What

Packet transformer compilation gets roughly 1.8× faster (BM_FirstTimeCompileNonOverlappingPolicy; ~1.4× on BM_FirstTimeCompileOverlappingPolicy) by eliminating the pervasive copying in the Union/Sequence/Difference combinators — the overhead already flagged by the TODO(dilo)s on GetMapAtValue and the node-level helpers. The win should grow on policies with wider match/modification maps, since the deleted copies scaled with map size.

The PR also makes the golden diff test robust to internal refactorings: golden output now depends only on transformer structure, not on node-interning order.

How

Commit 1 — copy elimination. The combinators previously copied entire DecisionNodes (nested btree maps and all) at every recursion step, re-interned expanded nodes through the unique table just to recover handles the caller already had, and copied the per-value modification map (GetMapAtValue) inside per-value loops. All of that is replaced with cheap, non-owning views:

• DecisionNodeView views an operand "at" a field: either the node's own maps, or the trivial "fall through to this handle" expansion when the operand branches on a strictly larger field (or is Accept). The old code materialized that expansion as a real DecisionNode and recursed; now each op is a single handle-level function and the expansion costs two pointers.
• ModifyBranchesView replaces GetMapAtValue's map copies with a view of the base map plus at most one extra entry (the unmodified fall-through), visited base-then-extra via a simple ForEach.
• CombineModifyBranches is now a template over the combiner — no absl::AnyInvocable type-erasure, no contains+at double lookups, hinted insertion since keys arrive sorted.

Commit 2 — follow-ups.

• Sequence accumulated its result maps by rebuilding them from scratch per left-branch entry (quadratic in branch count). It now unions each sequenced branch into the result map in place, which also deletes the remaining intermediate maps.
• Union and Difference were near-identical after the refactor; their shared body lives in a PointwiseCombine template parameterized on the operation.
• The golden diff test asserted raw interning indices, so any internal reordering (including this PR, and future work like operation memoization) churned the golden file without semantic change. The test runner now renumbers nodes and fields canonically before printing, by copying each compiled transformer into a fresh manager in deterministic traversal order. The golden file is regenerated accordingly.

Non-obvious choices

• ViewAtField/SmallestField take the (private) DecisionNode as a deduced template parameter so they can live in the anonymous namespace without widening the class interface.
• The per-value loops iterate values in sorted order (SortedUniqueKeys) instead of nondeterministic flat_hash_set order, making node-creation order deterministic.
• The canonicalizing copy in the test runner pre-interns fields in their original relative order, since the node invariant "fields increase strictly along each path" depends on it.
• NodeToTransformer canonicalization is intentionally untouched; it has its own inefficiencies, but mixing canonicalization changes into this refactor would have muddied verification.

Verification

• packet_transformer_test (including fuzz-property tests against reference implementations), packet_set_test, analysis_engine_test, table_test, evaluator_test, switch_test, and the full //netkat:all suite: all pass.
• After commit 1, the golden file was byte-identical, confirming the view refactor preserved behavior exactly (down to interning order). Commit 2's golden regeneration was verified to be a pure renumbering: every changed line is a handle number; structure, fields, and labels are identical.
• Benchmarks: interleaved A/B runs, old and new binaries back to back; the new build won every round.

🤖 Generated with Claude Code

Commit 3 — review cleanups. A four-angle cleanup review (reuse, simplification, efficiency, altitude) replaced the view's hand-rolled merging iterator with a simple ForEach, deduplicated the operand-view prologue into ViewOperandsAtSmallestField, switched the empty-map singletons to absl::NoDestructor, named the Deny-handle contract in one place (IsDenyHandle), hinted the per-value btree insertions, and removed a stale TODO plus the unused any_invocable dependency. No behavior change; golden file unchanged; benchmarks neutral.