{ "version": "chk-2", "generatedAt": "2026-08-25", "controls": [ { "id": "alpn.offer", "value": "h2, http/1.1", "browser": "any current desktop browser", "source": "report 259, section C7 (the browser's ALPN offer, not the server's)", "provenance": "the offer is a property of the client build; read from the ClientHello, not negotiated", "capturedAt": "2026-08-15", "staleAfter": "2026-11-13", "confidence": "published" }, { "id": "automation.evaluation-source", "value": "an error stack names only page scripts", "browser": "any browser", "source": "Puppeteer appends //# sourceURL=pptr:… to every evaluated script, so the scheme shows up in the stack of an error created inside it", "provenance": "only the scheme is reported, never the stack itself: that would carry the visitor's own paths", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "community" }, { "id": "automation.globals", "value": "no automation binding in the global scope and none on the document", "browser": "any browser", "source": "the names come from the tools themselves: Playwright injects __playwright__binding__ and __pwInitScripts into the main world, ChromeDriver caches under cdc_<22 chars>_", "provenance": "a fixed list, never a walk of the whole namespace: that would carry every extension and page script the visitor has and would describe him rather than his tooling", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "community" }, { "id": "automation.natives", "value": "every built-in function reports \"[native code]\"", "browser": "any browser", "source": "ECMAScript: Function.prototype.toString returns a NativeFunction string for built-ins", "provenance": "specification-level guarantee; a replacement shows its own source instead, which is what makes a JavaScript-level fix discoverable in one line", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "automation.pointer-origin", "value": "pageX and screenX differ outside fullscreen", "browser": "any browser", "source": "the two coordinate systems have different origins unless the viewport starts at the screen origin", "provenance": "read from a REAL pointer event, the click that started the check, because an event created in script would carry whatever we put in it", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "automation.realm-coherence", "value": "the same value in the document and in a same-origin frame", "browser": "any browser", "source": "a frame gets its own realm with its own prototypes, fed by the same browser", "provenance": "the classic gap of a JavaScript-level fix: it is applied to the top-level realm, and a freshly created frame never sees it", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "automation.receiver-check", "value": "a built-in accessor throws a TypeError when called on an object of the wrong type", "browser": "any browser", "source": "WebIDL: an attribute getter performs a brand check on its receiver before doing anything", "provenance": "the opposite direction from the toString check: there a replacement gives itself away through its source, here through its behaviour. Rebuilding toString does not help with this one, because the silence is the signal", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "automation.webdriver-consistency", "value": "navigator.webdriver reads the same in the document and in a frame", "browser": "any browser", "source": "WebDriver specification: the flag belongs to the browsing context's agent, not to a document", "provenance": "specification-level guarantee; whoever sets the value on the document often misses a freshly created frame, which gets its own context", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "automation.webdriver-shape", "value": "an accessor on Navigator.prototype, with nothing of that name on the navigator instance", "browser": "any browser", "source": "WebIDL: an attribute of an interface lives on the interface prototype object, not on instances", "provenance": "specification-level guarantee. The common way to hide the flag defines it on the instance instead, which puts the value in a place no browser puts it", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "build.codecs", "value": "Chrome answers \"probably\" for H.264 and AAC; an open-source Chromium build answers \"\"", "browser": "Google Chrome", "source": "chromium.org, Audio/Video: the licensed decoders ship with Chrome and are excluded from the open-source build", "provenance": "a property of the build, not of a version. Automation tooling ships the open-source build, and a spoofed user-agent string does not change what the binary can decode", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "build.widevine", "value": "Chrome resolves requestMediaKeySystemAccess for com.widevine.alpha", "browser": "Google Chrome", "source": "Chrome