A dated record of what we’ve shipped, what’s in progress, what’s paused, and why. If it isn’t here, it hasn’t happened yet.
Current stage of every product
- ArgusGaming Infrastructurev1.0 in developmentEvery finding comes with the evidence behind it. Your moderators make the call.
- CullMCGaming InfrastructurePlannedPerformance-debt auditing built into the Minecraft server.
- NarrativAIAffective NarrativeClosed betaFor writers whose original characters outlive a single story.
- OperaHouseAmbient HospitalityPrototypeWhen Alfred doesn’t know, it asks your team — and never has to ask that question again.
Entries
We dropped two planned checks, and only half the reason is measured
A follow-up to something we told you a few days ago. When we said we were shipping eight of thirteen planned checks, two of the five that stopped were described as ones we probably could not see at all. Those two are now formally dropped rather than left on the list, because leaving them there implies work that would deliver nothing. They were a check for an over-long chat, sign or book message, and a check for a packet sent at the wrong point while a player is still joining. The reason is where Argus sits. It reads packets after your server has already unpacked them, so anything your server throws out while unpacking never reaches Argus at all — we could write either check and neither could ever fire. Here is the part we would rather say than not. That sentence has two halves, and we have only measured one of them. Where Argus sits is measured: our automated testing reads the order of the chain on every supported server version on every build, and fails if it is ever wrong. That your server specifically rejects those particular values is standard behaviour for the game protocol, and we have reasoned it rather than read it — the machine we build on does not carry the server internals needed to check. Our own recommendation was to take that reading first, and the decision was to drop the rows without it. We are recording that disagreement rather than tidying it away, because anyone who revisits this should know the claim is half argued. What makes it a reasonable call rather than a corner cut is which way being wrong would hurt. If your server does accept one of those values, Argus has lost two checks it could have had. It has not accused anybody of anything. Nearly every unverified assumption that has cost us something this year pointed the other way — a comment claiming a test we had never run, a coverage figure counting protection that was not there — and each of those risked either a false accusation or an overstated promise. This one risks us quietly delivering less, which is recoverable and easy to see. Two things would bring the checks back, and we have written both down: a reading showing your server does accept such a value, or a change to where Argus sits in the chain. Nothing acts on anyone, and nothing about what Argus currently does has changed — this is housekeeping on a plan, told in public because the plan was.
A twenty-sixth check, deliberately narrower than we set out to build
We planned a check for a client confirming a teleport your server never asked it to confirm, and settling the question properly turned it into a smaller check than that. Here is why, because the reasoning is the useful part. When your server moves a player it asks them to confirm the move, and the real client confirms exactly once. Catching a confirmation for a move your server never asked about sounds straightforward, but it requires Argus to know every move your server has ever asked for — and it cannot. A confirmation points backwards at something that already happened, and Argus does not always see the beginning: it starts watching players who are already online when it loads, and on a fresh join it finishes attaching a fraction of a moment after the player arrives. So “I did not see your server ask for that one” is a different statement from “your server never asked for it”, and only the second would be evidence of anything. Every way of papering over that gap depends on timing, and a timing assumption is exactly what produced the worst false alarm in last week’s check. So we built the part where Argus does know everything it needs to. If it watched your server ask for a particular move, and watched the player confirm it, then both halves happened while it was looking — and a second confirmation of that same move is something the real client never sends. A confirmation naming anything Argus did not watch being asked for is ignored, not questioned. That is the whole safety of it, and it comes from the design rather than from a grace period. Two deliberate limits. It takes several repeats rather than one, because if you run a proxy in front of your servers — and plenty of networks do — a proxy re-sending a packet looks exactly like a client doing it, so one is excused. And it is off for clients older than 1.9, and for any client whose version Argus could not read: those clients do not send these confirmations at all, the version-translation layer sends them on the player’s behalf, and an unreadable version is the one case where Argus cannot tell whether a translator is in the way. That last part closes an assumption that has cost us before — treating “unknown version” as “probably modern” — and this is the first check to refuse it outright. What this is worth, plainly: less than the check we set out to build. It catches a confirmation-spam pattern rather than a forged one. We would rather ship the part that is sound and say so than ship the whole thing and hope. Nothing acts on anyone: findings are recorded for staff to look at.
