Differences

This shows you the differences between two versions of the page.

--- provenance:programming:traffic_files [2026/08/14 03:19] – New provenance page for programming:traffic_files: queries, folds and residue, 95 hand-classified HAR verdicts, unedited script output, external checks. Authored by Claude. karel.kubicek.claude
+++ provenance:programming:traffic_files [2026/08/14 03:42] (current) – Add §10.6, the generic review pass: 15 accepted findings including two internal contradictions the focused passes could not catch; correct §10.5, which had wrongly justified skipping it. Refresh embedded script output. Authored by Claude. karel.kubicek.claude
@@ Line 29: / Line 29: @@
 | CAP ∩ proxy-interception | | 206 |
 | both | | 36 |
-| **ON** | CAP ∧ the tool name folds to a non-''offtopic'' family in ''CAPTURE_FAMILIES'' | **511** |
+| **ON** | CAP ∧ the tool name folds to a non-''offtopic'' family in ''CAPTURE_FAMILIES'' | **514** |
-| OFF-only | CAP ∧ every folded family is ''offtopic'' — excluded from the page | **165** |
+| OFF-only | CAP ∧ every folded family is ''offtopic'' — excluded from the page | **162** |
-| ON ∧ web | ''platforms'' includes ''web'' — the denominator for the layer flip | **186** |
+| ON ∧ web | ''platforms'' includes ''web'' — the denominator for the layer flip | **188** |
 | **HAR-SWEEP** | ''paper.cols.txt'' matches the HAR regex printed in §5 (DokuWiki tables cannot hold a literal pipe, so it is not repeated here) | **95** |
 | HAR-SWEEP ∧ verdict ''instrument'' | the page's HAR population | **32** |
@@ Line 40: / Line 40: @@
 ==== 2.1 Why CAP is not the population ====
-''traffic-capture'' on a seven-venue security corpus is not a web-measurement category. Of 679 papers, **165 name only instruments that produce no web traffic file at all**. Those are folded into six explicitly named ''offtopic:'' families and excluded with a printed count:
+''traffic-capture'' on a seven-venue security corpus is not a web-measurement category. Of 679 papers, **162 name only instruments that produce no web traffic file at all**. Those are folded into seven explicitly named ''offtopic:'' families and excluded with a printed count:
 ^ Excluded family ^ Papers ^ Examples of the names in it ^
 | radio / SDR / RF sniffer | 90 | USRP, HackRF, bladeRF, LimeSDR, Ubertooth, Proxmark, Kismet, nexmon, gr-gsm, TI CC2531 |
-| commercial VPN / residential proxy (a vantage point, not an instrument) | 39 | Luminati, Bright Data, ProxyRack, NordVPN, Mullvad, Hola, Hide My Ass, Proxychains, Tor |
 | hardware probe / lab instrument | 30 | oscilloscopes, spectrum analysers, ChipWhisperer, Monsoon power monitor, OBS Studio, ''arecord'' |
 | host / side-channel instrumentation | 30 | Mastik, Flush+Reload, Prime+Probe, Intel Pin, ''strace'', ''perf'', Process Monitor, ''netstat'' |
+| commercial VPN / residential proxy (a vantage point, not an instrument) | 27 | Luminati, Bright Data, ProxyRack, NordVPN, Mullvad, Hola, Hide My Ass, Proxychains, Tor |
 | traffic generation / replay load | 17 | ''tcpreplay'', ''iperf3'', TGen, DPDK Pktgen, Harpoon, Resperf |
 | passive dataset / telescope / vantage platform | 17 | UCSD Network Telescope, MAWI, LANDER, BGPStream, RIPE Atlas |
+| proxies something other than web traffic | 5 | ProxySQL (a database proxy), HA-Proxy, ''dnscrypt-proxy'', ''doh-proxy'', ''netcat'' |
-A paper can match several families, so the rows sum to more than the union (217 papers match at least one off-topic family; 165 match //only// off-topic families).
+A paper can match several families, so the rows sum to more than the union (210 papers match at least one off-topic family; 162 match //only// off-topic families).
 The VPN row is the one a reasonable person could disagree with. A commercial VPN in a ''proxy-interception'' tuple is a **vantage point**, which is [[design:crawling_location]]'s subject, not an instrument that writes a file. We excluded it. The residential-proxy question is genuinely two questions and this page answers only one of them.
