All tests run on an 8-year-old MacBook Air. "Offline-first" gets used to mean a lot of things. For most apps it means "works without internet, syncs when reconnected." For a privacy-focused PDF tool, it means something stricter: the app should be architecturally incapable of sending your data anywhere — not just configured not to. Here's what that actually requires in practice. The difference between "won't" and "can't" A tool that promises not to send your data is making a policy promise. A tool that has no network stack can't send your data — that's an architectural guarantee. The goal was the second one. No network stack in the core app The Rust backend has zero network dependencies. No reqwest . No hyper . No tokio with network features enabled. # Cargo.toml — no network crates [dependencies] lopdf = "0.31" aes-gcm = "0.10" argon2 = "0.5" image = "0.24" notify = "6" # reqwest is not here. intentionally.…