Round 2: optimization + revised methodology

Historical document. Written on 2026-11-12, when the project was called zidl (later Graven).

Date: 2026-11-12 · Replaces the timings of the baseline (sizes and allocations did not change). Machine: Intel Core i9-14900HX, Linux 7.3, rustc 1.94.0, --release. Noise observed between runs: ~±5%. Differences smaller than that do not count as wins.

What was wrong with the methodology (and was fixed)

1. zidl's writing paid for the pool on every message.
   • zidl created a Builder per message: take + give on the SimplePool, with two Mutexes, plus reserve.
   • FlatBuffers reused its builder with reset() and Cap'n Proto reused its allocator.
   • Fix: Builder::flush(), the equivalent of reset(). The builder lives between messages and each message is cut from the same pool block.
2. The benchmark's checksum dominated reading.
   • Each field did rotate ^ v and then * K, a serial chain of ~5 cycles per field, the same for every format.
   • That hid the real difference between them: in frame/500 it was ~8 ns per entity just for the checksum.
   • Fix: now it is only rotate ^ v, at ~1 cycle.
3. "Unverified reading" was not the same thing in the three formats.
   • FlatBuffers root_unchecked: validates nothing, not even UTF-8.
   • Cap'n Proto: checks bounds, but does not validate UTF-8.
   • zidl read(): validates required fields, bounds and UTF-8.
   • Now zidl appears in two modes: zidl (safe, the default) and zidl_trusted (strings without UTF-8 validation, unsafe, the equivalent of root_unchecked).
4. "Verified" in zidl validated UTF-8 twice: once in verify() and again when reading. Now reading after verify() uses the trusted mode.

Cap'n Proto still pays a copy into the output Vec when writing (write_message). This disfavors it slightly and is noted here.

Optimizations in zidl

The optimizations are covered by tests:

• Required-field mask: a proptest compares the fast path with the slow one over 8192 cases per schema. Verified by mutation: a wrong mask is detected.
• Allocations: the test still shows 0 allocations per message in steady state and fewer than 0.05 per message with 4 in flight.

Results (ns, median; bold = best)

Writing (round 4)

Three ways of handing over the message, all measured:

• zidl (borrowed, Builder::finished()): a &[u8] valid until the next root(). It is the same contract as FlatBuffers' finished_data() and Cap'n Proto's &Vec, which are the numbers in those two columns.
• zidl_batched (seal() + take_frames()): each message becomes a [u32 len][msg] frame in the same buffer. Every 64 frames or 32 KiB, the whole batch leaves as one Bytes, with one refcount per batch. It is the path of a sender writing to a socket.
• zidl_owned (flush()): one owned Bytes per message, with one atomic refcount per message.

¹ Only bank has a streaming variant; in the other rows it is zidl's only measurement.

Reading the modes:

• Small messages: batching removes the cost of the refcount. chunk/64 goes from 26.0 to 10.8 ns and telemetry from 21.1 to 6.4 ns, both faster than borrowed FlatBuffers.
• Large messages (frame/500, 15.5 KB): borrowed takes 766 ns; owned or batched, 886–920 ns. The difference is not the refcount. It is cache locality: the borrowed message always rewrites the same 15.5 KB (hot in L1), while a message that outlives the next write needs new memory. We tested a 1 MiB block to rule out reallocation: no change. Cap'n Proto (868) was measured borrowed; an owned version of it would require copying the Vec.

Reading every field

Reading one field

Reading with full verification

² Cap'n Proto's "verification" is lazy and does not validate UTF-8. zidl and FlatBuffers walk and validate the whole message.

Sizes and allocations: the same as the baseline (zidl smaller than FlatBuffers and than unpacked Cap'n Proto in every scenario; 0 allocations per message).

Verdict per criterion (spec §8)

What is still missing

• Large owned messages: ~15–20% above borrowed (cache locality, see above). An option for whoever sends right away: write straight to the socket from finished(), without an owned message.
• verify() on large lists: each element calls enter, leave and charge. The whole list could be charged at once when the element has no pointers.
• Streaming list: the per-element resize in the aux buffer plus the fix-up cost ~2.4 ns per element.