Constant SENSOR_SCRIPT 

pub const SENSOR_SCRIPT: &str = r#"(function () {
  try {
    if (window.__meridian_signals__ && window.__meridian_signals__.__installed) return;
    var CAP = 300, SNIP = 512;
    var P = Array.prototype.push, slice = Function.prototype.call.bind(Array.prototype.slice);
    var S = { __installed: true, sinks: [], console: [], errors: [], csp: [], postmessage: [] };
    try { Object.defineProperty(window, "__meridian_signals__", { value: S, writable: true, enumerable: false, configurable: true }); }
    catch (e) { window.__meridian_signals__ = S; }
    var now = function () { try { return Date.now(); } catch (e) { return 0; } };
    var snip = function (v) {
      try {
        var s = typeof v === "string" ? v : (function () { try { return JSON.stringify(v); } catch (e) { return String(v); } })();
        if (s == null) return "";
        return s.length > SNIP ? s.slice(0, SNIP) + "…" : s;
      } catch (e) { return ""; }
    };
    var stack = function () { try { return (new Error().stack || "").split("\n").slice(2, 8).join("\n"); } catch (e) { return ""; } };
    var rec = function (bucket, entry) {
      try { entry.ts = now(); P.call(bucket, entry); if (bucket.length > CAP) bucket.splice(0, bucket.length - CAP); } catch (e) {}
    };

    // ---- DOM-XSS sinks -----------------------------------------------------
    var hookSetter = function (proto, prop, sink) {
      try {
        var d = Object.getOwnPropertyDescriptor(proto, prop);
        if (!d || !d.set) return;
        var orig = d.set;
        Object.defineProperty(proto, prop, {
          configurable: true, enumerable: d.enumerable, get: d.get,
          set: function (val) { rec(S.sinks, { sink: sink, tag: (this && this.tagName) || "", value: snip(val), stack: stack() }); return orig.call(this, val); }
        });
      } catch (e) {}
    };
    hookSetter(Element.prototype, "innerHTML", "innerHTML");
    hookSetter(Element.prototype, "outerHTML", "outerHTML");
    try {
      var iah = Element.prototype.insertAdjacentHTML;
      Element.prototype.insertAdjacentHTML = function (pos, html) { rec(S.sinks, { sink: "insertAdjacentHTML", tag: (this && this.tagName) || "", value: snip(html), stack: stack() }); return iah.apply(this, arguments); };
    } catch (e) {}
    try {
      var dw = document.write;
      document.write = function () { rec(S.sinks, { sink: "document.write", value: snip(slice(arguments).join("")), stack: stack() }); return dw.apply(this, arguments); };
    } catch (e) {}
    try {
      var ev = window.eval;
      window.eval = function (code) { rec(S.sinks, { sink: "eval", value: snip(code), stack: stack() }); return ev.apply(this, arguments); };
    } catch (e) {}
    try {
      var setAttr = Element.prototype.setAttribute;
      Element.prototype.setAttribute = function (name, value) {
        try { var n = ("" + name).toLowerCase(); if (n.indexOf("on") === 0 || ((n === "src" || n === "href") && /^\s*javascript:/i.test("" + value))) rec(S.sinks, { sink: "setAttribute:" + n, tag: (this && this.tagName) || "", value: snip(value), stack: stack() }); } catch (e) {}
        return setAttr.apply(this, arguments);
      };
    } catch (e) {}
    try {
      var sd = Object.getOwnPropertyDescriptor(HTMLScriptElement.prototype, "src");
      if (sd && sd.set) { var so = sd.set; Object.defineProperty(HTMLScriptElement.prototype, "src", { configurable: true, get: sd.get, set: function (u) { rec(S.sinks, { sink: "script.src", value: snip(u), stack: stack() }); return so.call(this, u); } }); }
    } catch (e) {}

    // ---- console -----------------------------------------------------------
    try {
      ["log", "info", "warn", "error", "debug"].forEach(function (level) {
        var orig = console[level];
        if (typeof orig !== "function") return;
        console[level] = function () { try { rec(S.console, { level: level, text: snip(slice(arguments).map(function (a) { return typeof a === "string" ? a : snip(a); }).join(" ")) }); } catch (e) {} return orig.apply(this, arguments); };
      });
    } catch (e) {}

    // ---- uncaught errors + rejections -------------------------------------
    try { window.addEventListener("error", function (e) { rec(S.errors, { kind: "error", message: snip(e && e.message), filename: (e && e.filename) || "", line: (e && e.lineno) || 0, col: (e && e.colno) || 0, stack: snip(e && e.error && e.error.stack) }); }, true); } catch (e) {}
    try { window.addEventListener("unhandledrejection", function (e) { rec(S.errors, { kind: "unhandledrejection", message: snip(e && e.reason && (e.reason.message || e.reason)) }); }, true); } catch (e) {}

    // ---- CSP violations ----------------------------------------------------
    try { document.addEventListener("securitypolicyviolation", function (e) { rec(S.csp, { directive: (e && e.violatedDirective) || "", blocked: (e && e.blockedURI) || "", source: (e && e.sourceFile) || "", line: (e && e.lineNumber) || 0, sample: snip(e && e.sample) }); }, true); } catch (e) {}

    // ---- inbound postMessage ----------------------------------------------
    try { window.addEventListener("message", function (e) { rec(S.postmessage, { origin: (e && e.origin) || "", data: snip(e && e.data) }); }, true); } catch (e) {}
  } catch (e) {}
  return true;
})()"#;

The sensor install script — an idempotent IIFE so the SAME source is valid both as a preload body and as a one-shot evaluate expression.

Records into a non-enumerable window.__meridian_signals__ with slices: sinks (DOM-XSS), console, errors (uncaught + rejections), csp (violations), postmessage (inbound). Each entry carries a short value snippet and, where available, a JS stack so the agent can locate the source.