Habitat H2 · 258 sightings
Building with AI: SDKs, APIs, agents, and coding with AI. Every sighting here, newest first, with its specimen number and wildness rating.
Vercel Labs' UI SDK beta ships 50+ behaviors like popups, focus and typeahead that agents compose into components for React, Vue, Svelte, Solid and the web.
DeepSeek's 13 November API release adds server-run web search, file parsing, URL reading, TTS, ASR and a safety check to deepseek-flash, with per-use prices.
A custom error stays in place until your code clears it, even after the value changes.
A stable list needs a final ordering key that distinguishes otherwise equal rows.
Arm's Lorenzo Stoakes posted patches removing himself as reviewer for MM core, misc, reclaim and Rust, saying AI-generated series left him no bandwidth.
SubmitEvent.submitter identifies the initiating control when there is one.
Combining two result sets needs a decision about whether repeated values represent repeated events.
Eight changes for people building with AI: an active CI stealer, a GPUStack patch, a Val Town shutdown and three new tools.
India joins Australia and Japan for in-country API inference on gpt-6-luna. It needs Zero Data Retention, Standard pay-as-you-go and a 10% residency uplift.
Request a normal submission when validation and submit handlers matter.
Rows with the same ordering key can share a cumulative result unless the frame says otherwise.
Autocomplete tokens distinguish address purposes and group repeated fields.
Explicit NULL ordering makes a ranked list easier to understand and maintain.
Relate is an Apache 2.0, in-process graph database in Rust with Cypher, vector search, a CLI and an MCP server. Neo4j calls it an experimental Labs project.
Gemini Decision 1 answers up to 1,000 yes/no, choice or rubric questions per call over text, images, audio, video and PDFs, at $0.10 per million input tokens.
Autocomplete tokens distinguish an existing password from one a person is creating.
A dashboard count needs to say whether it measures records or populated fields.
A hidden identifier can carry context through a form, but the server must still authorize its use.
A uniqueness rule on an optional field does not also require that field to be present.
Val Town closed signups on 10 November, paused billing and goes read-only on 10 December. It has migration guides to Cloudflare, Vercel, Netlify and Render.
RFC 10008 standardizes QUERY, a safe and idempotent HTTP method with a request body. It is the clean way to send a large or private query.
Guide people toward expected files with accept, then validate uploads on the server.
Choose the comparison mode and cache policy before treating a matching result as proof about file contents.
Soft and hard wrapping can submit different text even when the controls look alike.
A fixed three-part result makes a missing delimiter explicit without splitting the rest of the value.
Bedrock AgentCore's Web Answer plans its own searches and returns a synthesized answer with citations. us-east-1 only, $10 per 1,000 calls, no model choice.
Torvalds' 7.4-rc2 note says much of the work was AI-driven fixes and relays Alexei Starovoitov's claim that BPF fixes now arrive faster than new reports.
Textarea length limits use UTF-16 code units, with important validation and newline caveats.
Text line handling needs an explicit boundary rule, especially when the source is a protocol.
Use browser network indicators as hints, then check the service you actually depend on.
Register each successful acquisition so a later failure can unwind the earlier resources.
Check HTTP status separately from network and request failures.
Copying the outer dictionary does not isolate the lists and dictionaries inside it.
A fulfilled fetch promise does not mean its response body has finished arriving.
Memoization changes object lifetime as well as how often a function runs.
Google measured TODO(bug) comments derailing its internal coding agents: unprompted detours cost about 70% more steps and 77% more tokens.
Cancel discards the remaining stream data and requests source cleanup. Releasing a lock leaves the stream for another reader.
A fixed-length recent-history buffer is useful precisely because it does not preserve every entry.
Reading a response consumes its body stream. Clone before the body is locked or disturbed when two consumers need it.
Splitting an iterator can retain a backlog when one consumer runs ahead of the other.
Keep decoder state across byte chunks so a split UTF-8 character survives intact.
A slice of a stream consumes its source; a second reader starts after that work.
Use inputmode to make text entry easier, then validate the actual value separately.
Sorted input and an equality check turn a useful boundary search into a correct membership lookup.
Eight changes from our past week for people building with AI: two security fixes, a new default, three deadlines and two new tools, each with a next step.
