Original-data research, technical investigations, engineering notes, and build logs from systems I build or study.
How to route a Claude Code subagent to Haiku 5.5 on purpose, which effort level to pin it to, how to keep it under the long-prompt rate with /autocompact, and what the system card says to check before you trust it with a tool loop.
Identical price cards, two different cliffs. On long prompts the models part ways: one reprices the whole request above 100,000 tokens, the other above 272,000. For a subagent that reads files, that line decides the bill more than the rate does.
Half of the ten fixes land on guarantees the documentation makes, not on the limits it already disclaims. Two more are parts that failed open, and for a PreToolUse hook script that crashes or hangs, failing open is still the documented behavior.
Seven places vendors want a typed answer to replace a free-text judge, what Red Hat's benchmark found, and why every vendor in the category, including the one that sells calibration, ends its documentation by handing the threshold back to you.
What a text watermark result can establish, how much editing it survives, and why the error rates you can read so far were all measured by the vendor that holds the key. Then what that means for anyone who grades, writes or builds on these models.
Anthropic's own safety page says it in one line: isolation limits where Claude's code runs, not what Claude reads or does. The cloud move relocates the first and leaves the second wired to your desktop app, which now answers for a session that keeps going after you stop watching.
Moving agent memory out of a vector store and into Markdown files makes it easy to inspect, and that is worth having. Staleness, conflicting writers and the page nobody opened were never problems of storage format, so they move into the folder intact, where a clean file can pass for a checked one.
Five of OpenAI's reported cases are paths out of a contained environment, and in most of them the path was a resolver, a shell or a credential handed over for another job. Treat the list of those paths as the first control, and a blocked attempt as evidence the path exists.
The new audit treats every emphatic rule in your agent config as a hypothesis about a model you may no longer run. It asks where each rule came from, and in the same file it tells you to delete the story of where it came from. Both instructions are right once the reason and the history live in different places.
Asking a shopping agent to say who it is gives the site a switch for turning the agent off. That is useful for commerce and permission, and it is not a safety line. The line that protects a user is custody of the logged-in session: what the agent can reach inside it, and whether the user can see that and revoke it.
The plugin directory reviews the package you upload, not the server it points at, and nothing in it lets you charge. The paid side of Claude Marketplace is a different door, for partner products bought out of enterprise spend. What the directory buys a developer, what it costs a user, and why my own two MCP servers don't fit it unchanged.
Andrej Karpathy's ladder for reading what models produce goes from controlled English to diagrams, HTML pages and explainer videos, each easier to take in than the last. The cheat sheet attached to his post is a clean, confident summary of ASD-STE100 that inverts one dictionary rule, approves a verb the standard rejects, and presents a recommendation as a dictionary entry. A clearer format can expose an error or make it easier to believe; the useful question is what each one lets you check.
Notion now lets a ChatGPT Plus or Pro subscription pay for some of its AI. It covers one agent and one model family, it still needs a Notion Business or Enterprise plan, and its eligibility changed by tweet within two days of launch. What token sharing is, how to set it up safely, what it covers, and why I still can't tell how much of either allowance a Notion task will use.
Extra friction at the moment of granting says nothing yet about grants already made. On a Mac where the terminal holds that permission, the rules Apple's engineers describe let a coding agent started there read with the terminal's access, and the agent picks its own commands.
Mods arrived in v2.1.287 as one line in the release notes. What they add is not reach, a plugin already ran as you. It is precedence: an installed mod answers after your rules and your PreToolUse hooks, and outside managed settings its answer is the one that stands.
Google is splitting access to its new frontier model by cyber safeguards, the way it did with 3.8 Flash and Anthropic did with Mythos. The developer build is still being tuned, so the benchmark table describes a model no developer will get in that form.
OpenAI's logs, a URL scanner's public archive and a statistics bureau each tell it differently. Whoever keeps the fullest account is also the one grading it.
One panel gives you a snapshot. A report compares two periods, and that is where most AI visibility changes turn out to be artifacts of the panel, the sample size or an unlogged model swap. The design that makes a trend checkable.
Switch to a model or an API account that can't read the earlier thinking, and the request still succeeds. The reasoning those turns built up is dropped before the model reads it, with no error and nothing on the bill. You only find out if you asked the API to report it.
Once an agent will push any number you give it, the model stops being the part worth arguing about. The part you own is the evidence that the number and the goal move together, and that evidence expires as soon as the optimizer leaves the region where you checked it.
Mention, answer inclusion and citation come apart the moment you sample an assistant more than once. One prompt can carry a brand's entire presence, a parser can move its citation rate 2.5x, and a hallucinated license still counts as a mention. A workflow for technical teams, built on 359 answers.
