navigator.language disagrees with navigator.languages[0] (spec-invariant violation)
br.language_vs_languages · convicts
What it catches
The self-contained, no-Worker language analog of timezone_offset_vs_intl. The HTML standard defines navigator.language as navigator.languages[0], so on EVERY real browser they are identical — there is no legitimate way to make them differ. A residential-proxy / geo locale spoof that Object.defineProperty's navigator.language to the proxy's country but forgets navigator.languages (or vice versa) breaks the invariant. The collector fires only when both are present and differ. FP-safe ACTIVE by spec (a real browser cannot disagree — unlike languages_worker_vs_main, this needs no Worker and is not tripped by a legit CDP locale override, which sets both fields together); convicting coherence. Catches the naive JS locale spoof that the worker-divergence and HTTP-Accept-Language checks may miss when only one main-realm field was patched.
Signals it reads
browser.language_list_incoherent
How it fires
present
Evaders it caught 1
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.