A check for clicking a chest nobody opened — and four ways it could have accused the innocent
One more check, taking the build to twenty-five. When your server opens a container for somebody it sends them a number identifying that window, and every click they make inside it carries the number back. The real game client has no way to invent one — it can only send a number it was given — so a click naming a window your server never opened did not come from one. That is where several container and duplication exploits begin: reaching an inventory you were never shown. This is also the first of our checks whose evidence is your server’s own record rather than our model of how a client behaves, which makes it a sturdier kind of check than most. Getting there needed a piece of plumbing we had been putting off. Argus could already read what your server sends to players, but only while it happened to be recording a replay clip — so a check built on that would quietly stop working whenever recording was off, while the coverage table on the Argus page went on counting it. We have caught that class of mistake three times this year, so instead the reading is now always on, and deliberately tiny: it looks for two kinds of message and ignores everything else, because the traffic it sits in is mostly movement and terrain. It also has its own failure budget, so if that reading starts failing it switches off this one check and says so in the console, rather than taking anything else down with it — and a switched-off check reports nobody rather than reporting wrongly. The part worth telling is the false alarms. There were four ways this check could have accused an honest player, and we only designed for one. The one we planned for: your server closes a container while a click is already travelling, and that click was perfectly legitimate when it was sent — so a just-closed window is excused for a second. The second we found by reading our own attach code before writing the check: Argus attaches to players who are already online when it starts up, and one of them may have had a chest open for ten minutes without Argus ever seeing it opened. The third came out of review: if your server opens a second container without closing the first, the first vanishes with no closing message of its own, and a click still in flight on it would have been reported. The fourth we only found by re-reading the change after we had already pushed it, and it is the one that would have hit real servers hardest. Argus finishes attaching to a connection a fraction of a moment after a player joins, and its own join handler runs before other plugins’ do — so a kit selector or lobby menu opening an inventory in that gap writes its message before Argus can see it, and every legitimate click in that menu would have been reported. Join menus are common on exactly the servers this is for. So judgement now waits on evidence instead of on timing: this check says nothing about a player until it has actually seen a window open or close for them. The cost is real and we would rather state it than bury it — a player for whom your server never opens any window is not judged by this check at all. Any chest, any plugin menu, and they are. Nothing acts on anyone: findings are recorded for staff to look at, and no check has earned the right to act. As always with this family, the limit comes from the protocol itself rather than from a measurement of how people play.
We planned thirteen checks of one kind and are shipping eight — here is what stopped the other five
Earlier this autumn we grouped thirteen checks together on the theory that they would be cheap. They all ask the same sort of question: not whether something was too fast or too accurate for a person, but whether the thing was possible at all. A position that is not a number. A hotbar slot that does not exist. There is no human threshold to get wrong in a check like that, which is what made them look cheap, and eight of them were. We are now stopping at eight, and the reason the other five stopped is worth more than a forced ninth would have been. Two of them we probably cannot see at all. Argus reads packets after your server has already unpacked them, which means anything your server rejects while unpacking never reaches Argus in the first place. An over-long chat message or a packet sent at the wrong point during joining are both of that shape: we could write the check, and it could never fire. Two more need something Argus does not have yet. Those two depend on knowing what your server has told a player — which window it opened for them, which teleport it asked them to confirm — and today Argus only reads what the server sends while it happens to be recording a replay clip. A check built on that would quietly stop working whenever recording was off, while the coverage table on the Argus page went on counting it as protection. That is the third time this year we have caught a number on that table claiming more than the build delivers, so we are not adding a fourth. One piece of work fixes both of those, and it is the next thing we will do. The fifth rests on an assumption about the real game client that we cannot check without a real game client: it would catch a client re-using a counter the game increases with each block it touches, which is impossible — unless that counter resets when a player respawns or changes world, in which case it would walk back over numbers it has already used and the check would accuse ordinary players in large numbers. Answering that is exactly what the test tool we have planned is for. One last thing, because it is the part we nearly got wrong ourselves. The first version of this write-up stated those first two as settled fact. They are not. We have measured where Argus sits in the chain, which is solid; we have not measured that your server really does reject those particular values, and those are two different claims that we had quietly merged into one. It is the same mistake as a piece of arithmetic we were very pleased with a few days ago, which was correct, checkable, and not actually the explanation for what we were looking at. So the two are recorded as probable rather than proven, and before we strike them off we will take the reading — which costs us one deliberately malformed message sent to our own test server. Nothing here changes what Argus can do today, and nothing acts on anyone: findings are recorded for staff to look at.
