Offline, hybrid, online

#At a glance

The "someone goes away" row is WhitePawn's choice (profile whitepawn/1). Other apps can choose differently through the rules profile. Any game may also use several links at once (Bluetooth and the server, say): every record races on all of them and the first copy counts, see Links.

#Offline

Two phones at a café table, no internet. The game runs entirely between them. Every record carries its signer's own clock (at), every record is answered at once with an ACK, and both devices compute the clocks from those signed timestamps with the same function. While the game runs, each device also pings the other four times a second and checks every timestamp it receives against its own clock. A lie bigger than a few tens of milliseconds is caught on the spot.

If someone hops off. A player is gone when nothing arrives from it, no records and no pings, on any link. Without a referee nobody can tell whether it walked away or the radio failed, so a hop-off never wins anything:

• Gone before its turn started (it never acknowledged the last move): after away_after_ms the other device signs CANCEL and the game is canceled.
• Gone on its own turn: its clock keeps running. The other device may cancel after away_after_ms, or wait for the deadline and claim the flag, with a CANCEL right behind it. The claim decides; the CANCEL only counts if a move dated in time turns up later and voids the claim.

A canceled game is still a game: either player uploads it later and it is saved with all its moves, unrated.

#Hybrid

Same peer clocks as offline. When a device reaches the server, it also sends checkpoints in the background: an anchor at least every 10 seconds and right after every record it signs or receives, with the records themselves, so the server can deliver them. A checkpoint goes over the player's own authenticated session, or is the player's signature over a fresh server nonce, so it proves "this player was here at server time T". A phone without its own connection can get the nonce from the opponent over the direct link, sign it, and let the opponent submit it. A hybrid game anchors its genesis as soon as it can and plays on without it.

The server signs VERDICT_ABANDON for a player only on proof, when all three hold:

1. The game waits on them. They have not acknowledged the opponent's record R.
2. They held R. The server delivered R on their own session, then a nonce, and they signed that nonce in a checkpoint. The session is ordered, so the nonce arrived after R.
3. They did not answer. A checkpoint of their own at least away_after_ms later (WhitePawn: 15 s bullet, 30 s blitz, 60 s rapid, 120 s classical) still has not seen R.

That player was there, had the record and did not answer: it loses (a draw if the remaining player cannot mate). An honest client acknowledges at once, so it never meets all three. A player who goes quiet instead sends no such checkpoint, and the game is canceled. Only a player's own checkpoints count: the opponent holds all of that player's signed records and could submit them. Leaving them out, or holding back a relayed nonce, only removes evidence, and missing evidence never counts against anyone.

Everything else follows the offline hop-off rules, whatever the checkpoints say. A player who stays silent on its own turn past its deadline is flagged (its heartbeats keep it from reporting a move dated in time later). One that cut every link before its deadline gets the game canceled. A player gone before its turn started, with nothing proving it held the record, is an outage: canceled after away_after_ms. Missing checkpoints, a lost connection or a server nobody reached never turn into a loss.

#Online

The server becomes the clock. Both players anchor every record they sign, right after sending it to the opponent, and every record they receive. The server times each move by when its records reached it (their existence time) and forgives network lag from a bounded quota, the same way lichess does.

Why neither player can move time onto the other:

• You cannot make your move look earlier than it existed: anchors carry signed heads, never bare hashes.
• You cannot make the opponent's move look later: the opponent anchored it when sending, and the server pushed it to you then.
• Anchoring your own move late only costs your own clock.
• If you stop anchoring, your opponent anchors your moves when they arrive, and your clock keeps running, just like losing the connection today.

Flags and abandonment are the server's call, signed as verdict records (VERDICT_FLAG, VERDICT_ABANDON, VERDICT_RESULT). Without a direct link, an online game still works through the server alone: the anchor of a record is its delivery.

#Choosing