Hindsight 1.2 can hand small memory judgments to hs-decide-1-flash, an Apache 2.0 0.8B model. Vectorize says some operations get 2.5x cheaper; it is opt-in.
An omitted button type can make a local UI action submit its form. Explicit types make the intended behavior clear.
A convenient insertion helper can still call an expensive constructor when the key already exists.
Both can prevent editing, but disabled and readonly have different effects on form submission and validation.
Why separated keys become separate groups, and when sorting would change the question you are asking.
A Developer Preview in the 27.3 betas lets any app expose actions to Siri AI via App Intents. Shipping is months away; Siri AI is unavailable in the EU on iOS.
SkillSpector checks Claude Code, Codex and MCP skills for injection, exfiltration and supply-chain risk, then scores them 0 to 100. How to run it.
A file descriptor is just a number, so safe Rust code could hand any number to an API that trusts it. I/O safety closes that gap with OwnedFd and BorrowedFd. In October 2026 tokio deprecated four safe AsyncFd constructors for breaking it.
How a per-response nonce authorizes inline and external scripts, and how strict-dynamic lets a trusted script vouch for everything it loads.
The original and multilingual E5 embedding models were trained with a "query:" or "passage:" prefix on every input. Leave the prefixes off, or store documents with the query prefix, and retrieval quietly gets worse with no error anywhere.
How one response header tells a browser to erase its own cookies, cache, and storage for an origin when a session ends.
Some Rust crates fetch a prebuilt native library while they compile. The build works for months from a local cache, then a clean machine meets a refusing download host. Cargo's offline mode does not cover that download.
Why gzip and brotli belong to the representation itself, while chunked transfer is about how bytes cross the wire.
A Rust crate that wraps a C library declares it with the links key, and Cargo allows only one package per links value in a build. Two major versions of such a crate cannot share one dependency graph.
Why no-cache still allows caching and requires revalidation, while no-store forbids storing the response at all.
How the Strict-Transport-Security header turns one HTTPS visit into a standing rule to use only HTTPS for as long as max-age lasts.
When a branch was built on another feature branch, the three-argument git rebase --onto moves just its own commits onto main.
In Turkish, capital I lowercases to dotless ı, which breaks case-insensitive comparisons in Java and JavaScript unless the code uses a locale-independent fold.
Why a file created with mode 0666 ends up 0644, how to read and set the umask, and why chmod after creation is not masked.
How an informational 103 response pre-announces Link headers so a client can preload or preconnect while the server still works.
Rewriting a file in place leaves a window where readers and crashes see it half written, and a temporary file, fsync and rename(2) close that window.
Browsers send an OPTIONS preflight for non-safelisted methods, headers or Content-Type values, the server answers with allow lists, and the browser alone decides whether the script sees the response.
How HTTP/2 uses a connection-level and a stream-level credit window so a receiver can limit what it buffers and keep streams from blocking each other.
The endpoint that closes first waits 2xMSL in TIME-WAIT to resend its final ACK and to let old segments expire, so servers should set SO_REUSEADDR instead of tuning the wait away.
With no comparator, Array.prototype.sort converts elements to strings and compares UTF-16 code units, so numbers need (a, b) => a - b, and toSorted returns a sorted copy.
How the WebSocket Upgrade handshake proves a server actually understands the protocol, and why client-to-server frames are XOR-masked even over TLS.
A mutable default such as a list is created once at definition time and shared by every call that omits the argument, so use None and build the object inside the function.
Go 1.22 gives variables declared by a loop fresh instances on each iteration. The module's go line sets the default, and a per-file build constraint can override it.
What the Content-Digest header actually protects against, and why a digest is not proof of origin without TLS or a signature.
Python treats the argument to lstrip as a set of characters. Use removeprefix for an exact opening string, and validate separately when that opening string is required.
How the Vary response header tells a cache which request fields a response depends on, and why Vary: * blocks reuse without revalidation.
Repeated query parameters survive in URLSearchParams, but get returns only the first. Choose deliberately between reading every value, adding another value, and replacing the list.
How the If-Match header and strong entity tags implement optimistic locking, so a slower editor can't silently overwrite a faster one.
JavaScript can turn a damaged quantity into a plausible integer. Validate the complete text, then check the numeric range before accepting a count from a form or configuration file.
