perf: traverse trie keys with a nibble cursor instead of materializing nibbles

[Qumeric]

Every get/insert/delete converted its key into a 64-nibble SmallVec up front (~64 bounds-checked pushes per operation), leaf comparison walked nibble by nibble, and new leaf paths were packed nibble by nibble — across the tens of thousands of trie operations in a block this adds up to a significant share of guest instructions.

Traversal now uses a KeyNibbles cursor: a (key bytes, nibble offset) pair that computes nibbles by shift/mask on demand.

• No nibble array is ever materialized for the key; branch steps just advance the offset.
• Leaf/extension path comparison exploits alignment: after a path's optional odd leading nibble, its data is whole bytes, and for whole-byte keys the cursor is byte-aligned there in every leaf comparison — so the comparison is a direct byte-slice equality check. The nibble-by-nibble fallback only runs for parity-mismatched extension paths.
• New leaf paths built from key suffixes (encoded_path_from_key) are a one-byte prefix plus a direct copy of the key's remaining bytes, instead of a nibble-packing loop.

Node-path operations (prefix_to_nibs, split/merge path construction) are unchanged — they operate on stored paths, not lookup keys.

Benchmark results

OpenVM 2.1 / new default block

Compare-branches run vs develop-v2.1.0: 29742009056 (block 24001988, prove-stark, g7e.2xlarge):

metric	develop-v2.1.0	this PR	delta
execute_metered_insns	664,702,189	651,778,530	−12,923,659 (−1.94%)
total_cells	65,071,473,647	63,820,222,214	−1,251,251,433 (−1.92%)
rows	1,323,107,351	1,289,412,192	−33,695,159 (−2.55%)
app segments	73	72	−1
total_proof_time_ms	72,472	70,791	−1,681 (−2.32%)
reth-block_time_ms	388,659	387,991	−668 (−0.17%)

Previous: OpenVM 2.0 / old default block

These historical runs used the previous OpenVM 2.0 branch and old default block 23992138. They are retained for context and are not directly comparable to the OpenVM 2.1 results above.

Compare-branches run vs main (which now includes #644): 29086324164 (block 23992138, prove-stark, g7e.2xlarge):

metric	main	this PR	delta
execute_metered_insns	708,067,128	696,408,331	−11,658,797 (−1.65%)
total_cells	64,178,350,072	63,288,917,334	−889,432,738 (−1.39%)
rows	1,319,323,277	1,305,202,103	−14,121,174 (−1.07%)
app segments	77	76	−1
total_proof_time_ms	80,021	77,778	−2,243 (−2.80%)
reth-block_time_ms	135,630	132,108	−3,522 (−2.60%)

(An earlier run against the pre-#644/#648/#649/#650 base showed −11.2M insns / −2.23% cells: 28864942969; the instruction saving carried over fully to the leaner base.)

The compare-results job failed only on the known artifact-path issue (#632); numbers were aggregated from the run artifacts directly.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​reqwest@​0.13.3 ⏵ 0.12.28
	cargo/​reqwest@​0.13.3 ⏵ 0.13.4	+1
	cargo/​serde_json@​1.0.149 ⏵ 1.0.150
	cargo/​serde_with@​3.16.1 ⏵ 3.21.0
	cargo/​actix-web@​4.12.1 ⏵ 4.14.0
	cargo/​alloy-eips@​1.5.2 ⏵ 1.8.3
	cargo/​bumpalo@​3.19.1 ⏵ 3.20.3
	cargo/​bytes@​1.11.1 ⏵ 1.12.1
	cargo/​clap@​4.5.56 ⏵ 4.6.1
	cargo/​clap_builder@​4.5.56 ⏵ 4.6.0
	cargo/​rayon@​1.11.0 ⏵ 1.12.0
	cargo/​smallvec@​1.15.1 ⏵ 1.15.2
	cargo/​spin@​0.10.0 ⏵ 0.9.9
	cargo/​spin@​0.10.0 ⏵ 0.10.1
	cargo/​toml@​0.9.5 ⏵ 0.9.12+spec-1.1.0
	cargo/​tower@​0.5.2 ⏵ 0.5.3
	cargo/​tracing-actix-web@​0.7.20 ⏵ 0.7.22
	cargo/​tracing-subscriber@​0.3.22 ⏵ 0.3.23
	cargo/​criterion@​0.8.1 ⏵ 0.8.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo hyper-util is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/reqwest@0.13.4 → cargo/hyper-util@0.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hyper-util@0.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo openssl is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/openssl@0.10.81 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.81. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/url@2.5.8 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/alloy-trie@0.9.4 → cargo/criterion@0.8.2 → cargo/alloy-eips@1.8.3 → cargo/alloy-primitives@1.6.0 → cargo/alloy-json-rpc@2.0.5 → cargo/alloy-rpc-types@2.0.5 → cargo/alloy-eips@2.0.5 → cargo/alloy-rpc-client@2.0.5 → cargo/alloy-consensus@2.0.5 → cargo/alloy-provider@2.0.5 → cargo/alloy@2.0.5 → cargo/reqwest@0.13.4 → cargo/revm@40.0.3 → cargo/reth-primitives-traits@0.4.1 → cargo/ark-bls12-381@0.5.0 → cargo/ark-bn254@0.5.0 → cargo/ark-ec@0.5.0 → cargo/ark-ff@0.5.0 → cargo/aurora-engine-modexp@1.2.0 → cargo/alloy-trie@0.8.1 → cargo/metrics@0.23.1 → cargo/revm@27.1.0 → cargo/bls12_381@0.8.0 → cargo/zerocopy@0.8.54 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report