The server holds movement to plausible limits; the game mode decides on suspicion

Status: Accepted (2026-11-02)

Context

A player's position is the client's claim, yet shots, pickups, stealth kills, vehicle entry, towing and streaming all rest on it. The server has no collision world, so it cannot tell a wall from open air. A threshold with a generous margin does not stop a cheat (the server is open source, so its thresholds are public), and dropping a frame that breaks a limit punishes an honest player on a lagging connection.

Decision

• A claimed position is cut back to the limit, not rejected. Each player and vehicle has an accepted position and a distance budget: it refills at an average speed limit, with room for a burst, and frames spend it. A frame past the budget is clamped to the limit; every check and the relay to other players see the clamped position, and the body catches up with the claim at the limit's speed. A false positive is brief and clears itself. Falling is free.
• Movement the server caused or expects is credited. Server teleports, spawns and seating move the body without counting against the limit; a vehicle exit, an explosion, a moving carrier (a vehicle roof, a moving object, a towing vehicle) and a network stall each lend speed or time for a bounded while.
• No correction goes to the client. A cheating client only fools itself; the protocol and the client stay as they are.
• What cannot be decided deterministically becomes the player_suspicion event. It carries a class (teleport, speed, fly, vehicle_teleport, vehicle_speed, god_mode, vehicle_god_mode), the measured value and the limit, and the number of distinct witnesses it rests on. It fires at most once per class per player in 5 s. The sanction is the game mode's (player:kick, a warning, nothing); clamping does not depend on it.
• Limits are server constants based on the game's own speeds, with no tuning surface until a game mode needs one.

Consequences

• The server keeps 3 s of position history per player (also used to rewind shots, ADR 0041).
• Movement the server did not foresee, such as a new carrier or a new way to accelerate a body, is clamped and flagged. A capability that adds one must declare it to this check, as a carrier or a limit.
• Walking through walls and levitating while claiming to stand on the ground need a collision world and are not caught.
• Server-side health accounting is ADR 0045.

Alternatives considered

• Drop a frame past the limit. An honest player on a lagging connection freezes in place for everyone else.
• Flag only far past the limit, with a large margin. The margin is public and becomes the cheat's speed.
• Send a position correction to the client. Adds a packet and a client behavior for nothing: the clamped position is already what everyone else sees.