September 28, 2026 — Faster Reasoning, Unverified Numbers

Host0:36

Fireworks put out a model on September twenty-third that's built to think less. It's called Ember-one, and it's built on Kimi K3. The pitch is to preserve answer quality with a shorter reasoning trace. Fireworks describes it as an option alongside Kimi K3; its announcement doesn't specify an Ember-one API model ID. The company says its team ran more than fifty training experiments and over two hundred evaluations across math, coding, search, tool use, and software engineering to build it. The mechanism is the interesting part. Fireworks says just turning down Kimi K3's reasoning-effort dial tanked quality too much, so instead they trained a new model on standalone tasks and multi-turn interactions, using outcome feedback to teach it when reflection earns its keep. That matters in agents specifically, because every earlier turn's reasoning gets replayed into the next prompt, so a bloated first answer taxes you again and again downstream. The number that matters: thirty five to fifty percent fewer reasoning tokens across seven benchmarks, with accuracy holding, according to Fireworks. On Terminal Bench two point one, that's eighty two percent for Ember-one against eighty point nine percent for Kimi K3 Max. On SWE-bench Verified it's ninety two point two percent against ninety three point two percent, basically a wash. One customer's production A/B test reported roughly forty nine point three thousand output tokens for Kimi K3 versus roughly twenty-nine point nine thousand for Ember-one, with scores of point seven five one and point seven five three, respectively. Here's the honest limit. Every one of those numbers is Fireworks grading its own homework. An independent write-up on the release says the savings aren't uniform at all: they range from a five point nine percent cut on τ-2 Bench Airline to a fifty one point nine percent cut on Terminal Bench two point one, and the numbers had not been independently reproduced at publication. There's no published price, and Fireworks calls this a two-week research preview. An OpenRouter comparison listing shows a price and a context window past a million tokens, but the sources don't establish whether that listing reflects an active Ember-one route or the actual limits of Fireworks' endpoint. Fireworks' own description of the rollout is refreshingly blunt: no news is good news, which is one way to describe shipping a model with no price tag attached. So here's the verdict. If you run multi-turn coding or agent workloads, shadow-test Ember-one against your real traffic on Fireworks Serverless and watch task success, latency, and your actual bill, and pull the current model ID from Fireworks' own listing rather than guessing at it. Don't move a budget-sensitive production workload onto it until there's an actual price.

3:47

If Ember-one is something you rent through an API, this next thing you can actually clone and read. It's called ZCode, Z.ai's open-source coding-agent harness, Apache two licensed, and it's trending hard enough that Trendshift caught it climbing the daily chart starting September twenty-first. It's not just a terminal bot. The repo describes a desktop app, a browser interface, a terminal agent, a backend, and shared UI packages, all in one Node-based project. Run the packaged command with no arguments and you get a terminal interface, add a web flag and you get a browser one, throw anything else at it and it passes straight through to the agent CLI. One command, three personalities. The number: about six point nine thousand stars and two point one thousand forks on this read, for a project that only started trending about a week ago. That's fast. The honest limit: stars aren't a security audit. The README says the Web development setup runs a local backend and proxies its WebSocket and API traffic. It also flags that the default local setup doesn't turn on an access token unless you configure one yourself. Read that before you open it up to your network. To try it, you'll need Node twenty-four and pnpm ten thirty-three, both pinned in the project's own config file, then run pnpm bootstrap to set up the workspace.

