Working log behind Interaction with Websites. Every figure on that page, the query that produced it, its denominator, the folds and their residue, the quotes checked, the external sources verified and rejected, what could not be established, and the review. Corpus-wide caveats — the venue scope, the selection funnel, the stability of each field — are on corpus and are not restated here.

Voice is a working log, not prose. It is for someone checking a number.

Create, extend or overlap? Extend, and broaden. The stub was titled Interaction with website and listed three topics “to cover in separate pages”: form input, consent, and stateful/stateless crawling. Two of those three now have their own pages (consent, stateful_stateless) and the third is registration. That left the hub with nothing of its own. The decision taken here was to give it the subject the neighbours explicitly delegate to it: consent says “the crawler-side mechanics of clicking anything at all are on Interaction”, and stateful_stateless says “for what to do on the page once you are there, see Interaction”. So the page is now about depth, subpage selection, on-page action and the identity knobs, and it delegates consent and login back out. No content was removed except the one claim corrected below.

One inherited claim was wrong and is now corrected on the page. The stub said, of Urban et al. [1Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]: “From 10 visited subpages is increase small.” That number is not in the paper. Its pre-study visits 25, 50, 75, 100, 250, 500 and 1,000 subsites — 10 is not one of the steps — and its stated result is that the cookie count “stabilizes around 50 (SD: 100; median at 12) after visiting 100 subsites”. The stub understated the saturation point by an order of magnitude, in the direction that would let a reader justify a shallower crawl. Verified against both renderings of the paper (see Quotes checked).

Every figure on the page uses one of these four. None of them is 5,859.

The 263 crawled papers that are not webCrawled are app-store scraping, network probing and social-graph traversal. “How far into the site” does not mean the same thing there, so they are excluded and the count is printed by the report.

crawlConfig.interactionDepth has five values. Only three of them answer “how far into the site did the crawl go”. The fourth, single-target-page (285 of the 857 web crawls — the single largest value), does not: read against the papers' own text it fires on website-fingerprinting trace collection, phishing-URL monitors, search-result scrapes, cloud-dashboard pulls and API polling. Those crawls have a page list, not a site list.

Folding it into the depth ratio would have moved “went beyond the landing page” from 262/417 (62.8%) to 262/702 (37.3%) and made the number meaningless in both directions. It is reported separately on the page and excluded from every depth denominator. A reproducible sample of its evidence quotes, every 12th of the 285, was read on 2026-08-27; representative entries:

CCS/2010/blade-...       "Prior to visiting each URL, the testbed reverts the VM ..."
USENIX/2011/show-me-...  "The crawler traverses any redirection pages and then fetches ... the resulting page"
IMC/2019/shamfinder-...  "We accessed to the corresponding websites via the two schemes, HTTP and HTTPS"
USENIX/2020/phishtime-.. "40 virtual machines ... to empirically monitor blacklisting of each website"
CCS/2023/transformer-... "After each visit, we closed the browser and cleared the cookies"
IMC/2025/roam-without-.. "We conducted daily retrievals of eSIM offers over a four-month period"

None of those is a statement about site depth.

A terminology trap that the exclusion does not fix, and that the page names instead. In the phishing, malvertising and spam literature “landing page” means the destination of a redirect or ad click. A detection[] sweep for /landing page/i over the web-crawl population returns mostly that sense: spam campaigns sharing a blacklisted landing page, rogue landing-page lifetime, LDA topics over advertiser landing pages. Anyone re-running a query on this page's topic must read the sense, not the string.

The whole report, unedited. Run it with:

cd /workspace/publications_dataset && node /workspace/artifacts/wiki/scripts/report_interaction.mjs
node /workspace/artifacts/wiki/scripts/report_interaction.mjs --wiki    # DokuWiki tables
node /workspace/artifacts/wiki/scripts/report_interaction.mjs --list    # the 417 site-depth papers
node /workspace/artifacts/wiki/scripts/report_interaction.mjs --quotes <regex>

The full unedited output is on the outputs page, in report_interaction-output.txt.

The schema has no field for scrolling, clicking, hovering, typing or waiting. The only way to count them is to sweep the text, and the count is an upper bound by construction: it counts papers with a first-person sentence matching a pattern, and “we did not scroll” matches too.

Two columns are printed side by side so the width of the claim is visible: any match anywhere in the paper against a match in a sentence that also contains a first-person marker. The gap is large — 469 papers mention clicking, 282 mention it in a first-person sentence — and the page quotes only the tighter column.

