fix(engine): resolve evalSandbox memory/error, loop fuel, and DLP variant (v0.10.7)

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.10.6"
+version = "0.10.7"
 edition = "2021"
 authors = ["Slice Runtime Team"]
 license = "MIT OR Apache-2.0"

README.md

@@ -12,45 +12,45 @@
 ## Verified Benchmark Overview (Linux `x86_64` Docker & Windows `x86_64`)
 
 <!-- BENCHMARK_SUMMARY_START -->
-> **Latest Verified Benchmark Report:** **[`tests/reports/latest.md`](./tests/reports/latest.md)** (Archive: [`bench_v0.10.5_20261109_225249Z_47bfa6b.md`](./tests/reports/bench_v0.10.5_20261109_225249Z_47bfa6b.md))  
-> **Provenance:** Slice `v0.10.6` (`47bfa6b`) · Generated `2026-11-09T22:52:49Z` · Environment: `Linux x86_64 Docker (io_uring SQPOLL + WRPKRU)`  
+> **Latest Verified Benchmark Report:** **[`tests/reports/latest.md`](./tests/reports/latest.md)** (Archive: [`bench_v0.10.7_20261110_030245Z_2c3e16a.md`](./tests/reports/bench_v0.10.7_20261110_030245Z_2c3e16a.md))  
+> **Provenance:** Slice `v0.10.7` (`2c3e16a`) · Generated `2026-11-10T03:02:45Z` · Environment: `Linux x86_64 Docker (io_uring SQPOLL + WRPKRU)`  
 > **Scorecard Across All 33 Production Workloads:** Beats **Deno (`v2.9.8`)** on **33/33**, **Node.js (`v27.0.0-alpha.0.0.0`)** on **33/33**, **Bun (`v1.4.4`)** on **30/33** cold one-shot, and **all 3 runtimes on 33/33 workloads in `--warm` pooled execution**.
 
 #### 1. Core Architecture, HTTP Throughput & 1,000-Tenant MicroVM Density
 
-| Metric | Slice (`v0.10.6` `SLICEBC\x01`) | Bun (`v1.4.4`) | Deno (`v2.9.8`) | Node.js (`v27.0.0-alpha.0.0.0`) | Slice Advantage |
+| Metric | Slice (`v0.10.7` `SLICEBC\x01`) | Bun (`v1.4.4`) | Deno (`v2.9.8`) | Node.js (`v27.0.0-alpha.0.0.0`) | Slice Advantage |
 | :--- | :---: | :---: | :---: | :---: | :--- |
-| **In-Process Isolate Cold Start (`P50` / `P99`)** | **`1.05 us` / `1.80 us`** | N/A (Process/VM) | N/A (Process/VM) | N/A (Process/VM) | **~120,000x faster than 125ms Firecracker VM** |
-| **1,000-Tenant MicroVM Swarm (Boot + Exec)** | **`1.37 ms` (`9.70 MB` RSS)** | > 5,000 ms | > 15,000 ms | > 30,000 ms | **> 3,900x faster / ~32,000x denser** |
+| **In-Process Isolate Cold Start (`P50` / `P99`)** | **`1.06 us` / `2.55 us`** | N/A (Process/VM) | N/A (Process/VM) | N/A (Process/VM) | **~120,000x faster than 125ms Firecracker VM** |
+| **1,000-Tenant MicroVM Swarm (Boot + Exec)** | **`1.36 ms` (`9.82 MB` RSS)** | > 5,000 ms | > 15,000 ms | > 30,000 ms | **> 3,900x faster / ~32,000x denser** |
 | **500-Module Monorepo Cold Boot (`stat()` Calls)** | **`3.41 ms` (`0 stat()`)** | `12.72 ms` (`500+ stat`) | `41.80 ms` (`500+ stat`) | `70.38 ms` (`1,500+ stat`) | **`3.7x` faster than Bun / `20.6x` Node.js** |
-| **HTTP/1.1 Keep-Alive Throughput (`16k` Reqs)** | **`137,020 req/s`** (Tier-0)<br>**`125,831 req/s`** (Tier-1) | `72,924 req/s` | `87,455 req/s` | `45,868 req/s` | **`1.88x` (`Tier-0`) / `1.73x` (`Tier-1`) vs `Bun.serve`** |
-| **Peak Process Memory (`Max RSS` Across Suite)** | **`13.25 – 21.75 MB`** | `25.88 – 40.83 MB` | `45.47 – 62.24 MB` | `70.03 – 92.88 MB` | **`2.0x–2.3x` less than Bun / `4.3x–6.8x` less than Node** |
+| **HTTP/1.1 Keep-Alive Throughput (`16k` Reqs)** | **`140,643 req/s`** (Tier-0)<br>**`119,010 req/s`** (Tier-1) | `80,578 req/s` | `71,774 req/s` | `46,241 req/s` | **`1.75x` (`Tier-0`) / `1.48x` (`Tier-1`) vs `Bun.serve`** |
+| **Peak Process Memory (`Max RSS` Across Suite)** | **`13.19 – 21.75 MB`** | `26.25 – 40.57 MB` | `45.81 – 62.38 MB` | `69.77 – 92.88 MB` | **`2.0x–2.3x` less than Bun / `4.3x–6.8x` less than Node** |
 | **Multi-Tenant Security Containment** | **`5 / 5 PASS`** (OCap+SES+Fuel+DLP) | `0 / 5` (Ambient) | `2 / 5` (Coarse CLI) | `0 / 5` (Ambient) | **Hardware & Language Zero-Trust Isolation** |
 