+**This row was wrong in the first published version and was fixed on review.** It also swallowed **Squid, Squid ICAP modules, Privoxy, Tinyproxy, 3proxy and wwwoffle** — self-hosted forward and caching proxies, which sit exactly where an intercepting proxy sits and can log the same traffic (Squid with SSL-bump, Privoxy's filters). They are neither commercial VPNs nor vantage points, and excluding them as such was indefensible. They are now their own **on-topic** family, ''forward / caching proxy (self-hosted)'', 7 papers. ProxySQL (a //database// proxy), HA-Proxy, ''dnscrypt-proxy'', ''doh-proxy'' and ''netcat'' were in the same row for the same bad reason and are now in a separate off-topic family named for what they actually are. The reviewer's point stands generally: **an off-topic family's name is a claim about everything in it, and it has to be true of every member, not of the ones you had in mind when you wrote the regex.**
 ===== 3. Running it =====
@@ Line 99: / Line 102: @@
 ^ Family ^ Layer ^ Papers ^ Distinct spellings ^
 | offtopic: radio / SDR / RF sniffer | offtopic | 90 | 105 |
-| offtopic: commercial VPN / residential proxy | offtopic | 39 | 39 |
 | offtopic: hardware probe / lab instrument | offtopic | 30 | 34 |
 | offtopic: host / side-channel instrumentation | offtopic | 30 | 29 |
+| offtopic: commercial VPN / residential proxy | offtopic | 27 | 28 |
 | offtopic: traffic generation / replay load | offtopic | 17 | 12 |
 | offtopic: passive dataset / telescope | offtopic | 17 | 16 |
+| offtopic: proxies something other than web traffic | offtopic | 5 | 5 |
 | packet capture (libpcap family) | packet | 287 | 72 |
 | TLS-intercepting proxy | proxy | 189 | 79 |
@@ Line 112: / Line 116: @@
 | record-and-replay / web archive | browser | 9 | 9 |
 | browser-native HTTP log (HAR / NetLog) | browser | 8 | 8 |
+| forward / caching proxy (self-hosted) | proxy | 7 | 6 |
 **Unmapped residue: 9 distinct names across 9 papers**, printed in full by the report and reproduced here so it does not live only in a local file:
@@ Line 212: / Line 217: @@
 ===== 6. Unedited report output =====
-The full output of ''node scripts/report_traffic_files.mjs'' is below, unedited. ''--list'' output (the 511-paper population with its families) is not reproduced here for length; regenerate it with the command in §3.
+The full output of ''node scripts/report_traffic_files.mjs'' is below, unedited. ''--list'' output (the 514-paper population with its families) is not reproduced here for length; regenerate it with the command in §3.
 <file text report_traffic_files.txt>
@@ Line 237: / Line 242: @@
 offtopic: host / side-channel instrumentation                   offtopic  30      4.4%   29
 offtopic: traffic generation / replay load                      offtopic  17      2.5%   12
-offtopic: commercial VPN / residential proxy (a vantage point)  offtopic  39      5.7%   39
+offtopic: commercial VPN / residential proxy (a vantage point)  offtopic  27      4.0%   28
+offtopic: proxies something other than web traffic              offtopic  5       0.7%   5
 offtopic: passive dataset / telescope / vantage platform        offtopic  17      2.5%   16
 browser-native HTTP log (HAR / NetLog)                          browser   8       1.2%   8
 record-and-replay / web archive                                 browser   9       1.3%   9
+forward / caching proxy (self-hosted)                           proxy     7       1.0%   6
 TLS-intercepting proxy                                          proxy     189     27.8%  79
 packet capture (libpcap family)                                 packet    287     42.3%  72
@@ Line 248: / Line 255: @@
 on-device mobile / IoT capture                                  mobile    21      3.1%   15
-On-topic families, union of papers      511
+On-topic families, union of papers      514
-Off-topic families, union of papers     217
+Off-topic families, union of papers     210
-Off-topic ONLY (excluded from the page) 165
+Off-topic ONLY (excluded from the page) 162
   (sum of family counts != union: a paper may match several families)
 Unmapped residue: 9 distinct names, 9 papers
   Google Translate (1); browser add-on we designed (1); custom program (1); lb (1); Facebook tracking pixel (1); SSL measurements (1); custom addon script (1); custom tracing plugin (1); iPhone 16 (1)
