WEB / WEB-10.06

Observing with Developer Tools

Network, DOM, Console, and Storage expose different evidence. Bound observations by request, context, and capture time.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Observe HTTP 404

Capture started
Observation recording starts before the action with top context and the public-note filter.
Page / Duru
DOM Loading; request ready
Origin
No request
Observation view
Recording; no row yet
Client state
theme dark; no result
GET arrival
The origin receives harmless GET /notes/missing while the browser result remains pending.
Page / Duru
DOM Loading; pending
Origin
GET received
Observation view
Recording; request visible
Client state
theme dark; result pending
404 prepared
The origin prepares a normal 404 response with Not found content rather than a network error.
Page / Duru
DOM Loading; pending
Origin
404 Not found ready
Observation view
Recording; status pending
Client state
theme dark; result pending
Response arrival
The 404 and complete harmless content arrive at the page with status404 and okfalse.
Page / Duru
Response404; Not found received
Origin
404 delivered
Observation view
Recording; response available
Client state
theme dark; body read pending
Local DOM/log
The page consumes content, sets DOM to Not found, and emits its application request completed message.
Page / Duru
DOM Not found
Origin
Exchange complete
Observation view
404 row available
Client state
theme dark; application log completed
Cross-surface check
Observation records original Loading HTML, live Not found DOM, and 404 fields together.
Page / Duru
DOM Not found
Origin
No new mutation
Observation view
HTML≠DOM; status404; initiator script
Client state
Log completed ≠ HTTP200
Bounded conclusion
TTFB is not a server DB duration; request completion proves neither business success nor permission.
Page / Duru
Missing note shown
Origin
Internal durations unobserved
Observation view
Evidence bounded; no fake ms
Client state
theme dark; no backend authority

Local DOM edit

Observed state
Supplied previous response HTML is Loading, live DOM is Not found, and originTitle is Atlas note.
Page / Duru
DOM Not found
Origin
Title Atlas note
Observation view
HTML Loading; current DOM Not found
Client state
theme dark
Local text edit
A harmless local edit sets active document result text to Preview without sending a request.
Page / Duru
DOM Preview
Origin
Title Atlas note
Observation view
Previous observation retained
Client state
theme dark
Elements view
The Elements-equivalent observation reads active DOM Preview while response HTML remains unchanged.
Page / Duru
DOM Preview
Origin
Title Atlas note
Observation view
DOM Preview; original HTML Loading
Client state
theme dark
Storage view
Selected-origin storage contains theme dark and does not become a server session store.
Page / Duru
DOM Preview
Origin
Title Atlas note
Observation view
Client storage observed
Client state
theme dark; server session unobserved
Compare ownership
There is no exchange supporting a server mutation claim from local DOM evidence; the authoritative title stays unchanged.
Page / Duru
DOM Preview
Origin
Title Atlas note
Observation view
No server mutation evidence
Client state
Client-only state
Bounded conclusion
Observation concludes a local presentation change, without proving backend permission or mutation.
Page / Duru
DOM Preview
Origin
Title Atlas note
Observation view
Local edit only; server claim false
Client state
Client-only state

Late recording

Recording off
Selected Network capture is off before the action; its later table cannot reconstruct history.
Page / Duru
GET public note ready
Origin
No request
Observation view
Recording off; empty
Client state
Result pending
GET arrival
The origin receives the harmless public-note GET while the selected observation table does not collect it.
Page / Duru
Waiting response
Origin
GET received
Observation view
Recording off; empty
Client state
Result pending
Response arrival
The normal public response200 reaches the page while selected capture remains off.
Page / Duru
Response200 public note
Origin
Response delivered
Observation view
Recording off; empty
Client state
Result available
Late capture starts
Observation starts recording now; no captured request row is produced for the previous exchange.
Page / Duru
Public note shown
Origin
Exchange complete
Observation view
Recording on; prior row absent
Client state
Result available
Missing evidence
An empty table does not prove no earlier request occurred; this branch has an explicit capture gap.
Page / Duru
Public note shown
Origin
Historical GET occurred
Observation view
Historical request unobserved
Client state
No no-request proof
Scope recorded
The report marks this action network evidence missing; a new measurement cannot alter the old capture retroactively.
Page / Duru
Public note shown
Origin
Historical GET occurred
Observation view
Capture gap documented
Client state
No compromise claim

ACTORS · STATE · DATA FLOW

Start with the capture contract

Developer Tools is an observation instrument rather than an automatic judgment of application correctness or vulnerabilities. Network displays requests made while the panel is open and recording. Open it before the action and record capture/filter choices; make Preserve log explicit when retaining a navigation chain. Opening it afterward and seeing an empty table does not prove no request occurred. Cached or Service Worker responses can appear too; not every row represents a new origin round trip.