ships the content decryption module; the open-source build does not", "provenance": "only the access request is measured, never a key session: a session would leave something behind in the visitor's profile, and a measuring page that writes to the profile it measures is the thing this product argues against", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "cross.family-source", "value": "handshake and user agent name the same browser family", "browser": "any unmodified browser", "source": "Durumeric et al., NDSS 2017: matching the user agent against TLS behaviour is the documented core heuristic", "provenance": "peer-reviewed publication; no device measurement of our own involved", "capturedAt": "2017-02-26", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "cross.ja4-vs-useragent", "value": "Chrome t13d1516h2 · Firefox t13d1517h2 · Safari iOS t13d2014h2", "browser": "any unmodified browser", "source": "Durumeric et al., NDSS 2017: matching the user agent against TLS behaviour is the documented core heuristic", "provenance": "peer-reviewed publication; no device measurement of our own involved; the prefix values come from FoxIO JA4 specification (layout) plus the reference values above", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "community" }, { "id": "env.avail-origin", "value": "a desktop reserves screen space for a bar, so avail top or left is non-zero", "browser": "any browser on a desktop", "source": "CSSOM View: availTop and availLeft describe the area left after system furniture", "provenance": "both at zero happens on a real full-screen desktop too, which is why this one is a weak signal on its own and only counts next to the others", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "community" }, { "id": "env.frame-interval", "value": "a real display paces the frame loop, typically near 16.7 ms", "browser": "any browser with a display", "source": "the animation callback is tied to the display refresh", "provenance": "the MEDIAN of a dozen intervals, not the mean: a single late frame happens on every busy machine and would move a mean without saying anything about the pace", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "env.gpu-adapter", "value": "a consumer machine names a real adapter, never a software rasteriser", "browser": "any browser on real hardware", "source": "the newer graphics interface reports the adapter it actually got; a build without one falls back to software and says so", "provenance": "measured separately from the WebGL renderer string on purpose. The two falling apart IS the finding: a build without a real adapter reports software here while the WebGL string can still claim a card", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "env.media-devices", "value": "a desktop or phone knows at least one audio or video device", "browser": "any browser on real hardware", "source": "device names need permission, the COUNT does not. A machine with no audio output at all is a server, not a workstation", "provenance": "only the count is read, never a name: a device name describes the visitor, a count describes the machine", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "env.notification-permission", "value": "Notification.permission and the permissions query describe the same state", "browser": "any browser", "source": "both read the same underlying permission; denied on one and prompt on the other is not a state a permission can be in", "provenance": "the classic headless signal, and one of the few that survived: it is a logical contradiction rather than a value that can be set", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "env.window-chrome", "value": "a windowed browser has a frame, so the outer window is taller than the viewport", "browser": "any windowed browser", "source": "the outer size includes tab strip and address bar, the inner size does not", "provenance": "an equal pair means either fullscreen or no window at all; fullscreen is checked separately before this one speaks", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "fonts.os-rule", "value": "no Linux font families appear under a Windows user agent", "browser": "Chrome on Windows", "source": "CreepJS, check isFontOSBad (open source, MIT)", "provenance": "rule read from the open-source implementation; the family marks are verifiable by the visitor in one line", "capturedAt": "2026-08-15", "staleAfter": "2027-08-15", "confidence": "published" }, { "id": "geo.zone-language", "value": "time zone and language match, or the language is English", "browser": "not a browser property, an expectation about where you are", "source": "report 263: this comparison is the most classic marker and legitimate a million times over", "provenance": "no measurement: a mapping from zone to the