refactor(duplicatedcontent): length-prefix rootDir instead of hashing

Pass 3 of code review on PR #732 found that hashing rootDir with
sha256 (added in 07e0f10 to fix a real key-collision risk) was more
than the problem needs: corpusIndexKey is called once per file on
corpusIndex's hot path, and this is a cache-key uniqueness need, not
an adversarial one, so paying a cryptographic hash for it is wasted
CPU and an allocation on every call.

Write rootDir with a netstring-style length prefix (its byte length,
':', then the literal bytes) instead: the prefix makes rootDir's
boundary unambiguous regardless of its content — two different rootDir
values can only produce the same "N:" + N-byte segment by having the
same length and the same bytes — without needing a fixed-length
digest. Cheaper than sha256+hex, same collision-freedom guarantee.

TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields is
updated to pin the new invariant (key starts with the exact length
prefix) instead of the old fixed-length-digest one; confirmed red
against the prior bare-concatenation scheme before this commit's
predecessor fixed it, and again here against a bare-rootDir variant
with no prefix at all.

Author: claude

internal/rules/duplicatedcontent/rule.go

@@ -396,16 +396,23 @@ func (r *Rule) corpusIndex(f *lint.File, corpus fs.FS, minChars int, sharedRoot
 // does; rule settings (include/exclude) are YAML-parsed strings, so
 // they cannot contain these control bytes. rootDir is not YAML-parsed
 // — it is a filesystem path, and most filesystems permit any byte but
-// NUL and '/' in a path component — so it is hashed to a fixed-length
-// hex string first: a pathological directory name that happened to
-// contain a literal 0x1f/0x1e could otherwise bleed into the fields
-// that follow it and collide two different scopes onto one cache slot.
+// NUL and '/' in a path component — so it is written with a
+// netstring-style length prefix (its byte length, a ':', then the
+// literal bytes) instead of a bare separator: this is called once per
+// file in the corpus (corpusIndex's hot path when sharedRoot is true),
+// so it avoids paying a cryptographic hash for a collision-avoidance
+// need that isn't adversarial. The length prefix makes rootDir's
+// boundary unambiguous regardless of its content — two different
+// rootDir values can only produce the same "N:" + N-byte segment by
+// having the same length and the same bytes — without needing a
+// fixed-length digest.
 func corpusIndexKey(
 	rootDir string, maxBytes int64, minChars int, stripFrontMatter bool, include, exclude []string,
 ) string {
 	var b strings.Builder
-	rootSum := sha256.Sum256([]byte(rootDir))
-	b.WriteString(hex.EncodeToString(rootSum[:]))
+	b.WriteString(strconv.Itoa(len(rootDir)))
+	b.WriteByte(':')
+	b.WriteString(rootDir)
 	b.WriteByte(0x1f)
 	b.WriteString(strconv.FormatInt(maxBytes, 10))
 	b.WriteByte(0x1f)

internal/rules/duplicatedcontent/rule_test.go

@@ -5,6 +5,7 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -1039,11 +1040,13 @@ func TestCorpusIndexKey_DistinctInputsProduceDistinctKeys(t *testing.T) {
 // strings that cannot contain 0x1f/0x1e), rootDir is a raw filesystem
 // path — most filesystems permit any byte but NUL and '/' in a path
 // component, including the key's own 0x1f/0x1e separators. Writing
-// rootDir raw into the key would let a pathological directory name
-// bleed into the fields that follow it. Hashing rootDir to a
-// fixed-length hex digest first closes that: the digest is always the
-// same length and alphabet (0-9a-f) regardless of rootDir's byte
-// content, so it can never absorb or be absorbed by an adjacent field.
+// rootDir raw into the key with only a bare trailing separator would
+// let a pathological directory name bleed into the fields that follow
+// it. A netstring-style length prefix (byte length, ':', then the
+// literal bytes) closes that without needing a cryptographic hash:
+// rootDir's boundary is unambiguous regardless of its content, so a
+// value embedding the key's own separator bytes cannot be mistaken for
+// "rootDir ends early, here comes the next field."
 func TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields(t *testing.T) {
 	poisoned := "root" + string(rune(0x1f)) + "999" + string(rune(0x1f)) + "sneaky" + string(rune(0x1e))
 
@@ -1054,12 +1057,14 @@ func TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields(t *testing
 	b := corpusIndexKey(poisoned, 2, 200, false, nil, nil)
 	assert.NotEqual(t, a, b, "maxBytes must still distinguish keys when rootDir embeds the key's own separator bytes")
 
-	// The hashed rootDir segment (64 hex chars) has fixed length
-	// regardless of the raw rootDir's length or content.
-	short := corpusIndexKey("x", 1, 200, false, nil, nil)
-	long := corpusIndexKey(poisoned, 1, 200, false, nil, nil)
-	assert.Equal(t, len(short), len(long),
-		"the hashed rootDir segment must be a fixed length independent of the raw rootDir's length")
+	// The key must start with rootDir's own byte length followed by
+	// ':', then exactly that many literal bytes — the netstring-style
+	// prefix that makes rootDir's boundary unambiguous regardless of
+	// its content, including a value that embeds the key's own
+	// separator bytes.
+	want := strconv.Itoa(len(poisoned)) + ":" + poisoned
+	require.True(t, strings.HasPrefix(a, want),
+		"key must start with the length-prefixed rootDir verbatim, got %q", a)
 }
 
 func newLintFileWithRoot(t *testing.T, path, root string) *lint.File {