Read method, target, status, headers, and content separately. HTTP404 can coexist with fulfilled Fetch. The artifact GET /notes/missing yields HTTP404/body Not found while the client can log request completed. An Initiator can explain parser, script, or request relationships, not a business identity or permission decision. Its stack trace concerns request initiation, not the internal server call chain.

Do not reduce Timing phases to one undifferentiated duration. Queueing/Stalled can involve browser scheduling, DNS/connect the initial connection, and Waiting (TTFB) round-trip plus server response preparation. TTFB is not merely database duration; Content Download can involve network and browser-consumption conditions. Reuse or caching can leave phases absent. This example invents no millisecond values and separates observed phases from unmeasured server duration.

Response HTML and live DOM are different artifacts

Elements shows the active DOM tree. Response HTML is initial content; parsing constructs the tree and scripts can later change nodes or text. In the artifact, p#result begins as Loading and becomes Not found after the client reads 404 content. This does not prove the server later rewrote its HTML. Correlate document response content or View Source separately with live Elements, capture time, and the same navigation.

Console has a selected JavaScript context; the top document and iframe can differ. Filtered messages are not a complete trace. An application request completed log is an application statement, not a substitute for status or server audit evidence. Locally changing DOM text to Preview changes this document presentation; a server-mutation claim needs a real exchange and server behavior.

Application/Storage lets you inspect the selected origin localStorage key/value pairs and Cache Storage entries. These are not a server session store. Local theme=dark proves neither identity/tenant permission nor response authorization. Cache Storage inspection is not the browser HTTP-cache management table; refresh state and displayed resource content depend on observation time. Do not label old onscreen state as current backend state.

Evidence scope and sensitive fields

HAR exports captured exchanges through a defined JSON format. Chrome default sanitized export excludes headers such as Cookie, Set-Cookie, and Authorization. This does not guarantee every URL query, request/response body, or application identifier is anonymized. Review shared content separately and retain only necessary bounded observations.

This bundle is not a real HAR; it is an inert projection of benign request, selected DOM, and storage observations. It retains only a public path and harmless text; excludedHeaderNames lists omitted field types. Capture gaps remain explicit. Reading an export cannot restore exchanges that were unobserved during capture. When comparing browser-instrumentation fields with a filtered panel view, preserve which observations were actually collected.

Read every scenario without motion

Local DOM

Original response was separated from current DOM
Original HTML has result text Loading; after script it is Not found; local editing changes it to Preview. These snapshots belong to different stages. Current serialization is not original response bytes.
Browser observation bundle
Source Loading / script Not found / local Preview
Provenance/privacy gate
Review pending
Server/evidence boundary
No verdict
A local edit was not server-mutation evidence
serverTitleBefore and serverTitleAfterLocalEdit remain Atlas note with serverMutationObserved false. Elements shows client presentation. Treating a local UI edit as an authoritative object update creates the wrong boundary.
Browser observation bundle
Source Loading / script Not found / local Preview
Provenance/privacy gate
Server Atlas note unchanged / mutation false
Server/evidence boundary
No verdict
A client preference was not backend authority
localStorage has theme dark while serverSessionStoreObserved is false. A preference field is not a role, session or resource grant. Cache Storage observations likewise are not evidence of the HTTP-cache engine.
Browser observation bundle
Source Loading / script Not found / local Preview
Provenance/privacy gate
Server Atlas note unchanged / mutation false
Server/evidence boundary
Theme dark / server session unobserved
The completed log was compared with HTTP status
The application writes request completed to Console, but GET /notes/missing has status 404 and ok false. The fulfilled Response shows why the label is not HTTP-200 evidence. Selected context is top.
Browser observation bundle
Application log completed / HTTP404 ok=false
Provenance/privacy gate
Server Atlas note unchanged / mutation false
Server/evidence boundary
Theme dark / server session unobserved
The provenance oracle used normal and positive controls
Normal XML has serverMutationClaim false for local-dom evidence and count zero; positive XML has true and count one. The rule selects incorrect server inference from local edits; it is not a real log schema.
Browser observation bundle
Application log completed / HTTP404 ok=false
Provenance/privacy gate
Normal inference count0 / positive count1
Server/evidence boundary
Theme dark / server session unobserved
Control tied original sources to observed effects
Response, active DOM, application outcomes and authoritative server state remain separate. The inert bundle is neither actual DevTools UI nor a full HAR capture. Server changes require scoped server evidence; local Preview is insufficient.
Browser observation bundle
Application log completed / HTTP404 ok=false
Provenance/privacy gate
Normal inference count0 / positive count1
Server/evidence boundary
Local effect known / authority requires server evidence

