Differences

This shows you the differences between two versions of the page.

--- provenance:programming:crawler:tracker_radar_collector [2026/08/14 14:12] – Add shared bibliography references to Tracker Radar provenance — Authored by Claude karel.kubicek.claude
+++ provenance:programming:crawler:tracker_radar_collector [2026/09/17 07:24] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Provenance: Tracker Radar Collector ======
-This is the working log for [[programming:crawler:tracker_radar_collector|Tracker Radar Collector]]. It records the decisions and checks specific to that page; dataset-wide extraction caveats live on [[literature:corpus|the corpus provenance page]]. It deliberately has no discussion block: comments belong on the content page.
+This is the working log for [[:programming:crawler:tracker_radar_collector|Tracker Radar Collector]]. It records the decisions and checks specific to that page; dataset-wide extraction caveats live on [[:literature:corpus|the corpus provenance page]]. It deliberately has no discussion block: comments belong on the content page.
-===== Page, scope and run =====
+===== 1. Page, scope and run =====
 ^ Item ^ Record ^
-| Content page | [[programming:crawler:tracker_radar_collector|programming:crawler:tracker_radar_collector]] |
+| Content page | [[:programming:crawler:tracker_radar_collector|programming:crawler:tracker_radar_collector]] |
-| Corpus provenance | [[literature:corpus|literature:corpus]] |
+| Corpus provenance | [[:literature:corpus|literature:corpus]] |
-| Report script | ''scripts/report_tracker_radar_collector.mjs'' |
+| Scripts | ''report_tracker_radar_collector.mjs'', ''trc_review_probe.mjs'', ''trc_index_reconcile.mjs'', ''trc_paper_detail.mjs'', ''trc_smoke.mjs'' |
-| Run date | 2026-08-14 UTC |
+| First run | 2026-08-14, one Codex/GPT-5.6-Luna pass, 14:10:09--14:14:32 UTC |
-| Corpus at run | 5,859 extracted papers, 2010--2026, seven venues: CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P |
+| Review run | 2026-09-03, Claude Opus 5 coordinating four ''sonnet'' passes and one ''fable'' pass |
-| Relevant population | CRAWLED = 1,120 papers; the report defines this using crawl configuration or the automated-web-crawl study type |
+| Corpus at both runs | 5,859 extracted papers, 2010--2026, seven venues: CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P |
-| Models/agents | One primary Codex run. No subagent/Agent tool was available in this environment, so the focused and generic review passes below were performed by the primary run and are recorded as such. |
+| Relevant population | CRAWLED = 1,120 papers, defined by a crawl configuration or the automated-web-crawl study type |
+| TRC checkout used | ''8b64006691a1ce3929cfdfeeb425e7cc64be6543'' (2026-07-22), plus ''main'' at ''4ad2472b346bf9b544ca4815db29266e3a8369d5'' (2026-08-24) for the currency diff |
-The existing [[programming:crawler|Comparison of Crawling Libraries]] page already promised a red link to this exact page and acts as the crawler index. I created this new focused subpage rather than broadening the index or duplicating [[programming:crawler:openwpm|OpenWPM]]: the question here is TRC's capture schema and its path into Tracker Radar, while the neighbours compare crawler families and OpenWPM's Firefox instrumentation. No parent-page edit was needed.
+==== 1.1 Why this page was reviewed rather than written ====
-===== Queries and populations =====
+The content page and this page were created and "reviewed" in a **single 4 min 23 s pass** by the cheap model tier, and its outcome note claimed only "all checks passed" — no reviewer count, no findings, no named script. The revision log is the evidence:
-The following were run from ''/workspace/artifacts/wiki'' unless an absolute path is shown. The first command is an orientation query only; its free-text table was not pasted into the page.
+<code>
+rev 1786716609  C  20905  Create Tracker Radar Collector page
+rev 1786716871  E    236  Clarify Tracker Radar output schema
+prov 1786716614 C  24707  Add Tracker Radar Collector provenance
+prov 1786716731 E     58  Add shared bibliography references
+prov 1786716872 E    311  Log Tracker Radar schema review adjustment
+</code>
+Every comparable page in this namespace (openwpm, traffic_files, pagegraph, webxray, foxhound) needed three to five review passes, and every pass found blocking defects. So the absence of findings was evidence about the review, not about the page. The 2026-09-03 run therefore ran the full review layer over the published pages. Every published corpus **figure** held up: the script reproduces byte for byte, an independent full-text probe finds the same 10 papers, and every clause of every per-paper claim survived a clause-by-clause check. Two things that came out of the first pass's own **script** did not — its quote-check summary ("2 exact" was really 1 verbatim and 1 case-only) and a sliding-window match that passed a mutated quote — so "the arithmetic was fine, only the reading was wrong" would be too flattering. What was wrong in bulk was the reading: the tool's README, its dependency's changelog, an open bug in its issue tracker, and the neighbouring page's numbers.
+===== 2. Populations, denominators and every query =====
+Run from ''/workspace/artifacts/wiki'':
 <code bash>
 node scripts/sitemap.mjs
-node /workspace/publications_dataset/scripts/site_queries.mjs --run /workspace/publications_dataset/data/extract/run1 --page crawlers --format wiki
 node scripts/report_tracker_radar_collector.mjs
+node scripts/trc_review_probe.mjs
+node scripts/trc_index_reconcile.mjs
+node scripts/trc_paper_detail.mjs
+TRC_UNSAFE_DISABLE_SANDBOX=1 PUPPETEER_EXECUTABLE_PATH=... node scripts/trc_smoke.mjs sandbox/trc out/trc_smoke
 </code>
-The report's exact populations are:
 ^ Query/result ^ Population and denominator ^ Rule ^
-| CRAWLED | 1,120 papers | ''POPULATIONS.crawled'' from the current ''run1'' extraction: a crawl configuration or automated-web-crawl study type |
+| CRAWLED | 1,120 papers | ''POPULATIONS.crawled'' from the current ''run1'': a crawl configuration or the automated-web-crawl study type |
-| TRC crawler users | 10 papers | At any corpus size, a paper has a ''tools[]'' tuple whose name matches ''tracker[- ]radar[- ]collector'', whose category is ''crawler-framework'' or ''browser-automation'', and whose status is ''used'' or ''produced''. The published adoption figure uses the 10-paper intersection with CRAWLED; all 10 are inside it. |
+| TRC crawler users | **10 papers** | A paper with a ''tools[]'' tuple whose name matches ''tracker[- ]radar[- ]collector'', whose category is ''crawler-framework'' or ''browser-automation'', and whose status is ''used'' or ''produced''. All 10 are inside CRAWLED, so 10/1,120 is the published figure |
-| OpenWPM comparison | 58 papers | Same automation-category and used/produced rule in CRAWLED, with a case/spacing fold for OpenWPM. This is a context comparison, not a claim of relative quality. |
+| Category audit for that query | 9 papers ''crawler-framework/used'', 1 paper ''browser-automation/used'' | Run with **no** category or status filter, printed in the probe output. ''tools[].category'' is a denominator: a TRC tuple filed under another category would drop out silently. None is. |
-| Broad Tracker Radar boundary | 21 papers | All 5,859 extracted papers whose tool name matches ''tracker[- ]radar'', regardless of whether the tuple names a crawler, dataset, entity map, wiki or service. 11 do not satisfy the Collector automation query. |
+| Broad Tracker Radar boundary | 21 papers | All 5,859 papers whose tool name matches ''tracker[- ]radar'', regardless of whether the tuple names a crawler, dataset, entity map, wiki or service. 11 do not satisfy the Collector query |
-| Year table | Per-year CRAWLED denominator | For each year, count CRAWLED papers and TRC papers in that year; percentages are TRC users divided by that year's CRAWLED papers. 2025 and 2026 are marked provisional. |
+| Full-text recall | 10 papers | ''/tracker[\s-]*radar[\s-]*collector/'' over the whitespace-collapsed, hyphen-normalised ''paper.cols.txt'' of all 5,855 papers that have one, with **no reference to the extraction**. Same 10, zero misses either way |
-| Name audit | Tuple counts only | Count every matching raw ''tools[]'' tuple to print the fold and residue. These tuple counts are not paper denominators and are not published as prevalence. |
+| OpenWPM context count | 58 papers | Same automation-category and used/produced rule inside CRAWLED, with a case/spacing fold. Context only, not a quality claim — and see §2.1 |
+| Year table | Per-year CRAWLED denominator | For each year, count CRAWLED papers and TRC papers in that year. 2025 and 2026 are marked provisional |
+| ''crawlConfig'' survey | 10 papers, all with an object | Enum-bearing keys, so publishable as counts; sentinels printed, never subtracted |
+| Measured results | 10 papers, each its own denominator | ''detection[].prevalence'', printed unaggregated. Three were re-read in the papers themselves before publication |
+| Name audit | Tuple counts only | Count every matching raw ''tools[]'' tuple to print the fold and residue. Not paper denominators, never published as prevalence |
-The page says “10 papers in the 1,120-paper CRAWLED population,” not “10 of 5,859,” because the latter would silently use the wrong population. The all-paper 5,859 and broad 21/11 figures are stated only with the all-paper boundary definition.
+The page says "10 papers in the 1,120-paper CRAWLED population", never "10 of 5,859". The all-paper 5,859 and the broad 21/11 appear only with the all-paper boundary definition stated.
-===== Folding and residue =====
+==== 2.1 Why the OpenWPM count is 58 here and 59 or 60 on its own page ====
-The report uses the case-insensitive pattern ''tracker[\\s-]?radar[\\s-]?collector''. It permits a DuckDuckGo prefix and a ''(TRC)'' suffix because the match is on the full tool name, then restricts the population to the two automation categories and used/produced statuses. This is deliberately narrower than ''tracker[- ]radar''.
+Three numbers exist across the wiki and each is right for its own documented rule. Pass (d) reconstructed the difference exactly:
+  * **58** — automation-category filter, used/produced, intersected with CRAWLED. What ''report_tracker_radar_collector.mjs'' computes, and what the [[:programming:crawler|crawler index]]'s folded-framework table publishes.
+  * **59** — the same, without the category filter.
+  * **60** — no category filter, over all 5,859 papers. The [[:programming:crawler:openwpm|openwpm page]]'s headline.
+The one-paper delta between 58 and 59 is ''PETS/2020/a-comparative-measurement-study-of-web-tracking-on-mobile-and-desktop-environmen'', whose tuple is ''"OpenWPM Firefox extension"'' with ''category: "browser"'' and ''usedOrMentioned: "used"''. It is a browser-category tuple, so this page's automation filter excludes it and the openwpm page's rule keeps it. Nothing is wrong; nothing was reconciled before this run either.
