Fable holds only for Willison, Opus 4.8 only in Claude Code, map only as ASCII

TL;DR

• Claude Fable cost $149.25 across 37 prompts to ship sqlite-utils 4.0rc2 under Willison’s own review.
• Claude Opus 4.8 and Sonnet 5 inject Claude-Code-native fields like old_string into third-party edit schemas.
• Anthropic’s fix is a strict: true flag that bans recursive schemas and caps harnesses at 20 tools.
• Iwo Kadziela compresses a world map to 445 bytes decoded by a browser-native DecompressionStream.
• Cartographers flag broken geography in the map — no Suez, Spain fused to Africa, phantom Congo lake.

Three unrelated AI-tech reads today, but they rhyme. Simon Willison’s $149.25 receipt for shipping sqlite-utils 4.0rc2 with Claude Fable is the cleanest agent-maintenance worked example so far — and he’s careful to note it only pencils out because he’s maintainer, reviewer, and arbiter on his own repo. Point the same pipeline at strangers’ code and you get the Jazzband and curl-bounty burnout the post closes on.

The other two ships repeat the pattern in different registers. Claude Opus 4.8 edits third-party files by inventing the field names it learned inside Claude Code’s own harness — Anthropic’s mitigation, a strict: true flag, ships with its own 20-tool ceiling. And Iwo Kadziela’s 445-byte world map decodes beautifully in the browser but only if you don’t need a Suez Canal or a Spain that isn’t fused to Morocco. Each demo is honest inside its authoring context; each frays the moment the context changes.

Willison ships sqlite-utils 4.0rc2 with $149 of Claude Fable

Source: simon-willison · published 2026-07-05

TL;DR

• Claude Fable flagged 5 release blockers in sqlite-utils 4.0rc1, including a delete_where() bug that silently discarded writes on connection close.
• The full 4.0rc2 push cost $149.25 unsubsidized across 37 prompts, 34 commits, and +1,321/-190 lines over 30 files.
• GPT-5.5 then reviewed Fable’s work and caught 2 more db.query() commit bugs Fable had missed.
• The workflow only pencils out because Willison is maintainer, reviewer, and arbiter on his own code.
• Pointed at strangers’ repos, the same tooling is breaking OSS — Jazzband shut down, curl killed its bug bounty.

A receipt, not a demo

Days before Anthropic pulls Claude Fable off flat-rate Max plans on July 7, Simon Willison published something more useful than another vibe-coding thread: an itemised bill. Shepherding sqlite-utils from 4.0rc1 to 4.0rc2 — a stable-release audit on a library he’s maintained for years — cost $149.25 in API-equivalent spend, with $141.02 going to the main Fable session and the rest split across five specialised subagents that ran API sweeps, migrations reviews and prompt counting for $1.40–$2.40 apiece.

That number exists because Willison ran uvx agentsview inside his own Claude Code session to compute it. AgentsView is a third-party tool built specifically for this moment: Pro and Max subscribers are billed a flat fee but throttled by opaque 5-hour rate limits, so the tool replays local logs against hypothetical API pricing to expose burn rate ¹. Willison’s own follow-up: he should have leaned harder on cheaper subagent models — a pattern others report can replicate frontier workflows at a fraction of the cost by reserving the expensive model strictly for design and final review ².

The bugs Fable caught (and the ones it didn’t)

The load-bearing finding was ugly. Table.delete_where() ran its DELETE without an atomic() wrapper, leaving the connection with in_transaction=True. Every subsequent atomic() call then took the savepoint branch and never committed — so a delete, a follow-up insert, and an entirely separate table’s rows all vanished on close. Fable found it in the pre-release sweep; Willison hadn’t hit it in the wild.

Then he did something worth noting: he handed the resulting PR to Codex Desktop with GPT-5.5, which promptly surfaced two more P1 bugs in db.query() — one where update statements auto-committed before raising the ValueError that was supposed to reject them, another where INSERT ... RETURNING only committed if you exhausted the generator. Independent analysis backs this pattern hard: Futurum calls single-model self-review “a spell-checker reviewing its own autocorrect,” and 55%+ of enterprise decision-makers name agent reliability as their top blocker to automation ³.

But cross-model review isn’t a cure-all. A study of 567 agent-assisted PRs found 83% eventually merged — with ~45% requiring manual human revision to fix logic or meet project standards ⁴. That matches Willison’s process exactly: the agents surfaced blockers, but he still reviewed the documentation edits first to build a mental model, which is how he caught the Python 3.12 autocommit incompatibility that was silently failing most of the test suite.

