Did anyone actually read itDid anyone actually read it

A small beacon reports the four things only the page knows: how long it was visible, whether anyone touched it, which path, and the referrer. Device class, operating system and browser are derived by the worker from headers it observed.

That split is a security property rather than a style. The beacon runs inside a page the platform did not write, so every field it could assert is a field it could forge — a client that can name its own country can name a hundred of them.

The visitor’s address is the sharpest edge in the exchange, and it is never stored. It goes into a hash and out of scope in the same expression. Nothing returns it, logs it or keeps it.

It is the tab an artifact opens on: views over 30 days with a daily trend, readers, named readers, the peak day, and a ledger of every session — who, when, which version, and from which path, device, country and browser.

Faults thrown in a visitor’s browser are recorded too, though no screen shows them yet.