self.md radar — 2026-09-12
the install that never opened
Twenty Android phones arrived through a paid campaign with an old app build, zero seconds of use, and a claim that Google Play installed each one. Elsewhere, plugin authors get a way to measure whether their instructions work at all, while a deploy tool quietly moves HTTPS into the file it writes for you.
1. Dayzle stops buying installs and starts buying solved puzzles
A Google Ads campaign told the maker of puzzle app Dayzle that it had bought 21 installs in one day. The app’s own panel showed one. Raw analytics later found 21 new Android devices, but 20 were running a version the Play Store had stopped serving. Each opened once, spent zero seconds on a screen, and disappeared.
Across two weeks, the account billed 56 installs. Thirty-three followed that pattern; seven came from countries outside the campaign’s targeting. Thirteen people completed 92 games. The next campaign objective is now “won a puzzle,” not an install. It will cost more for a script to fake, which is the point.
reading: Dayzle’s campaign audit · Google’s definition of invalid clicks
2. Claude Code gives plugins a baseline test
Claude Code now documents claude plugin eval: a command that runs a plugin against prompts and graders, then compares the result with a run that has no plugin loaded. Graders can inspect the reply with a regex, check that a tool was called, or use another model against a rubric.
The more useful constraint is the setup. Each case starts in a fresh, isolated non-interactive session with only that plugin loaded. A team can then put the score behind a CI gate when it changes its instructions or a new model ships. Every run and judge call still hits the account’s usage budget, so the test loop comes with a meter attached.
reading: the plugin-eval documentation · the plugin structure guide
3. A Fly deployment plugin writes HTTPS into the starter file
datasette-publish-fly 1.4 now puts force_https=true in the fly.toml it generates. The release also fixes a missing-volume error and accepts app-scoped deploy tokens.
None of this is a platform announcement. It is one boring default moving from a future checklist into the file a deploy begins with. The app-scoped token support gives users a narrower credential for that step; it does not make credentials somebody else’s problem.
reading: datasette-publish-fly 1.4 · the deployment plugin repository
left on the table
- Datasette’s security update was real, but yesterday’s Radar already covered that release and its audit. No second lap.
- Today’s noisy GitHub sponsor listings made sweeping model and token claims without a versioned change to inspect.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Sandboxing and security — give agents useful power without giving them the whole house