Rust keeps moving up the stack. This fortnight the Tokio team shipped a full-stack web framework, System76's Rust desktop environment passed seven months of shipping real software, and an outside language author put runtime memory safety forward as a rival to the borrow checker. The systems language is now building the whole product, from the allocator to the app.

Tokio's Topcoat Brings Full-Stack Web to Rust, No WASM Required

The team behind Tokio just moved up the stack. Carl Lerche and Julien Scholz have released Topcoat, a batteries-included framework for building full-stack, server-rendered reactive web apps in Rust, and its headline decision is what it leaves out: no WebAssembly in the browser.

Instead, client-side reactivity is produced by compiling Rust to JavaScript through macros, while all markup renders on the server. That server-first model is the whole point. As the announcement puts it, "all markup is rendered on the server, and so components can be async, access the database, or verify user permissions safely." Authentication and data fetching live at the component level rather than in middleware, with request-level memoization to kill redundant database calls.

The rest is deliberately pragmatic: a content-hash-based asset pipeline, a Tailwind component library modeled on shadcn/ui, and native integrations for Fontsource, Iconify, HTMX, and Alpine.js. It ships as a production-ready first release with a getting-started guide.

Takeaways:

• Topcoat targets organizations already running Rust on the backend who want to build apps without adding a second language or a WASM toolchain
• Server-rendered components that can be async and touch the database directly are the core bet, not client-side hydration
• Coming from the Tokio maintainers, this is a serious signal that Rust wants a place in full-stack web, not just its infrastructure

Andrew Kelley Pitches Runtime Memory Safety, and Aims It at Rust

The most-discussed thread of the fortnight, 408 upvotes and 193 comments, is not about Rust at all. Zig creator Andrew Kelley opened a proposal for a new "fil" ABI, inspired by Fil-C, that would make Zig fully memory safe at runtime. He updated the issue title to read "actually memory safe (unlike borrow checking)," and that framing is the story.

Kelley's argument is that Rust offers compile-time memory safety only if you avoid unsafe, whereas a runtime-enforced model has no escape hatch at all. The mechanism is "invisicaps," pointer provenance checks combined with syscall interception, with an expected 1x to 6x performance penalty. It could compile entire C and C++ dependency trees as memory safe, targeting x86_64 Linux first.

The reaction was mixed and pointed. Critics argued hidden allocations clash with Zig's explicit-everything philosophy and its arena patterns. Fil-C's creator Fil Pizlo joined constructively, and the thread eventually got heated enough that Kelley locked it to serious contributors.

Takeaways:

• The debate reframes "memory safe" as compile-time (Rust without unsafe) versus run-time (no escape hatch), a distinction worth being precise about
• A credible language author positioning runtime safety as superior for security-critical code is a direct challenge to Rust's core pitch
• Rust's answer, that unsafe is auditable and localized rather than a loophole, is exactly the argument this thread forces into the open

Unbounded Channels Are Mostly a Mistake

Ali Fereidani makes a case Rust developers reach for daily and rarely question: unbounded channels are a dishonest API. They advertise infinite capacity, but they are really bounded by RAM, and the failure mode is the kernel killing your whole process at the worst possible moment.

The math is Little's Law. If 110,000 messages arrive per second and 100,000 leave, the queue grows by 10,000 per second, roughly 2.3 GB per hour at 64 bytes each. Worse, a deep queue hides the overload while quietly wrecking latency: five million queued messages served at 100,000 per second means every message is 50 seconds stale. Retries then pile on, a bufferbloat feedback loop that makes everything slower.

The fix is to make the decision explicit. Start at bounded(0) or bounded(1), then size capacity on purpose: for latency, capacity equals send rate times acceptable delay, so 50,000 per second times 100ms gives 5,000. Bounded channels force you to choose backpressure, load shedding, or a deadline. Unbounded ones just hide that choice.

Takeaways:

• Unbounded channels defer overload to an out-of-memory kill instead of surfacing it as backpressure
• Size a bounded channel from a real number: send rate times the delay you can tolerate
• Legitimate exceptions exist, waker edges, interior pipeline stages behind an entry bound, and finite batch jobs, but each should come with a stated reason

COSMIC at Seven Months: A Whole Desktop, Written in Rust

While Rust climbs into web frameworks, it is also shipping at the other end of the stack. System76's seven-month retrospective on the COSMIC desktop environment is a reminder that a full end-user desktop, not just a library, is being written in Rust in public and moving fast.

The feature list reads like a maturing product. Appearance gained frosted glass with adjustable opacity and consistent corner styling across GNOME and KDE apps. There is a new COSMIC System Monitor with resource graphs, workspace search and cycling in the launcher, and a steady stream of file-manager upgrades: tab drag-and-drop, network paths, pasting images and video from the clipboard, and text previews. COSMIC Text, their pure-Rust text handling library, even learned ellipsis truncation.

The quieter wins matter most. Screen reader activation is now on by default during setup, multi-display works during first configuration, and gaming got multiple fullscreen windows per workspace. Features ship as they land rather than waiting for a big release.

Takeaways:

• A complete desktop environment in Rust has moved from promise to a shipping product with real accessibility and gaming work
• The pure-Rust COSMIC Text library maturing in the open is a quiet dividend the whole ecosystem can reuse
• This is the accessible, tangible face of Rust adoption: software people actually run all day, not an RFC

Snippets

• This Week in Rust 661 The weekly firehose for everything this edition skipped. Highlights this issue: Rust 1.97.1, syn 3.0.0, PGO landing for Cargo and rustdoc, and, fittingly, Topcoat.

• arctic: a lock-free concurrent ordered map A practical lock-free adaptive radix tree from a paper at OSDI '26, with wait-free reads and lock-free writes, ordered range and prefix scans, and benchmarks against DashMap and concurrent B+-trees. On crates.io as arctic-map.

• Improving std::simd::swizzle_dyn Sergey Davidoff reworks the AVX2 path so a base64 encoder prototype jumps from 1.6 to 9.4 GiB/s, roughly 6x, without needing custom target-cpu flags.

• Rust compilation in the browser with WASM Weblings downloads the Rust toolchain into your browser and compiles Rust to WebAssembly client-side, no local install required. Worth a click just to watch it work.

• rsloop is now faster than uvloop rsloop, a Rust event loop for Python's asyncio, reports benchmarks beating uvloop, the long-standing speed champion in that space.

• 3D ascii tetris The most-upvoted show-and-tell of the fortnight at nearly a thousand points, Tetris rendered in 3D ASCII in the terminal, in Rust.

We are thrilled to have you as part of our growing community of Rust enthusiasts! If you found value in this newsletter, don't keep it to yourself — share it with your network and let's grow the Rust community together.

👉 Take Action Now:

• Share: Forward this email to share this newsletter with your colleagues and friends.

• Engage: Have thoughts or questions? Reply to this email.

• Subscribe: Not a subscriber yet? Click here to never miss an update from Rust Trends.
  
  

Cheers,
Bob Peters

Want to sponsor Rust Trends? We reach thousands of Rust developers biweekly. Get in touch!