Working notes behind Programming:Stateful stateless: every query, every folding rule and its residue, every quote checked, every external source verified or rejected, and every judgement call. Corpus-level caveats are on corpus and are not repeated here.

Voice here is a log, not prose. It is for someone checking a number.

Two denominators are in play and the page states which it uses everywhere it matters.

• The page quotes 19.6% of 1,120, not 20.3% of 1,080, because a paper with no crawl-configuration record at all has certainly not told you whether its crawl was stateful. Both are printed by the report script.
• not-applicable (17 papers) and not-stated (844) are sentinels and are never counted as answers.
• Karel's task note said “19.2% of 859 crawling papers”. That is the pre-2026 corpus figure and is stale: the crawling population went from 859 to 1,120 in commit 8a6b843. Re-derived here as 219/1,120 = 19.6%. Nothing was carried over.
• Counts are of papers throughout. No table on the page counts tuples.

One script produces every figure on the page:

node scripts/report_stateful_stateless.mjs         > out/stateful_stateless_report.txt
node scripts/report_stateful_stateless.mjs --wiki  > out/stateful_stateless_report_wiki.txt

Real, unedited output:

stateful_stateless_report.txt

corpus: 5859 papers
population 'crawled' (crawlConfig object present OR studyTypes includes automated-web-crawl): 1120
  of which a crawlConfig object was built: 1080
  of which statefulness carries a stated value: 219
 
 
=== How often a crawling paper says whether its crawl was stateful ===
 
crawlConfig.statefulness          Papers  Share of 1120 crawling papers  Share of 1080 with a crawlConfig
--------------------------------  ------  -----------------------------  --------------------------------
stateless                         113     10.1%                          10.5%
stateful                          77      6.9%                           7.1%
both                              29      2.6%                           2.7%
not-stated                        844     75.4%                          78.1%
not-applicable                    17      1.5%                           1.6%
//no crawlConfig object at all//  40      3.6%                           —
 
Stated at all: 219 of 1120 crawling papers = 19.6% (20.3% of the 1080 with a crawlConfig object).
Among the 219 that state it: stateless 113 (51.6%), stateful 77 (35.2%), both arms 29 (13.2%).
 
 
=== Statefulness against the other crawl-configuration fields it competes with ===
 
Field                       Papers stating it  Share of 1120 crawling papers
--------------------------  -----------------  -----------------------------
Interaction depth           841                75.1%
Authentication              779                69.6%
At least one browser named  529                47.2%
Consent action              349                31.2%
**Stateful or stateless**   219                19.6%
Headless or headful         140                12.5%
 
 
=== Trend: reporting rate and the stateless share, by four-year bucket ===
 
Bucket      Crawling papers  State it  Share stating  stateless  stateful  both  stateless share of stated
----------  ---------------  --------  -------------  ---------  --------  ----  -------------------------
2010–2013   102              16        15.7%          7          8         1     43.8%
2014–2017   167              35        21.0%          14         15        6     40.0%
2018–2021   308              61        19.8%          31         21        9     50.8%
2022–2024   345              71        20.6%          42         22        7     59.2%
2025–2026*  198              36        18.2%          19         11        6     52.8%
 
* 2025–2026: CCS 2026 and IMC 2026 have not been held, and IEEE S&P/WWW 2026 are
  incompletely selected because selection screens on OpenAlex abstracts. The bucket is
  under-represented by construction. Per-year detail:
 
Year  Crawling papers  State it  Share  stateless  stateful  both
----  ---------------  --------  -----  ---------  --------  ----
2010  25               4         16.0%  1          2         1
2011  22               2         9.1%   1          1         0
2012  29               7         24.1%  4          3         0
2013  26               3         11.5%  1          2         0
2014  35               8         22.9%  4          2         2
2015  41               10        24.4%  3          6         1
2016  40               10        25.0%  2          5         3
2017  51               7         13.7%  5          2         0
2018  61               12        19.7%  4          3         5
2019  97               10        10.3%  3          6         1
2020  75               21        28.0%  11         8         2
2021  75               18        24.0%  13         4         1
2022  110              25        22.7%  13         9         3
2023  125              23        18.4%  16         5         2
2024  110              23        20.9%  13         8         2
2025  129              23        17.8%  11         9         3
2026  69               13        18.8%  8          2         3
 
 
=== The same buckets, for three reporting norms that did move ===
 
Bucket      States statefulness (of crawling papers)  Releases an artifact link (of all papers)  Mentions an ethics review (of empirical papers)
----------  ----------------------------------------  -----------------------------------------  -----------------------------------------------
2010–2013   16/102 = 15.7%                            121/511 = 23.7%                            47/460 = 10.2%
2014–2017   35/167 = 21.0%                            295/769 = 38.4%                            155/718 = 21.6%
2018–2021   61/308 = 19.8%                            728/1439 = 50.6%                           378/1272 = 29.7%
2022–2024   71/345 = 20.6%                            1270/1955 = 65.0%                          681/1649 = 41.3%
2025–2026*  36/198 = 18.2%                            907/1185 = 76.5%                           467/1019 = 45.8%
 
 
=== Every crawl-configuration field, reporting rate per bucket (of the crawling papers in each bucket) ===
 
Field                 2010–2013       2014–2017        2018–2021        2022–2024        2025–2026*       max-min  last - first
--------------------  --------------  ---------------  ---------------  ---------------  ---------------  -------  ------------
interactionDepth      80/102 = 78.4%  126/167 = 75.4%  237/308 = 76.9%  255/345 = 73.9%  143/198 = 72.2%  6.2 pp   -6.2 pp
authentication        61/102 = 59.8%  117/167 = 70.1%  213/308 = 69.2%  251/345 = 72.8%  137/198 = 69.2%  12.9 pp  +9.4 pp
browsers (>=1 named)  33/102 = 32.4%  81/167 = 48.5%   153/308 = 49.7%  162/345 = 47.0%  100/198 = 50.5%  18.2 pp  +18.2 pp
consentAction         25/102 = 24.5%  50/167 = 29.9%   99/308 = 32.1%   116/345 = 33.6%  59/198 = 29.8%   9.1 pp   +5.3 pp
**statefulness**      16/102 = 15.7%  35/167 = 21.0%   61/308 = 19.8%   71/345 = 20.6%   36/198 = 18.2%   5.3 pp   +2.5 pp
headless              1/102 = 1.0%    26/167 = 15.6%   41/308 = 13.3%   50/345 = 14.5%   22/198 = 11.1%   14.6 pp  +10.1 pp
 
The last two columns are the test of the page's claim: which field moved, and by how much.
 
 
=== By venue ===
 
Venue    Crawling papers  State it  Share stating  stateless  stateful  both
-------  ---------------  --------  -------------  ---------  --------  ----
WWW      242              45        18.6%          20         19        6
USENIX   221              30        13.6%          17         12        1
CCS      163              27        16.6%          11         10        6
IMC      132              28        21.2%          17         9         2
NDSS     129              24        18.6%          15         7         2
PETS     123              42        34.1%          22         11        9
IEEE-SP  110              23        20.9%          11         9         3
 
 
=== By automation framework: does the instrument make you say it? ===
 
Framework family                                                                      Crawling papers  State it  Share stating  stateless  stateful  both
------------------------------------------------------------------------------------  ---------------  --------  -------------  ---------  --------  ----
OpenWPM                                                                               58               32        55.2%          15         12        5
Selenium                                                                              242              67        27.7%          31         26        10
Puppeteer                                                                             76               27        35.5%          18         6         3
Playwright                                                                            34               12        35.3%          6          3         3
webXray                                                                               1                0         0.0%           0          0         0
Tracker Radar Collector                                                               10               3         30.0%          2          0         1
Vulnerability/state-space crawlers                                                    29               11        37.9%          4          7         0
OpenWPM //(name match over all tool categories, as on Programming:Crawler:OpenWPM)//  59               33        55.9%          16         12        5
//any framework named//                                                               723              182       25.2%          91         68        23
//no framework named//                                                                397              37        9.3%           22         9         6
 
 
=== Designs whose result is uninterpretable without the statefulness: do they state it? ===
 
Subset of crawling papers                                                       N     State statefulness  Share stating  stateless  stateful  both
------------------------------------------------------------------------------  ----  ------------------  -------------  ---------  --------  ----
Repeat-visit designs (repeatVisits >= 2)                                        199   85                  42.7%          49         21        15
Crawls that acted on a consent notice                                           36    22                  61.1%          11         4         7
Crawls that logged in (authentication stated, not "none")                       90    54                  60.0%          7          39        8
Deep crawls (interactionDepth = deep-crawl)                                     157   40                  25.5%          8          26        6
Crawls beyond the landing page (subpages or deep)                               303   83                  27.4%          30         40        13
Crawls whose consent interaction was //verified// by the privacy:consent audit  28    16                  57.1%          8          3         5
//all crawling papers, for comparison//                                         1120  219                 19.6%          113        77        29
 
 
=== The word "stateful" belongs to two literatures; the extraction does not separate them ===
 
Subject matter of the paper (keyword fold over slug + detection.phenomenon + classification target)  Papers stating statefulness  stateless  stateful  both
---------------------------------------------------------------------------------------------------  ---------------------------  ---------  --------  ----
tracking / privacy measurement                                                                       133                          78         35        20
web-application security scanning                                                                    23                           7          14        2
both vocabularies present                                                                            18                           6          9         3
neither (residue)                                                                                    45                           22         19        4
 
