Design

14. Sandbox, Challenges, and achievements

Guided and free Sandboxes, fixed puzzles with histograms, daily drills, and achievements.

Sandbox#

A Sandbox is a Board outside any Company. It runs the same Simulation as a Company. Nothing in a Sandbox changes a Company, and nothing in a Company changes a Sandbox. There are two kinds: guided and free. ADR 0003 records why.

The Sandbox fixes one problem. A Company teaches each mechanic when the player first needs it, so a player who wants to learn zones or GC pauses must first play the Company to Series A. The Garage Era is the tutorial for a new player (Progression).

Guided Sandboxes#

A guided Sandbox teaches one mechanic through two to four ordered objectives, like a Factorio tutorial level.

  • Start. A fixed Design with the problem already on the Board, or one that appears within the first minute: a red card, a long tail, or Stranded requests.

  • Objectives. Each objective is one sentence that states the goal, for example "Keep p99 under 300 ms for 2 minutes." It passes when its rule on the Ledger holds for 90 to 180 sim seconds without a break. A break starts the hold again.

  • Escalation. Later objectives raise demand, add a Burn budget, or script an Incident, so the first fix stops being enough. An Incident the Design must survive fires again after each failure. An Incident the player must answer by hand, such as a slow query, fires once.

  • Palette. The research the Sandbox grants. It holds the fix, plus at least one wrong option that a reasonable player would try. The wrong option plays out, so the player sees why it fails.

  • Demand and seed. Fixed and flat, with no daily cycle. Users do not grow or leave.

  • Visibility. The Sandbox grants the visibility step that the mechanic needs. A player cannot learn tail latency without seeing the p99.

  • Money. None. Placing and resizing are free; Burn shows, because some objectives set a budget.

  • Length. Varies with the mechanic. At 1× speed the fastest pass takes 4 to 11 sim minutes, and a first attempt takes longer. Later tracks are longer, as later Factorio tutorials are.

A guided Sandbox has no text overlays, arrows, or step-by-step prompts. The Board, the Node cards, and the Tradeoff cards work as they do in a Company. The game teaches through consequences (Vision).

Results are pass or fail. There is no score, no histogram, and no server. Nothing pays Cash, Insight, or Legacy, because a reward would make the Sandbox a required grind (pillar 5).

Sandbox tracks#

A Sandbox track is the ordered set of guided Sandboxes for one Era. Every track is available from the start. Inside a track, each Sandbox opens when the player passes the one before it.

EraGuided SandboxThe problem on the BoardThe fix it teaches
GarageOut of CreditsA Burstable box is throttled to 20%Change the Instance type: vertical scaling
GarageShared BoxApp and database on one box run out of RAMSplit the database onto its own Node
GarageSecond ServerOne App Server at 100%A Load Balancer and a second App Server
Pre-seedConnection LimitMore App Servers cause refused errors at PostgresA Connection Pooler
Pre-seedEvent Loop Stall5% login on Node.js raises the p99 of every kindRoute login to its own App Servers, or change Stack
Pre-seedRead MostlyThe database is the bottleneck on q-readA Cache. A Read Replica passes the first objective, then fails on stale reads
SeedStampedeA cache restart sends every miss to the databaseStampede protection and cache warming
SeedSlow Uploadsupload holds App Server slotsA Queue and a Worker
SeedBotsA bot flood takes Capacity from real usersRate limits and a WAF
Series AZone OutageA zone fails at minute 2Multi-zone with spare capacity
Series ACold StartNew JVM Nodes are slow during a spikeWarmup and spare capacity
Series AStale Checkoutbuy reads its own write from a lagging replicaRead-your-writes routing
Series BGC PausesHeap above 90%: the p99 spikes and the p50 does notMore memory or a different collector
Series BRetry StormRetries multiply load after a short outageRetry budgets, backoff, and load shedding
Series BAnalytics on Primaryreport queries slow down checkout on the primaryA Warehouse
Series CFar AwayUsers in another region see 150 ms more latencyA second region
Series CMissed WriteReads miss the latest writeR + W > N
Series CHot KeyOne key receives 30% of readsKey splitting and local caching

The list is a balance target. Each track arrives with the milestone that adds its mechanics (Scope and roadmap). All six tracks hold 18 Sandboxes in all, and a test plays each one with its fix and with a wrong option.

Free Sandbox#

The free Sandbox is a test bench.

  • Every Component, Stack, research item, and visibility step is unlocked.

  • Cash is unlimited. Burn still shows, so the player sees what a Design costs.

