Differences

This shows you the differences between two versions of the page.

--- roadmap [2026/09/11 07:14] – SSO/WebAuthn/MFA row: the gating audit ran — 22 of the queued 46 measure deployment, 45 of a widened 184-candidate pool do; written as Security:Authentication. Authored by Claude karel.kubicek.claude
+++ roadmap [2026/10/08 12:19] (current) – Assessed row: privacy:pii_leakage written. Authored by Claude. karel.kubicek.claude
@@ Line 8: / Line 8: @@
 <WRAP info>
-**The links below are red on purpose.** These pages are scoped and queued but not written; the id is fixed now so later work lands in the right place. ''scripts/sitemap.mjs'' checks that every promised-but-missing page on the wiki appears in this table: a red link anywhere else is a defect, and a row here that has turned blue must be removed.
+**Nothing is queued: the queue is empty.** As of 2026-09-16 every page scoped here has been written, and the last one — //Data subject rights// — moved to //Assessed// below. ''scripts/sitemap.mjs'' gates on this table: every promised-but-missing page on the wiki must appear here, a red link anywhere else is a defect, and a row here that has turned blue must be removed. The script accepts an empty queue **only** when this section says so in words, so that a table-parser regression still fails the run rather than passing vacuously.
 </WRAP>
-^ Planned page ^ Why, and the evidence ^
+When a page is queued again, add a ''%%^ Planned page ^ Why, and the evidence ^%%'' table here and delete the first sentence above.
-| [[design:ownership_resolution|Ownership resolution]] | Attributing a third-party domain to a company. The material exists, but under [[programming:crawler:webxray|a dead tool's name]], where nobody looking for it will search. |
-| [[design:connected_tv|Connected TV]] | Smart TVs, sticks and set-top boxes as measurement targets. 16 candidates, of which about six are directly smart-TV tracking measurement — //Watching You Watch// (CCS 2019), //The TV is Smart and Full of Trackers// (PETS 2020), //FingerprinTV// (PETS 2022), the HbbTV study (NDSS 2023) and the automatic-content-recognition first look (IMC 2024). Only one candidate is on the web platform, which is the point: almost none of the web instrumentation transfers, and nothing on this wiki says so. |
-| [[privacy:age_assurance|Age assurance]] | Age verification and age gates as deployed. **Thin on purpose, and the thinness is the finding**: of 11 candidates, most are children's-privacy and COPPA-compliance work (//Won't Somebody Think of the Children?//, PETS 2018) rather than age-assurance measurement — the one squarely on it is //Easy As Child's Play// (USENIX 2025). The policy surface is moving years ahead of the literature, so expect method, denominators and caveats rather than a figure table. |
-| [[privacy:data_subject_rights|Data subject rights]] | Access, deletion and opt-out requests as a measurement: DSARs, Global Privacy Control, "do not sell". 9 papers, **6 of them 2024–2026**. Note the id — [[Privacy:Requests]] is //web// requests. |
 ===== Assessed, and not written =====
@@ Line 22: / Line 18: @@
 ^ Proposal ^ Disposition ^
-| Anti-adblock and adblock walls | **3 papers.** A section on [[Programming:Filter Lists]], not a page. |
+| PII leakage to third parties | **Written 2026-10-08** as [[privacy:pii_leakage|Privacy:PII leakage]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **218** (≥ 5 hits of the ''pii_leakage'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 76 web, 96 from 2024–2026), flagged there as noisy. The count re-runs exactly; the noise is as described and larger. Over whitespace-collapsed ''paper.cols.txt'' the regex gives **226**, of which **13** are in the page's population — **5.8%** precision, **65.0%** recall; 4 of its top 20 are language-model PII papers, and its largest classes are mobile apps (61), attacks (27), user studies (24) and language models (20). The page's population is **20** papers from a hand audit of **314** candidates from three probes (**6.4%** precision), against an inclusion rule written before the first count; a second reader re-adjudicated 97 exclusions (two moved in) and a full-text reading of every included paper moved three to context. The boundary the row asked about is settled: **5** of the 20 are cited on [[Privacy:Email tracking]], which keeps the address as an identifier; this page owns personal-data leakage in general. Four of the five spine candidates are in the population; //Investigating sources of PII used in Facebook's targeted advertising// (PETS 2019) is context — what a platform does with PII it already holds. No paper in the population is a health-sector study: that literature is in medical journals and workshops outside the seven venues, and the page cites it as such. |