Export scope

Minimal sharing was separated from full HAR
Sharing uses a minimal observation projection, excluding Cookie, Set-Cookie and Authorization. retainedQuery is none and the body only public Not found. This selected bundle is not an export of a real user journey.
Browser observation bundle
Minimal public projection / credential headers excluded
Provenance/privacy gate
Review pending
Server/evidence boundary
No verdict
Header filtering was not full anonymization
fullAnonymizationProven is false. Removing headers does not generally prove absence of sensitive data in queries or bodies. Export scope and field inspection are separate controls; a filtered table may not cover the whole journey.
Browser observation bundle
Minimal public projection / credential headers excluded
Provenance/privacy gate
Header filtering only / anonymization not proven
Server/evidence boundary
No verdict
Sharing needs were separated from authority decisions
An observation bundle transfers data to another reader, so only needed fields are selected. Accounts and private responses are outside this public fixture. Excluded fields here do not establish safety of all future captures.
Browser observation bundle
Minimal public projection / credential headers excluded
Provenance/privacy gate
Header filtering only / anonymization not proven
Server/evidence boundary
Share only scoped fields / future captures need review
Timing-phase names did not carry a cause verdict
Phase names are Waiting (TTFB) and Content Download, with inventedDurationMs null and serverDatabaseDurationKnown false. TTFB is not slow-database proof. Initiator script supplies no trusted actor identity.
Browser observation bundle
Timing names only / DB duration unknown
Provenance/privacy gate
Header filtering only / anonymization not proven
Server/evidence boundary
Share only scoped fields / future captures need review
Observations and hypotheses remained separate
Script initiation is browser provenance; a database cause is another hypothesis. Unobserved durations or server processes are not added. Causal review needs separate authorized application/server evidence.
Browser observation bundle
Timing names only / DB duration unknown
Provenance/privacy gate
Browser initiation known / server cause separate
Server/evidence boundary
Share only scoped fields / future captures need review
Privacy verdicts stayed within the bounded projection
The bundle uses public placeholders and selected exclusions without measuring actual HAR format/export or complete anonymization. Sharing review keeps capture scope and required fields explicit instead of claiming a full journey.
Browser observation bundle
Timing names only / DB duration unknown
Provenance/privacy gate
Browser initiation known / server cause separate
Server/evidence boundary
Minimal projection scoped / full HAR unmeasured

ASSUMPTION · BOUNDARY · CONTROL

Do not treat visible state as authority

Treating local DOM text or a storage value as backend permission exceeds observation boundaries. A node labeled Preview can change presentation, but an ordinary client edit does not prove a server object changed. The condition is confusing local presentation with authoritative state; impact depends on the application decision that uses it. This lesson creates no server-policy bypass experiment.

A quiet or green-looking Console does not establish request success. Logger behavior, filters, selected context, and capture time can exclude events. Reading 404, fulfilled Fetch, and result text together reveals what a completed log actually says. Correlate original response, active DOM, and application outcome with the request/navigation identity while leaving missing evidence explicit.

Export creates a new data-sharing boundary

Interpreting sanitized HAR header filtering as complete content privacy can accidentally share sensitive application data remaining in queries or bodies. Export from a filtered table may also omit part of the journey. The condition is skipping scope and field inspection. Here only a public-note path and harmless text are shared, with no credentials, cookies, or account data captured.

Inferring unseen server behavior from Timing or Initiator can create an incorrect incident narrative. TTFB alone does not prove a slow database; a script initiator does not prove a trusted business actor. Separate measured phases from hypotheses, obtaining authorized application/server evidence separately if needed. Rather than declaring observation failure a compromise, record which fields actually exist.