5:20

Reading a README before you trust it is one thing. Google's security team used more than six days of differential fuzzing to test an AI's rewrite of a C library. Here's the setup: giflib, the roughly three-thousand-line C library that decodes GIFs. Google had Gemini produce a memory-safe Rust replacement, in three stages. First, a one-shot Gemini rewrite. Then engineers hand-iterated on the C-compatible interface, because that boundary still touches raw pointers coming in from C, and Google says the first pass had unsound memory-management patterns that needed expert review. Then verification: the two versions ran side by side against more than thirty million real-world GIFs, and a differential fuzzer churned for over six days and more than two hundred million iterations without finding a single logic mismatch. That process found an LZW-decoder edge case and an out-of-bounds write introduced by an internal patch to the original C code. And after Google had already started rolling out the Rust version, an outside researcher reported an upstream giflib out-of-bounds heap write, CVE-2026-26740. The number: Google says the Rust version matches the C version's runtime performance in production, and dropping the C library's operating-system sandbox actually cut tail latency. The honest limit is right there in the project's own README. It says the port isn't an officially supported Google product, and if you don't strictly need C API compatibility, use the separate, faster, idiomatic gif crate instead. Wrapping unsafe C calls in a memory-safe language doesn't erase the unsafe boundary, it just narrows it, and human experts still had to review that seam by hand. You can go read the whole thing yourself on Google's giflib-rs repository.

7:26

Google shipped a library. The rest of the ecosystem just shipped point releases, and a few of them are worth your attention. vLLM zero point thirty landed with seven hundred sixty two commits from three hundred fifteen contributors, over a hundred of them brand new. It adds new model support, including DeepSeek V four point one Flash and GLM five point three Flash, plus an IPC weight-cache that keeps sharded weights resident in GPU memory so restarts skip reloading from disk. Separately, vLLM reports that freezing garbage collection on H200 cut engine initialization from twenty-eight point nine seconds to eight point two. Upgrade if you use the new models or hate slow restarts, but check the scale-out flag change first, since the old environment variable is gone. Claude Code two point one point two eight three adds an opt-in header, so gateways can group requests serving one user prompt. Turn it on with `CLAUDE_CODE_GATEWAY_HINT_HEADERS=1` if your gateway can use it, and update regardless, since the same release quietly patches a PowerShell bug that could let commands delete drive roots. Node point js twenty-two point twenty-three point three is a routine LTS refresh: new root certificates, Corepack up to zero point thirty-six, npm to ten point nine point nine, OpenSSL to three point five point eight. Nothing dramatic, just update your twenty-two line when you get a minute.

8:59

Let's speed run the rest of Sunday, three stories, no brakes. Copland reboots. Developer Michael Steil got Apple's cancelled nineteen-ninety-six OS, Copland, booting in a browser using an AI-assisted emulator fork. Apple killed the project and bought NeXT instead, so this is the OS history skipped, thirty years late and running in a tab. Valve's bandwidth diet. Valve's experimental Pyrowave codec, built by VKD3D-Proton developer Hans-Kristian Arntzen, hit the Steam beta for low-latency streaming. Phoronix reports it needs five to ten times the bandwidth of other streaming codecs, so it's less a codec and more a very expensive extension cord. The iPod talks back. A developer reverse-engineered the iPod Classic's undocumented Mikey chip to make Apple inline earphone remote controls work in Rockbox, and found releases can arrive nearly two seconds late. Told to click the center button three times, they clicked the clickwheel instead and got three debug-screen resets and zero remote events. Between a codec that eats bandwidth for breakfast and a chip that takes two seconds to admit you released a button, Sunday's hardware had one theme: everything's slower than it says it is.

10:21

Today: Fireworks shipped Ember-one promising fewer reasoning tokens with no price to check it against, Z.ai's ZCode is trending on Trendshift, Google had Gemini help rewrite a C library in Rust and its verification process found bugs, vLLM and Claude Code and Node all pushed point releases worth your time, and Copland, Pyrowave, and a talkative iPod chip rounded out the strange corners of Sunday. Try this before the weekend's out: pull up Google's giflib-rs repository and see what an AI-drafted, human-reviewed Rust port actually looks like next to the original C. Full show notes and every source are on the website. Follow The Daily Reboot wherever you get your podcasts, so Monday's episode is just there Monday morning. I'm out, go build something. See you tomorrow.