+==== 2.2 The 21-versus-10 conflation, and the neighbour it was found on ====
+''scripts/tool_fold.mjs'' line 27 is:
+<code javascript>
+F('Tracker Radar Collector', /tracker.?radar/i),
+</code>
+a family **named after the crawler** that matches the dataset, the entity list, the entity map and the wiki. The [[:programming:crawler|crawler index]] publishes that family as ''| Tracker Radar Collector | 21 | 1 | 2021–2026 |'' and said in prose that extending the corpus "tripled Tracker Radar Collector (8 → 21)". All 11 papers in the difference used the **dataset**, not the crawler. ''trc_index_reconcile.mjs'' prints both rules side by side and lists them:
+<file text trc_index_reconcile-output.txt>
+Populations: all papers = 5859; CRAWLED = 1120
+/ 5859   index family rule, all papers, used/produced
+/ 5859   index family rule, all papers, any status
+/ 1120   index family rule, CRAWLED, automation + used/produced
+/ 5859   subpage rule, all papers, automation + used/produced
+/ 1120   subpage rule, CRAWLED, automation + used/produced
+/ 5859   subpage rule, all papers, any category/status
+published on programming:crawler ("Which specialised crawlers actually get used"): 21 papers using or producing
+published on programming:crawler (folded framework table, within CRAWLED): 10 papers, 0.9%
+published on programming:crawler:tracker_radar_collector: 10 papers of 1,120 CRAWLED
+=== in the index family (used/produced, all papers) but NOT in the subpage query: 11 ===
+  WWW/2022/investigating-advertisers-domain-changing-behaviors-and-their-impacts-on-ad-bloc
+        "Tracker Radar" [classification-service/used]
+  PETS/2023/evaluating-practical-quic-website-fingerprinting-defenses-for-the-masses
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  IMC/2024/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc
+        "DuckDuckGo Tracker Radar" [cookie-database/used]
+  IEEE-SP/2025/only-as-strong-as-the-weakest-link-on-the-security-of-brokered-single-sign-on-on
+        "Tracker Radar Entity List" [other/used]
+  IMC/2025/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  NDSS/2025/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
+        "DuckDuckGo Tracker Radar Wiki" [classification-service/used]
+  WWW/2025/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  NDSS/2026/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  PETS/2026/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government
+        "DuckDuckGo Tracker Radar" [classification-service/used]
+  USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
+        "Tracker Radar Entity Map" [classification-service/used]
+=== in the subpage query but NOT in the index family: 0 ===
+</file>
+Both fixes were applied to the index on 2026-09-03: the 21 row now carries a footnote with the split, and the prose now says "the Tracker Radar family" and points at the crawler-only row. ''tool_fold.mjs'' was **not** changed, because renaming the family would relabel the folded-framework row where the 10 genuinely is the crawler, and would change figures on a page outside this run's scope. The label still matches the script; the footnote carries the truth. That is a compromise and it is recorded as one.
+===== 3. Folding and residue =====
+The report's fold pattern is case-insensitive:
+<code>
+tracker[\s-]?radar[\s-]?collector
+</code>
-The four raw strings mapped to the Collector are:
+It permits a DuckDuckGo prefix and a ''(TRC)'' suffix because the match is on the full tool name, then restricts the population to the two automation categories and used/produced statuses. This is deliberately narrower than ''tracker[- ]radar''.
-  * ''DuckDuckGo Tracker Radar Collector'' — 4 tuples
+Four raw strings map to the Collector: ''DuckDuckGo Tracker Radar Collector'' (4 tuples), ''Tracker Radar Collector'' (4), ''DuckDuckGo tracker-radar-collector'' (1), ''Tracker Radar Collector (TRC)'' (1).
-  * ''Tracker Radar Collector'' — 4 tuples
-  * ''DuckDuckGo tracker-radar-collector'' — 1 tuple
-  * ''Tracker Radar Collector (TRC)'' — 1 tuple
-The complete excluded radar-name residue printed by the script is:
+The complete excluded radar-name residue, printed in full:
 <code>
@@ Line 59: / Line 141: @@
 </code>
-The raw audit therefore has 9 distinct radar strings, 4 mapped Collector strings and 5 excluded strings. The report prints this residue so a later alias change cannot silently turn the dataset or entity map into a crawler count.
+Nine distinct radar strings, four mapped, five excluded, and no string lands in both maps. Two cautions a reader needs:
-===== Verbatim report output =====
+  * The residue is counted in **tuples**, not papers. Twelve tuples over five strings is not twelve extra papers.
+  * The residue is **not paper-disjoint from the 10**. Pass (a) found that ''PETS/2025/referrer-policy-implementation-and-circumvention'' has both a Collector tuple (so it is one of the 10) and a ''"DuckDuckGo Tracker Radar"'' tuple (so it also feeds the residue). The paper-level "11 excluded" figure does filter out any paper with a qualifying Collector tuple, so 10 and 11 are disjoint; the tuple residue is not.
-The following is the output of ''node scripts/report_tracker_radar_collector.mjs'' from the run above, copied without editing. It is the audit trail for every number on the content page.
+===== 4. Recall: the probe that does not trust the extraction =====
-<file text>
+''trc_review_probe.mjs'' reads ''paper.cols.txt'' for all 5,859 extracted papers, ignoring ''tools[]'' entirely, and prints every hit with its extraction status and every match context — not the first, because one window hides a reference-list-only mention behind a methods mention. Result:
+<code>
+full-text probe over 5855 papers with a paper.cols.txt (4 of 5859 extracted papers have none)
+probe: /tracker[\s-]*radar[\s-]*collector/ on whitespace-collapsed, hyphen-normalised text
+papers whose full text names the Collector: 10
+papers in the report's TRC population: 10
+in probe but NOT in the report population: 0
+in the report population but NOT in the probe: 0  []
+...
+=== tools[] tuples naming the Collector, by category and status (no filter) ===
+papers  browser-automation / used
+papers  crawler-framework / used
+</code>
+Pass (a) widened it further over the same 5,855 papers and the population did not move: ''radar[\s-]*collector'' → 10, ''duckduckgo.{0,40}collector'' → 10, ''\btrc\b'' near ''crawl'' → 6, no extras in any case. It also checked the four papers with no ''.cols'' rendering against ''paper.norm.txt'' (''USENIX/2010/idle-port-scanning'', ''CCS/2014/beware-your-hands-reveal-your-secrets'', ''IMC/2020/bgp-beacons'', ''IEEE-SP/2020/burglars-iot-paradise'' — zero hits for "tracker radar", "puppeteer" or "trc"), and swept for papers where ''\btrc\b'' is frequent and "collector" absent: five Rowhammer and DRAM papers where TRC means Target Row Refresh or Target Row Counter. All true negatives.
+This is the check that makes the 10 worth publishing. It is independent of ''tools[].category'', which is the field most likely to drop a paper silently.
+===== 5. The report script and its unedited output =====
+<file text report_tracker_radar_collector-output.txt>
 corpus: 5859 papers, 7 venues, 2010–2026
 population CRAWLED: 1120 papers (crawlConfig or automated-web-crawl study type)
@@ Line 129: / Line 234: @@
 === E. Evidence quote checks ===
--word  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  /workspace/publications_dataset/data/fulltext/2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion/paper.cols.txt
+-word-compact  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  /workspace/publications_dataset/data/fulltext/2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion/paper.cols.txt
   "We built our crawler by modifying the DuckDuckGo Tracker Radar Collector [21], a Puppeteer-based crawler that uses the Chrome DevTools Protocol (CDP)."
 -word-compact  USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  /workspace/publications_dataset/data/fulltext/2022/USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission/paper.cols.txt
   "We develop an interactive, instrumented crawler based on DuckDuckGo's Tracker Radar Collector"
 -word-compact  USENIX/2023/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3  /workspace/publications_dataset/data/fulltext/2023/USENIX/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3/paper.cols.txt
@@ Line 139: / Line 244: @@
 -word-compact  PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework  /workspace/publications_dataset/data/fulltext/2024/PETS/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework/paper.cols.txt
   "We used code from DuckDuckGo's Tracker Radar Collector (TRC) that allowed us to set non-invasive breakpoints on the DOM cookie methods and record the JavaScript stack traces"
--word  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  /workspace/publications_dataset/data/fulltext/2024/WWW/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting/paper.cols.txt
+-word-compact  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  /workspace/publications_dataset/data/fulltext/2024/WWW/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting/paper.cols.txt
   "Our web crawler is a fork of Tracker Radar Collector (TRC), a crawler created by DuckDuckGo."
-exact  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  /workspace/publications_dataset/data/fulltext/2025/IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th/paper.cols.txt
+exact-except-case  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  /workspace/publications_dataset/data/fulltext/2025/IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th/paper.cols.txt
   "We modified DuckDuckGo's Tracker Radar Collector [22], a Puppeteer-based Web crawler."
 -word-compact  PETS/2025/referrer-policy-implementation-and-circumvention  /workspace/publications_dataset/data/fulltext/2025/PETS/referrer-policy-implementation-and-circumvention/paper.cols.txt
@@ Line 147: / Line 252: @@
 -word-compact  PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic  /workspace/publications_dataset/data/fulltext/2025/PETS/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic/paper.cols.txt
   "To collect ads, we utilized the DuckDuckGo tracker-radar-collector framework, built on the Puppeteer web crawler."
 -word-compact  USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost  /workspace/publications_dataset/data/fulltext/2026/USENIX/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost/paper.cols.txt
   "We perform web crawls using a customized version of DuckDuckGo's Tracker Radar Collector (TRC), an opensource Puppeteer-based crawler equipped with anti-bot measures"
-Quote checks: 2 exact, 8 partial (longest 5–10 word run), 0 not located, 10 TRC tool tuples checked.
+Quote checks: 1 verbatim, 1 exact except capitalisation, 8 partial (longest 5–12 word run containing "tracker radar collector"), 0 matched only outside the anchor, 0 not located, 10 TRC tool tuples checked.
+A "partial" grade means the run was split by the column repair, not that the source is silent: every accepted window contains the anchor phrase itself.
+"exact except capitalisation" means the extraction dropped a leading clause and capitalised a mid-sentence word. The sentence supports the claim; the string is an edited fragment and must not be printed as verbatim.
-=== F. Current-tool interpretation ===
+=== F. What the ten papers configured (crawlConfig, sentinels shown as values) ===
+crawlConfig is an enum-bearing object, so these are publishable as counts -- but note that all of
+crawlConfig, ethics and artifacts share one evidence quote per paper, so no single key here is
+independently quote-checked. Sentinels are printed, never subtracted.