 #### 2. Real-Life Workload Summary by Domain (All 33 Workloads Aggregated)
 
 | Workload Domain & Stack Coverage | Suites | Slice Cold `.cas` Avg (Range) | Slice Warm (`--warm`) Avg | Bun `v1.4.4` Avg | Deno `v2.9.8` Avg | Node.js `v27.0.0-alpha.0.0.0` Avg | Category Speedup vs Bun / Node.js |
 | :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |
-| **Core Edge, Auth & Crypto (`Apps 01, 04, 05, 16`)**<br><sub>Multi-file TS, SHA-256/HMAC, JWT/OAuth2, `.env` Auto-DLP</sub> | `4` | **`8.47 ms`** (`6.55–11.14 ms`) | **`3.30 ms`** | `15.91 ms` | `49.42 ms` | `74.55 ms` | **`1.88x Bun` (`4.82x` Warm) / `8.80x Node`** |
-| **NPM Ecosystem, AST & Disk I/O (`Apps 02, 03, 06, 07, 08, 20`)**<br><sub>`semver`, `flatted`, `dlv`/`dset`, `mitt`, 10-Shard JSONL I/O, `Buffer`</sub> | `6` | **`12.62 ms`** (`7.94–16.55 ms`) | **`3.89 ms`** | `20.07 ms` | `55.22 ms` | `75.47 ms` | **`1.59x Bun` (`5.16x` Warm) / `5.98x Node`** |
-| **WinterTC Web Standards, Fetch Mesh & DLP (`Apps 09–14, 17–19`)**<br><sub>`Request`/`Response`, Static CDN `304`, SSE, Live `fetch`, WebCrypto</sub> | `9` | **`16.64 ms`** (`9.45–30.99 ms`) | **`8.73 ms`** | `21.55 ms` | `61.92 ms` | `110.65 ms` | **`1.29x Bun` (`2.47x` Warm) / `6.65x Node`** |
-| **Realtime WebSockets, Workers & Wasm/TSX (`Apps 15, 21–24`)**<br><sub>RFC 6455 WS, `worker_threads` + TCP/UDP, Pure-Rust `wasmi` Wasm, TSX SSR</sub> | `5` | **`15.94 ms`** (`9.44–23.82 ms`) | **`3.00 ms`** | `33.42 ms` | `74.66 ms` | `100.88 ms` | **`2.10x Bun` (`11.14x` Warm) / `6.33x Node`** |
-| **Full-Stack Edge & Node Frameworks (`FW 01–04`)**<br><sub>`Hono v4.6.20`, `itty-router + UnJS Nitro`, `Express/Polka node:http`, `SvelteKit 3.1.1 + Svelte 5.57.3`</sub> | `4` | **`23.77 ms`** (`16.90–39.32 ms`) | **`9.79 ms`** | `34.46 ms` | `64.80 ms` | `111.20 ms` | **`1.45x Bun` (`3.52x` Warm) / `4.68x Node`** |
