What actually happens when a browser talks to a server — the status codes, the address system, the machinery — every entry explained in plain English, then shown live in your own estate: the Railway 404s, today's DNS cut, the concierge that answers 403 to strangers.
Every page view is a phone call. Five things happen in about half a second — and every term in this manual lives at one of these five steps.
You type labs.elysiumlabs.co.za. That's a name, not an address. The DNS system is the phone book that translates it into an IP address — the actual number to dial. Today's "DNS cut" was adding one line to that phone book.
Your browser connects and both sides agree to encrypt the line (the padlock). If nobody picks up, that's a timeout — what truef.co.za does right now, on purpose.
The browser asks: GET /beer-fong/ — "give me this page." Requests can also send things: a booking form is a POST.
Before any content, the server replies with a 3-digit verdict: 200 here-you-go, 404 nothing-here, 301 we've-moved. This is the number the whole dead-or-alive audit ran on. Full board in §2.
Then the goods arrive: HTML, images, scripts. A server can lie — say 200 but serve an error page — which is why the sweep also checked the content, not just the code.
The first digit is the whole story: 2 = success, 3 = go elsewhere, 4 = you/the address is the problem, 5 = the server is the problem.
"Found it, here's the page." The healthy answer. The guest house picked up and said "yes, we're open."
"Done — nothing to show you." The server did what you asked but has no page to send back. Common after saving a setting.
"We've moved — here's the new address, update your records." Browsers follow it automatically; Google transfers the old address's reputation to the new one.
"Temporarily over there." Same forwarding, but "don't update your records." Used for logins ("go sign in first, then come back").
-L flag means "follow the hops.""Nothing lives at this address." The server answered — it exists — but has no page by that name. The number is in service; the room is empty.
*.up.railway.app deploys. The server farm answers; your apps are gone from it."It exists, but you need a password." Crucially different from 404: something is alive behind the door. A 401 in an audit means not dead — locked.
"I know who you are — and no." A password won't help; you're simply not allowed. Servers use it to turn away suspicious callers.
/api/chat gives 403 to foreign websites so strangers can't drain your metered AI key from their own pages."Slow down." You've called too often, too fast. This is rate limiting — protection against hammering, accidental or hostile.
"Something broke on our end." Your request was fine; the code behind the door crashed. The generic "it's not you, it's me."
"The front desk answered but the office behind it is down" (502) or "we're temporarily closed — try later" (503, typical mid-deploy or overloaded).
Not a real code — curl's way of saying "nobody even picked up." No server, no DNS entry, or a timeout. Worse than 404: with 404 something answered.
The forty-odd words that come up every session, grouped by where they live. Filter as you go.
— NO MATCH · CLEAR THE FILTER —
How a name you can remember becomes a machine you can reach.
A name you rent yearly (never own outright) from a registrar: elysiumlabs.co.za. Stop paying and it goes back on the market — part of how rextrueform.co.za was never gettable.
A free extension on the left of a domain you already rent: labs., sites., dashboard. — three doors into the same Elysium building, each leading somewhere different. No extra rent.
The internet's phone book: name in, IP address out. Distributed worldwide, which is why a change takes minutes to spread ("propagation").TodayCutting labs.elysiumlabs.co.za = writing one DNS record. Cloudflare did it automatically from the worker config.
One phone-book line. An A record points a name at a server's IP; a CNAME points a name at another name ("same as him"). sites.elysiumlabs.co.za once broke purely because its CNAME didn't exist.
The actual numeric address of a machine, e.g. 192.168.0.28 (your Mac on home Wi-Fi) or a public one for a server. Names exist because humans can't remember these.
The full address of one thing: protocol + domain + path — https://labs.elysiumlabs.co.za/beer-fong/. Everything after the domain is the path — which room in the building.
A numbered door on one machine, letting many services share it. The web uses 443 (https) by default so you never see it — but locally every tool needs its own door.In your estateDashboard :7450 · Image Scraper :7432 · Beat Sermon :7436 — the port registry exists so two tools never fight over one door.
"This machine, talking to itself." localhost:7450 is your dashboard reachable only from your own Mac — nothing on the internet can see it. The opposite of deployed.
The security layer — what the padlock means and where secrets live.
The encrypted version of the call — the padlock. Anyone tapping the line sees noise, not your booking details. SSL/TLS are the protocol names; HTTPS is HTTP running over them.
The ID document proving a server really is who it claims, issued by an authority browsers trust. Expired cert = scary browser warning.TodayCloudflare auto-issued the labs. certificate during the DNS cut — the ~20-second wait before first 200.
A password for software — a long secret string a program presents to use a paid/limited service. Leak one and strangers spend your money.In your estatePexels/Unsplash keys power the Image Scraper; an ADMIN_KEY leak on TRUEF forced a rotation. Keys live in env vars, never in code.
A named value handed to a program from outside its code — where secrets belong. The code says "use OPENROUTER_API_KEY"; the hosting platform supplies it. Code can be shared; the env var never travels with it.
Proving who you are (login, key, cookie). Its sibling authorization is what you're then allowed to do. 401 = failed authentication; 403 = failed authorization.