+Year  Paper                               statefulness  headless    consentAction      interactionDepth       browsers                                                             subpagesPerSite
+----  ----------------------------------  ------------  ----------  -----------------  ---------------------  -------------------------------------------------------------------  ---------------
+  the-cname-of-the-game-large-scale-  stateless     headless    not-stated         landing-plus-subpages  Chrome                                                               20
+  leaky-forms-a-study-of-email-and-p  not-stated    not-stated  accept-and-reject  landing-plus-subpages  Chrome+mobile-emulated browser                                       10
+  is-your-wallet-snitching-on-you-an  not-stated    not-stated  not-stated         landing-page-only      Chromium                                                             null
+  targeted-and-troublesome-tracking-  stateless     not-stated  accept-all         landing-plus-subpages  Puppeteer/TRC desktop browser+Puppeteer/TRC emulated mobile browser  5
+  johnny-still-cant-opt-out-assessin  not-stated    not-stated  no-interaction     landing-plus-subpages  Chrome                                                               9
+  the-double-edged-sword-identifying  not-stated    headless    accept-all         landing-plus-subpages  Chrome                                                               15
+  canvassing-the-fingerprinters-char  not-stated    not-stated  accept-all         landing-page-only      (empty)                                                              null
+  referrer-policy-implementation-and  not-stated    not-stated  accept-and-reject  landing-plus-subpages  Chrome                                                               null
+  sheeps-clothing-wolfish-intent-aut  both          not-stated  not-stated         landing-plus-subpages  Chrome                                                               3
+  bridges-to-self-silent-web-to-app-  not-stated    not-stated  accept-all         landing-page-only      (empty)                                                              null
+statefulness: not-stated=7, stateless=2, both=1
+headless: not-stated=8, headless=2
+consentAction: accept-all=4, not-stated=3, accept-and-reject=2, no-interaction=1
+interactionDepth: landing-plus-subpages=7, landing-page-only=3
+browsers: Chrome=5, (empty)=2, Chrome+mobile-emulated browser=1, Chromium=1, Puppeteer/TRC desktop browser+Puppeteer/TRC emulated mobile browser=1
+subpagesPerSite: null=4, 10=1, 15=1, 20=1, 3=1, 5=1, 9=1
+Papers with a crawlConfig object at all: 10 of 10.
+=== G. What the ten papers measured, verbatim, with each paper's own denominator ===
+detection[].prevalence, printed unaggregated. Ten papers with ten denominators do not add up, and
+`metric` names the unit, not the population -- read the quote, not the metric.
+  PETS/2021/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion  (8 of 8 detection tuples carry a prevalence string)
+  - [share of websites] 9.98% of the top 10,000 websites employed at least one CNAME-based tracker.
+      quote (introduction): "9.98% of the top 10,000 websites employ at least one CNAME-based tracker."
+  - [relative increase in publishers] 21% growth over 22 months, compared with −3% and −8% for comparison tracker groups.
+      quote (results): "the CNAME-based trackers are rapidly gaining popularity, with a growth of 21% over the past 22 months"
+  - [share of sites with leaks] 95% of sites with an identified CNAME tracker had one or more cookie leaks.
+      quote (results): "We identified one or more cookie leaks on 7,377 sites (95%) out of the 7,797 sites where we could identify the presence of at least one CNAME-based tracker."
+  - [sites leaking sensitive information] 13 of 50 successfully registered sites leaked sensitive information.
+      quote (methodology): "In total, we found that on 13 of these websites sensitive information leaked to a CNAME tracker."
+  - [number of leaked cookies and sites] 166 cookies on 94 distinct sites were sent in POST bodies.
+      quote (results): "We found that 166 cookies (on 94 distinct sites) set by another party were sent to a CNAME tracker's subdomain in a POST request body."
+  - [number of leaks and sites] 1,899 cookie leaks on 1,295 distinct sites.
+      quote (results): "We found 1,899 cookie leaks in request URLs to CNAME subdomains on 1,295 distinct sites."
+  - [number of websites] 19 websites requested active content over HTTP; 72 sent analytics over HTTP from HTTPS pages.
+      quote (results): "we did identify 19 websites where active content, i.e. HTML or JavaScript, was requested from the tracker over an insecure connection."
+  - [number of vulnerable trackers] Two different trackers had vulnerabilities affecting publishers that included them.
+      quote (methodology): "For up to maximum 30 minutes per tracker, we analyzed the requests and responses to/from the CNAME subdomain for client-side web vulnerabilities."
+  USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  (4 of 4 detection tuples carry a prevalence string)
+  - [number of distinct websites] 1,844 EU websites and 2,950 US websites
+      quote (abstract): "Our crawler finds and fills email and password fields, monitors the network traffic for leaks, and intercepts script access to filled input fields."
+  - [number of distinct websites] 52 websites in follow-up crawls without password input-type swapping
+      quote (results): "We found that passwords are collected by trackers on 52 distinct websites even for users who do not use ShowPassword or similar extensions."
+  - [number of domains and percentage increase] 41 tracker domains; 13.4% EU and 4.2% US increase in leaky websites
+      quote (methodology): "we uncover 41 tracker domains that are not listed in any of the popular blocklists."
+  - [received emails and source websites] 290 emails from 88 desktop-crawl sites in six weeks
+      quote (results): "In the six-week period following the crawls, we received 290 emails from 88 distinct sites on the email addresses used in the desktop crawls"
+  USENIX/2023/is-your-wallet-snitching-on-you-an-analysis-on-the-privacy-implications-of-web3  (5 of 5 detection tuples carry a prevalence string)
+  - [websites with wallet-API calls] 1,325 of 96,905 successfully crawled websites
+      quote (results): "We found 1, 114 unique scripts on 1, 325 websites which made in total 1, 517 JavaScript calls to at least one wallet APIs listed in Table 1."
+  - [fingerprinting scripts and websites] 878 scripts belonging to 1,099 websites
+      quote (results): "we find that 878 scripts (79%) belonging to 1, 099 websites (83%) engage in browser fingerprinting and leverage wallet information to enhance the fingerprints they generate."
+  - [connected DApps leaking wallet addresses] 211 of 616 connected DApps (35%)
+      quote (results): "Our framework identified 211 unique DApp websites (35% of the connected DApps) which leak the user's wallet address across 137 unique third-parties."
+  - [wallet extensions leaking wallet addresses] 13 of 100 extensions
+      quote (results): "We found 13 out of 100 analyzed extensions which leak the user's wallet address to at least one of 24 third-parties."
+  - [blocked third parties] 60 of 108 checked third parties (56%) blocked by all five combined
+      quote (results): "the combination of all five blocklists results in blocking 60 third-parties (56%)"
+  IEEE-SP/2024/targeted-and-troublesome-tracking-and-advertising-on-childrens-websites  (8 of 8 detection tuples carry a prevalence string)
+  - [number of verified websites] 2,004 websites in 48 languages
+      quote (results): "Our final list contained 2,004 websites in 48 distinct languages after eliminating false positives and deduplicating websites by their registrable domain"
+  - [share of crawled pages with ads] 36% of pages contained one or more ads
+      quote (results): "An average of 36% of the pages contained one or more ads"
+  - [share of pages and disclosed ads] 27% of crawled pages; 73% of 40,281 disclosed ads
+      quote (results): "targeting was enabled for 73% of the ads with disclosures"
+  - [share of sites with tracker domains] around 90% of websites
+      quote (results): "We find that around 90% of the websites have at least one tracker domain, and over 93% embed at least one third-party domain."
+  - [share of sites] 9% in Frankfurt and 10% in NYC desktop crawls
+      quote (results): "we detect fingerprinting scripts on 176 (9%) and 218 (10%) websites in Frankfurt and NYC crawls, respectively."
+  - [number of ads] 1,003 improper ads across 311 distinct websites
+      quote (results): "Table 5 shows the number of improper ads identified in each crawl, amounting to 1,003 across 311 distinct websites."
+  - [flagged links] 149 of nearly 3,940 links flagged malicious or phishing
+      quote (results): "149 of the nearly 3,940 scanned links were flagged as malicious or phishing by at least one scan engine."
+  - [accuracy and error shares] 85% correctly detected; 7.5% false non-ads and 7.5% blank or empty ads
+      quote (evaluation): "The crawler correctly detected ads in 85% of cases, misidentified non-ads in 7.5%, and captured blank or empty ads in 7.5%."
+  PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework  (8 of 8 detection tuples carry a prevalence string)
+  - [share of publishers] 821 of 10,000 publishers (8.2%) in Crawl 1
+      quote (results): "In Crawl 1 we detected the presence of the USP API on 821 (8.2%) publishers."
+  - [share of publishers] 358 of 10,000 publishers (3.6%) stored a USP String in a cookie
+      quote (results): "In our data from Crawl 1 we detect the USP String value being stored in a cookie on 358 (3.6%) publishers out of 10 K"
+  - [share of requests containing injected opt-out value] 354,416 of 421,497 requests (84.1%) contained 1YYN
+      quote (results): "421,497 HTTP requests contained a URL with a USP parameter, of which 354,416 (84.1%) contained our chosen USP String value of 1YYN."
+  - [share of A&A chains rooted at USP-API publishers] 218,541 of 1,214,540 chains (17.9%) contained at least one USP String transmission
+      quote (results): "There are 1,214,540 A&A inclusion chains rooted in the 821 publishers that implement the USP API, of which 218,541 (17.9%) contained at least one HTTP request transmitting the USP String."
+  - [share of A&A pairs sharing in every chain] 47.1% of A&A pairs shared the USP String in all observed chains
+      quote (results): "only 47.1% of A&A pairs share the USP String in all chains in which they appear."
+  - [share of USP-API publishers setting opt-out] 380 of 825 publishers (46.1%) set the USP String to opt-out
+      quote (results): "In Crawl 3, when GPC was enabled, 380 out of 825 (46.1%) publishers with the USP API set the USP String to opt-out."
+  - [tracking pixels per publisher] No statistically significant reduction for most crawl comparisons
+      quote (results): "GPC and a USP String set to opt-out do not significantly reduce the number of tracking pixels embedded in publishers"
+  - [false-positive and false-negative rates] 2% false positives; zero false negatives in sampled negatives
+      quote (methodology): "Our crawler successfully detected the USP API on 49 websites, yielding a false positive rate of 2%."
+  WWW/2024/the-double-edged-sword-identifying-authentication-pages-and-their-fingerprinting  (6 of 6 detection tuples carry a prevalence string)
+  - [share of visited pages] 9.2% of visited pages
+      quote (results): "Table 5 shows that 9.2% of the pages our crawler visited were flagged as fingerprinting."
+  - [share of authentication pages] 10.2% of login and sign-up pages
+      quote (results): "when we consider only login and sign-up pages, the percentage rises slightly to 10.2%"
+  - [share of fingerprinting homepages] 93.10% of fingerprinting homepages
+      quote (results): "nearly every homepage that performs fingerprinting engages in canvas fingerprinting (93.10%)."
+  - [share of fingerprinting scripts] 50.50% on login pages and 55.65% on sign-up pages
+      quote (results): "home pages have the highest rate of tracking at 61.46%, compared to login pages at 50.50% and sign-up pages at 55.65%."
+  - [share of domains fingerprinting on both pages] 505 of 515 domains (98.06%)
+      quote (results): "Of these 515 domains, 505 (98.06%) used scripts from the same set of third parties"
+  - [manually inspected websites] Disruptions observed on deezer.com and hepsiburada.com
+      quote (results): "Due to the scalability challenges, we conducted a manual inspection of 30 websites where fingerprinting attempts were detected on login pages."
