Differences

This shows you the differences between two versions of the page.

--- provenance:privacy:cookie_syncing [2026/08/26 18:57] – Fix one live stale count and mark the historical ones as historical. Authored by Claude karel.kubicek.claude
+++ provenance:privacy:cookie_syncing [2026/08/26 19:11] (current) – Log rows 26-28; correct the whole-page unaccounted count and the windowed-guard claim; state precisely why a digit guard cannot see a stale quantity. Authored by Claude karel.kubicek.claude
@@ Line 3: / Line 3: @@
 Working notes behind [[privacy:cookie_syncing]] — every query with its population and denominator, the scripts and their unedited output, the hand labels and their residue, the quotes checked against the source papers, the external sources and how each was verified, what could not be established, and the judgement calls. Corpus-level caveats that apply to every page on this site are on [[literature:corpus]] and are not restated here.
-This page carries no ''~~DISCUSSION~~'': comments belong on the content page.
+This page carries no ''%%~~DISCUSSION~~%%'': comments belong on the content page, which is the convention the earlier provenance pages on this site set.
 ===== 1. What this page is backing =====
@@ Line 11: / Line 11: @@
 | Corpus report script | ''scripts/report_cookie_syncing.mjs'' — three passes: full-text probe, hand curation, structured extraction over the curated set |
 | Exploratory probe | ''scripts/cookiesync_fulltext_probe.mjs'' — the wider sweep the population was chosen from, kept because the choice of regex width is the page's largest single source of error |
-| Quote verification | ''scripts/cookie_syncing_quotecheck.mjs'' — 66 literals against two renderings of each source paper |
+| Quote verification | ''scripts/cookie_syncing_quotecheck.mjs'' — 80 literals against two renderings of each source paper |
 | Stale-number guard | ''scripts/cookie_syncing_number_guard.mjs'' — page-specific, because the shared ''check_page_numbers.mjs'' has a site-wide ''ALLOW'' map and adding forty per-paper figures to it would weaken every other page's check |
-| Bibliography additions | ''scripts/bib_additions_cookie_syncing.bib'' — 7 entries, key-scanned and DOI-scanned against a fresh export of ''literature:bibliography'' before appending |
+| Bibliography additions | ''scripts/bib_additions_cookie_syncing.bib'' — 8 entries, key-scanned and DOI-scanned against a fresh export of ''literature:bibliography'' before appending |
 | Data | ''data/extract/run1/extractions.jsonl'' — 5,859 papers with a structured record; ''data/fulltext/*/*/*/paper.cols.txt'' — 5,869 papers with readable full text; 7 venues, 2010–2026 |
 | Written | 2026-08-26, against the corpus as extended on 2026-08-11 (commit ''8a6b843'') |
@@ Line 26: / Line 26: @@
 | ''privacy:server_side_tracking'' | 0 | Where the exchange goes when it leaves the browser | Linked as the successor case |
 | ''privacy:fingerprinting'', ''privacy:javascript'', ''privacy:consent'', ''privacy:darkpatterns'', ''programming:crawler'', ''programming:traffic_files'', ''programming:interaction'', ''design:website_selection'', ''design:crawling_location'', ''literature:corpus'' | 0 | — | Nothing to broaden |
+**Two live pages were edited to make the new one reachable**, and the sweep above was run //before// those edits: ''start'' gained a line in the Privacy section of the outline, and ''privacy:requests'' gained a Related-Pages line. Nothing else on either page was touched. Anyone re-running the sibling sweep today will therefore see one match on ''privacy:requests'' that the table records as zero.
 So this is a **new page, not a broadening of a neighbour**. The alternative considered and rejected was widening ''privacy:cookies'' from "Classifying Cookies" to "Cookies": rejected because that page's whole apparatus (purpose taxonomies, label databases, CookieBlock) is orthogonal to identifier exchange, and because syncing's method literature overlaps ''privacy:requests'' far more than ''privacy:cookies''. Recorded in §8.
@@ Line 115: / Line 117: @@
 ==== 2.4 The detection-family labels ====
-Each of the 29 MEAS papers carries a hand label naming the technique that does the identifier-sharing work — not the paper's overall contribution. The labels are in ''scripts/report_cookie_syncing.mjs'' as a literal map, one line per paper, so a disagreement can be pointed at a line.
+Each of the 30 MEAS papers carries a hand label naming the technique that does the identifier-sharing work — not the paper's overall contribution. The labels are in ''scripts/report_cookie_syncing.mjs'' as a literal map, one line per paper, so a disagreement can be pointed at a line.