-── Capture layer (of 511 papers naming an on-topic capture instrument) ──
+── Capture layer (of 514 papers naming an on-topic capture instrument) ──
 Layer    Papers  Share
 -------  ------  -----
-packet   318     62.2%
+packet   318     61.9%
-proxy    189     37.0%
+proxy    194     37.7%
 mobile   21      4.1%
 browser  17      3.3%
 flow     13      2.5%
-── Capture layer, web subset only (of 186 on-topic papers whose platform includes web) ──
+── Capture layer, web subset only (of 188 on-topic papers whose platform includes web) ──
 Layer    Papers  Share of web subset
 -------  ------  -------------------
-proxy    92      49.5%
+proxy    95      50.5%
-packet   86      46.2%
+packet   86      45.7%
-browser  13      7.0%
+browser  13      6.9%
 mobile   5       2.7%
-flow     4       2.2%
+flow     4       2.1%
 ── Named instruments in the on-topic families (papers; of 679) ──
@@ Line 295: / Line 302: @@
 ── Version reporting ──
-Tuples in on-topic capture families: 662; state a version: 84 (12.7%)
+Tuples in on-topic capture families: 669; state a version: 85 (12.7%)
 Tool              Papers  Tuples  Tuples with a version  Share
 ----------------  ------  ------  ---------------------  -----
@@ Line 308: / Line 315: @@
 Bucket      Papers  On-topic  Share  packet  proxy  browser  flow  mobile
 ----------  ------  --------  -----  ------  -----  -------  ----  ------
-–2013   511     53        10.4%  37      15     3        2     1
+–2013   511     54        10.6%  37      16     3        2     1
-–2017   769     95        12.4%  59      33     2        2     3
+–2017   769     96        12.5%  59      35     2        2     3
-–2021   1439    109       7.6%   67      39     4        4     6
+–2021   1439    110       7.6%   67      40     4        4     6
-–2024   1955    157       8.0%   98      59     6        3     9
+–2024   1955    157       8.0%   98      60     6        3     9
 –2026*  1185    97        8.2%   57      43     2        2     2
 * 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P/WWW 2026 abstracts are not fully in OpenAlex.
@@ Line 375: / Line 382: @@
   have ANY traffic-capture / proxy-interception tuple at all:              16 (50.0%)
   named in tools[]: PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned, WWW/2020/comparing-the-effects-of-dns-dot-and-doh-on-web-performance, WWW/2020/understanding-the-performance-costs-and-benefits-of-privacy-focused-browser-exte, IMC/2024/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc, IMC/2024/of-choices-and-control-a-comparative-analysis-of-government-hosting, IMC/2024/replication-taking-a-long-look-at-quic, WWW/2024/quic-is-not-quick-enough-over-fast-internet, IEEE-SP/2026/setting-the-course-but-forgetting-to-steer-analyzing-compliance-with-gdprs-right, IEEE-SP/2018/surveylance-automatically-detecting-online-survey-scams
+── Crawling papers vs HAR-instrument papers, per venue ──
+Venue    Papers  Ran a crawl  HAR-instrument papers
+-------  ------  -----------  ---------------------
+CCS      990     163          0
+IMC      638     132          9
+NDSS     701     129          1
+PETS     510     123          8
+USENIX   1410    221          3
+WWW      843     242          7
+IEEE-SP  767     110          4
 ── Homographs (why the sweep cannot be automated) ──
@@ Line 432: / Line 450: @@
 ── Traffic files inside a crawl ──
 Papers that ran an automated web crawl:                       1120
-  …that name an on-topic capture instrument in tools[]:      155 (13.8%)
+  …that name an on-topic capture instrument in tools[]:      156 (13.9%)
   …that use HAR as an instrument (full-text sweep):          26 (2.3%)
-  …union of the two:                                         171 (15.3%)
+  …union of the two:                                         172 (15.4%)
@@ Line 469: / Line 487: @@
       "recorded a trace of all HTTP requests initiated by the web page (HAR)"; five of its features are HAR features
   PETS/2019/4-years-of-eu-cookie-law-results-and-lessons-learned
-      "they dump to file the HTTP Archive (HAR) [55], a JSON-formatted … We look at all HTTP responses with Set-Cookie header in the HAR file." Also analyses the httparchive.org corpus — counted in both.
