getBoundingClientRect is non-deterministic or disagrees with getClientRects — geometry shim
br.domrect_invariant · convicts
What it catches
On a real engine getBoundingClientRect is DETERMINISTIC: two reads of an unchanged element are byte-identical (pages depend on it). A per-call DOMRect-noise shim breaks that. FP-safe: determinism is a hard invariant no real browser (incl. farblers, which use stable per-session offsets) violates. Ref CreepJS domrect. v0.74.22 FIRST LIVE POSITIVE: the stealth DOMRECT_SPOOF=1 evader (per-call sub-pixel noise on getBoundingClientRect) tripped it through the live edge+detector. NEGATIVE: a plain STEALTH=1 run does NOT trip it, and zero of the committed real/fleet captures do. v0.74.x FP FIX: the second arm — getClientRects()[0] == getBoundingClientRect() consistency at 1e-6 — was REMOVED. It false-positived real Safari on Retina (devicePixelRatio>=2 rounds the two geometry paths to sub-pixel-different values, a legitimate engine difference, not a shim), and no evader ever exercised it (DOMRECT_SPOOF trips determinism, not consistency), so dropping it loses no grounded coverage while clearing the Safari FP.
Signals it reads
browser.domrect_invariant_violated
How it fires
present
Evaders it caught 1
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.