This consolidates all performance work into a single end‑to‑end refactor:

• We consolidate all internal representation into a single IR structure.
• ~zero allocation now in the sense that we almost never call malloc anymore.
• introduces UTF-16 SIMD escaping.
• use zmig for parsing floats
• jiff for datetimes

Architecture (before → after) — allocation savings highlighted

BEFORE (streaming output, token pipeline)

  EVTX file
    |
    v
  BinXML streaming decoder
    |  (binxml::tokens + binxml::deserializer)
    v
  Token vectors (Vec<Token>)
    |    + alloc: token list per record
    v
  Template instantiation (legacy)
    |  (binxml::assemble)
    |    + alloc: per-template token expansion
    |    + alloc: repeated name/value copies
    v
  Streaming JSON/XML renderer (token-driven)
    |  (json_stream_output + xml_output)
    |    + alloc: transient strings
    |    + alloc: per-node scratch buffers
    v
  Output

AFTER (IR tree + streaming output)

  EVTX file
    |
    v
  BinXML → IR tree builder
    |  (binxml::ir + binxml::array_expand)
    |    - arena-backed nodes/strings (IrArena)
    |    - template cache reuse
    |    - spec-compliant array expansion in-place
    |    - WEVT fallback on corrupt templates
    v
  IR tree (typed, compact)
    |  (model::ir + model::ir_visit)
    |    - names/strings are arena slices
    |    - no token vectors
    v
  Streaming JSON/XML renderer
    |  (binxml::ir_json + binxml::ir_xml + binxml::value_render)
    |    - no serde_json / no HashMap
    |    - utf16-simd for bulk decode/escape
    |    - sonic-rs / zmij / jiff for fast formatting
    v
  Output

Allocation savings:

• eliminate per-record Vec
• eliminate per-template expansion buffers
• reduce string copies via arena slices
• avoid serde_json/HashMap materialization

Performance

• Machine: Darwin 25.2.0 arm64
• Sample: samples/security_big_sample.evtx (30MB)
• Command: evtx_dump -o json

Supersedes (will close after merge)

• perf: lazy decode TemplateInstance substitutions #277 perf: lazy decode TemplateInstance substitutions
• perf: H2 compiled template ops for JSON streaming #276 perf: H2 compiled template ops for JSON streaming
• perf: finish H1 streaming JSONL output #275 perf: finish H1 streaming JSONL output
• perf: two-lifetime arenas + streaming XML/JSON output #268 perf: two-lifetime arenas + streaming XML/JSON output

Breaking changes

• Timestamp types changed from chrono::DateTime to jiff::Timestamp in:
  • EvtxRecord, EvtxRecordHeader, SerializedEvtxRecord
  • binxml::value_variant::BinXmlValue (FileTimeType, SysTimeType, and array variants)
• Removed public token/DOM models:
  • model::deserialized (e.g., BinXMLDeserializedTokens, BinXmlTemplateRef, etc.)
  • model::xml (XmlModel, XmlElement, etc.)
  • binxml::deserializer
• Removed public streaming/output interfaces:
  • JsonOutput, JsonStreamOutput, XmlOutput, BinXmlOutput re‑exports removed
  • EvtxRecord::into_output removed
  • EvtxRecord::into_json_stream removed
  • EvtxParser::records_json_stream removed
• EvtxRecord public fields changed:
  • tokens: Vec removed
  • New: tree: IrTree, binxml_offset, binxml_size
• wevt_templates API changes:
  • parse_temp_binxml_fragment / parse_wevt_binxml_fragment removed from exports
  • render_with_substitution_values renamed to render_with_values