Game Rules & Scoring for Suirodoku

9 colors × 9 numbers = 81 unique pairs.

Each color contains all numbers (1-9), and each number exists in all colors. This means every color-number combination appears exactly once in the grid.

If you place a "Red 5" somewhere, no other cell can be "Red 5". This 4th constraint creates powerful deduction techniques unique to Suirodoku.

In Ranked mode, a game only counts after 40 seconds of play. If you quit before 40 seconds, no penalty is applied. After 40 seconds, the game is "activated" and will affect your rating.

If you accidentally close your browser or lose connection during a Ranked game, you have 5 minutes to return and resume your game. After 5 minutes, the game is considered abandoned.

The multiplier starts at ×3.0 and decreases linearly to ×1.0 over 40 minutes:

Streaks count across all difficulties: Easy → Hard → Medium = 3-win streak.

Each game contributes 30% to your new rating for that difficulty. High scores pull your rating up; low scores or abandons pull it down. Playing Hard mode does not affect your Easy rating, and vice versa.

Player ratings: Easy: 950 | Medium: 820 | Hard: 0 | Expert: 0 | Master: 0

Calculation: (950 + 820 + 0 + 0 + 0) ÷ 5 = 354

Tip: Even with high Easy and Medium ratings, the Global Rating stays low until you play all difficulties. A balanced player who plays all levels will rank higher than someone who only masters one difficulty.

Zero client-side trust: The browser transmits only raw input data (cell actions, timestamps). Score computation happens exclusively server-side via mirror calculation. No payload containing a score is ever accepted.

Cryptographic token validation: Google reCAPTCHA v3 generates signed tokens at game start and submission. The server verifies both tokens using a private secret key via Google's siteverify API. Tokens are single-use, time-limited, and cryptographically bound to the action. Forgery requires breaking Google's signature algorithm.

Server-authoritative timestamps: Game activation and completion times are recorded server-side at the moment of API calls. Client-reported durations are ignored. The speed multiplier is computed from server timestamps only.

Stateless mirror calculation: The server reconstructs the entire game state from raw inputs and independently computes: base points, speed multiplier, error penalties, hint costs, and bonuses. Any inconsistency between transmitted data and computed result triggers automatic rejection.

Session binding: Each ranked game is assigned a unique server-generated session ID at activation (40s). Submissions require a valid, non-expired session token. Replay attacks and session spoofing are blocked at the API level.

To bypass this system: An attacker would need to simultaneously forge Google-signed tokens, manipulate server-side timestamps, generate mathematically consistent raw data that produces a target score, and obtain a valid session ID without triggering the game activation flow.

Find My Rank: Instantly jump to your position in the leaderboard with one click.

Player Search: Search for any player by username to see their ranking and stats.

Real-time Updates: Rankings update automatically as new scores are submitted.