Anti-cheat and match audit trail

K-Cricket never trusts browser timing alone. Each action uses a one-time signed token, a server delivery timestamp, a server arrival timestamp, and a committed event hash. Refreshing the browser cannot reroll a completed ball.