Optional Killed-By Correlation — Inferred K/D (Stats Only)

[ntatschner]

Problem

Individual users see their own deaths and kills, but there's no way to infer killer ↔ victim pairings across the user base — and a naive approach would leak identifying info about who killed whom, or invite leaderboard abuse.

Approach

Opt-in per user, off by default. When two users have both opted in, server-side correlation across concurrent sessions infers killer ↔ victim pairs from kill/death events that happen within tight time + location windows. Each inferred match is confidence-scored.

Stats-surface only — no notifications, no leaderboards, no exposure of the inferred edges to either party beyond their own aggregated K/D number.

Acceptance criteria

• User-level opt-in toggle (default OFF) with explicit privacy disclosure
• Correlation runs only across pairs of users who BOTH opted in
• Confidence scoring based on time + location window proximity
• Inferred K/D appears in personal stats only; never on leaderboards or org views
• Inferred edges are NOT exposed via any API to either party (only the count survives)
• Audit-log entry on each correlation pass (count of matches, no identifying detail)

Risks / Open questions

• Time/location window thresholds: too loose → false positives; too tight → misses. Needs tuning data.
• Server-side correlation cost grows with concurrent-user count — what's the upper bound and ratelimit?
• Privacy regression risk: even aggregate K/D might be back-inferrable in small populations. Threshold for showing the number?
• Opt-in semantics: does opt-in apply only to future events, or retroactively? Probably future-only to avoid surprise.

Original draft notes

Opt-in per user, off by default. Server-side correlation across concurrent sessions to infer killer ↔ victim pairs from kill / death events that happen within tight time + location windows. Confidence-scored matches. Stats surface only — no notifications, no leaderboards, no leakage of the inferred pairing back to either party.

---

Tracking

• Roadmap slug: optional-killed-by-correlation-inferred-k-d-stats-only
• Public roadmap: https://starstats.app/roadmap/optional-killed-by-correlation-inferred-k-d-stats-only
• Project board: https://github.com/orgs/TheCodeSaiyan/projects/1
• eta_band: tbd (set on the Project board when scoping firms up)
• Channel targeting: likely tech-preview + alpha + beta — experimental privacy-sensitive feature; tech-preview gate appropriate while opt-in semantics + leakage proofs land. Add channel/<name> labels when targeting firms up.

[ntatschner]

Audit note (2026-07-26): data-blocked on modern SC log data.

Cross-user killer↔victim correlation needs the killer's identity, which modern (4.x+) Star Citizen logs no longer provide:

• The victim's PlayerDeath event carries only {timestamp, body_class, body_id, zone} — no killer field, and zone is None at parse time (crates/starstats-core/src/events.rs:162-174).
• The killer-bearing ActorDeath line format was removed by CIG pre-4.x and is retained only for legacy/synthetic fixtures (events.rs:196-211).

Neither the victim's nor the killer's log names the other party, and the time/location window (zone) is unavailable — so the cross-user inference is not implementable as specced until CIG restores combat attribution (or a non-log source appears). The existing per-user self-K/D is itself fed by an event stream modern SC no longer emits.

Keeping open as a tracked upstream dependency, not active build work.