John Guerra · Backend Software Engineer · Laredo, TX

I find out why
production systems
actually fail.

I’m a backend engineer. For six years I’ve worked in Java and Python on systems running under live production load, mostly high-traffic real-time infrastructure. A good share of what gets handed to me has been looked at before and written off as something else.

This page is arranged by depth. Each section goes further down into the system than the one above it.

340 Case files

Case 01

A freeze that had been open for two years

Dragonball Online Global · live consumer platform · whole user base affected

000

Reported

Clients froze at random and nobody could reproduce it on demand.
120

Assumed cause

~~A memory leak~~ Every earlier attempt stopped here.
340

Traced

ProcMon showed the pauses lining up with logging calls.
620

Mechanism

Every log line was flushed to disk before the program continued.
900

Root cause

Antivirus was inspecting each of those writes, which turned slow logging into a visible freeze.

Outcome I rewrote the logging path and the freezes stopped across the whole user base, after two years open.

Case 02

A launch that started degrading the moment it was real

GekkoQuest · client: Bionic · Java real-time session server, built from scratch

000

Reported

A newly launched server started degrading under real traffic. Synthetic load testing had not surfaced it.
200

First pass

I found and fixed memory leaks and hot-path bottlenecks within 24 hours of launch.
520

Second pass

JVM heap sizing and GC tuning, plus Prometheus instrumentation so the next regression would show up in metrics first.
900

Held

A fixed 50 ms processing deadline at 99.9% uptime, maintained through live incident response.

Outcome I co-architected the server and scaled it through a launch of 1,000+ concurrent connections.

Case 03

Detecting actions the client would not report

Dragonball Online Global · real-time abuse detection · Python

000

Reported

Users were performing actions the rules should have made impossible.
150

Assumed cause

~~Ask the client what happened~~ The client is the one component the user can modify.
480

Approach

I cross-validated heartbeat cadence against observed movement and action rates, so detection did not depend on what the client reported.
900

Result

Speed and automation exploits were caught while they were happening, using signals the client could not forge.

Outcome A real-time Python service that cancels impossible actions while they are still in flight.

Reported upstream

sveltejs/kit #16933
Streamed error pages were served with HTTP 200

SvelteKit’s streamed response path left out the status code that the buffered path already passed, so error pages reached caches and intermediaries looking like successful ones. I reported it on 25 August 2026.

The project’s triage bot wrote the patch. Its first attempt merged the two response paths into one and turned CI red. I traced that to the buffered path losing the Content-Length that text() had been setting, which left the traced response body size unknown. I asked for the two paths to be kept separate instead of the failing tests being changed, and for the header to use the body’s UTF-8 byte length rather than its string length.

A maintainer then told the bot not to take my instructions on trust, and to work out from scratch whether the fix was actually right. It did, and reached the same answer. The patch merged that night with a regression test.

Further security and quality reports are open with Notepad++ and SvelteKit.

620 Instruments

Three systems I built and maintain myself.

Fairview

Local interview-monitoring agent

Rust · Windows · macOS · Linux

GekkoQuest/fairview

Fairview runs on the candidate’s own machine and gathers evidence about what else is running there, then checks it against a session policy. The report it writes lists findings: a click-through overlay, a virtual display, a known assistant process. Deciding what any of that means is left to a person.

Most of the work is in deciding what to ignore. Discord, NVIDIA and Steam all draw overlays. Plenty of people work on two monitors. gdi32.dll is mapped into almost every desktop process on Windows. Fairview treats all of that as ordinary, and it will never match a process name against a substring like “gpt”, which would catch an editor, a browser tab and half a user’s home directory.

Each signal has one specific source. On Windows, display topology comes from QueryDisplayConfig and the monitor’s EDID; Linux reads /sys/class/drm and macOS uses CoreGraphics. Overlay state is read from window styles and display-affinity flags. Microphone use comes from active WASAPI capture sessions, which also identify the PID holding the device. Baselines are keyed on PID and image path together, since PIDs get reused and a reused PID belongs to a different program.

The README is explicit about what the tool cannot see. A local agent has no view of a phone, a second laptop, or a chat assistant open in a browser tab the policy allows.

