Perf regression: npm/hosted wall +15% (2463257a..9c43dfc9) #993

[agent] Bench: npm/hosted wall time is +15% to +20% over the last 7 days of main (CPU +12% to +14%, peak RSS +3% to +5%). npm/rescan, npm/dry-run and npm/public-proxy moved the same way. Request counts are unchanged (127 / 67 / 151).

There is no single culprit commit. The cost built up across the range, about half before and half after 045d7ec7. This is gradual drift, not one bad PR.

Same-machine interleaved compare (base 2463257a #277 → head 9c43dfc9, run 2026-10-07):

An A/A run of the same binary at two paths on this runner was clean (npm/hosted -2.3%), so the result isn't runner noise. On 2026-10-06 the weekly ratio was already 1.100 (CI [-0.3, +15.9]); before that it held at 1.02-1.05.

Narrowing (one extra build, 045d7ec7, the main SHA measured 10-03 to 10-05):

Neither half is significant alone, so bisecting further won't name one commit.

Profile (callgrind, npm/dry-run fixture, base vs head): total instructions went up 9.4%, from 948M to 1,036M Ir. The added work is in new npm lock passes during VEX discovery and the rewrite:

• vex::discover::discover_with_ctx: +57M Ir. It includes vendor::npm_origin::npm_non_registry_entries (27M, new, from Fix npm rewiring git/URL/file lock entries (#326) #345 and Fix npm overrides of git deps being refused (#490) #491), vex::discover::npm::drop_non_registry_installs (18M, new, Fix npm rewiring git/URL/file lock entries (#326) #345) and vex::discover::npm::NpmLockRefs::mention (20M, new, Fix npm VEX attesting a patch the twin lock lacks (#798) #799).
• cli::commands::context::ProjectContext::locks (102M inclusive, new, Full Gradle support in agent, hosted and vendored modes #646): the shared lock cache now parses the lock through vendor::common::parse_json_manifest and JsonLayout.
• patch::redirect::rewrite_registry_redirect_withholding_vlt: +23M.

Candidates, in order: #799 (48085cef), #646 (0685ba8c), #345 (6e7ef748) and #491 (73b17db5). Each one re-walks the 3000-entry package-lock.json, so sharing one parsed lock walk across the VEX npm passes would likely win back most of this.

Repro

export CARGO_PROFILE_PERF_INHERITS=release CARGO_PROFILE_PERF_LTO=thin CARGO_PROFILE_PERF_STRIP=none
git worktree add /tmp/base 2463257a && (cd /tmp/base && CARGO_TARGET_DIR=/tmp/tb cargo build --locked --profile perf -p socket-patch-cli)
cargo build --locked --profile perf -p socket-patch-cli -p socket-patch-bench
target/perf/socket-patch-bench compare --base /tmp/tb/perf/socket-patch --head target/perf/socket-patch -f '^npm/hosted$' -f '^npm/rescan$'

Runner: 4 vCPU, Intel(R) Xeon(R) Processor @ 2.80GHz (cloud sandbox), nproc = 4.

Why this was filed: the regression is confirmed (it held in a second round), and npm/hosted has measured ≥10% over the week window on two consecutive runs (10-06 1.100, 10-07 1.150/1.196). Progress is logged in #575.

Generated by Claude Code

Backlog review — 2026-10-08

Priority: P1 → P3. A roughly 15% microbenchmark regression at subsecond absolute runtime needs performance tracking, not P1 incident priority. Keep active #1008.