source-line table (`(compacted_line_1, "#slice-source payload")`) for `.cas` and `SLICEEXE` stack traces
     #[serde(default)]
     pub source_map_markers: Vec<(usize, String)>,
+    /// Optional BLAKE3 hash of the project's lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`)
+    #[serde(default)]
+    pub lockfile_blake3: Option<String>,
+    /// Resolved `(package_name, resolved_version)` pairs recorded from `package.json` and `node_modules/`
+    #[serde(default)]
+    pub resolved_dependencies: Vec<(String, String)>,
 }

crates/slice-cas/src/archive/reader.rs

@@ -212,7 +212,7 @@ impl MappedCasArchive {
     pub fn reconstruct_annotated_source(&self, entry: &CasBlobEntry) -> String {
         let src = self.get_source_slice(entry);
         let markers = &self.header.source_map_markers;
-        if markers.is_empty() || src.contains("// #slice-source: ") {
+        if markers.is_empty() || src.contains("// #slice-source: ") || src.contains("//@sm:") {
             return src.to_string();
         }
         let mut out = String::with_capacity(src.len() + markers.len() * 64);