-| **AI Agent, Multi-Tenant SaaS & Chaos Case Studies (`CS 01–05`)**<br><sub>Depth-4 ToT Agent, MCP Code Mode, 12-Tenant Mesh, Wasm CDR, 48 Payment Sagas</sub> | `5` | **`21.56 ms`** (`15.33–31.11 ms`) | **`7.29 ms`** | `23.51 ms` | `63.56 ms` | `91.60 ms` | **`1.09x Bun` (`3.22x` Warm) / `4.25x Node`** |
+| **Core Edge, Auth & Crypto (`Apps 01, 04, 05, 16`)**<br><sub>Multi-file TS, SHA-256/HMAC, JWT/OAuth2, `.env` Auto-DLP</sub> | `4` | **`8.69 ms`** (`7.12–11.37 ms`) | **`2.60 ms`** | `17.49 ms` | `51.87 ms` | `76.75 ms` | **`2.01x Bun` (`6.72x` Warm) / `8.84x Node`** |
+| **NPM Ecosystem, AST & Disk I/O (`Apps 02, 03, 06, 07, 08, 20`)**<br><sub>`semver`, `flatted`, `dlv`/`dset`, `mitt`, 10-Shard JSONL I/O, `Buffer`</sub> | `6` | **`12.83 ms`** (`8.55–17.13 ms`) | **`4.33 ms`** | `21.51 ms` | `56.52 ms` | `77.42 ms` | **`1.68x Bun` (`4.97x` Warm) / `6.03x Node`** |
+| **WinterTC Web Standards, Fetch Mesh & DLP (`Apps 09–14, 17–19`)**<br><sub>`Request`/`Response`, Static CDN `304`, SSE, Live `fetch`, WebCrypto</sub> | `9` | **`17.91 ms`** (`9.79–33.52 ms`) | **`9.11 ms`** | `22.64 ms` | `65.46 ms` | `119.05 ms` | **`1.26x Bun` (`2.49x` Warm) / `6.65x Node`** |
+| **Realtime WebSockets, Workers & Wasm/TSX (`Apps 15, 21–24`)**<br><sub>RFC 6455 WS, `worker_threads` + TCP/UDP, Pure-Rust `wasmi` Wasm, TSX SSR</sub> | `5` | **`17.15 ms`** (`10.14–25.80 ms`) | **`3.45 ms`** | `37.02 ms` | `79.14 ms` | `108.70 ms` | **`2.16x Bun` (`10.73x` Warm) / `6.34x Node`** |
+| **Full-Stack Edge & Node Frameworks (`FW 01–04`)**<br><sub>`Hono v4.6.20`, `itty-router + UnJS Nitro`, `Express/Polka node:http`, `SvelteKit 3.1.1 + Svelte 5.57.3`</sub> | `4` | **`25.13 ms`** (`19.11–40.14 ms`) | **`9.15 ms`** | `35.64 ms` | `66.58 ms` | `116.67 ms` | **`1.42x Bun` (`3.90x` Warm) / `4.64x Node`** |
+| **AI Agent, Multi-Tenant SaaS & Chaos Case Studies (`CS 01–05`)**<br><sub>Depth-4 ToT Agent, MCP Code Mode, 12-Tenant Mesh, Wasm CDR, 48 Payment Sagas</sub> | `5` | **`22.17 ms`** (`16.65–30.36 ms`) | **`8.81 ms`** | `24.26 ms` | `67.35 ms` | `96.00 ms` | **`1.09x Bun` (`2.75x` Warm) / `4.33x Node`** |
 
