{
  "method": {
    "what": "HerePDF's own Merge, run by the script built to measure whether online PDF tools upload a file (docs/superpowers/specs/2026-10-17-network-study-design.md). No other tool has been run, and this file says nothing about any other tool.",
    "markerLength": 24,
    "files": "two one-page PDFs built fresh for the run, each with a random 24-character marker written in the page text, in the Info title and in a plain comment line, and about 60 KB of padding",
    "run": "a fresh Chromium with no cookies or storage, a 1280 by 800 window, the page loaded and left quiet for 5 seconds, the cookie banner declined with its own Decline button, both files chosen, the page's own Merge button pressed, and the download checked to be a two-page PDF holding both markers",
    "recorded": "every request at browser level through the DevTools Fetch domain, with request bodies including file parts (Playwright's own request API reports a file upload as an empty body), and every WebSocket frame sent",
    "detectors": "'marker found': a request or frame body, as it is or URL-decoded, base64-decoded or gunzip/inflate-decoded, holds one of the run's markers. 'bytes match': the bytes sent in non-GET requests to one host after the files were chosen add up to at least the size of the two files",
    "positiveControls": [
      "a multipart form upload",
      "base64 in a JSON body",
      "an upload made from a Web Worker",
      "an upload made from a frame on another site",
      "binary WebSocket frames"
    ],
    "positiveControlsRule": "each of these, sent by a small local server the same script is pointed at, is reported as an upload by the marker detector; a detector never seen to say yes proves nothing when it says no (e2e/network-study.spec.js)",
    "limits": "one browser (Chromium), one anonymous flow, one day, and one run each on the built site and on the live site, not the three runs on three days the full study asks for. Seeing no request carry the files is evidence for that run, not proof that no copy was ever made, and says nothing about any other site",
    "browser": "Chromium 156.0.8078.4",
    "commit": "2d77922"
  },
  "runs": [
    {
      "where": "the built site, served locally",
      "day": "2026-10-29",
      "completed": true,
      "fileContentsSent": false,
      "bytesMatch": false,
      "markerFound": false,
      "cookieBannerDeclined": true,
      "hostsBeforeAFile": {
        "own": 1,
        "storage": 0,
        "advertising": 2,
        "other": 0
      },
      "hostsAfter": {
        "own": 1,
        "storage": 0,
        "advertising": 0,
        "other": 0
      },
      "requestsAfterAFile": 1,
      "bytesSentAfterAFile": 0
    },
    {
      "where": "herepdf.app, live",
      "day": "2026-10-29",
      "completed": true,
      "fileContentsSent": false,
      "bytesMatch": false,
      "markerFound": false,
      "cookieBannerDeclined": true,
      "hostsBeforeAFile": {
        "own": 1,
        "storage": 0,
        "advertising": 2,
        "other": 0
      },
      "hostsAfter": {
        "own": 1,
        "storage": 0,
        "advertising": 0,
        "other": 0
      },
      "requestsAfterAFile": 1,
      "bytesSentAfterAFile": 0
    }
  ]
}