No. 11 Saturday 24 October Game dev, software and AI

Agents take the chores

DoorDash lets agents clean up stale feature flags for under $5 each. A study finds agents trust an outdated CLAUDE.md over your code, and one sentence fixes it. Plus a 2D look built in Unreal and a free GameMaker runtime.

The short version

  • Software and AI DoorDash's agents removed 45 of 50 stale feature flags with engineer-approved pull requests, at an average of $4.79 and 13.8 minutes each.
  • Software and AI When CLAUDE.md or AGENTS.md disagrees with the code, agents followed the file in 90% of choices. One sentence in your user-level file turns that around; today's Try this adds it.
  • Software and AI Vercel shows how its agent asks for production access once per plan, and a ClickBench entry was pulled for answering 43 known queries from hand-written kernels and caches.
  • Games and software The Brotli bug behind Node's last patch also hits Python, Bun, Envoy and Istio, and common audit tools miss it.
  • Game dev Gameloft explains Bluey's flat 2D look in Unreal Engine 5, GameMaker's new runtime goes free for commercial games in 2027, and Epic dropped its AI-is-mandatory jam rule.
Software and AI Lesson

DoorDash hands stale feature flags to a team of agents

DoorDash built a team of AI agents that remove old on/off switches from its code. Engineers approved the result for 45 of 50 switches, at about $5 and 14 minutes each, where a person needs one to two hours.

ContextFeature flags are switches in code that turn a feature on for some users. Once a feature has fully launched, the switch and the code behind it are dead weight.

Architecture diagram: an orchestrator agent queries Jira, an experimentation platform MCP and GitHub to write a report; after engineer verification, parallel cleanup agents each edit, test, check coverage and lint, then open a pull request.
Image: Chandratre and Datar, DoorDash (arXiv)

DoorDash has over 56,000 flags across about 623 repositories; 1,659 were stale in May and about 2,300 new ones appear each month. Rule-based cleanup tools did not fit its code, so the team built a two-phase agent system and wrote it up for the ICSME 2026 industry track.

First, an orchestrator agent reads the cleanup ticket, asks the experimentation platform through MCP which value each flag actually settled on, finds every reference and writes a report. An engineer confirms it. Then one removal agent per flag works in its own git worktree, up to four at once per repository, and must pass build, tests, 95% patch coverage and the linter before it opens a pull request to the flag's owner.

On 50 stale flags, 31 were accepted first time, 14 after small revisions and 5 failed. CI passed on the first attempt for 44, and all six first-time failures were coverage gaps, not wrong code. The figures are the authors' own, from one company's Kotlin repositories.

$4.79average cost per flag removed (authors' figure)

Technical details

The orchestrator runs on Claude Sonnet 4.6 and the removal agents on Claude Opus 4.6: a cheaper model plans, a stronger one edits. Each removal agent deletes the flag definition, its wrapper and call sites, updates tests, then loops on build, tests, JaCoCo patch coverage of at least 95% and Detekt until they pass.

Simple flags succeeded 6 of 6, medium 17 of 18 and complex 22 of 26. Of the revised pull requests, several had missed a dead variable or reference deep in a call chain, which the agent fixed when asked. The authors say early runs without worktree isolation corrupted each other's changes, and that asking production for the real flag value beat letting the agent guess it.

Why it mattersThis is agent work with a clear finish line: a deterministic check list decides when an edit is done, and a person signs off before and after. Most codebases have a backlog of the same shape, such as dead config or deprecated calls.

For youThe same shape fits your SaaS repos and plugin code: one subagent per cleanup task in its own worktree, real state fetched through MCP or a CLI, and build, tests and lint as the gate. Start with deprecated engine API calls in a plugin.

Feature flags
Switches in code that turn a feature on or off for some users without a new release.
orchestrator
The agent that plans the work and hands pieces of it to other agents.
MCP
Model Context Protocol: a standard way for AI agents to discover and call tools and data sources.
git worktree
A second working folder for the same repository, so two changes can be made side by side without touching each other.
patch coverage
The share of the lines a change touches that the tests actually run.

Sources Paper (arXiv, ICSME 2026 industry track)Full text (HTML)

More like this Less like this

Agents doing the chores

Stale instruction files, production keys and the shape of a long-running agent.

Software and AI Lesson

Agents obey an old CLAUDE.md over your code

When a project's instruction file says one thing and the existing code does another, coding agents follow the outdated file. One sentence in your own settings file flips that.

90.1%of choices followed the stale file

91.4%followed the code with one sentence

In 320 runs on 40 small Python projects, Claude Code flagged the conflict in 79 of 80 runs and followed the file anyway. Codex CLI rewrote working code to match the file 20 times, breaking tests in 17. With the sentence, no rewrites happened and every test passed.

