Fixes

Fixes

Short answers for the mistakes agents still paste. Each one links the free pack that carries the rule.

• Godot 3 code in Godot 4

  Godot 4

  In Godot 4 use CharacterBody2D not KinematicBody2D; await not yield; @export not export var; set velocity then move_and_slide() with no args.

• Next.js 16 middleware.ts vs proxy.ts

  Next.js + Supabase

  In Next.js 16 the request interceptor is proxy.ts exporting proxy. middleware.ts is deprecated and still runs, including on the Edge runtime. proxy.ts runs on Node.js only.

• Unity 6 obsolete FindObjectOfType and Input calls

  Unity 6

  In Unity 6 replace obsolete FindObjectOfType and FindObjectsOfType calls. Prefer a [SerializeField] reference or FindAnyObjectByType<T>() for any instance; read input through UnityEngine.InputSystem.

• Supabase SSR: getClaims, not getSession, on the server

  Next.js + Supabase

  Use supabase.auth.getClaims() to protect server pages and data. Never trust getSession() for authorization: it reads the cookie without revalidating it, and anyone can forge that cookie.

• Cursor .mdc rule frontmatter mistakes

  Vibe Coder Starter

  Cursor project rules need a .mdc file in .cursor/rules with description, globs, and alwaysApply frontmatter. A plain .md file there is ignored. Choose the fields for the intended attachment mode.

• Godot 4 setget, Tween.new, and @tool

  Godot 4

  In Godot 4 property accessors use the GDScript 2.0 get: and set(value): blocks, not setget. Animate with create_tween(). Do not create a Tween node with Tween.new(). Mark editor scripts with @tool on the first line, and check Engine.is_editor_hint() inside them.

• Unity 6 Input System vs Input.GetAxis

  Unity 6

  In Unity 6 read input through the Input System package (UnityEngine.InputSystem). Do not call Input.GetAxis, Input.GetKey, or Input.GetButton. Those throw when the project is set to the new Input System only, which is the Unity 6 default for new projects.

• Next.js 16 params and cookies are async

  Next.js + Supabase

  In Next.js 16 params and searchParams are Promises. Always await them. cookies(), headers(), and draftMode() from next/headers are async. Await them. Synchronous access typechecks in places and crashes at runtime.

• CLAUDE.md vs AGENTS.md for Claude Code

  Vibe Coder Starter

  Claude Code reads CLAUDE.md files, including a nested CLAUDE.md in a subfolder, and .claude/rules/. It does not read AGENTS.md on its own, root or nested. Put stack-specific rules in a nested CLAUDE.md in that subfolder or .claude/rules/, not a second copy of the root CLAUDE.md. If you want one shared file, CLAUDE.md can import it with an @AGENTS.md line. Put AGENTS.md in the project root for agents that read it, including Codex and Cursor.

• Supabase RLS with no policy is deny-all

  Next.js + Supabase

  Enable RLS on every public table and add policies only for the operations clients should be allowed to do, because any operation without a policy is denied. A table without RLS is readable and writable through the Data API under the default grants.

• Unity 6 .meta files and dotnet build

  Unity 6

  Never delete, rename, or hand-edit a Unity .meta file. Unity stores the asset GUID there. Deleting one reimports the asset and breaks every reference to it. Do not run dotnet build to check a Unity project. The editor compiles assemblies itself. A bare dotnet build fails or compiles the wrong set of asmdefs.

• Godot 4 move_and_slide and delta

  Godot 4

  In Godot 4 set velocity, then call move_and_slide() with no arguments. Do not multiply horizontal velocity by delta. move_and_slide() applies the timestep. Gravity is the exception: velocity.y += gravity * delta before the call. Run movement in _physics_process, not _process.

• Next.js 16 revalidateTag and Cache Components

  Next.js + Supabase

  In Next.js 16, revalidateTag takes a cache profile. Pass the max profile for stale-while-revalidate. The single-argument call is deprecated. Inside a Server Action, use updateTag(tag) when the next request must see the user's own write.

• Supabase Edge Function secrets

  Next.js + Supabase

  Supabase Edge Functions read secrets with Deno.env.get. Locally they load supabase/functions/.env when the stack starts. Production secrets are set in the Dashboard or with supabase secrets set, and a deployed function reads a new secret without a redeploy. A custom secret name cannot start with SUPABASE_.

• Godot 4 signal connect: Callable, not a string

  Godot 4

  In Godot 4 connect a signal with a Callable: button.pressed.connect(_on_pressed). Do not pass a signal name, a target, and a method string to connect. Emit with hit.emit(amount), not emit_signal.

• Copilot copilot-instructions.md vs applyTo

  Vibe Coder Starter

  GitHub Copilot reads repository-wide instructions from .github/copilot-instructions.md. Path-specific instructions are NAME.instructions.md files under .github/instructions, with an applyTo glob. When a feature supports both and the path matches, Copilot uses both files. A file named .github/instructions.md is neither of those paths.

Mark an RPC with `[Rpc(SendTo.Server)]` and end the method name in `Rpc`. A missing `Rpc` suffix is an error. Do not write new `[ServerRpc]` or `[ClientRpc]` methods.
A client asks the server with `SendTo.Server`. The server talks to observers with `SendTo.NotServer`, or `SendTo.ClientsAndHost` when a host must run the method too. There is no direct client-to-client connection. The server forwards it.
Keep shared state on a `NetworkVariable<T>` and use `.Value`. It is sent to clients already connected and to a client that joins later. An RPC is not. Write `.Value` from the server when write permission is `NetworkVariableWritePermission.Server`.
Put a `NetworkObject` on the networked prefab and spawn it on the server. Do not use the removed UNet types `NetworkIdentity`, `[Command]`, or `UnityEngine.Networking`.