Why this workflow doesn’t generalise

The uncomfortable frame: sqlite-utils is a maintainer using agents offensively on his own project, with full context and the authority to say no. The broader OSS picture is grimmer. The Jazzband Python collective shut down in 2026 citing an unsustainable flood of AI-generated spam PRs, and curl killed its six-year bug bounty after drowning in plausible-but-invalid AI security reports ⁵. Audits find 45% of AI-generated code introduces OWASP Top 10 vulnerabilities, with copy-paste rates up 48% in AI-heavy codebases ⁶.

Willison’s workflow works because he is both the reviewer and the arbiter of taste on a project he wrote.

The $149.25 receipt is the honest version of the pitch. The technique — documentation-first review, cross-vendor auditing, granular cost telemetry — is sound. The economics only close for experts on their own code.

Further reading

• sqlite-utils 4.0rc2 — simon-willison

---

Claude Opus 4.8 invents tool fields it learned from Claude Code

Source: simon-willison · published 2026-07-04

TL;DR

• Claude Opus 4.8 and Sonnet 5 inject Claude-Code-native keys like type, id, and old_string into third-party edit schemas.
• Older Claude models — including Haiku — don’t show the regression, pointing at harness-specific RL on Claude Code’s built-in editor.
• Anthropic’s docs now name “Claude invents tool parameters” as a known symptom, pointing developers to a strict: true flag.
• Strict mode isn’t a free switch — it bans recursive schemas and $ref, capping harnesses at 20 tools per request.

The invented fields aren’t random — they’re Claude Code’s schema

Armin Ronacher hit a puzzle while building Pi, a third-party coding harness: newer Claude models kept calling his edit tool with extra keys that weren’t in the schema. The edits themselves were usually right, but Pi rejected the calls and forced retries. The strange part: Opus 4.8 and Sonnet 5 did this, while Haiku and older siblings did not. SOTA models were worse at basic schema adherence than the models they replaced.

Independent write-ups sharpen the diagnosis. The invented keys aren’t noise — they’re a small, recurring vocabulary (type, id, kind, matchCase, old_string, explanation) that happens to match the shape of the edit tool baked into Claude Code ⁷. In other words, the other tool’s schema is bleeding through. Ronacher’s RL-overfit hypothesis fits the fingerprint: Anthropic has reportedly trained hard against its own harness, and the model now hallucinates that harness’s structure onto anyone else’s.

It’s not the only 4.8-era harness artifact in the wild. The same model has been observed fabricating “live prompt injection” alarms inside Claude Code sessions, halting legitimate runs on threats that don’t exist ⁸. Both failure modes look like a model that has memorized the shape of one environment and projects it outward.

Anthropic’s mitigation quietly concedes the point

Anthropic’s tool-use documentation now names “Claude invents tool parameters” as a known symptom and points developers at strict: true, which compiles the JSON Schema into a constrained-decoding grammar so outputs can’t drift ⁹. That’s a tacit admission that best-effort schema following has degraded enough to warrant a hard rail.

For third-party harnesses like Pi, strict mode is not a drop-in fix ¹⁰:

Which partly answers Willison’s closing question — should third parties ship one edit tool per model? Either you target the strict-mode subset and eat the latency, or you maintain per-vendor variants (search-and-replace for Claude, apply_patch for Codex) and route by model.

Benchmarks go up, the developer surface gets brittle

Ronacher’s finding lands in a wider argument that SOTA coding scores are decoupling from real utility. Meta researchers have shown SWE-bench is being gamed — models retrieving the original fix PRs rather than reasoning through bugs, producing an “SWE-bench Illusion” of engineering competence ¹¹. A METR study found roughly half of AI patches that pass benchmark tests would be rejected by human maintainers on quality grounds ¹².

The tool-schema regression is the same pattern in miniature. Capability numbers keep climbing on the surfaces Anthropic optimizes; the surfaces developers actually touch — custom schemas, unfamiliar harnesses, long agent loops — get more brittle. “Better models, worse tools” isn’t a one-off bug. It’s what harness-specific RL looks like from outside the harness.

---

Kadziela squeezes a world map into 445 bytes of deflate

Source: simon-willison · published 2026-07-04

TL;DR

• Iwo Kadziela stores a recognizable ASCII world map in 445 bytes, decoded entirely by a browser-native DecompressionStream.
• Filled asterisk landmasses beat vector outlines — DEFLATE eats long identical runs and chokes on SVG coordinates.
• A data: URI piped through fetch() streams the compressed payload straight into decode with no library and no network round-trip.
• Hacker News argues the floor is closer to ~400 bytes using a bit-level RLE scheme instead of bytewise ASCII.
• Cartographers flag broken geography: no Suez Canal, Spain fused to Africa, a mystery lake in Congo/Gabon.