 ^ Label ^ Meaning ^ Papers ^
@@ Line 503: / Line 505: @@
 ==== 4.2 Quote check ====
-Every literal figure the content page takes from a corpus paper, checked against **both** renderings of that paper — ''paper.cols.txt'' (column order repaired; the one the extraction read) and ''paper.norm.txt''. They fail on different sentences, so a literal found in either is verified and the report says which. **66 literals, 0 not found.**
+Every figure and every quoted phrase the content page takes from a corpus paper is pinned by a literal here and checked against **both** renderings of that paper — ''paper.cols.txt'' (column order repaired; the one the extraction read) and ''paper.norm.txt''. They fail on different sentences, so a literal found in either is verified and the report says which.
+**The coverage claim in the previous sentence was false when it was first written and is the review's best catch.** The check then held 61 literals and the content page carried at least fourteen more paper-derived figures and quotes that were not among them — Vallina's 2,867 and 58%, the WebViews 44%, Rasaii's 76, Bashir's "90 personas", Calzavara's 4%–7% and its "no consensus" sentence, Khaleesi's "more than half of the request chains", Englehardt's "is essential" and "includes both events where it is a referer and where it is a receiver", Acar's "by nearly a factor of two". The reviewer verified all of them by hand and every one was correct, so nothing on the page changed — but a provenance page whose headline coverage claim is checkable and false is worse than one that claims less. They are all pinned now, which is why the count is 80 and not 61. **80 literals, 0 not found.**
 **A dozen literals failed across successive runs as the check was extended, and every one of them was an error in the //check// or in my paraphrase, never in the paper.** Three kinds:
@@ Line 516: / Line 520: @@
    OK   [cols|norm]  at least 11%
    OK   [cols|norm]  respawning
+   OK   [cols|norm]  by nearly a factor of two
 -- 2016/CCS/online-tracking-a-1-million-site-measurement-and-analysis
@@ Line 525: / Line 530: @@
    OK   [cols|----]  76% of all third-party domains present on more than 5 of the top 100,000 sites
    OK   [cols|----]  visits the top 10,000 sites in a serial fashion
+   OK   [cols|norm]  it is essential
+   OK   [cols|----]  includes both events where it is a referer and where it is a receiver
    OK   [cols|norm]  by using the pyvirtualdisplay library
 -- 2016/USENIX/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
    OK   [cols|norm]  for 31% of our cookie matching partners
+   OK   [cols|norm]  We train 90 personas
    OK   [cols|----]  4.1% cookie matching chains that would be completely missed
    OK   [cols|norm]  35,448
@@ Line 557: / Line 565: @@
    OK   [cols|norm]  cookie syncing
    OK   [cols|norm]  bounce tracking
+   OK   [cols|norm]  more than half of the request chains
 -- 2022/IMC/measuring-uid-smuggling-in-the-wild
@@ Line 582: / Line 591: @@
 -- 2025/PETS/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
    OK   [cols|norm]  2,545
+   OK   [cols|norm]  76
    OK   [cols|norm]  we define intractable
    OK   [cols|norm]  accepts the banner
@@ Line 587: / Line 597: @@
 -- 2025/PETS/tracking-without-borders-studying-the-role-of-webviews-in-bridging-mobile-and-we
    OK   [cols|norm]  1,190
+   OK   [cols|norm]  44%
+-- 2019/IMC/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem
+   OK   [cols|norm]  2,867
+   OK   [cols|norm]  58%
+-- 2023/WWW/the-hitchhikers-guide-to-facebook-web-tracking-with-invisible-pixels-and-click-i
+   OK   [cols|norm]  6.2 third
+-- 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion
+   OK   [cols|norm]  1,899
+   OK   [cols|norm]  1,295
 -- 2021/IEEE-SP/fingerprinting-the-fingerprinters-learning-to-detect-browser-fingerprinting-beha
@@ Line 612: / Line 634: @@
    OK   [cols|norm]  tranco top 10k
    OK   [cols|norm]  zxcvbn
+   OK   [cols|norm]  there is no consensus on the most effective heuristic
+   OK   [cols|norm]  is then 4%-7%
  literals verified, 0 not found.
 </file>
@@ Line 742: / Line 766: @@
   - a ''DERIVED'' map, for the two figures this page computed itself from two verified ones (''17,496 / 33,584 = 52%'' and ''850 / 10,814 = 7.86%''), spelled out so a reader can redo the division rather than trust it.