A check for conjuring items — which our own review caught accusing builders
One more check, taking the build to twenty-four. In creative mode the game lets a client write any item it likes straight into any slot, and your server honours it, because in creative that is the whole point. So a player the server has in survival sending that same instruction is asking for something out of nothing, and it is where several item-duplication and give-yourself-anything exploits begin. Your server refuses the write, so nothing is created — but it does not tell you a client tried, which is the gap this fills. The care in it is not the rule, which is simple, but the timing. Argus reads which mode a player is in once per tick, while packets arrive continuously, so when a member of staff takes somebody out of creative there is a moment where an instruction already in flight was perfectly legitimate when it was sent. Judging it against the mode it landed in would mean reporting a player for staff timing, so there is a two-second grace after any mode change. The grace expires, deliberately: having once been in creative is not a permanent excuse. Then a review before release found the check reporting honest players, and it is the same lesson we learned about terrain a few days ago, in a new place. Argus accepts packets from a player as soon as it has latched onto their connection, but it only learns their mode on the next tick — and until then its record of that mode reads as survival, because that is what an empty record looks like. So a builder rejoining in creative who opened their inventory straight away would have been reported, in a window of up to a twentieth of a second on every single join, against the most visible people on any server. The fix is to make “we have not looked yet” a different answer from “we looked, and they are in survival”, rather than letting the second stand in for the first. A flag that accuses must never do so by default. We proved the problem before fixing it and kept a second test alongside, so that a silent check cannot pass for a working one. One limitation we are documenting rather than engineering around: a plugin that tells a client it is in creative without changing the mode on the server will produce honest findings from this check, because Argus reads the server’s record. The real fix is for Argus to track what the server told each client, which is work we have not done; until then, if you run such a plugin, switch this check off. We would rather say that than imply we have covered it. Nothing acts on anyone: findings are recorded for staff to look at, and no check has earned the right to act. As always, the limits come from the protocol itself rather than from a measurement of how people play.
We switched three checks off for old clients — and the problem we blamed turned out not to be ours
Three of our checks work by timing a player: Argus sends them a small “are you still there?” message and measures how long the reply takes, which is how it tells a sped-up game clock from a laggy connection. Your server sends messages like that too, and it disconnects anyone who answers one it did not send — so Argus has to recognise its own replies and take them out before your server sees them. On clients older than 1.13 it provably cannot, because the reply carries a number too small to hold the marker Argus stamps on its own. We have therefore stopped timing those clients altogether, which means three checks are now off for anyone on 1.8 to 1.12: the sped-up-clock check, the fast-bow check, and the one that catches a client refusing to answer. On a server where legacy PvP players are a large share that is a real loss. Every other check still covers them, and the coverage table on the Argus page now reads 13 of 23 for a 1.8 player rather than 16, which is the honest number. The reason this is worth writing down is the part we got wrong. We made that change because our automated testing caught a 1.10.2 test client being disconnected, and we concluded Argus had done it. Two days later the same test failed with Argus switched into its passive mode — no packet reading, no timing messages sent, most checks switched off — and the client was disconnected anyway. So Argus was not the cause. It is an interaction between the version-translation plugins and our test client on one server version, and we had attributed it to ourselves on reasoning that was tidy and did not apply. The change we made is still the right one, for a different reason than the one we gave: timing those old clients really is unsafe, even though it was not what the test was showing. We are keeping it, and we would rather tell you that we reached a correct decision by a faulty route than quietly leave the first version of the story standing. No real player was affected at any point, because Argus is not installable and runs on no live server. And we have not switched the failing test off to keep our build green: a test that catches a player being disconnected stays on even when it is inconvenient, and especially when it is telling us something we did not expect.
