window.Worker absent while the collector runs — the Worker realm was stripped to hide from divergence guards
br.worker_removed · convicts
What it catches
The escalation guard BEYOND br.worker_constructor_tampered, closing the last exit on the realm-coherence family. The worker-divergence rules (webgl/canvas/timezone/languages/deviceMemory/uadata_worker_divergence) all observe a Web Worker and EXPLICITLY skip when the worker value is missing ('missing → never fires', 'fires only when the WORKER actually exposes it') — FP-safe, but it means a tool that DELETES window.Worker entirely (rather than WRAPPING it, WORKER_WRAP → caught by ctorTampered invariant 1, or PROXYING it, WORKER_PROXY → caught by invariant 2) presents NO worker value to any of them, so they all stay silent; and ctorTampered itself guards typeof c !== 'function' and skips an absent ctor. So DELETE-the-Worker was a clean EVADES on the entire worker-realm surface. This rule closes it: the collector emits worker_removed when typeof self.Worker !== 'function' WHILE THE COLLECTOR IS EXECUTING. FP-SAFE BY CONSTRUCTION: every real browser since ~2012 (Chrome/Firefox/Safari/Edge, desktop AND mobile) exposes a native, callable window.Worker; a client that ran the collector's main-thread JS yet has no window.Worker deliberately stripped it to hide the worker realm — no real browser lacks it. Extensions run in isolated worlds and do not delete page globals; a legit CDP session does not remove Worker. Convicting (w0.8 — a stripped realm-execution primitive is a hard tamper). COMPLETES the escalation ladder with no residual exit: main-thread patch → br.*_worker_divergence; WORKER_WRAP (plain wrap) → br.worker_constructor_tampered (invariant 1); WORKER_PROXY (Proxy over native) → br.worker_constructor_tampered (invariant 2); WORKER_DISABLE (delete the ctor) → br.worker_removed. GROUNDED LIVE: a stealth WORKER_DISABLE run (deletes window.Worker before the collector spawns its worker) trips worker_removed while real Chromium + plain STEALTH (native Worker present) do NOT.
Signals it reads
browser.worker_removed
How it fires
present
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.