Online Trust & Safety

Online Trust & Safety

Reports · Discord pager · case log · invisible ghost spectate

Online-only integrity loop. Players report. Volunteer mods and studio Trust review. Discord pages them. The Command Deck Trust overlay is the workbench. Spectate joins the live instance as an invisible fly-cam. Bans stay studio-only. RAID / Vault / Ladder Match Results (live roster, frozen recap, Last match on maps) are a separate chapter — Online Match Results. This chapter does not document how to cheat or how to bypass checks.

Note

Slow path. Cheap hit auth stays on the Game Thread (impossible origin, cadence spam, wall traces). Reports, replay clips, and statistical flags never delay HP, death, Flow, or loot. Solo has no chat, no Social, no reports, no Trust tab, no ghost, no Match Results.

Note

Day one. In-game Trust overlay + Discord notifications. A web/admin console may read the same case IDs later — it is not required to ship the loop.

Roles

Volunteer access is an EOS staff flag on the PUID. A Discord role alone does not open spectate. Actions always go through Terra Firma’s server.

Role	Queue	Spectate	Notes	Kick	Restrict / ban
Player	Own reports only	No	No	No	No
Volunteer mod	Assigned / open player reports + medium flags	Yes	Yes	No	No
Studio Trust	Everything	Yes	Yes	Yes	Yes

Lock plate. Players report. Volunteers spectate and write notes. Studio kicks and bans. Discord is the pager.

Player reports

Keep report on Online OmniVisor / Command Deck Social — not Character I, not a fifth I tab, not Discord-as-chat.

• Social → In this instance row → Report.
• A chat line (Fireteam / Clan / Match / General / Proximity / Whisper) → Report this player. Channel bible: In-game Chat.
• Match Results row (RAID / Vault / Ladder) → click another player → same sheet.
• Optional: hold on a world IFF pip while looking at them → same sheet.

Sheet (W_TFA_Report). One Send. Fail-closed like invites.

• Target is PUID + character name, not a Discord name.
• Category chips: combat feel, movement, vision, chat, economy / marketplace, other. Do not list exploit steps on the sheet.
• Short text. Optional attach of the reporter’s last view clip if the demo buffer exists (length TBD-043).
• Server stamps: instance ID, activity (hub / story / RAID / Vault), map, time, reporter PUID, target PUID.

Note

Fail-closed. Solo. Empty target. Already reported this PUID this instance (cooldown TBD-044). Target not in the Online pool. Reporter in combat or downed can still send — report is not a spend. Overlay does not pause. Player sees “Report received.” They never see whether a mod joined.

Notifications

Discord is the pager. The Trust overlay is the workbench. Discord is not in-game chat and not a player Discord channel.

• Volunteer queue — player reports, medium heuristics.
• Studio only — high heuristics, economy, repeat offenders, anything that can become a ban. Channel mapping TBD-046.

Each ping is a case card: case ID, category, instance, target display name, open-in-game deep link. No bag contents. No Credits / BTUCOIN / LUMENAR. Discord miss does not drop the case — the overlay still lists it.

Note

Trust overlay. Command Deck tab Trust (W_TFA_Trust). Online, staff-flagged PUID only. Solo: tab hidden, or visible and locked like Social-on-Solo. Same overlay rules as Social: world keeps running, hit does not close it, death dumps the stack. Character I has no Trust tab.

Queue rows: New / Watching / Needs studio / Closed. Volunteers cannot open studio-only cases.

Case log

One server-side case per signal, or merge if same target + same instance + short window. Worker path, then marshal. Never on the hit thread.

• Who / what / when / where (instance, activity size, map).
• Report text + category.
• Optional replay clip IDs.
• Cheap reject counts for that session (rate-limit drops, wall traces) as counts, not packet dumps in Discord.
• Spectate: who joined, when, fly vs follow.
• Notes (volunteer vs studio tagged).
• Outcome: dismiss / warn / kick / restrict / ban + studio actor.

Retention TBD-045. Players never read another player’s case. Volunteers see notes on cases they can open. Studio sees all.

Ghost spectate

Mod presses Spectate on the case. Server places them in that dedicated instance as a ghost, not a player.

• Does not consume RAID / Vault 2 / 4 / 8 or fireteam 8.
• Not on In this instance, not IFF, not chat, not fireteam, not Clan roster as “in this activity.”
• Target is not told.
• If the instance is gone: case stays, Spectate disabled, note “instance ended,” replay still available if captured.
• Target disconnect ends live spectate; case remains. Mod disconnect just leaves the ghost.

Camera: free fly + Follow target (orbit / behind — not a second visor pawn). No OmniVisor combat chrome that looks like they are playing. Staff chrome (W_TFA_GhostHud): target name, case ID, Follow / Fly, Leave. Leave returns to Trust overlay or hub, never a body in that fight.

Note

Ghost. No pawn, no collision, no loot, no damage, no interact, no spend. Other clients never spawn a visible actor. Ghost may receive full instance relevancy (normal clients stay fogged). Ghost still does not get other players’ bags or wallets. Does not SetGamePaused. Volunteer and studio share this camera — actions on the case are what differ.

Lock plate. Invisible fly-cam in the live instance. Not a player slot. Target is not told.

Kick (studio): target dumped per existing disconnect / session-lost rules. Fireteam members stay. Ban: EOS / Online pool, studio only. Volunteer notes can mark Needs studio.

What this is not

• Not a public cheater wall, not a Command Deck chat tab, not Discord-as-voice.
• Not Character I. No CREDITS / BTUCOIN on Trust or Report windows. Match Results is its own chapter.
• Not a second combat auth path. Do not wait on Discord, HTTP, or replay to confirm a hit.
• Not a how-to for cheats. Categories stay chips. Heuristic names stay high-level (aim snap stats, movement correction, vision relevancy).

Illustrated stills (report sheet, Trust queue, ghost chrome) are reserved. Lock plates above are the ship art until those stills land. Match Results still is in Online Match Results.