Ten Languages,
One API

1. Three sizes

Large tier force a module split: domain, store, service, api, each import only from above. That is real enterprise shape, and it is where a language with no module pay twice — C and C++ must write a header per module. C three header alone = 368 of its 3,245 line.

2. How we verify

Nothing count until it work. Two gate, both must pass.

Order of work each tier: spec first, test second, then one Python reference driven to a full pass, then the other nine. Every build re-verified by hand, separate from the report it came with. Result: 30/30 pass 22 / 98 / 139, and all 20 mid and large build pass the log check.

3. Our three mistakes

Mistake 1 — PHP had OPcache off

php -S run the CLI SAPI, where opcache.enable_cli default Off. So PHP recompile the whole app from source every request. No production PHP run that way.

Mistake 2 — C and C++ had no keep-alive

Both send Connection: close every response, so a new TCP handshake per request. HTTP/1.1 default is a persistent connection. Zig also hand-write raw socket with no framework, and Zig do keep-alive right — that is what prove this our defect, not a property of C.

Before the fix we ranked C 8th on speed. C is actually near the top. The fix also add safety: cap 1,000 request per connection, SO_RCVTIMEO 5 s so one idle client cannot deadlock a single-thread accept loop, and TCP_NODELAY in C because it write header and body as two send and Nagle would stall the second. Correct keep-alive cost C about +26% token. Protocol-correct code is more code. Every number here include that.

Mistake 3 — our PHP store was O(n) per request

Covered in full in the next section. Short version: the large tier grow an audit log, and our store re-serialize the whole dataset every request, so PHP paid O(total state) per request for what every other language do as an O(1) append to a list in RAM.

What we checked and left alone

Everything else reviewed for the same kind of handicap and found fair: all ten run a single process with default framework setting, the compiled language all build in standard release mode (-O2, --release, ReleaseSafe), and no language get a tuning flag another is denied.

4. Where PHP time really go

PHP looked far worse than any of us expected, so we took it apart layer by layer. Same server, fresh store, GET only, warm. Three separate things were wrong, and all three were ours.

Layer by layer, after the OPcache fix

Bare PHP 0.874 ms — faster than C# and faster than Python. About 94% of the gap was Slim container, router and middleware stack built from scratch on every request. That is what shared-nothing require. Every other language here build its router one time at startup and keep it for the life of the process.

So we threw the framework away

Mistake 3: the store was O(n). Measured.

File I/O was never the problem. JSON serialization was. With a fresh store, PHP answer GET /health at the large tier in 1.656 ms — healthy, same range as Python. After a 10,000-request run it had degraded to 25.2 ms, because the audit trail and outbox grow and our store rewrote the whole dataset each time.

Fix: audit and outbox move to append-only JSON Lines file written with FILE_APPEND and never rewritten; auditCount, outboxCount and outboxDelivered counter in store.json so /stats and /metrics stay O(1); and an outboxFlushedThrough watermark so flush stay O(1) and each event delivered flag is derived on read rather than rewritten.

Flat. Large tier p50 drop 25.2 → 8.6 ms. Cost: +1,216 token, because O(1) persistence is more code than O(n). That move PHP from 4th to 5th on large-tier token. Honest trade, and every number here include it.

A mixed create-and-delete workload still drift after the fix, but that residue is not the audit trail: it soft-delete 1,000 task, and those row stay in store.json as live domain state that every build in the tier also hold. That part is legitimate and stay.

Framework cost, language and logic held constant

No framework also cost fewer token: 15,607 against 16,238 at the large tier, plus zero manifest because there is no composer file. So Slim cost about 4.2 ms per request, roughly 4% more token, a manifest and a vendor tree — and nothing measured here got better for it. That is why PHP is published with no framework.

Honest summary. PHP is not a slow language. Three separate handicap were stacked on it and all three were ours. What remain after removing them is the shared-nothing execution model itself: PHP cannot hold state between request, and this benchmark forbid a database, so PHP must serialize something on every request while the other nine keep everything in RAM for free. A persistent runtime — Swoole, RoadRunner, FrankenPHP — remove that too. Not tested here.