Ring Logger

Lock-free Java logging library

Java 24 · JMH

GekkoQuest/ring-logger

A logging library for Java services where the logging call has to stay cheap enough to leave in a hot path.

Steady-state hot-path allocation is cut to zero using a 16K ring of pre-allocated direct ByteBuffers, with VarHandle release/acquire publishing and lap-tagged flags so a consumer can never read a half-written slot on wrap. Counters are cache-line padded; the drain batches with spin, yield and park backoff.

0allocations, steady-state hot path
16Kpre-allocated direct buffers
~3×Log4j2 async throughput, short messages
~25×cheaper than per-call System.nanoTime

Stella / Novi

Real-time AI VTuber

Python · asyncio · ONNX · WebSockets · SQLite · React · Tauri

A live virtual character that listens, talks and reacts on stream in real time. Roughly 25,000 lines, built and operated solo, on a single-process asyncio runtime. Every input module hands typed events to exactly one writer, so a failed dependency degrades to a status flag instead of stalling the voice loop.

It merges microphone audio, live event streams, encrypted voice and vision into one ordered timeline — isolating voice-activity state per speaker and rate-limiting chat with token buckets and per-sender cooldowns, so a burst can’t evict the live context window.

The prompt path assumes hostile input: text sanitized against delimiter injection, identity keyed to immutable numeric IDs rather than renameable logins, and inbound events PII-screened ahead of a two-level moderation filter.

~400msend of speech to first audio
120Hzanimation and lip-sync compositor
~25klines, single-process, solo

The 400 ms comes from running ASR on CPU via ONNX and streaming the first sentence into TTS through a hand-written incremental parser — before the model’s JSON closes, which removes a full round-trip from the live path. The compositor runs at 120 Hz because measured frame-gap data said 60 Hz was holding about 15% of frames.

840 Record

Aug 2023 — Present

Mineplex · MunchyMC · Bionic

Backend Software Engineer

GekkoQuest — contract backend engineering for high-traffic real-time networks

Hardened server-side abuse detection for a network averaging 7,000+ concurrent connections, extending packet inspection and movement validation and shipping through development, staging and production.
Built and maintained a client’s server-side abuse detection end to end — detection logic, threshold tuning and false-positive triage, on a live network.
Co-architected a Java real-time session server from scratch and scaled it through a launch of 1,000+ concurrent connections.
Diagnosed and resolved memory leaks and hot-path bottlenecks within 24 hours of going live, then held a fixed 50 ms processing deadline at 99.9% uptime through JVM heap and GC tuning, Prometheus instrumentation and live incident response.

Feb 2020 — Sep 2025

One of three developers

Backend Developer (Volunteer)

Dragonball Online Global — a live, long-running consumer platform

Eliminated a two-year client freeze affecting the entire user base by tracing it through ProcMon to synchronous per-write flush logging compounded by antivirus scanning, then rewriting the logging path — a failure repeatedly misdiagnosed as a memory leak.
Cancelled impossible user actions in flight with a Python real-time abuse-detection service that cross-validated heartbeat cadence against movement and action rates, catching speed and automation exploits the client could not be trusted to self-report.
Held a weekly release cadence to the live user base while reverse-engineering and incrementally modernizing legacy synchronous C++ subsystems, owning client stability, performance and CI/CD across a three-person team.

The two roles above overlap. For three of those years I also coached at a local axe-throwing center, and fit the engineering work around it.

Stack

Languages: Java · Python · C++ · TypeScript · SQL
Backend & performance: Spring Boot · FastAPI · Netty · REST · WebSockets · asyncio · multithreading · JVM and GC tuning
Data & infrastructure: PostgreSQL · MongoDB · SQLite · Redis · Docker · Linux · Git · CI/CD · Prometheus
Tooling: AI-assisted development · Claude Code · Codex
Spoken: English (native / bilingual) · Spanish (professional working)

1000m — bedrock

If you have a problem
that’s been closed
and reopened twice

I’d like to hear about it. I’m open to backend and systems work in Java or Python, contract or full time.

I find out why production systems actually fail.