+      "they dump to file the HTTP Archive (HAR) [55], a JSON-formatted … We look at all HTTP responses with Set-Cookie header in the HAR file." It ALSO analyses the httparchive.org corpus, so it is the one paper that is both instrument and dataset. This map is single-label and it is filed under instrument, so the dataset row of 14 excludes it — the content page says so rather than implying 15. (The earlier comment here claimed it was "counted in both", which the arithmetic disproves: the five verdicts sum to exactly 95.)
   PETS/2019/oblivious-dns-practical-privacy-for-dns-queries
       "Chrome webdriver and record HAR files for each browsing session"
@@ Line 512: / Line 530: @@
 re-fetches each one.
-  HAR 1.2                    the spec version every implementation targets (2007 draft, never a W3C Recommendation)
+  This block is a POINTER, not a source of truth. The authoritative list of
-  HAR ISO 8601 / 3-decimal   `startedDateTime` and the `timings` object are milliseconds
+  external figures, each with the primary source it was fetched from, is in
-  mitmproxy 12.1.2           latest release checked 2026-08-14
+  scripts/verify_traffic_figures.mjs (EXTERNAL FIGURES) and is re-fetched by
-  Wireshark 4.6.2            latest stable release checked 2026-08-14
+  scripts/external_checks_traffic_files.sh. Two sibling scripts drifted apart
-  Okta / Cloudflare Oct 2023 the HAR-file support-ticket incident
+  here once already — this block carried mitmproxy 12.1.2 / Wireshark 4.6.2 /
-  Chrome 127                 "Save all as HAR (with sensitive data)" renaming
+  Chrome 127 as "current" while the page correctly said 12.2.3 / 4.6.8 / 130,
+  and the stale copy was reproduced verbatim in the provenance page's
+  "unedited report output". Caught by review on 2026-08-14.
+    node scripts/verify_traffic_figures.mjs
+    sh   scripts/external_checks_traffic_files.sh
 </file>
@@ Line 731: / Line 754: @@
   libpcap 1.10.6         latest tag
   Playwright 1.62.1      the version the fixture runs used
+  Playwright 1.60        tracing.startHar()/stopHar() added (May 2026)
+  Playwright 1.61        "HAR and trace recordings now include WebSocket requests" (June 2026)
   HARExportTrigger 0.6.1 last release, May 2018; repo archived, description "DEPRECATED"
   selenium-wire          repo archived January 2024
@@ Line 745: / Line 770: @@
     check_page_numbers.mjs (which splits on the second dot in a version string)
     can match them. Each is accounted for immediately above.
-.14 4 12.2 3 4.6 8 4.99 6 1.10 6 1.62 1 0.6 1 08 05 130 1500 1.2 5 134
+.14 4 12.2 3 4.6 8 4.99 6 1.10 6 1.62 1 1.60 1.61 0.6 1 08 05 130 1500 1.2 5 134 2.1 4
-,000 802.15 12.8 127.0 0.1 127.0.0.99 172.66 147.243 8098 8081 2500
+,000 802.15 12.8 127.0 0.1 127.0.0.99 104.20 23.154 8098 8081 2500
 === NOT FIGURES — digit fragments the page contains that are not measurements
-.0.0.1, 127.0.0.99, 172.66.147.243   IP addresses in the fixture output
+.0.0.1, 127.0.0.99                   loopback addresses in the fixture output
+.20.23.154                           example.com's address as the proxy saw it on
+-08-14. NOT a constant: example.com is on
+                                          Cloudflare anycast and this rotates. It was
+                                          listed here as an unchanging "not a figure"
+                                          once, which let a WRONG value (172.66.147.243,
+                                          from an unrelated earlier curl) survive the
+                                          stale-number guard. Caught by review 2026-08-14.
 , 8081                              fixture and proxy ports
 .15.4                                a radio standard named in the fold
@@ Line 828: / Line 860: @@
 ===== 10. Review log =====
-REVIEW_PLACEHOLDER
+Three focused passes and the author's own read, all against the frozen snapshot **rev 1786677596** (''pages/programming_traffic_files.txt'' md5 ''d165a98f56316b0d2c618128bc9d801d''). Each reviewer was told its context might not be exhaustive and was handed the page, the provenance, the scripts and their committed output. Nothing was edited while they ran.
