The Machine Should Not Cheat: Building the Custodian System

More than an enemy with a cone on its face

The earliest Custodian was already a native Unreal Character with navigation, perception, a state machine and a basic set of dispositions. Friendly units could patrol and perform routine activities. Hostile units could notice the player, pursue, attack and capture them. On paper, that was most of an enemy AI.

In practice, it was only the skeleton of the thing. A Custodian who always converts sight into a chase is predictable. A Custodian who cheats is irritating. A Custodian who teleports into view, shouts a line which contradicts what she knows and then vibrates against the furniture is neither frightening nor especially dignified.

The real work was therefore not adding more actions. It was deciding what information she was allowed to use, which system owned her at any particular moment and what must happen when an apparently successful operation did not mean what everybody thought it meant.

That sounds like architecture rather than horror design. It is both. The player never sees a movement serial or an evidence timestamp, but they feel the difference between a machine which found them and a machine which was told where they were by the level.

She only knows what she knows

The most important rule in the system is that the Custodian may act only on information she genuinely possesses. If the player is behind a wall, she should not shuffle sideways until they happen to come into view because the game has quietly supplied their exact location. If she says, “I see you,” she must have valid direct sight. If she announces that the other machines know, the group must actually have accepted and shared that information.

Every useful fact therefore has a source. Direct sight requires range, field of view and an unobstructed trace. Scripted evidence can be less certain, but it still arrives as evidence with a location, confidence and age rather than as permission to acquire the player. Shared knowledge exists only after another machine has honestly observed something and the receiving system has accepted the report.

Speech is downstream from those facts. It can describe what the Custodian knows, misunderstands or has been instructed to do. It cannot create a sighting merely because a dramatic line would be convenient. Presentation works the same way. Cameras, sound, lights and sequences may make an encounter considerably more alarming, but none of them is evidence.

This rule did more than prevent obvious cheating. It gave the tactical system room to exist. Uncertain evidence can produce a search. Old evidence can produce an inspection of the last known area. Direct sight can produce observation, shadowing, preparation or pursuit. The Custodian is not clever because she always knows the answer; she is clever because she behaves coherently with the answer she currently has.

Movement, ownership and the informative failure

Movement was one of the first large problems. Unreal navigation can turn a request which sounds like “walk over there” into an impressive collection of questions about possession, path following, NavMesh projection, animation, streaming, movement mode and whichever other system has decided it also owns the character.

Some early moves had perfectly valid navigation but failed to start. Others were being requested from a Blueprint context which conflicted with the Custodian's own state ownership. Moving the request to the Level Blueprint, AI Controller or another appropriate external owner solved the immediate problem, but the more useful change was diagnostic: a failure stopped being reported as simply Move Failed.

The system began recording whether the pawn was possessed, whether path following existed, whether a path could be generated, whether the destination projected onto navigation and whether another operation currently owned movement. This made the fault much less mysterious. It also made the logging rather less polite, which is often helpful.

The broader lesson was that a gameplay move is not just a destination. It has an owner, a purpose, a requested point, a resolved navigation point and a lifetime. Once those pieces were explicit, the Custodian could stop accepting any vaguely successful callback as proof that the current problem had been solved.

The first time she genuinely stalked me

The stalking system was where the Custodian began to feel distinctive. Instead of chasing whenever she noticed the player, she could select authored observation markers placed behind doors, around corners, inside alcoves and at the ends of long sightlines. These are positions from which she can watch a space, disappear into it or be discovered standing somewhere the player would very much prefer to be empty.

Markers are scored for distance, visibility, navigation safety, occupancy, recent use, the player's current camera and their tactical relationship to the area. The best marker is not always the closest one. Sometimes the correct answer is a position which takes longer to reach but allows the player to glimpse the Custodian only after entering the room.

The first working test contained a wonderfully subtle failure. She selected a marker, walked to it and stopped in exactly the right place, but remained in the Shadowing state. The movement had completed; the state machine did not believe that completion belonged to the active stalking request.

