V7 Discovery Integrity — Anti-Gaming for the Realm Browser

Status: V7 trust-and-safety / discovery design. Source: fills the planning gap identified in V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.2 (no anti-gaming design for realm discovery). Grounded in V7/V7_features.md (features§"The In-Game Realm and Mod Browser", features§"Realm Lifecycle and Registry", features§"The Economy Firewall and Anti-Fraud") and V7/V7_ARCHITECTURE.md (arch§"The Economy Firewall and Anti-Fraud" — the verified-spend/retention/graph levers, arch§"Observability and Live Operations", arch§"The Trust Boundary — Platform vs. Realm"). The eval-gate format follows V7/ADVERSARIAL_EVAL_GATES.md. Owner: Abundantia discovery lead (ranking), anti-fraud team (detection), Kuanyin (penalties). Date: 2026-06-12.

1. The Plague Being Designed Against#

FiveM's server browser is the cautionary tale: fake-population servers (idle bots and spoofed player counts) crowd the top of a list sorted by raw player count, because raw count is both the ranking input and operator-reportable. New players join "full" servers that are empty of humans; honest servers are buried; trust in the browser dies and discovery migrates to streamers and Discord — exactly the funnel V7's realm browser must own (features§"The In-Game Realm and Mod Browser"). Every mechanism below follows one principle: rank on what the platform itself verified, weight what bots cannot cheaply fake.

2. Population Attestation — Platform-Verified Presence Only#

• Realms never self-report population. The displayed and ranked count is computed platform-side from gateway session records: the gateway is the sole client ingress (arch§"High-Level Topology"), so every genuine presence is an authenticated, attested-client session the platform observed itself. A realm process has no API to assert a count; the browser reads only the gateway's number. (This kills count-spoofing structurally, not by policy.)
• "Present" is stricter than "connected." A session counts toward the displayed population when: authenticated platform account + attested client (arch§"Anti-Cheat and Client Integrity") + session age ≥10 minutes + input liveness over the last 15 minutes (intent-stream entropy above the idle floor — the server already consumes the full intent stream, features§"Server-Authoritative Netcode"). Spectators (read-only delta stream, features§"Streaming, Spectating, and the Creator Loop") display as a separate spectator count, never in population. Planning assumption adopted 2026-06-12 on the thresholds; tuned against the false-idle rate (genuine RP includes long stillness — see §3.1 mitigations).
• Anti-inflation cap: sessions from accounts that fail §3 screening are excluded from displayed population retroactively and silently (no signal to the botter about which accounts were caught).

3. Fake-Player Detection#

Runs platform-side in the anti-fraud pipeline, sharing the account↔realm↔device↔payment graph of arch§"The Economy Firewall and Anti-Fraud" — population fraud and payout fraud are the same actor with the same toolkit, detected once.

3.1 Idle-bot signatures#

• Input-entropy profiling per session: bots exhibit looped/scripted intent (periodic micro-movement, identical input cadence). The deterministic sim consumes sequenced intent (arch§"Netcode"), so cadence/entropy features are cheap per-session computations.
• RP-aware mitigation: legitimate roleplay includes AFK-adjacent behavior (sitting in a hospital bed, manning a store). Liveness therefore weights interaction events (chat/voice activity windows, zone interactions, economy events) over raw movement, with a 45-minute grace for sessions embedded in social context (proximity to other live sessions with mutual interaction history). Planning assumption adopted 2026-06-12.
• Behavioral ML: the V5 server-side ML anti-cheat pipeline (features§"Anti-Cheat on Community Servers") gets a bot-classifier head; precision target ≥95% before automated exclusion (below that, human review), matching the anti-cheat bar (anticheat gate).

3.2 Connection-pattern and fleet analysis#

• Same-subnet / same-ASN session clusters joining one realm (hosting-provider ASNs weighted heavily — residential players don't connect from datacenter ranges), device-attestation fingerprint reuse across "different" accounts, and synchronized join/leave waves.
• Same-payment-method fleets: accounts sharing payment instruments or KYC-adjacent signals form cliques in the existing graph; a clique of 30 accounts populating one realm nightly is the canonical purchased-bot-fleet topology (same centrality anomaly as the self-dealing detection, arch§"The Economy Firewall").
• Never-spent clusters: the verified-spend lever already gates payouts; discovery applies it as weight, not exclusion (new players genuinely haven't spent) — see §5.

3.3 Cost asymmetry, stated#

Attested clients + platform accounts + liveness means a convincing fake player costs the attacker a real attested client session with humanlike behavior over weeks (retention-weighted ranking, §5). The design goal is not "impossible" but "more expensive than buying ads" (planning assumption adopted 2026-06-12: target attacker cost ≥$0.50 per fake verified-player-day, re-estimated annually by red-team exercise, §7).

