1. Server-Authoritative Game State (Zero Local Trust)
No game state or move execution is ever trusted from the browser client alone. The DAMII backend maintains the master board matrix, verifies all diagonal vectors, checks jump compulsions, and enforces clock thresholds independently.
- Client-side memory modifications, script injectors, or modified network packets are rejected instantly with HTTP 400 Bad Request.
- Every completed match generates a comprehensive move log (`movesJson`) stored with sub-second timestamps for referee inspection.
- Spectator feeds operate with anti-leak safeguards to prevent ghosting or external board assistance.
All match logs are permanently stored with SHA-256 room identifiers and available to admins during dispute arbitration.