Perf regression: yarn-classic/hosted wall +165% (5096c41a, #1328) #1423

[agent] Bench: yarn-classic/hosted wall time is +165% and yarn-classic/rescan +153% on today's main (17793173), compared with f3c6313a (the previous bench run, 2026-10-09). The hosted scan also makes 60 more requests (127 → 187), one GET per patched package's served tarball.

Culprit: 5096c41a, #1328 ("Fix fragmentless yarn classic hosted pins (#558)"). This was found by profiling, not by bisect builds, and git log -L puts the hot function's only change in that range in that commit.

Same-machine interleaved compare

Base f3c6313a → head 17793173, on a 4 vCPU Intel Xeon @ 2.10GHz cloud sandbox. An A/A run on the same machine was clean.

The rescan makes no extra requests, so most of the cost is local CPU work rather than the tarball downloads.

Hot spot

Callgrind on the head binary, yarn-classic/rescan (3000 packages, 60 patched), inclusive instructions:

93.8%  scan::run_scan
72.3%    scan::hosted::run_redirect_selected_untracked
67.8%      hosted::engine::yarn_classic_artifact_targets
60.8%        hosted::engine::classic_locks_registry_copy
43.4%          formats::yarn::blocks::scan_blocks
10.5%          drop_in_place<Vec<LockBlock>>
 8.0%          formats::yarn::patterns::split_key_patterns

yarn_classic_artifact_targets runs classic_locks_registry_copy(lock, name, version) once per candidate dep. Each call re-runs scan_blocks over the whole yarn.lock and splits every block's key patterns, so the cost is O(patched deps × lock size). The registry-copy filter also runs before the cheap lock.contains("\"<url>#") test, so a rescan pays it for every dep even though every dep is already pinned and nothing gets fetched.

Possible fixes:

• Scan the blocks once per lock and build a (real name, version) → registry copy set.
• Put the sha1.is_some() && lock already pins the url check first.
• The hosted run (+60 GETs) also downloads every patched tarball to read its package.json for the Yarn classic: a patch that adds a dependency to the package's own package.json leaves vendored yarn.lock with a dangling dependency (offline frozen install fails, lock churns), and hosted silently installs without it #591 unlocked-dependency check. That is intentional and explained in Fix fragmentless yarn classic hosted pins (#558) #1328, but the downloads run inside the scan's critical path.

Repro

export CARGO_PROFILE_PERF_INHERITS=release CARGO_PROFILE_PERF_LTO=thin CARGO_PROFILE_PERF_STRIP=none
git worktree add /tmp/base f3c6313a && (cd /tmp/base && CARGO_TARGET_DIR=/tmp/tb cargo build --locked --profile perf -p socket-patch-cli)
CARGO_TARGET_DIR=/tmp/th cargo build --locked --profile perf -p socket-patch-cli -p socket-patch-bench
/tmp/th/perf/socket-patch-bench compare --base /tmp/tb/perf/socket-patch --head /tmp/th/perf/socket-patch -f '^yarn-classic/' --runs 20

On main, the yarn-classic scenarios fail validation (60 unexpected tarball GETs) until the bench fixture update in #1422 lands. The PR serves real .tgz artifacts. Run the repro from that PR's branch.

Runner: nproc 4, Intel(R) Xeon(R) Processor @ 2.10GHz.

Generated by Claude Code