fix: implement server-side speed validation for paddle movement

Author: rgilks

ARCHITECTURE.md

@@ -57,6 +57,9 @@ Each game match runs in a Cloudflare **Durable Object** (DO). The DO maintains t
 - **Tick Loop:** The server calls `GameState::step` which delegates to `game_core::step`.
 - **Broadcasting:** Every 3rd tick (20Hz), it sends a snapshot to all clients via `broadcast_state`.
 
+> [!NOTE]
+> **Edge Latency Nuance:** While Durable Objects run "at the edge," each specific match runs in a **single location**. Frame updates still suffer light-speed latency for players far from that specific data center. Global latency is mitigated by region-aware matchmaking, ensuring players match in a DO close to both of them.
+
 ### 3. The Client (`client_wasm`)
 
 The client needs to be smooth (120Hz+) even though headers only arrive at 20Hz.
@@ -122,7 +125,7 @@ graph TD
 1. Browser captures key press in [`on_key_down`](client_wasm/src/lib.rs).
 2. Client updates local paddle immediately.
 3. Client sends `C2S::Input` to server.
-4. Server applies input in its next tick.
+4. Server validates input (enforcing speed limits) and updates entity intent.
 5. Server includes new paddle position in next broadcast.
 
 ### Rendering Frame
@@ -154,7 +157,7 @@ graph TD
 ```rust
 enum C2S {
     Join { code: [u8; 5] },
-    Input { player_id: u8, paddle_dir: i8, seq: u32 },
+    Input { player_id: u8, y: f32, seq: u32 },
     Ping { t_ms: u32 },
 }
 ```

ARTICLE.md

@@ -120,6 +120,8 @@ The server advances the simulation at ~60Hz but only broadcasts authoritative sn
 The server is the authority.  
 If the client thinks the ball is at `x = 100` but the server says `x = 102`, the server wins. Always.
 
+For paddles, the server uses **Target-Based Validation**. It accepts the client's desired position but moves the authoritative paddle towards that target at the maximum allowed speed. This prevents teleportation cheats while maintaining responsiveness.
+
 ---
 
 ## 3. Client: Prediction and Reconciliation

game_core/src/components.rs

@@ -43,15 +43,32 @@ impl Ball {
 }
 
 /// Movement intent for paddle
-#[derive(Debug, Clone, Copy, Default)]
+#[derive(Debug, Clone, Copy)]
 pub struct PaddleIntent {
-    pub dir: i8, // -1 = up, 0 = stop, 1 = down
+    pub dir: i8, // Deprecated: Only used for legacy/client prediction hints if needed
+    pub target_y: f32, // Desired Y position
+}
+
+impl Default for PaddleIntent {
+    fn default() -> Self {
+        Self {
+            dir: 0,
+            target_y: 12.0, // Center default
+        }
+    }
 }
 
 impl PaddleIntent {
     pub fn new() -> Self {
         Self::default()
     }
+
+    pub fn with_target(y: f32) -> Self {
+        Self {
+            dir: 0,
+            target_y: y,
+        }
+    }
 }
 
 #[cfg(test)]

game_core/src/lib.rs

@@ -81,7 +81,7 @@ pub fn step(
 
 /// Helper to create a paddle entity
 pub fn create_paddle(world: &mut World, player_id: u8, y: f32) -> hecs::Entity {
-    world.spawn((Paddle::new(player_id, y), PaddleIntent::new()))
+    world.spawn((Paddle::new(player_id, y), PaddleIntent::with_target(y)))
 }
 
 /// Helper to create the ball entity
@@ -212,13 +212,16 @@ mod integration_tests {
             &mut respawn_state,
         );
 
-        // Verify paddle moved
+        // Verify paddle moved towards target
         for (_entity, paddle) in world.query::<&Paddle>().iter() {
             if paddle.player_id == 0 {
+                // Should have moved UP (smaller Y) towards 5.0
                 assert!(
                     paddle.y < initial_paddle_y,
                     "Paddle should move up after input"
                 );
+                // Should not overshoot target if speed allows
+                // (Depends on speed/dt, but 12.0 -> 5.0 is far, so it should just be closer)
             }
         }
     }

game_core/src/systems/input.rs

@@ -1,21 +1,17 @@
-use crate::{NetQueue, Paddle};
+use crate::{NetQueue, Paddle, PaddleIntent};
 use hecs::World;
 