Technical details

The authors' explanation: the instruction file reaches the model as an instruction, while code it reads arrives as tool output, which models are trained to rank lower. The sentence goes in the user-level file (~/.claude/CLAUDE.md or ~/.codex/AGENTS.md), so it applies to every repository. Runs used Claude Code 2.1.302 with Sonnet 5.5 and Codex CLI 0.163.0 with GPT-6 Sol. The projects were synthetic, so treat the size of the effect as an estimate.

Why it mattersInstruction files rarely get updated, so every repository drifts. This fix needs no audit of old files: it tells the agent which source wins.

For youYou keep CLAUDE.md files in many repos and plugins; some are surely stale. Add the sentence to your user-level file today (see Try this).

CLAUDE.md
A file of standing instructions that Claude Code reads at the start of every session; AGENTS.md plays the same role for other agents.

Sources Paper (arXiv)

More like this Less like this

Software and AI Lesson

Build long-running agents like actors, not loops

A QCon AI talk argues that agents in production are long-lived, stateful programs that fail in pieces, so they should be built from small actors that own their state and talk only by messages.

Manju Rajashekhar of Mad Labs demoed a minimal coding agent as four actors in Rust: a supervisor, the model, a tool registry and the agent itself. Chat turns, tool results and cancellations are all just messages.

  • One owner per piece of state.
  • Write state through as you go, so recovery is just resuming.
  • A task records its next step instead of blocking and waiting.
  • Every failure stops at a supervisor boundary.

Why it mattersRetries, timeouts and half-finished tool calls are distributed-systems problems. Treating them that way from the start beats patching a single loop later.

For youYour long-running automations are exactly this shape. When one gets flaky, model it as a supervisor plus workers before adding more retry code.

actors
Independent units of a program that each keep private state and communicate only by sending messages.
supervisor
An actor whose job is to watch others and restart them when they crash.

Sources InfoQ presentation

More like this Less like this

Software and AI Lesson

Vercel's agent asks for production access once per plan

Vercel explains how its AI agent fixes live sites safely: it investigates with read-only access, writes a plan that lists the access each step needs, and asks the user to approve the plan once instead of every click.

Approving every single action trains people to click yes without reading. Vercel ties permission to a plan the user can review as a whole.

Approval can never grant more than the approving user already has. GitHub access is a separate credential for one repository, with its own approval.
Technical details

The read-only baseline is every registered scope starting with read:. Before using a credential, the runtime reloads the stored plan and checks that it is still active, and a stop request wins if it arrives before approval is recorded. A shared scope registry rejects invalid scope names while the plan is drafted.

Vercel lists the gaps itself: scopes are coarse for actions that touch several resources, and read-only access can still expose sensitive data, so plans sit alongside sandboxing, network policy, rate limits and audit logs.

Why it mattersAny agent that touches production needs a permission model people will actually read. A plan with scopes per task is a pattern you can copy for your own automations.

For youYour unattended routines hold broad keys. Copy the plan idea: let a run read freely, then write a plan file naming what it wants to change, and only then hand it a scoped key.

scopes
Named permissions, such as reading deployments or redeploying, that a token can carry.
token
A temporary key that proves what a program is allowed to do.

Sources Vercel blog

More like this Less like this

Check before you trust

A patch with a long tail, vendor scores, a benchmark that memorised, the week's updates.

Games and software Do this

The Brotli bug behind Node's patch reaches Python, Bun and proxies

ContextBrotli is a compression format web servers and browsers use to shrink pages. Node's October 21 security release fixed it as CVE-2026-111497.

A memory bug in the code that unpacks Brotli-compressed web traffic, fixed in Node this week, also sits in Python packages, Bun and popular proxies, and common audit tools do not flag it yet.

A crafted compressed stream can write past a buffer. It works both ways: a malicious server can hit a client, and a malicious client can hit a server that unpacks request bodies.

  1. Update the runtimes

    Node 22.23.4, 24.22.1 or 26.12.1; Bun 1.4.4, then rebuild compiled binaries; Envoy and Istio to their latest patch releases.

  2. Check Python

    Run pip show Brotli brotlicffi. Brotli 1.2.0 and earlier is affected; upgrade to 1.2.1 or brotlicffi 1.2.1.0. requests, httpx, aiohttp and Scrapy load it automatically when installed.

  3. Do not trust the scanner yet

    As of October 23, Aikido reports that pip-audit, Dependabot and Safety did not flag these versions. Check images and lockfiles by hand.