 #### 3. Flagship Real-World Representative Workloads (9 of 33 Highlights)
 
 | # | Flagship Workload | Slice Cold `.cas` | Slice Warm (`--warm`) | Bun `v1.4.4` | Deno `v2.9.8` | Node.js `v27.0.0-alpha.0.0.0` | Speedup vs Bun / Node.js |
 | :- | :--- | :---: | :---: | :---: | :---: | :---: | :--- |
-| **01** | `01-fintech-checkout` (Multi-File TS + SHA-256) | **`6.55 ms`** | **`1.93 ms`** | `15.17 ms` | `42.61 ms` | `74.22 ms` | **`2.32x Bun` (`7.84x` Warm) / `11.33x Node`** |
-| **03** | `03-disk-io-log-pipeline` (10 JSONL Shards Disk I/O) | **`7.94 ms`** | **`1.61 ms`** | `17.73 ms` | `50.10 ms` | `70.81 ms` | **`2.23x Bun` (`11.00x` Warm) / `8.92x Node`** |
-| **14** | `14-federated-api-mesh-dlp` (`bytes` + `dlv` + `dset` + Live `fetch`) | **`15.93 ms`** | **`7.80 ms`** | `24.46 ms` | `61.59 ms` | `122.58 ms` | **`1.54x Bun` (`3.14x` Warm) / `7.70x Node`** |
-| **20** | `20-node-compat-and-edge-router` (`Uint8Array` `Buffer`/Node Core/AST Bundler) | **`12.30 ms`** | **`0.89 ms`** | `25.97 ms` | `64.07 ms` | `88.27 ms` | **`2.11x Bun` (`29.24x` Warm) / `7.17x Node`** |
-| **22** | `22-worker-threads-and-raw-sockets` (3 Worker Threads + TCP/UDP + 5-Ring Sec) | **`24.54 ms`** | **`2.38 ms`** | `68.04 ms` | `134.58 ms` | `116.66 ms` | **`2.86x Bun` (`28.63x` Warm) / `4.90x Node`** |
-| **FW-01** | `FW-01: frameworks/01-hono-edge-microservice` (`hono@4.6.20` + `hono/cookie` + `ms`) | **`16.90 ms`** | **`7.54 ms`** | `22.25 ms` | `61.18 ms` | `110.86 ms` | **`1.32x Bun` (`2.95x` Warm) / `6.56x Node`** |
-| **FW-04** | `FW-04: frameworks/04-sveltekit-edge-ssr` (`@sveltejs/kit@3.1.1` + `svelte@5.57.3` + `devalue@6.0.3`) | **`39.32 ms`** | **`19.71 ms`** | `52.50 ms` | `84.30 ms` | `133.01 ms` | **`1.34x Bun` (`2.66x` Warm) / `3.38x Node`** |
-| **CS-01** | `CS-01: case_studies/01-tot-autonomous-sre-agent` (20 ToT Sandboxes) | **`31.11 ms`** | **`13.13 ms`** | `32.78 ms` | `86.41 ms` | `105.35 ms` | **`1.05x Bun` (`2.50x` Warm) / `3.39x Node`** |