  • The player sets the users and an Era's Request kind mix, sets the speed, and triggers any Incident in the catalog.

  • There are no Users to grow, no Funding rounds, no Team, no Dev Hours, and no Insight. A free Sandbox is Design and traffic only.

  • The player can copy the current Company's Design into a free Sandbox, like a staging environment, to test a change before making it in the Company.

  • The free Sandbox keeps its Board in local storage between visits, apart from the Company save.

  • Achievements do not count in any Sandbox.

Challenges#

A Challenge is a fixed puzzle, separate from the company. It gives a brief, a fixed demand, a fixed palette, a fixed budget, and a duration. The player builds a design and runs it. A Challenge is complete when the design meets its targets.

This mode follows Opus Magnum: a crude solution is easy, and the depth is in improving it (Influences).

Scoring#

Every completed Challenge scores three axes. Lower is better on all three.

AxisMeasure
CostBurn per second at the target load
Tailp99 latency over the run
ComplexityNumber of Nodes plus number of links

Each axis has a histogram of every player's best result. The player sees where they fall, for example "Cost: better than 72% of players". The game never shows a rank or a top-10 list. The question is whether the player can reach the 70th percentile, not whether they can be first.

The three axes conflict. A cheap design has a long tail. A short tail needs more Nodes. So the player picks a direction, and each player's best results usually come from different designs.

Rules#

  • The first Challenge is open from the start. Completing a Challenge opens the next in the global list, including across Era boundaries. Completed Challenges remain open for replay; the daily drill is always open.

  • A Challenge's palette is fixed. Legacy perks do not apply. Every player has the same tools.

  • The seed is fixed. Incidents in a Challenge are scripted and the same for everyone.

  • Results upload as a design plus a seed, and the server re-runs them to verify. The server score is the authoritative one, and a score on the player's device is provisional until the server confirms it. The simulation is deterministic (Simulation).

  • Rewards: a badge, and Legacy on first completion (1 to 10 ★ by difficulty). No Cash, no power.

Challenge list#

Each Challenge is inspired by a real event or a real engineering problem. Briefs name the event as an inspiration; the numbers are the game's.

#ChallengeEraInspired byThe problem
1Hello, WorldGarageEvery first deployServe 20 rps of page on one box under $0.05/s
2Split the BoxGarageThe first scaling step at most companiesApp and database share a box; reach 100 rps
3SlashdottedPre-seedThe Slashdot effect×10 traffic for 3 minutes with a fixed budget
4C10kPre-seedDan Kegel's C10k problem (1999)10,000 concurrent slow clients; process-per-request runtimes fail
5The Event LoopPre-seedNode.js "Don't block the event loop"Node.js only; 5% login; p99 under 300 ms
6Too Many ConnectionsPre-seedPostgreSQL connection limits40 App Servers, one Postgres; no refused errors
7Stack Overflow on a ShoestringSeedStack Overflow serving huge traffic from a small number of serversServe the target with at most 12 Nodes
8The N+1SeedORM lazy loadingRails with N+1; 12 Dev Hours to fix it, then minimize Cost
9Thirteen EngineersSeedInstagram had 13 employees when Facebook acquired it (2012)Reach the target with a team of 13 and a fixed Dev Hour budget
10Credential StuffingSeedCommon attacks on login endpointsSurvive a login bot flood without blocking real users
11Black FridaySeries ARetail peak daysA known spike at a known hour; minimize cost
12us-east-1Series ASeveral AWS us-east-1 outagesA zone dies at minute 5; keep 99.9%
13Exactly OnceSeries APayment idempotencyCheckout with retries and no duplicates
14Two Million SocketsSeries APhoenix reached 2 million WebSocket connections on one server (2015)Hold the most rt connections per dollar
15Pokémon GOSeries APokémon GO launch traffic reached about 50× the planned target (2016)Demand ×50 of the forecast within 10 minutes
16Healthcare Launch DaySeries AThe healthcare.gov launch (2013)A fixed design with many faults; fix it under time pressure
17Thundering HerdSeries AReconnect stormsA Realtime Hub restart at minute 2; 60,000 users, then 240,000 reconnect at once
18Read StatesSeries BDiscord moved a service from Go to Rust to remove GC spikes (2020)A hot service with a strict p99; any runtime
19The Fail WhaleSeries BTwitter's timeline scaling problemsServe feed for accounts with 10 million followers
20Reports at NoonSeries BAnalytical queries on transactional databasesAdd dashboards without hurting checkout
21GPU EconomicsSeries BSelf-hosted inference against hosted APIsServe ai at the target with a positive margin
22MetastableSeries BMetastable failures in distributed systemsA retry storm in progress; recover with the fewest changes
23Regex of DoomSeries BCloudflare outage, 2 July 2019A WAF rule pins CPU worldwide; restore service
2443 SecondsSeries CGitHub network partition, 21 October 2018A short partition between regions; avoid split brain
25Follow the SunSeries CGlobal daily peaksFour regions with offset peaks; minimize cost
26CelebritySeries CHot keys from viral accountsOne key receives 30% of reads
27Gone From the InternetSeries CFacebook outage, 4 October 2021A routing change removes all regions; restore with a staged rollout
28The TypoSeries CAmazon S3 outage, 28 February 2017A capacity removal command goes wrong; recover a data tier
29Leap SecondPre-IPOThe 2012 leap secondClock jumps across a region
30Rule of 40Pre-IPOThe SaaS Rule of 40Reach growth plus margin of 40 from a loss-making design
31Postgres for EverythingPre-IPOThe "just use Postgres" argumentServe every kind with only Postgres Components
32Five NinesPublic99.999% availability targets99.999% of requests across four calendar weeks of scripted incidents