The full unedited output is on the outputs page, in interaction_fulltext_probe-output.txt.

Read individual sentences behind any row with:

node scripts/interaction_fulltext_probe.mjs --pop web --hits "scrolls"
node scripts/interaction_fulltext_probe.mjs --pop web --hits "LLM / agent-driven browsing"

There is no name fold on this page. Nothing it counts is a free-text name: interactionDepth and authentication are enums, subpagesPerSite and repeatVisits are integers, and the on-page-action figures are regex sweeps whose patterns are published in full in the script. What this page has instead is three hand classifications, all guarded at run time, and two published sweeps whose patterns live in one place so they cannot drift apart again.

A full-text sweep for agent frameworks and LLM-driven browsing over the 857 web crawls returns 35 papers. A sweep hit is an upper bound and nothing more: “LLM” and “agent” appear in papers that classify text with a model, in papers that study agents as a threat, and in reference lists citing Mind2Web. Each of the 35 was read for its deciding sentence and given one of six roles.

The report throws a FAILURE line if the sweep returns a paper with no hand verdict, so the map cannot silently go stale as the corpus grows. It printed 8 such lines on the first run; all 8 were read and added. One verdict (USENIX/2024/understanding-help-seeking-…) is carried over from a wider earlier sweep and is not returned by the current one; the report notes it rather than dropping it.

Two of the citation verdicts are homographs rather than citations, and are marked as such in the fold: in USENIX/2016/internet-jones-… and USENIX/2023/policycomp-… the string “browser use” is ordinary English, not the Browser Use framework.

Residue: zero. Every sweep hit has a verdict.

See The validity problem specific to this page below. 42 papers; every 4th read by hand (11 papers); 10 verdicts inferred, 1 stated-elsewhere; residue zero within the sample, and the report fails loudly if a sampled paper has no verdict or a verdict no longer corresponds to a sampled paper. The 31 unsampled papers in the cell are not claimed to be anything — the page says “a hand-read sample of those found”, not “all of those are”.

12 papers, verdicts depth / other / partial, each with the deciding quote. See The validity problem specific to this page. Residue zero within the sample; the report fails loudly on divergence.

The hand maps, with the deciding sentence for every entry, are in scripts/interaction_fold.mjs.

crawlConfig carries ONE evidence quote for the WHOLE object. statefulness, browsers, headless, consentAction, interactionDepth, subpagesPerSite, authentication, languages and repeatVisits all share it. So the site's usual check — “read a handful of evidence.quote values before publishing a figure” — is structurally blind here: the quote behind an interactionDepth value usually evidences the browser or the statefulness instead. Spot-checking it validates nothing. (The same trap cost privacy:consent a 19.4% false-positive rate on consentAction before it was audited.)

How blind, measured. On the subset where it is cheapest to judge — the 71 web crawls labelled landing-plus-subpages that also state a subpagesPerSite — every 6th was read on 2026-08-27 and its single shared quote classified by what it actually evidences:

So about half the quotes behind a depth value evidence something else. Read that as the size of the blindness, not as an error rate: a quote about statefulness does not make the depth label wrong, it makes the quote useless as a check on it. The 12 verdicts, each with the deciding quote, are in SHARED_QUOTE_AUDIT in scripts/interaction_fold.mjs and printed by the report, which fails loudly if the sample and the map diverge.

In place of the quote check, a discriminant. For each paper, does its own text contain a first-person sentence naming the root of a site as the unit of a visit (LANDING), something below the root (DEEPER), both, or neither? If the label tracks the text there will be a gradient across the enum, and not-stated is the control.

What this supports, and what it does not:

• It supports the labels. landing-page-only papers name a deeper unit and nothing else in 4 of 155 cases. landing-plus-subpages has by far the highest “both” rate, which is the signature you would predict for a design that visits the root and pages below it. And the not-stated control has neither phrase 83.8% of the time — the sentinel is behaving.
• It does not validate any individual paper. It is a distributional check.
• It shows a real soft spot. 42 of 155 (27.1%) landing-page-only papers contain neither phrase. A hand-read sample of 11 of those found 10 in which the paper describes visits at site granularity (“we visited each domain in our target list 5 times”, “we accessed each website five times using curl”, “the Alexa top 10K websites that we crawled”) and never says which part of the site — so the label is a defensible default inference, not a stated value. One (WWW/2019/the-chain-of-implicit-trust-…) does state the root, in wording both regexes miss (“the Alexa top-200K websites' main pages”, outside a first-person sentence).

subpagesPerSite and interactionDepth are extracted from the same shared quote but mean different things, so a systematically wrong depth label would show up as disagreement between them. Of the 104 web crawls that state both, contradictions = 0 — no landing-page-only paper carries a positive subpage count, and no landing-plus-subpages paper carries zero. Printed by the report.