RESIDUE — papers stating statefulness that neither keyword set matched, printed in full:
  stateless CCS/2010/blade-an-attack-agnostic-approach-for-preventing-drive-by-malware-infections
  stateless IMC/2011/understanding-website-complexity-measurements-metrics-and-implications
  stateful  IMC/2012/evolution-of-social-attribute-networks-measurements-modeling-and-implications-us
  stateful  USENIX/2012/efficient-and-scalable-socware-detection-in-online-social-networks
  stateless IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o
  stateful  WWW/2013/traveling-the-silk-road-a-measurement-analysis-of-a-large-anonymous-online-marke
  stateful  WWW/2012/counting-beyond-a-yottabyte-or-how-sparql-1-1-property-paths-will-prevent-adopti
  stateful  USENIX/2015/measuring-the-longitudinal-evolution-of-the-online-anonymous-marketplace-ecosyst
  stateful  WWW/2015/e-commerce-reputation-manipulation-the-emergence-of-reputation-escalation-as-a-s
  stateless USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions
  stateful  IMC/2016/a-first-look-at-quality-of-mobile-live-streaming-experience-the-case-of-periscop
  stateful  IMC/2016/a-multi-perspective-analysis-of-carrier-grade-nat-deployment
  stateful  WWW/2016/tell-me-about-yourself-the-malicious-captcha-attack
  stateful  NDSS/2017/fake-co-visitation-injection-attacks-to-recommender-systems
  stateless PETS/2017/topics-of-controversy-an-empirical-analysis-of-web-censorship-lists
  stateless IMC/2018/an-empirical-analysis-of-the-commercial-vpn-ecosystem
  stateful  WWW/2018/crimebb-enabling-cybercrime-research-on-underground-forums-at-scale
  stateful  WWW/2019/web-experience-in-mobile-networks-lessons-from-two-million-page-visits
  stateless WWW/2019/who-watches-the-watchmen-exploring-complaints-on-the-web
  stateful  CCS/2020/impersonation-as-a-service-characterizing-the-emerging-criminal-infrastructure-f
  both      IMC/2020/reading-in-between-the-lines-an-analysis-of-dissenter
  stateless WWW/2020/a-first-look-at-commercial-5g-performance-on-smartphones
  stateful  NDSS/2021/all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers
  stateless NDSS/2021/cv-inspector-towards-automating-detection-of-adblock-circumvention
  stateless IMC/2022/causal-impact-of-android-go-on-mobile-web-performance
  stateless IMC/2022/phishinpatterns-measuring-elicited-user-interactions-at-scale-on-phishing-websit
  stateless IMC/2022/respect-the-origin-a-best-case-evaluation-of-connection-coalescing-in-the-wild
  stateful  USENIX/2022/experimental-security-analysis-of-the-app-model-in-business-collaboration-platfo
  both      WWW/2023/a-method-to-assess-and-explain-disparate-impact-in-online-retailing
  stateless NDSS/2024/on-precisely-detecting-censorship-circumvention-in-real-world-networks
  stateful  NDSS/2024/understanding-and-analyzing-appraisal-systems-in-the-underground-marketplaces
  stateless USENIX/2024/phishdecloaker-detecting-captcha-cloaked-phishing-websites-via-hybrid-vision-bas
  stateless WWW/2024/detecting-and-understanding-self-deleting-javascript-code
  stateful  IEEE-SP/2010/a-practical-attack-to-de-anonymize-social-network-users
  stateful  CCS/2025/lock-the-door-but-keep-the-window-open-extracting-app-protected-accessibility-in
  stateless IMC/2025/a-permissions-odyssey-a-systematic-study-of-browser-permissions-on-modern-websit
  stateless USENIX/2025/when-llms-go-online-the-emerging-threat-of-web-enabled-llms
  both      NDSS/2026/characterizing-the-implementation-of-censorship-policies-in-chinese-llm-services
  stateful  WWW/2025/the-poorest-man-in-babylon-a-longitudinal-study-of-cryptocurrency-investment-sca
  stateless NDSS/2026/loki-proactively-discovering-online-scams-by-mining-toxic-search-queries
  stateless NDSS/2026/benchmarking-and-understanding-safety-risks-in-ai-character-platforms
  stateless IEEE-SP/2018/the-spyware-used-in-intimate-partner-violence
  stateless IEEE-SP/2025/sok-decoding-the-enigma-of-encrypted-network-traffic-classifiers
  both      IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams
  stateless NDSS/2026/on-borrowed-time-measurement-informed-understanding-of-the-ntp-pools-robustness-to-monopoly-attacks
 
 
=== Every paper that states BOTH arms (the comparison studies), in full ===
 
Year  Venue    Slug                                                        repeatVisits  Shared crawlConfig quote (truncated)
----  -------  ----------------------------------------------------------  ------------  ----------------------------------------------------------------------------------------------------
2010  WWW      analyzing-content-level-properties-of-the-web-adversphere   —             We first disable cookies on our PlanetLab nodes ... After visiting the websites to establish a brows
2014  CCS      the-web-never-forgets-persistent-tracking-mechanisms-in-th  —             Note that, except for the sequential crawl (Crawl1 ), we ran multiple browsers in parallel to extend
2014  CCS      your-online-interests-pwned-a-pollution-attack-against-tar  50            Subsequently, users from both sets visit the controlled publisher page once every hour for a duratio
2015  NDSS     i-do-not-know-what-you-visited-last-summer-protecting-user  2             In each site, we randomly visit four more pages. ... This process is repeated twice: once starting w
2016  CCS      cspautogen-black-box-enforcement-of-content-security-polic  10            we use PhantomJS [34], a popular headless browser, to render each webpage ten times with five user-a
2016  CCS      online-tracking-a-1-million-site-measurement-and-analysis   —             For each site, the browser will visit the homepage and wait until the site has finished loading or u
2016  IMC      characterizing-website-behaviors-across-logged-in-and-not-  3             This ensures that each crawl is independent of each other by guaranteeing no state, e.g. cookies, is
2018  CCS      can-browser-add-ons-protect-your-children-from-online-trac  —             Privacy Badger - assuming no previous browsing history - is the least effective ... However, in the
2018  PETS     i-never-signed-up-for-this-privacy-implications-of-email-t  2             Each email is loaded twice in its own measurement instance: once with a fresh profile, and then agai
2018  WWW      adbudgetkiller-online-advertising-budget-draining-attack    —             Starting from a fresh profile, the profile trainer produces customized browsing profiles by simulati
2018  WWW      auditing-the-personalization-and-composition-of-politicall  —             the extension opened two new browser windows, one standard and one incognito, and began conducting s
2018  IEEE-SP  surveylance-automatically-detecting-online-survey-scams     3             The crawler remains on each page for 90 seconds before restarting the session and opening the next w
2019  PETS     4-years-of-eu-cookie-law-results-and-lessons-learned        5             If not otherwise specified, we take care of erasing the browser cache and cookies stored before each
2020  IMC      reading-in-between-the-lines-an-analysis-of-dissenter       —             To obtain the NSFW and “offensive” content ... we re-spider Dissenter using the HTTP cookies of an a
2020  WWW      stop-tracking-me-bro-differential-tracking-of-user-demogra  5             A HPW crawl with a loaded persona is stateless, i.e., each HPW website visit is independent. We repe
2021  WWW      cookie-swap-party-abusing-first-party-cookies-for-web-trac  3             After each website has finished loading, we wait for an additional two minutes... This process is th
2022  CCS      im-spartacus-no-im-spartacus-proactively-protecting-users-  2             We evaluate the effectiveness of Spartacus by visiting the same phishing web sites with two differen
2022  PETS     how-can-and-would-people-protect-from-online-tracking       2             On the second visit, we accept the cookies... and on the next visit, we try to opt-out from the prev
2022  USENIX   web-cache-deception-escalates                               —             We set up our crawler to visit pages on any subdomain we may discover on the target website, and tes
2023  WWW      a-method-to-assess-and-explain-disparate-impact-in-online-  —             After collecting data for the selected products and zip codes, the crawler closes the browser and ca
2023  IEEE-SP  the-leaky-web-automated-discovery-of-cross-site-informatio  5             We visit every pair up to five times to minimize the probability of false positives due to server-si
2024  PETS     opted-out-yet-tracked-are-regulations-enough-to-protect-yo  9             After filtering the websites, we iteratively visit each website nine times from each of our 16 (+ co
2024  IEEE-SP  to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-a  5             Each experiment ... crawled the site twice independently in parallel, once with the received session
2025  PETS     johnny-can-t-revoke-consent-either-measuring-compliance-of  1             we visit each website afresh with storage cleared for all websites in the browser
2025  PETS     intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-  1             each crawl within a run is performed once without repetition
2025  PETS     sheeps-clothing-wolfish-intent-automated-detection-and-eva  —             Browser state was purged after every crawl. Ad screenshots were collected from the targeted websites
2026  NDSS     characterizing-the-implementation-of-censorship-policies-i  5             for each query and service, we complete five separate tests. For the majority of services, we keep t
2026  PETS     the-masks-we-think-we-wear-privacy-threats-of-browser-exte  —             Each experiment starts from a copy of the corresponding clean profile so that the wallet always begi
2026  PETS     redefining-website-fingerprinting-attacks-with-multi-agent  —             The crawler does not emulate user interaction such as scrolling, pausing, or branching behavior. It
 
