_checkBinary ran the visited-set cycle detection (visit-key string
allocation + Set has/add) on every call, including top-level direct
checks that never recurse — making the 'fast' binary path 2.5x slower
than the normal fast path, which already skips the block when _visited
is empty.
The cycle block now sits after the direct fast path: direct checks
return before it, while the rule-evaluation branches (which recurse via
evaluateRule with the shared _visited) still detect cycles. Binary
direct checks drop from 6.7us to 4.1us avg; the remaining 1.4x is the
honest cost of the richer binary result contract (allow/deny, threshold
compare, config lookup). Parity suites and full rigor remain green.
John Dvorak
5566d6c0ab