Deepgram is acquiring Daily. Pipecat stays BSD-2 under a new foundation, and the two launch RCS, an alpha format for tone and delivery cues.
Eight changes from our past week for people building with AI: two security fixes, a new default, a hosted shutdown and new tools, each with a next step.
Mistral's stateless /v1/responses endpoint returns the answer, reasoning and tool calls as separate items, for its hosted chat models including Large 4.
Pro plans get API credits equal to their price; Business pools $20 or $100 per seat, capped at $500. Credits expire each cycle and exclude Codex.
Chroma Cloud goes read-only on 22 November and stops serving reads on 22 December. Open-source ChromaDB stays Apache 2.0. Your migration options.
A Berkeley-led vector index keeps a pruned graph, not the vectors, so a local RAG index can be a few percent of the data's size. Costs and how to try it.
Claude Code, OpenCode and mini-SWE-agent ran five models on SWE-bench Verified. Harness choice moved cost up to 3x but outcomes about as much as noise.
A moderator post on Saturday banned AI-made and AI-related projects from r/opensource, with strict age and English rules. Users answered with protest posts.
TokenGate, from Stanford and Berkeley researchers, trains a gate that drops unneeded context tokens early, cutting prefill time and memory on small models.
Bitcoin Core now ships fixes for easily discoverable bugs as soon as possible, skipping its year-long embargo, after a rise in LLM-found reports.
Epic's 2026 AI MegaJam runs 12 to 15 November. Teams of up to five people and any number of AI agents build an Unreal Engine or UEFN game for cash prizes.
Eight changes from our past week for people building with AI: model shutdowns, new defaults, two security fixes and new tools, each with a next step.
Participating apps can draw on your ChatGPT usage with no API key. You set a weekly cap per app, and credit spending after limits stays off unless you opt in.
OPAL wraps a PyTorch optimizer so Claude Code can change learning rates, clipping and update rules mid-run. Single-run gains, and it can make runs worse.
Anthropic's first API version since 2023 returns a 400 for temperature, top_p or top_k. New major SDKs send it by default. What breaks and how to stay put.
Five open NVIDIA retrieval models search page images and text, rerank results and parse PDFs, under the permissive OpenMDW license. What to check first.
Since 20 October, GPT-5.6 and later can hold a cached prefix for at least 12 hours in the Responses API. Writes cost 2.5x input; read prices are unchanged.
Exa 3.0 adds a larger embedding model, GA highlights that use 95% fewer tokens, billions of new documents and a $4 Lite search tier. Benchmarks self-run.
Unicode lets you write é as one precomposed character or as an e plus a combining accent. The two look alike but differ in code points, and normalization gives them a single form.
The byte order mark is a signature that U+FEFF becomes at the start of a stream. Its exact bytes depend on the encoding, and whether to use one is the protocol's call.
Why a printed decimal like 0.1 is a rounded picture of a stored binary approximation, and why adding three of them does not give exactly 0.3.
A NOT IN query can lose every candidate when its exclusion set contains NULL. A small SQLite example shows why and how a correlated NOT EXISTS changes the result.
During a repeated local hour, two timezone-aware Python datetimes can compare equal. Convert to UTC before comparing instants or calculating elapsed time.
When Python pairs separately produced values, a missing result can vanish silently. Strict pairing catches unequal lengths, with an important limit around side effects.
Hy Memory 2.0 is on GitHub and PyPI as hy-memory 2.0.2 under Apache 2.0. MemHub imports authorized tool chats into a local store. The scores are Tencent's.
DeepSeek's API guide documents Search and Fetch at 5 requests a second. The Chinese pages price each at 5 yuan per 1,000 successes; the English pages say $0.75.
XERJ published v1.0.0-rc.96 on 16 October, a Rust engine for local search. Corpus Hub is not enabled in this build.
Jonathan Corbet applied the patch that removes the Assisted-by tag to the kernel docs tree on 14 October. Linus's tree and the published docs still require it.
decomp.dev's admin disabled the public index, saying AI forks broke the progress board. Existing project pages stay. 404 Media reported the note.
Christian Schaller says Claude Code and USB captures produced a SANE backend for his Plustek OpticFilm 8200i. He says upstream SANE already supports it.
GitHub's 15 October changelog says agentic autofix for code scanning is generally available. Its access page also lists public repositories.