 
=== Every paper that states a stateful-only crawl, in full ===
 
Year  Venue    Slug
----  -------  --------------------------------------------------------------------------
2010  IMC      challenges-in-measuring-online-advertising-systems
2010  IEEE-SP  a-practical-attack-to-de-anonymize-social-network-users
2011  CCS      automated-black-box-detection-of-side-channel-vulnerabilities-in-web-appli
2012  IMC      evolution-of-social-attribute-networks-measurements-modeling-and-implicati
2012  USENIX   efficient-and-scalable-socware-detection-in-online-social-networks
2012  WWW      counting-beyond-a-yottabyte-or-how-sparql-1-1-property-paths-will-prevent-
2013  CCS      delta-automatic-identification-of-unknown-web-based-infection-campaigns
2013  WWW      traveling-the-silk-road-a-measurement-analysis-of-a-large-anonymous-online
2014  WWW      adscape-harvesting-and-analyzing-online-display-ads
2014  WWW      quite-a-mess-in-my-cookie-jar-leveraging-machine-learning-to-protect-web-a
2015  USENIX   measuring-the-longitudinal-evolution-of-the-online-anonymous-marketplace-e
2015  USENIX   the-unexpected-dangers-of-dynamic-javascript
2015  WWW      cookies-that-give-you-away-the-surveillance-implications-of-web-tracking
2015  WWW      e-commerce-reputation-manipulation-the-emergence-of-reputation-escalation-
2015  CCS      sunlight-fine-grained-targeting-detection-at-scale-with-statistical-confid
2015  IEEE-SP  understanding-and-monitoring-embedded-web-scripts
2016  IMC      a-first-look-at-quality-of-mobile-live-streaming-experience-the-case-of-pe
2016  IMC      a-multi-perspective-analysis-of-carrier-grade-nat-deployment
2016  USENIX   internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-stud
2016  USENIX   tracing-information-flows-between-ad-exchanges-using-retargeted-ads
2016  WWW      tell-me-about-yourself-the-malicious-captcha-attack
2017  NDSS     fake-co-visitation-injection-attacks-to-recommender-systems
2017  PETS     cross-device-tracking-measurement-and-disclosures
2018  CCS      mystique-uncovering-information-leakage-from-browser-extensions
2018  WWW      crimebb-enabling-cybercrime-research-on-underground-forums-at-scale
2018  WWW      hiding-in-the-crowd-an-analysis-of-the-effectiveness-of-browser-fingerprin
2019  IMC      tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosy
2019  NDSS     dont-trust-the-locals-investigating-the-prevalence-of-persistent-client-si
2019  WWW      before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-pr
2019  WWW      evaluating-anti-fingerprinting-privacy-enhancing-technologies
2019  WWW      measuring-political-personalization-of-google-news-search
2019  WWW      web-experience-in-mobile-networks-lessons-from-two-million-page-visits
2020  CCS      impersonation-as-a-service-characterizing-the-emerging-criminal-infrastruc
2020  CCS      the-cookie-hunter-automated-black-box-auditing-for-web-authentication-and-
2020  NDSS     cross-origin-state-inference-cosi-attacks-leaking-web-site-states-through-
2020  PETS     canarytrap-detecting-data-misuse-by-third-party-apps-on-online-social-netw
2020  PETS     inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosy
2020  PETS     missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisib
2020  USENIX   cached-and-confused-web-cache-deception-in-the-wild
2020  WWW      beyond-the-front-page-measuring-third-party-dynamics-in-the-field
2021  NDSS     all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-me
2021  USENIX   jaw-studying-client-side-csrf-with-hybrid-property-graphs-and-declarative-
2021  USENIX   prisec-a-privacy-settings-enforcement-controller
2021  IEEE-SP  black-widow-blackbox-data-driven-web-scanning
2022  CCS      a-run-a-day-wont-keep-the-hacker-away-inference-attacks-on-endpoint-privac
2022  CCS      cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entan
2022  IMC      measuring-uid-smuggling-in-the-wild
2022  PETS     atom-ad-network-tomography
2022  USENIX   a-large-scale-investigation-into-geodifferences-in-mobile-apps
2022  USENIX   experimental-security-analysis-of-the-app-model-in-business-collaboration-
2022  WWW      measuring-the-privacy-vs-compatibility-trade-off-in-preventing-third-party
2022  IEEE-SP  the-state-of-the-samesite-studying-the-usage-effectiveness-and-adequacy-of
2022  IEEE-SP  towards-automated-auditing-for-account-and-session-management-flaws-in-sin
2023  CCS      marketing-to-children-through-online-targeted-advertising-targeting-mechan
2023  NDSS     rescan-a-middleware-framework-for-realistic-and-robust-black-box-web-appli
2023  USENIX   a-large-scale-measurement-of-website-login-policies
2023  IMC      tracking-profiling-and-ad-targeting-in-the-alexa-echo-smart-speaker-ecosys
2023  IEEE-SP  toss-a-fault-to-your-witcher-applying-grey-box-coverage-guided-mutational-
2024  IMC      browsing-without-third-party-cookies-what-do-you-see
2024  NDSS     understanding-and-analyzing-appraisal-systems-in-the-underground-marketpla
2024  PETS     a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-p
2024  IMC      poster-identifying-filter-bubble-based-on-feed-level-embedding-similarity-
2024  PETS     a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on
2024  USENIX   spider-scents-grey-box-database-aware-web-scanning-for-stored-xss
2024  WWW      tiktok-and-the-art-of-personalization-investigating-exploration-and-exploi
2024  IEEE-SP  holistic-concolic-execution-for-dynamic-web-applications-via-symbolic-inte
2025  CCS      lock-the-door-but-keep-the-window-open-extracting-app-protected-accessibil
2025  IEEE-SP  403-forbidden-ethically-evaluating-broken-access-control-in-the-wild
2025  NDSS     evocrawl-exploring-web-application-code-and-state-using-evolutionary-searc
2025  PETS     beyond-the-request-harnessing-http-response-headers-for-cross-browser-web-
2025  PETS     more-and-scammier-ads-the-perils-of-youtubes-ad-privacy-settings
2025  WWW      the-poorest-man-in-babylon-a-longitudinal-study-of-cryptocurrency-investme
2025  WWW      before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation
2025  PETS     understanding-regional-filter-lists-efficacy-and-impact
2025  WWW      the-first-early-evidence-of-the-use-of-browser-fingerprinting-for-online-t
2026  IEEE-SP  setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs
2026  PETS     from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-

Three fields on this page needed folding. Nothing else on the page aggregates free text.

Reused scripts/tool_fold.mjs unchanged — the same file Programming:Crawler uses, so the two pages cannot disagree about what “a Selenium paper” is. Families are explicit ordered regex lists; first match wins; the unmapped residue is printed by report_crawler.mjs and is not re-printed here.

One deliberate discrepancy, resolved in the script rather than in prose. Programming:Crawler:OpenWPM defines “an OpenWPM paper” as any tools[] tuple whose name matches /open[\s-]?wpm/i with usedOrMentioned ∈ {used, produced}, regardless of the tuple's category. tool_fold.mjs only considers tuples categorised crawler-framework or browser-automation. The two definitions differ by one paper inside the crawling population:

Both rows are printed by report_stateful_stateless.mjs. The page quotes 55.2% and names the other number and its definition in the same paragraph.

The word “stateful” belongs to two literatures (tracking measurement; web-application security scanning) and the extraction does not separate them. There is no enum for this, so it was folded by keyword over a bag built from slug + every detection.phenomenon + every classification.target/targetDetail. The two regexes, verbatim from scripts/report_stateful_stateless.mjs:

const TRACKING_RE =
  /track|cookie|consent|banner|advertis|\bads?\b|advert|fingerprint|privacy|gdpr|ccpa|personaliz|personalis|retarget|ad.?network|third.?part|tcf|cmp|profiling|analytics|pixel/i;
const APPSEC_RE =
  /vulnerab|xss|csrf|sqli|sql.injection|scanner|scanning|fuzz|exploit|access control|authentication bypass|session (management|fixation)|web application (security|scan)|taint|code coverage|crawler coverage|state.space|csp\b|content security policy|cache deception|xs-leak|clickjack/i;

A paper matching both is reported as “both vocabularies present” rather than assigned; a paper matching neither is residue and is printed in full, 45 papers, in the report output above. Spot-reading the residue: it is dominated by papers that are not web crawls in either sense (an NTP-pool robustness study, a carrier-grade-NAT deployment study, a commercial-VPN ecosystem study, a 5G performance study, several underground-marketplace studies). That is the expected shape for a broad security corpus and is why the residue is a row in the page's table rather than a footnote.