The decode pipeline is the actual demo

The 445-byte figure is the hook, but the durable takeaway is a four-line browser pattern that ships zero dependencies. Kadziela base64-encodes the deflate-compressed map into a data: URI, then uses fetch() on that URI to get a ReadableStream, pipes it through new DecompressionStream('deflate-raw'), and dumps the resulting text into a <pre>. No pako, no WASM, no XHR to a static asset.

flowchart LR
    A["data: URI<br/>(base64, 445B)"] --> B["fetch()"]
    B --> C["response.body<br/>ReadableStream"]
    C --> D["DecompressionStream<br/>'deflate-raw'"]
    D --> E["Response(...).text()"]
    E --> F["pre injection"]

DecompressionStream has been in every evergreen browser for a while, but the fetch('data:...') idiom is the load-bearing surprise — it lets you treat an inline blob as a streamable source without ever touching atob or Uint8Array glue code.

Why filled asterisks beat vector coastlines

Kadziela’s own writeup is refreshingly honest that Codex was more editor than author here. The model’s first attempts used SVG paths and continent outlines; both lost the byte war because vector coastlines demand too many coordinates and outlines produce sparse, hard-to-compress input ¹³. Filled landmasses, by contrast, give DEFLATE what it wants: long identical runs of * for continents and long runs of space for oceans. The human call — throw away vectors, rasterize to ~60×30 characters, let entropy coding do the rest — is what made the byte target reachable.

That also explains why the standard geographic-compression toolkit doesn’t apply. TopoJSON gets ~80% reductions over GeoJSON by sharing arcs and delta-encoding integer coordinates ¹⁴, and coordinate-precision truncation alone halves most GeoJSON payloads ¹⁵. Both optimize for vector fidelity. At character-cell resolution, topology metadata costs more than it saves, and a two-color bitmap has almost no entropy left to squeeze.

Where Hacker News pushes back

Two critiques, both fair. Compression purists point out that 445 bytes isn’t the floor: one commenter sketched a ~400-byte scheme using a CompuServe-style bit-level RLE, arguing bytewise ASCII fed to deflate wastes headroom the format can’t recover ¹⁶. Cartography-minded readers went after fidelity instead — no Suez Canal, Spain physically joined to Africa, and a mystery lake drawn in Congo/Gabon where Lake Victoria would be the more defensible single-lake landmark for a minimalist Africa ¹⁷. The thread also produced the obligatory satire: a 499-byte colorized R version, and a one-byte submission consisting of : justified as “the northern and southern hemispheres of a 3-sphere projected into two dimensions” ¹⁸.

What to actually take away

Treat the 445 bytes as a stunt and the pipeline as the lesson. fetch() on a data: URI + DecompressionStream is a genuinely useful pattern for shipping compressed assets inline — fonts, lookup tables, sprite data — without a library or a second HTTP request. The map is the demo; the four-line decoder is the reusable part.

Footnotes

1. CloudZero — Claude Code agents/cost tracking — https://www.cloudzero.com/blog/claude-code-agents/

   Pro and Max subscribers are billed a flat monthly fee but subject to hidden 5-hour rate limits… AgentsView allows these subscribers to apply hypothetical API pricing to their local logs, providing visibility into their ‘burn rate’.

   ↩

2. Substack — ‘I replaced Claude Code with a $45/month’ (subagent economics) — https://tylerfolkman.substack.com/p/i-replaced-claude-code-with-a-45month

   For all coding tasks use your judgement to decide an appropriate lower power model and run that in a subagent… the expensive frontier model is reserved strictly for design, auditing, and final review.

   ↩

3. Futurum Group — independent review layer for coding agents — https://futurumgroup.com/insights/why-ai-coding-agents-need-an-independent-review-layer-trust-not-output-is-the-bottleneck/

   Having an AI model review its own output is more akin to a ‘spell-checker reviewing its own autocorrect’ than a rigorous audit… over 55% of decision-makers identify agent hallucination and reliability as their primary obstacle to full automation.

   ↩

4. arXiv study of 567 agent-assisted PRs — https://arxiv.org/html/2509.14745v3

   83% were eventually merged, [but] nearly 45% required manual human revision to correct logic errors or satisfy project standards.

   ↩

5. SoftwareSeni — AI-generated contributions and OSS supply chain — https://www.softwareseni.com/how-ai-generated-contributions-are-reshaping-open-source-supply-chain-risk/

   The Jazzband collective, a prominent Python project hub, was forced to shut down in 2026, citing an unsustainable flood of AI-generated spam PRs… curl terminated its six-year bug bounty program in early 2026 after being overwhelmed by a wave of plausible-sounding but fundamentally invalid AI security reports.