languages that are unremarkable there, deliberately small and deliberately incomplete; a zone that is missing produces no finding at all", "capturedAt": "2026-08-15", "staleAfter": "2031-08-14", "confidence": "published" }, { "id": "geo.zone-offset", "value": "the offset follows the zone's name, in January as in July", "browser": "any browser", "source": "both values come from the same time-zone database of the operating system", "provenance": "checked at two dates of the year, not only at the current one: a zone name alone says nothing about the daylight-saving rule the zone really runs (PRD AC-TOOL-005)", "capturedAt": "2026-08-15", "staleAfter": "2031-08-14", "confidence": "published" }, { "id": "graphics.renderer-os", "value": "Direct3D only on Windows · Metal or Apple GPU only on Apple systems · OpenGL elsewhere", "browser": "any browser with WEBGL_debug_renderer_info", "source": "ANGLE backend selection: the backend is chosen from the operating system, not from a string", "provenance": "the same coupling this project enforces in its own engine: the machine's own rendering cross-checks anything that describes hardware", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "graphics.vendor-renderer", "value": "the vendor string names the same manufacturer the renderer string does", "browser": "Chromium browsers", "source": "WEBGL_debug_renderer_info: both strings come from the same driver query", "provenance": "specification-level guarantee; both values are read from one ANGLE context in the same call", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "grid.clockResolution", "value": "100 µs without isolation, 5 µs with isolation", "browser": "Chrome", "source": "MDN, DOMHighResTimeStamp; Chrome since version 91 (Spectre mitigation)", "provenance": "measured as the smallest observed step of performance.now() over up to fifty samples", "capturedAt": "2026-08-15", "staleAfter": "2027-02-11", "confidence": "published" }, { "id": "grid.connection.downlink", "value": "a multiple of 0.05, at most 10", "browser": "Chromium", "source": "Chromium source: third_party/blink/renderer/platform/network/network_state_notifier.cc, NetworkStateNotifier::RoundMbps, kBucketSize = 50 kbps, kMaxDownlinkKbps = 10000", "provenance": "read from the Chromium 150 checkout at ~/projects/chromium-150/src, not from a secondary source", "capturedAt": "2026-08-16", "staleAfter": "2027-02-12", "confidence": "published" }, { "id": "grid.connection.effectiveType", "value": "slow-2g · 2g · 3g · 4g", "browser": "Chromium", "source": "Network Information API: the field is an enumeration with exactly four values", "provenance": "specification-level guarantee; the enumeration has no fifth member", "capturedAt": "2026-08-15", "staleAfter": "2027-02-11", "confidence": "published" }, { "id": "grid.connection.rtt", "value": "a multiple of 50, at most 3000", "browser": "Chromium", "source": "Chromium source: third_party/blink/renderer/platform/network/network_state_notifier.cc, NetworkStateNotifier::RoundRtt, kGranularity = 50 ms, kMaxRtt = 3 s", "provenance": "read from the Chromium 150 checkout at ~/projects/chromium-150/src, not from a secondary source", "capturedAt": "2026-08-16", "staleAfter": "2027-02-12", "confidence": "published" }, { "id": "grid.deviceMemory", "value": "a power of two: 0.25 · 0.5 · 1 · 2 · 4 · 8 · 16 · 32", "browser": "Chromium", "version": "150 and later for the raised ceiling", "source": "Chromium source: third_party/blink/common/device_memory/approximated_device_memory.cc, ApproximatedDeviceMemory::CalculateAndSetApproximatedDeviceMemory, rounds to the nearest power of two, then clamps; kUpdatedDeviceMemoryLimitsFor2026 (enabled by default in 150) raises the clamp from 0.25–8 to 2–32 outside Android", "provenance": "read from the Chromium 150 checkout at ~/projects/chromium-150/src, not from a secondary source; the raised ceiling was found by this very page reporting 32 as impossible on a real browser, then confirmed in the source", "capturedAt": "2026-08-16", "staleAfter": "2027-02-12", "confidence": "measured" }, { "id": "grid.screen.colorDepth", "value": "24", "browser": "Chrome and Firefox on desktop", "source": "report 260, section B9 (Chromium behaviour; Firefox under resistFingerprinting also 24)", "provenance": "measured on the project's own Windows and Linux machines; Firefox value read from its resistFingerprinting implementation", "capturedAt": "2026-08-15", "staleAfter": "2027-02-11", "confidence": "published" }, { "id": "headers.chrome-navigation", "value": "Host, Connection, sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform, Upgrade-Insecure-Requests, User-Agent, Accept, Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-User, Sec-Fetch-Dest, Accept-Encoding, Accept-Language", "browser": "Chrome", "version": "151.0.7922.109", "platform": "Windows", "source": "own