The signal codes

These are the codes the beacon reports about the browser it is running in. A code is an observation, not a verdict: the scorer correlates them with the transport and behaviour planes and owns the final number.

The weight column here is only this plane’s contribution to the client sub-score. The rules that turn them into a verdict are on the scoring page, and the identifiers that land on a session are on identifiers and labels.

Only the strong four — the renderer, the missing window object, the notification contradiction and the zero outer size — plus any automation marker set the headless boolean. The weak ones each have a real population of genuine humans behind them, and a boolean that is wrong for real visitors is worse than no boolean.

A scraper can set any User-Agent string it likes, but it cannot retrofit a JavaScript engine. The probe table pairs a browser major version with a function that first shipped natively in it:

var UA_PROBES = [
    63,  'Promise.prototype.finally',
    69,  'Array.prototype.flat',
    73,  'Object.fromEntries',
    85,  'String.prototype.replaceAll',
    93,  'Object.hasOwn',
    98,  'structuredClone',
    110, 'Array.prototype.toSorted',
    122, 'Set.prototype.union'
];

Given a User-Agent claiming version N: every entry at or below N minus two must be present, or the engine is older than claimed; every entry at or above N plus two must be absent, or the engine is newer than claimed. The grace of two majors means a browser mid-upgrade, an enterprise pin, or one of the browser’s own User-Agent reduction quirks is never flagged.

Adding a row as the browser advances

Roughly every ten releases, pick a feature that is shipped in a known version — look it up rather than guessing, because a wrong version number here manufactures false accusations against real people — that is reachable as a function by a dotted path, and that is not commonly polyfilled. Never remove old rows; they are what catches ancient engines.

The beacon reports the raw measurements and the server does the comparing. Three reasons, and byte count is the least of them: the server holds the authoritative User-Agent read off the connection, and half these checks compare something against the User-Agent, which is precisely the thing we do not trust; a client cannot suppress a comparison it never performs; and thresholds can be tuned server-side without asking every site to redeploy a script tag.

Two conservatism rules apply here. The reverse of the touch check is deliberately not performed, because a desktop User-Agent with touch would flag every touchscreen laptop. And the display checks only run when the payload actually reported a screen size — a truncated write or an older client sends zeroes, and “no data” must never be read as “a window with no size”.

Mouse positions are sampled at most once per second, up to sixteen points, and the classifier stays silent below six samples: somebody who nudged the mouse twice is not evidence of anything. The coordinates never leave the browser — only the verdict does.