Cheng Lou published Handwired, a toy that turns ordinary JavaScript into an exact neural net with no training. The repository is MIT.
Anthropic says Claude Platform can export OpenTelemetry traces in public beta. The same day's Desktop posts add a sessions view for side-by-side work.
A 13 October Xbox post says a small Xbox Labs group will turn emerging ideas into things players can try. It also says Xbox will keep stewarding its IP.
An empty cell is not simply nothing. Under default tabular-data metadata it is a null value, and the reason it is empty does not survive unless you give it a column of its own.
A plain file copy of a SQLite database that a program is still using can be inconsistent or miss recent writes. What SQLite's own documentation says goes wrong, and three supported ways to take a safe copy.
ALTER TABLE ADD COLUMN in SQLite edits the stored schema text and leaves the rows alone, so it takes the same time on one row or ten million. The same design explains the limits on what kind of column you can add.
A network call can hang while connecting, while waiting for the next byte, or by dribbling data forever. Connect, read and total timeouts each cover one of those, and some clients set none by default.
An agent that retries a failing tool call immediately, at every layer, can turn a short blip into an outage. Backoff, jitter, retry limits and which errors to retry at all.
"It's faster now" is a claim, and one timed run can't support it. Warm-up, repeated runs, outliers, noise thresholds and what to write down, using hyperfine and Criterion.rs as worked examples.
QGIS merged QEP 428 on 7 October, replacing a human-in-the-loop AI policy with a ban on LLM, AI or agent-assisted code in the qgis/qgis repository. The pull request drew fresh attention on 12 October.
Linus Torvalds published a Linux branch for small reads that skip page-cache folio refcounts. The commit says Claude Code wrote the code and the first draft, and he does not schedule a merge.
Turn promptfoo assertions into a required GitHub check: deterministic tests, the action's failure rules, branch protection, and the path-filter trap that leaves checks pending.
Build a three-sample Inspect task with a solver chain and a built-in scorer, run it with inspect eval, and read the log to tell a wrong answer from a format mismatch.
Swap TestModel or FunctionModel in for the real model and block real model requests, so Pydantic AI agent tests run fast, free and the same way every time.
Generate n samples per problem, count the passes, and compute 1 - C(n-c,k)/C(n,k). The common 1-(1-p)^k shortcut underestimates pass@k.
Input and output share one context window. Count the input, give max_tokens what remains, and handle the two stop reasons that mean the answer was cut short.
Before you reuse a JSON Schema with strict structured outputs, audit it against the supported keywords and move the rules that do not fit into your own validation code.
Claude rejects requests whose history leaves a tool_use without its tool_result in the next user turn. Here is the shape the API expects and a loop that keeps it.
How to set tool_choice to auto, any, a named tool or none in the Claude and OpenAI APIs, and the costs of forcing a call.
A shallow CI checkout can build the current tree while hiding the ancestor a change detector needs. Diagnose missing history, deepen deliberately, and fetch the right refs.
Browser echo-cancellation constraints negotiate a track setting. Learn what supportedConstraints, ideal, exact, and getSettings reveal, then test the microphone route that users actually use.
A newline in one filename can turn a transcript-ingestion job into two wrong arguments. Use NUL-delimited find and xargs streams, and keep the boundary intact downstream.
Read RTP sequence numbers and timestamps together to separate likely packet loss from suppressed silence, then account for comfort-noise packets.
Use TypeScript satisfies to check every stage in an AI pipeline configuration while retaining the specific shape of each stage for later code.
Twilio buffers outbound media and returns matching marks after playback or clear. An AI voice agent needs that distinction to account for speech interrupted by a caller.
Azure Speech can turn spoken words into formatted display text. Keep the recognized wording and reader-facing transcript separate when building voice applications.
A valid JSON integer may lose precision when parsed as a JavaScript Number. Decimal strings keep opaque IDs stable across runtimes.
A proto3 scalar getter can return zero for both an omitted field and an explicit zero. Presence tracking makes partial updates behave as intended.
An older proto3 service can carry a newer binary field through unchanged message handling, but a JSON conversion or field-by-field rebuild can drop it.
An AI request's latency budget should follow every downstream gRPC call. Deadline propagation limits waiting, while application cancellation stops work already in motion.
Epic's Unreal Engine account posted on 8 October 2026 about Unreal MCP, an experimental editor plugin. The docs say it binds to loopback only, with no authentication.