-| **CS-05** | `CS-05: case_studies/05-time-travel-chaos-fuzzer-payments` (48 Payment Sagas) | **`20.77 ms`** | **`9.38 ms`** | `23.26 ms` | `71.21 ms` | `96.48 ms` | **`1.12x Bun` (`2.48x` Warm) / `4.65x Node`** |
+| **01** | `01-fintech-checkout` (Multi-File TS + SHA-256) | **`7.50 ms`** | **`1.26 ms`** | `17.06 ms` | `45.38 ms` | `72.99 ms` | **`2.39x Bun` (`13.50x` Warm) / `10.25x Node`** |
+| **03** | `03-disk-io-log-pipeline` (10 JSONL Shards Disk I/O) | **`8.55 ms`** | **`1.94 ms`** | `19.25 ms` | `51.81 ms` | `73.89 ms` | **`2.25x Bun` (`9.95x` Warm) / `8.64x Node`** |
+| **14** | `14-federated-api-mesh-dlp` (`bytes` + `dlv` + `dset` + Live `fetch`) | **`16.32 ms`** | **`9.17 ms`** | `27.48 ms` | `64.80 ms` | `135.19 ms` | **`1.68x Bun` (`2.99x` Warm) / `8.28x Node`** |
+| **20** | `20-node-compat-and-edge-router` (`Uint8Array` `Buffer`/Node Core/AST Bundler) | **`12.91 ms`** | **`0.62 ms`** | `27.52 ms` | `66.07 ms` | `86.58 ms` | **`2.13x Bun` (`44.67x` Warm) / `6.71x Node`** |
+| **22** | `22-worker-threads-and-raw-sockets` (3 Worker Threads + TCP/UDP + 5-Ring Sec) | **`25.80 ms`** | **`2.38 ms`** | `73.43 ms` | `141.09 ms` | `127.68 ms` | **`2.85x Bun` (`30.83x` Warm) / `4.95x Node`** |
+| **FW-01** | `FW-01: frameworks/01-hono-edge-microservice` (`hono@4.6.20` + `hono/cookie` + `ms`) | **`19.11 ms`** | **`6.56 ms`** | `24.00 ms` | `63.91 ms` | `117.23 ms` | **`1.26x Bun` (`3.66x` Warm) / `6.13x Node`** |
+| **FW-04** | `FW-04: frameworks/04-sveltekit-edge-ssr` (`@sveltejs/kit@3.1.1` + `svelte@5.57.3` + `devalue@6.0.3`) | **`40.14 ms`** | **`18.62 ms`** | `52.96 ms` | `83.65 ms` | `139.94 ms` | **`1.32x Bun` (`2.84x` Warm) / `3.49x Node`** |
+| **CS-01** | `CS-01: case_studies/01-tot-autonomous-sre-agent` (20 ToT Sandboxes) | **`34.36 ms`** | **`16.70 ms`** | `33.35 ms` | `89.42 ms` | `109.04 ms` | **`1.10x Bun` (`2.00x` Warm) / `3.59x Node`** |
+| **CS-05** | `CS-05: case_studies/05-time-travel-chaos-fuzzer-payments` (48 Payment Sagas) | **`21.32 ms`** | **`11.94 ms`** | `23.29 ms` | `73.80 ms` | `100.35 ms` | **`1.09x Bun` (`1.95x` Warm) / `4.71x Node`** |
 
