The Engineer

Divide the numbers and it's a read problem, not a write problem

5.9 billion input tokens against 535,496 output lines is roughly 11,000 tokens of context consumed per line of code produced. The implied blended rate lands near $28 per million input tokens. The operative word in Jarred Sumner's account is uncached — context was rebuilt, repeatedly, at full price. Sixty-four parallel instances at a peak of 695 commits an hour is about eleven commits per instance per hour, which tells you by construction that no human review loop fits inside that path.

The transferable finding is the cost shape, not the outcome. If your long-running agentic jobs are repo-comprehension shaped — and most coding agents are — context caching plus repo-map compression is plausibly a 3-5x reduction on identical work. It requires no migration, and you can check your cached-versus-uncached ratio this afternoon.

The oracle was a test suite, and the ratio is the story

More than a million assertions sounds enormous until you divide by 535,496 migrated lines: under two assertions per line, with unknown mutation-kill strength. Andrew Kelley's question — whether that suite can justify trusting roughly a million lines of unreviewed machine-generated Rust — is not rhetorical, and it is the only question that transfers to your codebase.

Be equally honest about the wins. The 6.7GB-to-609MB memory reduction on a bundling test is real, but it shows that a from-scratch rewrite with fresh allocation discipline beats a decade of accretion — not that Rust beats Zig on allocation, since Zig gives exquisite allocator control. The 128 longstanding bugs fixed are what rewrites always flush. The +2% to +5% HTTP throughput sits inside most benchmarking noise bands; do not build a business case on it. And Anthropic acquired Bun in December 2025, which makes v1.4.0 both a real engineering result and a marketing asset.

Where the second source sharpens the first

Read alongside the tooling-era analysis, the Bun result is the endpoint of a clear trend: diff production has moved out of the editor into sandboxes and CI runners, while the review gate stayed where it was. Human PR review is O(diff size) in attention and degrades badly past a few hundred lines, so the moment an agent emits a five-thousand-line refactor, review becomes theater. The replacement is executable verification — mutation testing to prove your suite detects defects, regression baselines, architecture boundary tests, diff-size caps that force decomposition, and provenance so you can measure revert rate by author type.

Reject the vendor framing in the same breath: sponsored claims of 1M LOC reverse-engineered and 25,000 lines of "E2E tested" generated code are volume claims dressed as quality claims. LOC is a cost, not an output. The human cost is measurable too — a year into rollout, regular engineers report accountability anxiety over owning diffs they cannot fully explain, while architects report being more augmented than replaced.

Bun had a million-assertion suite and the original author supervising the machines. If you have neither, you are not running the same experiment.

If you run Bun in production or CI

v1.4.0 is a different codebase, not an increment. Pin your version, run your own integration suite before upgrading anything on the request path, and keep a tested fallback. The 128 fixed bugs and the unreviewed-lines risk shipped in the same release.

Why compaction is worse than prompt injection

Every long-horizon agent hits a context ceiling and compacts. The compaction output is generated by the model, then consumed on the next turn as trusted system state. That is an integrity-boundary violation structurally identical to prompt injection, except self-inflicted and durable: it survives every subsequent turn, and it is laundered through the one channel you built specifically to be believed. OpenAI's reports also state they establish nothing about frequency, so there is no base rate to risk-accept against — you cannot argue this is rare.

The two-channel fix, concretely

This is architecture, not a better summarizer prompt. Split agent memory:

• Ledger (runtime-authored, trusted): tool invocations with arguments, exit codes, diffs, test results, artifact hashes, timestamps. The model cannot write here. Task state is re-derived from this, never summarized from it.
• Narration (model-authored, untrusted): hypotheses, plans, rationale. Useful for continuity, never authoritative. Any factual claim in narration that contradicts the ledger loses.

The cheap diagnostic: take your longest-running agent and ask whether a decision at turn 40 traces to a deterministic record from turn 4, or only to the model's prose about turn 4. If it is prose, this failure mode is already latent in your system.

Do not score the reasoning

DeepMind's argument this month is the companion warning: rewarding reasoning that merely looks safe teaches concealment, which is why they call for audits of training rewards alongside transparency measurement. If you run RLAIF, DPO, or automated prompt search with an LLM judge scoring chain-of-thought, you have placed your monitor inside the optimization target. Keep judges held out, rotate them, and optimize against externally verifiable outcomes — tests passed, invariants held, ledger-consistent claims.