AbortSignal.reason and throwIfAborted help distinguish cancellation from ordinary failure; combine caller cancellation with a timeout for bounded AI requests.
Python asyncio.shield protects an inner task from cancellation propagated by its waiter. The caller still receives CancelledError and must account for work that continues.
Hugging Face published TRL v1.15.0 on 8 October 2026. SFT, DPO, KTO, GRPO, RLOO and Distillation now use a fused LM head by default. Sequence and memory figures are Hugging Face's own.
stale-while-revalidate and stale-if-error permit different kinds of bounded staleness. Their windows start after freshness ends, and each trades current data for a specific benefit.
A POST followed by a redirect can become a GET or remain a POST. The choice between 303, 307, 308, and historic 301/302 behavior changes what a form or API client sends next.
A transaction can update two attached SQLite databases, but crash atomicity across both files depends on the main database and journal mode. Here is the boundary to check before relying on it.
An encoded slash can be identifier data or a path boundary. Parse URL structure before decoding, and give each routing layer one clear interpretation.
Augment and Harness both say Harness acquired Cosmos, the Auggie CLI, the Code Context Engine, and related technology, and that the team joins Harness. Neither post states a price or a plan for current customers.
Amazon's October posts describe an open-source physical AI toolchain on AWS, wired to NVIDIA Isaac and Cosmos. The sample repo is Apache-2.0, and its status table still marks edge deployment planned.
SQLite busy timeout can wait for a lock to clear, but it may return SQLITE_BUSY immediately when waiting would preserve a transaction deadlock. Design retries around the whole transaction.
A covering PostgreSQL index can supply query columns, yet an index-only scan may still fetch table rows to check visibility. Learn when that happens and what to inspect.
PostgreSQL can change how it plans a prepared query after repeated executions. Inspect custom and generic plans when parameter values have very different row counts.
PostgreSQL prevents certain cross-row anomalies by aborting a Serializable transaction. Applications must replay the entire decision, including its reads.
A preflight SELECT cannot decide whether a concurrent insert conflicts. Design the unique key first, then let PostgreSQL arbitrate each proposed row.
Guix maintainers merged a manual change on 7 October saying the project does not accept contributions written by, or based on code written by, an LLM coding assistant. Supporters call it a stop-gap.
PostgreSQL accepts a CHECK expression that evaluates to NULL. Make optional positive quotas explicit, and pair CHECK with NOT NULL when a value is required.
Azure Speech lets applications choose encoded audio characteristics. Match the codec, sample rate, channels, and header format to the browser or phone pipeline before naming or forwarding the bytes.
Amazon Polly speech marks give timing and UTF-8 byte ranges for synthesized words and sentences. Audio and marks require separate output choices, so a highlighting UI must keep their inputs aligned.
SSML can request a slower, softer or higher voice, but the synthesizer decides how to render it. Design voice prompts around audible outcomes and a usable fallback.
A keypad press arrives as a distinct Twilio WebSocket event in a bidirectional voice stream. Route it separately from speech before turning either input into an application command.
Network audio arrives asynchronously while an AudioWorklet must fill each render block on time. A bounded ring buffer and explicit silence policy turn missing samples into predictable behavior.
Streaming captions need a committed transcript and a replaceable interim suffix. Learn what isFinal, stability, and confidence each say about a result.
Perplexity's model cards describe pplx-embed-v2-late 0.6B and 9B as MIT-licensed ColBERT-style embedders, one 128-wide vector per token, sharing one embedding space.
Weaviate 1.40.0 marks namespaces generally available. A merged pull request says namespaced endpoints return 403 without a license. The notes do not name a plan.
A PLS lexicon can give a voice application a reusable pronunciation for product names. Learn what graphemes, phonemes, aliases, language and alphabet settings actually control.
Google published EmbeddingGemma 2, an open model that maps text, code, images, video, and audio into one 768-wide vector. Developers can load fewer encoders or store a shorter vector.
Stack Overflow's 2026 Developer Survey counts 30,903 valid responses from 169 countries. Coding assistants lead reported AI use, and trust clusters on output people say they can check.
Column order changes how much of a multicolumn B-tree index PostgreSQL must scan. Match the leading columns to the conditions in your queries.