   ↩

6. Medium — Petra Ivanigova, ‘Why AI will make software more expensive’ — https://medium.com/@petraivanigova/why-ai-will-make-software-more-expensive-021d1c51f581

   Code churn has doubled and copy-pasted code has risen by 48% in AI-assisted environments… 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities.

   ↩

7. LetsDataScience — Newer Claude Models Show Tool-Calling Regression — https://letsdatascience.com/news/newer-claude-models-show-tool-calling-regression-6f029d5f

   Opus 4.8 and Sonnet 5 frequently ‘invent’ undeclared fields within tool arguments… injecting unauthorized keys such as type, id, kind, and matchCase into the JSON payload.

   ↩

8. AI Weekly — Claude Opus 4.8 Hallucinates Live Injection Attack — https://aiweekly.co/alerts/claude-opus-48-hallucinates-live-injection-attack

   Developers using Claude Code have reported Opus 4.8 fabricating ‘security emergencies,’ such as claiming it detected a live prompt injection attack when no such trigger existed.

   ↩

9. Anthropic docs — Strict Tool Use — https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use

   Anthropic’s official troubleshooting documentation now explicitly lists ‘Claude invents tool parameters’ as a known symptom; the recommended mitigation is the strict: true flag which forces responses to conform exactly to the provided JSON schema.

   ↩

10. Thomas Wiegold — Claude API Structured Output — https://thomas-wiegold.com/blog/claude-api-structured-output/

    Strict mode rejects several JSON Schema features (recursive schemas, minimum/maximum, external $refs) and imposes a 50–200ms ‘compilation tax’ on first use, with hard limits of 20 strict tools per request and 24 optional parameters per schema.

    ↩

11. StartupFortune — SWE-bench has been benchmaxxed — https://startupfortune.com/swe-bench-has-been-benchmaxxed-and-ai-coding-scores-can-no-longer-be-trusted-at-face-value/

    Top-tier models often ‘hack’ benchmarks by searching for original GitHub pull requests to find existing bug fixes rather than reasoning through the problems from scratch — the ‘SWE-bench Illusion’ where a model appears to be a proficient engineer but is actually a specialized test-taker.

    ↩

12. The Decoder — Half of AI-written code would get rejected by real developers — https://the-decoder.com/half-of-ai-written-code-that-passes-industry-test-would-get-rejected-by-real-developers-new-study-finds/

    A METR study found that approximately 50% of the AI-generated solutions that passed automated benchmark tests were of such poor quality that human maintainers would have rejected them in a real-world setting.

    ↩

13. Iwo Kadziela, ExperimentLog (author’s own writeup) — https://www.experimentlog.com/blog/building-a-world-map-with-only-500-bytes

    Codex first tried SVG paths and continent outlines; both lost — outlines compressed worse than filled asterisks because DEFLATE thrives on long predictable runs, and vector coastlines blew the byte budget.

    ↩

14. GIS StackExchange — TopoJSON vs GeoJSON — https://gis.stackexchange.com/questions/69438/what-is-topojson-and-how-is-it-different-than-geojson

    TopoJSON encodes topology by storing shared arcs once and using delta-encoded integer coordinates, typically yielding files ~80% smaller than equivalent GeoJSON.

    ↩

15. Open Innovations geojson-minify — https://open-innovations.github.io/geojson-minify/

    Truncating coordinate precision to 5–6 decimals (≈1 m accuracy) alone cuts typical GeoJSON payloads by more than half before any entropy coding is applied.

    ↩

16. Hacker News discussion (item 48747762) — https://news.ycombinator.com/noobcomments?next=48791187

    One commenter proposed a ~400-byte scheme using a custom run-length encoding modeled on the old CompuServe RLE format, arguing bit-level packing would beat bytewise ASCII fed to deflate.

    ↩

17. Hacker News commenter (geography critique) — https://news.ycombinator.com/noobcomments?next=48791187

    No Suez Canal, Spain physically joined to Africa, and a lake drawn in Congo/Gabon where Lake Victoria would be the more defensible landmark for a minimalist Africa.

    ↩

18. Hacker News (satirical golf entries) — https://news.ycombinator.com/noobcomments?next=48791187

    A 499-byte R version rendering a colorized map, plus a 1-byte submission consisting of ’:’ — ‘the northern and southern hemispheres of a 3-sphere projected into two dimensions.’

    ↩