This fold is not presented on the page as a precise measurement. It is a two-way split by keyword, published as a ranking with the residue visible, exactly as the free-text rule requires.

crawlConfig.statefulness, .interactionDepth, .consentAction, .authentication, .repeatVisits and venue/year are enums or integers. They are published as exact percentages without folding.

crawlConfig carries one evidence.quote for the whole configuration object — statefulness, browsers, headless, consent action, interaction depth and authentication all share it. So the dataset's standard advice (“read a handful of evidence.quote values behind any figure”) cannot validate this field: the quote behind a statefulness value is as often evidence for the browser or the interaction depth. This page is entirely about that field, so two checks were built.

node scripts/statefulness_probe.mjs                # summary
node scripts/statefulness_probe.mjs --sentences    # the candidate sentences, per paper
node scripts/statefulness_probe.mjs --only both --sentences

For each paper, every sentence in its own paper.cols.txt containing a state-management term and a first-person marker is extracted. A paper with no such sentence stated its statefulness nowhere the text can show, so the value was inferred rather than read.

statefulness_probe_output.txt

Value      Papers  Text has a state sentence  Text has none  No full text  Shared quote itself mentions state
---------  ------  -------------------------  -------------  ------------  ----------------------------------
stateless  113     93 (82.3%)                 20 (17.7%)     0             51 (45.1%)
stateful   77      58 (75.3%)                 19 (24.7%)     0             12 (15.6%)
both       29      27 (93.1%)                 2 (6.9%)       0             9 (31.0%)
 
all stated: 219 papers; 178 (81.3%) have at least one state-management sentence in their own text, 41 (18.7%) have none, 0 have no full text on disk.
the shared crawlConfig quote itself contains a state term for only 72 (32.9%) of them — which is the point: the quote is not evidence for this field.
 
papers with NO state sentence in their own text (the false-positive candidates):
  both      WWW/2010/analyzing-content-level-properties-of-the-web-adversphere
  stateless IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o
  stateful  WWW/2013/traveling-the-silk-road-a-measurement-analysis-of-a-large-anonymous-online-marke
  stateful  WWW/2012/counting-beyond-a-yottabyte-or-how-sparql-1-1-property-paths-will-prevent-adopti
  stateful  USENIX/2015/measuring-the-longitudinal-evolution-of-the-online-anonymous-marketplace-ecosyst
  stateful  WWW/2015/e-commerce-reputation-manipulation-the-emergence-of-reputation-escalation-as-a-s
  stateless USENIX/2014/hulk-eliciting-malicious-behavior-in-browser-extensions
  stateless USENIX/2014/effective-attacks-and-provable-defenses-for-website-fingerprinting
  stateful  WWW/2016/tell-me-about-yourself-the-malicious-captcha-attack
  stateless PETS/2017/fingerprinting-keywords-in-search-queries-over-tor
  stateless USENIX/2018/freezing-the-web-a-study-of-redos-vulnerabilities-in-javascript-based-web-server
  stateful  WWW/2018/crimebb-enabling-cybercrime-research-on-underground-forums-at-scale
  stateful  NDSS/2019/dont-trust-the-locals-investigating-the-prevalence-of-persistent-client-side-cross-site-scripting-in-the-wild
  stateful  WWW/2019/evaluating-anti-fingerprinting-privacy-enhancing-technologies
  stateless WWW/2019/who-watches-the-watchmen-exploring-complaints-on-the-web
  both      IMC/2020/reading-in-between-the-lines-an-analysis-of-dissenter
  stateful  NDSS/2020/cross-origin-state-inference-cosi-attacks-leaking-web-site-states-through-xs-leaks
  stateless NDSS/2021/cv-inspector-towards-automating-detection-of-adblock-circumvention
  stateless WWW/2021/tls-1-3-in-practice-how-tls-1-3-contributes-to-the-internet
  stateful  CCS/2022/a-run-a-day-wont-keep-the-hacker-away-inference-attacks-on-endpoint-privacy-zone
  stateless IMC/2022/respect-the-origin-a-best-case-evaluation-of-connection-coalescing-in-the-wild
  stateful  USENIX/2022/a-large-scale-investigation-into-geodifferences-in-mobile-apps
  stateless PETS/2023/blocking-javascript-without-breaking-the-web-an-empirical-investigation
  stateless PETS/2023/evaluating-practical-quic-website-fingerprinting-defenses-for-the-masses
  stateless USENIX/2023/automated-cookie-notice-analysis-and-enforcement
  stateful  IMC/2024/browsing-without-third-party-cookies-what-do-you-see
  stateful  NDSS/2024/understanding-and-analyzing-appraisal-systems-in-the-underground-marketplaces
  stateful  USENIX/2024/spider-scents-grey-box-database-aware-web-scanning-for-stored-xss
  stateful  IEEE-SP/2015/understanding-and-monitoring-embedded-web-scripts
  stateful  NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search
  stateful  PETS/2025/beyond-the-request-harnessing-http-response-headers-for-cross-browser-web-tracke
  stateless NDSS/2025/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector
  stateless NDSS/2026/loki-proactively-discovering-online-scams-by-mining-toxic-search-queries
  stateless IEEE-SP/2025/sok-decoding-the-enigma-of-encrypted-network-traffic-classifiers
  stateless NDSS/2026/pruning-the-tree-rethinking-rpki-architecture-from-the-ground-up
  stateless PETS/2026/clicking-into-exposure-uncovering-privacy-risks-of-google-click-identifier-in-yo
  stateless PETS/2026/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr
  stateless IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages
  stateless IEEE-SP/2022/surakav-generating-realistic-traces-for-a-strong-website-fingerprinting-defense
  stateful  IEEE-SP/2021/black-widow-blackbox-data-driven-web-scanning
  stateful  IEEE-SP/2024/holistic-concolic-execution-for-dynamic-web-applications-via-symbolic-interprete

The term regex is deliberately wide (it matches “fresh profile”, “cookie jar”, “incognito”, “cleared the browser”, “between each visit”, “seed profile”, “persona” and about twenty more forms), because a false negative here would understate corroboration, which is the direction that flatters the extraction. Even so, hand-reading a sample of the 41 no-sentence papers showed that some are probe misses rather than extraction errors — application-security scanners (Black Widow, JAW, EvoCrawl, Spider-Scents) discuss “state” in ways the regex does not match, because for them state means the application's session and database rather than the browser profile. So 18.7% is an upper bound on the false-positive rate, not a measurement of it, and the page says so.

One clean confirmed false positive found in that set: USENIX/2023/automated-cookie-notice-analysis-and-enforcement is labelled stateless and the string “stateful”/“stateless” appears zero times in its full text.

The both bucket is the page's most load-bearing set — it is the reading list of comparison studies — so all 29 were read rather than sampled, using the probe's –only both –sentences output plus the paper text where that was thin.

node scripts/statefulness_audit.mjs
node scripts/statefulness_audit.mjs --detail

statefulness_audit_detail.txt

population: the 29 papers labelled crawlConfig.statefulness = "both", read in full
 
Verdict  Papers  Share of 29  Meaning
-------  ------  -----------  -------------------------------------------------------------------------------
ok       16      55.2%        a stateful arm and a stateless arm really were both run
partial  10      34.5%        two conditions, but the contrast is login / seeding / consent, not statefulness
wrong    3       10.3%        no stateful-vs-stateless contrast in the paper at all
 
Effect on the page's figures: of 219 papers with a stated statefulness, 29 are "both".
Counting only the 16 adjudicated-ok papers as genuine comparison studies, the corpus holds 16 of 1120 crawling papers (1.4%) that ran both arms — not 29 (2.6%).
Read as an error rate for this field: 3 of 29 (10.3%) hard false positives, 10 of 29 (34.5%) where the enum value overstates what the paper did.
This is one coder's judgement on one bucket; it is not a measurement of the whole field's accuracy.
 
per paper:
 
PARTIAL  WWW/2010/analyzing-content-level-properties-of-the-web-adversphere
         cookies are DISABLED for one arm and a browsing pattern is established for the other; a no-cookies arm is not a stateless crawl arm
OK       CCS/2014/the-web-never-forgets-persistent-tracking-mechanisms-in-the-wild
         "except for the sequential crawl (Crawl1), we ran multiple browsers in parallel ... at the cost of not keeping a profile state (cookies, localStorage) between visits"
OK       CCS/2014/your-online-interests-pwned-a-pollution-attack-against-targeted-advertising
         polluted profiles against "clean profiles by replaying user web traces bypassing the profile polluter"
OK       NDSS/2015/i-do-not-know-what-you-visited-last-summer-protecting-users-from-third-party-web
         "repeated twice: once starting with a clean browser and once more after priming the client-side state"
PARTIAL  CCS/2016/cspautogen-black-box-enforcement-of-content-security-policy-upon-real-world-webs
         "two cookie settings (i.e., a clean cookie jar and a cookie jar initiated with login credential)" — that is a login-state contrast, not accumulation across sites
OK       CCS/2016/online-tracking-a-1-million-site-measurement-and-analysis
         the census configuration table lists Default Stateless (1M sites) beside Default Stateful (100k)
PARTIAL  IMC/2016/characterizing-website-behaviors-across-logged-in-and-not-logged-in-users
         logged-in against not-logged-in; between crawls "no state, e.g. cookies, is maintained" — a login contrast inside a stateless harness
OK       CCS/2018/can-browser-add-ons-protect-your-children-from-online-tracking
         Privacy Badger measured "assuming no previous browsing history" and again with "accumulated browsing history (post-calibration)"
OK       PETS/2018/i-never-signed-up-for-this-privacy-implications-of-email-tracking
         "loaded twice in its own measurement instance: once with a fresh profile, and then again keeping the same browser profile"
PARTIAL  WWW/2018/adbudgetkiller-online-advertising-budget-draining-attack
         a profile trainer starts from a fresh profile and accumulates; the "fresh" state is the start of the stateful arm, not a separate stateless arm
OK       WWW/2018/auditing-the-personalization-and-composition-of-politically-related-search-engin
         "the extension opened two new browser windows, one standard and one incognito" — a logged-in/personalised window against a clean one
WRONG    IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams
         the crawler "remains on each page for 90 seconds before restarting the session"; that is a stateless crawl and no second arm is described
PARTIAL  PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
         main crawl erases cache and cookies before each visit; a separate consent experiment exists, so the second arm is a consent arm, not a stateful crawl
PARTIAL  IMC/2020/reading-in-between-the-lines-an-analysis-of-dissenter
         an anonymous spider and a re-spider "using the HTTP cookies of an authenticated account" — authentication state, not accumulated tracking state
OK       WWW/2020/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa
         personas are trained statefully, then "A HPW crawl with a loaded persona is stateless, i.e., each HPW website visit is independent"
OK       WWW/2021/cookie-swap-party-abusing-first-party-cookies-for-web-tracking
         repeat visits with retained state alongside fresh-profile visits
WRONG    CCS/2022/im-spartacus-no-im-spartacus-proactively-protecting-users-from-phishing-by-inten
         the two configurations are "default settings" against "Spartacus installed" — an extension contrast, nothing to do with statefulness
OK       PETS/2022/how-can-and-would-people-protect-from-online-tracking
         sequential visits carry consent state ("On the second visit, we accept the cookies ... on the next visit, we try to opt-out"), plus a private-mode arm
OK       USENIX/2022/web-cache-deception-escalates
         cache state is the object of study and both a primed and an unprimed cache are exercised
PARTIAL  WWW/2023/a-method-to-assess-and-explain-disparate-impact-in-online-retailing
         neighbouring zip codes share one session, then "the crawler closes the browser and carefully deletes the local browsing history and cookies" — stateful within a batch, stateless between
OK       IEEE-SP/2023/the-leaky-web-automated-discovery-of-cross-site-information-leaks-in-browsers-an
         "logged-in state, and anonymous state ... a fresh browser context that we reset between"
OK       PETS/2024/opted-out-yet-tracked-are-regulations-enough-to-protect-your-privacy
         personas accumulate state across nine iterated visits, with control personas
OK       IEEE-SP/2024/to-auth-or-not-to-auth-a-comparative-analysis-of-the-pre-and-post-login-security
         "crawled the site twice independently in parallel, once with the received session" — pre- and post-login arms
PARTIAL  PETS/2025/johnny-can-t-revoke-consent-either-measuring-compliance-of-consent-revocation-on
         "we visit each website afresh with storage cleared for all websites"; revocation is measured inside one session, so the contrast is within-visit, not between arms
OK       PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
         accept banners statefully across the first half of the list, then measure the second half with that profile loaded — the design the whole paper is about
WRONG    PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic
         "Browser state was purged after every crawl ... a fresh Chrome profile for each site" — purely stateless. The only "stateful" in the paper is "Stateful tracking stores explicit identifiers in the browser", i.e. the OTHER meaning of the word
OK       NDSS/2026/characterizing-the-implementation-of-censorship-policies-in-chinese-llm-services
         "we keep the browser session persistent" for most services but "instantiate new browser sessions for each query" for Kimi — genuinely both, though the subject is LLM chat services rather than the web
PARTIAL  PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w
         "Each experiment starts from a copy of the corresponding clean profile" — a seeded profile reset per experiment, i.e. seeded-stateless
PARTIAL  PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms
         LLM-persona sessions are contrasted with the "stateless nature of robot-generated sessions"; the contrast is agent-driven vs scripted browsing, statefulness is a side effect

