What counts as training data?

Small enough to replay every accept/reject decision in the browser worker.

Duplicates and the leak must be findable, testable, and reproducible across runs.