• Compilation. Source to bytecode, then Cranelift IR, then native code. Both JIT and AOT backends. Binary inspection on Mach-O arm64 showed __text dominated by cranelift-codegen at around 5 MB, with a transitive wasmtime-internal-core dependency I am still working to drop.
• HTTP. Hyper on Tokio, with SO_REUSEPORT per core so the kernel distributes accepts rather than a single acceptor thread fanning out. Thread-per-core, moving toward io_uring via Monoio after 1.0.
• Optimisation passes. Scalar Replacement of Aggregates at the Cranelift IR level removed roughly 13 million runtime method calls from a single bytes.at hot loop. Arena allocators and prebuilt response caches are in; kernel-level profiling with flamegraphs drives the rest.
• Memory.Heap::Bytes(Arc<[u8]>, Range<usize>) gives zero-copy slicing. The 650 MB to 15 MB reduction came from fixing a Weak pointer cycle that was keeping whole buffers alive. The Bytes API is built around next_line and next_field returning [start, end, next], backed by memchr.

The primitives are chosen around what web applications actually need, not around what is easy to compile.

• store {} is an actor with a query / action split. It solves mutable shared state without locks in user code, and it turns out to be structurally the same thing as an Erlang GenServer, which I only realised after building it.
• parallel {} has static and dynamic forms, so the scheduler can plan the static case at compile time.
• schedule {} puts cron-shaped work in the language rather than in a sidecar process.
• model {} is the ORM, with the schema in the type system.
• html {} is a first-class type that is XSS-safe by construction. You cannot concatenate a string into it.
• memo fn and stream fn with emit from cover caching and SSE.
• WebSocket routes are declared like HTTP routes, alongside SSE routes with heartbeat and typed events.

Tooling ships with the language: a full LSP (diagnostics, completion, hover, go-to-definition, references, symbols, signature help, formatting), a VS Code extension, test blocks and fixture declarations inside .ryo files, and a fuzzing harness.

The grammar is formally specified in EBNF at spec/grammar/ryo.ebnf. Individual subsystems have their own written specs before implementation: lifecycle events, config and services (config desugars to resource, with a Secret<str> type), the mail service (send versus enqueue, memory transport for tests), security defaults (CSRF on by default, rate limiting with trusted_proxies) and a cache layer with a flat normalised store and O(1) read and edit guarantees behind sharded read-write locks.

The core language is feature-complete and core HTTP hardening is in place: body limits, per-request timeouts, graceful shutdown, CORS, CSRF, rate limiting, connection caps, security headers. What is still missing before I would put it in front of real traffic: database pool backpressure, full observability defaults, supply-chain signing, documentation, and any stability guarantee at all.

The open items are tracked in roadmap/before_prod.md and summarised in spec/caution_prod.md, both in the repository. Ryo is not ready for your production traffic and I will keep saying so until it is.

Postgres LISTEN/NOTIFY is a lovely primitive right up to the point where you need durability, replay, or more than one consumer group. Migrated to Debezium reading the write-ahead log into Kafka, with Go consumers fanning out to ClickHouse for analytics and Meilisearch for search. Search latency on participant lookup dropped 40%, partly from the index being fed properly and partly from query rewriting on the read side.

Race sites are fields. The network is one bar of 3G and a lot of hope. Built a Go WebSocket gateway that streams identity documents and face captures to OCR and facial recognition, chunked and backpressured for links that drop constantly. The naive HTTP upload version failed often enough to be unusable.

Monetico, Fintecture and PayZen, each with its own opinion about HMAC signatures and webhook semantics. The interesting work is not the happy path, it is reconciliation: what you do when the webhook arrives twice, arrives late, or never arrives and the money moved anyway. Plus refunds, which every gateway models differently.

Redis for shared hot state, Badger and Pogreb for embedded local tiers where a network hop was not worth paying for. Chosen per access pattern rather than by putting Redis in front of everything and hoping.

Implemented independently in both, because the two languages fail in different places.

Java. SWAR temperature parsing, branchless throughout, flat open-addressed hash table, GraalVM native image to skip warmup.

Rust.read_unaligned for the parsing hot path, name addresses stored as offsets into the mapped file rather than as pointers or owned strings, and a triple-cursor hot loop to give the CPU three independent dependency chains to work on at once.

Also profiled MmapSlice against a straight Vec copy on a 13 GB input, which is where the zero-copy Bytes design in Ryo came from.

• flamegraph_breakdown.py, a per-worker function-level breakdown of flamegraph output, because aggregate flamegraphs lie when your workers are not symmetric.
• A Streamlit and Plotly benchmarking dashboard that ingests parquet and CSV so framework comparisons are reproducible rather than remembered.