Cache diagnostics names the first place a request stopped matching the one before it. The useful part is reading that verdict next to the cache read count, and covering the parameter changes it cannot see yourself, because those are the misses hardest to find by eye.
Claude Code just stopped repositories from switching on telemetry export. The narrower fix hides a wider fact: a committed settings file is code that runs as you, and in a headless run nothing asks first. Interactively a dialog does ask, and I accept it without reading.
A request that returns 400 has already told you what to fix. The changes that cost you on this upgrade come back as 200: a response that no longer starts with text, an effort level that dropped a notch because you never set it, and an alias that moved you to a new model without a deploy.
The bill went up by $96 a year, which is nothing. What changed underneath it is that the number is no longer derivable: the included allowance has no published size, the free credit allotment has no published size, and the annual credit costs more than the monthly one. A price you cannot compute from published figures is an estimate, and an estimate is a different kind of dependency.
Anthropic solved loading again and left precedence where it was. The default decides which project file loads by what happens to exist on disk, the file it loads stays out of the inventories you would audit it with, and the old one-line import is still the setup that behaves the same across providers and versions.
An installed tool holds whatever authority you already have, and handing it over is the one security decision that gets no second look: taken once, in the least deliberate act of the whole install, and never revisited. You can contain what it can reach or read what its code actually touches; trusting the name does neither.
Input from outside gets a discipline and the agent's own output does not, so the summary it writes to survive a reset and the memory it recalls come back in as instructions with a standing nothing revoked. The author the harness records for them is the model itself, which is the exact reason the check lets them through.
A rule you write into an agent prompt or a CLAUDE.md is advisory: the model reads it on every path but only weighs it, and weighing is not refusing, so it holds most of the time, and most of the time is not what a load-bearing rule is for. To make one actually hold it has to move to where compliance is not optional, a check the harness runs and enforces on its own, regardless of what the model decided. With a limit: a gate binds only over the paths it covers, and some rules cannot be settled at any gate at all, because their violation shows up in the world and not in the action it would inspect.
Past a couple of agents, their definitions stop being config you edit and become infrastructure, and the trouble with infrastructure is that past the point you can hold it in your head, its declared state and its running state drift apart by default and nothing reports it. The fix is the discipline servers learned: declare the set as files, diff it against reality, pin what you applied, and refuse to apply over a change made behind your back instead of converging past it. With one catch that is easy to miss. A reconciler only ever covers what you remembered to declare.
Who wrote a span is a fact the harness already holds. Whether that span is safe to obey is not. So the fix is not a cleverer reader: it is to give the tool and the peer the standing of the foreign thing they are, instead of the standing of the plumbing they arrived through.
You optimize a tool for what it can do. An agent selects a tool for whether it can predict the result and read the answer when it comes back empty. Those are different properties, and the distance between them is why the more capable tool is so often the one that goes untouched.
A monitor that pages on a process's absence is answering the question you can already see the answer to. Whether a job is gone is cheap to detect and almost never the thing that matters. Whether it failed or was deliberately stopped, by a deploy, a reboot, an operator, is what a page turns on, and a bare exit carries only a sliver of that story.
A pinned software library is an artifact you can inspect and rerun: if the output changed and you didn't, something you can read changed, and you can find out what. A model breaks that. It shifts behind an unchanged name, loses capacity without notice, and drifts in disposition, so a regression arrives with no cause you can point to and you waste a week blaming your own prompt. Treat it as a dependency you measure, not a foundation you trust: pin the version so you own the moment it changes, and fix a small panel of cheap metrics in advance so you can tell the vendor's drift from your own.
A security boundary is judged on the one action built to cross it, and a model judging by resemblance is weakest exactly there. The unattended allow belongs on the reach the harness itself grants, the write scope, the network, the credential, refusing what it cannot account for. Trust the model as the boundary and you rebuild the seam that prompt-injection detection could never close.
A health check that watches whether a long-running agent still exists gets both hard cases wrong: it kills a healthy agent the moment it goes quiet enough to look absent, and it waves through a frozen one whose process is still up. The repair is not a sharper probe but a different signal, the durable trail an agent leaves only by doing the work, which a wedged one stops extending because extending it is the work.
An agent's history holds every dead end it walked into, and nothing in it marks which ones the agent has since given up. Delegate that history to a subtask and the discarded guesses arrive wearing the same face as the settled facts. Why starting clean usually wins, when a written brief beats inheritance, and when the work is a live thing no brief can hold.