Read every scenario without motion

Correlated review

Capture scope was selected before the action
This bundle is an authored observation projection, not a new DevTools capture. Its Network row represents browser request/response observation, Elements current DOM, Console an application logger, and theme origin-scoped localStorage. In capture-gap, a displayed result does not establish a late panel recorded the earlier request; the server session store remains unobserved. openedBeforeAction and recording are true with context top and filter public-note. Preserve log is supplied as false. Visible rows do not represent all historical exchanges unless scope is known.
Capture observations
Before action / recording / top / public-note
Correlation review
Review pending
Evidence conclusion
No verdict
The Network row retained one exchange’s fields
GET /notes/missing has status 404, body Not found and bodyComplete true. Initiator script and fulfilled Response are separate fields. Complete body consumption can coexist with HTTP acceptance ok false.
Capture observations
Before action / recording / top / public-note
Correlation review
GET missing / 404 / complete Not found
Evidence conclusion
No verdict
Elements and Console were not one success event
Live DOM shows Not found while Console shows request completed, authored by the application. Local Preview is another edit. Context top does not represent frame logs. UI text and log labels do not replace network status.
Capture observations
DOM Not found / application completed log / local Preview
Correlation review
GET missing / 404 / complete Not found
Evidence conclusion
No verdict
Storage records were separated from authoritative server records
Theme dark is a client preference; serverTitle Atlas note is retained with server mutation false. Storage originAlias is local-fixture-origin. Deleting another context’s storage is not automatically a server fix.
Capture observations
DOM Not found / application completed log / local Preview
Correlation review
Client theme dark / authoritative title unchanged
Evidence conclusion
No verdict
The result retained the smallest evidence scope
Public GET 404, local DOM updates and a client preference are known. Backend sessions and DB duration are unknown. The synthetic projection teaches surface differences without being a complete DevTools-panel or HAR-export test.
Capture observations
DOM Not found / application completed log / local Preview
Correlation review
Client theme dark / authoritative title unchanged
Evidence conclusion
Exchange/client effects known / backend scope unknown
Reproducibility fields retained minimal scope
Review records method/path/status, capture start, filter/context and bodyComplete without full queries, cookies or private bodies. A new observation in another selected context requires renewed correlation.
Capture observations
DOM Not found / application completed log / local Preview
Correlation review
Client theme dark / authoritative title unchanged
Evidence conclusion
Retain scoped capture/context/status/body state

Late capture

Recording start was separated from historical action
This bundle is an authored observation projection, not a new DevTools capture. Its Network row represents browser request/response observation, Elements current DOM, Console an application logger, and theme origin-scoped localStorage. In capture-gap, a displayed result does not establish a late panel recorded the earlier request; the server session store remains unobserved. captureGap has openedBeforeAction false and visibleRequestRows 0. An empty table may omit exchanges before capture began. Zero rows are not equivalent to an observed absence of requests.
Capture observations
Late capture / visible rows0
Correlation review
Review pending
Evidence conclusion
No verdict
Filters and context retained their coverage role
Recording time, selected context and filters affect historical-request coverage. An absent event yields neither a guessed network failure nor successful no-op. Before-action records do not fill a new trace’s gap.
Capture observations
Late capture / visible rows0
Correlation review
Historical coverage incomplete
Evidence conclusion
No verdict
A DOM result did not create a missing network event
Not found or Preview may appear in local DOM. Their source exchange cannot be conclusively identified without the missing network observation. Current DOM does not supply complete original-response provenance.
Capture observations
DOM text exists / historical exchange source unknown
Correlation review
Historical coverage incomplete
Evidence conclusion
No verdict
A new capture was not historical evidence
Observing the benign action again creates a new exchange rather than reconstructing an old missing event. Source/version and action identity remain distinct. New results are not written as exact measurements of the previous unknown outcome.
Capture observations
DOM text exists / historical exchange source unknown
Correlation review
New capture ≠ reconstructed historical event
Evidence conclusion
No verdict
Historical-request verdicts remained unknown
Historical exchanges remain unobserved in this late capture. No-request, successful-response and compromise conclusions are withheld. Missing rows may reflect capture policy, but no cause is selected without evidence.
Capture observations
DOM text exists / historical exchange source unknown
Correlation review
New capture ≠ reconstructed historical event
Evidence conclusion
UNKNOWN: historical exchange
New evidence was tied to the capture contract
Further review needs scoped capture timing, filters, context and, when needed, server-request association without full user journeys or private logs. Projection limits help another reader interpret unknown outcomes correctly.
Capture observations
DOM text exists / historical exchange source unknown
Correlation review
New capture ≠ reconstructed historical event
Evidence conclusion
Needed: capture timing/filter/context/request association

