Make spawn and movement acceptance server-authoritative

docs/protocol-notes.md

@@ -10,7 +10,7 @@ This is a behavior guide for packet semantics beyond raw schemas.
 
 ## Client -> Server
 
-- `update_position`: authoritative player position update.
+- `update_position`: client movement intent; server enforces world bounds and movement rate policy.
 - `update_nickname`: nickname change request (server enforces uniqueness).
 - `chat_message`: player chat.
 - `ping`: latency measurement.
@@ -45,6 +45,9 @@ This is a behavior guide for packet semantics beyond raw schemas.
 ## Welcome Metadata
 
 - `welcome.worldConfig.gridSize`: server-authoritative grid size used by clients for bounds/drawing.
+- `welcome.worldConfig.movementTickMs`: server movement-rate window used for client movement pacing.
+- `welcome.worldConfig.movementMaxStepsPerTick`: max allowed grid steps per movement window.
+- `welcome.player`: server-assigned spawn/current self position at connect time.
 - `welcome.serverInfo`: server process identity/version metadata:
   - `instanceId`: unique id generated at server startup
   - `version`: server package version (or `unknown` fallback)
@@ -60,6 +63,7 @@ This is a behavior guide for packet semantics beyond raw schemas.
 ## Validation Boundaries
 
 - Server is authoritative for all action validation and normalization.
+- Server is authoritative for movement acceptance (bounds + rate/delta checks).
 - Client validates incoming packet shapes and applies runtime behavior.
 - Client-side item edit validation is convenience only; server remains source of truth.
 

docs/runtime-flow.md

@@ -8,10 +8,13 @@
 4. Server sends `welcome` with users/items snapshot.
 5. Client:
    - applies `welcome.worldConfig.gridSize` for authoritative grid bounds/rendering
+   - applies `welcome.worldConfig.movementTickMs` as movement pacing guidance
+   - applies `welcome.worldConfig.movementMaxStepsPerTick` for movement-rate parity
+   - uses `welcome.player` as authoritative starting position
    - records `welcome.serverInfo` (`instanceId`, `version`) for restart detection
    - if `welcome.serverInfo.version` differs from running client version, auto-reloads the page
    - applies `welcome.uiDefinitions` for item menus/properties/options
-   - sends initial `update_position`
+   - sends initial `update_position` echo from server-assigned starting tile
    - sends initial `update_nickname`
    - creates peer runtimes for known users
    - syncs item runtimes (`radio`, `emit`)
@@ -24,6 +27,7 @@
 Each frame:
 
 - Handle local movement input.
+- Send movement intents; server remains authoritative on accepted movement updates.
 - Update spatial voice audio.
 - Update spatial radio audio.
 - Update spatial item emit audio.