+  IMC/2025/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th  (7 of 7 detection tuples carry a prevalence string)
+  - [share of successfully crawled sites] 12.7% of 16,276 popular sites; 9.9% of 17,260 tail sites
+      quote (results): "Of the 16,276 popular sites crawled successfully, 2,067 (12.7%) of them extracted at least one fingerprintable canvas."
+  - [number of unique fingerprinting canvases and site reach] 504 popular-site canvases and 288 tail-site canvases
+      quote (results): "Popular sites generated a total of 504 unique fingerprinting canvases, and tail sites generated 288."
+  - [sites linked to vendors] Akamai reached 485 popular and 205 tail sites; FingerprintJS reached 462 and 298
+      quote (results): "Akamai has the greatest reach of any one fingerprinting service. Its unique test canvas was generated on 485 (23%) popular sites and 205 (12%) tail sites."
+  - [share of test canvases] 45% of top-20k and 37% of tail test canvases matched at least one list
+      quote (results): "Nearly half (45%) of test canvases in the top 20k sites and over one-third (37%) in the tail 20k sites are generated by a script that has been included in one of the three lists."
+  - [reduction in generated test canvases and sites] The number of test canvases and sites decreased by about 5%.
+      quote (results): "Under both crawls with ad blockers, the number of test canvases generated, and the number of sites that generate at least one test canvas, only decreased by about 5%."
+  - [share of fingerprinting sites] 49% of top-20k and 52% of tail sites had a first-party-rendered test canvas
+      quote (results): "49% of the top 20k and 52% of the tail 20k sites engaging in canvas fingerprinting have at least one test canvas rendered by a script that is served first-party."
+  - [share of fingerprinting sites] 45% had at least one test canvas generated and extracted twice
+      quote (results): "Nearly half of them perform this canvas inconsistency check: 45% of them have at least one test canvas that was generated and extracted twice."
+  PETS/2025/referrer-policy-implementation-and-circumvention  (6 of 6 detection tuples carry a prevalence string)
+  - [share of distinct websites] 48.38% of websites implemented document-wide referrer policies
+      quote (abstract): "Our findings reveal that 48.38% of websites implement document-wide referrer policies"
+  - [share of distinct websites] 13.39% of websites applied element-specific referrer policies
+      quote (abstract): "13.39% apply element-specific referrer policies."
+  - [share of distinct websites] 77.20% of websites had at least one circumvention
+      quote (results): "RP circumventions were identified on 77.20% of the websites (Table 10) and in 11.57% of the third-party requests"
+  - [share of distinct websites] 21,084 websites, or 76.91%, had full URL circumventions
+      quote (results): "Circumventions with full URL leaks were observed in 21,084 websites, corresponding to 76.91% of the studied websites."
+  - [share of distinct websites] 2,704 websites, or 9.86%, had partial URL circumventions
+      quote (results): "Circumventions with partial URL (path and/or query), on the other hand, were detected on 2,704 websites (9.86%)"
+  - [share of distinct websites] location.href was accessed on 89.63% of SF-crawled websites
+      quote (results): "The location.href property, which contains the full URL, was accessed on 89.63% of the websites."
+  PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic  (4 of 4 detection tuples carry a prevalence string)
+  - [share of collected advertisements] 35.87% of ads were problematic
+      quote (conclusion): "Overall, 35.87% of the ads were found to be problematic."
+  - [difference in problematic-ad proportions] 13.6% overall increase; 17.6% US and 21.8% under-18
+      quote (introduction): "Our findings reveal a significant increase of 13.6% in the number of problematic ads shown to ABP's users on average compared to users with no adblocker installed"
+  - [share of under-18 advertisements] 9.57% of ads shown to underage users violated regulations
+      quote (conclusion): "9.57% of ads shown to underage users violated regulations"
+  - [problematic-ad ratio difference] 34% increase, from 0.49 control to 0.67 treatment
+      quote (results): "we see a significant 34% increase in the problematic ad ratios from control (0.49) to treatment (0.67)."
+  USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost  (5 of 5 detection tuples carry a prevalence string)
+  - [number of sites establishing localhost connections] 15,819 EU sites and 17,368 USA sites
+      quote (results): "When visited from the EU and the USA, our crawls identify 15,819 and 17,368 sites establishing localhost connections"
+  - [share of localhost cases attributable to Meta] Meta accounted for 99.1% of EU cases and 99.2% of USA cases
+      quote (results): "with Meta accounting for 99.1% of EU cases and 99.2% of the USA cases."
+  - [share of HTTP(S) localhost cases attributable to Yandex] Yandex accounted for 95.0% of EU cases and 95.1% of USA cases
+      quote (results): "of which Yandex is responsible for 95.0% and 95.1% of these cases, respectively."
+  - [share of sites triggering communications without consent] Meta: 75.8% EU and 78.2% USA; Yandex: 84.4% EU and 83.5% USA
+      quote (results): "localhost communications were triggered without user consent by Meta Pixel. Yandex Metrica triggered localhost communications on 84.4% (EU), 83.5% (USA) of websites without user consent."
+  - [observed deployment span] Yandex observed since February 2017; discontinued June 3, 2025
+      quote (results): "Yandex has used localhost channels since February 2017 ... until June 3rd 2025, when Yandex discontinued the practice"
+=== H. Current-tool interpretation ===
 The corpus identifies TRC users in 2021–2026. The complete 2021–2024 count is historical evidence; the 2025–2026 count is a provisional current-use signal, not a prevalence estimate for the field.
 No query here claims that TRC supersedes OpenWPM. The repositories were checked separately for current maintenance and the page compares capture surfaces rather than ranking one as a standard.
 </file>
-===== Paper evidence and quote checks =====
+''trc_paper_detail.mjs'' prints the same ten papers' full ''crawlConfig'', ''population'' and ''detection'' records, one field per line, and is not reproduced here because sections F and G above carry everything the page uses from it.
-The script's 10 evidence tuples were checked against the corresponding ''paper.cols.txt'' files under ''/workspace/publications_dataset/data/fulltext/<year>/<venue>/<slug>/''. Two quotes matched after whitespace normalization; eight matched as a 5--10-word run after compacting column/page-break punctuation. The partial status is a repaired-column-layout artifact, not an unsupported citation: the surrounding sentence in each source states the Collector use. No quote was unlocatable. The exact result is 2 exact, 8 partial, 0 not located, 10 tuples checked.
+===== 6. Quotes checked =====
-The checked papers and the measurement detail used on the page are:
+All 10 evidence quotes behind the adoption count were checked against ''/workspace/publications_dataset/data/fulltext/<year>/<venue>/<slug>/paper.cols.txt''. The first run reported "2 exact, 8 partial, 0 not located" and explained every partial as a repaired-column artefact. Both halves of that were wrong, and the checker is now stricter in two ways (§10.2, §10.3):
+  * **Anchored windows.** A sliding-window match is not a check unless the window contains the phrase the claim rests on. Every accepted window must now contain ''tracker radar collector'' in normal or compacted form; a run matching only outside it is graded ''unanchored'' and counted separately. The window search also now runs to 12 words.
+  * **Case-explicit grading.** ''normal()'' lowercases, so ''exact'' had always meant case-insensitive-exact. The checker now also tests the raw source and reports ''exact-except-case'' separately.
+The result is now **1 verbatim, 1 exact except capitalisation, 8 partial, 0 unanchored, 0 not located**.
+^ Corpus record ^ Grade ^ Why the grade, and what was read around the quote ^
+| PETS 2021, ''The CNAME of the Game'' | 12-word-compact | A subsection heading and a running page footer are spliced mid-sentence and "DevTools" is split "Dev-/Tools" across a page break. TRC is Puppeteer/CDP; the fork captured HTTP-request cookies, POST data, ''document.cookie'' assignments and cookie-setting scripts, with fresh profile, wait and reload. {[dimova2021cname]} |
+| USENIX 2022, ''Leaky Forms'' | 6-word-compact | Two-column interleaving inserts an unrelated right-column sentence mid-bullet. TRC extended with interactive form filling, inner-page discovery, Fathom, Consent-O-Matic, API/cookie/request collectors, CDP stacks, WebSocket and POST/input capture. {[senol2022_leaky]} |
+| USENIX 2023, ''Is Your Wallet Snitching on You?'' | 8-word-compact | **Edited fragment.** The source reads "...to track users on the web. For that purpose, //we// use Duck-DuckGo's Tracker Radar Collector (TRC) [19] to crawl popular websites..." — the extraction dropped the leading clause and capitalised the mid-sentence "we". The sentence supports the claim. {[torres2023_wallet]} |
+| IEEE S&P 2024, ''Targeted and Troublesome'' | **verbatim** | The only genuinely verbatim quote: lowercase "we" preserved, no edit. {[moti2024_targeted]} |
+| PETS 2024, ''Johnny Still Can't Opt-out'' | 10-word-compact | Exact except a bracketed ''[54]'' dropped and a trailing comma trimmed. The paper reused TRC code for DOM cookie-method breakpoints, stack traces and values; it does not claim these are default TRC output. {[aziz2024_johnny]} |
+| WWW 2024, ''The Double Edged Sword'' | 11-word-compact | A footnote marker "5" is glued inline between "(TRC)," and "a crawler created by DuckDuckGo". {[senol2024_double]} |
+| IMC 2025, ''Canvassing the Fingerprinters'' | **exact except case** | **Was published as "exact" and is not.** The source reads "To record Canvas API calls on a page, //we// modified DuckDuckGo's Tracker Radar Collector [22], a Puppeteer-based Web crawler." The extraction dropped the leading clause and capitalised "we". Verified: exact substring present ''False'', lowercase-"we" variant present ''True''. {[luo2025_canvassing]} |
+| PETS 2025, ''Referrer Policy'' | 9-word-compact | **Edited fragment**, same pattern: the source begins "To measure RP usage and circumventions across websites, //we// extended...". {[zagi2025_referrer]} |
+| PETS 2025, ''Sheep's Clothing, Wolfish Intent'' | 10-word-compact | Footnote "1" glued to "collector" and ''[12]'' dropped; "To collect ads, we utilized..." genuinely is sentence-initial. {[roongta2025_sheep]} |
+| USENIX 2026, ''Bridges to Self'' | 12-word-compact | "DuckDuckGo's" rendered "Duck-DuckGo's" and ''[46]'' dropped; "We perform web crawls..." genuinely is sentence-initial. {[vlummens2026_bridges]} |
+So **six** of the partials are extraction or column-repair artefacts and **three** quotes are edited fragments that drop a leading clause and recapitalise a word. None is a fabrication and none is unlocatable, but the page no longer describes any of them as verbatim.
+==== 6.1 Claim-to-source attribution ====
+Pass (b) checked **every clause of every row** of the ten-paper table against that paper's own full text — the long technical lists ("inner-page discovery, email/password filling, Fathom and Consent-O-Matic, browser-API/cookie/request collection, CDP breakpoints with JavaScript stacks, WebSocket capture and POST/input observations" and the like), which are exactly where a weak model confabulates. **Every clause was supported. No confabulated clause in any row.** That is the strongest single result of this review and it is worth recording as a pass, not just as an absence of findings.