+==== 10.1 Figures vs script (''sonnet'') ====
+^ # ^ Finding ^ Verdict ^
+| F1 | The page said the mitmproxy HAR recorded ''172.66.147.243'' for ''example.com''; the committed run says **''104.20.23.154''**. The wrong value came from an unrelated ''curl'' earlier in the session. Worse, it had been added to ''verify_traffic_figures.mjs''’s ''NOT FIGURES'' allowlist as a constant, which is exactly how it survived ''check_page_numbers.mjs''. | **Accepted.** Page corrected, and the reviewer's second point is the more important one: ''example.com'' is on Cloudflare anycast, so that address is not a constant at all. The page now says so, and the allowlist entry says so. **An allowlist entry is an assertion that a number cannot go stale — writing one is how you disable the guard.** |
+| F2 | "mitmproxy is reported three times better than ''wireshark''" — 24.8% / 12.3% is **2.0×**, not 3×. (The "seven times…''tcpdump''" half, 24.8/3.4, was right.) | **Accepted.** Corrected to "twice as often". A ratio computed in prose is not covered by any of the guards. |
+| F3 | The ''offtopic: commercial VPN / residential proxy'' family also swallowed **Squid, Squid ICAP modules, Privoxy, Tinyproxy, 3proxy, wwwoffle** — self-hosted forward and caching proxies — plus **ProxySQL** (a database proxy) and **netcat**. §2.1's defence of that row discussed only Tor and commercial VPNs and never engaged with what was actually in it. | **Accepted**, and it is the finding with the widest blast radius. Squid and friends are now their own **on-topic** family; ProxySQL, HA-Proxy, the DNS proxies and ''netcat'' are a separate, honestly-named off-topic family. Downstream: on-topic 511→514, off-topic-only 165→162, web subset 186→188, and six percentages moved. |
+| F4 | ''report_traffic_files.mjs''’s closing block hardcoded "mitmproxy 12.1.2 / Wireshark 4.6.2 / Chrome 127" as current while the page correctly said 12.2.3 / 4.6.8 / 130 — and the stale copy was reproduced verbatim in §6 of this page. | **Accepted.** That block is now a pointer to ''verify_traffic_figures.mjs'' and ''external_checks_traffic_files.sh'' rather than a second, drifting copy. **A provenance page that embeds a script's output inherits that script's stale numbers.** |
+The same pass re-ran the report (plain and ''--wiki'', byte-identical to the committed output), re-ran the figure verifier, re-ran both experiments three times, and confirmed papers-not-tuples, sentinel handling, ''usedOrMentioned'' filtering, both-ended year buckets and every denominator in "Use in Publications". No other issue found.
+==== 10.2 Citations and quotes (''sonnet'') ====
+^ # ^ Finding ^ Verdict ^
+| C1 | "BrowserMob Proxy … last tagged release 2016" — the last GitHub //Release// is 2.1.4 (December 2016), but a later ''2.1.5'' git tag exists from September 2017. | **Accepted**; wording tightened to distinguish a Release from a tag. |
+| C2 | ''figueira2024_diffaudit'' was cited as evidence that "the mobile-privacy literature is built on [an intercepting proxy]" — but DiffAudit's mobile side uses **PCAPdroid**, which the page's own taxonomy puts in the //packet// layer, not the proxy layer. | **Accepted**, and it is the sharpest kind of finding: the page blurred its own central distinction in a supporting sentence. The claim now rests on ''kollnig2022_iphones'' alone, and DiffAudit is given as the counter-example it actually is. |
+All 16 ''%%{[key]}%%'' citations resolve; 279 keys in the bibliography, 279 unique; all 14 new entries match Crossref on authors, title, year, DOI, and the three hand-written PoPETs entries match on volume, issue and pages. Every quotation verified verbatim after whitespace normalisation. Every claim-to-paper attribution checked, including all eleven Hantke et al. figures for numerator/denominator/percentage coming from the same sentence. The "six papers cite a W3C HAR URL" figure was independently reproduced (two ''dvcs.w3.org'', four ''w3c.github.io''). No missing citations, no footnote/citation mismatches.
