Bun Rewrites 535K Lines of Zig into Rust in Four Months, Eliminates Numerous Memory Leaks

Bruno Couriol · rss · 2026-09-20 source ↗ Reader 🖥️

Agentic Engineering Capacity to Verify AI Output Coding Agents Incremental Rewrite Granularity Multi-Agent Orchestration Rust (Programming Language)

A single domain expert, directing dozens of parallel adversarial-review AI agents against a mechanical (behavior-preserving) porting process anchored to an extensive pre-existing test suite, rewrote a 535K-line production codebase into a memory-safer language in months instead of a year and shipped measurable bug and memory-leak reductions — but critics dispute whether passing that same test suite ever was, or could be, sufficient proof that a million lines of largely unreviewed AI-generated code are actually safe.

practical · mixed — Primarily a narrative case report (Sumner's account of the rewrite process and outcomes), but it embeds a genuine argumentative thread via Andrew Kelley's published rebuttal of the safety framing, plus a third-party (vitaminCPP) reframing of the stakes. It implicitly argues 'this approach is worth trusting,' while also reporting the counter-argument that it is not.

Structure

Part	Role
Sumner's motivation and the historical risk of rewrites ('historically, rewrites are a terrible idea')	context
The process: PORTING.md and LIFETIMES.tsv planning artifacts, implementer/reviewer/fixer agent roles run in isolated context windows, sharded across 64 parallel Claude instances	evidence (methodology)
Quantitative outcomes: $165,000 in tokens, 1,300 lines/minute peak, 128 bugs fixed, native memory leaks eliminated, 2-5% HTTP throughput gain	evidence (results)
Post-merge hardening: 19 subtle semantic regressions found by fuzzing, 11 rounds of security review, 15 fuzzing-driven PRs	evidence (qualification of the results)
Andrew Kelley's (Zig creator) rebuttal that the safety framing is a 'sleight of hand' since bugs are eliminated by engineering resources, not language or method, and that the same test suite deemed inadequate for the old Zig code cannot simultaneously be trusted as sufficient for a million new lines	counter-argument
vitaminCPP's framing of the merge as an 'industry canary' for whether massive LLM-generated codebases stay maintainable long-term	broader implication

Key terms

adversarial agentic code review
A structural separation where an implementer agent never reviews its own work and two reviewer agents (in isolated context windows, seeing only file diffs) have no task but to find bugs and behavioral divergences before a fixer agent addresses them — 'the implementer doesn't review, the reviewer doesn't implement.'
mechanical port
A rewrite that preserves the original code's structure and behavior line-for-line rather than redesigning it — chosen specifically because it lets the existing test suite serve as an oracle, at the cost of some regressions rooted in surface-level Zig/Rust syntactic similarity.
unreviewed slop
Andrew Kelley's characterization of the merged Rust code: over a million lines accepted into production without genuine human line-by-line review, regardless of how many automated gates it passed.

Propositions

explicitThe AI-assisted rewrite of Bun from Zig to Rust was completed and released (v1.4.0) about four months after it began, versus an estimated one year for a small human team.conf: high
extendsHow building software is changing at Anthropic · p5 — Gives the fuller end-to-end timeline (4 months to the v1.4.0 release) against the companion piece's 11-day initial-rewrite-sprint framing, showing most elapsed time went to post-hoc hardening rather than generation.
explicitRust's compiler-enforced ownership/borrow-checking converts a recurring class of memory bugs (use-after-free, double-free, forgot-to-free on error paths) into compile errors, which the author considers a better feedback loop than a style guide.conf: high
explicitStructural separation between an implementer agent and adversarial reviewer agents, each confined to isolated context windows, was treated as essential to catching bugs and behavioral divergences before merge.conf: high
explicitPlanning artifacts (PORTING.md mapping Zig-to-Rust patterns, LIFETIMES.tsv documenting struct-field lifetimes) were key success factors — the planning phase mattered as much as execution.conf: high
explicitPassing the full pre-existing test suite (over one million assertions) was necessary but not sufficient: subsequent fuzzing, 11 rounds of security review, and further validation surfaced 19 additional subtle semantic regressions and produced 15 more fix PRs.conf: high
explicitThe Rust rewrite (Bun v1.4.0) fixed 128 longstanding bugs from v1.3.14, eliminated native memory leaks (stable at 609MB vs. climbing past 6.7GB across 2,000 consecutive Bun.build() runs), and improved HTTP throughput by 2-5%.conf: high
refinesPresentation: Accelerating Performance by Incrementally Integrating Rust Into Existing Codebase · p1 — p1 there claims full-system rewrites are generically error-prone and blow past deadlines; this case reports the opposite outcome for an AI-orchestrated, test-suite-anchored full rewrite — though the 19 post-merge regressions this same document reports suggest the underlying risk was reduced, not eliminated.
implicitA sufficiently rigorous process-level verification loop (planning artifacts, structural implementer/reviewer separation, post-merge fuzzing and security review) can substitute for exhaustive human line-by-line review of a million lines of generated code, provided the codebase has an extensive, language-independent test suite to serve as an oracle.conf: medium
explicitcontestedBugs and correctness in a large codebase come from dedicating engineering resources to catching them, not from which programming language or automated verification method is chosen — and it is inconsistent to argue the old test suite didn't catch all the Zig bugs while trusting that same suite is sufficient to validate a million new lines of Rust.conf: high
contradictsHow building software is changing at Anthropic · p10 — The companion piece frames layered automated verification (AI review, security scanner, fuzzing) as a legitimate substitute for human line-by-line review at scale; Kelley's critique here directly disputes that this substitution is trustworthy, on the same underlying rewrite.
explicitBun's merged rewrite functions as an industry canary for whether massive, LLM-generated codebases can remain maintainable over the software engineering lifecycle — an open, unresolved question.conf: medium
implicitMost of the four-month public timeline was spent on post-hoc verification and hardening (fuzzing, security review, regression fixes) rather than on the generative rewrite itself, which undercuts a naive 'AI made this N times faster' headline reading of the story.conf: medium

Arguments

The rewrite's process was rigorous enough that the resulting codebase is trustworthy to ship, despite being largely AI-generated.

Explicit premises:

Rust's borrow checker converts a known bug class into compile errors.
The test suite is decoupled from the implementation language, so it remains a valid oracle across the rewrite.
Implementer/reviewer/fixer role separation, run in isolated context windows, was designed specifically to catch divergences before merge.
Extensive post-merge hardening (11 rounds of security review, 24/7 fuzzing) found and fixed the regressions that did slip through.

Implicit premises:

A sufficiently rigorous process-level verification loop can substitute for genuine human line-by-line review of a million lines of generated code.
The combination of the original test suite, fuzzing, and security review constitutes a sufficient oracle for behavioral correctness.

Inferences:

If this process generalizes, the bottleneck for future large-scale AI rewrites shifts from generation speed to the quality of the test/verification oracle available — codebases with weaker test suites would be substantially riskier candidates for the same approach.

The safety claim for the rewrite is a sleight of hand and the resulting code should be regarded as unreviewed. strength: high