 *Full 33-workload latency breakdown, standalone binary metrics, peak RSS per app, and historical reports: **[`tests/reports/latest.md`](./tests/reports/latest.md)**.*
 <!-- BENCHMARK_SUMMARY_END -->

crates/slice-engine/src/bindings/kv_and_sandbox.rs

@@ -334,13 +334,6 @@ pub(crate) fn register_kv_and_sandbox_host_functions(ctx: &mut boa_engine::Conte
                     f.set((used.saturating_add(outcome.fuel_used), limit));
                 });
             }
-            let child_net_mem = outcome.memory_used_bytes.saturating_sub(4096);
-            if child_net_mem > 0 {
-                crate::boa_realm::BOA_KV_MEM_BUDGET.with(|m| {
-                    let (used, limit) = m.get();
-                    m.set((used.saturating_add(child_net_mem), limit));
-                });
-            }
             if crate::boa_realm::is_trace_recording_enabled() {
                 crate::boa_realm::record_trace_event(
                     "sandbox.eval",

crates/slice-engine/src/isolate/exec_ast.rs

@@ -572,11 +572,19 @@ impl SliceIsolate {
             }
             ("JSON", "parse") => {
                 if let Some(JsValue::Str(s)) = eval_args.first() {
-                    if let Ok(val) = serde_json::from_str::<serde_json::Value>(s) {
-                        return Ok(Some(serde_json_to_js_value(&val)));
+                    match serde_json::from_str::<serde_json::Value>(s) {
+                        Ok(val) => return Ok(Some(serde_json_to_js_value(&val))),
+                        Err(e) => {
+                            return Ok(Some(JsValue::str(format!(
+                                "Uncaught SyntaxError: {}\n    at <main> (unknown at :1:12)",
+                                e
+                            ))));
+                        }
                     }
                 }
-                return Ok(Some(JsValue::Null));
+                return Ok(Some(JsValue::str(
+                    "Uncaught SyntaxError: Unexpected token in JSON\n    at <main> (unknown at :1:12)",
+                )));
             }
             ("Object", "keys") => {
                 if let Some(JsValue::Object(map)) = eval_args.first() {

crates/slice-engine/src/isolate/exec_boa.rs

@@ -411,6 +411,7 @@ impl SliceIsolate {
         }
         clear_event_loop_state();
 
+        let loop_iters = realm.ctx.runtime_limits().loop_iterations_executed();
         realm
             .ctx
             .runtime_limits_mut()
@@ -461,6 +462,14 @@ impl SliceIsolate {
                 return Err(v);
             }
         }
+        if loop_iters > 0 {
+            let loop_fuel = (loop_iters / 250).max(1);
+            let avail_fuel = self
+                .compartment
+                .fuel_limit
+                .saturating_sub(self.compartment.fuel_consumed);
+            let _ = self.compartment.consume_fuel(loop_fuel.min(avail_fuel));
+        }
         if !ses_mutated_target.is_empty() {
             // Do NOT return a realm whose SES intrinsics were mutated back to BOA_CONTEXT_POOL.
             drop(realm);
@@ -574,6 +583,14 @@ impl SliceIsolate {
                 let raw_err = format!("Uncaught {}", err);
                 let mut mapped = crate::boa_realm::map_error_with_active_source(&raw_err);
                 if mapped == raw_err {
+                    if let Some((first_line, rest)) = mapped.split_once('\n') {
+                        if let Some(open) = first_line.rfind(" (unknown at ") {
+                            let loc_paren = &first_line[open + 1..];
+                            if rest.contains(loc_paren) {
+                                mapped = format!("{}\n{}", &first_line[..open], rest);
+                            }
+                        }
+                    }
                     if let Some(opaque) = err.as_opaque() {
                         if let Some(obj) = opaque.as_object() {
                             if let Ok(stack_val) =
@@ -583,17 +600,22 @@ impl SliceIsolate {
                                     let st = s.to_std_string_escaped();
                                     for line in st.lines() {
                                         let trimmed = line.trim();
-                                        if trimmed.starts_with("at ") && !trimmed.contains("<anonymous>") {
+                                        if trimmed.starts_with("at ")
+                                            && !trimmed.contains("<anonymous>")
+                                        {
                                             if let Some(open) = trimmed.rfind('(') {
                                                 if let Some(close) = trimmed[open + 1..].find(')') {
                                                     let loc = &trimmed[open + 1..open + 1 + close];
-                                                    if loc.contains(':') {
+                                                    if loc.contains(':') && !raw_err.contains(loc) {
                                                         mapped = format!("{} ({})", raw_err, loc);
                                                         break;
                                                     }
                                                 }
                                             } else if let Some(loc) = trimmed.strip_prefix("at ") {
-                                                if loc.contains(':') && !loc.contains(' ') {
+                                                if loc.contains(':')
+                                                    && !loc.contains(' ')
+                                                    && !raw_err.contains(loc)
+                                                {
                                                     mapped = format!("{} ({})", raw_err, loc);
                                                     break;
                                                 }
@@ -739,7 +761,11 @@ impl SliceIsolate {
                 detect_needed_shards(js_code, is_http_req),
                 needs_lazy_global_getters(js_code),
             );
-            let scoped_code = format!("{{\n{}\n}}", js_code);
+            let scoped_code = if js_code.starts_with("//") {
+                format!("{{\n{}\n}}", js_code)
+            } else {
+                format!("{{{}\n}}", js_code)
+            };
             realm
                 .ctx
                 .eval(boa_engine::Source::from_bytes(scoped_code.as_bytes()))