The verdicts are one coder's judgement, recorded in VERDICTS in the script with a reason per paper so they can be argued with. Two verdicts are worth flagging as contestable:

• WWW/2018/auditing-the-personalization-and-composition-of-politically-related-search-engin was scored ok on “the extension opened two new browser windows, one standard and one incognito”. An incognito window is not the same as a fresh profile, so this is a defensible partial.
• NDSS/2026/characterizing-the-implementation-of-censorship-policies-in-chinese-llm-services was scored ok — it genuinely keeps sessions persistent for most services and fresh for one — but the subject is LLM chat services, not the web, so it is a real comparison study of a phenomenon this page is not about.

The three wrong verdicts are the informative ones. Two are extension or configuration contrasts mistaken for statefulness contrasts; the third, PETS/2025/sheeps-clothing-…, is the terminology trap in action: the extraction saw “Stateful tracking stores explicit identifiers in the browser” and labelled a purely stateless crawl as running both modes. That single case is why the page opens with the disambiguation.

Effect on the page: the page reports 16 genuine comparison studies (1.4% of 1,120), not 29 (2.6%), and says which number came from where.

Every quotation on the page is checked by script against the paper it is attributed to.

node scripts/state_quotecheck.mjs

Whitespace, quote characters, dashes and ligatures are normalised; nothing else is. Each quote is tried against paper.cols.txt, then paper.norm.txt, then — because both text renderings splice two-column text — against paper.pdf itself via scripts/pdf_grep.py (pypdf 6.16.1, de-hyphenated). The rendering that matched is printed, because a quote that only the PDF has is a quote whose .cols text is spliced, and that is worth knowing.

Result: 37 of 37 pass (29 when the checker was first written; eight more were added with the comparison-studies table and the tightened denominators). Four passed only against the PDF:

Two quotes were rewritten during checking rather than published as first drafted:

• The Jueckstock quote was first written as “the browser is launched with a clean user profile (i.e., no cookies or cached content)”. pypdf renders the parenthesis as “( i.e.,” with a leading space, so the longer form is not verbatim in any rendering. Shortened to the contiguous clause.
• A quote attributed to [4Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] about not clearing state between subpage visits was invented from memory during drafting and did not exist in the paper. Caught by the checker on the first run. It was replaced by the real sentence, which says something better and different: the profile is loaded but not altered, i.e. the design is seeded-stateless, not stateful. The page's whole “three positions, not two” section came out of that correction.

state_quotecheck_output.txt

PASS  CCS 2016 online-tracking-a-1-million-site-measurement-a
        found in: paper.cols.txt
        used for: why stateful crawls do not scale
        "Making stateful measurements is fundamentally at odds with parallelism."
PASS  CCS 2016 online-tracking-a-1-million-site-measurement-a
        found in: paper.cols.txt
        used for: how good a seed profile is
        "We find that a seed profile which has visited the top 10,000 sites will have communicated with 76% of all third-party domains present on more than 5 o…"
PASS  CCS 2016 online-tracking-a-1-million-site-measurement-a
        found in: paper.cols.txt
        used for: the parallelism cost of statefulness
        "On the same machine we can run 20 browser instances in parallel if the browser state is cleared after each page load."
PASS  CCS 2016 online-tracking-a-1-million-site-measurement-a
        found in: paper.cols.txt
        used for: why the limit differs
        "stateful parallel measurements are memory-limited while stateless parallel measurements are typically CPU-limited"
PASS  CCS 2016 online-tracking-a-1-million-site-measurement-a
        found in: paper.cols.txt
        used for: the seed-profile artefact
        "third parties which don’t appear in the top sites if the seed profile will have different cookies set in each of the parallel instances"
PASS  CCS 2014 the-web-never-forgets-persistent-tracking-mech
        found in: paper.cols.txt
        used for: the parallelism/state trade made explicit
        "except for the sequential crawl (Crawl1 ), we ran multiple browsers in parallel to extend the reach of the study at the cost of not keeping a profile …"
PASS  CCS 2014 the-web-never-forgets-persistent-tracking-mech
        found in: paper.cols.txt
        used for: respawning makes a clean profile hard
        "once some tracking has happened, it is hard to start from a truly clean profile"
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.cols.txt
        used for: the crawler-vs-human gap in third parties
        "crawler site visits issued requests to a median of 11.6 third-party domains, whereas for visits by humans, the median was 4.5 third parties"
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.cols.txt
        used for: the crawler-vs-human gap in trackers
        "The median number of tracking domains accessed by a user on visiting a Trexa list site is 1.9, whereas for the crawler it is 6.1."
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.cols.txt
        used for: the tail of the gap
        "while users’ browsers only connect to up to 8 trackers in 99% of visits to list sites, the crawler may reach 26"
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.cols.txt, paper.norm.txt
        used for: set overlap, not just counts
        "the average similarity in third parties is low, with a median of 20%, and in most cases (87% of list domains) this is due to the crawler accessing mor…"
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.pdf (both text renderings splice it)
        used for: the mechanism they propose for the gap
        "cookie syncing is not necessary for users who have already had their cookies synced, whereas a stateless crawler browser instance with a fresh profile…"
PASS  WWW 2020 the-representativeness-of-automated-web-crawls
        found in: paper.cols.txt
        used for: order dependence
        "A stateful crawler, i.e., one that supports cookies, caches or other persistent data, may be desirable to better emulate users, but the results of the…"
PASS  WWW 2022 reproducibility-and-replicability-of-web-measu
        found in: paper.cols.txt
        used for: the reporting requirement
        "authors need to document what part of a browser profile is maintained statefully, what part is reset, and when"
PASS  WWW 2022 reproducibility-and-replicability-of-web-measu
        found in: paper.cols.txt
        used for: what each design can answer
        "In stateful experiments, the order of visited pages potentially impacts the results, and it accounts for HTTP session-specific phenomena, such as opt-…"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: the headline stateful-only result
        "Our findings reveal that around 50% of websites send at least one intractable cookie"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: CMP vs native
        "websites with Consent Management Platform (CMP) banners, on average, send 6.9 times more intractable cookies compared to those with native banners"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: GPC effect
        "enabling the Global Privacy Control (GPC) signal initially reduces the number of intractable cookies by 30% on average, with a further 32% reduction p…"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt, paper.norm.txt
        used for: reload changes the answer
        "on average, 25% of intractable cookies are not sent after reloading"
PASS  WWW 2020 stop-tracking-me-bro-differential-tracking-of-
        found in: paper.cols.txt
        used for: the hybrid seed-then-stateless design
        "A HPW crawl with a loaded persona is stateless, i.e., each HPW website visit is independent."
PASS  PETS 2018 i-never-signed-up-for-this-privacy-implication
        found in: paper.pdf (both text renderings splice it)
        used for: the matched-pair design
        "Each email is loaded twice in its own measurement instance: once with a fresh profile, and then again keeping the same browser profile after sleeping …"
PASS  WWW 2021 towards-realistic-and-reproducibleweb-crawl-me
        found in: paper.pdf (both text renderings splice it)
        used for: this paper is stateless throughout, contrary to a claim on a neighbouring page
        "First, the browser is launched with a clean user profile"
PASS  NDSS 2021 tales-of-favicons-and-caches-persistent-tracki
        found in: paper.cols.txt, paper.norm.txt
        used for: the favicon cache is not cleared by clearing browsing data
        "is not affected when users clear"
PASS  WWW 2020 beyond-the-front-page-measuring-third-party-dy
        found in: paper.pdf (both text renderings splice it)
        used for: the seeded-stateless design and its order-independence justification
        "This profile is loaded before each website visit but is not altered. Hence, each website visit uses the same profile and the order of visited websites…"
PASS  CCS 2014 the-web-never-forgets-persistent-tracking-mech
        found in: paper.cols.txt
        used for: respawning plus syncing defeats a state clear
        "This scenario enables at least 11% of a user's history to be tracked over time."
PASS  WWW 2020 stop-tracking-me-bro-differential-tracking-of-
        found in: paper.cols.txt
        used for: what a trained profile buys you
        "having an established persona from a particular demographic (with cookies obtained from visiting stereotypical websites for users of that demographic)…"
PASS  WWW 2020 beyond-the-front-page-measuring-third-party-dy
        found in: paper.cols.txt
        used for: the subpage effect measured under a seeded-stateless design
        "subsites set considerably more (36 %) cookies than the respective landing pages. On average, 55 cookies were set when loading a landing page while 78 …"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: partitioning does not yet blunt cross-site state
        "only 1.3% of all unique tracking cookies are partitioned, with more than half accompanied by nonpartitioned cookies from the same tracker domain"
PASS  PETS 2022 my-cookie-is-a-phoenix-detection-measurement-a
        found in: paper.cols.txt
        used for: a stateless harness detecting a stateful mechanism, via paired visits
        "we perform two stateless crawling instances from machine A as described in Figure 2 (Initial and Reappearance crawl)"
PASS  PETS 2022 my-cookie-is-a-phoenix-detection-measurement-a
        found in: paper.cols.txt
        used for: what makes the paired-visit design work
        "we only collect cookies that appear in both the Initial and Reappearance crawl when visiting the same website in the two crawls"
PASS  CCS 2014 the-web-never-forgets-persistent-tracking-mech
        found in: paper.cols.txt
        used for: the scale of Flash respawning
        "33 different Flash cookies from 30 different domains respawned a total of 355 cookies on 107 first party domains"
PASS  PETS 2022 my-cookie-is-a-phoenix-detection-measurement-a
        found in: paper.cols.txt
        used for: a stateful phenomenon measured statelessly, with its denominator
        "of the Alexa top 30, 000 websites use cookie respawning with browser fingerprinting"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: the design, and the real denominator of the 50% figure
        "we crawl the top 20,000 websites from Tranco, accepting cookie banners in the first half and measuring the number of intractable cookies on successful…"
PASS  PETS 2025 intractable-cookie-crumbs-unveiling-the-nexus-
        found in: paper.cols.txt
        used for: order randomisation as an order-effect control
        "we randomly select and shuffle 20k sites from Tranco"
PASS  WWW 2022 reproducibility-and-replicability-of-web-measu
        found in: paper.cols.txt
        used for: they announce a crawling-strategy analysis
        "Since the effects of C5 and C11 are not yet adequately discussed by previous work, we analyze them in Section 4"
PASS  WWW 2022 reproducibility-and-replicability-of-web-measu
        found in: paper.cols.txt
        used for: and then do not deliver it: C11 is absent
        "four exemplarily case studies focusing on C4, C5, C10, and C12"
PASS  WWW 2022 reproducibility-and-replicability-of-web-measu
        found in: paper.cols.txt
        used for: their own 24 profiles are stateless
        "the commander issues a signal to start the experiment as stateless coordinated crawls of the provided URLs"
 