Consequence, stated on the page: the 81.9% “states a depth” figure is an upper bound. It is still the best-reported crawl-configuration field in the schema, and that is the claim the page makes.

The regexes matter more than they look. A first attempt used a narrower “explicit landing-page phrase” pattern and reported that only 47.1% of landing-page-only papers had one. Hand-reading the misses showed the pattern was simply missing “root page”, “main page”, “frontpage” and plural-with-a-number forms (“crawl the landing pages of 100K websites”). That 47.1% was a regex artefact and was never published. The widened patterns are in scripts/interaction_fold.mjs as LANDING and DEEPER, in full.

The page publishes a measurement rather than an assertion: a local instrumented site with five third-party beacons, each reachable only under a different condition, visited under six strategies by Playwright's own Chromium. It needs no network.

The full unedited output is on the outputs page, in interaction_probe-output.txt.

Design notes, because the fixture is doing real work:

• The third parties are served from a second origin (127.0.0.2) so the browser treats them as third-party the way a real measurement would.
• /about is deliberately empty of third parties and is deliberately the first link in DOM order. That is what makes row 2 informative: the HTTP Archive's first-same-origin-link rule lands on it and learns nothing. On a real site the first nav item is usually institutional, so this is the rule's normal behaviour, not a contrived worst case.
• /comments is linked only from /article, so no landing-page-plus-one-hop strategy can reach it.
• The scroll beacon fires on a scroll listener at the bottom of a 3000px page; the click beacon on a click listener. Both are the ordinary lazy-loading shapes.
• The ladder is monotone and each rung adds exactly one beacon, which is the point: depth does not substitute for scrolling and scrolling does not substitute for clicking.

The two files are published on the page in <file> blocks and are byte-identical to sandbox/interaction_site.mjs and sandbox/interaction_probe.mjs — asserted by a diff on every save, and checked end-to-end (see The published code was checked end-to-end).

Two independent renderings, because they fail on different sentences. paper.cols.txt repairs two-column reading order but still interleaves a fragment of the neighbouring column into some sentences; a pypdf extraction of paper.pdf keeps raw order (wrong across columns, right within a line). A quote present in either, with whitespace collapsed and -\n hyphenation undone, is present in the paper.

The full unedited output is on the outputs page, in interaction_quotecheck-output.txt.

26 of 26 quotes located; 23 in .cols, 25 in the PDF rendering, 0 in neither.

The three that .cols misses are column splices, and the raw text is worth showing because it is what a splice looks like:

found that the mean amount ON THE CLIENT, BECAUSE EACH PAIR CAN BE USED FOR DIFFERENT PURPOSES.
of accessed/set cookies stabilizes around 50 (SD: 100; median at 12) WE HEURISTICALLY GROUP
COOKIES IN DIFFERENT CATEGORIES BASED ON after visiting 100 subsites (see Figure 2).

(capitals mark the interleaved neighbouring column). The pypdf rendering of the same passage:

mber of visited subsites, we found that the mean amount of accessed/set cookies stabilizes
around 50 (SD: 100; median at 12) after visiting 100 subsites (see Figure 2).

The page quotes the reconstructed sentence. That reconstruction is the whole basis of the page's central correction, which is why it was checked twice.

One elision, declared. The page quotes Aziz and Wilson [2Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)] whole as the model reporting statement. The PDF renders “the domain's homepage,9” with a superscript footnote marker; the page drops the marker and nothing else. The quotecheck carries the marker form so the elision is visible in the audit trail rather than invisible in the prose.

A separate needle check covers every literal per-paper figure on the page — not just the quoted sentences — against paper.cols.txt:

The full unedited output is on the outputs page, in verify_interaction_figures-output.txt.

44 needles, 0 not located anywhere, 3 located only after undoing a column splice, 6 flagged as shorter than 20 characters (the count of needles is unchanged by the review fixes; two Musch and Johns needles replaced one) (a short needle can pass for the wrong reason; they are flagged rather than trusted).