measurement, tools/header-probe (3 runs, 2026-08-12)", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server", "capturedAt": "2026-08-12", "staleAfter": "2026-11-10", "confidence": "measured" }, { "id": "http2.chrome", "value": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p", "browser": "Chrome", "version": "150 and 151", "source": "own measurement, tools/header-probe (3 runs, 2026-08-12)", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server", "capturedAt": "2026-08-12", "staleAfter": "2026-11-10", "confidence": "measured" }, { "id": "http2.firefox", "value": "1:65536;2:0;4:131072;5:16384|12517377|0|m,p,a,s", "browser": "Firefox", "version": "141", "source": "community capture (CycleTLS), documented via report 259", "provenance": "third-party capture libraries (curl_cffi, CycleTLS) that record real browser handshakes; not measured on our own devices, carried as community confidence for that reason", "capturedAt": "2026-08-15", "staleAfter": "2026-11-13", "confidence": "community" }, { "id": "http2.pseudo-header-order", "value": "Chrome :method :authority :scheme :path · Firefox :method :path :authority :scheme", "browser": "Chrome and Firefox", "source": "own measurement, tools/header-probe (3 runs, 2026-08-12) (Chrome); community capture (Firefox)", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server (Chrome); third-party capture libraries (curl_cffi, CycleTLS) that record real browser handshakes; not measured on our own devices, carried as community confidence for that reason (Firefox)", "capturedAt": "2026-08-12", "staleAfter": "2026-11-10", "confidence": "measured" }, { "id": "hw.main-vs-worker", "value": "both report the same number", "browser": "any browser", "source": "both read the same hardware; the worker does not see a different machine", "provenance": "specification-level guarantee; the worker reads navigator.hardwareConcurrency of the same device", "capturedAt": "2026-08-15", "staleAfter": "2031-08-14", "confidence": "published" }, { "id": "impossible.physical-limits", "value": "a window fits on its screen, usable area fits inside the screen, the drawing area fits inside its own window, the pixel ratio is between 0 and 6, and the core count is a whole number the browser itself clamps", "browser": "any browser on any device", "source": "CSSOM View for the screen, window and viewport relationship; the HTML specification clamps hardwareConcurrency, and every shipped display sits inside the pixel-ratio range", "provenance": "derivations, not measurements: each pair comes from one source in the device, so the two numbers cannot disagree unless one of them was written. The viewport clause was measured against four browsers on two operating systems on 2026-08-25 before it was written down: Chrome 141 on Linux and Chrome 151 on Windows, each with and without a window, never came within 80 pixels of the limit in height and never crossed it in width", "capturedAt": "2026-08-25", "staleAfter": "2031-08-24", "confidence": "published" }, { "id": "input.click-has-approach", "value": "a mouse click is preceded by pointer movement", "browser": "any browser", "source": "W3C Pointer Events Level 3: a mouse reports its path before it reports a press", "provenance": "confirmed against the same 14 recordings: 8 clicks with 0 pointer samples in every run without an input layer, 139 to 577 samples in every run with one and in the human run", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "input.events-are-trusted", "value": "an event from hardware carries isTrusted true", "browser": "any browser", "source": "DOM standard: isTrusted is false for any event dispatched from script", "provenance": "measured twice on 2026-08-24: nodriver dispatches its clicks from script at coordinates 0,0 with isTrusted false; Playwright, Puppeteer and Selenium send them over the control connection, where they arrive trusted", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "input.keypress-follows-keydown", "value": "keydown, then keypress, then keyup", "browser": "any browser", "source": "W3C UI Events: the order of key events is normative", "provenance": "measured twice on 2026-08-24 against tools/behavior-lab: nodriver sent 79 keypress events and zero keydown; the other four tools sent all three", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "input.pressure-when-down", "value": "0.5 while a button is held, on any device without a pressure sensor", "browser": "any browser", "source": "W3C Pointer Events Level 3: the value MUST be 0.5 in the active buttons state", "provenance": "a normative MUST, not a convention. Measured twice per tool on 2026-08-24: Playwright reports 0.5, Puppeteer and Selenium report 0, a human and our own