37 pass, 0 fail, of 37 quotations.

Three probes. All were run in this container on 2026-08-19 with Playwright 1.62.1 and its own pinned Chromium 151.0.7922.34, PLAYWRIGHT_BROWSERS_PATH=/workspace/.playwright.

scripts/state_probe/{server,probe}.mjs. An instrumented local origin sets a server cookie, a JS cookie, a localStorage marker and an immutable-cached subresource; the crawler visits twice with a different reset in between.

state_probe_output.txt

Reset between visit 1 and visit 2                               cookie  localStorage  cache hit
--------------------------------------------------------------  ------  ------------  ---------
nothing — second page.goto() in the same context                ✓       ✓             ✓
context.newPage()                                               ✓       ✓             ✓
context.clearCookies()                                          ✗       ✓             ✓
clearCookies() + clearPermissions()                             ✗       ✓             ✓
browser.newContext() — new context, same browser process        ✗       ✗             ✗
fresh chromium.launch() (Playwright default, no user-data-dir)  ✗       ✗             ✗
launchPersistentContext() twice on the SAME user-data-dir       ✓       ✓             ✓
same user-data-dir + clearCookies() on relaunch                 ✗       ✓             ✓
storageState() saved and reloaded into a new context            ✓       ✓             ✗
 
✓ = the state SURVIVED the reset and visit 2 saw it. A stateless crawl needs ✗ in all three columns.
"cache hit" ✓ means the immutable subresource was NOT re-requested from the origin.
 
  nothing — second page.goto() in the same context
      visit 2 sent Cookie: srv=server-set; js=js-set; localStorage carried in: visit-1787135120253; /cached.js re-requested from origin: no
  context.newPage()
      visit 2 sent Cookie: srv=server-set; js=js-set; localStorage carried in: visit-1787135121376; /cached.js re-requested from origin: no
  context.clearCookies()
      visit 2 sent Cookie: (none); localStorage carried in: visit-1787135122565; /cached.js re-requested from origin: no
  clearCookies() + clearPermissions()
      visit 2 sent Cookie: (none); localStorage carried in: visit-1787135123666; /cached.js re-requested from origin: no
  browser.newContext() — new context, same browser process
      visit 2 sent Cookie: (none); localStorage carried in: (none); /cached.js re-requested from origin: yes
  fresh chromium.launch() (Playwright default, no user-data-dir)
      visit 2 sent Cookie: (none); localStorage carried in: (none); /cached.js re-requested from origin: yes
  launchPersistentContext() twice on the SAME user-data-dir
      visit 2 sent Cookie: srv=server-set; js=js-set; localStorage carried in: visit-1787135127368; /cached.js re-requested from origin: no
  same user-data-dir + clearCookies() on relaunch
      visit 2 sent Cookie: (none); localStorage carried in: visit-1787135128812; /cached.js re-requested from origin: no
  storageState() saved and reloaded into a new context
      visit 2 sent Cookie: srv=server-set; js=js-set; localStorage carried in: visit-1787135130296; /cached.js re-requested from origin: yes
 
playwright 1.62.1; chromium 151.0.7922.34; linux

A bug in this probe was caught and fixed before publication, and it is the kind that would have produced a wrong table. The first version measured localStorage.getItem('ls') after the page's inline script had already re-set it, so every row read “survived” and the column was meaningless. The fix stamps a unique marker once and reads window.__lsBefore — what the page found before writing its own. Only after that fix do the browser.newContext() and fresh-launch() rows correctly read “gone”.

A second bug: the script declared const URL = `http://…`, shadowing the global URL constructor, which made the version-printing line at the end throw TypeError: URL is not a constructor after the table had already printed. The published code renames it TARGET and the page's code listing carries the warning inline.

scripts/state_probe/thirdparty.mjs. Three HTTPS origins on loopback aliases (127.0.0.1 and 127.0.0.3 as two first-party “sites”, 127.0.0.2 as one third party), self-signed certificate, ignoreHTTPSErrors. HTTPS is required because a cross-site cookie needs SameSite=None, which needs Secure, which needs a trustworthy origin.

thirdparty_probe_output.txt

Engine                  third party got its cookie back on the SECOND, different site
----------------------  ----------------------------------------------------------
Chromium 151.0.7922.34  YES — sent "tp=third-party-id"
 
  Chromium 151.0.7922.34
      iframe loads seen: 1 on site 1, 1 on site 2
      Cookie header the third party received on site 1: (none — it is setting it here)
      Cookie header the third party received on site 2: tp=third-party-id
      context cookie jar afterwards: tp@127.0.0.2

Three failures on the way to that output, all recorded in the script's comments:

• First design used localhost as the second site. In this container getent hosts localhost resolves only to ::1, so a server bound to 127.0.0.1:8132 was unreachable and the script hung until killed. Switched to numeric loopback aliases.
• Playwright's Firefox will not launch here. Headless dies with RenderCompositorSWGL failed mapping default framebuffer, no dt; headed under a manually started Xvfb :99 dies for want of dbus-launch (xvfb-run itself fails earlier: xauth command not found). So the Firefox row is absent from the output rather than guessed, the script records the launch failure instead of crashing, and the page's Firefox claim rests on Mozilla's documentation, explicitly labelled as such. This is the one measurement the page wanted and could not take.
• headless: !process.env.DISPLAY is wrong in this container. DISPLAY is set even though no X server is reachable, so Playwright launched headed and died with “Looks like you launched a headed browser without having a XServer running”. Replaced with an explicit –headed flag.

scripts/state_probe/launch_args.mjs. Reads the real command line from chromium.launchServer().process().spawnargs and compares it against puppeteer.defaultArgs().