+==== 6.2 The three denominators the page publishes ====
+Read in the papers, not taken from ''detection[].prevalence'', because ''metric'' names the unit and often not the population.
+^ Paper ^ What was verified in the source ^
+| {[senol2022_leaky]} | Table 7: ''Leaky/ Filled Sites — EU Desktop 1,844 / 60,008 (3.0%); US Desktop 2,950 / 60,999 (4.8%); Mobile 1,745 / 55,738 (3.1%) and 2,744 / 57,715 (4.8%)'', captioned "The number of sites leaking emails or passwords to trackers, compared to the number of sites where we could fill an email address". The crawl was the Tranco top 100,000. The extraction's prevalence string is "1,844 EU websites and 2,950 US websites" with **no denominator at all** |
+| {[torres2023_wallet]} | "TRC was able to crawl 96,905 out of 100K websites successfully (i.e., 96.91%). We found 1,114 unique scripts on 1,325 websites which made in total 1,517 JavaScript calls..." |
+| {[luo2025_canvassing]} | "Of the 16,276 popular sites crawled successfully, 2,067 (12.7%) of them extracted at least one fingerprintable canvas." |
+**A regex note, recorded because it nearly produced a false finding.** The first probe for the wallet paper's denominator was ''96,?905'' over whitespace-collapsed text and returned **zero hits in every rendering** — which looked like the extraction had invented a denominator. The PDF renders it ''96, 905'': comma, space, digits. Widening to ''96,?\s?905'' found it in ''paper.txt'', ''paper.cols.txt'' and ''paper.norm.txt''. Collapsing whitespace is not enough when the digits themselves are split.
+===== 7. Installing and running it: every command =====
+The page's install section is written from a real checkout and a real crawl, not from the README. What was run, in order:
+<code bash>
+git clone https://github.com/duckduckgo/tracker-radar-collector.git sandbox/trc
+git -C sandbox/trc checkout 8b64006691a1ce3929cfdfeeb425e7cc64be6543
+cd sandbox/trc && npm i --no-audit --no-fund      # added 445 packages in 5s
+node ./cli/crawl-cli --help                        # published verbatim on the page
+# CLI attempt, aarch64 host:
+node ./cli/crawl-cli -u https://example.com -o /tmp/trcout -d requests,cookies,apis,targets -v
+#   Error: Failed to launch the browser process!
+#   rosetta error: failed to open elf at /lib64/ld-linux-x86-64.so.2
+#   Max number of retries (2) exceeded for "https://example.com".
+#   ✅ Finished successfully.   <-- on 0/1 successful crawls
+#   Sucessful crawls: 0/1 (0.00%)
+# Module route, which works:
+TRC_UNSAFE_DISABLE_SANDBOX=1 \
+PUPPETEER_EXECUTABLE_PATH=/workspace/.playwright/chromium-1234/chrome-linux/chrome \
+node scripts/trc_smoke.mjs /workspace/artifacts/wiki/sandbox/trc out/trc_smoke
+#   [trc] crawling https://example.com/
+#   [trc] wrote out/trc_smoke/https_example_com_.json
+#   [trc] crawling https://www.wikipedia.org/
+#   [trc] wrote out/trc_smoke/https_www_wikipedia_org_.json
+# and one consent run, against a site with a real CMP:
+#   collectorFlags: {autoconsentAction: 'optOut'}, CookiePopupsCollector + CookieCollector
+#   -> cookiepopups keys ["cmps","performance","scrapedFrames"]
+#      cmps: [{"final":false,"name":"Sourcepoint-frame","open":false,"started":false,
+#              "succeeded":false,"selfTestFail":false,"errors":[],"patterns":[],
+#              "snippets":[],"filterListMatched":false}]
+#      3 cookies set anyway
+</code>
-^ Corpus record ^ Quote-check result ^ Detail read around the evidence quote ^
+Two facts about this that belong in a log rather than on the page:
-| PETS 2021, ''The CNAME of the Game'' | 10-word | TRC is Puppeteer/CDP; the fork captured HTTP-request cookies, POST data, ''document.cookie'' assignments and cookie-setting scripts, with fresh profile/wait/reload. {[dimova2021cname]} |
-| USENIX 2022, ''Leaky Forms'' | 7-word-compact | TRC was extended with interactive form filling, inner-page discovery, Fathom, Consent-O-Matic, API/cookie/request collectors, CDP stacks, WebSocket and POST/input capture. {[senol2022_leaky]} |
-| USENIX 2023, ''Is Your Wallet Snitching on You?'' | 8-word-compact | TRC was used for popular-site measurement with wallet API breakpoints/simulation and network/cookie observations. {[torres2023_wallet]} |
-| IEEE S&P 2024, ''Targeted and Troublesome'' | exact | The authors extended TRC and added ad/fingerprint collection, anti-bot and mobile settings. {[moti2024_targeted]} |
-| PETS 2024, ''Johnny Still Can't Opt-out'' | 10-word-compact | The paper reused TRC code for DOM cookie-method breakpoints, stack traces and values; it does not say these are default TRC output. {[aziz2024_johnny]} |
-| WWW 2024, ''The Double Edged Sword'' | 10-word | The crawler was a TRC fork for authentication-page and fingerprinting analysis. {[senol2024_double]} |
-| IMC 2025, ''Canvassing the Fingerprinters'' | exact | Canvas arguments, return values, source and timestamps were added, alongside anti-bot, scrolling and consent automation. {[luo2025_canvassing]} |
-| PETS 2025, ''Referrer Policy'' | 9-word-compact | The fork added inner-page links, Referer/Referrer-Policy, POST bodies, the page's ''referrerPolicy'' and API collection. {[zagi2025_referrer]} |
-| PETS 2025, ''Sheep's Clothing, Wolfish Intent'' | 10-word-compact | TRC was used to collect advertisements for automated evaluation. {[roongta2025_sheep]} |
-| USENIX 2026, ''Bridges to Self'' | 10-word-compact | The custom TRC crawl added anti-bot handling, WebSocket frames, WebRTC APIs and Priv-Accept observations. {[vlummens2026_bridges]} |
-The report output above is the primary quote log; no paper claim was added from a free-text tool tuple without a source quote.
+  * The %%<file javascript trc_smoke.mjs>%% block on the content page is **byte-identical** to the committed ''scripts/trc_smoke.mjs''. The committed file was regenerated from the page block and the published block was then downloaded from ''?do=export_code'' and run verbatim: it produced both JSON files. A published script that is an abridged sample of the real one has caused a defect on this wiki before.
+  * The published ''example.com'' JSON is a real capture, but ''size'' is not reproducible. A second run of the same script against the same URL gave ''size: 474'' where the published block says ''473'', with an **identical** ''responseBodyHash''. That is what led to the ''encodedDataLength'' pitfall on the page: ''RequestCollector.js'' sets ''request.size = data.encodedDataLength'' from ''Network.loadingFinished'' — wire bytes including headers — and coerces negatives to ''null'' with the comment "make sure we can use unsigned int for this field in clickhouse". The discrepancy is disclosed on the page rather than hidden by re-pasting the second run.
-===== External and industry sources =====
+===== 8. External sources =====
-The external pass used primary DuckDuckGo repositories only. Each was fetched/read on 2026-08-14 and pinned below by the main-branch commit recorded in the bibliography. Claims about the output schema come from source files, not a README summary alone.
+Every external fact re-fetched on 2026-09-03. Claims about the output schema come from source files and from real output, never from a README summary.
 ^ Source ^ Verification and load-bearing use ^
-| [[https://github.com/duckduckgo/tracker-radar-collector|DuckDuckGo tracker-radar-collector]], commit ''8b64006691a1ce3929cfdfeeb425e7cc64be6543'' | Read the README/package metadata and the crawler, collector-list, request, cookie, API-call, cookie-popup, screenshot and metadata-file implementations. Verified Puppeteer/CDP architecture, CLI flags, top-level result shape, collector keys, request fields, cookie omission, API output and metadata fields. {[duckduckgo_trc_2026]} |
+| [[https://doi.org/10.1145/3366423.3380113|ahmad2020_apophanies]] | Read in ''paper.cols.txt''. Verified verbatim: "a qualitative comparative evaluation of a selected set of **eight** crawling tools", "there were **932 unique domains** (of which 30 domains were removed as they returned SOA records) which were crawled by each of our workers", and "the choice of crawler has a critical impact on the data generated". The page quotes the 932 as the paper words it rather than saying "over 932", because 30 were then dropped. |
-| [[https://github.com/duckduckgo/tracker-radar|DuckDuckGo tracker-radar]], commit ''a1d894db2312f3fdeea06d6c784739b97eb727c8'' | Read README, ''docs/DATA_MODEL.md'' and generated-data documentation. Verified that Tracker Radar is a behavior/domain/entity dataset rather than the Collector, and checked region files, prevalence, resources, cookie/fingerprinting/CNAME fields and generated maps. {[duckduckgo_tracker_radar_2026]} |
+| [[https://www.usenix.org/conference/usenixsecurity23/presentation/sanchez-rola|sanchezrola2023_rods]] | Read in ''paper.cols.txt''. Verified verbatim, including the resolution the page leans on: "we analyzed a random sample of 1, 000 phishing websites using both techniques. In total, we found 728 websites calling fingerprint-related APIs. Our crawler was able to detect and log all invocations, while OpenWPM missed calls in 348 (47.8%) of the websites. The main reason behind this result lies in the fact that OpenWPM monitors a smaller set of fingerprinting APIs ... In this experiment 48 different types of APIs calls were detected, out of which Open-WPM supported only 36 ... After this update, both our crawler and OpenWPM were able to detect all the 2092 calls performed on the test set". Publishing only the 47.8% would have inverted the paper's own conclusion. |
-| [[https://github.com/duckduckgo/tracker-radar-detector|DuckDuckGo tracker-radar-detector]], commit ''0f6eb7db39bbf7cf7357db7279535941e1c0eb4b'' | Read README/configuration and the crawl-processing/build scripts. Verified that Detector reads site JSON/Postgres, processes requests/cookies/APIs, has ''minSites'' and first-party/CNAME options, aggregates prevalence and builds region tracker entries. {[duckduckgo_tracker_radar_detector_2026]} |
+| [[https://github.com/duckduckgo/tracker-radar-collector|duckduckgo/tracker-radar-collector]] | Clone at ''8b64006...''; ''main'' at ''4ad2472b...'' (2026-08-24), and ''git diff %%--stat%% 8b64006..HEAD'' is ''.github/workflows/asana-sync.yml'' (+25) and one deleted test line (-2), reproduced independently by two passes. Read ''crawler.js'', ''crawlerConductor.js'', ''constants.js'', ''cli/crawl-cli.js'', ''cli/crawlConfig.js'', ''cli/metadataFile.js'', ''browser/*'', ''helpers/*'' and all nine collectors. {[duckduckgo_trc_2026]} |
+| [[https://github.com/duckduckgo/tracker-radar|duckduckgo/tracker-radar]] | ''pushed_at'' 2026-09-02, so genuinely current; the pinned ''a1d894db...'' (2026-08-12) is a real ancestor two commits behind HEAD. All four generated files present and populated: ''domain_map.json'' 10.4 MB, ''entity_map.json'' 4.7 MB, ''domain_summary.json'' 16.3 MB, ''data_by_site.json'' 20.1 MB. ''docs/DATA_MODEL.md'' matches the page's field description including ''exampleSites''. {[duckduckgo_tracker_radar_2026]} |
+| [[https://github.com/duckduckgo/tracker-radar-detector|duckduckgo/tracker-radar-detector]] | ''"archived": false, "pushed_at": "2025-03-31T15:00:37Z"''. The pinned ''0f6eb7db...'' **is** HEAD — no commit in roughly seventeen months, no deprecation notice. ''config.json'' line 2 is ''"minSites": 2,'', used at ''src/trackers/classes/crawl.js:72''; ''keepFirstParty'' and ''treatCnameAsFirstParty'' confirmed in ''config.json'' and ''site.js:152,174''. {[duckduckgo_tracker_radar_detector_2026]} |
+| ''@duckduckgo/autoconsent'' | TRC pins autoconsent at ''16.8.1'' or newer (a caret range) at both commits; installed 16.8.1; latest published 16.35.0. The installed ''CHANGELOG.md'' line 142 onwards: ''# v16.0.0 (Tue Jun 23 2026)'' / breaking changes "Drop support for consent-o-matic rules (#1393)" and "Remove EasyList and filterlist support (#1399)". This is the source for two page corrections. |