"Max N calls per minute" enforcement — the bouncer that answers 429. Protects paid APIs and servers from being hammered, maliciously or by a runaway script.
What's actually running on the other end of the call.
Just a computer that answers requests, usually someone else's, in a datacentre, running non-stop. Your Mac becomes one every time Flask starts.
Renting space on someone's always-on computers so your site answers while your Mac sleeps. Railway, Cloudflare and Vercel are all hosting — different shapes, same job.
A site that's just files — HTML, images, JS — the server only hands them over, computes nothing. Cheap to host, nearly impossible to crash.In your estateBeer Fong and NeeDoh are static — why reviving them on THE LAB cost nothing.
A site with a brain — code that runs on the server per request: databases, logins, rendering. Needs a real computer, which costs money.In your estateVaporwave rendered voxel videos server-side — a backend — so it can't live on the Lab's static hosting. That's the whole "dry dock" story.
Everything that runs in the visitor's browser: the HTML, CSS and JavaScript they see and touch. Your vanilla-JS preference is a frontend choice.
A service's counter for software — instead of pages for humans, structured answers for programs. QuokkaBot's currency switcher calls a rates API; your dashboard's queue_tools talk to its own.
One specific counter window at an API: /api/chat, /health, /claim. Beer Fong's prize QR points at a /claim endpoint whose server is gone.
Structured, searchable storage that survives restarts — the difference between "a file" and "a system of record". Supabase (Rex Casino), D1 (TRUEF), even leads.json is a tiny one.
A small program (or set of files) running on Cloudflare's edge — hundreds of locations worldwide instead of one server. Free at your scale.In your estateThe audit's survivors — Elysium, TRUEF, Keyside, Papachinos, Galaxy Map, THE LAB — are all Workers. The pattern that lived.
Copies of your site stored near the visitor — a George visitor gets served from Johannesburg or Cape Town, not Texas. Faster pages; it's why Cloudflare sites feel instant.
A kept copy to avoid re-fetching — browsers cache images; edges cache pages. Fast, but can serve stale content briefly.In your estateCloudflare's ~5-min edge cache is why a deploy can "look like it didn't take" — the ?v=timestamp cache-buster forces a fresh copy.
Hosting with no machine you manage — code runs on demand, you pay per use (often nothing). Workers are serverless. The opposite: Railway, where a container of yours runs (and bills) continuously.
How code gets from your Mac to the world — and back out of trouble.
A time machine for a folder — every saved state (commit) is recoverable forever. The vault's Brain has one; the sweep commits to it every sitting.
One project under git's protection, locally and/or on GitHub. The lesson of Vaporwave: it had no remote repo — folder deleted, Trash emptied, code gone forever. A pushed repo can't die that way.
Commit = save a snapshot with a message, locally. Push = send those snapshots to GitHub so they exist off this machine. Commit without push = backed up nowhere.
Ship it — copy the current code to the hosting so the live site changes. npx wrangler deploy, railway up, ./publish.sh — same verb, different platforms.
A transform step before deploy — bundling, compiling, snapshotting. Keyside's publish.sh boots the Flask app and photographs every page into static files; that's a build.
Production = the live thing real people touch. Staging/lab = the practice copy you break safely.In your estatetruef-studios (prod) vs truef-studios-lab — with the standing trap that lab shares prod's database, so lab code is safe to ship but lab data-writes hit real orders.
Deploying a previous version to undo a bad ship. Cloudflare keeps every worker version; git keeps every commit — rollback is why the time machine matters.
Hosting where anything your app writes to disk dies on redeploy. Railway works this way.In your estateThe trading datalog needs a mounted Volume or every redeploy wipes months of data; the Image Scraper's throwaway /tmp zips are ephemeral by design.
How you prove things instead of guessing — the sweep's toolkit.
A command-line phone: make one web request, show exactly what came back — status code, headers, content. No browser, no cache, no interpretation.In your estateThe entire dead-or-alive audit was 39 curl calls. Every "verified" date in the vault is a curl receipt.
A real browser without a window, driven by code — it runs the JavaScript, lays out the page, takes screenshots. Catches what curl can't: overlaps, broken JS, tiny tap targets.In your estateThe phone-QA harness (Playwright at 360/390/430px) that cleared all 14 guest-house pages and THE LAB.
The server's diary — one line per event, including every error with its exact time and cause. The first place to look when something 500s; on Railway, railway logs.
A robot that calls your sites on a schedule and alerts when an "up" host stops answering 200.In your estateThe Sunday engine reads DATA.md's endpoints table weekly — THE LAB joined the watch list today.
The delay before an answer arrives, in milliseconds. Edge hosting exists to shrink it: Texas→George is slow physics; Cape Town→George isn't.
How long a caller waits before giving up. The audit gave every site 15 seconds; truef.co.za let all 15 pass in silence — that's a timeout, logged as 000.
The caller ID a browser sends — "I'm Safari on an iPhone." Sites use it to serve mobile layouts; scrapers change theirs to look like browsers.
A script that lets a website install like an app and work offline by caching its own files on the phone. PWA = a site doing this properly.In your estateBeer Fong and Radium Hall are PWAs — Beer Fong plays with no signal once installed.