4. Listing-Boost Abuse#

• Review brigading (up and down): reviews/ratings (features§"The In-Game Realm and Mod Browser" discovery dimensions) are eligible only from accounts with ≥3 hours verified presence in the rated realm; rating weight scales with reviewer diversity (device/payment/social- graph independence); burst detection flags rating waves uncorrelated with a population/content event; coordinated negative campaigns against competitors are penalized on the attacking accounts and any realm whose operator staff are graph-linked to the campaign.
• Keyword stuffing / metadata spam: the listing linter (publish-time) enforces tag count limits (≤8), rejects tag-irrelevance (tags must map to realm-config evidence: a "law-rp" tag requires the CAD/MDT institutions enabled — features§"Civic Institutions"), and bans trademark/brand-name baiting in titles (shares the IP-matching text corpus, V7/docs/ip-content-matching.md). Repeated relist-after-reject is a §6 ladder input.
• Featured-slot integrity: curator-selected rotations (features§"Live-Service and Community Programming") publish their selection criteria, and curators are conflict-of-interest screened (no featuring realms they hold a revenue stake in — dependency-revenue links make stakes machine-checkable from the lock file).

5. Ranking Design — Resistant by Construction#

The default browser sort ("Recommended") is verified-engagement-weighted, not raw count:

realm_score = log(1 + verified_unique_players_28d)
            × median_session_minutes_28d^α        (α≈0.5)
            × week4_return_rate^β                 (β≈1.0)
            × health_factor                        (uptime/degradation from
                                                    gateway health — a degraded
                                                    realm is flagged, never
                                                    surfaced as healthy:
                                                    arch§"Observability")
            × integrity_factor                     (1.0 clean; <1.0 under §6)

• verified = §2 presence-qualified sessions from §3-clean accounts; weight per player scales with account trust (verified-spend accounts weigh 2×, aged accounts with cross-realm history 1.5×, fresh accounts 0.5× — planning assumption adopted 2026-06-12, exact weights are anti-fraud-team tunables and deliberately unpublished).
• Median (not mean) session length × week-4 return rate is the core: bots can fake presence, but faking retention of diverse, trusted accounts for four weeks costs more than the ranking is worth — the identical logic the payout formula uses (arch§"The Economy Firewall": retention weighting kills CCU-inflation bots), applied to discovery so the two systems can't be arbitraged against each other.
• Raw concurrent count appears in the UI (players want it) but is a display field and an optional explicit sort, never the recommended-rank driver; the explicit sort still uses attested counts only.
• Cold-start fairness: new realms get a discovery_probe allocation (a small share of browser impressions reserved for low-data realms, ε-greedy style) so the rich-get-richer loop doesn't freeze the market; probe performance (session length/return of probe-delivered players) feeds their initial score. Planning assumption adopted 2026-06-12: 10% of Recommended impressions to probe inventory.
• Anti-overfitting cadence: weights (α, β, trust multipliers) are re-tuned quarterly against holdout cohorts; the structure (median × retention × verified) is the commitment, the constants are not.

6. Penalties Ladder#

Owner: Kuanyin enforcement on anti-fraud findings; Themis appeals; consistent with the V7/docs/off-platform-monetization-policy.md §5 pattern.

Attribution rule: Stage 1+ requires evidence the operator procured or directed the manipulation (payments to bot services, staff-account involvement, config evidence); third-party sabotage (botting a rival to get them punished) is the known false-flag risk — sabotage-pattern review is mandatory before Stage 1+, and unexplained bot traffic alone never exceeds Stage 0.

7. Integrity Eval Gate#

In the V7/ADVERSARIAL_EVAL_GATES.md format — to be added to that inventory and .github/workflows/v7-ci.yml when the discovery service test rig lands (owner: Abundantia discovery lead):

Measurable operational criteria (telemetry suite, features§"Telemetry, Analytics, and Eval Sets"; targets are planning assumptions adopted 2026-06-12):

• Bot-session share of displayed population: <1% (estimated via honeypot + labeled-cohort extrapolation).
• Bot-classifier precision ≥95% / recall ≥80% on the labeled corpus, refreshed quarterly.
• Median detection-to-exclusion latency for a new fleet: ≤48 h.
• Rank-manipulation half-life: a seeded red-team fleet (run twice yearly by the anti-fraud team against production with synthetic accounts) must fail to hold a top-50 Recommended position for >7 days.
• Discovery trust survey ("the browser shows me real, healthy realms"): ≥70% agree among new-player cohorts at GA.
• False-positive harm: confirmed wrongful Stage 1+ actions <5% of actions (Themis reversal rate), and zero honest-realm exclusions in the Stage-0 silent path above 0.5% of sessions (audited by sampling).