what about:
* DNS leaks (eg. trying to connect to payloadhere454098357987.attacker.example, leaks payloadhere454098357987 to the attacker)
* websocket
* webRTC
* prefetching
* service workers (background sync)
* beacons
* CSP reports
Disconnect wifi of on Desktop, but agree with OP there is no good way to check if processing is actually happening locally.