input layer report 0.5", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "input.text-follows-key", "value": "every insertText is preceded by a keydown", "browser": "any browser", "source": "W3C UI Events and Input Events Level 2: a keyboard-produced insertText follows the keydown that produced it; paste, autofill and composition carry their own inputType", "provenance": "the specification describes the browser, not the person, so a deviation is a statement about the input path. Confirmed against 14 recordings in tools/behavior-lab/sessions: 143 of 143 insertText events had no key behind them without an input layer, and 0 of 143 with one", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "input.uppercase-needs-shift", "value": "an uppercase letter follows a shift key or an active caps lock", "browser": "any browser", "source": "W3C UI Events: the shift state is part of the key event that produces the character", "provenance": "measured twice per tool on 2026-08-24 against tools/behavior-lab: Selenium sent 6 shift presses for the 6 capitals in the script, Playwright and Puppeteer sent none at all", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "ja4.chrome", "value": "t13d1516h2_8daaf6152771_806a8c22fdea", "browser": "Chrome", "version": "150 and 151", "platform": "Windows", "source": "own measurement, tools/header-probe (3 runs, 2026-08-12)", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "measured" }, { "id": "ja4.chrome-resumed", "value": "t13d1517h2_8daaf6152771_a87ad97598a9", "browser": "Chrome", "version": "150", "platform": "Windows, resumed session", "source": "own measurement, tools/header-probe (3 runs, 2026-08-12)", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server; second connection of the same browser, session ticket accepted", "capturedAt": "2026-08-12", "staleAfter": "2026-08-26", "confidence": "measured" }, { "id": "ja4.firefox", "value": "t13d1517h2_8daaf6152771_3cbfd9057e0d", "browser": "Firefox", "version": "154", "platform": "Windows", "source": "own measurement, deployed detect-probe (2 runs, 2026-08-18)", "provenance": "Windows 11 desktop, stock Firefox from the vendor installer, a fresh throwaway profile per run, no extensions, no proxy; the handshake was read by our own measurement service from the raw ClientHello ahead of the TLS server, on a real navigation. Both runs byte-identical, and neither carried pre_shared_key — this is a FRESH handshake, not a resumed one", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "measured" }, { "id": "ja4.prefix-shape", "value": "Chrome t13d1516h2 · Firefox t13d1517h2 · Safari iOS t13d2014h2", "browser": "Chrome, Firefox, Safari", "source": "FoxIO JA4 specification (layout) plus the reference values above", "provenance": "Windows 11 desktop, stock Chrome from the vendor installer, fresh profile, no extensions, no proxy; variations seed as shipped (no --disable-features); measured by tools/header-probe reading the raw ClientHello ahead of the TLS server (Chrome); Windows 11 desktop, stock Firefox from the vendor installer, a fresh throwaway profile per run, no extensions, no proxy; the handshake was read by our own measurement service from the raw ClientHello ahead of the TLS server, on a real navigation. Both runs byte-identical, and neither carried pre_shared_key — this is a FRESH handshake, not a resumed one (Firefox); third-party capture libraries (curl_cffi, CycleTLS) that record real browser handshakes; not measured on our own devices, carried as community confidence for that reason (Safari)", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "community" }, { "id": "ja4.safari-ios", "value": "t13d2014h2_a09f3c656075_e42f34c56612", "browser": "Safari", "version": "18.3", "platform": "iOS", "source": "community capture (curl_cffi #530), documented via report 259", "provenance": "third-party capture libraries (curl_cffi, CycleTLS) that record real browser handshakes; not measured on our own devices, carried as community confidence for that reason", "capturedAt": "2026-08-15", "staleAfter": "2026-08-29", "confidence": "community" }, { "id": "key.hold", "value": "116.25 ms", "browser": "human cohort", "source": "Dhakal et al., CHI 2018 (DOI 10.1145/3173574.3174220), n=168,000, collected in the browser: key press to release of the same key; other studies report centers from 77 ms", "provenance": "published aggregate figures only; the raw corpus is licensed for non-commercial use and is never shipped or re-analysed here (PRD DEC-035, step 1)", "capturedAt": "2018-04-21", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "key.interval", "value": "238.66 ms", "browser": "human cohort", "source": "Dhakal et al., CHI 2018 (DOI 10.1145/3173574.3174220), n=168,000, collected in the browser: keydown to keydown", "provenance": "published