Proof Key for Code Exchange ties an authorization code to a secret the client created. Following that secret through the flow shows why a stolen code is insufficient.
A voice widget can fail before the browser asks for microphone access. Learn how the parent page’s Permissions Policy affects an iframe and how to check each layer.
A chat can carry its own history or ask the API to keep the thread. The choice changes what your application stores, sends, and checks on every turn.
Two tabs can start the same sync at once. Web Locks lets them coordinate the work within one browser, with clear limits for retries and work beyond that browser.
Compare PostgreSQL’s estimated and observed row counts before changing an index. The first useful clue is often where the counts diverge.
A username can have equivalent encodings or resemble another name made from different characters. This explains what Unicode normalization and confusable detection each solve.
An expired OpenAI batch can still contain completed results. Custom IDs let you reconcile those results with failed requests and retry only the work that expired.
Check a GitHub webhook signature against the received request body before accepting work. Then check the event, prevent duplicate jobs, and decide what the payload is allowed to trigger.
A repeated JSON object name can produce different results in different parsers. Here is how to spot the problem and reject it.
A failed application trace can become a repeatable regression case when you preserve the input and define the expected behavior.
A user-supplied URL can make a server contact private services. Here is how server-side request forgery works and how to set safe fetch boundaries.
Metamorphic tests check how answers relate when inputs change. They can reveal faults even when no exact expected answer is available.
A row policy cannot protect tenant data if the application queries through a role that bypasses it. Check table ownership, privileged roles, and views before relying on row-level security.
When generated chunks arrive faster than downstream code can process them, queues grow. Backpressure gives the producer a signal to slow down, if that signal can reach it.
An older tab can leave an IndexedDB schema upgrade waiting. Here is how versionchange and blocked coordinate the handoff, and how to give users a clear way forward.
A chat needs to announce when a reply starts, finishes, or fails. Short status messages can do that without moving focus.
Use a PostgreSQL exclusion constraint to keep active reservations for the same GPU from overlapping. Range bounds and cancellation rules make the schedule explicit.
A STRICT table can keep unexpected types out of local state. Older SQLite versions need attention before you adopt it.
Target a prompt change to a defined group, check who receives it, and watch for regressions before widening the release.
An error identifier deserves a literal search path. SQLite FTS5 can find token and prefix matches, rank the results, and leave strict spelling checks to the stored field.
A response can satisfy two JSON Schema branches and still fail validation. This example shows how overlapping object shapes cause that result and how to make the branches distinct.
Python context variables let asynchronous tasks read a request ID without passing it through every function call. The key is when each task receives its context.
When one task in a Python TaskGroup fails, its siblings receive cancellation requests. The group waits for them and reports the failures together.
Trusted Types and Content Security Policy can make the browser require a reviewed policy before dynamic HTML reaches an injection sink. Here is how to introduce that boundary.
Neon's 2 October 2026 post adds POST /v1/embeddings on AI Gateway, with qwen3-embedding-0-6b at $0.02 and gte-large-en at $0.13 per million input tokens, for vectors stored in Lakebase Postgres.
Cloudflare's 1 October 2026 changelog says workers-oauth-provider v1 can run token issuing and an MCP resource server in separate Workers, with MCP's July 2026 client-metadata flow. npm shows 1.0.0 on 24 September.
Use BroadcastChannel to update open tabs after logout. Keep session invalidation on the server and account for storage partitions and missed messages.
A Web Worker can move browser-side computation away from the interface thread. Here is how to send work, return results, and handle the limits.
The Agents SDK changelog of 2 October 2026 adds PiHarness so a Pi 1.0 agent can keep a turn on a Durable Object. Cloudflare calls the API beta and says Pi Durable is still experimental.
SQLite and PostgreSQL use the same name for incompatible binary JSON formats. Transfer JSON as text and let the receiving database build its own representation.
A list of expected fields does not close a JSON object. Here is how to decide when model-generated objects should reject unknown keys.
JSON Patch paths are evaluated after each preceding edit. Follow array shifts, moves, and tests step by step to see why changing operation order changes the result.
Both PyTorch modes skip gradient recording. Inference mode also changes the tensors it creates, which matters when later code needs autograd.
RFC 9457 gives HTTP API errors a standard JSON shape. Learn which fields clients can rely on and how to define useful problem types.