The daily drill#

Every calendar day (real day, UTC), all players get the same short Challenge: a seeded design with a seeded incident. Results go on a daily histogram. The drill takes 5 to 15 minutes. It is optional and never rewards streaks, so missing a day costs nothing.

Achievements#

Achievements reward knowledge, unusual builds, and real engineering moments. They do not reward hours played. Some unlock Mutators or Ventures (Exit and Legacy).

AchievementConditionUnlocks
Hello, WorldServe the first requestNone
It Works on My MachineShip a bad deployNone
Split BrainSplit the database onto its own NodeNone
Averages LieResearch percentiles while p99 is more than 5× the meanNone
Shared NothingReach Seed with only PHP-FPM servers and no memory incidentNone
BlockedHave a Node.js service whose p99 rises by 100 ms from one kindNone
Two Hard ThingsHave a stale-read incident on a cacheNone
Off by One RegionServe a user from a region more than 150 ms awayNone
Little's LawFix an app server bottleneck by fixing the databaseNone
Default AliveReach IPO without raising any roundBootstrapped indie
PolyglotRun five languages in production at onceNone
MonoglotReach IPO with one languageMutator: Single language
Big RewriteMigrate every service to a new language in one companyNone
StranglerFinish a migration in four traffic steps with errors under 1%None
Conway's LawHave more Services than teams, then fix itNone
FallaciesExperience all eight fallacies of distributed computing in incidentsNone
QuorumRun a wide-column store with R + W > N across three regionsNone
EventuallyRun R = 1, W = 1 at a billion usersNone
NinesHold 99.99% for a calendar weekMutator: Strict SLO
Five NinesComplete the Five Nines ChallengeNone
Thundering HerdSurvive a reconnect storm with no errorsNone
MetastableRecover from a retry stormNone
BlamelessWrite 50 postmortemsNone
RunbookHave an incident resolve with no player actionNone
Chaos MonkeySurvive 100 random terminationsMutator: Chaos Monkey
Hug of DeathSurvive a ×10 spike with no lost usersMutator: Hacker News front page
Egress ShockHave egress be the largest line on the billNone
FinOpsRun a fleet with reserved, on-demand, and spot Nodes at onceNone
Spot the DifferenceSurvive a spot reclaim with no errorsNone
Warm StartScale a JVM service during a spike with no p99 regressionNone
Zero GCRun a Rust service at 100,000 rpsNone
Let It CrashHave an Elixir service survive 1,000 crashes with no failed requestsNone
Postgres for EverythingReach Series B with only Postgres data ComponentsMutator: Postgres for everything
No CacheReach Series A with no Cache and no CDNMutator: No caches
CelebrityServe a 10-million-follower post with no hot key errorsNone
Follow the SunServe four regions with no Node above 70% at its local peakNone
Rule of 40Reach a Rule of 40 score of 80 as a public companyNone
Beat and RaiseBeat guidance eight quarters in a rowNone
UnicornReach a $1 billion valuationNone
DecacornReach a $10 billion valuationNone
Everyone OnlineReach 6 billion usersNone
Serial FounderExit with every VentureNone
HistogramReach the 90th percentile on any axis of any ChallengeNone
ParetoReach the 70th percentile on all three axes of one Challenge with one designNone