Article
Detecting occasional x-ray: when a single suspicious pass is enough
A player who mines honestly 90% of the time and only cheats in short bursts does not need to hide for long: all they need is for an average to exist somewhere in the system to pull it back under the threshold. A single score per whole session is exactly that kind of average — and sorting by player would be another one.
The problem: an average always hides its worst moment
Picture a 40-minute mining session. The first 35 are entirely ordinary strip-mining — lots of stone broken, little ore, modest yield. Then, over the last 5 minutes, the player goes straight for a diamond vein that no cavity could have revealed to them.
A single score, computed over the full 40 minutes, dilutes that pass into the average of the rest of the session. The suspicious behaviour is right there in the data — but drowned in enough legitimate mining to pull the overall score back under any reasonable threshold.
This is not a badly tuned threshold: it is structural. As long as a score summarises a whole session into a single number, an x-rayer only needs to mine honestly long enough before and after their suspicious pass to stay under the radar.
The sliding window: never average over the whole session
The direct fix is to stop settling for a single score per session: the session is split into overlapping windows, and each one gets its own score, computed exactly like the session score — same indicators, same insufficient-evidence safeguards. The whole session's score and verdict are still computed alongside, unchanged: this new signal is additive, it replaces nothing.
The split is done in blocks actually dug, not in minutes or raw blocks: a cave session, where a player walks a lot between two breaks, would otherwise produce windows almost empty of material. A window too short to gather enough dug blocks simply is not scored on its own — the whole session then remains the only available unit, exactly as today.
The principle that still applies here Why a suspicion score should never be enough to ban →Triage must never average by player either
The same dilution logic exists at a larger scale: if the sorted list ranked players rather than sessions, a cheater with plenty of honest sessions behind them would see their personal average crushed by their own history — exactly the same problem as the intra-session average, one level up.
The triage list ranks individual sessions, never a per-player average. A single session — or, now, a single window inside an otherwise clean session — is enough to rise to the top of the list, without being drowned out by the rest of the session or by the rest of the player's history.
The safeguards that prevent the opposite effect
Splitting more finely could also, the other way around, make a signal appear where there is not enough to conclude anything. Two protections prevent that:
- Same evidence thresholds as the session score. A window without enough dug blocks to make an indicator reliable applies exactly the same safeguards — it never invents an inflated score from too little material.
- Overlap, not tiling. Without overlap, a suspicious pass sitting right on the boundary between two windows would get cut in half, each half individually too short to be judged. Overlap guarantees there is always a window that covers it in full.
What this changes in practice for moderation
Beyond the signal itself, this split answers a practical frustration: once a session was flagged, you previously had to replay it in full in a 3D preview to find the part that actually raised concern. The most suspicious window now comes with its own position in the path — from which moment to which moment to look at — instead of searching for a needle in a session of several thousand blocks.
A suspicious window is a signal to corroborate, not a verdict — see why a score should never be enough to ban. It says where to look first, never who to ban.
What to remember
- A single per-session score always dilutes a short suspicious pass into the rest of an otherwise legitimate session.
- Splitting into overlapping windows, with the same evidence safeguards, catches that pass without ever changing the existing session score.
- The same trap exists at the player scale: ranking individual sessions, never a per-player average, stops a clean history from masking one isolated session.
- The most suspicious window points to where to look in the path — it never replaces human inspection.
TunnelVision applies this principle at every level
TunnelVision never averages a suspicious pass away — not within a session, not across a player's sessions. Every session that surfaces comes with its indicators and, now, the most suspicious window in its path when one exists. The decision stays entirely yours.