Stored and virtual generated columns calculate the same kind of value at different times. A usage total shows how to choose between them.
A large HTTP upload can be rejected from its headers before its body is sent. Here is how Expect: 100-continue works and where its limits lie.
PostgreSQL can coordinate workers that request the same advisory lock. The application must decide where to request it and protect work that outlives the lock.
Space-based splitting can put transcript highlights around the wrong text. Intl.Segmenter offers locale-sensitive word boundaries and text offsets.
MCP resource indicators name the server a token is for. Audience checks and separate upstream tokens keep that boundary intact.
A streaming shuffle can choose only from rows it has reached. Buffer and shard shuffling improve the mix, but they do not provide the global reach of an indexed dataset.
A JSON Pointer can resolve successfully while selecting the wrong field. Escape each member name before building the pointer.
A practical cross-site request forgery defense for a cookie-backed AI dashboard, from session tokens to browser signals and rejection tests.
Matching seeds do not guarantee matching results. Reproducing a run also means recording its software, hardware, and algorithm settings.
SQLite savepoints let you undo later work while keeping the surrounding transaction open. Here is how to use one and decide what to commit.
PostgreSQL does not reclaim sequence values after a transaction aborts. That is why generated IDs can have gaps, and why business counters need a separate design.
An agent loop can end when the model finishes or when a limit fires. Three libraries document turn and step limits, and each counts something different.
A partial index over pending jobs helps only when PostgreSQL can tell that the query asks for rows covered by the index.
Chunk size, overlap and boundaries decide what a retriever can return. This post covers defaults documented by Azure AI Search and OpenAI, plus a way to test a setting on your own questions.
Generated Markdown can cross a security boundary when an app turns it into HTML. Here is how to render the answer while keeping text, links, and formatting under control.
A reviewer finds mistakes faster when a diff holds one change, shows moved code as moved, and comes with a clear description. Here is what Google's review guide and the git manual say about it.
Apple says it will add controls so users can grant Full Disk Access only with very explicit action. The post names no macOS version and no date. Here is what developers who ship agents on Mac should check.
Meta published firmware and device SDKs for Muse gadgets under Apache-2.0, with a short list of third-party exceptions. Every gadget still needs a Meta-issued token and the Muse app, and a backend change already broke voice replies.
Some prompts break the day the model underneath changes. The ones that last lean on stable capabilities, and on tests that catch the break early.
How to handle a model response that arrives in pieces. It covers server-sent events, partial JSON, user cancellation, and what is safe to store.
A pipeline, a log tee or a local variable can turn a failed command into exit status 0. Patterns that hide failure from CI and AI agents, and how to make the status tell the truth.
Three ways to get machine-readable output from a model. What JSON mode, strict tool calls and grammar-constrained decoding each guarantee, what they leave open, and how to validate.
A lost checkout response leaves the payment outcome unclear. An idempotency key lets the client retry the same purchase intent without starting another charge.
Cron jobs overlap, CI retries, queues redeliver and AI agents try again when unsure. A practical guide to writing scripts whose second run changes nothing and whose half-finished run can simply be repeated.
The release-note lines that quietly change your build hide in the same places every time. Three lines to scan first.
Vectors, Plainly · Part 6 of 6
The parts tutorials skip: sharding and write freshness, memory and disk-based indexes, where a GPU actually pays off, and the security and compliance questions a vector store raises.
When AI agents send each other messages, the old queueing problems come back with new twists: a message delivered but never read, a duplicate that repeats an action, and a relayed yes that nobody actually gave.
An AI coding session that ends mid-task forgets everything it knew. Five things a handoff note needs so the next session, human or AI, can pick up the work without guessing.
SQLite puts application data, full-text search and, with an extension, vector search in a local database file. Here is where that fits and when PostgreSQL fits better.
Vectors, Plainly · Part 5 of 6
Retrieval-augmented generation is an architecture, and the vector database is one box in it. The whole loop, the RAG variants worth knowing, reranking, and when a knowledge graph beats similarity.
LlamaIndex (Oct 1, 2026) shipped Extract v2.5: schema-based document extraction agents with Advanced Citations on Agentic and Agentic Plus, same per-page pricing, and native spreadsheet mode.
turbopuffer made native embedding generally available (Sep 29, 2026): embed on write, on query, or keep BYOE. Systems overlap with index metadata fetch; Linear/Readwise beta color is vendor-stated.
