In Ahmed Moaz’s account of building Boardit, the hardest multiplayer failures were not solved by adding more realtime subscriptions. They came down to three decisions: which copy of a board is authoritative, how a client recovers when an update is late or missing, and what the server must verify before accepting an action. His project paired Next.js App Router with Supabase Auth, Postgres and Realtime, and Cloudflare Workers for six browser games: Ludo, Property Rush, Trivia Tavern, Snakes & Ladders, Who’s the Spy, and Draw and Guess.
The lessons below are Moaz’s reported implementation details and measurements, not an independent audit or a guarantee about either platform. His central design rule is simple: store the truth in the database, use realtime messages to prompt faster reads, and keep a recovery path for clients that do not receive those messages.
As an Amazon Associate I earn from qualifying purchases.
Which copy of the board should players trust?
Moaz’s implementation treats the current game row in Postgres as authoritative. A browser’s local state is a view of that row, not a competing source of truth. Realtime notifications help a client learn that something may have changed; they do not replace reading the current state from the database.
That distinction matters whenever updates arrive out of order, arrive late, or never arrive. A client that treats every notification as a complete and definitive board update can remain stale or apply an obsolete view. In Boardit, a monotonically increasing version lets the client distinguish newer state from older deliveries. The shared-board hook also fetches authoritative state on a two-second interval, according to Moaz’s 2026 account, so a missed notification does not leave a turn-based game stale indefinitely.
#1 Best Overall
- 🎮 20,000+ Classic Games: This retro gaming console comes preloaded with over 40,000 classic games from your favorite retro consoles. Play instantly—no downloads, no internet needed!
- 📡 Dual Wireless Controllers: Enjoy smooth, lag-free gaming with two 2.4GHz wireless controllers. Play comfortably from anywhere without tangled wires, making multiplayer fun hassle-free.
- 🖥 4K HDMI Output: Connect the game stick to your TV, PC, or projector via HDMI and experience stunning 4K visuals for an immersive and crystal-clear gaming experience.
- 🔌 Plug & Play: Setup is super easy! Simply plug in the console, connect to your TV, and start playing immediately—no complicated installation required.
- 🎁 Perfect for All Ages: Whether you're introducing the next generation to classic entertainment or reliving nostalgic moments, this system makes an ideal gift for any occasion. Perfect for family gatherings, holidays, or just downtime fun.
Keep rules testable, but enforce actions on the server
Each game has its own reducer under lib/games/<game>/engine/. The reducer takes the current state and an action, plus explicit context for time and randomness, and returns a result. Passing time and randomness in rather than hiding them inside game logic makes rule behavior reproducible in tests.
Moaz reports tests for cases including tied votes, timeouts, rematches, simultaneous correct guesses, and malformed older states. Such tests check what the rules do when given particular state and actions; they do not establish that a browser is authorized to submit those actions or that two clients remain synchronized. The server action still has to decide who may act, supply trusted time and randomness, and persist the resulting state safely.
Treat version zero carefully after a rematch
Moaz notes that version zero can be ambiguous after a rematch. Rather than assume that a low version proves a client has the latest board, the hook re-fetches state in that case. This is a useful example of a recovery rule tied to the game’s lifecycle: version ordering helps identify newer updates, but lifecycle transitions can make a familiar version value mean something different.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat should a realtime message contain?
For games with hidden information, the safest shared update is often a signal to fetch—not a copy of the secret or even the whole board. Moaz describes a Broadcast pattern in which a database trigger sends a nudge when relevant state changes. The browser then fetches data it is authorized to see. The nudge itself contains neither board contents nor secrets.
For Draw and Guess, the word and choices are held in a separate restricted table, not in the shared board state. A server action returns them only to the drawer. Moaz says he applied the same kind of privacy review to roles and words in Who’s the Spy. A practical review question is: is every field in this shared object intended for every player who can join the room?
In his project, Moaz observed drawing-channel Broadcast delivery in tens of milliseconds, and later reports roughly 300 ms for Trivia’s Broadcast path compared with about five seconds for its earlier row-change path. Those are observations from Boardit, not a promise of latency for other applications or a service-level guarantee.
