When The Sovereign Becomes A Founder
Why Bun's Rust rewrite matters, and why the next systems language cannot choose between Zig's trust and Rust's ceremony.
The Tweet That Lit The Discourse
On May 9th, 2026, Jarred Sumner, creator of Bun, posted one sentence that detonated across systems-programming Twitter:
"99.8% of bun's pre-existing test suite passes on Linux x64 glibc in the rust rewrite."
Bun, the flagship Zig-in-production exhibit. The language's most visible commercial success. The "look, Zig ships at scale" demo every Hacker News thread cited for two years.
Experimenting with a Rust rewrite serious enough to run the existing test suite against it.
Not a final migration decree. Not an irreversible public commitment. But serious enough that he is running the existing test suite against a Rust implementation and publishing the pass rate.
The discourse, predictably, lost its mind.
The Rust crowd treated it like a coronation. The Zig crowd treated it like betrayal. Both reactions are noise. Both miss the only signal in this story that actually matters.
We will not speculate on Sumner's specific reasoning. The man can speak for himself, and has. What matters here is the archetype: the moment the sovereign individual becomes a founder. The earlier public reporting framed the Rust work as exploratory; that caveat makes the signal cleaner, not weaker. The Register covered the same ambiguity.
Two Photographs Of The Same Engineer
Picture a hypothetical engineer in solo founder mode. Brain on fire, fingers on keys, building a runtime from nothing. They pick Zig because Zig fits their head: every byte visible, every allocator explicit, no compiler trying to parent them through ownership decisions they already understand.
This is the engineer-as-craftsman. Zig serves them perfectly. Their relationship is a love story written in errdefer and arena resets.
Now picture the same engineer in company mode. The runtime has employees, a roadmap, customer commitments, and an on-call rotation. The codebase crossed the threshold where one brain can no longer hold the whole architecture at once. New engineers ship code into it every week. Some are excellent. Some are learning. Most are strong in the runtime's domain and merely adequate at low-level memory discipline.
Zig assumes the engineer reading the docs is the engineer writing the code. At a thirty-person company, that assumption breaks every Tuesday morning at standup.
The junior forgets defer on the wrong path. The mid-level engineer ships a toOwnedSlice() whose ownership semantics he half-understood. The senior catches it late. The CTO watches production memory climb and asks the question every founder eventually asks:
What language would have caught this at compile time instead of in production?
For many founders, the answer is Rust. Of course it is. Rust converts large classes of dangling-reference, use-after-free, and data-race discipline from a cultural property of the team into a mechanical property of the compiler. It does not prove leak-freedom; Rust itself documents reference cycles as memory-safe leaks.
The Two Kingdoms
Zig is a tool for sovereign individuals. Engineers who already know what allocator-threading means. Engineers who understand that errdefer cleans partial construction. Engineers who can hold the lifetime of a returned slice in their working memory while reviewing the API shape.
Zig assumes you graduated kindergarten. It refuses to walk you to the bathroom. If you wet yourself in production, that is between you and your god.
Rust is a tool for teams that cannot make that assumption. The borrow checker exists because at any sufficiently large company, someone on the team is going to mishandle ownership, and you would prefer that someone be a compiler error instead of a CVE.
Zig says: "You own the bytes. Don't be stupid."
Rust says: "Prove to the priesthood you are not stupid."
Both positions are coherent. Both are correct for their target population. The problem is that neither population is the team that exists at a successful Series B startup.
- Two senior engineers would be happy in Zig and find Rust insulting.
- Five mid-level engineers could go either way but appreciate the safety net.
- Eight junior engineers know the domain and are still learning memory discipline.
- One staff engineer just wants the on-call rotation to stop catching fire.
Zig serves the seniors and abandons the rest. Rust serves the rest and forces the seniors to file paperwork in triplicate every time they want to write something obvious.
That decision is not a victory for Rust. It is a defeat for both languages. Because the right answer was never on the menu.
Allegory Time: The Construction Site
Imagine you are building a skyscraper.