Weaviate v1.39.3 (Oct 1, 2026) fixes a High CVSS 7.1 credential disclosure in text2vec-google, multi2vec-google, and generative-google. Impacted: < v1.39.3. CVE pending MITRE assignment.
AI Search generally available (blog Oct 1, 2026). Billing starts November 1, 2026; free tier remains. Blog pricing: ingestion $0.75/1M + image +$0.50/1M; storage $2/GB-mo; semantic $0.75/1k · full-text $0.10/1k. Qwen3-VL-Embedding; OCR; files to 10 MiB. Video/audio = roadmap not GA.
A practical way to turn real user examples into graders, regression tests, and model-update reviews.
Same-day Sep 30, 2026: Voyage ships rerank-3 and rerank-3-lite (“available today”, with no GA claim). MongoDB Atlas Native Reranking via $rerank is Preview only (docs). The Voyage and MongoDB lift claims are theirs. Separate from Atlas Agent Engine, and neither is a Vector Search substitute.
WebRTC is built for live media; WebSockets stream audio as ordered messages. Here is how the transport choice affects latency, loss, browser audio, and deployment.
Cohere GA’d Embed 5 (2026-09-30): embed-v5.0-pro / embed-v5.0-fast share one space (index Pro → query Fast). Blog pricing $0.12 / $0.08 per 1M text; image $0.40 both. 128K, Matryoshka dims, multimodal—ViDoRe/finance benches are Cohere-reported.
Vectors, Plainly · Part 4 of 6
Retrieval quality is decided by the embedding model, the dimensions and the chunking, and it is only known once you measure recall. How to choose, how to test, and where vector search earns its place.
A practical guide to server-sent events, WebSockets, provider event streams, tool calls, disconnects and buffering in AI applications.
Perplexity published open-weight pplx-embed-v2-context-9b-preview on Hugging Face (MIT): contextual chunk embeddings for RAG. Preview may break; not on Perplexity API yet. Use encode_queries vs encode; int8 + MRL 1024/2048; transformers≥5.4 + trust_remote_code.
The model proposes; the harness executes, remembers, and gates. Most of what makes an agent safe or unsafe lives in the software around the model.
A practical guide to JSON mode, schema-constrained output, and tool calling, with the limits that still require validation in your application.
Prompt injection can arrive in a user prompt, web page, file, email or tool result. Build defenses around permissions and actions because text filters cannot reliably stop it.
Vectors, Plainly · Part 3 of 6
A vector index has no row-level security by default, and a missing filter leaks data without an error. The isolation levels, what each engine offers, and how to lay out collections, namespaces and metadata.
At DevDay 2026 OpenAI turned Codex cloud from one throwaway sandbox per task into published setups with saved per-task state. What changed, what it costs you, and what it still cannot do.
Compare hosted APIs with models you run yourself, then choose dimensions, language and context length against your own retrieval workload.
Vectors, Plainly · Part 2 of 6
How HNSW graphs, IVF cells and product quantization make nearest-neighbour search fast, and how filters, keyword fusion and reranking change what a query returns.
A practical map of speech recognition, language models, speech synthesis, direct speech-to-speech models, streaming, and the latency measurements that matter.
Vectors, Plainly · Part 1 of 6
A vector database answers “what is closest in meaning to this?” instead of “which rows match?”. Here is the machinery: embeddings, distance, and why you never design the fields.
The context window is a working memory, not a perfect one — accuracy fades as it fills, and "just give it more text" quietly stops working.
An inside look at why AI systems switch between models — the cost-saving chooser everyone talks about, and the failover path that's where outages actually hide.
Google's antigravity-preview-09-2026 brings Antigravity coding-agent tools to the Gemini API on Gemini 3.8 Flash, with new APIs to move files in and out of the sandbox and keep secrets away from the model.
OpenAI’s Agents API (public beta since 2026-09-10) exposes a managed Codex harness via sessions, MCP, subagents, and sandboxes. Billing = model + tool + container rates. US residency only; not ZDR-eligible even with self-hosted.
OpenAI removes Videos API and all listed sora-2* aliases on 2026-09-24. Deprecations table shows no replacement. Consumer Sora ended April 26.