-| AI crawlers, ''robots.txt'', training opt-out | **4 papers**, 3 of them 2024 or later: the corpus lags the field by about two years. Extend [[Programming:Crawler Detection]], which covers your crawler being noticed, to cover measuring who crawls //you//. |
+| Super-app mini-programs (WeChat, Alipay, Douyin, QQ, Baidu) | **Written 2026-09-27** as [[design:mobile_and_app_measurement:mini_programs|Design:Mobile and app measurement:Mini programs]], the first child of [[Design:Mobile and app measurement]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **37** papers (21 from 2024–2026) with at least ten full-text hits of "mini-program" or "WeChat". The count re-runs exactly. The page's population is **16** papers that measure mini-programs or their host framework — 13 as the main object — hand-verdicted from a **57**-paper candidate set. The gap rule contains **15** of them: **40.5%** precision, **93.8%** recall; 19 of its 22 false hits use no mini-program vocabulary at all (WeChat as a messenger, payment method, login target or dataset owner). The ecosystem's own vocabulary (mini-program, mini-app, super app, app-in-app) at ≥ 3 hits finds all 16 at 53.3% precision. The first paper is from 2020, and 10 of 16 are from 2024–2026. |
+| Messaging groups and channels (Telegram, WhatsApp, Discord) | **Written 2026-09-27** as [[design:platforms:messaging_channels|Design:Platforms:Messaging channels]], the second child of [[Design:Platforms]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on full-text candidate counts of **40 / 41 / 13** papers naming Telegram / WhatsApp / Discord at least ten times (case-sensitive; 23 / 18 / 8 of them from 2024–2026). The counts re-run exactly. The page's population is **26** papers that collect data from inside groups, channels or servers — 9 as their main dataset — hand-verdicted from a **147**-paper candidate set. The gap rule's union of **76** papers contains **23** of them: **30.3%** precision, **88.5%** recall. WhatsApp's count is the weakest, **4 of 41**, because a paper naming WhatsApp ten times is usually about its encryption, its users or its traffic; 21 of the 26 are Telegram papers and none predates 2019. Account enumeration through contact discovery (4 papers) became a pointer section on the page, not a second page. |
+| Domain abuse (squatting, parking, expired domains, dangling DNS) | **Written 2026-09-25** as [[security:domain_abuse|Security:Domain abuse]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **85** (≥ 5 hits of the ''domain_abuse'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 47 web, 25 from 2024–2026). The count re-runs exactly. The page's population is **48** papers — 40 about the namespace, 8 measuring it in one section — hand-verdicted from a **149**-paper union of six probes against a rule with four families (lookalike, parking, residual, dangling). The gap regex finds **38** of the 48 (**79.2%** recall, **42.2%** precision over whitespace-collapsed ''paper.cols.txt'') and misses the name-collision and delegation-hijack papers, which never say //typosquat// or //dangling DNS//. Of its 27 hits from 2024–2026, **11** are in the population; the rest are passing mentions and squatting in other namespaces (packages, containers, social handles, blockchain names), which the page records as context. The recent slope is real but belongs to the residual and dangling families: the population has **no** primary typosquatting paper from 2022–2024. Three on-topic papers were selected for the corpus but never retrieved (empty full-text directories) and are cited, not counted. The page flags an open question for [[practices:ethics]]: 19 of the 48 papers registered or took control of names to measure the traffic they receive, and that page does not cover it. Audit, all 149 verdicts, the hand codes and the dated primary sources: [[provenance:security:domain_abuse]]. |
