Melee hit detection

This isn't about the networking part of melee hit detection, but:
No, hitboxes or collision hulls do not lag behind the player model
No, hit registration is never performed by the attacker's client
Yes, lag compensation and client prediction results in wacky scenarios with higher player latencies

Melee hits work by performing a line trace from the attacker's eyes. If the line trace hits nothing, then a hull trace is performed. These traces check for intersection with player bounding boxes (aka collision hulls).

The player's bounding box has a volume of 48×48×82 while standing and 48×48×62 while crouching. All classes use the same size.

The position of the player's eyes differ based on class. For Scout, it's 65 units high. For Soldier, Pyro, Demoman, and Engineer, it's 68 units high. For Heavy, Medic, Sniper, and Spy, it's 75 units high. While crouching, it's 45 units high for every class.

The line trace uses a default distance of 48 units. Swords increase this to 72 units. The Disciplinary Action multiplies this by 1.7 to 81.6 units.

The hull trace uses the same distance as the previous line trace and uses a default volume of 36×36×36 units³. The Disciplinary Action multiplies this by 1.55 to 55.8×55.8×55.8 units³ (this is why it can hit players behind the user).

While charging, melee range is increased to 128 units. However, attacking while charging cancels the charge and there's a 0.2-second delay before a melee attack is finished. So swinging after charging doesn't use the increased melee range. However, swinging before charging uses the increased melee range.

Attacks with the Engineer's wrenches perform another line+hull trace for friendly buildings. This uses a distance of 70 units and a volume of 36×36×36 units³. This is performed first, so wrenches will hit friendly buildings through players.

Attacks with the Homewrecker and Neon Annihilator perform another line+hull trace for friendly buildings that are being sapped. This still uses the same distance and volume as the melee weapon. This is performed first, so friendly buildings being sapped will be hit through players.

In Mann vs Machine, the robot team's melee attacks will completely ignore their own teammates. This is so clumps of bots wielding melee weapons can still hit RED players.

When you swing a melee weapon, the game saves a list of living enemy players that are within a distance of 120% of your melee range (from your eyes to their centre). When your melee attack misses, the game loops through this list to check if any of the saved players are still alive and in the server. If none of them are, then your attack is considered a "clean miss". If you're wielding the Boston Basher, then a clean miss means you receive self-damage and self-bleed.