-/// Ingest network inputs and apply to paddle positions
+/// Ingest network inputs and apply by updating paddle targets
 pub fn ingest_inputs(world: &mut World, net_queue: &mut NetQueue) {
     // Process all queued inputs
     for (player_id, y_pos) in net_queue.inputs.drain(..) {
-        // Find paddle with matching player_id
-        for (_entity, paddle) in world.query_mut::<&mut Paddle>() {
+        // Find paddle and intent with matching player_id
+        for (_entity, (paddle, intent)) in world.query_mut::<(&Paddle, &mut PaddleIntent)>() {
             if paddle.player_id == player_id {
-                // Apply absolute position (clamped to arena)
+                // Update target, clamped to valid arena range for the center of the paddle
                 // Arena height is 24.0, paddle height 4.0.
-                // Valid range: 2.0 to 22.0 (center pos)
-                // Wait, previous code used Clamp(2.0, 22.0)?
-                // Let's check previous CLAMP values used in client:
-                // client.local_paddle_y.clamp(half_height, ARENA_HEIGHT - half_height);
-                // half_height = 2.0. Arena = 24.0. So 2.0 to 22.0 is center position range.
-                paddle.y = y_pos.clamp(2.0, 22.0);
+                // Valid center range: 2.0 to 22.0
+                intent.target_y = y_pos.clamp(2.0, 22.0);
             }
         }
     }
@@ -42,16 +38,16 @@ mod tests {
 
         ingest_inputs(&mut world, &mut net_queue);
 
-        // Verify positions were applied correctly
-        let mut paddle_y = Vec::new();
-        for (_entity, paddle) in world.query::<&Paddle>().iter() {
-            paddle_y.push((paddle.player_id, paddle.y));
+        // Verify targets were updated correctly
+        let mut paddle_targets = Vec::new();
+        for (_entity, (paddle, intent)) in world.query::<(&Paddle, &PaddleIntent)>().iter() {
+            paddle_targets.push((paddle.player_id, intent.target_y));
         }
-        paddle_y.sort_by_key(|(id, _)| *id);
+        paddle_targets.sort_by_key(|(id, _)| *id);
 
-        assert_eq!(paddle_y.len(), 2);
-        assert_eq!(paddle_y[0], (0, 5.0));
-        assert_eq!(paddle_y[1], (1, 18.0));
+        assert_eq!(paddle_targets.len(), 2);
+        assert_eq!(paddle_targets[0], (0, 5.0));
+        assert_eq!(paddle_targets[1], (1, 18.0));
     }
 
     #[test]
@@ -79,9 +75,11 @@ mod tests {
 
         ingest_inputs(&mut world, &mut net_queue);
 
-        // Last input should be applied
-        for (_entity, paddle) in world.query::<&Paddle>().iter() {
-            assert_eq!(paddle.y, 8.0, "Last input should be applied");
+        // Last input target should be applied
+        for (_entity, (paddle, intent)) in world.query::<(&Paddle, &PaddleIntent)>().iter() {
+            if paddle.player_id == 0 {
+                assert_eq!(intent.target_y, 8.0, "Last input target should be applied");
+            }
         }
     }
 
@@ -92,14 +90,18 @@ mod tests {
 
         net_queue.push_input(0, -100.0); // Too low
         ingest_inputs(&mut world, &mut net_queue);
-        for (_entity, paddle) in world.query::<&Paddle>().iter() {
-            assert_eq!(paddle.y, 2.0, "Should clamp to min");
+        for (_entity, (paddle, intent)) in world.query::<(&Paddle, &PaddleIntent)>().iter() {
+            if paddle.player_id == 0 {
+                assert_eq!(intent.target_y, 2.0, "Should clamp target to min");
+            }
         }
 
         net_queue.push_input(0, 100.0); // Too high
         ingest_inputs(&mut world, &mut net_queue);
-        for (_entity, paddle) in world.query::<&Paddle>().iter() {
-            assert_eq!(paddle.y, 22.0, "Should clamp to max");
+        for (_entity, (paddle, intent)) in world.query::<(&Paddle, &PaddleIntent)>().iter() {
+            if paddle.player_id == 0 {
+                assert_eq!(intent.target_y, 22.0, "Should clamp target to max");
+            }
         }
     }