Sorry for so many questions.
What is handled by the qvm, binary, and the base pk3?
What does the client do? Are all calculation handled server side?
Are speedhacks, going through walls, etc. possible in tremulous through packet manipulation(not exploits server code)?
pretty much all calculations are done server side (the movement calculations are mirrored on the client side to provide a more responsive feeling to the game, but that's pretty much the only thing). none of those things should be possible.