Three more checks, and one of them was a way to switch Argus off
Three more checks, taking the build to twenty-three. All three are about packets a real client cannot send, rather than judgements about how someone was playing. The first catches an attack aimed at the player’s own character: nobody can be in front of themselves, because the game picks a target by looking out from your own eyes and leaves you out of the search, so no way of aiming produces it. The second catches an attack naming a creature or player that cannot exist — your server hands those numbers out from a counter that starts at one and only climbs, so a negative one belongs to nothing that has ever been in the world. The third catches a claim to have selected a hotbar slot that does not exist; the hotbar is nine slots and the client clamps a keypress or a scroll before sending it, and while your server already refuses anything else, it only notes it where nobody looks. The second one was not really a missing check at all. Building it, we found that an attack naming one particular impossible number made Argus throw an error on the connection thread, and enough of those in a minute switch Argus’s packet reading off for everyone on the server. So any client could have disabled it with one repeated packet, and it would have looked as though Argus had decided to fall back on its own. That is fixed, with a test that floods two thousand of them and requires Argus to keep reporting and keep running. Nothing acts on anyone: findings are recorded for staff to look at. As always, the limits behind these checks come from the protocol itself rather than from a measurement of how people play, which is what makes this family different from the rest — there is no human threshold to get wrong, only a question of whether the thing is possible at all.
Four checks for packets a real client cannot send — and one packet that could switch other checks off
Four more checks, taking the build to twenty. They are a different kind from the rest: every other check asks whether something was too fast or too accurate for a person, and these ask whether it was possible at all. A position that is not a number. The same for where the player is looking. A client reporting that it is looking further than straight up or straight down, which the real game clamps before it sends. A position outside the coordinates the game can even represent. None of these are judgements about how someone was playing — the value itself is one the real client cannot express, so the packet did not come from one. The third is the most useful, because a server accepts such a packet without complaint: without the check, nothing questions it. All four need Argus’s packet reading, which is opt-in and still experimental. Building them turned up something worse than anything they catch. A position that is not a number was flowing straight into Argus’s own record of where a player was, and because such a value compares as false against everything, the checks that wind the world back — hits at range, aim, knockback, hits through walls — quietly stopped working for that player for the rest of their session. One packet, and a client could switch off the checks watching it. Servers disconnect a player for sending that, so the window was short, but Argus reads the packet before the server does, and that is not a good enough reason to keep a broken value. It is now thrown away before it is stored. Two things we are being careful not to overclaim. Our test fights do not yet model traffic rewritten by ViaVersion or Geyser, the layers that sit between older or Bedrock clients and the server and send packets on a player’s behalf — until they do, a clean test result for these four says less about real servers than we would like, and that is the next piece of work rather than a footnote. And we found that these four were being counted on the coverage table as working on servers without packet reading, where they cannot work at all; that figure is corrected, and fifteen of the twenty need packet reading. Nothing acts on anyone: findings are recorded for staff to look at. The numbers come from our own model of how clients behave and from test bots, not from real players.
A check for hits through walls — which we then caught accusing honest players
A new check, taking the build to sixteen, for one of the cheats server owners ask about most: landing hits on someone through a solid wall. The game’s own aiming stops at the first block in the way, so a hit that lands through one did not come from it. Argus walks the line from the attacker’s eyes to where their target was, as their connection could have been shown it, against a copy of the blocks taken once a tick so that reading the world never slows the server down. Only blocks that are full cubes and solid in every state count — doors, trapdoors, slabs, stairs, fences and glass are treated as clear, so a cheat hitting through a door is not caught and nobody is accused because a hinge was modelled wrong. A wall that went up too recently for the player’s own connection to have received it never counts against them, and nothing is judged while they are breaking blocks themselves. Then a review before release found the check reporting honest players, and the reason is worth telling. It tried several lines to a target before deciding, but it only varied them up and down, at a single point across — so fighting through a doorway, or leaning out past the end of a wall, could be read as a hit through one. That is ordinary play. We found it by sliding two players along opposite sides of a wall and comparing every verdict against whether any part of the target was actually reachable; the fix tries the corners of the target as well, and the cases it still cannot judge are a known, measured handful we have written down rather than rounded away. The more useful finding is why our own tests had not caught it. Every honest test fight was arranged so that nothing was ever really in the way — one of them produced exactly the same answers as fighting in an open field — and worse, our test fights let the attacker land hits through walls, which the real game never allows, so an honest fight with cover in it would have looked like a cheat. Both are fixed: the test fights now respect what the server would refuse, and the geometry is checked by something independent of the code being tested, so the tests can disagree with it. One more thing came out of the same review. A plugin can place or hide blocks without telling players’ clients, and a player hitting through a wall they genuinely cannot see is acting in good faith. So if two different players land hits through the same patch of world, Argus now stops judging that patch entirely and says so in the console, because a plugin is a far better explanation than both of them cheating. The first player through such a spot can still be reported, and we would rather state that limit than imply we have solved it. Nothing acts on anyone: findings are recorded for staff to look at. As always, the numbers come from our own model of how people play and from test bots, not from real players.
