all barriers are falling in realtime

Here’s this year, more or less.

Super Smash Bros. Melee took six years to decompile, 19,828 functions turned back into C that compiles to the same GameCube bytes, and the last seven percent of it went in six days in September. Snowboard Kids 2 took 596 days to reach a full match on the N64. Its predecessor followed in 84. One engineer at Cloudflare rebuilt most of Next.js in a week for about $1,100 in tokens. Sixteen Claude agents wrote a C compiler in two weeks that boots Linux. The maintainer of chardet, a Python library that a huge number of projects pull in without thinking about it, rewrote the whole thing from an empty repository and changed its license on the way out. A hobbyist in Scotland reverse-engineered a DisplayLink dock and got a letter from a patent department.

None of that took a company’s worth of people or a decade. The barriers aren’t falling slowly. They’re falling while you watch.

Which leaves the obvious suspicion. If everything got this fast, the machines must just be typing more. Are we filling the world with code, or finally clearing some out?

what fell

Start with what each barrier was, because it was never typing.

Melee’s was a binary with no source, and a compiler whose habits you only learn by matching them one function at a time. The DisplayLink dock’s was a protocol nobody outside the company had written down. Next.js’s was the sheer size of the surface: every route, every rendering mode, every edge case thousands of apps depend on. chardet’s was a license. A C compiler’s was the forty years of corner cases GCC has been fixing.

Every one of those is a barrier of knowing, not of writing. The expensive part was always finding out how the thing behaves. Once you know, the code tends to be short. What changed is that finding out got cheap. A model will sit with a disassembly, a USB capture or a failing test suite as long as it takes, and it doesn’t get bored.

count it

So did it take more code, or less? Here’s what got built and what it was measured against.

Read down the middle column and you don’t get one answer.

A matching decomp can’t bloat. It is exactly the size of what shipped, because if it compiles to one instruction more, the comparison fails. There’s no room in it for slop, only for wrong guesses that get thrown away.

A static recompilation is a deletion with a game attached. Unleashed Recompiled translates Sonic Unleashed’s Xbox 360 code to C++ ahead of time, so there’s no emulator. Its authors skipped the parts of the original hardware a PC port doesn’t need, and the game runs better for it. The tools behind it were inspired by N64: Recompiled, and the same pattern keeps repeating: a shared runtime paid for once, in the open, and a thin layer per game. Every port that runs native is one less emulator nobody has to keep alive.

vinext is the clean case for “less.” It’s a reimplementation of the Next.js API on Vite, and it ships client bundles 57 percent smaller and builds 4.4 times faster in Cloudflare’s benchmarks. Some of that comes from covering 94 percent of the API instead of all of it, and Cloudflare calls it experimental. But a clone that’s smaller than the original is telling you how much of the original was weight.

The C compiler is the honest case for “more.” It’s 100,000 lines of Rust, and its author, Nicholas Carlini, is blunt about it: even with every optimization on, its output runs slower than GCC’s with optimizations off. It can’t do the 16-bit code to boot x86, so it calls GCC for that. It’s a remarkable thing to have built in two weeks, and it’s also exactly what the suspicion describes: a lot of new code doing worse what old code already does.

And Vino is pure addition, 6,341 lines with nothing deleted. But what it would replace is a kernel module and a closed user-space daemon that nobody outside Synaptics can read, so “more code” here means more code you can see. As of its second patch series it still doesn’t put a pixel on the screen. The dock won’t acknowledge the first encrypted frame, even though, by Mike Lothian’s own check, every byte the host can observe matches. That’s the most honest sentence in the whole story, and I’ll come back to it.

the slop is real

None of this means the suspicion is wrong.

GitClear looked at 211 million changed lines and found that in 2024, blocks of five or more duplicated lines went up eightfold, while “moved” code, which is how they measure refactoring, fell 39.9 percent. For the first time more code was being pasted than moved. That’s what slop looks like in aggregate: new lines copying old ones in codebases that keep growing and get tidied less.

curl ended its bug bounty on January 31. In six years it had paid out $86,000 for 78 confirmed vulnerabilities. Then the AI reports came. By mid-2025 about a fifth of submissions were what Daniel Stenberg calls slop, and the share of reports that turned out to be real fell from around 15 percent to under five. “We need to do something to prevent us from drowning,” he told The New Stack.

