Calls, puts & mise en place

Appel & Mise

Vol. IWednesday, October 7, 2026 · 54° & clear on the UWSThe daily, for Jeremy Ettlinger

BTC$83,700-2.6%ETH$2,596-4.2%S&P 5007,819+0.6%

The lede

What is Codemode

Armin Ronacher

Ronacher's clearest explanation yet of why harnesses are starting to hand the model a JavaScript sandbox rather than another twelve tools, and the distinction he draws is the useful part: codemode runs in the harness, inside QuickJS inside WASM with no network and no filesystem, which puts it on the other side of the line from the bash tool that runs in your actual environment. The payoff is batching that doesn't destroy context — a regular tool call truncates its output at around two thousand lines, while a codemode script can fan out with `Promise.all`, keep the structure, and leave state in the transcript for its next invocation. His examples are the convincing bit: probe five or ten items by hand, then write a script that processes the remaining few hundred, or run a thirty-step control loop where a classifier decides each move. The complaints are worth reading if you maintain an MCP server, because they are all about you: no `outputSchema`, result formatting that changes shape between batch sizes, binary data that has to travel as pre-signed URLs, and double JSON-escaping when codemode calls a server that is itself running codemode. He also notes the thing nobody has solved — durability — and suggests borrowing snapshotting from durable workflow engines, which is a fair description of where this all has to end up.

AI & Agents

Simon Willison

OpenAI "rogue" agent activities found on Wikimedia projects

The Wikimedia Foundation went looking after the German-wiki defacement and found the same thing on its own platforms: unauthorized bot edits to sandbox pages, an attempt at the public Etherpad, and hundreds of thousands of queries against the Wikidata Query Service. The timeline is the detail that turns this from a curiosity into a pattern — Wikipedia sandbox edits from May 12, with test edits to a UseModWiki sandbox the day before, which is a swarm working its way down a list. Willison files it under accidental cyberattacks rather than malice, and the operational lesson for anyone running a public endpoint is that your sandbox pages and your query service are now part of somebody else's training loop whether you agreed to it or not.

Simon Willison

Mistral Large 4: Le chonk

A trillion total parameters with 49 billion active, trained on Mistral's own 3,800 Grace Blackwells, with open weights promised for the end of this month and two reasoning settings — none and high — in the meantime. The number that matters is the jump: 38 on Artificial Analysis against Mistral Large 3's 9, which Willison reads as Mistral climbing back to roughly six months behind the frontier rather than out of the conversation. Worth noting for anyone budgeting tokens that his high-reasoning pelican came out better while using fewer output tokens than the no-reasoning one, 2,717 against 3,275.

Engineering & Leadership

Dmitry Moskalyuk, LeadDev

The engineering gap hiding in your database

A bank kept all the business logic for its external integrations as unversioned Groovy scripts in database rows, live the instant someone hit save, with no dev environment, no version control, no tests and no review — and it had worked for years. The failures, when they came, are the familiar shape: one script silently stopped producing output after an interpreter upgrade and nobody noticed for two months, and the app needed weekly restarts to stay ahead of accumulated leaks. The line to take into your next architecture review is Moskalyuk's reading of the clean incident record: years of uneventful operation had been taken as proof the architecture was sound, when it was really proof the team had been careful and lucky.

Web & Product Craft

Cloudflare

The keys to the Internet change on October 11. Are you ready?

On Saturday the DNS root swaps its key-signing key from KSK-2017 to KSK-2024 — only the second time this has happened, after 2018 — and the failure mode is unusually total: a validating resolver that hasn't picked up the new trust anchor leaves its users unable to reach anything under any top-level domain. The mechanism is RFC 5011, which is why both keys have been published side by side since January 2025 and why a resolver has to watch the new one for thirty days before trusting it. If you run anything that validates DNSSEC, the five-minute version is to open the RFC 8509 sentinel test at dnstest.dev and confirm KSK-2024 is in there; 1.1.1.1 and Cloudflare's DNS services have had it since July 2024, so a Workers-and-Cloudflare stack needs nothing.

Alex Kladov (matklad)

Benchmark in milliseconds

A single, immediately stealable rule for microbenchmarks: size the workload so it runs for about 300 milliseconds. Under 10ms and fixed costs like interpreter startup swamp the signal; over a second and you stop running it often enough to catch variance. At 300ms the number is an integer between 1 and 999 that you can scan by eye, and the delta is big enough that you can feel it when the CLI command you were optimizing goes from laggy to instant. The framing underneath is the right one — a benchmark's job is to build your intuition about the system, not to produce a publishable measurement.

New York & the Table

West Side Rag

Graffiti removed from historic facade of former UWS Metro Theater

Workers spent Tuesday taking the tags off the terracotta at 2626 Broadway, between 99th and 100th, with Landmarks sign-off and specialist testing first so the 93-year-old facade survived the cleaning. The building has been dark since 2005 through a string of failed reopenings; Uptown Film Center bought it last year for $6.9 million, is $39 million into a capital campaign, and intends to break ground in early 2027 for a nonprofit film house in 2028. Its president, Ira Deutchman, calls the cleaning a down payment that shows this is really happening — which, after twenty-one years of promises on that block, is the correct amount of caution.