+| [[https://nodejs.org/en/about/previous-releases|nodejs.org previous-releases]] and [[https://raw.githubusercontent.com/nodejs/Release/main/schedule.json|nodejs/Release schedule.json]] | Both HTTP 200. Pass (c) reported the EOL dates from the HTML page; the coordinator re-fetched and could not find them in that page's text, so the canonical ''schedule.json'' was fetched as well and confirms them: ''v18 end 2025-04-30'', ''v20 end 2026-04-30'', ''v22 maintenance 2025-10-21'', ''v24 maintenance 2026-10-20'', ''v26 start 2026-05-05''. The HTML page's own status fields read EOL for 18 and 20, LTS for 22 and 24, Current for 26 — so pass (c) was right and the page now cites the machine-readable source and adds Node 26. |
+| npm registry | Puppeteer latest 25.9.0, so TRC's caret range on ''24.7.1'' is one major behind and resolves cleanly. Recorded, not published as a defect. |
+| [[https://doi.org/10.56553/popets-2024-0120|popets-2024-0120]], [[https://doi.org/10.56553/popets-2025-0142|popets-2025-0142]], [[https://doi.org/10.56553/popets-2025-0092|popets-2025-0092]] | Fetched with ''-L'' and a browser User-Agent, all HTTP 200 to ''petsymposium.org''. ''citation_publication_issue'' = 4, 4 and 3 respectively. The first two were recorded as issue 3 in the shared bibliography and were corrected. |
-Rejected during the external pass:
+==== 8.1 Sources rejected ====
-  * SEO “best scraper” and “top web crawler” listicles: no source-level schema or Tracker Radar provenance, so they were not used for architecture, currency or recommendations.
+  * SEO "best scraper" and "top web crawler" listicles: no source-level schema or Tracker Radar provenance. Not used for architecture, currency or recommendations. Carried over from the first run's rejection list, and re-affirmed.
-  * Unverified vendor summaries and search-result snippets: useful for discovery at most, but not primary evidence for a field or a current maintenance claim.
+  * Unverified vendor summaries and search-result snippets: discovery at most, never primary evidence for a maintenance claim.
-  * A claim that TRC is the industry or research standard: rejected because the repositories show an active project, while the corpus has no matched comparison and only 10 identified research users under the narrow query.
+  * "TRC is the industry or research standard": rejected. The repositories show an active project; the corpus has 10 identified research users under the narrow query and no matched comparison.
+  * **The TRC README as a source for defaults.** Rejected during this run, having been accepted during the first. It is stale on ''maxLoadTimeMs'' (2022-01-13, never updated; code changed 2025-07-08), on the "hard limit of 38" crawlers (removed in ''963f9ec'', 2025-04-16) and on a ''browserContext'' option the code does not have. Two of the four review passes independently re-confirmed the README's 30 s rather than the code's 60 s, so this is not a mistake only a cheap model makes.
-===== What could not be established =====
+===== 9. What could not be established =====
-  * The corpus contains no formal TRC paper and no same-sample, same-browser, same-question comparison of TRC with OpenWPM or plain Playwright. The page does not rank accuracy, speed, coverage or “best” tool.
+  * The corpus contains no formal TRC paper and **no same-sample, same-browser, same-question comparison of TRC with OpenWPM or a plain Playwright crawl**. Pass (d) searched for one specifically — regex sweeps for comparison language near crawler names over all 5,855 papers, plus an extraction join for papers naming OpenWPM together with Playwright, TRC or Puppeteer — and found two papers that compare crawler architectures without involving TRC ({[ahmad2020_apophanies]}, {[sanchezrola2023_rods]}). Both are now cited on the page. The negative claim is scoped to "no paper in these seven venues compares TRC with another instrument on the same sample", never to "nobody has compared crawlers".
-  * The 10/1,120 figure is adoption in seven selected venues under an extraction query, not field prevalence, commercial usage or the share of all web measurement.
+  * The 10/1,120 figure is adoption in seven selected venues under an extraction query. It is not field prevalence, commercial usage, or a share of all web measurement.
-  * The 2025--2026 signal is provisional. It cannot support a complete end-of-year trend, especially for unheld or under-selected venue-years.
+  * The 2025--2026 slice is provisional and cannot support an end-of-year trend.
-  * The public repositories document the pipeline and current source, but do not establish that every production Tracker Radar release used the public defaults or that the current schema is stable across commits.
+  * Whether DuckDuckGo has said anything publicly about ''tracker-radar-detector'''s dormancy. No archive flag, no README notice, nothing either way. The page states the dormancy as an observed fact and draws no conclusion about intent.
-  * The page does not infer cookie values, cookie set timing or request bodies from TRC's default output. The default CookieCollector is a final jar snapshot and the default request record has no raw bodies.
+  * Whether ''screenshots'' and ''trace'' behave as described, and whether the fork-only capabilities do. Those rows are checked against source only; ''requests'', ''cookies'', ''apis'', ''targets'' and ''cookiepopups'' were checked against real output.
-  * No independent benchmark was run. The content page's comparison is a source/schema comparison and a warning about denominators and capture surfaces.
+  * The extraction's ''crawlConfig'', ''ethics'' and ''artifacts'' objects **share one evidence quote per paper**, so no single key in the ''crawlConfig'' survey is independently quote-checked. The page says so in a box rather than presenting the row totals as verified per-key counts.
+  * No performance benchmark was run. One two-site crawl proves the tool starts and what it emits; it says nothing about throughput, failure rates at scale, or bot detection.
-===== Judgement calls =====
+===== 10. Review log =====
-  * I created a new page because the sitemap/parent index already names this exact missing page, and the topic has a distinct implementation/data-pipeline question. I did not broaden or overwrite the OpenWPM page.
+Five passes over the **published** pages, each told explicitly that the author's context might not be exhaustive and to verify from primary sources. Every pass was handed the page text, the provenance text, the report script, its real output, the recall probe and its output, and the two neighbouring pages. Findings are recorded whether accepted or rejected: a rejection is the only record of whether a reviewer earns its slot.
-  * I counted only ''crawler-framework''/''browser-automation'' tuples marked used/produced. “Tracker Radar Entity Map” and similar names remain printed residue, not silent exclusions.
-  * I describe TRC as current/available as of the 2026-08-14 repository check, but describe 2021--2024 use as historical and 2025--2026 use as a provisional signal. I did not call older OpenWPM-style methods superseded: the evidence shows different capture surfaces, not replacement.
-  * I used paper-level counts for every published adoption figure. Raw tuple counts appear only in the provenance audit, where they expose name normalization.
-  * I retained the broad 21 and excluded 11 only as a boundary check. Publishing 21 as TRC adoption would have conflated a dataset and entity map with a crawler.
-===== Review log =====
+==== 10.1 Coordinator's own pass (opus), by running the tool ====
-The requested focused review categories were executed as checks by the primary run because no Agent/subagent capability was exposed in this environment. Findings and disposition:
+^ # ^ Finding ^ Action ^
+| X1 | **Blocking.** "the README documents a default maximum page-load window of 30 seconds" — the code fallback in ''crawler.js'' is ''options.maxLoadTimeMs'' or-else ''60000''. The page published a README error as a default | **accepted**; the page now states 60 s and makes the divergence the pitfall |
+| X2 | The page says values need added instrumentation, but ''set-cookie'' is in ''RequestCollector'''s nine-header default safelist, so HTTP-set cookie values, ''HttpOnly'', ''Secure'', ''SameSite'' and ''Expires'' are already in the default output — shown in real output from wikipedia.org | **accepted**; the cookie row and the schema table now say so, and the safelist is named |
+| X3 | ''expires'' is milliseconds (''Math.floor(cdpDate * 1000)''), and ''-1'' becomes ''undefined'' so the key is **absent**; ''sameSite'' likewise. Real output has 5 keys on one cookie and 6 in the union | **accepted**, both stated |
+| X4 | "The CLI can use a fresh context" — there is no such flag; ''LocalChrome'' mkdtemps a profile unconditionally. Meanwhile the README offers a ''browserContext'' option that exists only in the README | **accepted**; the page now says a fresh temp profile is unconditional and cannot be turned off from the CLI |
+| X5 | The CLI cannot be pointed at a browser you already have (no ''%%--executable-path%%''; ''PUPPETEER_EXECUTABLE_PATH'' ignored), and Chrome for Testing has no linux-arm64 build, so the CLI cannot start on aarch64 | **accepted**; new install section with the real error |
+| X6 | No published command, no %%<file>%% block, no evidence the tool was ever run — unlike every sibling crawler page | **accepted**; ''%%--help%%'', a runnable script and real output are now published |
+| X7 | The OpenWPM comparison rests on "TRC = Puppeteer/CDP vs OpenWPM = Selenium/Firefox", but TRC has ''%%--selenium-hub%%'' and a ''selenium-webdriver'' dependency | **accepted in part**; pass (c) established that Selenium only provisions a remote **Chrome** and CDP is still the instrument, so the conclusion stands and the sentence was corrected rather than the row |
+| X8 | ''targets'' on a real crawl is one row, ''{"type":"page","url":"about:blank"}'' — the URL is captured at attach time | **accepted**, stated in the schema table |
+| X9 | The ''CollectorData'' typedef is in ''helpers/collectorsList.js'' and omits ''trace'' while declaring ''elements'' | **accepted**; the page now names the file and says the typedef is not the authority |
+| X10 | ''DEFAULT_USER_AGENT'' is a hard-coded macOS ''Chrome/135'' string and emulation is on by default | **accepted**, now a pitfall |
+| X11 | The crawler index publishes 21 for "Tracker Radar Collector" while this page publishes 10 | **accepted**; reconciled on both pages, see §2.2 |
+| X12 | The index's "caps concurrency at 38" is a README claim removed from the code in 2025-04-16 | **accepted**; the index bullet was rewritten |
+| X13 | No pitfalls, install, papers-to-read-first or related-pages section, unlike every sibling | **accepted**, all four added |
+| X15 | ''metadata.json'''s ''config'' writes every field with a falsy-coalescing default to ''undefined'', so ''filterOutFirstParty: false'' produces no key; and ''projectVersion'' has been ''1.0.0'' since the initial commit | **accepted**, both stated |
+| X16 | A real ''optOut'' run detected a Sourcepoint CMP and never acted on it (''started'', ''succeeded'' both false) while three cookies were set | **accepted**; "detection is not action" is now a pitfall and the checklist asks for the success rate |
+| X18 | Headless is a hard-coded ''const VISUAL_DEBUG = false'' with no flag; statefulness is a module-only choice. So the 8-of-10 "not stated" in the ''crawlConfig'' survey is mostly "nothing to state", not under-reporting | **accepted**; the survey table now says which kind of silence it is |
-^ Review pass ^ Finding ^ Disposition ^
+X14 (the revision-log timing of the first run) and X17 (the script repairs) are recorded in §1.1 and §10.2 rather than as page changes. X19 is §6.2.
