Reverse once, run forever: designing client-side defenses that assume the attacker has already read every line (opens in new tab)

There's a sentence every engineer in this field eventually says out loud, usually with a sigh: "But the code is right there in their browser." It is. That's the whole problem, and pretending otherwise is how most bot defenses quietly fail. Anything we ship to detect automation runs inside an environment the attacker owns completely: their CPU, their debugger, their clock, their unlimited patience. They can set a breakpoint anywhere. They can run our logic ten thousand times and diff the outpu...