One paraphrase was caught in review and removed. The first draft presented “Visiting subpages increased prevalence by about 17%” in quotation marks. That string is a detection[].prevalence summary of Musch and Johns [3Musch, Marius; Johns, Martin (2021): "U Can't Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)], not a sentence they wrote — the checker's own PARAPHRASED block flagged it and the draft did not act on the flag. The page now quotes the paper's sentence, “we can see that visiting subpages did indeed significantly increase the prevalence by about 17% compared to only crawling the front pages”, and adds the denominator and per-technique spread from the paper's Table 2. PARAPHRASED is now empty: every quoted string on the page is verbatim.

Not just “the <file> block matches the committed file”, which is where this check usually stops. Both code blocks were downloaded back off the rendered page through DokuWiki's own export, diffed against the committed scripts, copied into an empty directory and run:

curl -s "https://measuretheweb.org/_export/code/programming/interaction?codeblock=1" -o interaction_site.mjs
curl -s "https://measuretheweb.org/_export/code/programming/interaction?codeblock=2" -o interaction_probe.mjs
node interaction_probe.mjs

Both downloads are byte-identical to sandbox/interaction_site.mjs and sandbox/interaction_probe.mjs, and running the downloaded pair reproduces the table on the page, ending with the version line the page quotes. A reader who copies the page gets the thing that produced the result.

Related Pages links to automated_measurements, which does not exist. It is left in because the wiki already promises it from start and from four other pages, so removing it here would be inconsistent rather than helpful. Every other outbound link on both pages was fetched and returns a real page.

Everything below was fetched on 2026-08-27. Recall was not used.

Rejected, and why:

• The 2022 Web Almanac methodology page as the source for the secondary-page claim. It says the right thing (“This year, we introduced secondary pages”), but it is a yearly report about a snapshot, not the crawler's documentation, and it does not state the selection rule. Replaced with the BigQuery reference plus the crawl source.
• A search-engine summary that asserted “as of April 2022, both the root page and one secondary page are tested” without a link to the primary source. The sentence turned out to be correct, but it was re-derived from har.fyi before use. Search summaries are not sources here.
• dl.acm.org for Aqeel et al. — returns HTTP 403 to this container. Used the first author's institutional PDF instead, and said so.
• httparchive.org/faq as a statement of current behaviour — kept only as a documented example of stale vendor documentation.

scripts/check_page_numbers.mjs treated version identifiers as three-part semver only. Chromium builds are four-part (“151.0.7922.34”), so the guard shredded them into “151.0” and “7922.34” and reported both as unaccounted figures forever. Both the detection regex and the removal regex were widened to \d+\.\d+\.\d+(?:\.\d+)?.

Checked for behaviour change against four existing page/report pairs:

Worth a section rather than a footnote, because it is a failure mode with no error message anywhere and a guard that actively certified it.

Symptom. After a routine save, the rendered page simply stopped mid-table. The Related and References sections were not in the HTML at all — no purple warning, no PHP notice, no truncated response; DokuWiki emitted a complete page that happened to contain only part of the content. The only way to notice is to count what rendered against what you wrote.

What it was not. Two hours of bisecting on playground:playground ruled out: total size (a neighbouring provenance page renders 143 KB), the biggest embedded output block (removing 27 KB changed nothing), the review section (removing 16 KB changed nothing), the specific table cell it stopped at (rewriting it moved nothing), and every section on its own (all 13 rendered fine in isolation). Cumulative prefixes gave the decisive clue by being non-monotone — the first 11 KB failed while the first 34 KB passed — which cannot happen under any size or complexity budget, and can only happen if something is left open and something later closes it.

What it was. One table cell in the run table at the top of the page:

| Page before | a 2,411-byte stub: a ''<WRAP todo>'' box, three bullet topics, ... |

(with real angle brackets, of course — they are escaped here so this page does not reproduce the bug while describing it.)

''…'''' is monospace, not nowiki. It changes how the text looks and does nothing whatever to stop the wrap plugin. That literal opened a real, never-closed <div>, and everything after it vanished. Replacing the quotes with … fixed it on the next save, with nothing else changed.

The guard was worse than useless. scripts/check_wrap.mjs masked ''…'''' before counting tags — on the assumption that a tag written in inline code is a mention — and did not mask …. That is backwards on both counts: it blinded the guard to the one construct that fires, and it would have raised a false alarm on the one that does not. It reported OK on the broken page every time it was run.

