Going Public, and the Discipline of a Plateau

The last post counted eight tricks earned through the night. This one counts just two — and that near-stall is, oddly, the better story. Because the same week the trick number barely moved, SrTDb went public: the verified trick database now lives on the open internet at srtdb.esamarathon.dev, real Let's Encrypt certificate and all, where anyone with the link can browse it. Two headlines pulling opposite ways — a door opened to the world, and a research loop that chose to stand still rather than manufacture a number to fill it. They turn out to be the same virtue.

A public door to a private room

The thing I'm proudest of in the launch is what didn't get exposed.

The machine that does the work — harvesting, transcribing, running the local model, holding every draft and every runner credit — is a private homelab box. It has no business being on the internet, and it isn't. What faces the world is a separate, public mini-PC running a small reverse proxy. A request to srtdb.esamarathon.dev lands on that proxy, which terminates TLS, decides what's allowed, and forwards the survivors over the local network to the private backend. That backend listens only on its private-network interface, never on all interfaces — so it's reachable only from inside the private network, and in practice from exactly one place: the proxy.

That split is the whole posture. The public surface is small, replaceable, and holds nothing precious; the valuable, fragile thing — the research machine with all the data and the long-running loop — keeps a property a public service can never have: it is not addressable from the internet at all. If the front door is ever forced, the blast radius is a stateless proxy, not the workshop.

What the proxy lets through is deliberately narrow. Reads of the verified database are open to anyone on the internet — that's the point of publishing. The handful of endpoints that let a volunteer contribute — verify a trick, rate it, file a report — sit behind a login. Everything else — anything administrative, runner-PII, or loop-control — is refused at the edge with a flat 403 and never touches the backend. Unusual HTTP methods get a 405 first, and a full set of security headers (HSTS, frame-denial, and a content-security policy whose only allowed frame source is YouTube) rides on every response with the server banner stripped.

Publish the output, not the workshop. A public product should expose the thing people came for and nothing about the machine that made it — least of all an address.

Defense in depth, even for a hobby

The proxy is the wall. But I hardened the inside as if there were no wall, because the cheapest time to do that is before you need it. On the private backend, the changes are unglamorous and exactly the kind that only matter on the one day they do:

• Path containment, twice over. Every game identifier runs through a strict validator — no separators, dot-segments, control characters, or absurd lengths — and then, as a second independent check, the resolved file path is confirmed to still live inside the games directory before anything is read. A crafted parameter can't walk out of where it's allowed.
• Caps the server enforces, not the form. Request bodies are capped at the edge and re-capped in the app, content-length claims that are negative, non-numeric, or oversized are rejected, a short socket timeout drops a client that dribbles bytes to hold a connection open, and every volunteer-submitted field is truncated server-side. The form can ask politely; the server doesn't trust it.

None of this is exotic. All of it assumes the proxy will one day fail, be misconfigured, or be bypassed by something I didn't foresee.

Harden the inside as if the wall isn't there — because the one time it isn't, that assumption is all that's standing.

The discipline of a plateau

Now the honest part. Since the last post, the trick database has barely grown. It sits at 137 verified tricks across the whole database; among the six games getting deep attention, the counts are drill-dozer 4, minish-cap 6, sly-1 3, super-pitfall 1, wario-land-3 1, pokémon ruby/sapphire 3. The loop's own log stopped dressing it up and started calling it what it is: deep plateau, heartbeat only, no new material to act on.

Why that's the right outcome and not a stall: the easy wins are banked — the mechanic-level techniques two independent sources plainly agree on got promoted already. What's left is hard — route-specific tricks one runner explains and the next never mentions, plus tool-assisted runs documenting a different route entirely.

So the loop spent the week mostly holding — but not blindly. An offline pass that re-read transcripts already on disk (no new downloads, no rate-limit risk) did surface two candidates that genuinely cleared the bar, and both were promoted. The first is dash chaining in Drill Dozer — cancel a dash's animation and immediately re-dash, repeat, and you cross the ground far faster than mashing the button; it's named and explained in two independent runs. The second is a poison death warp in Pokémon Ruby/Sapphire: deliberately let a Pokémon get poisoned during the Flannery fight, then walk the overworld until the party faints, and the white-out warps you back to Petalburg — skipping a long backtrack. It's credited to a runner named xarin and corroborated across three separate VODs. That's the bar working in the accepting direction: when the evidence is genuinely there, it promotes.

The rejecting direction did more work. Three Wario Land 3 candidates — a dash-jump cancel, a floor-clip, a sequence break — had a second "source" that was really just loose word co-occurrence in another transcript, not an independent confirmation of the same mechanic. They stayed held. A "Roll Lifting" candidate in Minish Cap turned out to be the same mechanic, with the same two videos, as a trick already verified under another name — a duplicate, dropped. A draft the scoring proudly surfaced as a "new" trick, Day/Night Cycle Manipulation, was a video calmly explaining the game's normal day/night feature — a mis-extraction, rejected. And a "ladder clip" in Super Pitfall was the subtlest of all: two runners name it, but neither actually explains the mechanic, and it can't be cleanly distinguished from the wall-clip already on the books — so it waits.

It would have been trivial to round any of those up and post a cheerful number. I didn't, and going public is why the restraint matters more now: the moment strangers can read this database, a soft promotion stops being a private embarrassment and becomes a public falsehood. The cost of being wrong went up the day the door opened.

A plateau is the sound of a filter working. Don't lower the bar to manufacture a number — wait for material that's genuinely new, and let it through only when it is.

One thing keeps the flat week from being a starved one. Priority is finally a single honest signal — one canonical per-game file the live worker actually reads, high tier swept first, skip excluded entirely. Not long ago that file had 151 games marked "high," which is the same as marking none of them. Now it's six high games and a short, deliberate list of low and skip. The plateau isn't hundreds of games each getting a thin trickle; it's six games getting everything the pipeline has, until their footage is genuinely mined out. That's focus, not failure.

The thread

The week's real product wasn't a pile of tricks. It was a public surface you can trust and a private one you can't reach — and the willingness to show a flat 137, two hard-won additions and not one soft one, instead of a flattering fiction. Going public and refusing a soft promotion are the same move made twice: do the careful thing precisely when there's no shiny number to hide behind. The database is now a rich set of candidates, honestly labeled, waiting on the people who can actually settle them — the on-site ESA experts who'll sit down with it during the event. Until then, the loop's job is to keep the door open, the workshop closed, and the bar where it is.

The bravest output a system like this can produce is an honest plateau.