Zig is the philosophy of master craftsmen. Every worker on the site is a thirty-year veteran. No signs, no fences, no safety equipment. Why would there be? Everyone here knows where the edges are.
Then the project gets big enough that you hire fifty more workers. Some are veterans. Most are not. The site has no signs. They start falling off the third floor.
Rust is the philosophy of OSHA. Everyone wears the harness. Every beam has a rating. Every tool has a certification. Veterans grumble. Productivity drops. Nobody falls.
Now ask the language-design question: what if the site could have signs that experienced workers can ignore, and that warn juniors exactly where the danger is? What if harnesses were optional in low-risk zones and mandatory in high-risk zones? What if safety was adaptive to the worker and the work instead of one uniform policy everywhere?
That site does not exist in the language landscape today. Rust is uniform-everywhere OSHA. Zig is no-OSHA-anywhere. Janus is being built as the third site.
What Each Language Actually Promises
| Language | What it promises | What it does not | Cognitive tax |
|---|---|---|---|
| C | You can do anything. | Memory safety, type safety, pretty much any safety. | Zero, until production. |
| C++ | You can do anything, plus safety nets if you remember them. | Coherence between safety nets. | Variable, hidden, weaponized at code review. |
| Zig | Allocation is visible. Errors are visible. You own the bytes. | Compile-time enforcement of ownership discipline. | Zero for veterans, infinite for juniors. |
| Rust | Safe Rust prevents large classes of dangling-reference, use-after-free, and data-race bugs. | Ergonomic ownership, cycle-leak freedom, sane async. | Constant, uniform, paid by everyone. |
| Go | Garbage collection. Goroutines. Ship it. | Performance predictability and real systems control. | Low, paid in latency tails. |
Now look at what nobody promises: memory discipline visible at the boundaries that matter; compile-time ownership proof without user-facing lifetime annotations; authority, effects, termination, and determinism tracked under one doctrine; junior-safe defaults with senior-controllable escape hatches.
That list is the gap.
Janus: What We Built From The Wreckage
Janus did not start from "what would be cool to add to a language." It started from cataloguing where Zig forces sovereign individuals to perform discipline manually, and where Rust charges teams cognitive rent for guarantees the seniors do not need.
The result is the Eight Axes of Provability. Janus is being designed around eight orthogonal compile-time questions — some already specified, some in implementation, some still under formal audit — that the language lets you express only when relevant:
| Axis | Janus mechanism | Rust equivalent | Zig equivalent |
|---|---|---|---|
| Memory | view / edit / take / make intents | &T, &mut T, lifetimes | Manual allocator and ownership discipline |
| Concurrency | iso / val / ref / tag | Send + Sync | Manual discipline |
| Side effects | !{IO, Net, Alloc} rows | None | None |
| Authority | Capability tokens + manifests | None | None |
| Termination | total func | None | None |
| Preconditions | where predicates | Newtype patterns | Runtime asserts |
| Compile-time | §{}, comptime, !{Comptime} | const fn + macros | comptime |
| Determinism | Effect absence + replay discipline | None | None |
Eight axes. Most functions use one or two. Some use zero. The eight-axis architecture is not a tax. It is a vocabulary. You only pay for what you express.
The Specific Move: Scoped Allocation Blocks
The operational pain that makes allocator-threading a death march at thirty engineers is solved by one Janus mechanism: lexical arena scopes that handle the Alloc effect.
Zig:
pub fn handle_request(allocator: std.mem.Allocator, socket_data: []const u8) !Response {
const req = try parse_request(allocator, socket_data);
defer req.deinit(allocator);
const route = try match_route(allocator, req.path);
defer route.deinit(allocator);
const response = try handle_route(allocator, route, req);
errdefer response.deinit(allocator);
try write_response(allocator, response);
return response;
}Allocator threaded four times. Three defers. One errdefer. Every junior who touches this is one missed cleanup away from production bloat.
