perf: an archive names its directories once and encrypts into one buffer

[donislawdev]

Sixth chunk of the 2026-09-05 performance report: P9 and P10. Neither moves a byte.

⚠️ Stacked on #58 (perf/plan-without-encoding), so the base is that branch rather than main. It has to be: docs/, tools/ and CLAUDE.md are single repositories with no branches, so a branch cut from main fails TestEveryGuardIsEitherProvenByMutationOrListedAsNotProven and TestEveryGuardCitedInTheSummaryIsJustifiedInRegression for guards that exist only on #58. Merge #58 first and this collapses to its own three commits.

P9 - the directory chain, built once

Layout.Path rebuilt the chain for every entry, through a fmt format verb, though it depends only on Depth. Prefix() builds it, and the two hot callers hoist it out of their loops.

variant	median, depth 50, 10 000 entries
before (fmt.Fprintf per entry)	82.2 ms
the verb removed, still per entry	30.6 ms
prefix built once (what the code does)	~0 ms

So more than half of it was the format verb, which the report did not separate from the loop.

⚠️ defaultDepth is 0, and at zero the prefix is empty - a flat archive never paid any of this. This is the ceiling of a setting, not a run anybody has.

P10 - one buffer per entry, not per write

Both locked-entry writers allocated a fresh make([]byte, len(p)) on every Write. At 128 MB in 32 kB blocks that is roughly four thousand allocations.

🔴 It cannot be done in place, and that is the only reason a buffer exists at all: p belongs to the caller and the zip writer passes the same slice on, so encrypting it where it lies would corrupt what someone else is about to read. Written next to both writers.

Nobody had measured this - entryWriter is unexported, so a probe outside the package cannot reach it - and the clock does not settle it either: the processor-time ranges overlap. The collector count does, and it is deterministic:

GODEBUG=gctrace=1, 128 MB locked zip
aes-256     48 collections -> 6
zipcrypto   48 collections -> 7

System time fell visibly too (203 → 78 ms, 234 → 141 ms) and the wall clock slightly (585 → 570, 630 → 597). I do not claim a processor-time figure.

No new guard, on purpose

Both are already guarded: archivedepth_test.go compares path length against the LongestPath arithmetic, and archivelock_test.go checks exact size, a real archiver opening it, and determinism. Adding a fourth defence beside three is the shape this project has removed seven times.

Instead, three mutations prove those guards catch the broken version: lost zero-padding in a level name, and - for both writers - the buffer handed on at full length instead of the length written. All caught.

⚠️ One mutation pattern went stale from this change (it quoted the layout.Path(...) call that was rewritten). staleness.py caught it; retargeted and re-proven.

Verification

• full go test -tags "$(cat .github/build-tags)" ./... - green, 83 packages
• python tools/preflight.py --quick - all 12 checks pass
• try-named.py on both guards - 5 mutations, all caught

🤖 Generated with Claude Code