# 0020: No Public Server Binaries at Launch — Player Hosting Is Platform-Orchestrated

Status: Proposed

Date: 2026-06-12

## Context

`V5_features.md` §"Network Quality, LAN, and Server Browser" specs a server
browser of "player-hosted private rooms, filterable by mode, cell, region,
ping, password, and mod set" — which implies player-controlled servers — but
no document decides **how players host**: whether the studio distributes
dedicated-server binaries to the public, or hosting stays on official
infrastructure. The audit (V1_V7_PLAN_SET_AUDIT_2026-06-12 §6.2) flags the gap.

The decision is constrained from three directions:

- **Anti-cheat (ADR-relevant interaction):** V5 ships Easy Anti-Cheat plus a
  custom *server-side* signal layer — aim plausibility, LOS-history wall-hack
  detection, speed and auto-fire checks "run server-side so a tampered client
  cannot suppress them" (features§"Anti-Cheat"). A public server binary hands
  that signal layer to the community: a community server operator can patch the
  signals out, and a public Linux server binary is the single best
  reverse-engineering artifact a cheat developer can get — symbols, replication
  schema, movement constants, and validation logic, decoupled from EAC's client
  protections. EAC itself attests clients, not third-party servers; there is no
  EAC story for community-operated server trust.
- **Licensing:** the Unreal Engine EULA permits distributing dedicated-server
  builds to end users, so Epic is not the blocker; the blockers are our own
  middleware (per `V5_DEPENDENCIES.md`, several runtime components are licensed
  for studio-operated services, redistribution rights unverified) and the
  licensed-content bundles (ADR 0008 period-authenticity audio/likeness
  clearances are scoped to studio distribution channels). A redistributable
  server SKU would need a clause-by-clause middleware audit and likely
  re-papering — real cost, no launch payoff.
- **Already-specced hosting surface:** the connection models already give
  players LAN (offline-capable, entitlement-check only) and listen servers
  (bounded co-op, sub-2 s migration). The unmet need the server browser
  expresses is *persistent, configurable, mod-set rooms* — not binary
  ownership.

## Decision

1. **No public dedicated-server binaries at launch.** The server binary ships
   only to studio-operated fleets (GameLift + first-party relay pools).
2. **"Player-hosted" in the server browser = platform-orchestrated private
   rooms on official infrastructure.** A player creates a room (mode, cell,
   region, password, mod set), and the platform places it as a dedicated
   session on the official fleet — the player owns the *configuration and
   admission*, the studio owns the *binary and the signal layer*. Rooms are
   capacity-managed as the small-mode session class in
   `V5/docs/planning/capacity-and-load-plan.md` (§2.2, 16-player class; hub-
   class rooms are not player-creatable at launch).
3. **LAN and listen-server modes are unaffected** — they already run without
   online services and remain the offline/couch path per spec.
4. **Community dedicated binaries are deferred, not refused**, and are
   **contingent on an anti-cheat strategy revision**: a community-server SKU
   requires (a) a server-trust tier in which community sessions are excluded
   from ranked, leaderboards, tournament reporting, and the shared persistent
   world, (b) the middleware/content redistribution audit above, and (c) a
   hardening pass that strips the proprietary signal layer from the
   redistributable binary. This work is scoped only if post-launch demand
   justifies it (trigger for re-evaluation: private-room creation sustained
   above 25% of online sessions, or a top-10 community feature request through
   two consecutive seasons).

## Consequences

- The anti-cheat server-side signal guarantee stays true for every online
  session at launch — no session exists whose server the studio does not run.
- Private rooms inherit official-fleet costs (priced into the capacity plan's
  small-mode fleet); a popular private-room scene is an infrastructure cost
  the studio carries, which is the deliberate trade against the cheat surface.
- No community server scene at launch: no 24/7 community-modded persistent
  servers beyond what private-room configuration allows. This is a real
  community cost and should be messaged honestly ("private rooms, not server
  files") rather than implying server files are coming.
- Sunset interaction: because players cannot self-host dedicated servers, the
  end-of-life commitments in `V5/docs/planning/sunset-eol-commitment.md`
  **must** cover the dedicated-MP path at EOL (its Preservation Patch converts
  bounded co-op to listen/LAN and commits to a community-server release
  decision at sunset, when the anti-cheat and licensing constraints lapse).
- **V7 supersession:** V7's community-realm hosting continuum
  (`V7/V7_features.md` §"The Hosting Continuum" — Solo / Listen / Dedicated
  single Rust node up to ~256 / Meshed clusters) is the platform-level answer
  to community-operated servers, built with realm-scoped trust, verification
  (Ixchel/Sekhmet), and a registry from day one. When V7's Dedicated tier
  ships, it supersedes condition 4's bespoke V5 community-server SKU: V5-era
  community hosting demand routes to the V7 realm model rather than a V5
  binary release, and this ADR should then be re-statused accordingly.