A new check for auras that spray attacks around — and one we built and threw away
The new check, taking the build to fifteen, catches a cheat that attacks everyone near it in turn. Hitting a second opponent means noticing them, moving the mouse to them, and clicking, and that takes a person about a tenth of a second even when they are standing close together — so Argus looks for hits landing on two opponents well apart from each other faster than that, several times over. It counts the gap in the player’s own movement reports rather than in clock time, so a connection that freezes and then dumps everything at once cannot make an ordinary fight look instant. It will not catch a cheat that pauses for a tenth of a second between targets, and we would rather say so than let anyone believe otherwise. The other check was meant to catch software that clicks the instant your crosshair crosses a player. We built it, tested it, and then found that the test we had judged it with was flattering it: it modelled the server as knowing more precisely where everyone was than a real server can. Corrected, the check could no longer reliably tell that software apart from an ordinary player who flicks onto someone and clicks as they arrive — so we did not ship it. It is the fourth check we have built and held back for that reason. We would rather ship fifteen checks that work than sixteen where one guesses. Nothing acts on anyone: findings are recorded for staff to look at. As before, the numbers come from our own model of how people play and from test bots, not from real players.
Two new checks, and they cover 1.8 players too
Two more checks, taking the build to fourteen. The first catches a client running the game faster than real time, which lets a player move, hit and act quicker than everyone else; it shows up as more movement than the clock allows. The second catches the old fast-bow trick, where a client floods the server with movement while drawing a bow so the shot fires fully drawn straight away. Both work for every Java client from 1.8.8 up, not only modern ones: Argus now sends its own timing pings that older clients answer, and ViaVersion and ViaRewind pass them along unchanged. Neither can be set off by lag, because the count is measured between the player’s own replies — a stall and the burst of movement that follows it cancel out. This was also the first time Argus read packets from live connections, which turned up a bug that had stopped it attaching at all, and a review before release found three ways an honest player could have been disconnected. All fixed, and that review is why players on old clients now get extra room: ViaVersion sends movement on their behalf, and that had to be allowed for. Nothing acts on anyone — findings are recorded for staff to look at. The numbers behind both checks come from our own model of how clients behave and from test bots on local servers, not from real players.
Argus pre-orders are open
You can now pre-order an Argus v1.0 licence on the Argus page: Scout, $25 one-time, for one standalone server, or Sentinel, $95 one-time, for one BungeeCord or Velocity network of up to 5 servers. You’re paying for software that isn’t finished, so the terms are written to make that safe: your licence is delivered when v1.0 ships and no later than June 30, 2027; you can get a full refund any time before then; and if v1.0 hasn’t shipped by that date, every pre-order is refunded automatically, without anyone having to ask. Payment goes through Stripe, and Argus now has its own privacy policy, covering what the plugin and the dashboard will do with server and player data.
Argus now checks reach, speed and flight
Three new checks, taking the build to six. Reach is the one that took the work. A player with a slow connection attacks what their screen is showing them, which by the time it reaches the server is out of date — and a naive check punishes them for their ping. Argus now keeps a couple of seconds of where everyone was, and winds the target back to what that player could actually have seen, so the question becomes “could their connection explain this hit?” rather than “is this hit long?”. Speed and flight are simpler: they compare movement against what the game’s own physics allows, and step aside for ice, boats, elytra, riptide, knockback, teleports and speed effects rather than guessing. Speed and flight apply to Bedrock players too, who most anti-cheats skip; reach needs a Java 1.17+ client with packet capture on. Nothing acts on anyone — every finding is recorded for staff to look at. The thresholds come from our own model of how people play, not from real servers, so they will move once Argus has run on live ones.
Argus Core is now just Argus
We dropped “Core” from the name: Argus is shorter and easier to remember. Nothing else changes: same product, same v1.0 plan, same pre-order tiers. Earlier Ledger entries keep the old name as they were written.