  4. If you cannot upgrade

    Reject inbound requests with br in Content-Encoding at the proxy, and drop br from outgoing Accept-Encoding while rejecting br responses.

Why it mattersCompression is on by default almost everywhere, so a bug in the decoder reaches far beyond one runtime. A clean audit report is not proof here.

For youCheck the Python tooling and Docker images around your Node and Supabase apps, not just Node itself.

Brotli
A compression format that web servers and browsers use to make pages smaller to send.
proxies
Servers that sit in front of other servers and pass traffic through, often unpacking it on the way.

Sources Aikido analysisNode.js 26.12.1 release

More like this Less like this

Software and AI Release

Kimi K3.1 Pro nears the top agent models, with open weights promised

Moonshot's new Kimi model scores close to the leading models on a coding-agent test, costs about half as much as Claude Opus 5.5, and its makers say the weights will be public by November 4.

Terminal-Bench 4.0, a test of agents doing tasks in a terminal. Scores are Moonshot's own, with every model at maximum thinking effort.

Independent check: Artificial Analysis scores it 55, behind only Opus 5.5 at 58 (via Simon Willison). Price: $2 per million input tokens and $10 per million output; a Highspeed version runs 2 to 3 times faster at twice the price.

Why it mattersIf the weights ship as promised, a near-frontier agent model becomes something you can host yourself. Until then, treat the chart as a vendor claim.

For youWorth a cheap side-by-side on one of your agent tasks through an OpenAI-compatible endpoint; Vercel's AI Gateway already lists it.

weights
The trained numbers that make up a model; open weights means anyone can download and run it.

Sources Kimi blogSimon Willison

More like this Less like this

Software and AI News

A database topped a benchmark by memorising its queries

The ClickBench database benchmark removed an entry after its maintainer found it shipped hand-written code for each of the test's 43 queries and answered repeat runs from a cache.

10.8 squery 20, first run

11 mssame query, second run

After a restart it was back to 11.2 seconds, and a slightly changed query was refused as not served. These are the maintainer's findings in the pull request; the answers themselves were correct.

Why it mattersA benchmark measures what it can see. Change the inputs a little and rerun cold before trusting a headline number, whether a person or an agent produced the code.

For youKeep this in mind when an agent reports a dramatic speedup on your own code: rerun cold and with changed inputs before you believe it.

benchmark
A fixed set of tests used to compare the speed or quality of different systems.

Sources ClickBench pull request

More like this Less like this

Software and AI Release

Shipped this week: monitors on every cloud, usage by client, budgets from the CLI

Small updates to Claude Code, GitHub, Vercel and Claude Managed Agents that change daily setups, mostly around limits and visibility.

From the release notes, October 20 to 23.

  • Claude Code 2.1.310

    The Monitor tool now works on Bedrock, Vertex and Foundry. Windows PreToolUse and PermissionRequest hooks no longer let a call through when Git Bash is missing. /sandbox names Ubuntu's AppArmor restriction when the sandbox will not start.

  • Claude Code cleanup fix

    Background cleanup no longer deletes recent files such as pasted images when cleanupPeriodDays is set very high, and read prompts now show where a symlink leads.

  • GitHub usage metrics by client

    Copilot usage reports gain totals_by_client, naming tools such as claude_code, codex and opencode with requests, sessions and tokens. GitHub calls it best-effort grouping, not verified identity.

  • Vercel budgets from the CLI

    vercel budgets set --amount <dollars> --pause sets a spend cap that pauses production deployments at 100%. Without --pause it only alerts. Needs the Owner or Billing role.

  • Managed Agents fetch rules

    web_fetch now obeys the organisation's domain restrictions as well as each agent's own allow and block lists, including after redirects.

Why it mattersThe Windows hook fix closes a quiet gap: a guard hook that silently allowed calls. The usage and budget changes make agent spending visible before the bill does.

For youUpdate the machines that run your routines, and put a paused budget on any Vercel team an agent can deploy to.

hooks
Scripts that Claude Code runs before or after a tool call, often to block risky actions.

Sources Claude Code v2.1.310GitHub changelogVercel changelogClaude Platform release notes

More like this Less like this

Looks, licences and jams

A flat look in a 3D engine, a free runtime and a rule rewritten.

Game dev Lesson

How Gameloft made Bluey look hand-drawn in Unreal Engine 5

The Bluey game keeps the show's flat, cartoon look in a 3D world by building each character from flat layered cards, painting them with resolution-free textures, and drawing outlines in a custom shader.