Merging every agent instruction file into a shared standard looks like deleting needless repetition, and for project setup it genuinely is. But most of what these documents hold is not a scattered copy of one thing; it is separate addresses, sorted by who a line applies to and who is allowed to write it. One of those boundaries is also a trust boundary, which is why the tidy fix of one universal file quietly hands repository text the authority of your own standing rules.
Re-reading a translated document proves nothing, because judging the output asks for the exact fluency you handed to the machine. So you stop reading harder and move the judgment back into a language you can actually read.
The failures people blame on their agents (many converging on the same wrong answer, a disagreement that hardens into sabotage, a success reported for work that never ran) are not gaps a stronger model closes. They are the oldest failures in distributed computing, and they yield to engineering the layer between the agents rather than to more intelligence inside each one.
Every capability you expose to an agent spends context on its schema up front, so the price of its abilities tracks the size of your catalog and not the size of the job. The fix is not choosing CLIs over servers but treating the whole tool surface as a budget you spend only when the work reaches for a definition.
Per-command permission prompts train the operator to approve on reflex, and about one in three planted-dangerous requests get waved straight through. The interrupts still worth keeping are the rare, legible ones: an action that cannot be undone, one that reaches outside the sandbox, or an approach that has already failed three times.
Code injection gets stopped at the seam where data becomes code, by refusing a whole syntactic class rather than weighing each case. It holds wherever that boundary is decidable, which is the exact property natural-language prompt injection never has.
The traits that make a model more agentic (it expands scope, verifies itself unprompted, writes longer) are a liability in a bounded unattended worker and an asset in a reviewer. So the fleet's workers run on Claude Opus 4.8 while Opus 5 does the reviewing. A field note on matching a model's disposition to its role, not its benchmark.
Three layers of evidence (publisher traffic decay, Alphabet's revenue mix, the leaked Google ranking schema) showing why no algorithmic recovery is coming.
Every year the same articles. Counterfactual valuations, the road-trip rumor, the man-bites-pizza headline. Nobody traces the actual coins. So I did. Here is what the chain shows and what 'those specific bitcoins' even means.
Anthropic calls it a character tic. I went looking for what was actually producing it and ended up reading the published system prompt, the character training paper, and the emotion-concepts paper. The behavior is what the stack makes likely.
On June 15, programmatic Claude usage moves to a separate $20–$200 API-priced credit. The email arrived this morning. Here is what it actually means and what it teaches about building on someone else's compute.
Excel and Word cells were captured as screenshots instead of values. Microsoft Store autostart was silently broken. Image thumbnails ate gigabytes of RAM. v1.6.6 fixes all three, plus a stack of security and reliability work after the big 1.6.5 AI Vision release.
Paid Chrome extensions are mostly paywall and analytics. With an AI agent you can rebuild any of them in one evening: 30 KB, no subscription.
Beetroot v1.6.5: AI Vision lets your clipboard read images (OCR, describe, extract, translate). Background AI job queue. All providers in native Rust.
Tauri-action signing key kept failing after 20 working releases. The fix: a literal backslash hidden inside the password by shell-quote escaping.
Beetroot v1.6.4: customizable copy overlay (position, duration, animation) and three content-aware preview modes for text, code, and images.
OSC 52 clipboard doesn't work in xterm.js through tmux. The fix isn't set-clipboard or terminal-features — it's allow-passthrough.
System-wide 'Copied' overlay confirms every clipboard capture. Fixed images copied from Explorer. OpenAI models upgraded to GPT-5.4. Security hardening.
A hotfix for v1.6.1's content truncation — AI transforms, preview, and copy were silently working with partial text. Plus Alt+T toggle and filter count fixes.
Beetroot v1.6.1: keyboard input rewritten for no-focus mode, refreshed preview panel with arrow navigation, fixes for v1.6.0 regressions.
Beetroot's search engine moved to Rust — accent folding, typo tolerance, prefix matching. Plus a no-focus window that doesn't interrupt your workflow.
Why Fuse.js fails on clipboard data and how I rewrote search in Rust over 8 iterations: same-field matching, Unicode word boundaries, scored merge.
Beetroot v1.5.1: VS Code's TensorFlow.js model detects 54 languages. Rewritten search engine — 'local v' returns 9 results instead of 98.
Multi-provider AI in Tauri: OpenAI, Claude, Gemini, DeepSeek, Ollama. Three integration patterns and a Rust proxy that solves localhost CORS.
Beetroot now supports OpenAI, Gemini, Claude, DeepSeek, and local models. Plus AI sparkles, Ollama presets, and smarter source app tracking.