Cheat Anomaly Detector UEB

CAD watches for behavior which ordinary play does not produce and publishes each occurrence on the UEB. It never kicks and never bans: every flag is a signal for an admin to look at, because any of these detections can fire on legitimate play in rare circumstances. Anomaly detection is not proof — treat every flag as a reason to look, not a verdict.

What it flags:
- movement speed above what the game allows on foot
- position jumps too large for the elapsed time (Game Master moves are marked as such)
- kills at implausible range, in severity tiers
- unnaturally dense bursts of kills, corroborated by other flags on the same player
- kills through solid geometry, and kills through soft cover the target could not be seen through
- headshot ratios far above human distribution over a meaningful sample
- friendly fire kills.

Every flag carries the identities involved and the numbers behind it — distance, speed, hit counts, positions, weapon, time window — so a report can be judged, not just counted.

Configuration in $profile:/CheatAnomalyDetector/settings.json a master switch plus one flag per detection. Every threshold tunable in thresholds.json. Check ANTICHEAT.txt for detailed description.

Install Universal Events Logger and the flags land in your JSONL logs; any other mod can subscribe to the anticheat category and build a UI or a report on top of it.

Server-side. Requires Universal Events Bus (UEB).