The fix was to give every owned move a serial and retain both the authored and resolved destinations. A completion advances behaviour only if its serial is still current, the expected state still owns it, the destination matches and the body has genuinely arrived within tolerance. A callback from an old decision is now simply old news.

That pattern spread through the rest of the project. Finishing a path is a transport result. Arriving somewhere meaningful is a gameplay result. They are related, but they are not the same fact.

Moving only when nobody is looking

Concealed relocation was the next important part of stalking. If the player had not seen the Custodian for long enough, she could move between valid hidden observation positions. The intended effect was that she might vanish from one side of a large space and later be found somewhere else, without materialising in front of the camera like an embarrassed stagehand.

The simple version is a teleport. The actual version checks that the player is not looking at her, direct sight has been absent, the cooldown is ready, the destination is far enough from recent markers, the zone and tags permit it, the position is loaded, navigation is valid, the space is unoccupied and an alternative exists if the preferred point fails.

Early versions could remain indefinitely in Observing even when the broad conditions seemed correct. The solution was again better evidence, this time for the developer: every relocation gate and every candidate marker began reporting why it had been rejected. A system with twelve safety rules is considerably easier to trust when it can name the eleventh one.

The final relocation is intentionally conservative. It refuses during pursuit, avoids visible and unsafe markers and prevents repeated loops through the same small set of positions. The player should feel that the Custodian moved cleverly while they were occupied. They should not feel that I placed her behind them because I wanted a louder noise.

Direct sight is evidence, not a sprint button

One correction briefly made the Custodian much worse. I was removing stale stalking ownership when direct sight returned, and the fix went too far: seeing the player effectively became an automatic pursuit order. Every interesting encounter collapsed into the same chase.

It also created the appearance of knowledge through walls. Partial sight, room-level assumptions or a badly timed retained fact could push the system into pursuit when the player had no reasonable way to understand what had happened. The Custodian was technically reacting to something. From the other side of the wall, she was simply psychic.

The corrected chain is deliberately less excitable. Direct sight clears behaviour which is no longer valid, records a strong piece of evidence and asks the tactical planner what to do with it. Depending on disposition, distance, recent events, available positions and the current activity, the answer may be to observe, shadow, prepare an ambush, search or pursue.

This changed the mood immediately. She could see the player and remain still. She could speak. She could leave and choose a better position. She could allow the player to realise, several seconds too late, that they had already been noticed.

A chase is frightening because it is urgent. Being watched is frightening because it gives you time to think about it.

Animation, or several ways to remove all menace

AI logic is not the only thing which decides whether a machine feels intelligent. Retargeted animations produced tremors, snapping and NaN bone errors in Unreal's animation graph. The decision system could be behaving perfectly while the visible Custodian shook as though she had been left on top of an industrial washing machine.

That was a useful separation. Animation assets need their own validation: mesh alignment, stable locomotion, sensible root-motion handling, transition timing and clean montages. An AI fault should not be diagnosed through a broken animation, and a broken animation should not be disguised with more AI logic.

Rotation exposed the same issue from a different direction. During friendly conversation, the Custodian would turn towards the player, snap back to her previous patrol direction and turn again in a loop. Focus, controller rotation, movement-facing and patrol-facing were all politely attempting to help.

The fix was narrow. Conversation stops movement once, maintains focus for the duration and does not restore patrol facing until the activity ends. Nothing revolutionary happened in the state machine. She simply stopped arguing with herself about which way her head belonged.

It was a small technical change with a large emotional effect. The Custodian now feels present in a conversation rather than like a machine trying to remember where it parked.

Capture is a transaction

Capture and wake markers became another defining part of the system. A Custodian or Pacifier can subdue the player, take control of the presentation, fade the screen, relocate them to a safe wake point and return control. Any one of those steps can fail, especially in a streamed world.

A serious Pacifier failure made the risk very clear. The knockout attack consumed its available charge, then the ordinary charge-unavailable guard ended the response early. The screen had already faded out. Relocation and fade-in never happened. The player received the unusually severe punishment of permanent darkness for being successfully attacked once.