And the decomp scene, the one place where the bytes keep everyone honest, got its own version. On October 16, decomp.dev, the site that tracked progress across all the projects, shut its public index: “The community aspect of decompilation has been broken.” People were taking others’ half-finished projects, rushing them to 100 percent and putting ports out the door. The bytes matched. Nothing got learned.

So the same tools that closed Melee also flooded curl’s inbox. The tool isn’t the variable.

the referee

Look at the last column of the table again.

Every case that came out small, or at least came out right, had something checking the work that can’t be talked out of its answer. The original binary. Next.js’s own test suite. GCC as a reference compiler and a kernel that has to boot. A dock that either acknowledges the frame or doesn’t. Carlini said it in so many words: because the agents will work on whatever they’re given, “it’s important that the task verifier is nearly perfect.”

Under a referee like that, the cheapest way to finish is the smallest change that passes. You can’t write around a hash. Without one, the cheapest way to finish is to add, because adding never breaks anything you can see. A bug report has no referee until a maintainer spends an afternoon on it, and a bad report costs Stenberg the same afternoon as a good one. Slop lives wherever producing a thing is cheaper than checking it.

Dijkstra had the accounting for this in 1988. In EWD1036 he argued that we should stop counting lines of code as lines produced, and count them as lines spent, on the cost side of the ledger. A model makes producing lines nearly free. It does nothing to the cost of having spent them. Someone still reads them, carries them and maintains them. The referee is what makes that cost show up before the code merges and not a year later.

decomp.dev is the warning that a referee only checks what it checks. A hash confirms the bytes. It doesn’t confirm that anyone understood the game, named anything right, or wrote down what they found, and that understanding was the part the community actually wanted. Build the check for what you actually want, or you’ll get exactly what you asked for.

So, slop or deletion? Both, and you can tell beforehand which one you’ll get. Point these tools at a problem with a strong referee and they converge on the short answer. Point them at one without and they grow the pile.

the paper

Which brings it back to the letter, and to the license.

Everything in the table was a barrier made of not knowing, and that kind of barrier is going. A closed protocol is a fact about bytes on a bus, and bytes on a bus can be captured. A compiled game can be decompiled, and the comparison will tell you when you have it. Nobody needs permission to find out how something they own works.

What’s left standing is paper. Synaptics’ answer to Vino wasn’t a better dock. It was more than 270 patents and a deadline, for a workaround USB-C made unnecessary years ago. I wrote about that letter already.

chardet is the same fight from the other side. Dan Blanchard has maintained it for over a decade. For 7.0 he had Claude rewrite it from an empty repository, told it not to draw on the LGPL code, and released the result under MIT. Mark Pilgrim, who wrote the original, opened an issue saying that’s not a clean room: the maintainer had spent years inside the code being replaced. Bruce Perens argued in The Register that this is how AI kills software licensing. If the method holds, any copyleft project is one long session away from being permissive, or proprietary.

I don’t know who’s right on chardet, and that’s the point. No test can settle it. The rewrite can pass every test the old library had and the question stays open, because a license isn’t checked by anything that runs. Neither is a patent. A patent keeps people out and a copyleft license keeps code in, and they’re the two barriers in this whole story with no referee at all. They’re also the two that are still standing, and both are under the same pressure. When the secret is gone, paper is all that’s left of the moat.

Pascal ended one of his Provincial Letters in 1657 with an apology: “I have made this longer than usual because I have not had the time to make it shorter.” Short takes longer. Knowing what to cut is the expensive part.

What fell this year is the cost of finding out. The time Pascal didn’t have is suddenly cheap. Whether we spend it making things shorter depends on whether we built something that tells us when we have.

Sources: Tom’s Hardware: Melee fully decompiled ↗ · Capital and Compute: which games AI has decompiled ↗ · Chris Lewis: using coding agents to decompile N64 games ↗ · Cloudflare: how we rebuilt Next.js with AI in one week ↗ · Anthropic: building a C compiler with parallel Claudes ↗ · Time Extension: Unleashed Recompiled ↗ · LKML: drm/vino RFC v2 ↗ · The Register: chardet and the end of licensing ↗ · The New Stack: curl ends bug bounties ↗ · Time Extension: decomp.dev closes ↗ · DevClass: GitClear’s code quality report ↗