This is accomplished by simply preserving the player's body after disconnecting.
Bodies will despawn after the number of minutes specified by the rejointimeout
console variable (float). The default value of 0 disables the feature completely.
Bodies whose owner is disconnected are given flashing tics, which protect them from most hazards, and they are also immune to death pits, which simply cause them to respawn at their latest starpost (or map spawn). When the client rejoins, they keep flashing for 3 seconds in case the spawn is bad.
Clients rejoining are identified by their IP address, and may rejoin even if the server is full or joins are disabled, for as long as their body remains.
From a technical standpoint, when the user disconnects,
the player they were controlling does not leave,
the underlying player_t just keeps working normally,
except it does not receive any input anymore.
When the user reconnects, they are simply "relinked" to their player_t.
Those "soulless" players can be identified through their quittime field,
which is the number of tics elapsed since the user disconnected,
or zero if still connected. quittime is exposed to Lua.
As a consequence, most, if not all Lua scripts in existence are supported out-of-the-box,
as they do not need to perform any special handling to restore the player's status
when they rejoin. Although when needed, they can of course check the quittime field
mentioned above to handle disconnected players the way they like.
Additionally, the player spawning code is slightly refactored. Also, this fixes a minor bug where clients could send inputs built using the server's viewpoint shortly after joining.