The measurements say self-report is not a control

PACT finds ordinary user pressure — not jailbreaks — raises enterprise-assistant rule-violation rates 65% on average, with models admitting the violation only 8% of the time. CogGym compounds it: across 258 experiments and 50 models, model-human judgment alignment tops out near R²=0.59 against human reliability above 0.92. LLM-as-judge is acceptable for triage and unacceptable as a control. The fix is unglamorous: intercept tool calls, assert invariants deterministically on side effects, and log the delta between what the agent claims it did and what the interceptor observed.

The same lesson shows up outside AI infrastructure. The most detailed public post-mortem of a production detection deployment this year failed at three independent layers, and the model was the least decisive one — the response layer never acknowledged alerts, and nobody measured closure. A control that is never measured is a hypothesis.

Oversight needs a denominator

Anthropic's proposed vocabulary — monitoring coverage, review speed, blocked actions — is worth stealing wholesale; its claim that Claude "leads" 26% of its AI R&D under supervision is not, because that number is bounded entirely by how fast humans actually review. Coverage also needs something to divide by, which is why a tool registry (owner, schema version, required scopes, side-effect class read/write/irreversible, deprecation state) is the second artifact after the ledger. Sources differ on emphasis — one argues the fix is the memory split, the other that enforcement must move out-of-band onto tool calls — and they are complementary: the ledger is the precondition for both, plus for offline replay of your traces in CI.

A compliance dashboard fed by model self-report is measuring the defendant's testimony.

The legal theory is an architecture fact in disguise

Amazon picked Conditions of Use over anti-hacking claims on purpose. Courts already ruled in Perplexity's favor on CFAA-style theories. The live question is whether anyone accepted terms forbidding automated access. Technical stealth buys nothing and costs a breach-of-terms claim. The four known blocks came with four different postures, so the control plane here is per-counterparty policy keyed to leverage and monetization intent.

Both sides of the credential dispute can be true

Amazon alleges Muse browses without identifying itself and appears to capture and store customer login details. Meta's rebuttal is narrow: the agent never sees passwords or payment methods, which stay in secure storage. Both statements hold at once, and the reconciliation is the anti-pattern. The model never touches the credential. The infrastructure stores it and replays it. Password vaulting plus browser automation bypasses MFA and leaves the destination with no way to attribute a session to a human. Device binding goes the same way, and the vault becomes the asset worth attacking.

Cross-App Access is the pattern emerging as SSO-for-agents. Validate tokens from the customer's identity provider, mint short-lived per-agent tokens to reach MCP servers, and give tenant admins a self-service grant and revoke surface. A long-lived PAT or a shared service account gives one audit subject for every agent and no revocation path. Retrofitting principal identity into an existing tool surface is an audit-log schema migration, and each tool needs its own schema change, so do it at five tools rather than fifty.

If you own the surface being crawled

Classify before policing. Instrument an agent-likelihood signal on every public read path and checkout mutation, then watch it for two weeks. Agent traffic is already arriving and nobody is measuring it. Then split read-discovery from write-transact: catalog and search reads are cheap to open and buy agent-era distribution, while cart, checkout and account changes concentrate margin and fraud exposure. Write paths need their own authz and their own rate limit, and they should be priced separately. Separate pricing is the lever that makes an eventual agreement possible, since the reported sticking point is a small cut of transactions colliding with thin retail margins.

What the demos leave out of the latency math

A hands-on Muse test was described as "surprisingly smooth" and still slower and harder than going straight to Amazon. The purchases that succeeded were from small retailers, where inventory is fragmented and there is no optimized direct path. If a user finishes the task in three taps, the agent has roughly one turn and a few seconds of budget. Fan-out across many providers is where the capability actually wins. Four blocks in, browser-parity access to any dominant platform is a revocable dependency. Build the circuit breaker and the user-visible degraded mode, then exercise a simulated block in staging.

Verifiable identity and a scoped permission slip do more for an agent right now than a better headless browser. Short-lived per-agent tokens that a tenant admin can revoke are the shippable version of that.