+==== 10.3 External currency (''sonnet'') ====
+^ # ^ Finding ^ Verdict ^
+| E1 | Playwright's HAR API has moved: ''tracing.startHar()'' / ''stopHar()'' arrived in 1.60 (May 2026), ''recordHar'' takes ''mode'' and ''urlFilter'' as well as ''content'', and 1.61 (June 2026) added "HAR and trace recordings now include WebSocket requests". The page's own experiment runs 1.62.1 and reported WebSocket entries as if that were long-standing HAR behaviour. | **Accepted**, and independently re-verified here against the installed ''playwright-core'' type definitions and Playwright's release notes. This is the best finding of the three passes: the page was presenting a **six-week-old writer feature as a property of the format**. The writers table now names the tracing API and the version boundary, and the "what a HAR loses" list gained a bullet saying the WebSocket rows are about the writer, not the format. |
+| E2 | "classic WebDriver has no network commands at all … this is why Selenium crawls end up with a proxy bolted on" is true of //classic// WebDriver but misleading today: WebDriver BiDi gives Selenium native network interception. | **Accepted in part.** The qualifier was already there, but the surrounding sentence read as current practice. Reworded, with a pointer to [[programming:crawler]], which covers BiDi and its bugs at length. Selenium still ships no HAR writer, which is the row's actual point. |
+| E3 | The page missed Okta's investigation-closure statement of 8 February 2024. | **Accepted.** Added as a footnote. It revises no figure — and, as the earlier industry pass noted, despite its ''/harfiles/'' URL it contains no HAR-specific text. |
+| E4 | The "no maintained HAR sanitiser" claim survives, but the search behind it was narrower than the claim: ''harmor'' (last commit April 2025), Beyond Identity's ''har-sanitize'' (November 2023) and Edgio's ''har-tools'' (publisher shut down January 2025) were never named. | **Accepted.** All three are now named and dismissed on the page. **A negative claim has to show its search, or a reader who finds one candidate in one query concludes it was never researched.** |
+| E5 | Two small imprecisions: BrowserMob's tag year (same as C1), and this page's "''har-spec'' has not moved since 2019" against a last commit the reviewer dates to April 2018. | **Accepted with a caveat.** The two reviewers give different years and GitHub rate-limited the re-check, so the page now says "dormant for years" — which both agree on — rather than a year neither could confirm together. |
+The same pass independently re-verified the HAR abandonment banner, the two ''dvcs.w3.org''/''w3c.github.io'' copies, ''har.fyi''’s subject, both IETF drafts, WARC/ISO 28500, seven tool versions, every maintenance-status call, the Chrome 130 wording, all ten Firefox prefs read from ''firefox.js'', ''--set hardump'', the QUIC/custom-CA limitation, ''SSLKEYLOGFILE'' for both browsers, and ~20 URLs for liveness. One 403 (''iso.org''), already disclosed in §8.3. Nothing else superseded.
+==== 10.4 The author's own read ====
+Three fixes found by re-reading rather than by any check: the WebPageTest row put its citation where it looked like it supported a vendor-ownership claim; "papers that used HARExportTrigger cannot be reproduced with it today" asserted something never tested (the extension is archived, which is the actual point); and "the absence of CCS is real" invited a causal reading. The last was **sharpened rather than softened** after measuring it — CCS contributes 163 crawling papers to IMC's 132 and produces 0 HAR-instrument papers to IMC's 9, which is a stronger statement than the original and is now backed by a per-venue table in the report.
+==== 10.5 What the review layer cost and returned ====
+Ten accepted findings, zero rejected. The three passes disagreed usefully: only the figures pass could have found F3 and F4 (they need the scripts re-run), only the citation pass could have found C2 (it needs the cited paper read), and only the currency pass could have found E1 (it needs today's release notes). A fourth, **generic** pass (''fable'', no checklist) was run after the other three had been applied — see §10.6. An earlier version of this section justified //not// running it on the grounds that the three focused passes had covered every category one would. That justification was wrong, and §10.6 is the evidence: the generic pass returned fifteen findings, including two the focused passes were structurally unable to catch.
