Your Agent Has a Bug You Can't Reproduce. Here's How to Catch It.

Deterministic simulation testing drives every fault, clock, and random choice from one seed — so a flaky, once-in-production agent bug becomes a reproducible artifact you can shrink to one line. TL;DR: The worst agent bugs only appear under a specific interleaving of faults — a tool fails right after a side effect, a retry fires, and money moves twice. Happy-path tests miss it, and when it hits production you can't reproduce it. Deterministic simulation testing (DST) — the technique behind FoundationDB, TigerBeetle, and Antithesis — makes faults, timing, and randomness a pure function of one seed, so any failure replays exactly and can be shrunk to its minimal cause. In a runnable Python demo, the happy path passes, seeded fuzzing catches a double-charge, replays it identically, and shrinks a 4-fault schedule down to the single fault that matters. Mental model: a flight simulator with a record button. Instead of waiting for a storm to hit a real plane, you conjure storms on demand — and when one crashes the plane, you can replay that exact storm frame-by-frame until you understand it, then strip it down to the one gust that did the damage. The problem: the bugs that matter are the ones you can't reproduce Agents run in a hostile world. Tools time out, APIs return errors, retries fire, and steps race. Most of the time everything is fine. But somewhere in the space of when exactly does the fault land hides a bug — a retry that isn't idempotent, a state update that assumes a call succeeded, a compensation that runs twice. It shows up once, in production, moves real money, and then vanishes: you re-run the same input and it works, because the timing was different this time. Traditional tests can't help. Example-based tests exercise the happy path. Even randomized tests, if they do trip the bug, can't tell you how — the randomness that triggered it is gone. The pattern: make nondeterminism a function of a seed DST flips the model. Every source of nondeterminism — fault injection, the clock, thread scheduling, RNG — is routed through a single seed. That buys three things: Reproducibility. The same seed always produces the same run. A failure is a permanent artifact. Exploration. Sweep thousands of seeds (fast, in simulated time) to explore fault interleavings a human would never think to write by hand. Shrinking. Once you have a failing scenario, mechanically remove pieces until only the minimal trigger remains — turning a chaotic failure into a one-line repro. Here a "fault schedule" is just the set of steps that will fail on their first attempt — the entire source of nondeterminism, made explicit and seedable. The workflow has a real bug: confirm's retry re-runs charge with no idempotency guard. for step in PLAN: if step == "confirm": for t in range(2): try: attempt("confirm", t); break except Fault: attempt("charge", 1) #