A screenshot of Bluey's Happy Snaps: flat cartoon dog characters standing in a 3D bush path with layered ferns and rocks.
Image: Gameloft Brisbane, via 80 Level

Gameloft Brisbane told 80 Level that the look took months of research and several rebuilt pipelines. Lighting is baked into the textures; there is no dynamic lighting. The outline shader and the character rigs were among the biggest performance costs on low-end consoles.

  • SDF textures give crisp vector-like edges and save texture memory.
  • Eyes are drawn entirely in the shader with SDF curves.
  • Outlines keep the same thickness at any distance; vertex colours say where they appear.
  • Characters are authored at 8 angles, 45 degrees apart, animated with Control Rig.
Technical details

Hands, feet and mouths share textures and geometry across characters, mixing geometry with SDF flip books. The SDF maps use RGBA channel masks built in Photoshop and Substance Designer and assembled in Maya, which needed a custom preview material. Outlines were tried as post-process, then as inverse-hull geometry, before a custom shading model that simulates inverse hulls in real time. The game ships on PC, PlayStation, Xbox, Switch and Switch 2.

Why it mattersStylised games often fight the engine to stay flat. This is a tested recipe for a 2D look in a 3D engine that still runs on Switch.

For youSDF eyes and a constant-width outline are both packageable as material functions: a possible small Fab product, or a style option for your action RPG.

SDF textures
Textures that store the distance to a shape's edge instead of colours, so edges stay sharp at any size.
shader
A small program on the graphics card that decides the colour of each pixel.
Control Rig
Unreal Engine's tool for building animation controls on a skeleton inside the editor.

Sources 80 Level interview

More like this Less like this

Game dev News

Epic's AI jam drops its AI-is-mandatory rule

ContextThe AI MegaJam is a four-day Unreal Engine game jam with a $65,000 prize pool, first announced on October 22.

Epic's AI MegaJam first said entrants had to use AI. After a backlash on social media, Epic called that a mistake the same day: use as much or as little AI as you like.

What changed and what is coming, from Game World Observer's report.

  1. Epic announces the jam; its FAQ says AI use is mandatory. Critics say it presents generative AI as required for fast development, and a six-fingered hand on the poster draws mockery.

  2. Epic says the wording was a mistake. AI is now optional, in any amount.

  3. Theme revealed.

  4. Online jam on itch.io, in Unreal Engine or UEFN.

  5. In-person event in San Francisco with people from Anthropic, Google and OpenAI.

Why it mattersJams are where many developers first meet a tool. An optional rule keeps this one open to people who want to compete without AI.

For youYou can enter fully AI-first or not; the rule change does not affect setting up agents and MCP servers before November 12.

UEFN
Unreal Editor for Fortnite: a version of Unreal for building games inside Fortnite.

Sources Game World Observer

More like this Less like this

Game dev News

GameMaker's new runtime goes free for commercial games in 2027

ContextGameMaker is the 2D engine behind Spelunky, Deltarune and UFO 50. GMRT is its next-generation runtime, the part that ships inside your game, still rolling out in beta.

From January 1, 2027, you can sell games made with GameMaker's new runtime on desktop, mobile and web without buying a Professional licence. Consoles still need the Enterprise tier.

What you need to sell a game, by runtime, as reported by PocketGamer.biz.

New runtime (GMRT) Current runtime (GMS2)
Sell on desktop, mobile, web Free from January 1, 2027 Professional licence, as now
Source code Open to every tier Professional licence holders gain access
Consoles Enterprise licence and approved developer status Enterprise licence and approved developer status
Licence prices Unchanged Unchanged

The cost of shipping a commercial 2D game on GameMaker drops to nothing outside consoles, and the engine's runtime is open to read and adapt.

Why it mattersEngine choice for small 2D and mobile games just got cheaper, and having the source makes porting and debugging less of a black box.

For youWorth a look for quick 2D mobile or web side projects, next to your three.js stack; the source access helps if you ever need a custom platform target.

runtime
The part of an engine that ships inside the finished game and runs it on the player's device.

Sources PocketGamer.biz80 Level

More like this Less like this

Learn one thing

What is a feature flag, and why do old ones cause trouble?

A feature flag is a switch in code that lets a team turn a feature on for some users without shipping a new version. Once the feature is fully on, the switch and its unused branch become dead code nobody dares delete.

Think of it like thisIt is like the temporary signs and cones on a road under repair. Useful during the work, but if nobody removes them afterwards, drivers keep slowing down for nothing and one day someone moves a cone by mistake.

Teams use flags to roll a feature out slowly, to run experiments that compare two versions, and as kill switches when something goes wrong. Each one adds an if-statement: one path for on, one for off.

When the experiment ends, someone has to pick the winning path, delete the other one and remove the flag. That cleanup is boring, so it piles up. Old flags make code harder to read and can quietly switch dormant code back on.