The correction was to treat an accepted capture as a transaction. Once the outcome owns a serial, it must reach one shared completion path whether relocation succeeds, a wake marker disappears with World Partition, the operation times out, the owner is destroyed or the intended destination becomes unsafe.

Control locks are tokens rather than a vague boolean. A release is accepted only for the matching owner and serial, and releasing one system cannot restore movement or look while another system still owns that axis. The last valid release restores the exact original state once.

The most important promise happens when the screen goes black: it will come back. That should not require saying, but several hours of testing suggested that it did.

The smaller machines became an ecosystem

As the Custodian grew, the BOB units had to grow with her. The early BOBs were static-mesh machines with custom movement and a fairly relaxed relationship with physical matter. They could cross walls, overlap the player, jam one another and occasionally form something better described as a cupboard argument than a tactical response.

Moving them onto Unreal's Character-style collision and navigation approach was a large architectural change. Capsules, Character Movement, Crowd following and bounded recovery gave them physical bodies, normal floor finding and a sensible way to share space. A coordinate bug which confused a floor-level navigation point with the centre of a capsule initially made every BOB believe it was penetrating the ground. Once corrected, the system could finally see the actual obstacle in front of it.

The result was useful to the Custodian as well as the BOBs. Maniples can now build circles, corridors, horseshoes, walls and other formations from placed, loaded machines. They can leave a genuine gap, establish physical containment, open a real entrance for a Custodian and reseal it after she passes through.

The Pacifier connects these systems more directly. It can stun the player, request a chosen formation or complete a knockout-and-wake sequence. A formation can then call a Custodian with a defined support purpose instead of throwing her into an unrelated hostile loop.

The ownership rule remains the same. BOB support passes evidence and intent. It does not seize the Custodian's perception, pursuit, attack or capture systems. Coordinated machines are interesting. Machines which quietly rewrite one another are an afternoon of log reading.

A damaged voice which is still required to tell the truth

Speech added the final layer of personality. The Custodian has optional offline synthesis, positional playback, subtitles, damaged-machine processing, group arbitration and dialogue selected from accepted gameplay context.

Truth gating matters here more than the number of lines. “I see you” requires direct sight. A shared announcement requires genuinely accepted group knowledge. A search line can reflect uncertainty. The voice describes the state the machine already has; it does not give the state machine a helpful new fact because somebody wrote a dramatic sentence.

The BOBs use their own deeper and more primitive voice for hospital phrases, inter-machine exchanges, containment announcements and carefully limited group chants. Tannoys, vending machines, levers and other props can also call the shared machine-speech infrastructure, giving the hospital one damaged institutional language.

This has produced one of my favourite contrasts in the project. The Custodian can be stalking the player with a fairly sophisticated evidence model while speaking in the tone of an exhausted public-address system. She is capable, formal and slightly broken, which is more or less the entire design in one sentence.

What all the failures were for

The final system is complicated, but the complexity is controlled. The Custodian can be friendly, suspicious, hostile, watchful, procedural, quietly absurd or frighteningly competent. She can work at a machine, notice the player stealing something, pass accepted information, search honestly, stalk from a marker, call support, speak through a damaged voice and eventually capture them.

What matters is that every one of those abilities has a reason to stop. Evidence ages. Sight can be lost. A marker can be rejected. Movement can fail. A serial can become stale. A capture can clean up. Speech can disappear without changing gameplay. Failure is not an exceptional hole in the system; it is one of the outcomes the system is designed to survive.

The largest lesson has been that emergent horror depends on fairness. The Custodian does not need to be unbeatable. She needs to be legible enough that the player can form a theory about her, and unpredictable enough that the theory is never completely comfortable.

If she finds you, there should be a chain of events which explains how. If she vanishes, there should have been a moment in which you were not looking. If she appears to wait for you, she should have chosen a position from evidence rather than from my desire to make the scene work.

The goal was to create a machine the player can understand just enough to fear.

It has taken rather more code than simply giving her the player's location. I think that is probably a good sign.