5. Token gap shrink when app grow

Bar = cost versus the cheapest build that tier. Right-hand number = change in ratio small to large; minus mean the gap closed.

6. Token tables, all three tiers

Token from tiktoken o200k_base. A second encoder, cl100k_base, give the same order at every tier — that is the evidence the ranking belong to the source, not the encoder. Code line exclude blank and comment line.

Click any header to sort.

small tier — 7 routes

mid tier — 16 routes

large tier — 34 routes

7. Growth, small to large

Same data the other way round. This is the mechanism behind the shrink: the cheap build had the most room to grow into. Growth here is not good or bad, so nothing is colour-coded. A low multiple mean the build already carried a big fixed baseline at the small tier — C++ grow only 5.09× exactly because it start at 4,179 token for seven routes.

Click any header to sort.

8. Cold start

Millisecond from process spawn to the first good GET /health, median across the three tiers. The harness measure its own detection cost on every run, so the startup column have that floor removed instead of hiding it.

Click any header to sort.

Java take 112× longer than C to accept its first request. For a long-lived server that mean nothing. For anything that scale to zero, restart often, or run in a serverless container, it is the number that decide.

9. Latency and throughput, all three tiers

10,000 request, sequential, one at a time. Read p50. p99 and max cluster on the 15.6 ms Windows timer tick — that is the client losing its scheduling quantum, not the server. Do not rank on req/s: it derive from the mean, and for a sub-millisecond server one stall cost the wall clock of ~50 normal request, so three repeat run of Go gave 580, 1,095 and 1,145 while its p50 barely moved. Full variance study in METHODOLOGY.md.

Click any header to sort.

small tier

mid tier

large tier

10. CPU and memory, all three tiers

10,000 request. Memory = resident set of the whole process tree, sampled every 20 ms. CPU = process-tree CPU second divided by request count, reported only from run of 1,000 or more, because the Windows CPU counter have about 15.6 ms resolution and a short run round to zero.

Click any header to sort.

small tier

mid tier

large tier

11. Does latency hold under load?

p50 at each request count, large tier. Below 1.0 mean it got faster while running. Above 1.0 mean it degrade. This is where a warm-up effect or an accumulating-state problem show itself.

Click any header to sort.

PHP is the only real degradation, and after the append-only store fix the cause is no longer the audit trail — an isolated test of 2,000 audit-only write is flat at 1.00×. What remain is 1,000 soft-deleted task row living in store.json as domain state that every build in the tier also hold; PHP is just the only one that has to re-serialize it, because a shared-nothing process cannot keep it in memory. The absolute number improved a lot with the fix: 25.2 → 8.6 ms.

12. Token order is close to reverse of speed order

Click any header to sort.

Shift = token rank minus speed rank. Plus mean faster than the token cost suggest.

13. Findings

14. Data quality

Every departure from a clean run, said out loud instead of smoothed over.

1. C return 748 conflict at large tier, 10,000 request. C use fixed array and MAX_AUDIT is 2,048. The cycle write three audit entry, so the table fill after about 680 cycle and further write answer 409. Count was 8,781 200, 477 201, 748 409. So C latency there look slightly better than true, because a rejected write is cheap. Also a real finding: C is the only build with a hard ceiling on accumulated state.
2. PHP number are median of three run. PHP repeat tight — 1.362 / 1.361 / 1.376 ms at small, inside 1.1% — so the median barely matter. The dropped framework build swung 13.73 / 6.07 / 6.10 ms, because its Composer autoloader touch about a hundred file per request. Raw repeat in perf-variance/.
3. Do not rank on req/s. Three repeat run of Go gave 580, 1,095 and 1,145 req/s while p50 moved about 13%. Throughput derive from the mean, and for a sub-millisecond server one 15.6 ms stall cost the wall clock of ~50 request. The throughput order among C, C++, Zig, Go and Rust is not established by this data.
4. p99 and max are host artifact. They cluster on multiple of 15.6 ms, the Windows timer tick, and jump up to fortyfold from p90. p50 and p90 are stable.
5. Cold start had a 500 ms floor, now removed. The first probe used an HTTP client, and on Windows a refused loopback connection take hundreds of ms to report, which floored every cold start near 500 ms and made all the fast binary look identical. A raw socket probe replaced it, and the harness now measure its own detection cost every run.
6. Peak RSS read 0.0 MB once. A fast build finish 100 request inside one 20 ms sampling interval after the peak was zeroed. Peak now seeded from a direct reading.
7. CPU at 100 request unusable and not reported. The Windows process CPU counter have about 15.6 ms resolution so a short phase round to zero.
8. The perf harness once hung instead of failing. The old readiness probe left its connection open, and the Zig single-thread server kept serving that dead socket and never accepted the real client. Worse, a failed request record no sample, so the loop while samples < target spun forever. The probe now close, and the loop raise on an error ceiling or on any cycle producing zero sample.
9. One machine, one host, sequential client. No repetition across reboot, no process pinning, no tuned timer resolution. Sound for relative comparison, not for absolute capacity.