-The shared ''check_page_numbers.mjs'' was run first, over the //Use in Publications// window, and passes. Over the **whole page** it reports 42 unaccounted figures, all of them per-paper or per-vendor — which is what the page-specific guard exists to resolve rather than to suppress. Current state:
+The shared ''check_page_numbers.mjs'' passes over the //Use in Publications// window. Over the **whole page** it reports **48** unaccounted figures, all of them per-paper or per-vendor — which is what the page-specific guard exists to resolve rather than to suppress. It failed the windowed check once during the second review round, on a bare ''24'' where the report prints ''24.0%''; the figure was right and the prose formatting was not, and the prose now matches the table. Current state:
 <code>
 $ node scripts/cookie_syncing_number_guard.mjs pages/draft/privacy_cookie_syncing.txt
-figures checked: 169
+figures checked: 171
 OK — every figure traces to the report, to a verified quote literal, to a named external source, or to arithmetic on two verified figures.
 </code>
-Running it during the review caught nine figures that had no pinned source, six of which were per-paper figures the quote check had simply never been told about. They are pinned now.
+**The guard let two stale figures through, and the re-review caught them.** After the 29→30 correction the page still said "the 83%" for a value that had become 80.0%, and "the seven rows sum to 29" for a column that summed to 30. Both passed, and the reason is worth stating precisely because it bounds what either guard is worth:
+  * ''83'' appears in the report twice, both times as something else — ''83.3%'' as a ''temporal.mode'' share, and ''75–83% accuracy'' as a classifier's accuracy range in one of the papers. The **shared** guard's word-boundary matching does not help: ''83'' really is there, as a whole token, in ''75–83%''.
+  * ''29'' appears in the report in a dozen places.
+**A guard that asks "does this digit-string appear anywhere in the report" cannot ask "does it appear as //this// quantity."** That is not an implementation defect to fix; it is the ceiling of the technique, and it is the same ceiling the shared script's own comments describe. The only defence found is to re-read the prose by hand after any denominator change. Both stale figures were in prose, not in a table, which is where to look first.
+Running it during the first review caught nine figures with no pinned source, six of which were per-paper figures the quote check had never been told about; the generic reviewer then found fourteen more of the same kind that the guard could not see because they are //quotes// rather than digits. All are pinned now, which is what took the quote check from 42 literals at first draft to 80.
 ===== 5. Figures on the content page, and where each comes from =====
@@ Line 809: / Line 840: @@
   - **New page rather than broadening ''privacy:cookies''.** See §1. The deciding argument: syncing's method literature (identifier heuristics, request chains, filter lists, graph ML) overlaps ''privacy:requests'' far more than the cookie-purpose literature on ''privacy:cookies''. A reasonable person could instead have retitled ''privacy:cookies'' to "Cookies" and made this a section of it.
-  - **Which methods were called superseded.** Five: fixed length windows as the identifier test, long-expiry as a necessary condition, two synchronised profiles, plaintext-only matching, and the "post-cookie era" framing. Each rests on a **named, dated source that supersedes it**, not on my reading of the trend: the length and randomness change on {[calzavara2026_syntactic]}'s own comparison table plus its hand-verified false-positive analysis; the expiry and two-profile changes on {[randall2022_uidsmuggling]}'s stated reasons for dropping them; the plaintext point on {[bashir2016tracing]} and {[papadopoulos2019_csync]}; the framing on Google's two announcements. **No method was dated as superseded on corpus counts alone.** That matters because the corpus counts would have supported a different and wrong story — the family table shows ''syntactic'' running 2014→2025 with 14 papers, which reads as "the state of the art" if you do not read the 2026 paper that measures its error rate.
+  - **Which methods were called superseded.** Five: fixed length windows as the identifier test, long-expiry as a necessary condition, two synchronised profiles, plaintext-only matching, and the "post-cookie era" framing. Each rests on a **named, dated source that supersedes it**, not on my reading of the trend: the length and randomness change on {[calzavara2026_syntactic]}'s own comparison table plus its hand-verified false-positive analysis; the expiry and two-profile changes on {[randall2022_uidsmuggling]}'s stated reasons for dropping them; the plaintext point on {[bashir2016tracing]} and {[papadopoulos2019_csync]}; the framing on Google's two announcements. **No method was dated as superseded on corpus counts alone.** That matters because the corpus counts would have supported a different and wrong story — the family table shows ''syntactic'' as the largest family by a factor of three, running from 2014 to the most recent year in the corpus, which reads as "the state of the art" if you do not read the 2026 paper that measures its error rate.