Fixed on 2026-08-27: mask <nowiki> and … only, and flag a plugin tag inside ''…'''' as an error in its own right, with the reason in the message. Re-run across every page source in the workdir it now reports 71 instances, including three pages whose <WRAP> counts are unbalanced. Two of those were checked live and still render to the end, so this is a lead for whoever owns those pages rather than an emergency — but the class of defect is real and was previously invisible. Filed as the wrap-escape sweep item in /workspace/drain/work.db rather than fixed here, because editing ten other people's pages is outside this item's scope.

• Whether the 42-paper “neither” cell is representative. 11 were read. The other 31 were not, and no claim is made about them.
• Whether the depth labels are right for any individual paper. The discriminant is distributional. The object-level shared quote makes a per-paper check impossible without reading every paper, and 417 was too many for this run.
• Whether the 62.8% “went beyond the landing page” ratio has a selection bias, and how large. The page says it is an upper bound and gives the mechanism (a deeper crawl has more reason to describe itself). It does not quantify it. Closing it would need the 136 not-stated papers read by hand.
• How much an LLM agent changes a measurement. Five papers use one as the browsing instrument; none reports a same-site-list comparison against a scripted crawl. This is on the page as an open question.
• Whether subpagesPerSite means the same thing across papers. “10 subpages” could be 10 attempted, 10 successfully loaded, or 10 distinct URLs. Nothing in the schema distinguishes them and few papers say. The page reports the distribution and does not compute a mean.
• design:sampling now disagrees with this page and was not updated. It publishes its own depth figures — 24.8% landing-only of 680 papers, “15.0% state how many subpages” — against this page's 37.2% of 417 and 12.1% of 857. The populations are different and each page states its own, but nothing reconciles them for a reader who reads both. Its Hispar box, checked 2026-08-12, says there is “no maintained equivalent … no tooling to address it”, which is now stale against this page's HTTP Archive secondary-page paragraph. Deferred, and filed: editing that page is outside this item's scope, so it is recorded as the sampling depth reconcile item in /workspace/drain/work.db. The change it needs is one sentence pointing here plus a scope note on the two depth figures.
• Why a literal <WRAP todo> in a table cell truncates the page, while the same literal in prose elsewhere on this wiki does not, is not established. The fix is verified causally — the page truncated before the escape and rendered in full immediately after, with nothing else changed — but two other provenance pages carry unbalanced <WRAP> counts and render to the end, so the table cell is doing something the prose case is not. Not chased further.
• No discriminant was run for crawlConfig.authentication. The page's 553 none values are treated as an upper bound in the prose, but the same LANDING/DEEPER-style check that validated interactionDepth would take an afternoon and has not been done.
• The stability figures for interactionDepth (97% run-to-run) were measured on the old 4,322-paper corpus and have not been re-measured. They are quoted from data/extract/OVERVIEW.md as the right order of magnitude.

1. Broadening rather than splitting. The stub proposed three sub-pages. Two already exist elsewhere; a third (registration) exists as its own stub. Writing a fourth would have left the hub empty. A reasonable person could instead have made this a pure index page — the argument against is that depth and on-page action have no other home, and the neighbours already point here for them.
2. Excluding single-target-page from every depth ratio. This is the single biggest decision on the page, and it moves the headline from 37.3% to 62.8%. The justification is a read sample, printed above. A reasonable person could report both denominators; the page reports the value's size and says explicitly why it is out.
3. Reporting the depth ratio at all, given the selection bias. The alternative was to publish only the reporting rate. The ratio is published with an explicit upper-bound warning in its own <WRAP important> box.
4. Calling mouse-movement emulation “never established”. ~2% throughout with no trend, over 857 papers. That is a claim about seven venues and is labelled as such.
5. Calling landing-page-only crawls “still defensible” rather than outdated. Aqeel et al. and Urban et al. both argue for internal pages, and it would have been easy to write the currency table as “landing-only is superseded”. It is not: 155 of 417 depth-stating papers still do it, Lauinger et al. [5Lauinger, Tobias; Chaabane, Abdelberi; Arshad, Sajjad; Robertson, William; Wilson, Christo; Kirda, Engin (2017): "Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] give a good reason, and for many questions the landing page is the right unit. The claim the page makes is that it is no longer defensible silently.
6. Publishing a synthetic fixture rather than a live crawl. A live measurement of “third parties visible only after scrolling” over a real site list would be a stronger result. It would also be a crawl of third-party sites run from this container without an ethics review or a robots check. The fixture makes the mechanism visible; the open-questions box names the real measurement as missing.
7. Splitting the raw script outputs onto a sub-page. Done while chasing a render bug, and kept afterwards. The bug turned out to be something else entirely (below), so the split is no longer forced — it is kept because the log reads better without 39 KB of raw output between its sections, and every line of that output is still published, one click away, linked from the point that produced it. A reasonable person would keep them inline; the rule that matters — the output is unedited — holds either way.
8. Not adding ~~DISCUSSION~~ to this provenance page. Following the convention set by the existing provenance: pages: comments belong on the content page.