Row-change subscription and Broadcast nudge are different choices
| Approach | What it does in this design | Trade-off reported by Moaz |
|---|---|---|
| Postgres row-change subscription | Delivers a database-change notification to subscribed clients. | Some updates in this project took around five seconds to reach subscribers. The notification path can be slower than the observed Broadcast pattern. |
| Broadcast nudge followed by an authorized fetch | Signals that relevant data changed; the client fetches current data it is allowed to see. | Moaz observed faster delivery for the drawing channel and Trivia, while keeping secrets and board contents out of the nudge. |
Neither notification mechanism makes the message itself authoritative. The database remains the source of current state, and the client’s fetch is where authorization governs what it receives.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 【Relive Memories with Everyday Fun】Dive into nostalgia with our retro gaming console, pre-loaded with 2000+ classic and modern titles across 9 emulators. As one of the top game consoles with built in games, it offers endless variety so you never play the same game twice.Support for 24 language settings allows you to enjoy the game in your most familiar language.
- 【Versatile Entertainment for All Ages】Our dual wireless game console is the ultimate all-in-one solution, serving as both handheld video games for adults and tv games for kids. With its portable design and seamless TV connectivity, it transforms any space into a gaming hub, making it a perfect game system for family fun.Enjoy over 2000 built-in games that cater to every generation.
- 【High-Definition&Plug-and-Play Setup】Experience crystal-clear graphics with 1080p HDMI output,turning your TV into an instant arcade with plug and play video games for tv. The included 64GB TF card ensures ample storage for all your games, while the wireless design eliminates clutter. It's a user-friendly game stick-style device that requires no downloads or complicated installations—just connect and play!
- 【Kid-Friendly&Family-Oriented Design】With 2 PCS 2.4GHz wireless controller adapters, the connection is stable,the maximum connection distance is 32.8 ft.Console encourages cooperative play with its dual-user capability. It's an ideal game console for children to enjoy educational and entertaining titles, while adults can join in for multiplayer fun. The simple interface and robust build make it a reliable choice for everyday use, promoting bonding through shared gaming sessions.
- 【Perfecet Holiday Gift for Endless Joy】Surprise your loved ones with the perfect present this holiday season! Whether for Christmas, Thanksgiving, or the New Year.it's more than a gift—it's a box of shared memories and fun, making it the most thoughtful and entertaining present for any celebration.Rediscover the joy of gaming with this versatile video game consoles which brings back childhood memories while keeping entertainment fresh daily.
What happens when a socket goes quiet?
A notification-only design has no repair mechanism if a client misses the message. Boardit’s shared-board hook combines subscriptions with the two-second authoritative-state poll Moaz reports for this project. The subscription can make an update visible sooner; the poll reconciles a client that missed or delayed an event.
That fallback has costs: it adds database reads, and polling can make a disconnect less immediately visible than a connection-status signal would. For turn-based play, Moaz chose that trade-off to give clients a way to converge on current state even when the realtime path is unreliable. A poll is not a replacement for access controls or a guarantee of instantaneous updates; it is a recovery mechanism.
- Notification only: fewer reconciliation reads, but a client can stay stale if the event is lost or delayed.
- Notification plus polling: a quicker path when events arrive and a repair path when they do not, at the cost of recurring reads and less immediate disconnect visibility.
The Worker is not the gameplay WebSocket endpoint in this architecture. Browsers connect directly to Supabase Realtime; the Worker handles rendering and trusted actions. That separation matters when deciding where to investigate a quiet socket: the Worker’s WebSocket budget is not the same thing as the browser’s Realtime connection.
How should a game handle an absent player?
Timeout policy is part of a game’s rules, not just a timer in the interface. Moaz describes different policies for games with different waiting patterns. The server validates deadlines; a client clock is not trusted to decide that a player’s turn has expired.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ludo and Snakes & Ladders: a fixed turn clock
Moaz reports 30-second turn clocks for Ludo and Snakes & Ladders. When a Ludo deadline expires, the server checks its own deadline and selects an obvious legal move. Its reported priority is to capture, get a pawn home, leave base, then advance the furthest pawn. This keeps the table moving without letting a client invent an expired turn or submit an illegal automatic move.