aggregate figures only; the raw corpus is licensed for non-commercial use and is never shipped or re-analysed here (PRD DEC-035, step 1)", "capturedAt": "2018-04-21", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "key.interval-spread", "value": "0.47", "browser": "human cohort", "source": "Dhakal et al., CHI 2018 (DOI 10.1145/3173574.3174220), n=168,000, collected in the browser: 111.6 ms of spread on a 238.66 ms mean", "provenance": "published aggregate figures only; the raw corpus is licensed for non-commercial use and is never shipped or re-analysed here (PRD DEC-035, step 1). The coefficient is arithmetic on those two published figures", "capturedAt": "2018-04-21", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "language.header-vs-navigator", "value": "Accept-Language and navigator.languages start with the same language", "browser": "any browser", "source": "both are produced from the same language preference of the browser profile", "provenance": "the header is read from the wire by our own measurement service, before any page code runs; the JavaScript value is read in the visitor's browser", "capturedAt": "2026-08-16", "staleAfter": "2026-11-14", "confidence": "published" }, { "id": "language.tag-shape", "value": "every entry is a well-formed BCP-47 tag such as de, de-DE or zh-Hans-CN", "browser": "any browser", "source": "BCP 47: the browser assembles this list from validated locale settings", "provenance": "specification-level guarantee; the list is never free text in an unmodified browser", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "local.ports-reachable", "value": "a page from the web reaches nothing on the machine it is displayed on", "browser": "any browser", "source": "the expectation, not a measurement: loopback belongs to the machine, and a remote page has no business there. Chrome is closing the remaining paths under Local Network Access", "provenance": "measured against two ports that must be closed, so the result is a comparison rather than an absolute timing: without that baseline a slow machine reports everything as open and a fast one nothing", "capturedAt": "2026-08-24", "staleAfter": "2026-11-22", "confidence": "measured" }, { "id": "net.asn", "value": "autonomous system number and name from the routing table", "browser": "not a browser property", "source": "iptoasn.com daily snapshot (public domain), derived from RouteViews BGP data", "provenance": "local copy, refreshed by a scheduled job; never queried at request time", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "net.datacenter", "value": "official provider ranges, network type and reverse DNS agree", "browser": "not a browser property", "source": "published provider ranges (AWS, Google Cloud, Azure, Cloudflare, Oracle, DigitalOcean, Hetzner, OVH)", "provenance": "the providers publish their own ranges as machine-readable files; the verdict names which of the three derivations fired, so the visitor can check it", "capturedAt": "2026-08-16", "staleAfter": "2026-11-14", "confidence": "published" }, { "id": "net.ect-thresholds", "value": "slow-2g from 2010 ms · 2g from 1420 ms · 3g from 272 ms · 4g below that", "browser": "Chromium", "source": "Chromium source: net/nqe/network_quality_estimator_params.h, kHttpRttEffectiveConnectionTypeThresholds; selection loop in net/nqe/network_quality_estimator.cc, GetRecentEffectiveConnectionTypeUsingMetrics", "provenance": "read from the Chromium 150 checkout at ~/projects/chromium-150/src, not from a secondary source; the exposed rtt carries a per-host multiplier of 0.90 to 1.10 (GetRandomMultiplier) on top of the 50 ms rounding, so the comparison keeps a margin for both", "capturedAt": "2026-08-16", "staleAfter": "2027-02-12", "confidence": "published" }, { "id": "net.geo-country", "value": "country from a free IP database, documented error below 1 %", "browser": "not a browser property", "source": "DB-IP Lite / IPinfo Lite country files (CC-BY 4.0), refreshed by a scheduled job", "provenance": "local copies only, no third-party lookup on the request path (PRD AC-L5-001, NG11, C5); country accuracy below 1 % error is the figure all four large free datasets publish for themselves", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "net.tor-list", "value": "the official exit list of the Tor project", "browser": "not a browser property", "source": "check.torproject.org exit-address list, refreshed hourly by a scheduled job", "provenance": "the list is authoritative for its own network; this is the one network verdict that may be stated with certainty", "capturedAt": "2026-08-16", "staleAfter": "2026-11-14", "confidence": "published" }, { "id": "net.vpn-list", "value": "a hit on a known VPN range, and the list is not exhaustive", "browser": "not a browser