A leaderboard score is easy to display and difficult to trust if the browser sends only the final number. In fat-fingers, ranked verification reconstructs the run from its inputs.
Submit evidence of the run#
The verification contract includes the target seed, duration, difficulty, and input events. The server regenerates the target and applies those events to the same kind of typing state used for scoring.
The payload does not need to supply trusted WPM, accuracy, or a trusted word list. Those are derived values. Accepting a client-provided target would let the client change the task it supposedly completed.
Enforce the time window during replay#
Events must be ordered, fit the event-count limit, and fall within the ranked duration. The clock starts with character input, and verification filters the replay to the timed window.
Suppose a fifteen-second run contains events from the next forty-five seconds. Replaying all events and dividing by fifteen seconds would inflate the result. Filtering first preserves the relationship between credited work and allowed time.
Keep correction semantics explicit#
WPM uses correct credited characters. Press-time accuracy counts correct presses against total presses. These answer different questions.
A corrected mistake may disappear from the final text, yet it still happened during the run. Counting only the final text would conceal that extra input. The engine also credits a word separator only after a completed word has actually been passed.
Bound the claim#
Replay makes a submitted score reproducible from the accepted event stream. Ordering checks, ranked-duration checks, and a maximum-score condition reject several malformed submissions. They do not establish that all accepted input was human-generated.
That distinction keeps the implementation useful and honest: deterministic verification is a concrete improvement, while stronger anti-cheat claims require additional evidence.