-| Figures vs script | Re-ran ''node scripts/report_tracker_radar_collector.mjs''; the 10/1,120 count, 21/11 boundary, 58 OpenWPM context count, year cells, percentages, folded names, residue and 2/8/0 quote-check totals match the verbatim output. | Accepted; no stale figure found. |
-| Citations and quotes | Checked every content-page key against the shared live bibliography and checked all 10 extraction quotes in ''paper.cols.txt''. Eight are partial because repaired columns split the full sentence; none is unlocated. | Accepted; explained the partial status instead of presenting it as exact. No duplicate bibliography key added. |
-| External currency | Re-read the three official repositories, current commits, package metadata, collector code, data model and Detector build scripts on 2026-08-14. | Accepted; version/commit caveats and no-supersession wording retained. SEO/listicle and unverified-vendor claims rejected. |
-| Generic/page review | Checked that the page distinguishes Collector, Detector and Tracker Radar; gives a schema, comparison, build path, denominator, reporting checklist and limitations; and links the provenance and corpus pages. | Accepted. A suggestion to call TRC the field standard was rejected as unsupported. |
-No credential, private crawl, raw cookie value or response body was exposed. The metadata schema's possible hostname/username fields are called out for redaction; no such values were published.
+==== 10.2 Figures against the script (sonnet) ====
-===== Reproduction =====
+Re-ran the report independently and confirmed byte-identity with both the committed output and the %%<file text>%% block on the published provenance page (one trailing blank line apart). Hand-verified every per-year denominator, numerator and percentage, the 6/4 window split, the 21/11 paper-level figures, the ''9 = 4 + 5'' string audit, and that all 10 TRC papers are inside CRAWLED. Confirmed no shelled-out or back-calculated denominator anywhere in the script.
+^ # ^ Finding ^ Action ^
+| 1 | **''quoteMatch'' passes on a mutated quote.** Changing the one word the claim rests on — "Collector" to "EXTENSION" — still returned ''10-word-compact'', because an untouched run elsewhere in the sentence matched | **accepted**; every accepted window must now contain the anchor phrase, and an unanchored match is graded and counted separately. Mutation test after the fix: real ''exact'', Collector→EXTENSION ''unanchored (10-word-compact)'', Radar→Beacon ''unanchored (11-word-compact)'', wrong tool ''not located'', anchor-present-rest-fabricated ''not located'' |
+| 2 | The section C tuple residue is not paper-disjoint from the 10; the referrer-policy paper is in both | **accepted**, stated in §3. Verified it creates no wrong number |
+| 3 | ''detection[]'' carries real measured figures with denominators for all 10 papers, and the page carried none | **accepted in part**: three were re-read in the papers and published as denominator worked examples (§6.2). Aggregating ten heterogeneous denominators was rejected as a breach of the counting rules |
+| — | Its recall audit, the four ''.cols''-less papers and the ''\btrc\b'' false-positive sweep | no change needed; folded into §4 |
+| R | It listed "30 s ''maxLoadTimeMs'' verified directly at the pinned commit" among things it checked as **correct** | **rejected**. It read the README, not ''crawler.js''. Same error as the page, and as pass (b) |
+==== 10.3 Citations and quotes (sonnet) ====
+Checked all 14 published keys, the render on both pages, a DOI-and-title duplicate scan, BibTeX hygiene, every author list and DOI against a primary source, all 10 quotes by hand, and every clause of every row of the ten-paper table.
+^ # ^ Finding ^ Action ^
+| 1 | **Blocking.** ''aziz2024_johnny'' is recorded as PoPETs ''number = {3}''; the landing page and the paper's running header both say 2024(4) | **accepted**; the shared bibliography was corrected. Coordinator re-verified from ''doi.org'' |
+| 2 | **Blocking.** ''roongta2025_sheep'' the same: issue 4, not 3 | **accepted**, corrected. ''zagi2025_referrer'' was re-checked and is correctly 3 |
+| 3 | **Blocking.** "2 exact" is wrong: the IMC 2025 quote drops a leading clause and capitalises a mid-sentence "we", and only graded exact because ''normal()'' lowercases | **accepted**; the checker now grades case separately and the count is 1 verbatim / 1 exact-except-case / 8 partial |
+| 4 | One blanket explanation ("a repaired-column-layout artifact") is wrong for three of the eight partials, which are edited fragments, not layout damage | **accepted**; §6 now names which is which, per paper |
+| 5 | ''{[englehardt2016online]}'' sat at the end of "no same-sites, same-browser, same-question head-to-head benchmark" — a negative-existence claim cited to a 2016 Firefox paper that predates TRC and never mentions it | **accepted**; the key moved onto the first mention of OpenWPM, which is what it is the wiki's standard citation for |
+| — | **Every clause of every one of the ten paper rows verified as supported. No confabulation.** All 14 keys resolve once; no duplicate paper under two keys; no literal ASCII ''@'' in any entry; all author lists correct including three where the two-column PDF splits the author block | no change needed, and recorded in §6.1 as a pass |
+| R | It confirmed the 30-second load window "in README lines 70/90" among its correct list | **rejected**, same reason as §10.2 |
+==== 10.4 External currency (sonnet) ====
+Fetched rather than recalled: three fresh clones, ''npm ci'', a real ''%%--help%%'', a real crawl, the Node release schedule, the npm registry and all three repository links.
+^ # ^ Finding ^ Action ^
+| 1 | **Blocking**, independently: the README's 30 s is stale and the code says 60 s. Added the provenance — code changed in ''b7c35b4'' (2025-07-08), README comments untouched since ''81db6d0'' (2022-01-13), so it was already wrong at the pinned commit | **accepted**; this is the version of X1 that went on the page |
+| 2 | ''engines.node'' is ''>=18'' and Node 18 has been EOL since 2025-04-30, Node 20 since 2026-04-30. The page cited ">= 18" as evidence of currency | **accepted**, now a caveat with the schedule footnoted |
+| 3 | ''tracker-radar-detector'' has had no commit since 2025-03-31 and the page treated all three repositories as equally current | **accepted**; the dormancy is now stated in two places |
+| 4 | ''shared_worker'' is also attached; the page named four of the five target types | **accepted**, added |
+| 5 | WebSocket records carry fewer fields than HTTP records | **accepted**, added |
+| — | CookieCollector's ten field names, RequestCollector's full field list and header safelist, the top-level shape, ''metadata.json'', ''APICallCollector'', ''TargetCollector'', ''ScreenshotCollector'', the absent ''ElementsCollector'', the abstract ''ContentScriptCollector'', every CLI flag, Detector's ''minSites''/''keepFirstParty''/''treatCnameAsFirstParty'', all four generated file names, and the Selenium-is-Chrome-provisioning-only relationship — all verified at source | no change |
+| — | ''post-processing/detect-cookie-popups.js'' calls OpenAI's API offline for DuckDuckGo's own autoconsent-rule generation. Explains the ''openai'' dependency; not part of a live crawl | recorded, not published |
+| R | It graded the Consent-O-Matic problem **PLAUSIBLE** on the basis that ''grep'' finds no mention in the current source | **not accepted as the final grading**: pass (d) read the dependency's changelog and found the removal, which makes it CONFIRMED. Two passes reached different confidence on one fact because one looked for absence and the other for the removal event |
+==== 10.5 The OpenWPM comparison (sonnet) ====
+Read the openwpm page in full, cloned OpenWPM (v0.36.0, HEAD ''61d285f''), and checked every cell of the comparison table against both.
+^ # ^ Finding ^ Action ^
+| 1 | **Blocking.** "CookiePopupsCollector can record **Consent-O-Matic**/autoconsent CMP observations" is false for the current tool: autoconsent dropped Consent-O-Matic rule support in v16.0.0 (2026-06-23, #1393), and TRC's range starts at ''16.8.1'' — so it was already gone before the first run's own 2026-08-14 "current" check | **accepted**; the row now says autoconsent only, and the 2022 paper row notes that Consent-O-Matic was genuinely part of //that// crawler |
+| 2 | The "no head-to-head benchmark" claim is literally true but under-hedged: {[ahmad2020_apophanies]} compared eight crawlers over 932 domains, and {[sanchezrola2023_rods]} compared a CDP crawler with OpenWPM on the same 1,000 sites. The site had already found the second one and filed it as a population exclusion | **accepted**, and it improved the page more than any other finding: both are now cited, and the ''rods'' result is presented with the paper's own resolution — the 47.8% gap was OpenWPM's **default API list**, and after instrumenting the missing APIs "both our crawler and OpenWPM were able to detect all the 2092 calls". Coordinator verified that passage verbatim |
+| 3 | 58 / 59 / 60 for "OpenWPM inside CRAWLED" exist across the wiki with no reconciliation | **accepted**; §2.1 reconstructs the delta and names the one paper |
+| 4 | The table has no Playwright row although the prose invokes "a plain Playwright crawl" twice, and Playwright now outgrows Puppeteer in the provisional slice | **accepted in part**: a paragraph now says Playwright is the comparator the table lacks and that the corpus supports no claim either way. A Playwright column was **rejected** — inventing one from no evidence is what this page is supposed to teach readers not to do |
+| — | Every OpenWPM-column claim verified at source, including that ''cookie_instrument'' really does write **both** JavaScript and HTTP-response cookie changes to ''javascript_cookies'' (one ''browser.cookies.onChanged'' listener, ''cookie-instrument.ts:60-79''); that OpenWPM has no consent handling at all (zero hits outside tests); and both cross-links plus both in-page anchors resolve with zero ''wikilink2'' | no change |
+| R | It called the index's 21 "no contradiction" because each number is correct for its own rule | **partly rejected**: correct about the rules, wrong that the labelling is harmless. The row is labelled after the crawler and the prose attributed the growth to the crawler. See §2.2 |
+==== 10.6 Generic pass (fable, no checklist) ====
+It returned after the pages were already published, and it justified its slot: **twelve findings on a page four focused passes had cleared**, including the one boundary the whole page is about. Every finding was verified against the paper or the repository before being accepted, and every one was accepted.