+==== 10.6 Generic (''fable'', no checklist) ====
+Fifteen findings, **all accepted**. Two of them are the reason this pass exists, because no focused pass could have found them:
+^ # ^ Finding ^ Verdict ^
+| G1 | The opening ''%%<WRAP important>%%'' box said "Measured on a single page load of a local fixture" and then made the ''serverIPAddress'' claim — which §7.2's own output says the fixture **cannot** show, because both sides are loopback. The claim came from the separate remote re-run, which "What We Ran" did not even mention. | **Accepted.** This is the documented failure mode exactly: the body text carried the qualifier and the prominent box dropped it. Box reworded, the bullet now names the remote run, and "What We Ran" now says the mitmproxy script was run twice. |
+| G2 | "14 papers analyse the dataset and 32 use the format, and only one paper does both" contradicts the data structure: ''HAR_VERDICT'' is **single-label**, the five verdicts sum to exactly 95, and the fold's own comment claimed the paper was "counted in both". So the paper the box names as a dataset user is excluded from the 14. | **Accepted**, and the sharpest finding of any pass. Neither a figures check (the counts are all correct) nor a citation check (the paper is right) could see it — it needs the tip box read against the fold's data model. Prose corrected to state the single-label rule explicitly; the false comment in ''traffic_fold.mjs'' corrected. |
+| G3 | "in our corpus most papers give none of them" heads a six-item checklist of which exactly **one** was measured. | **Accepted.** An unmeasured claim hiding in a section lead. Replaced with the one figure we have. |
+| G4 | The limitations bullet "Nothing on this page claims a HAR loses //x%// of anything on real sites" contradicts §Replay, which quotes 13.9% and <0.3% over 8,544 real origins. | **Accepted.** The bullet meant "nothing //from our fixture//"; it now says that, and credits the percentages to Hantke et al. rather than to us. |
+| G5 | The "Volume per 1,000 sites" row traces to nothing — every other number on the page traces to a script or a source. | **Accepted.** Kept, but footnoted as an order-of-magnitude planning estimate with the reason it is not a measurement. |
+| G6 | The mitmproxy comparison ran on 11.0.2 while the surrounding section recommends 12.2.3, and the page argues elsewhere that mitmproxy's major versions matter — but the disclosure sat only in "What We Ran". | **Accepted.** Version now stated beside the table, with the page's own argument turned on itself. |
+| G7 | The published snippet contains ''.catch(() => {})'' — a silent error swallow, in code a newcomer will copy into a crawler, on a page whose whole argument is that inconsistently-recorded failures are the trap. | **Accepted**, and it is a fair hit: the page published the anti-pattern it warns about. The snippet now logs, with a comment saying why. Re-extracted from the page source and re-run; output unchanged. |
+| G8 | 514 + 162 ≠ 679. Three papers vanish with no explanation; a careful reader does the subtraction and concludes a number is wrong. | **Accepted.** The three are the residue papers whose only tool names the fold could not identify. Now stated. |
+| G9 | "the older ''dvcs.w3.org'' copy several of them point at" — it is **two** of the six. | **Accepted.** |
+| G10 | "no substantive commits since" for BrowserMob is a judgement presented as a checked fact; §8.3 records only a 2024-05-30 push, and nobody examined what it contained. | **Accepted.** Weakened to the recorded evidence. |
+| G11 | The regex printed on the page was an abbreviated one, not the regex that was run: it lacked the word boundaries, so as printed it would also match //SHARE// and //CHART// and give a different 95. | **Accepted.** The page now describes the sweep in words and points here for the exact, word-boundary-anchored regex. |
+| G12 | "budget roughly the raw byte count plus a third" is contradicted by the page's own run output (100.2% inflation), and the 4/3 base64 rule is textbook material the page's own test excludes. | **Accepted.** Now: text embeds ~1:1 (measured), binary costs ~4/3 (not measured here). |
+| G13 | NetLog is named in three tables and never given a sentence — leaving the page with no browser-native answer to a below-HTTP question, on a page that warns about silent QUIC downgrades. | **Accepted.** New short section. |
+| G14 | §10.5 was now false. | **Accepted** — this section. |
+| G15 | "12.7% of capture-tool //mentions//" uses a word the provenance explicitly excludes from the denominator. | **Accepted.** "uses". |
+**What this pass cost and returned.** It ran last, on an already twice-corrected page, and still found the two most structural defects on it. The lesson for the next refresh is the one this log got wrong the first time: the focused passes are good at their categories //and that is the problem// — G1 and G2 are both cases of a claim being individually true everywhere it was checked and false where two sections meet. Run the generic pass.
 ===== 11. Conventions =====