launch_args_output.txt

===== Playwright chromium.launchServer(): 45 flags =====
--disable-features (16):
    AvoidUnnecessaryBeforeUnloadCheckSync
    BoundaryEventDispatchTracksNodeRemoval
    DestroyProfileOnBrowserClose
    DialMediaRouteProvider
    GlobalMediaControls
    HttpsUpgrades   <-- changes what you measure
    LensOverlay
    MediaRouter
    PaintHolding
    ThirdPartyStoragePartitioning   <-- changes what you measure
    BlockOriginHeaderModificationOnRedirect
    Translate   <-- changes what you measure
    AutoDeElevate
    OptimizationHints   <-- changes what you measure
    msForceBrowserSignIn
    msEdgeUpdateLaunchServicesPreferredVersion
--enable-features: CDPScreenshotNewSurface
other flags worth knowing about:
    --disable-extensions
    --disable-sync
    --enable-unsafe-swiftshader
    --no-sandbox
    --user-data-dir=/tmp/playwright_chromiumdev_profile-Zrq7IG
 
===== Puppeteer defaultArgs(): 33 flags =====
--disable-features (9):
    Translate   <-- changes what you measure
    AcceptCHFrame   <-- changes what you measure
    MediaRouter
    OptimizationHints   <-- changes what you measure
    WebUIReloadButton
    WebUIOmniboxPopup
    WebUIOmniboxAimPopup
    ProcessPerSiteUpToMainFrameThreshold
    IsolateSandboxedIframes   <-- changes what you measure
--enable-features: PdfOopif
other flags worth knowing about:
    --disable-sync
    --enable-automation
    --disable-extensions
 
===== the difference, on the features that matter =====
  ThirdPartyStoragePartitioning    Playwright: disabled  Puppeteer: left on   <-- DISAGREE
  HttpsUpgrades                    Playwright: disabled  Puppeteer: left on   <-- DISAGREE
  IsolateSandboxedIframes          Playwright: left on   Puppeteer: disabled   <-- DISAGREE
  AcceptCHFrame                    Playwright: left on   Puppeteer: disabled   <-- DISAGREE
  OptimizationHints                Playwright: disabled  Puppeteer: disabled
  Translate                        Playwright: disabled  Puppeteer: disabled

Note that puppeteer.defaultArgs() returns a Promise in Puppeteer 25.5.0, not an array; the first version of this script failed with “its return value is not iterable”. The published version awaits it.

Everything outside the corpus was fetched, not recalled, on 2026-08-19. The page's “Since 2022 the engine decides” section is entirely external, so this table is the whole audit trail for it.

Rejected, and why:

• developers.google.com/privacy-sandbox/blog/cookie-countdown-2025 — returns HTTP 404. It is the URL a model would reach for from training data. Not cited.
• support.mozilla.org/en-US/kb/introducing-total-cookie-protection-standard-mode — returns a JavaScript client challenge (“A required part of this site couldn't load”) to curl. The Mozilla blog post was used instead; the support article was not cited on the basis of a page that never loaded.
• Any secondary summary of the third-party-cookie timeline. The Chrome position reversed twice (2024-07, 2025-04) and nearly every third-party write-up is stranded at one of the earlier states. Only the two dated Privacy Sandbox posts are cited.
• The claim that Playwright's Firefox partitions cookies like a release Firefox. Plausible and untested — Playwright ships its own patched Firefox build. Not asserted on the page in either direction, because the probe would not run.

• No controlled stateful-versus-stateless experiment exists in the corpus. Demir et al. [5Demir, Nurullah; Große-Kampmann, Matteo; Urban, Tobias; Wressnegger, Christian; Holz, Thorsten; Pohlmann, Norbert (2022): "Reproducibility and Replicability of Web Measurement Studies", in: Proceedings of the ACM Web Conference. (DOI)] explicitly name criterion C11 (crawling strategy) as one whose effects “are not yet adequately discussed by previous work” and then vary browser (C5), region (C12), interaction (C10) and repetition (C4) instead — §4.1 confirms all 24 of their profiles are stateless. So the size of the effect this whole page is about is unmeasured, and the page says so in Open Questions rather than filling the gap with an estimate.
• The 18.7% no-supporting-sentence rate is an upper bound, not a false-positive rate. Establishing the real rate needs all 41 papers hand-read; only a sample was.
• The 98% run-to-run stability of crawlConfig.statefulness comes from the previous 4,322-paper corpus's stability100/ comparison and has not been re-measured on the current run. The page labels it as such.
• Firefox's actual behaviour under a research crawl — see the rejected row above.
• Whether the seed-profile artefact Englehardt and Narayanan predicted actually inflates cookie-sync counts, and by how much. Nobody has measured it; the page lists it as an open question rather than quantifying it.
• Figures deliberately not published. A statefulness × vantage.infrastructure cross-tab was computed and dropped: the cells fall below ten papers almost everywhere and the result would have been noise dressed as a finding. Likewise a per-venue-per-bucket trend table.

1. Extend rather than broaden or split. The title already names the design question exactly. The page absorbed the stub's reading list, dropped the stub's “Shallow vs Deep crawling” section (that is Programming:Interaction's topic, and the [4Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)] material now appears here only for what it says about state), and kept the stub's papers, all of which survive on the new reading list.
2. Deliberate overlap with three neighbours, with the boundary stated on each side. OpenWPM keeps the implementation detail (reset=, seed_tar, num_browsers, crash-recovery semantics) and already points here for the design question; this page points back rather than restating it. Programming:Crawler keeps the tool comparison. Design:Crawling location keeps the vantage axis.
3. A false claim on a neighbouring page was corrected in the same sitting. design:crawling_location said “Stateful stateless — the other axis Jueckstock et al. vary”. They do not: WWW 2021 varies vantage point and browser configuration (naive vs stealth), and §2.3.1 states that every page visit begins with “a clean user profile (i.e., no cookies or cached content)”. Karel's task note carried the same claim (“Jueckstock et al. vary this axis alongside the vantage point”), which is presumably where the neighbour's line came from. The neighbour was patched (rev 1787137202) and this page states the correction explicitly in its reading list, because the claim is likely to be repeated otherwise.
4. The stub's reading of Zeber et al. was corrected, not deleted. The stub said “Stateless crawls surprisingly result in more third-party requests than stateful crawl (Fig. 6)”. Figure 6 compares crawler against human, not stateless crawl against stateful crawl; automation, vantage, interaction and statefulness all differ at once. The page keeps the finding, states what the comparison actually is, and keeps the authors' own statefulness explanation for it.
5. “Seeded stateless” was named as a third design position even though the extraction's enum has only three values none of which is it. Justification: the design demonstrably exists ([4Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)], [6Agarwal, Pushkal; Joglekar, Sagar; Papadopoulos, Panagiotis; Sastry, Nishanth; Kourtellis, Nicolas (2020): "Stop tracking me Bro! Differential Tracking of User Demographics on Hyper-Partisan Websites", in: Proceedings of the ACM Web Conference. (DOI)], [7Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]'s seed profile), it is the position most often mis-labelled, and 10 of the 29 both papers are partial precisely because the enum had nowhere else to put them. A reasonable person could have kept to the enum's vocabulary; that would have made the page match the data at the cost of misdescribing the field.
6. Demir et al.'s 41%-omit figure was reconciled rather than suppressed. Their 59% “at least partial” against our 19.6% looks like a contradiction. Both are reported on the page with the reason they differ (117 hand-picked web-measurement papers 2018–2021 versus 1,120 crawling papers in a broad security corpus, and a broader reading of “crawling strategy” than the enum). Suppressing the external number would have been the easier choice and the wrong one.
7. The page leads with a reporting-rate finding, not with advice. 19.6% and “no trend in sixteen years” are findings about the literature. They are placed in Use in Publications and the recommendations are kept separate, so a ranking of what the field did is never presented as advice about what to do now.
8. “Current practice” claims lean on external primary sources, not on the 2025–2026 corpus slice. That slice is provisional (CCS/IMC 2026 not held; IEEE S&P/WWW 2026 under-selected) and shows no change in reporting: 17.8% in 2025 and 18.8% in 2026 against a 16-year range of 16–21%. So the page's currency section is built from browser-vendor and tooling primary sources, with the corpus used only to show that the literature has not moved. The one genuinely new corpus signal in 2026 — LLM agents generating persona-driven, stateful browsing [8Song, Chuxu; Mekala, Dheekshith Dev Manohar; Wang, Hao; Martin, Richard (2026): "Redefining Website Fingerprinting Attacks with Multi-Agent LLMs", in: Proceedings on Privacy Enhancing Technologies, pp. 688-702. (DOI)] — is a single paper and is presented as one.
9. No ~~DISCUSSION~~ on this page. Comments belong on the content page. This sets the default for provenance: pages.

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all given the page text, the report script and its real output, and these notes.

Re-ran all three dataset scripts (byte-identical to the committed outputs), re-ran the three browser probes, independently recomputed ~35 figures across all 13 tables with its own jq/node queries, and pulled the primary-source PDFs for every quoted paper.

Everything else verified: the 1,120/1,080/219 populations, 19.6%/20.3%, the field-comparison table, the full 5-bucket and per-year trend tables, the venue table's raw numbers, the framework table including the deliberate 58-vs-59 OpenWPM discrepancy, every subset row (including “199 papers, 114 (57.3%)” and “39 of the 54 login crawls”), the two-literatures fold (133+23+18+45 = 219), the audit (16/10/3), the probe stats (178/41/72), and every quoted figure from Acar, Zeber, Rasaii and Urban. No sentinel-as-answer and no tuple-vs-paper error found.