Four reviewers, all told explicitly that the author's context might not be exhaustive, all handed the page text, the report script and its unedited output, the fold module and the provenance notes. The three focused ones ran in parallel first and every finding they raised was accepted; the generic reviewer then ran on the corrected page, and its findings are logged below with what was done about each.

That first finding is the exact failure mode the task spec warns about: a number carried over from a different population. It survived the author's own number guard because the guard checks that a figure appears in the report, and “1” appears everywhere.

One thing the reviewer noticed that is not a wiki error and is worth recording: the Sun et al. paper states “87% in Phase 2 and 79% in Phase 3” in one place and “87% in Phase 1 and 79% in Phase 2” in another. The inconsistency is in the source paper. The page quotes the first form, which is the one in the results section.

Worth recording because it is the same class of error the reviewers were looking for and none of them had reached it yet. The draft said depth is “by a wide margin, the best-reported crawl-configuration field in this corpus”. It is the best-reported, but the margin over authentication is 5.5 percentage points (841 against 779 of 1,120), which is not a wide margin. Replaced with the measured ranking of all six fields, which makes the real point better: there is no cliff between depth and authentication, and a large one below them (47.2%, then 31.2%, 19.6%, 12.5%).

After the focused reviewers, the draft was swept for words that assert more than a corpus of seven venues can carry — unchanged, always, never, no paper, nobody, every. Five things were wrong or overstated and were fixed:

The Open Questions box's remaining “nobody” claims now carry an explicit scope line: “nobody” means no paper in this corpus's seven venues, 2010–2026.

Two of these — the un-computed median and the probe-zero — passed check_page_numbers.mjs cleanly, because “10” and “0” both appear in the report attached to something else. The number guard proves a digit is in the report, not that it is the right digit for its sentence.

Given both pages, the scripts and the fixture, told the reader's profile and the corpus's scope, and told explicitly not to repeat the other three briefs. It reviewed the provenance page as well as the content page. Thirteen findings; twelve accepted in full, one accepted in part.

Wrong, and fixed:

• The two published sweeps of the same quantity disagreed. report_interaction.mjs and interaction_fulltext_probe.mjs each defined their own patterns and first-person marker, and they had drifted: 282 clicks against 285, 69 scrolls against 71, 11.1% against 12.4% for the 2025–2026 scrolling trend. Both were published — the page quoted one, this provenance page reproduced the other, and the prose here claimed the page quoted the number it did not
  • What was done: Definitions moved into interaction_fold.mjs and imported by both scripts. Outputs now identical wherever they overlap. The page's figures did not change; the probe's did. The episode is written up in a box above rather than quietly corrected
• This page contradicted itself about the published code, still carrying a parenthetical from before reviewer 1's fix saying the <file> block “drops only the trailing console block” — it no longer does
  • What was done: Parenthetical deleted; it now points at the end-to-end check
• The review log narrated a review that had not happened. The “worth its slot” table had 4, generic — see below with nothing below, and “Nothing was rejected in this round” was written before round 4 produced anything. The run table's page size was two saves stale
  • What was done: Both fixed. For a log whose whole purpose is honesty, pre-writing a conclusion is the exact failure it warns about, and it is recorded here rather than silently repaired
• “none of them justified anywhere” — a universal negative from no audit at all, over the 104 papers stating a subpage count
  • What was done: Replaced with a measured sweep, published on the page with every row labelled an upper bound: 13 cite Urban et al., 12 cite Aqeel et al. or Hispar, 18 say pilot or pre-study, 10 say saturation or diminishing returns. 51% carry some signal. “None” was wrong by any reading
• “553 explicitly did not authenticate” and “nine papers in ten use the logged-out design” — authentication shares the same blind crawlConfig quote, no discriminant was run for it, and the second claim folds the 204 not-stated into a design choice: the sentinel-subtraction trap the page carefully avoids for depth
  • What was done: “recorded as not authenticating”; “at most one crawl in ten gets past a login”; and an explicit warning that an unknown share of the 553 are the extractor's default reading
• The opening box said “say anything about scrolling” beside the tight first-person count (69), when the “says anything” count is 120
  • What was done: “describe scrolling in their own methods”, with the loose counts given beside them
• “Every depth percentage on this page has a denominator of 417” is false for the reporting rates and the on-page-action shares, which are of 857
  • What was done: Scoped to “every percentage of the depth distribution”
• The reader is sent twice to a stub — programming:registration is a “WiP: brainstorming” skeleton
  • What was done: Flagged inline, the way Hispar's death is flagged
• Trend framing conflicts with the sibling page. This page said depth reporting “has been true since 2010”; programming:stateful_stateless makes a named point of interactionDepth being the one field whose reporting rate declined
  • What was done: Acknowledged and linked: 83.8% to 79.1% across the buckets
• “Three things a fresh measurement gets wrong most often” — “most often” is unmeasured
  • What was done: “Three things this page exists to stop you getting wrong”