   - **The 2025–2026 slice is thin, and the page says so in the table itself** rather than in a footnote. Three papers in 2026 mention syncing at all and none mention it five times, so no "current practice" claim on the page rests on a 2026 count. The one 2026 paper that carries weight ({[calzavara2026_syntactic]}) carries it on its content, not on its being recent.
   - **"PoPETs is where this literature lives" is a claim about ≥5-mention papers**, where PoPETs has 9 of the 31. At the ≥1 level PoPETs still leads (28 of 106). It is stated as a venue signal, not as a quality judgement.
@@ Line 819: / Line 850: @@
 ===== 9. Review =====
-Four reviewers, all told the same thing: that my context may not be exhaustive, and all handed the page text, both scripts and their unedited output, and these notes. The three focused ones ran in parallel; the generic one ran after their findings were acted on.
+Four reviewers, all told the same thing: that my context may not be exhaustive, and all handed the page text, both scripts and their unedited output, and these notes. The three focused ones ran in parallel; the generic one ran after their findings were acted on. All four were then re-run against the corrected pages.
+**Rows 1–15 predate the boundary correction in §8**, so every count in them refers to the 29-paper set. They are left as the reviewers wrote them.
 ^ # ^ Reviewer ^ Finding ^ Verdict ^
@@ Line 847: / Line 880: @@
 ==== 9.1 Generic review ====
-@@GENERIC@@
+^ # ^ Finding ^ Verdict ^
+| 16.1 | The intro box said syntactic matching "misses about **17%** of the tracking requests that **taint tracking sees**". 17% is the share of the two methods' **union**; of what taint tracking sees on its own it is about 30%. The page stated it correctly 80 lines later, so it contradicted itself | **Accepted, and the most important finding of the whole review.** It is a wrong-denominator error in the box whose own subject is denominators, and it is the mirror image of finding 10 above. Both sentences now give the union figure and the per-method figure |
+| 16.2 | §4.2 of this page claimed "every literal figure the content page takes from a corpus paper" was checked, and named a count. At least fourteen paper-derived figures and quotes were not in the check | **Accepted.** All fourteen are pinned; the count went 61 → 80. The reviewer had verified every one by hand and all were correct, so no figure on the content page changed — but the claim was false and is the kind of overstatement this page exists not to make. §4.2 now says so explicitly |
+| 16.3 | The syntactic-matching status cell put "16%–19% false positives, ~17% false negatives" side by side as if they shared a denominator | **Accepted.** Split, with the denominators named |
+| 16.4 | "31% of the ad-exchange **pairs**" — the paper says **partners**, and observes that a pair can be detectable in one direction and not the other, which is exactly the distinction the page lectures about two sections later | **Accepted**, with the paper's own observation added as the reason the distinction matters |
+| 16.5 | Three negatives were phrased as claims about the world where the evidence is a claim about seven venues: "nobody has repeated the ad-semantics check", "the only published external ground truth", "nobody has measured how large that inflation is" | **Accepted**, all three scoped |
+| 16.6 | The methods-table box claimed the statuses "were checked against material outside the corpus as well", which §7 substantiates for the superseded list and the browser landscape but not for the //current// labels | **Accepted.** The box now says which judgements rest on a named external source and which rest on argument about a provisional corpus |
+| 16.7 | The by-year table invited a prevalence reading; this page says plainly that mention counts measure attention, and the content page did not | **Accepted.** The disclaimer moved onto the content page, next to the table, and the "2022 is the peak year" sentence now says peak //of attention// and calls the coincidence a coincidence |
+| 16.8 | The sibling sweep in §1 records ''privacy:requests'' at zero matches, but that page now links here | **Accepted.** §1 records that ''start'' and ''privacy:requests'' were edited after the sweep, and that a re-run will differ |
+| 16.9 | Minor: CONRAD never glossed; "six percentage points" is 5.6; the Khaleesi denominator cell is vaguer than every other row | **All three accepted** |
+| 16.10 | Re-ran the quote check independently (byte-identical), verified about twelve unpinned figures by hand, reconciled every internal sum, checked all five cross-page anchors against live headings, and found the overlap with neighbouring pages correctly deferred | No action |
+**One thing this reviewer could not see.** It reviewed the drafts as they stood before the boundary correction in §8, so its counts refer to a 29-paper set. Nothing in its findings depends on that count.
+==== 9.2 Second round ====
+All four reviewers were re-run against the corrected pages. Three returned findings.
