Rust debates go wrong when they are about identity ("we are a Rust shop") instead of economics ("where does this borrow pay"). Rust's pitch is narrow and real: memory safety without a collector, explicit ownership, and a type system strict enough to carry the invalid-states lesson's load natively. Its price is equally real: slower iteration, harder hiring, more ceremony per feature. The portfolio's answer is per-boundary, not per-brand.
the tool question
The decision rule in the repositories: use Rust where the stakes of a memory bug or a GC pause are structural, and TypeScript where they are not. The places that qualify are small and named: the kernels that must never crash while holding other people's state, the evaluators that run untrusted-ish input, the paths where determinism has to survive a hostile environment.
Everything else stays in TypeScript, where Bun's toolchain is fast, the type system still covers most of the same modeling discipline, and a crash is a failed request rather than a corrupted vault. The result is that Rust appears in the portfolio exactly where its guarantees are load-bearing, and conspicuously nowhere else.
where rust pays
vhalla is the flagship: a peer-to-peer workspace whose crates hold cryptographic material, durable journals, and wire state for rooms that persist across restarts. The cores are no_std and unsafe-banned; the deterministic-core lesson is written in this codebase. The unsafe ban is the load-bearing detail: Rust's safety argument only holds where unsafe is auditable, and the policy makes it nameable by making it absent in the cores.
ALGAL's kernel is the second case: the expression evaluator and the receipt engine must produce identical output on every platform forever, and the kernel being Rust (with the TypeScript runtime as the parity oracle, covered in its own lesson) is what lets verify be a credible offline check. The evaluator compiles to wasm for the Bun side from the same source, so the constraint runs in both places.
Oh's memory kernel is the third, and its plan documents the reasoning: a store that other tools project from needs to be boring in exactly the way Rust is boring (no GC pauses, no memory surprises), and the parity suite covers the port the way the ALGAL suite covers the runtime.
where it does not
The rest of the portfolio stays in TypeScript deliberately: Ghostget's provider orchestration, PeopleBlade's contact graph, the sites, the queues, the promotion machinery. These are I/O-bound orchestration layers where a Rust rewrite buys memory safety the domain does not need and costs iteration speed it does. The failure modes there (a wrong API call, a bad parse, a misordered retry) are better addressed by the parse-from-unknown and claims-ledger disciplines than by a memory model.
The boundary line is honest: Rust where a memory error is structural (vault, kernel, wire), TypeScript where the risk is logical. xcb's Rust core and ALGAL's unsafe bans live on one side; Ghostget and the product sites live on the other, and the choice is recorded per-repository rather than asserted as doctrine.