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

A comparison ledger for one request

This bundle is an authored observation projection, not a new DevTools capture. Its Network row represents browser request/response observation, Elements current DOM, Console an application logger, and theme origin-scoped localStorage. In capture-gap, a displayed result does not establish a late panel recorded the earlier request; the server session store remains unobserved. Enable Network recording before the harmless local-note action and record filter/context choices. Check that GET, /notes/missing, status404, and Not found belong to one exchange. Observe that fulfilled Fetch does not automatically perform status checking and Console messages are application-generated. If response content is incomplete, do not report missing content as an empty successful result.

Compare the result node transition from Loading to Not found with the original document response. Record Console top/frame context and the Application Storage origin. Local Preview edits, localStorage theme=dark, and serverTitle Atlas note belong to different owners. Do not mark server mutation or permission change proven without observation. Deleting another context value is not an automatic repair either.

Preserve observation boundaries in delivery

Retain observed Network Timing phases by name and leave server database duration absent. If Initiator is script, identify this as browser-initiation evidence. An empty table after late recording only establishes a capture gap. A repeated observation must remain harmless and local; a new capture cannot retroactively produce old missing evidence.

Keep excludedHeaderNames and inspected URL/body fields explicit in the observation bundle you share. A minimal public local projection is different from checking the format and content of a full HAR. Select required fields within authorized scope rather than adding another person journey, avoiding account details or private responses. Record selected context, capture start, filters, and body-completion state. These details help another reader interpret an empty table or different DOM result correctly.

NOW APPLY IT TO THE CASE

How do Network, live DOM, Console and Storage answer different authority and coverage questions?

The public missing-note request returns 404 and Not found while the application logs request completed. A local Elements edit shows Preview while serverTitle remains Atlas note. Late capture may show zero rows; a minimal sharing projection is not a full HAR.

Order response receipt, parsing, callbacks and visible DOM outcome in the case. Try explaining the retained old title through this lesson’s browser-state distinctions.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

One request, four evidence surfaces

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "capture": {
    "openedBeforeAction": true,
    "recording": true,
    "preserveLogSupplied": false,
    "selectedContext": "top",
    "filterScope": "public-note"
  },
  "network": {
    "method": "GET",
    "path": "/notes/missing",
    "status": 404,
    "body": "Not found",
    "bodyComplete": true,
    "initiator": "script",
    "fetchPromiseOutcome": "fulfilled-response",
    "ok": false,
    "timing": {
      "phaseNamesOnly": [
        "Waiting (TTFB)",
        "Content Download"
      ],
      "inventedDurationMs": null,
      "serverDatabaseDurationKnown": false
    }
  },
  "document": {
    "responseHTML": "<p id=\"result\">Loading</p>",
    "liveDOMAfterScript": "<p id=\"result\">Not found</p>",
    "liveDOMAfterLocalEdit": "<p id=\"result\">Preview</p>",
    "serverTitleBefore": "Atlas note",
    "serverTitleAfterLocalEdit": "Atlas note",
    "serverMutationObserved": false
  },
  "console": {
    "selectedContext": "top",
    "message": "request completed",
    "messageAuthor": "application",
    "provesHTTP200": false
  },
  "storage": {
    "originAlias": "local-fixture-origin",
    "localStorage": {
      "theme": "dark"
    },
    "serverSessionStoreObserved": false,
    "cacheStorageIsHTTPCache": false
  },
  "sharing": {
    "format": "minimal observation projection; not full HAR",
    "excludedHeaderNames": [
      "Cookie",
      "Set-Cookie",
      "Authorization"
    ],
    "retainedQuery": "none",
    "retainedBody": "public Not found text only",
    "fullAnonymizationProven": false
  },
  "captureGap": {
    "openedBeforeAction": false,
    "visibleRequestRows": 0,
    "conclusion": "historical exchange unobserved; not proof of no request"
  },
  "selector": {
    "language": "XPath",
    "xml": "<observations><decision evidence=\"local-dom\" serverMutationClaim=\"false\"/></observations>",
    "xpath": "count(/observations/decision[@evidence=\"local-dom\" and @serverMutationClaim=\"true\"])",
    "expected": 0,
    "positiveFixtureXml": "<observations><decision evidence=\"local-dom\" serverMutationClaim=\"true\"/></observations>",
    "positiveExpected": 1,
    "scope": "Only authored protocol-decision observations, not product log field names or a live HTTP capture.",
    "missingFieldBehavior": "Missing observation is insufficient evidence; zero matches is not proof of correct runtime behavior."
  }
}

