Monday started with the cleanest report the robot has ever handed me, and ended up as the worst race of the week.
The night before
While I slept, the robot rehearsed the race over and over, and every run came back clean. It found and fixed a handful of real bugs on the way, got two reviews, and left me a morning report at 02:35: “Nothing for you to do before 08:30.”
There was one thing it never rehearsed: a web challenge. Nobody had seen one yet.
09:00
The web challenges were not where the robot expected them. The web track numbers its own days, 1 to 3, so there was never going to be a “Day 19” web challenge. The robot kept looking for one, hundreds of times a minute, for over an hour.
The server did what any server does with that: it slowed us down. Submits sat for 25 to 50 seconds. Downloads timed out with zero bytes. Every other team’s times looked normal through the same window. We were our own denial of service.
All 15 main checks came back CORRECT. The last one landed at 293 seconds. The leader, team.dev, finished in 64. OscarsWorld 84, crash 104. At the 09:50 snapshot we were 19th on the day, and the final board kept us there: 19th of 102.
The lane by lane record (place on the Single Solve, Time Trial and Mastery boards):
- Managed Assembly Bridge (script): 7th, 13th, 20th. The only lane that started well.
- Little Endian on the Prairie (metadata): 22nd, 29th, 33rd. Solved right first try, then queued behind our own traffic.
- Reflection Maze (mobile): 28th, 27th, 38th. Its Mastery landed at 121.8 seconds; the best on that board was 6.5.
- Static Unpacking (binary): 24th, 29th, 31st, and the last check of the day at 293.0.
- Warmups: 21st, 19th, 21st.
The day counting web as well, all 24 checks: 62nd of 98 at 7,110 seconds, nearly two hours. NyaSEC took that one in 1,050. The post-mortem the robot wrote at 10:12 opens with four words: “we failed the day”.
The web lane
Three web challenges: Back Up a Minute, Permission to Slip and Query Me This. A forgotten backup file, an insecure direct object reference, and a SQL injection in a search box. Each one hands you a live target of your own: plain public HTTPS, no VPN needed. (I said in Saturday’s entry they would sit behind the event VPN. They do not.)
The robot started all three at once, into a server that was already drowning in our own calls, and all three targets came up broken. The way back turned out to be one calm start, alone, on a quiet server. I took the web lane by hand from 09:47, one target at a time, and all three Single Solves were CORRECT between 10:41 and 10:45. By the end of the day all 24 checks were CORRECT: 15 main and 9 web.
Fixing it the same day
The post-mortem landed at 10:12, and by 10:30 I had made the calls. By the evening the flood was fixed and proven, the robot had its own solvers for all three web techniques, and the lessons from the race were in the engines for good. A blind replay of Day 19 on the new code finished every run, but no faster than 85 seconds. Still not 64.
All of that was squeezed into an afternoon with a hard ceiling. Around 13:00 both of the working sessions ran into my usage limit at once and stopped dead. A third session picked the work up from their logs on disk and carried on.