Gaps it named, and what was added:

• The ethics and side effects of interaction were missing entirely. The page taught “click every button” and form-filling at 10k-site scale and never said that ad clicks are billed to advertisers, that form submissions hit production systems, or that EvoCrawl-style interaction is run against self-hosted deployments
  • What was done: A new subsection, Interacting is not free, and it is not only your cost, placed immediately after the strategy ladder — i.e. immediately after the page has told you to click everything. Both of its load-bearing claims are quoted and verified: Reitinger et al. resolve ad destinations by regex rather than by fetching, precisely because “the extension fetching a full link could charge advertisers as a higher-cost click”; EvoCrawl ships a Dockerfile per benchmark app. This was the best finding of the four rounds
• No Monday-morning default. All the ingredients were on the page and it never assembled them
  • What was done: A new If You Just Need a Default section: harvest the frontier once and freeze it, random with a published seed, start at ten and pilot for your own metric, scroll and wait a stated time on every page including the landing page, click nothing by default, crawl logged out, log the three failure counts
• Fixture portability. 127.0.0.2 fails with EADDRNOTAVAIL on stock macOS, and the page says “needs no network”, inviting a copy-run on a laptop
  • What was done: The lo0 alias command is now a comment in the published fixture

Accepted in part:

• Cross-page divergence with design:sampling. That page publishes its own depth figures (24.8% landing-only of 680) against this page's 37.2% of 417, on a different population and with no reconciliation for a reader who reads both — and its Hispar box, checked 2026-08-12, is now stale against this page's HTTP Archive paragraph. The reviewer is right on both counts. Editing design:sampling is outside this item's scope, so it is recorded here and in What could not be established rather than done. Nothing on this page was changed, because this page's denominators are stated and correct.

Meta-note the reviewer raised, and it is fair: the artefacts changed under it mid-review, because self-review fixes were being published while it worked. Its findings were re-checked against the final revision before being logged here.

Nothing was rejected in rounds 1–3. That is not a good sign about reviewer calibration so much as a sign that three focused reviewers with a narrow brief and the real artefacts in hand find real things. Round 4, which had no checklist, found more than the other three combined — including a defect (two scripts publishing different counts of the same quantity) that none of the focused briefs would ever have looked for.

• The page this log is for
• Corpus-level provenance — venue scope, selection funnel, field stability
• stateful_stateless and consent — the two neighbouring logs, both of which hit the same shared-crawlConfig-quote problem

[1]

Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[2]

Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[3]

Musch, Marius; Johns, Martin (2021): "U Can't Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)

[4]

Aqeel, Waqar; Chandrasekaran, Balakrishnan; Feldmann, Anja; Maggs, Bruce M. (2020): "On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement", in: Proceedings of the ACM Internet Measurement Conference, pp. 680-695. (DOI)

[5]

Lauinger, Tobias; Chaabane, Abdelberi; Arshad, Sajjad; Robertson, William; Wilson, Christo; Kirda, Engin (2017): "Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web", in: Proceedings of the Network and Distributed System Security Symposium. (Link)