15. Where the thirty builds differ

No test case reach any of these. Recorded because each move the token count a little, or because a language force the choice. Full list in METHODOLOGY.md.

• C# call the entity TaskItem, because Task collide with System.Threading.Tasks.Task. And every build use baseScore not base, because base is a C# keyword.
• PHP write its store to disk. PHP start a fresh process per request and cannot hold memory, and APCu is not on this box. The only build that touch disk. A property of the execution model, not a shortcut.
• C, C++ and Zig reject an unknown JSON key with 400; the other eight ignore it. C and C++ would need a recursive value skipper; Zig inherit it from the std.json default.
• String length unit differ. Python, Rust, PHP, Go and Zig count character. Java and C# count UTF-16 unit. C and C++ count byte. Every test string is ASCII so all agree.
• Idempotency scope is unpinned. The spec say every POST accept the key; the reference wire four route. Nine build follow the reference, C follow the prose. No test case separate them — so this is a defect in our test, not in any build.
• C use fixed capacity everywhere and return 409 on overflow. A real ceiling the other nine do not have.
• Header timing force three different mechanism. FastAPI can set a header after the handler return. ASP.NET need Response.OnStarting, Spring need a ThreadLocal written during the handler, because both commit the response while writing the body. Spring also rewrite a bare ETag into a quoted one unless it is set on the raw servlet response.

16. Limits — read before you quote a number

1. Framework included, so this measure ecosystem too. Each language use what a real team would pick — which for PHP mean no framework, precisely because there the framework is optional and cost 4.2 ms. FastAPI and Minimal API hide an HTTP parser, JSON parser, JSON writer and socket loop that C, C++ and Zig write by hand. A real gap, real for a team, but not a measure of pure syntax. A stdlib-only run would squeeze the band hard and is not done here.
2. Three thing left out on purpose. No password hash, no signed token, no wall-clock timestamp in a body. Each keep the work identical across the languages. Each is one library call in nine of them and a hundred-line detour in C — so leaving them out make the reported ratio kinder to C, not harsher.
3. Count read cost, not write cost. This count token to express working code once. It do not count the retries a compiler would have caught, which is exactly where strong typing pay its token back.
4. Tokenizer is a proxy. tiktoken o200k_base and cl100k_base, neither is Claude tokenizer, and no offline Claude tokenizer was available. Absolute count will move elsewhere; the order hold across both encoder, which is why the ratio column is the one to quote.
5. One workload shape. JSON over HTTP, CRUD, in-memory state. It say nothing about numeric work, streaming, heavy concurrency, or a real database. And note the in-memory-state assumption is exactly what penalise PHP.
6. Author effect. The same author wrote or directed all thirty, so style is more consistent than thirty independent team would be — that likely reduce variance versus the real world. The other way, per-language idiom expertise is uneven, and a specialist might write any one of these tighter.
7. Three size = three dot. The shrink is large and consistent, but three dot do not fix the shape of a curve.
8. No concurrency test. C, C++, Zig and the PHP built-in server are single-thread by design, so a concurrent benchmark would rank thread model rather than language. A separate study.