Rust:
fn handle_request<'a>(socket_data: &'a [u8]) -> Result<Response<'a>, HttpError> {
let req = parse_request(socket_data)?;
let route = match_route(&req.path)?;
let response = handle_route(&route, &req)?;
write_response(&response)?;
Ok(response)
}Looks clean. Now write the real version. Lifetimes propagate through the response, the error type crosses boundaries, and the senior starts filing paperwork.
Janus:
arena {
name: req_arena,
backing: heap,
capacity: 16.kib,
} do
let req = parse_request(socket_data)?
let route = match_route(req.path)?
let response = handle_route(route, req)?
write_response(response)?
return response
end
// arena released; every allocation freed at the boundaryOne arena declaration at the work-unit boundary. Functions inside declare !{Alloc}; the arena handles it. The compiler proves no arena-backed value escapes the arena lifetime.
The AI Migration Shadow
There is another signal under this story: AI-assisted translation. A runtime-scale codebase pushing deep into a language rewrite is not merely a Rust story. It is a toolchain story. Languages now compete not only on human ergonomics, but on how well agents can read, transform, verify, and repair them.
That does not weaken the memory thesis. It sharpens it. A language for the next decade must be legible to humans and agents, with invariants visible enough that both can preserve them under transformation.
What Janus Is Stealing, And What Janus Is Refusing
Good language design is the discipline of stealing the right things and refusing the wrong things.
Stolen from Zig: allocator visibility, defer, comptime, no hidden allocation, errors as values.
Stolen from Hylo: Mutable Value Semantics; the programmer expresses intent, the compiler chooses lowering.
Stolen from Pony and Erlang: capability-shaped actor discipline.
Stolen from OpenBSD: pledge and unveil as syscall-surface narrowing.
Refused from Rust: lifetime annotations, the borrow checker as user-facing ritual, async function coloring.
Refused from Zig: programmer-discipline-only memory safety where teams need compiler enforcement.
Refused from everyone: garbage collection as a default memory model. :script gets an execution-scoped arena, not a tracing collector. Convenience does not require amnesia. Ambient reference counting, external theorem-prover dependencies, and ambient filesystem/network/time authority are refused too.
The refusal list is longer than the steal list. That is intentional. Most language designs sin by addition. Janus adds only where subtraction would cost more.
The Pitch, Stripped
If you are a sovereign individual building solo and Zig fits your head: keep using Zig. Janus will be there when your project becomes a company.
If you are at a Rust shop and the borrow-checker fights drain your team's cognitive budget: Janus is being built for you.
If you are watching a team-scale runtime project pivot to a language nobody really wanted to migrate to but had no other option: we are building the language we wished existed earlier.
It is not ready yet. The eight-axis architecture is locked. The implementation is staged and deliberately audited. The native prover roadmap exists because importing sovereignty from someone else's cathedral is not sovereignty.
But here is the thing nobody else in the systems-language space can say: we know exactly what we are building, why we are building it, and what we refuse to build.
The Closing Bell
Bun is moving serious work toward Rust because the language Sumner loved may not scale to the company he built. That is not a Zig failure. That is Zig being honest about its target audience.
Rust catches the migration because the language was designed for exactly this transition. That is not a Rust victory. That is Rust paying the cognitive tax that Zig refused to charge.
The real story is not which language won. The real story is that the language we actually wanted did not exist.
A language where the senior keeps her bare-metal control. Where the junior gets compiler-enforced safety. Where memory discipline is visible at the boundaries that matter and invisible where it does not. Where allocation, authority, effects, termination, and determinism are tracked under one doctrine instead of stitched together from third-party crates.
Zig says: "Don't be stupid."
Rust says: "Prove you are not stupid."
Janus says: "Declare what you mean. The compiler proves the rest. You can bring your juniors."
The construction site has signs now. Veterans can ignore them. Juniors can read them. Nobody falls off the third floor.
Lexical arena scopes are an active design direction, not a ratified surface. The doctrine is the point: allocation honesty, not hidden memory magic.