+^ # ^ Reviewer ^ Finding ^ Verdict ^
+| 17 | generic (''fable'') | The 29→30 correction left **seven stale counts** across both pages, in exactly the place §8 claims it did not: "sum to 29" for a column summing to 30, "the 83%" for a row now reading 80.0%, "three papers added by hand" where the script says four, "29 MEAS papers", "Three were recovered by hand", "2014→2025 with 14 papers" in a sentence whose own argument the correction had inverted, and "7 entries" against §11's eight | **All seven accepted and fixed.** This is the finding that matters most in the round, because it is the failure the previous round's fix was supposed to prevent. Two of the seven had passed the stale-number guard; §4.5 now records why and what the guard cannot do |
+| 18 | generic | The intro claimed a stateless crawl or a cookie-blocking browser "will measure approximately zero" — contradicted by the page's own unit table, where a **stateless** crawl {[papadogiannakis2021_user]} finds syncing on 24–29% of sites, and by {[acar2014_never]}'s factor-of-two drop rather than a drop to zero | **Accepted.** Rewritten to say what is actually true: a Safari- or Firefox-default browser measures near-zero //by construction//; a stateless crawl measures first-contact syncing and misses the accumulated graph. More useful to the reader as well as more accurate |
+| 19 | generic | The content page argued against adding late-found papers while the provenance page recorded one paper //being// added late, and never explained the difference | **Accepted.** The rule — a boundary //inconsistency// gets corrected, a late //discovery// gets named but not counted — was stated in §8 only; a clause now states it on the content page too |
+| 20 | generic | The bibliography accounting did not reconcile: the ''.bib'' file, §1's count and §11's list disagreed, and three cited keys appeared to have reached the live bibliography by an unrecorded route | **Half accepted.** The count and the file were wrong and are fixed. **The unrecorded-route claim is rejected**: ''calzavara2026_syntactic'', ''bahrami2025_cookieguard'', ''dao2026_gclid'' and ''dimova2021cname'' were all present in the export taken before this run's first append, verified by grep against that export. The reviewer's evidence was a copy of the bibliography on disk dated 2026-08-19 — the exact trap of checking a local copy instead of a fresh ''?do=export_raw''. §11 now names them so the next reader does not re-raise it |
+| 21 | generic | The review log's time base was stated in one row rather than in the preamble, so row 3's "all confirmed" reads as current | **Accepted**, moved to the §9 preamble |
+| 22 | generic | The artifact table lists 8 rows against a claim of 13 public artifacts, with no inclusion rule, and omits the gclid paper's dataset | **Accepted.** The dataset row is added and the gap is explained |
+| 23 | generic | The Chrome-roadmap passage drifts toward a news ticker and could be halved | **Rejected.** Every clause is sourced to a primary page, the milestone is the one fact a reader cannot get from Google's blog, and the passage exists because the previous round's reviewer asserted a removal date that turned out to be wrong. Length is the cost of not repeating that |
+| 24 | citations-and-quotes (''sonnet'') | §1 says 7 bibliography entries, §11 says eight | **Accepted**, same fix as 20. This reviewer reached the opposite and correct conclusion about the pre-existing keys, having checked the live export |
+| 25 | citations-and-quotes | Independently verified the gclid figures and both of its denominators, the ''bekos2023_hitchhiker'' and ''dimova2021cname'' figures, the union/per-method arithmetic, Bashir's "partners" wording and the direction parenthetical, and re-ran all three scripts byte-identically. Confirms §4.2's coverage claim is now true | No action |
+| 26 | figures-vs-script (''sonnet'') | Independently found the same stale counts as row 17, plus two the generic reviewer did not: the whole-page count in §4.5 had drifted from 42 to 48, and the shared ''check_page_numbers.mjs'' had started **failing** over the //Use in Publications// window on a bare ''24'' where the report prints ''24.0%'' — while §4.5 still narrated it as passing | **Accepted.** The prose percentages now match the table's own formatting, both guards pass, and §4.5 records the failure rather than the claim |
+| 27 | figures-vs-script | Explained precisely why the stale ''83%'' survived both guards: ''83'' occurs in the report as ''83.3%'' //and// as ''75–83% accuracy'', so even word-boundary matching finds it. Neither guard can distinguish "this digit-string exists" from "this quantity exists" | **Accepted and recorded in §4.5**, in the reviewer's own terms. This is the most useful thing either round produced about the tooling, as opposed to about the page |
+| 28 | figures-vs-script | Confirmed both scripts byte-identical to their committed output, every 30/25-denominator table correct, the dead-label diagnostic self-consistent at 3, and every ''DERIVED'' entry arithmetically correct | No action |
 ===== 10. What could not be established =====
-  * **How many syncing papers the regex missed.** There is no ground-truth list of papers that measure identifier sharing. Three were recovered by hand; the true recall of the population is unknown and the page says "at least 106".
