# Capture upgrade — 14 October 2026 The user explicitly authorized a dedicated local research browser to repair the built-in collector's validated gaps. This extension preserves the original study and does not convert its old non-detections into new observations. ## Environment and capture Google Chrome 155.0.8059.39, headless, Playwright 1.62.1, mitmproxy 12.2.3. Each measured form visit uses a new non-persistent browser context with zero initial cookies, en-US locale, UTC time zone, and 1360×900 viewport. No personal profile is opened. Service workers remain allowed. Chrome runs with its sandbox; minimal explicit launch flags avoid Playwright's usual browser behavior switches. Two collectors operate independently: Playwright BrowserContext request/response and failure events, and a loopback-only HTTPS capture proxy. The proxy records URL, method, raw request bytes, timestamps, flow ID, response status and errors. It omits request headers, cookies and response bodies. It observes research-browser traffic only, not the desktop Proton app or unrelated browsers. Its CA's public-key hash is trusted only through a flag on this temporary browser process; no system or personal-browser certificate store is modified. Upstream public-site certificate verification stays enabled. QUIC was not explicitly tested; no completeness claim is made for every transport or browser API. The local fixture has independent receiver logs. HTTP and HTTPS rounds validate raw/query/JSON, base64, SHA-256, masked and negative controls; dedicated workers; service workers; a truly cross-site iframe verified as a separate iframe target; and pagehide beacons on navigation AND tab closure. The proxy receives exactly the receiver's probe paths and payload bytes. In both final rounds it captures 17 of 17 probe requests, including two departure beacons. Context events capture 15 of 17, missing both beacons. Seeded cookies, localStorage and sessionStorage are absent in a fresh context. These are tested mechanisms, not proof of universal coverage. HTTP validation preceded the live visits; an additional exact-byte HTTP check and HTTPS fixture validation followed. The HTTPS fixture uses a locally generated self-signed test certificate, trusted upstream only by a separate fixture proxy on 8795; live sites use the standard-verifying proxy on 8794. Both use the same capture add-on. An initial proxy launch attempt raced its readiness and failed; the later HTTPS validation passed. The first context-only prototype failed and is retained in fixture-context-only-failure.json. HTTP final validation uses an HTTP child frame; the current HTTPS fixture version uses an HTTPS child frame. ## Visits and actions Reconnaissance revisited all ten original routes without entering data. Five originally accessible non-positive surfaces and Dealroom were selected for field entry; Cisco was now measurable because child-frame coverage had been validated. Eight field-entry contexts were retained; seven are included: replacement Plaid, Cvent, Adobe, Secret Shopper, Cisco; Dealroom untouched; Dealroom refusal. Selectors were taken from actual visible forms before use. SGS was access-denied; Walmart and Expedia presented human/bot barriers; Spotify retained its account-based route. No barrier was solved or bypassed. Dealroom's automatic page verification resolved without interacting with a challenge. Use unique fpt-…@example.com markers and invented names only. Type characters at 70 ms intervals, Tab out, retain at least 60 seconds after the final recorded UI action, save original screenshots/DOM, then navigate to about:blank and retain capture for five seconds before closing the context. Dealroom's removal category is selected; the required LinkedIn field stays empty. Its refusal visit clicks the observed analytics Reject control. Secret Shopper's Decline control dismisses the cookie overlay. Adobe country and validation action remain untouched; Cvent controller authorization remains unchecked; Cisco's role/country/request category and account/service choice remain incomplete. The first Plaid visit is exploratory because its banner obscured entered fields in the saved screenshot. Its replacement opens Manage, chooses No for functional and advertising collection, saves, and verifies the preferences dialog disappeared before field entry. An exact-text Manage selector and a radio selector based on visible No text failed in consent-only explorations; no identifiers were entered in those failed attempts. Inspecting input markup showed that the accessible names were Disallow functional tracking and Disallow advertising tracking, with value=false. The replacement used those observed input names/values. No form, CAPTCHA, email verification, privacy request or login is submitted. Cookie clicks are specific consent controls. ## Analysis and wording Match full emails in URL-decoded/raw payloads, base64, SHA-256, SHA-1 and MD5; inspect available gzip/zlib/Brotli request bodies. Also search the unique email local part and raw synthetic name markers. Export destination host/path and query KEYS, not raw query values. Match response status to proxy flow ID, and retain body hashes. A proxy timestamp is observation at the local proxy, not provider processing time. HTTP 200 supports a returned response, not storage, validation success or retention. Two Dealroom full-email POSTs to /emailcheck/v1/json-ext have HTTP 200 responses and independent browser matches. No name marker was detected. Five other new visits have no detectable email or local-part transmission during the measured windows; report this as bounded non-detection, not a safety or compliance certification. Unknown transformations, encrypted application payloads, untested transports, later workflow steps and downstream processing remain outside scope. The HTTPS proxy/headless environment can change site behavior; these visits are a separate condition from the original built-in study, not a randomized causal comparison. No VPN route or verified geographic comparison is used. The proposed 40-company study remains incomplete; this work repairs capture and reruns the affected pilot. ## Primary technical documentation - https://playwright.dev/docs/api/class-browsercontext - https://playwright.dev/python/docs/service-workers - https://docs.mitmproxy.org/stable/concepts/certificates/ - https://docs.mitmproxy.org/stable/api/mitmproxy/http.html The documented APIs guide implementation; receiver-side tests establish actual coverage in this environment. Private originals, tokens, CA keys, environment and unreviewed screenshots must not be distributed as public research data.