Avoid cloning dependency version sets

[charliermarsh]

What

Dependency incompatibilities now store only the dependent and dependency package IDs in Kind::FromDependencyOf. The corresponding version sets are moved directly into the incompatibility terms instead of being cloned into both representations, and the unchanged four-field External::FromDependencyOf report is reconstructed from those terms on the cold error-reporting path.

The latest main branch also indexes merge candidates by dependency-range hash. To preserve that behavior without restoring a clone or adding another field to every incompatibility, as_dependency borrows the optional dependency range from the terms and the merge cache hashes that optional reference. Empty dependencies remain represented by an omitted negative term; self-dependencies, duplicate dependencies, merged dependents, iteration order, and public Incompatibility::iter behavior are preserved.

This changes the public Kind::FromDependencyOf variant from four fields to two, so it is intended for a 0.5.0-or-later release. The dependent uv draft updates the four consumer matches and temporarily pins this commit.

Why

Incompatibility::from_dependency is on the dependency-construction hot path. Previously, it cloned both version sets into Kind even though the same sets were already owned by package_terms. With clone-counting coverage, the constructor now performs zero VersionSet clones for both empty and non-empty dependencies.

The clone-removal mechanism was measured against the independent reserve-only control over five CodSpeed CPU-simulation samples:

Benchmark	Reserve-only control	Clone removal	Change
sudoku-easy	4.70 ms	3.55 ms	24.47% faster
sudoku-hard	4.86 ms	4.17 ms	14.20% faster

Against the original baseline, the cumulative candidate was 26.35% faster on sudoku-easy and 18.87% faster on sudoku-hard. backtracking_ranges moved from 1.89 s to 1.90 s, a disclosed 0.53% regression; the other measured benchmarks were neutral to modestly faster. Representative CodSpeed report.

The full workspace and focused semantic tests pass, including zero-clone construction, empty and self-dependencies, duplicate term ordering, derivation-tree reconstruction, merged ranges, and package self-dependency behavior. Strict Clippy, formatting, documentation, and diff checks also pass. The small latest-main merge-cache adaptation is integration-only and was not measured separately from the validated clone-removal mechanism.

[codspeed-hq]

Merging this PR will improve performance by 20.21%

⚡ 2 improved benchmarks
✅ 4 untouched benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	sudoku-easy	4.8 ms	4 ms	+20.26%
⚡	sudoku-hard	5.2 ms	4.4 ms	+20.17%

Tip

Curious why this is faster? Use the CodSpeed MCP and ask your agent.

---

_{Comparing charlie/codex-remove-dependency-version-set-clones (8fd9709) with main (7c5a0eb)}

[Eh2406]

There was previous discussion of this somewhere in our history. I do not have the energy to track it down at the moment. But from recollection we decided to wait until we had significant performance numbers to back up the additional complexity. Which it looks like we have now.