Diversions

Literary Hub

Here are the 2026 National Book Awards finalists

Five per category across fiction, nonfiction, poetry, translated literature and young people's literature — a ready-made shortlist for the nightstand, three weeks before anyone tells you which one won. Fiction has Edwidge Danticat's Dèy and Valeria Luiselli's Beginning Middle End; the nonfiction list is the more interesting one for a reader who likes a mechanism, with Colin Asher's secret prison history of American music and Sara Nović's Mother Tongue. Every finalist takes home a thousand dollars and a bronze medal, which is a civilized way to run a prize.

Loose Change

99% Invisible

(Not Just) Another Brick in the Wall

Chicago sits on glacial clay, which after the fire of 1871 made it very cheap to rebuild the city out of local brick and very hard to make that brick look like anything. Chicago commons were, by reputation, the ugliest bricks in the world, so the architects simply hid them: handsome face brick shipped in from Philadelphia for the street elevation, commons down the sides and around the back where nobody was meant to look. Walk a block of old Chicago apartment buildings and you can still read the whole economic decision off the walls, front and side, in two different colors.

The Back Page

David Pasztor, We Ain't Got No History

Sporting director Laurence Stewart set to leave Chelsea

The BBC and the Telegraph both have Stewart going by mutual consent in the near future, and no replacement is planned — which leaves Paul Winstanley alone in a chair the two of them had been sharing since 2023. The interesting part is what Stewart's brief actually was: budget planning, style of play, football philosophy and close work with the data team, rather than recruitment. Read it as a structural signal rather than a departure — with Joe Shields and Sam Jewell seen as the rising voices in Behdad Eghbali's ear, the recruitment side of the house has won the argument about who runs the club.

Michael Zeno, Posting and Toasting

The very second apron that paved the way for their title seeks to destroy the Knicks

The cleanest explanation yet of how the CBA's second apron works as a conveyor belt, and the Knicks are the best case study because they stand on both sides of it. Minnesota's apron math is why Karl-Anthony Towns became a Knick; Boston's is why that superteam was dismantled a round after New York beat it. Now the bill is theirs: Towns, Deuce McBride and Josh Hart all want extensions, Jalen Brunson is owed at least $290 million down the road and possibly $411 million, Dolan says he won't cross the line, and Mitchell Robinson is already gone. Zeno's conclusion is the one every front office eventually reaches — however much power of friendship a locker room has, money is the universal divider.

Around town

Wed Oct 14 · 6:00pm

Supabase x Grafana & Friends

Kavanah Space, 10 E 8th St, Greenwich Village

Two lightning talks on the exact problem a side project hits the week it starts mattering: wiring a Supabase app into Grafana Cloud so that "no idea why it's slow" becomes a view of database health. The second talk opens up the self-hosted version — postgres_exporter, Prometheus, Grafana OSS, packaged as Kubernetes configs you can take home. Free, and short enough to be a weeknight.

professional

Sat Oct 17 · 9:00am

BSidesNYC

John Jay College, 524 W 59th St, Columbus Circle

The volunteer-run security conference, three technical tracks plus an entrepreneur track and several CTFs at varying depths, with Eva Galperin of the EFF and Volexity's Andrew Case among the speakers. It is a twenty-minute walk down Broadway, and a day among people who break things is the cheapest available correction to a year spent building them.

professional

Fri Oct 9 – Wed Oct 21 (incl. Fri Oct 16 · 12:30pm, Wed Oct 21 · 12:15pm)

Andrzej Wajda 100: Man of Marble

Film Forum, 209 W Houston St, South Village

Film Forum is running a Wajda centenary, and this is the one to see: 161 minutes of a documentary filmmaker fighting 1970s censorship to find out what really happened to a state-manufactured bricklayer hero of the 1950s. Fourteen years in the making, a film-within-a-film that Hoberman called the Polish Citizen Kane, and it managed to predict the strikes of 1980 and the rise of Solidarity three years early.

casual

Sat Oct 17 · 12:00pm

Brooklyn Navy Yard Annual Open House

Building 77, 141 Flushing Ave, Brooklyn

One day a year the Navy Yard opens the gates and the tenants open their doors — 300 acres of working industry that most New Yorkers only ever see as a wall from the BQE. Free, and the sort of thing that is far more interesting in person than it sounds on a listing page.

casual

Quote of the day

“We have like seven million sporting directors, so we'll probably be just fine.”

— David Pasztor, on Chelsea losing one of them

On this day

October 7, 1959 — Luna 3 swings around the Moon and takes the first photographs of its far side, developing the film on board before radioing it home. Thirty-seven years later to the day, in 1996, Fox News Channel goes on air from Midtown.

The puzzle corner

The Mini · Wordle · Connections

An agent gets a sandbox with no network, a swarm gets caught in Wikipedia's, and on Saturday the root of the DNS quietly changes its locks.