network / capture: Exchange fields are bounded by capture scope; timing is not invented.
document / console: Original HTML, live DOM, and application logs differ.
storage: Client preference is not backend-session/permission evidence.
sharing / captureGap: Minimal projection and missing-evidence boundaries are explicit.

Inert synthetic projection without real HAR/logs or secrets. Native CDP observation is not a DevTools-panel UI/HAR-export test.

Two reality checks

Changing text in Elements changes server data.

Elements shows live DOM; a local edit proves neither an original-response change nor backend mutation.

Sanitized HAR anonymizes all application data.

Sensitive headers can be omitted while retained query/body content and export scope still need review.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

DevTools opened after the action and visibleRequestRows is 0. Can you say no request occurred?

No; the historical exchange may be unobserved.
Yes; an empty Network tab rules out all prior requests.

Read the explained answer

No; the historical exchange may be unobserved. — openedBeforeAction=false is an observation gap; zero rows do not prove absence of the event.

Did the local DOM Preview edit change the server title?

Selected lesson artifact fields; teaching example

document.liveDOMAfterLocalEdit: <p id="result">Preview</p>
document.serverTitleBefore: Atlas note
document.serverTitleAfterLocalEdit: Atlas note
document.serverMutationObserved: false

Yes; displayed text automatically updates all persistent state.
No; the server title remains Atlas note and no mutation is observed.

Read the explained answer

No; the server title remains Atlas note and no mutation is observed. — An Elements-panel/local edit changes this browser tree only; it supplies no server-write evidence.

What do Console request completed and Network 404 teach together? Why is removing Cookies alone not full anonymization when sharing observations?

Read the explained answer

The Console message is an application-completion notification, not HTTP 200 proof; a 404 Response can be fulfilled with ok=false. The observation projection retains only a public body and narrow metadata. Removing Cookie/Authorization is useful minimization but does not automatically anonymize information remaining in queries/bodies/other identifiers.

□ I did not substitute a Console message for HTTP status.

□ I distinguished minimization from full anonymization.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

Chrome DevTools — Network features referenceRecord network requests · Save requests across page loads · View a log of requests · Timing breakdown phases explained · View initiators and dependencies · Save all network requests to a HAR file
Chrome DevTools — Viewing and changing the DOMView DOM nodes · Edit DOM nodes · HTML versus the DOM
Chrome DevTools — Console features referenceFilter out messages from different contexts · Select JavaScript context
Chrome DevTools — View and edit local storageView localStorage keys and values · Edit localStorage keys or values · Interact with localStorage from the Console
Chrome DevTools — View cache dataView cache data · Refresh a resource
MDN — Using the Fetch APICanceling a request · Handling the response · Checking response status · Reading the response body

YOUR NOTES / THIS BROWSER

Observing with Developer Tools

1. Core · Mechanism

Observe HTTP 404

Local DOM edit

Late recording

Start with the capture contract

Response HTML and live DOM are different artifacts

Evidence scope and sensitive fields

2. Red · Trust & Impact

Local DOM

Export scope

Do not treat visible state as authority

Export creates a new data-sharing boundary

3. Blue · Secure development & defense

Correlated review

Late capture

A comparison ledger for one request

Preserve observation boundaries in delivery

How do Network, live DOM, Console and Storage answer different authority and coverage questions?

Two reality checks

DevTools opened after the action and visibleRequestRows is 0. Can you say no request occurred?

Did the local DOM Preview edit change the server title?

What do Console request completed and Network 404 teach together? Why is removing Cookies alone not full anonymization when sharing observations?

Sources and scope