Its own summary is worth recording: “No error was found in any script-derived number itself — every discrepancy found is in page prose layered on top of correct script output.” That is where the next run should look first.

Fetched every external claim live; also re-ran all three probe scripts against the installed toolchain and reproduced every published row.

On finding 3, the reviewer was partly wrong and it was checked before publishing. The GitHub API says issue 38455 was closed with state_reason: completed, not “as infeasible”, and the Chromium bug involved is crbug.com/468317746, not the crbug.com/410491202 the reviewer cited. Reading the actual thread gave a better and more on-topic story than the reviewer's summary: Playwright disables partitioning because its own storageState API cannot represent partitioned storage — “Without CDP support, it does not seem practical to replicate all the intricate details of storage partitioning outside of the browser, so disabling the feature is the only way to make things work for now” — and issue 38455 was closed after the Chromium-side request for bulk storage-key APIs was declined as “infeasible - too far outside of the product scope”. The “flag will be removed” expectation is the requester's remark in that thread, not a cited Chromium roadmap, and the page now says so in those terms. This is the run's clearest illustration of the standing rule that a sub-agent's findings are leads, not facts.

Checked all citekeys on both pages, verified all 13 new bibliography entries against Crossref / DOI resolvers / venue pages, re-ran the quote checker and then independently re-verified every quotation against the source text or PDF, and re-fetched all five non-paper footnote sources.

Its clean checks are worth recording because they bound what is left to doubt: all 24 citekeys resolved; 13 of 13 new entries had correct metadata against primary sources; 0 fabricated quotes across roughly 35 quotations and figures, each verified against paper.cols.txt, paper.norm.txt or the PDF; all five non-paper footnotes verbatim; and the Playwright/Puppeteer flag table verified against the installed package sources. A full duplicate-DOI scan of the 402-entry bibliography found only two other collisions, fouad2022my/fouad2022_cookie and bottger2025_regional/boettger2025_regional, both pre-existing and unrelated to this run — recorded here as work for whoever touches the bibliography next.

• Figures (sonnet) — yes. Its finding 1 (the published code sample reproduced 4 of 9 rows) is exactly the class of defect the slot exists for, and nothing else would have caught it: the table was right, the script was right, and only the published excerpt was wrong. It also independently reproduced every script number, which is what makes the rest of the page's figures trustworthy rather than merely self-consistent.
• Citations (sonnet) — yes, and it found the single most damaging defect of the run, a duplicate bibliography key that a naive key-equality check had passed. It also caught a wrong date range that had been copied from nowhere.
• Currency (sonnet) — yes on coverage: it fetched and confirmed 15-odd external claims that would otherwise rest on recall, and it found the “flag is going away” story. But its summary of that story was wrong in two specifics (closure reason and Chromium bug number), and using it verbatim would have put two false facts on the page. Its value is as a lead generator, not as a source.
• Generic (fable) — see reviewer 4; it was the most valuable of the four.

Given both pages, the script outputs, and the neighbouring pages, with no list of things to look for.

Its clean checks, recorded because they bound what remains in doubt: it re-derived the ratios 51.6%, 57.3%, 1.61×, 2.51×, 2.9×, 5.9× and 55.7% and all hold; it verified that the suspicious-looking 6.91× is verbatim in Rasaii et al. (which uses both “6.9 times” and “6.91 times”); and it independently recomputed the five OpenWPM papers labelled both and found all five among the 16 adjudicated-ok, so openwpm's “those five are the ones to read” survives this page's audit. It judged the voice consistent with the neighbours and the boundaries with crawler and openwpm clean.

Was it worth its slot: yes, and it was the most valuable of the four. Three of its high-severity findings are defects no checklist would have produced — a false claim in the first paragraph that the page's own evidence refutes, an uncomputed superlative, and a published script that cannot run under the names it is published with. Two of the three had been introduced or preserved by the fixes for earlier reviewers, which is the argument for running this pass last and for running it at all.

Reviewers 1 and 3 were re-run against the final text, because their findings had been acted on and because the report script had gained two tables since they last saw it. Both were told to check figures and quotes outside the windows that were edited.

Fixed from that pass: the em dash in the quoted Chromium closure reason (the comment uses a hyphen); the lower-cased “Removes cookies from context” in the quoted Playwright docs; “primed cache against unprimed” reworded for [9Mirheidari, Seyed Ali; Golinelli, Matteo; Onarlioglu, Kaan; Kirda, Engin; Crispo, Bruno (2022): "Web Cache Deception Escalates!", in: Proceedings of the USENIX Security Symposium. (Link)], whose cache control is per-URL hit-versus-miss inside one detection step rather than two population arms; and the ambiguous sentence about interaction depth “moving less”, which was true of the range and false of the net change. The one MISLEADING finding was against these notes, not the page: they described GitHub comments of 2026-01-06 and 2026-01-14 as “maintainer comments” when only the first is — corrected above.

The author also verified two things independently rather than taking a reviewer's word: the per-field table's six rows against the script's own fractions, cell by cell, and the 16-row table against the audit's ok list in order. Both matched. The published code was extracted under the page's own filenames into an empty directory and run: nine rows, matching the table.

Final state: page rev 1787140910 at 60,763 bytes; this log at roughly 108 KB. Every figure on the page is reproducible from scripts/report_stateful_stateless.mjs, statefulness_audit.mjs and statefulness_probe.mjs; every quotation from state_quotecheck.mjs (37/37); every measured browser claim from scripts/state_probe/.

Recorded because they are the same class of error the reviewers exist to find, and finding them first is not the same as them not having happened.

1. The page originally compared statefulness reporting against artifact release “24.3% to 72.7%” and ethics review “8.3% to 45.2%”, quoted from OVERVIEW.md. Those are computed on OVERVIEW.md`s bucket boundaries (2010–2011 / 2012–2015 / 2016–2019 / 2020–2023 / 2024–2026), not on lib.mjs YEAR_BUCKETS (2010–2013 / 2014–2017 / 2018–2021 / 2022–2024 / 2025–2026) which the page's own trend table uses. Quoting across incompatible buckets in a sentence beginning “over the same sixteen years” is exactly the kind of borrowed figure the corpus refresh warns about. Both indicators are now recomputed in report_stateful_stateless.mjs on the page's own buckets — 23.7% → 76.5% and 10.2% → 45.8% — and published as a table beside the statefulness column. (Writing that code also caught a wrong field name: the artifacts schema uses links[].belongsToAuthors, not isAuthorsOwn, which had silently produced 0.0% in every bucket.)
2. “the only reporting rate on this site that has not improved since 2010” was an unverifiable claim about every page on the wiki. It was narrowed to the crawl-configuration fields — but that narrowing was still not computed, and reviewer 4 caught it: the script had per-bucket trends for statefulness only. It is computed now; see reviewer 4, finding 2.
3. The consent-interaction subset (36 papers, 61.1% reporting) is the same 36 papers consent audited, where 7 (19.4%) are extraction false positives. Rather than repeat an unaudited figure, report_stateful_stateless.mjs now imports that page's VERDICTS map and prints the rate on the 28 verified papers too: 16/28 = 57.1%, i.e. the finding survives. The page carries both rows and the caveat.

All under /workspace/artifacts/wiki. The outputs quoted above are the committed out/*.txt files, regenerable by re-running the script named beside each.

• Programming:Stateful stateless — the page these notes are for.
• corpus — corpus-level provenance: the selection funnel, extraction method, and stability figures.
• Programming:Crawler:OpenWPM and Programming:Crawler — where the OpenWPM figures and the framework fold come from.
• consent — source of the consent-interaction adjudication reused here.

[1]

Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[2]

Englehardt, Steven; Han, Jeffrey; Narayanan, Arvind (2018): "I never signed up for this! Privacy implications of email tracking", Proceedings on Privacy Enhancing Technologies 2018(1):109-126. (DOI)

[3]

Jueckstock, Jordan; Sarker, Shaown; Snyder, Peter; Beggs, Aidan; Papadopoulos, Panagiotis; Varvello, Matteo; Livshits, Benjamin; Kapravelos, Alexandros (2021): "Towards Realistic and Reproducible Web Crawl Measurements", in: Proceedings of the ACM Web Conference. (DOI)

[4]

Urban, Tobias; Degeling, Martin; Holz, Thorsten; Pohlmann, Norbert (2020): "Beyond the Front Page:Measuring Third Party Dynamics in the Field", in: Proceedings of The Web Conference 2020, pp. 1275–1286. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[5]

Demir, Nurullah; Große-Kampmann, Matteo; Urban, Tobias; Wressnegger, Christian; Holz, Thorsten; Pohlmann, Norbert (2022): "Reproducibility and Replicability of Web Measurement Studies", in: Proceedings of the ACM Web Conference. (DOI)

[6]

Agarwal, Pushkal; Joglekar, Sagar; Papadopoulos, Panagiotis; Sastry, Nishanth; Kourtellis, Nicolas (2020): "Stop tracking me Bro! Differential Tracking of User Demographics on Hyper-Partisan Websites", in: Proceedings of the ACM Web Conference. (DOI)

[7]

Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[8]

Song, Chuxu; Mekala, Dheekshith Dev Manohar; Wang, Hao; Martin, Richard (2026): "Redefining Website Fingerprinting Attacks with Multi-Agent LLMs", in: Proceedings on Privacy Enhancing Technologies, pp. 688-702. (DOI)

[9]

Mirheidari, Seyed Ali; Golinelli, Matteo; Onarlioglu, Kaan; Kirda, Engin; Crispo, Bruno (2022): "Web Cache Deception Escalates!", in: Proceedings of the USENIX Security Symposium. (Link)