Property Rush: inactivity with auction pauses
Property Rush uses an inactivity model because a player may have completed an action but still be waiting during an auction. Moaz reports a 30-second grace period, a warning before a 150-second deadline, and a pause to that deadline while an auction is active. On expiry, the inactive player is removed from the table. A single fixed turn timer would not represent that waiting behavior as well.
The useful design distinction is whether the game is waiting for a player’s required move or whether that player has acted and the table is waiting on a shared process. The timeout should model the actual state of play, and the server should validate the deadline and transition.
Rank #3
- Tabletop Strategy Game: Bring the fun of the classic digital game to the tabletop & experience the fun of Tetris in real life with this multiplayer strategy game of rotating, dropping & line making
- Classic Tetris with a Competitive Twist: Drop a Tetrimino on a black Garbage Drop Icon in your grid to gain the power to add a piece to an opponent’s grid to block their line & their path to victory
- Puzzle Game: Tetris fans of all ages will have a blast dropping the semi-translucent pieces straight from the video game while having fun strategizing & problem solving; for 2-4 players, ages 8 & up
- Family Game Night: Keep the fun going with more Spin Master Games to add to your family’s board game shelf: Hedbanz, Beat the Parents, Family Feud, Jumanji, Wicked: The Game, Mind the Gap & more
- Spin Master Games & Toys: Looking for kids games, yard games & card games for adults, kids or teens? Find family favorite puzzles & games for family game night, travel games, kids puzzles & more
How do room codes and guest accounts affect access?
Room codes are credentials
Moaz treats a short room code as a bearer credential: anyone holding it can try to join. In his account, the application uses the caller’s session-bound Supabase client for a membership-scoped room lookup, with row-level security (RLS) enforcing the membership boundary. Privileged database access is reserved for operations that require it. Room codes are excluded from analytics and unnecessary debugging output; internal UUIDs are used as analytics identity instead.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A code that looks like a convenient locator still grants an attempt at access. That makes it important to avoid leaking it through telemetry or logs and to enforce membership in the database-backed path, not merely hide controls in the browser.
Anonymous sessions simplify entry, not authorization
Boardit uses Supabase anonymous auth sessions for guests. As Moaz describes it, those sessions give players stable user IDs for membership checks and RLS without requiring an email address or password before play. The trade-off is additional account-boundary work: guest cleanup, transitions between guest and full accounts, and what happens when a player returns on another device. An anonymous identity does not remove the need to authorize every operation.
Why did the Worker deploy fail when the app worked locally?
The project’s generated Worker exceeded the free-tier bundle limit Moaz reports. He measured a 3,084 KiB gzipped bundle in 2026 against the 3,072 KiB limit he describes for the free Workers tier at that time: a 12 KiB overage was enough for deployment to be rejected. These are figures from his account, not a current statement of Cloudflare plan limits; check Cloudflare’s current documentation before relying on them.
One surprise was dynamic social-image rendering. Moaz says it pulled in roughly 1.5 MB of WebAssembly. Replacing it with a pre-rendered 1200×630 public/og.png removed about 279 KiB from the generated bundle. Replacing a server analytics SDK with fetch removed another 94 KiB, and removing an unused icon package trimmed more weight. The project now runs on Workers Paid; Moaz gives a 10 MiB limit for his setup, which should not be assumed to describe every current plan or configuration.
The diagnostic lesson is to inspect the generated adapter output, not infer deployability from a successful local run. Work that does not change—such as a social image—may belong in a static asset rather than the request runtime. Bundle size is also distinct from the Worker’s WebSocket budget in this design, because gameplay subscriptions connect from the browser to Supabase Realtime rather than through the Worker.
What the implementation does—and does not—show
Moaz’s September 27, 2026 DEV Community post is a first-person account of Boardit, not an independent performance test, security audit, or vendor specification. The reported delivery times, polling interval, and bundle measurements describe this project and its setup. They should not be generalized into expected Supabase latency or current Cloudflare limits.
The implementation’s strongest transferable lesson is architectural rather than numerical: keep game rules independently testable, make the database state authoritative, enforce authorization on server/database paths, keep private information out of shared payloads, and give clients a way to reconcile when notifications fail. Those layers address different failure modes; a reducer test cannot prove access control, and a fast notification cannot prove that every client has the latest board.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
