Replace cheat-detection teleport with server reconciliation

The old PUNKBUSTER check compared client-reported position to server
position and snapped the player back when latency made them diverge,
which felt like getting teleported under any real network conditions.

Replaces that with proper client-side prediction + reconciliation:
client tags each input with a sequence number and keeps an input
buffer; server tracks the last processed sequence and reports its
authoritative position via a per-user inputAck alongside each
worldUpdate. The client only corrects when the actual disagreement
exceeds what the unacked input time can explain — so steady-state
movement runs purely on local physics, and only genuine unexpected
events (collisions, being hit) trigger a smooth blend toward the
server state.

Includes adaptive threshold scaling so high-latency sessions don't
false-positive corrections during normal running.

app/Game/Client/GameController.js

@@ -49,10 +49,9 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
 
         this.animationRequestId = requestAnimFrame(this.update.bind(this));
         this.physicsEngine.update();
-        
+
         if(this.me) {
             this.me.update();
-            this.mePositionStateOverride();
         }
 
         nc.trigger(nc.ns.client.game.events.render);
@@ -61,12 +60,32 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
         domController.fpsStep();
     };
 
-    GameController.prototype.mePositionStateOverride = function() {   
-        if(this.me.isPositionStateOverrideNeeded()) {
-            nc.trigger(
-                nc.ns.client.to.server.gameCommand.send, 
-                "mePositionStateOverride", 
-                this.me.getPositionStateOverride()
+    GameController.prototype.onInputAck = function(ackData) {
+        if (!this.me || !this.me.doll) return;
+
+        this.me.inputBuffer.acknowledgeUpTo(ackData.seq);
+
+        var currentPos = this.me.doll.body.GetPosition();
+        var diffX = Math.abs(ackData.p.x - currentPos.x);
+        var diffY = Math.abs(ackData.p.y - currentPos.y);
+
+        // Scale the acceptable drift by how many inputs the server
+        // hasn't processed yet. More unacked time = more expected drift.
+        var unacked = this.me.inputBuffer.getUnacknowledged();
+        var expectedDrift = 0;
+        if (unacked.length > 0) {
+            var unackedTime = (Date.now() - unacked[0].timestamp) / 1000;
+            expectedDrift = unackedTime * Settings.RUN_SPEED;
+        }
+
+        var threshold = Settings.RECONCILIATION_THRESHOLD + expectedDrift;
+
+        // Only correct when the error exceeds what latency can explain —
+        // meaning something unexpected happened (collision, being hit, etc.)
+        if (diffX > threshold || diffY > threshold) {
+            this.me.applyReconciliation(
+                ackData.p.x, ackData.p.y,
+                ackData.lv.x, ackData.lv.y
             );
         }
     };
@@ -108,36 +127,15 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
     };
 
 
-    /*
-
-    TODO : 
-    - remove this 
-    - overwrite setUpdateData inside client / Me with an empty function
-
-    GameController.prototype.onWorldUpdateGameObject = function(body, gameObject, update) {
-        if(gameObject === this.me.doll) {
-            this.me.setLastServerPositionState(update);
-            if(!this.me.acceptPositionStateUpdateFromServer()) {
-                return; // this is to ignore own doll updates from world update 
-            }
-        } 
-
-        Parent.prototype.onWorldUpdateGameObject.call(this, body, gameObject, update);
-    };
-    */
-
     GameController.prototype.onRemoveGameObject = function(options) {
 
     };
 
+    // Own doll position is handled by onInputAck reconciliation, not worldUpdate
     GameController.prototype.updateGameObject = function (gameObject, gameObjectUpdate) {
-        if(gameObject === this.me.doll) {
-            this.me.setLastServerPositionState(gameObjectUpdate);
-            if(!this.me.acceptPositionStateUpdateFromServer()) {
-                return; // this is to ignore own doll updates from world update 
-            }
-        } 
-
+        if (gameObject === this.me.doll) {
+            return;
+        }
         Parent.prototype.updateGameObject.call(this, gameObject, gameObjectUpdate);
     }
 
@@ -166,7 +164,11 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
 
         var player = this.players[playerId];
         player.spawn(x, y);
-        
+
+        if (player === this.me) {
+            this.me.inputBuffer.clear();
+        }
+
         if(options.holdingItemUid) {
             this.onHandActionResponse({
                 itemUid: options.holdingItemUid,
@@ -222,6 +224,10 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
         var killedByPlayer = this.players[options.killedByPlayerId];
         player.kill(killedByPlayer, options.ragDollId);
 
+        if (player === this.me) {
+            this.me.inputBuffer.clear();
+        }
+
         nc.trigger(nc.ns.client.view.gameStats.kill, {
             victim: {
                 name: player.user.options.nickname,
@@ -235,10 +241,6 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
         });
     };
 
-    GameController.prototype.onPositionStateReset = function(options) {
-        this.me.resetPositionState(options);
-    };
-
     GameController.prototype.loadLevel = function (path) {
         Parent.prototype.loadLevel.call(this, path);
     };
@@ -257,6 +259,7 @@ function (Parent, Box2D, PhysicsEngine, ViewManager, PlayerController, nc, reque
 
     GameController.prototype.endRound = function() {
         this.me.setInBetweenRounds(true);
+        this.me.inputBuffer.clear();
         this.toggleGameStats(true);
     };