Rollout Plan

Phase one

Install on the proxy, keep enforcement conservative, and start with observe mode. Let normal players use menus, crates, auctions, cosmetics, voice, TAB, queues, and minigames.

Phase two

Review incidents by family. Clear expected plugin traffic, confirm repeated suspicious traffic, and adjust integration settings only when the report points to a real plugin interaction.

Phase three

Move to balanced mode. Keep reports for support and only use strict mode when an attack is happening now.