Removing a flag safely means knowing the value it really settled on in production, finding every place it is used and proving nothing broke. That checkable, repetitive work is why today's lead hands it to agents.

The step teams skip is the last one, and that is where stale flags come from.
kill switches
Flags kept so a team can turn a feature off instantly if it causes problems.
dead code
Code that can no longer run, or whose result is never used.

Try this today

Software and AI 15 minutes

Tell your coding agent that the code wins over a stale CLAUDE.md

In fifteen minutes your agent will stop copying outdated conventions from instruction files and will tell you where those files are wrong.

You needClaude Code or Codex CLI, and a scratch folder.

  1. Add the sentence

    Paste the sentence below into your user-level file: ~/.claude/CLAUDE.md for Claude Code, ~/.codex/AGENTS.md for Codex. The study tested it there, not in project files.

  2. Plant a conflict

    In a scratch project, write a CLAUDE.md that says to use print for output while the existing code uses the logging module.

  3. Ask for a small feature

    Ask the agent to add a function that reports something, so it has to choose between the two styles.

  4. Compare

    Run it once with the sentence and once with it commented out, and compare the new code and the final reply.

When a repository's documentation and its existing code disagree, follow the conventions used in the existing code, and in your final reply point out each inconsistency you found between the documentation and the code.

You know it worked whenWith the sentence, the new code uses logging like the rest of the project, and the final reply lists the mismatch between CLAUDE.md and the code. Without it, the agent usually writes print.

For youAdd it to your global CLAUDE.md, then watch the next few runs in older plugin repos for the inconsistency lists: they are a free audit of stale project files.

user-level file
An instruction file in your home folder that the agent reads in every project, on top of each project's own file.

Sparks

What is catching on right now, and the idea worth borrowing from each.

The lab

Research from the front line, in plain words: what it solves, how, and what you could do with it.

Game dev PreprintarXiv preprint

A learned controller chooses which of 194 muscles to fire, and a GPU solver bulges and stretches the body to match, at 18 ms a frame.

RLMuscle: Muscle-Driven Character Animation via Reinforcement LearningChunlei Li, Siyuan Yu, Yang Gao, et al.

Four renders of a full-body muscle model, labelled walk, kick, swim and squat, with active muscles highlighted in blue.
Image: Li et al. (arXiv)
The problem
Getting muscles to bulge and slide realistically means artists specify activations by hand, which is slow and not physically guaranteed.
The idea
A reinforcement learning controller finds muscle activations that track a reference motion, using a fast 1D muscle model, then a 3D volumetric simulation with the same muscle law produces the final deformation. Measured muscle signals push it toward realistic choices.
The result
A 194-muscle body runs at 18 ms per frame on one RTX 4090 across walking, kicking, swimming and squatting. The abstract gives no comparison against a baseline.
Use it
Too slow for shipping games, but a way to bake secondary muscle motion for hero characters offline, and a reference for muscle constraints in an XPBD solver.

For youA reference if you ever add flesh or muscle secondary motion to your combat animations; bake it, do not run it live.

More like this Less like this

  1. Idea
  2. Prototype
  3. Code released
  4. Shipping

ReadPaper (arXiv)Project page

Software and AI PreprintarXiv preprint

Double-check a coding agent only when a small judge is unsure, and you keep most of the gain for about a tenth of the extra cost.

SWE-VERIFIER: Selective Verification for Cost-Efficient Coding AgentsKaijian Zou, Vaibhav Chennareddy, Yunxiang Zhang, et al. (University of Michigan, UT Austin)

The problem
Sampling and checking several candidate actions at every step makes coding agents better but multiplies what they cost to run.
The idea
A 4B-parameter verifier scores the agent's first proposed action. Only when the score falls below a threshold does the agent sample alternatives, which the verifier then ranks.
The result
On SWE-bench Verified with MiniMax-M2.7, the resolve rate rose from 75.47% to 77.20% at 1.09 times the cost, checking 3.43% of steps. Checking every step reached only 76.40% at 2.26 times the cost, and self-verification 75.27% at 3.35 times.
Use it
Spend extra compute where a cheap check is unsure, not everywhere. The same gate idea works in a harness hook: run the expensive review only when a fast score flags a step.

For youA pattern for your subagent setups: a cheap gate that decides when to call the expensive reviewer.

More like this Less like this

  1. Idea
  2. Prototype
  3. Code released
  4. Shipping

ReadPaper (arXiv)Code

Also moving

This week on Toa Radar

Read the weekly summary: The week agents got fences and rulebooks
Tune mode is on in this browser. Turn it off