+^ # ^ Finding ^ Action ^
+| 1 | **One of the "10 TRC users" did not run TRC.** {[aziz2024_johnny]} is the single ''browser-automation'' tuple, and its crawler is its own: //"We used custom scripts, written in Python and JavaScript, to drive and instrument an instance of Chrome using the Chrome DevTools Protocol"//. The extraction files ''"custom scripts" [crawler-framework/produced]'' and ''"Chrome DevTools Protocol" [browser-automation/used]'' beside the TRC tuple. The count is correct under the written rule, but "TRC users", "The papers use it as a base" and the "nothing to state" argument about ''headless''/''statefulness'' were all applied to a paper that had every choice TRC does not give you | **accepted**, verified verbatim. The page now says the 10 is nine TRC-driven crawls plus one module reuse, names the paper, and warns against reading the ''crawlConfig'' silences as TRC defaults for that row. This is the best finding of the review: a page whose thesis is "the count that is easy to get wrong" had a boundary inside its own count |
+| 2 | "every one of those seven wrote it" is false for at least two of the seven | **accepted**. The coordinator had already softened this to a disjunction between passes; the pass's per-paper detail is better and replaced it. Verified individually: {[senol2022_leaky]} ("We modify TRC to efficiently discover inner pages"), {[moti2024_targeted]} and {[zagi2025_referrer]} (each wrote a ''LinkCollector''), {[senol2024_double]} (regex-matched candidate links, up to fifteen on a second pass) — four wrote it; {[roongta2025_sheep]} selected inner pages into a pool ("for websites with over 10 inner pages, we included three additional inner pages… The final website pool consisted of 4,710 web pages"); {[dimova2021cname]} says only "a preliminary crawl of 20 pages per website" and never says how they were found; {[aziz2024_johnny]}'s traversal is in its own crawler |
+| 3 | **A documented, still-open TRC bug that two of the ten papers cite was absent from the page.** Issue #77, "Early browser API accesses and function calls are missed" | **accepted**, and it is the most useful thing added to the page. Verified through the GitHub API on 2026-09-03: ''"state": "open"'', created 2022-09-26 by ''asumansenol'' — an author of two of the ten papers — last touched 2023-03-06, four comments, maintainers describing "a race condition between API collection script setting things up and scripts on the page already running", noting it makes TRC's own API-collection integration test flaky, and ending "We're exploring different options to fix this". {[senol2024_double]} footnote 6, verified verbatim: //"Although TRC already has the capability to intercept JavaScript API calls, we introduced a separate collector due to a known TRC bug that causes it to miss the initial function calls, documented in a public GitHub issue"//. So a partial ''callStats'' has a second cause besides configuration, and the page's advice did not cover it |
+| 4 | This page's own headline self-assessment contradicted its §6: "the corpus arithmetic held up completely" against "both halves of that were wrong" about the first pass's quote-check summary | **accepted**, §1.1 and §11 both reworded. An overstatement about our own rigour is exactly what a provenance page is for catching, and it was in the second paragraph |
+| 5 | "Only two fields are not reproducible" — ''time'' is a measured duration and ''remoteIPAddress'' is anycast, and §12 of this page already said so | **accepted**, now four fields, and the two pages agree |
+| 6 | The ''cmps[]'' field list omits ''final'' — which is the **first** key in the coordinator's own published real output | **accepted**, added. A field list transcribed from a typedef while the real output sat two sections away |
+| 7 | {[sanchezrola2023_rods]}'s crawler is described as "CDP-breakpoint"; the paper says "a custom instrumentation based on the Chrome debugging protocol", and ''breakpoint''/''hook''/''wrap''/''overrid''/''getter'' have zero hits in it | **accepted**, now "CDP-instrumented Chromium crawler" |
+| 8 | Five rendered apostrophes are backticks, from ''%%''x''%%`s'' | **accepted**, all five fixed on both pages |
+| 9 | The CLI error block's ''...'' is above the success banner, but ''crawl-cli.js'' prints the banner **before** ''reporters.cleanup'' emits the start/finish/duration lines and the tally — so the elided lines fall below it, and "note the last three lines" pointed at the ellipsis | **accepted**, block and prose corrected |
+| 10 | The two pages disagreed on which schema keys were checked against real output (four versus five) and on how many scripts there are (four versus five) | **accepted**, both aligned |
+| 11 | **The published smoke script did not fail loud on a timed-out crawl** — it wrote the JSON and printed "wrote" regardless of ''data.timeout'', against this page's own lesson that a success message is not a success signal | **accepted**, and mutation-tested rather than read; see below |
+| 12 | "it predates TRC" is loose, and "over 932 popular domains" is ambiguous | **accepted**; now "its crawls (April 2019) predate TRC's first commit (2020-02-27)", and the coordinator had already re-quoted the 932 |
+==== 10.7 Mutation-testing the guard that finding 11 added ====
+A guard that never fires asserts nothing, so the new line was tested in both directions instead of read. The first attempt was misleading and is worth recording: forcing ''maxLoadTimeMs: 1'' makes ''crawl()'' throw a ''TimeoutError'' outright, because ''maxTotalTimeMs = maxLoadTimeMs * 2 + collectorExtraTimeMs'' kills the whole crawl before the inner path runs — no result, no file, guard never reached. That would have "passed" while proving nothing.
+The reachable path needs ''maxLoadTimeMs'' large enough that ''maxTotalTimeMs'' still covers the 2.5 s settle. ''crawler.js'' catches a navigation ''TimeoutError'' at line 338, sends ''Page.stopLoading'', sets ''timeout = true'' at line 349, and **carries on collecting**, returning a partial result at line 380. Reproduced with a local server serving a page whose image handler sleeps 12 s, and ''maxLoadTimeMs: 5000'':
+<code>
+# with the guard:
+[trc] crawling http://127.0.0.1:8099/
+   [log] Page navigation timeout
+  if (data.timeout) throw new Error(`${u} hit the crawler's timeout path; capture is partial`);
+Error: http://127.0.0.1:8099/ hit the crawler's timeout path; capture is partial
+--- files written: (none)
+# same run with the guard line deleted:
+[trc] crawling http://127.0.0.1:8099/
+[trc] wrote /tmp/trcout7/http_127_0_0_1_8099_.json
+/tmp/trcout7/http_127_0_0_1_8099_.json timeout = True | requests: 2
+</code>
+So the guard does real work: without it the script announces success over a two-request partial capture. The published block and ''scripts/trc_smoke.mjs'' were then re-synchronised and the amended script re-run against the two live sites to confirm it still completes normally.
+==== 10.8 What the generic pass checked and found correct ====
+Worth reading before re-checking anything. It independently reproduced the rendered-DOM audit on both pages (all anchors resolve, zero real red links — it correctly identified that the one ''wikilink2'' string on this page is literal text inside a code block — no list item containing preformatted text, no uneven table rows, all four WRAP boxes rendering as plugins, the footnote rendering, and the citekey-to-reference counts on both pages); confirmed the ''%%--help%%'' block is byte-identical to the real command at the pinned commit; and re-verified some thirty repository facts including the user-agent constants, the viewports, ''VISUAL_DEBUG'', the 60000/2500 defaults, the UA and browser-close gating, the unconditional ''downloadChrome'', the ''size'' coercion and its clickhouse comment, the ''saveHeaders'' default, the ''responseReceivedExtraInfo'' listener that makes ''set-cookie'' real, ''filterListMatched'' being written once and only read, and 82 commits since 2026-01-01 (so "actively developed" holds). It also established that ''example.com'' currently returns **none** of the nine safelisted headers, so the empty ''responseHeaders'' in the published output is correct rather than a capture failure — a check nobody else thought to make. On the index page it confirmed the diff contains only the three intended edits and that the 9/1/1 footnote split matches the reconcile output.
+===== 11. Judgement calls =====
+  * **Reviewed and rewrote rather than replaced.** The first pass's corpus work was sound and its structure was reasonable. Every **figure** it published survived — though not everything its script printed about those figures — and roughly half its non-corpus prose did not. The page kept its skeleton and gained an install section, a pitfalls box, three new subsections and two new citations.
+  * **Edited a neighbour.** Fixing ''programming:crawler'''s 21-row label and its "38 crawlers" bullet is outside a strict reading of "review this page", but publishing a contradiction and leaving the wrong side live would have been worse. ''tool_fold.mjs'' was deliberately **not** changed (§2.2).
+  * **Did not aggregate the measured results.** ''detection[]'' has 61 prevalence strings across the ten papers. Three are published, each with the denominator read out of the paper. A "TRC papers find X% of sites do Y" number would have been the most quotable thing on the page and the least defensible.
+  * **Published a real crawl of two live sites and one CMP site.** Three page loads of public homepages, no login, no interaction beyond the consent action the collector performs. The scraped button text from that run is described but not published, because it is third-party page content.
+  * **Kept the ''size: 473'' block and disclosed the 474.** Re-running until the numbers matched would have hidden the finding that produced the pitfall.
+  * **Left the corpus figures alone.** The temptation on a "least-verified page" review is to find something wrong with the numbers. Four passes and an independent probe say the numbers are right, and that is the finding.
+  * **No ''~~DISCUSSION~~'' on this page**, following the first run's call and the rest of the ''provenance:'' namespace: comments belong on the content page.
+===== 12. Reproduction =====
 <code bash>
 cd /workspace/artifacts/wiki
-node scripts/report_tracker_radar_collector.mjs
+node scripts/report_tracker_radar_collector.mjs   # every corpus figure on the page
+node scripts/trc_review_probe.mjs                 # recall, independent of the extraction
+node scripts/trc_index_reconcile.mjs              # the 10-versus-21 split
+node scripts/trc_paper_detail.mjs                 # full per-paper crawlConfig/population/detection
 </code>
-The report is deterministic against the mounted ''run1'' extraction. If the corpus changes, refresh the output, rerun the quote checks and update this log before changing a figure on the content page.
+The four corpus reports are deterministic against the mounted ''run1'' extraction. ''trc_smoke.mjs'' needs a TRC checkout and a Chromium of the host architecture, and is not deterministic: timestamps, ''time'' and ''size'' move. If the corpus changes, refresh the outputs, re-run the quote checks and update this log **before** changing a figure on the content page.
 ====== References ======
 <bibtex bibliography></bibtex>
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.