+  * **How many syncing papers the regex missed.** There is no ground-truth list of papers that measure identifier sharing. Four were added by hand — three for under-recall, one to correct the boundary — and the true recall of the population is unknown, which is why the page says "at least 106".
   * **Whether syncing prevalence has risen or fallen.** No two papers in the corpus measure the same unit over the same population, so no trend can be computed from them, and the per-year mention counts measure attention, not prevalence. Listed as the second open question.
   * **The size of the seed-profile self-sync artefact** predicted by {[englehardt2016online]} in 2016. Still unmeasured; also open on ''programming:stateful_stateless''.
   * **Deployment of deterministic-ID frameworks.** No corpus paper measures UID2, EUID or their competitors, and I found no primary measurement outside the corpus that I could verify. The page states the gap and does not guess at it.
+  * **Two papers that meet the boundary and are not in the set.** {[bekos2023_hitchhiker]} (TheWebConf 2023) measures a median website passing identifiers to **6.2 third parties**; {[dimova2021cname]} (PoPETs 2021) finds **1,899 cookie leaks in request URLs on 1,295 distinct sites**. Both were found by a late sweep for detection tuples using identifier-flow language //without// the word "sync", after the set had been fixed and every figure derived from it. They are named on the content page rather than added, because adding papers as one stumbles on them is how a hand-curated set stops being reproducible — and because two papers change no table's shape. The same sweep is the reason to believe the recall problem is real rather than hypothetical: it found two in one pass and was not exhaustive.
   * **Whether the nine "not-syncing" exclusions would survive another reader.** Four of them (in-vehicle networks, COPPA, Apple logging, analytics dashboards) plus the Meta server-side paper are extraction-only matches with no full-text occurrence of any syncing wording, which is a strong exclusion. The other four rest on reading the passage — and one of those, the privacy-vs-compatibility paper, is arguable, because it does measure a cross-site identifier flow, just not a cross-vendor one.
   * **A pre-existing bibliography defect, not fixed.** ''literature:bibliography'' contains two papers twice under different keys — ''fouad2022my'' / ''fouad2022_cookie'' (DOI ''10.56553/popets-2022-0063'') and ''bottger2025_regional'' / ''boettger2025_regional'' (DOI ''10.56553/popets-2025-0063''). Found by a DOI scan run before appending this page's entries. **Not touched**, because other pages may cite either key and deduplicating is a site-wide edit with its own review. Recorded here so the next run does not have to rediscover it.
@@ Line 860: / Line 925: @@
 ===== 11. Bibliography additions =====
-Seven entries appended before the closing ''</bibtex>'', after scanning the fresh export for both key collisions and DOI collisions:
+Eight entries appended before the closing ''</bibtex>'', after scanning the fresh export for both key collisions and DOI collisions:
 ^ Key ^ Paper ^ Source of the metadata ^
@@ Line 870: / Line 935: @@
 | ''cook2020_headerbidding'' | Inferring Tracker-Advertiser Relationships …, PoPETs 2020 | Same |
 | ''oh2022_cartology'' | Cart-ology, CCS 2022 | ''bibgen.mjs'', OpenAlex-by-DOI |
+| ''bekos2023_hitchhiker'' | The Hitchhiker's Guide to Facebook Web Tracking, TheWebConf 2023 | ''bibgen.mjs'', OpenAlex-by-DOI. Added during review, for the near-miss named in §10 |
 Two entries were generated and then **discarded as duplicates** of papers already present under other keys: Roesner et al. 2012 (already ''roesner2012_detecting'') and Sánchez-Rola et al. 2019 (already ''sanchezrola2019can'', DOI ''10.1145/3321705.3329806''). The page cites the existing keys.
+**The other 24 keys the two pages cite were already in the bibliography** and were not touched. Four of them are worth naming because a reviewer flagged them as possibly added without a record: ''calzavara2026_syntactic'', ''bahrami2025_cookieguard'', ''dao2026_gclid'' and ''dimova2021cname'' were all present in the export taken **before** this run's first append, and the reviewer's contrary evidence turned out to be a local copy of the bibliography from 2026-08-19. Check against a fresh ''?do=export_raw'', never against a copy on disk.
 ===== 12. Cross-links =====