---
title: "The regeneration problem"
date: "2025-06-26"
summary: "Two sign-in flows, two days apart, nothing alike — and the drift underneath finally showed me the bug living beneath every other bug"
tags: ["ai","agents","software","trust"]
---

Diff two files this morning that should have been the same file. Same job, two sessions, two days apart: sign a user in. One used a refresh-token rotation, one didn't. One spelled the cookie `sid`, one spelled it `session`. Both worked. Neither knew the other had ever been written.

I have stopped being annoyed by this and started being frightened by it.

Because it isn't one form. It's the uploader, written four ways. The retry logic around our payment provider, subtly different in three places. A date parser that handles Prague's timezone in one file and forgets it in the next. The agent doesn't copy what exists. It conjures a new version from nothing, every time, fluent and almost right and never twice the same.

What you get after a few months isn't a codebase. It's a chorus singing slightly out of tune with itself. Everything rhymes; nothing repeats. Each piece reads fine in isolation. Read ten of them and you can't hold the system in your head, because there is no system — only a thousand confident near-duplicates, drifting.

The waste of the rework is the cheap part of the bill. The expensive part is that not one of these versions is trusted. Nobody attested to them. I can't point at a single uploader and say: this one is correct, freeze it, use it everywhere, never write it again. So the agent regenerates and we re-review, on a loop, forever.

We spent two years making the models smarter. Smart was never the constraint. The constraint is that there is nothing an agent can pick up and trust instead of remaking.

That is the bug living underneath every other bug. I can see the shape of the fix now, and I cannot set it down.