One session replayed an identical pointer trajectory across page loads (record-and-replay bot)
bh.trace_replay_within_session · convicts
What it catches
Within-session BEHAVIORAL coherence — the within-session analog of coordination's cross-session trace_collision, and the INVERSE of the invariant-rotation axis (it catches INVARIANCE of something that must VARY, where the rotation rules catch rotation of something that must stay invariant). trace_hash is the collector's coordinate-quantised pointer-trajectory shape (FNV over rounded x,y; null below a 12-point movement floor, so trivial/no-motion loads emit no hash and cannot collide). A real human NEVER reproduces a path — every page load traces differently — so the SAME non-null trace_hash on >=2 page loads under ONE ks_sid is a record-and-replay bot injecting one canned 'humanised' trajectory (the botright/multilogin pattern, but within a single reused session rather than across a fleet). The detector accumulates per-hash distinct page-load timestamps over the pre-collapse behavioral history in ingest (trace_seen, surviving the latest-per-kind merge collapse) and derives a sticky behavioral.trace_replay when any trace_hash recurs on >=2 timestamps. CATEGORY coherence (convicting), NOT the corroborating behavioral biomech floor: unlike a power-law/straightness threshold (which can fire on real short motion), a byte-identical repeated trajectory is structurally impossible for human hardware, so it convicts without the FP risk that keeps the biomech tells corroborating-only. FP-safe by construction (no real motion repeats byte-for-byte across loads) and browserforge calibration carries no behavioral trace, so promotion cannot raise its legit-browser flag rate. GROUNDED LIVE 2026-06-20: the stealth REPLAY_TRACE + REPLAY_TWICE evader did two page loads in one context (cookie persists) replaying the identical 17-point recorded path; the detector accumulated the one trace_hash on 2 distinct timestamps, derived trace_replay, and the rule fired (label bot). A single-load REPLAY_TRACE (one trace_hash) and the human-mouse / varied-motion modes (distinct trace per load) do NOT fire it — zero FP. Residual: a bot that VARIES its replayed path per page load defeats this (distinct trace_hash) — but varied motion is exactly what the biomech floor + coalesced ladder already pressure, so the record-and-replay shortcut is closed without opening a gap. Complements the within-session network/browser rotation rules: this is the behavioral-layer member of the within-session-coherence axis.
Signals it reads
behavioral.trace_replay
How it fires
present
Evaders it caught 1
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.