Argus Core tiers: Scout for one server, Sentinel for one network
Scout covers a single server and fits best at around 50 players online. Sentinel covers one network of up to 5 servers behind BungeeCord or Velocity, such as Prisons, Factions, Skyblock, and SMP, and fits best at 100–300+ players online. Sentinel’s v1.0 build adds a proxy plugin for those networks. It isn’t built yet.
Argus Core now records a replay clip for every case
For each case, Argus now saves the 30 seconds before and 10 seconds after the moment it flagged: the player’s own movement and view, the players and mobs around them, and the blocks nearby. Clips store no usernames or IP addresses, and they need Argus’s packet capture, which is still opt-in. The viewer that turns a clip into first- and third-person playback isn’t built yet.
Argus Core v1.0 pre-orders now deliver by June 30, 2027
With the dashboard, replay viewer and Shadow Audit added to v1.0, we moved the delivery promise from March 31 to June 30, 2027, before any pre-order was sold. Both tiers include those three features. Discord alerts are no longer a Sentinel perk, because they arrive in v2.0. A full refund is still available any time before launch, and every pre-order is refunded automatically if v1.0 hasn’t shipped by June 30, 2027.
Argus Core v1.0 will include the dashboard, replay viewer and Shadow Audit
We moved three features into v1.0: an all-in-one dashboard, a replay viewer for the recorded moments behind a case, and Shadow Audit, which shows what Argus would have caught before you turn anything on. Discord alerts, third-party webhooks and an MCP server move to v2.0. None of these is built yet.
Argus Core can now record a case, with its evidence, before any kick or ban
Argus now saves each decision to kick or ban a player to disk, together with the stretch of play behind it, before anything happens to the player. If the record cannot be written, nothing happens. The kick and ban actions themselves are built, through Paper’s own ban list or a server’s ban plugin. They don’t act on anyone yet, because no check has earned the right to act. Until one does, each decision is only recorded as what Argus would have done. Cases are saved by default and hold no usernames or IP addresses: players appear only as a scrambled key, made with a secret that stays on the server. Argus is still not installable.
New studio line: AI that empowers people, never replaces them
We retired “AI that knows what it doesn’t know” the same day we adopted it. It described how our software behaves, not what it is for, and it was hard to read at a glance. The new line says what every product is for: emotionally intelligent AI that takes on repetitive work so people can do more thoughtful, effective work, with the judgment and the final call staying with them. Showing reasoning and holding back when unsure are still how our products earn that trust.
Argus Core plugin now boots on every supported Paper version
The Paper plugin, its first three detections, and its privacy safeguards are built. Our CI starts the plugin on real Paper 1.21.4, 1.21.11, 26.1.2 and 26.2 servers, including alongside ViaVersion, Geyser and Floodgate, and checks that it runs cleanly. It has not been tested with real players yet, so Argus is still not installable.
Argus Core will remove cheaters automatically, one proven check at a time
Argus will kick and ban cheaters on its own, with the evidence attached and a one-command way for staff to overturn any action. A check only gets to act once it has a measured record on real servers: no more than 1 in 10,000 legitimate players wrongly actioned, and at least 300 staff-reviewed cases with none overturned. Until then, its findings go to staff to review. The decision logic is built; kicking and banning are not yet.
One standard for every product: AI that knows what it doesn’t know
We replaced “emotionally intelligent AI” as the studio line. What our products actually share is that each shows its reasoning, holds back when it isn’t sure, and leaves the final call to a person.
Redesigned ohventures.cc
The site moved from static HTML to Next.js and adopted the navy-and-gold “Digital Opera House” design, with every product grouped into the Foundry and labelled with its real stage.
CullAI back-seated in favour of CullMC
We’re putting the standalone Unreal Engine 5 / Unity auditor on hold to focus that work on CullMC, a version built into the Minecraft server alongside Argus Core. The existing CullAI repository is still public on GitHub.
Argus Core v1.0 scope frozen; engine scaffolded
The v1.0 scope is fixed and the capture API, detection SPI, and engine runtime are building. The Paper adapter, capture sources, and detections are still being written, so Argus is not installable yet.
NarrativAI closed beta opened
The closed beta went live with the OC Vault and Muse, alongside a Founding Member offer for the first 100 members.
CullAI published as open source
CullAI’s repository went public under the MIT licence: performance-debt audits for Unreal Engine 5 and Unity codebases, with dry-run reports and PR-gated fixes. Early-stage; not for production use.