Open-World Narrative · Guides & deep dives

0020: No Public Server Binaries at Launch — Player Hosting Is Platform-Orchestrated

browser of "player-hosted private rooms, filterable by mode, cell, region, ping, password, and mod set" — which implies player-controlled servers — but no document decides how players host: whether the studio distributes

3sections4 minread
Markdown source
On this page

Status: Proposed

Date: 2026-06-12

Context#

V5_features.md §"Network Quality, LAN, and Server Browser" specs a server browser of "player-hosted private rooms, filterable by mode, cell, region, ping, password, and mod set" — which implies player-controlled servers — but no document decides how players host: whether the studio distributes dedicated-server binaries to the public, or hosting stays on official infrastructure. The audit (V1_V7_PLAN_SET_AUDIT_2026-06-12 §6.2) flags the gap.

The decision is constrained from three directions:

  • Anti-cheat (ADR-relevant interaction): V5 ships Easy Anti-Cheat plus a custom server-side signal layer — aim plausibility, LOS-history wall-hack detection, speed and auto-fire checks "run server-side so a tampered client cannot suppress them" (features§"Anti-Cheat"). A public server binary hands that signal layer to the community: a community server operator can patch the signals out, and a public Linux server binary is the single best reverse-engineering artifact a cheat developer can get — symbols, replication schema, movement constants, and validation logic, decoupled from EAC's client protections. EAC itself attests clients, not third-party servers; there is no EAC story for community-operated server trust.
  • Licensing: the Unreal Engine EULA permits distributing dedicated-server builds to end users, so Epic is not the blocker; the blockers are our own middleware (per V5_DEPENDENCIES.md, several runtime components are licensed for studio-operated services, redistribution rights unverified) and the licensed-content bundles (ADR 0008 period-authenticity audio/likeness clearances are scoped to studio distribution channels). A redistributable server SKU would need a clause-by-clause middleware audit and likely re-papering — real cost, no launch payoff.
  • Already-specced hosting surface: the connection models already give players LAN (offline-capable, entitlement-check only) and listen servers (bounded co-op, sub-2 s migration). The unmet need the server browser expresses is persistent, configurable, mod-set rooms — not binary ownership.

Decision#

  1. No public dedicated-server binaries at launch. The server binary ships only to studio-operated fleets (GameLift + first-party relay pools).
  2. "Player-hosted" in the server browser = platform-orchestrated private rooms on official infrastructure. A player creates a room (mode, cell, region, password, mod set), and the platform places it as a dedicated session on the official fleet — the player owns the configuration and admission, the studio owns the binary and the signal layer. Rooms are capacity-managed as the small-mode session class in V5/docs/planning/capacity-and-load-plan.md (§2.2, 16-player class; hub- class rooms are not player-creatable at launch).
  3. LAN and listen-server modes are unaffected — they already run without online services and remain the offline/couch path per spec.
  4. Community dedicated binaries are deferred, not refused, and are contingent on an anti-cheat strategy revision: a community-server SKU requires (a) a server-trust tier in which community sessions are excluded from ranked, leaderboards, tournament reporting, and the shared persistent world, (b) the middleware/content redistribution audit above, and (c) a hardening pass that strips the proprietary signal layer from the redistributable binary. This work is scoped only if post-launch demand justifies it (trigger for re-evaluation: private-room creation sustained above 25% of online sessions, or a top-10 community feature request through two consecutive seasons).

Consequences#

  • The anti-cheat server-side signal guarantee stays true for every online session at launch — no session exists whose server the studio does not run.
  • Private rooms inherit official-fleet costs (priced into the capacity plan's small-mode fleet); a popular private-room scene is an infrastructure cost the studio carries, which is the deliberate trade against the cheat surface.
  • No community server scene at launch: no 24/7 community-modded persistent servers beyond what private-room configuration allows. This is a real community cost and should be messaged honestly ("private rooms, not server files") rather than implying server files are coming.
  • Sunset interaction: because players cannot self-host dedicated servers, the end-of-life commitments in V5/docs/planning/sunset-eol-commitment.md must cover the dedicated-MP path at EOL (its Preservation Patch converts bounded co-op to listen/LAN and commits to a community-server release decision at sunset, when the anti-cheat and licensing constraints lapse).
  • V7 supersession: V7's community-realm hosting continuum (V7/V7_features.md §"The Hosting Continuum" — Solo / Listen / Dedicated single Rust node up to ~256 / Meshed clusters) is the platform-level answer to community-operated servers, built with realm-scoped trust, verification (Ixchel/Sekhmet), and a registry from day one. When V7's Dedicated tier ships, it supersedes condition 4's bespoke V5 community-server SKU: V5-era community hosting demand routes to the V7 realm model rather than a V5 binary release, and this ADR should then be re-statused accordingly.