property", "source": "X4BNet VPN and datacenter lists (MIT), refreshed by a scheduled job", "provenance": "a list hit is stated as a list hit, never as a verdict about the connection; a miss says nothing", "capturedAt": "2026-08-16", "staleAfter": "2026-11-14", "confidence": "community" }, { "id": "os.client-hint", "value": "user agent and client hint name the same system", "browser": "Chromium browsers", "source": "User-Agent Client Hints: the hint derives from the same source as the user agent", "provenance": "specification-level guarantee; both values are produced by the same Chromium code path", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "published" }, { "id": "platform.navigator", "value": "Windows Win32 · macOS MacIntel · Linux Linux x86_64", "browser": "Chrome", "source": "report 260, section C10 (frozen by user-agent reduction)", "provenance": "the value is frozen in the Chromium source since the user-agent reduction; not a per-device measurement", "capturedAt": "2026-08-15", "staleAfter": "2027-02-11", "confidence": "published" }, { "id": "pointer.gap", "value": "17 ms", "browser": "human cohort", "source": "SapiMouse (Antal, Fejer, Buza 2021), n=120, collected in the browser; own analysis, tools/behavior-lab/sapimouse-baseline.mjs: the frame-aligned stream, not the raw one", "provenance": "own re-analysis of the released corpus with the same formulas as the session evaluation, aggregated per subject and then medianed over subjects; written permission from the authors is being sought (PRD DEC-035, step 2) and this caveat is shown next to the figure", "capturedAt": "2026-07-27", "staleAfter": "2031-07-26", "confidence": "measured" }, { "id": "pointer.path", "value": "1.16", "browser": "human cohort", "source": "SapiMouse (Antal, Fejer, Buza 2021), n=120, collected in the browser; own analysis, tools/behavior-lab/sapimouse-baseline.mjs: path divided by beeline", "provenance": "own re-analysis of the released corpus with the same formulas as the session evaluation, aggregated per subject and then medianed over subjects; written permission from the authors is being sought (PRD DEC-035, step 2) and this caveat is shown next to the figure", "capturedAt": "2026-07-27", "staleAfter": "2031-07-26", "confidence": "measured" }, { "id": "pointer.peak-position", "value": "0.5 of the movement duration", "browser": "human arm movement", "source": "Flash & Hogan, Journal of Neuroscience 1985 (5:1688-1703): the minimum-jerk trajectory, derived rather than sampled", "provenance": "a theoretical result, not a cohort. It does not age with a browser version, and the value can be recomputed from the formula instead of looked up. The band is our own tolerance for a discretely sampled path, not a published spread", "capturedAt": "1985-07-01", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "pointer.peak-ratio", "value": "1.875", "browser": "human arm movement", "source": "Flash & Hogan 1985: the ratio follows from the same minimum-jerk trajectory", "provenance": "derived, not sampled. Measured against a path generated from the formula itself in behavior-curves.test.ts; a path interpolated in equal steps yields 1.0 there", "capturedAt": "1985-07-01", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "pointer.reversals", "value": "1.11 per 100 samples", "browser": "human cohort", "source": "SapiMouse (Antal, Fejer, Buza 2021), n=120, collected in the browser; own analysis, tools/behavior-lab/sapimouse-baseline.mjs", "provenance": "own re-analysis of the released corpus with the same formulas as the session evaluation, aggregated per subject and then medianed over subjects; written permission from the authors is being sought (PRD DEC-035, step 2) and this caveat is shown next to the figure", "capturedAt": "2026-07-27", "staleAfter": "2031-07-26", "confidence": "measured" }, { "id": "reading.speed", "value": "238 words per minute", "browser": "adult silent reading, non-fiction", "source": "Brysbaert, Journal of Memory and Language 2019 (DOI 10.1016/j.jml.2019.104047): a meta-analysis of 190 studies, n=18,573", "provenance": "published meta-analysis. It bounds a plausible reading time from below; anything faster than the words on screen allow means the text was not read, which says nothing about whether a person was there", "capturedAt": "2019-08-01", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "reference.axis-availability", "value": "four browser families over the thirty axes of the catalogue", "browser": "Chrome, Firefox, Safari, Safari on iOS", "source": "MDN browser-compat-data 8.0.11 (CC0), field version_added per engine", "provenance": "build step scripts/generate-reference-table.mjs; no device measurement, MDN's own data, read at build time", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "reference.hand-measured", "value": "performance.memory: Chromium yes, Firefox no, WebKit no", "browser": "Chrome, Firefox, Safari, Safari on iOS", "source": "own measurement on the four devices of this project", "provenance": "Windows 11 desktop (Chrome, Firefox), MacBook Air (Safari), iPhone (Safari on iOS); stock profiles, no extensions", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "measured" }, { "id": "screen.avail-vs-total", "value": "availWidth <= width and availHeight <= height", "browser": "any browser", "source": "CSSOM View: availWidth/availHeight describe the area inside the screen, minus system chrome", "provenance": "specification-level guarantee; geometry, not a per-device measurement", "capturedAt": "2026-08-16", "staleAfter": "2031-08-15", "confidence": "published" }, { "id": "screen.dpr-ios", "value": "2 or 3", "browser": "Safari", "platform": "iOS", "source": "Apple hardware: every iPhone since the iPhone 4 ships a 2x or 3x display", "provenance": "device property, not a browser setting; measured on the project's own iPhone and cross-checked against Apple's published display specifications", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "touch.points-vs-pointer", "value": "whatever reports touch points also reports a coarse pointer", "browser": "any browser on a touch device", "source": "Pointer Events and CSS media queries read the same device property", "provenance": "specification-level guarantee; the same lesson this project learned on its own engine, where maxTouchPoints said 10 while ontouchstart and (any-pointer: coarse) said no touchscreen", "capturedAt": "2026-08-15", "staleAfter": "2031-08-14", "confidence": "published" }, { "id": "typing.speed", "value": "51.56 wpm", "browser": "human cohort", "source": "Dhakal et al., CHI 2018 (DOI 10.1145/3173574.3174220), n=168,000, collected in the browser: subgroup range: 20.9 to 89.6 wpm", "provenance": "published aggregate figures only; the raw corpus is licensed for non-commercial use and is never shipped or re-analysed here (PRD DEC-035, step 1)", "capturedAt": "2018-04-21", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "version.feature-floor", "value": "a browser offers what its own engine shipped at or before the claimed version", "browser": "Chrome, Firefox, Safari", "source": "MDN browser-compat-data, field version_added per engine (CC0)", "provenance": "build step scripts/generate-reference-table.mjs; the judgement reads the same generated table the display does", "capturedAt": "2026-08-16", "staleAfter": "2027-08-16", "confidence": "published" }, { "id": "version.ua-vs-hints", "value": "the major version in the user agent equals the one in the brand list", "browser": "Chromium browsers", "source": "User-Agent Client Hints: both strings are produced from the same version constant", "provenance": "specification-level guarantee; cross-checked against engine-fork/patches/19-client-hints.md, which documents the same three-way agreement between JavaScript, HTTP headers and the handshake", "capturedAt": "2026-08-18", "staleAfter": "2026-09-01", "confidence": "published" }, { "id": "voices.origin-rule", "value": "under a Chrome user agent the network voices start with \"Google \"", "browser": "Chrome", "source": "report 261, section C3 (Chromium-vs-Chrome differences)", "provenance": "measured on real Chrome 150 on Windows: 19 network voices, all prefixed \"Google \", localService false, no Microsoft SAPI entry", "capturedAt": "2026-08-15", "staleAfter": "2027-08-15", "confidence": "published" }, { "id": "wire.fetch-metadata", "value": "Sec-Fetch-Site: none, Sec-Fetch-Mode: navigate, Sec-Fetch-Dest: document, Sec-Fetch-User: ?1", "browser": "Chrome, Firefox and Safari", "source": "W3C Fetch Metadata Request Headers: the browser sets these, and a page cannot", "provenance": "read from a real navigation to the measurement host, never from the CORS request the page makes: that one carries different values by design", "capturedAt": "2026-08-24", "staleAfter": "2031-08-23", "confidence": "published" }, { "id": "wire.tcp-timestamps", "value": "Linux and macOS send a timestamp option in the SYN, Windows does not", "browser": "any browser, because this is the kernel and not the browser", "platform": "Windows 11 and WSL2 Linux on the same host", "source": "own packet captures on 2026-08-24: two independent readings per operating system", "provenance": "captured with tcpdump on real interfaces, twice per system on different paths. Windows sent mss-nop-wscale-nop-nop-sackOK both times and no timestamp option; the Linux on the same host sent mss-sackOK-timestamp-nop-wscale both times. Both machines sent TTL 128, which is why no rule here touches the TTL", "capturedAt": "2026-08-24", "staleAfter": "2027-08-24", "confidence": "measured" } ] }