+| Online scams | **Written 2026-09-24** as [[security:online_scams|Security:Online scams]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **43** (≥ 5 hits of the ''scams'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 27 web, 21 from 2024–2026), described there as the steepest recent slope in the pass. The count re-runs exactly; the slope does not survive reading. The page's population is **27** papers, hand-verdicted from a **183**-paper union of five probes. The gap regex finds **18** of the 27 (**66.7%** recall, **40.0%** precision over whitespace-collapsed ''paper.cols.txt'') and misses all nine from 2010–2014, which say //pharmacy//, //counterfeit//, //affiliate program// or //one-click fraud//. Of its 23 hits from 2024–2026 only **7** are scam-website measurement — the rest are platform, on-chain, user-study, telephony and LLM-conversation papers — and the population holds at three to seven papers per year bucket. The ''seo_spam'' family was read: search poisoning enters only when its destinations are scams or fraudulent storefronts; 12 generic search-abuse papers are recorded as context. The line with [[security:phishing]] is what the victim hands over. |
+| Malicious web content (cryptojacking, exploit kits, malvertising, skimmers) | **Written 2026-10-08** as [[security:malicious_web_content|Security:Malicious web content]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **124** (≥ 5 hits of the ''malicious_web_content'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 87 web, 70 crawled, 20 from 2024–2026). The count re-runs exactly. The page's population is **39** papers — 36 about the topic, 3 measuring it in one section — hand-verdicted from a **261**-paper union of seven probes, the last a title-and-abstract probe over the whole venue index. The gap regex finds **36** of the 39 (**92.3%** recall, **26.1%** precision over whitespace-collapsed ''paper.cols.txt''). **None of its 20 hits from 2024–2026 is in the population**, and none of the 47 candidates from those years is: the last paper is from 2023, exploit-kit papers end in 2015 and mining papers in 2021. The page checked whether that is the field or the corpus — wider vocabularies over every 2024–2026 paper (0 found), the screening funnel (three on-topic 2025 defence papers were screened out; none is a census), and venues outside the seven — and records the answer: exploit kits and in-browser mining ended as mass phenomena, while malvertising, skimming, compromised-site injects and third-party script compromise continued in government and vendor reports and went unmeasured here. Web skimming has **no** paper in these venues; the three //skimmer// papers are gas-pump hardware. Audit, all 261 verdicts, the hand codes and the dated primary sources: [[provenance:security:malicious_web_content]]. |
+| Ad targeting and bidding | **Written 2026-09-23** as [[privacy:advertising|Privacy:Advertising]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **118** (≥ 5 hits of the ''ad_targeting_rtb'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''). Writing it moved that count three ways. The same regex over whitespace-collapsed ''paper.cols.txt'' gives **127**, of which **42** are in the page's population — **33.1%** precision — and it finds only **42 of the 71** population papers (**59.2%** recall): 22 of its 29 misses ask what served ads //contain// (malvertising, political and children's ads, archives) and never say "targeted ad" often enough, and the rest include the two founding persona papers. The population is **71** papers from a hand audit of **291** candidates from three probes (**24.4%** precision), against an inclusion rule written before the first count. The row's "about a third of the top hits are user-perception studies" held for the top 30 — **10** recruited participants — but **4** of those 10 also measured ads and are in the population; across all 127, **23** are pure perception studies, kept as context and not counted. The gap pass's 41 candidates from 2024–2026 compare with **20** population papers from those years. A title probe over the venue index finds **18** further ad measurements that never reached the extraction — at least a fifth of the total — mostly TheWebConf papers screened out and NDSS 2016/2018 papers in venue-years with no screening labels. Audit, all 291 verdicts, the needle checks and the dated primary sources: [[provenance:privacy:advertising]]. |
+| Data subject rights | **Written 2026-09-16** as [[privacy:data_subject_rights|Privacy:Data subject rights]]. Every number in the queued row was wrong in the same direction. The **9** title-and-summary candidates all survive — 100% precision, the only queued probe on this wiki to manage that — but the recall is **17.6%**: the page's population is **51** papers and the title probe misses **42** of them, including every paper that obtained its research data through the right of access, both people-search removal studies, and the largest opt-out-signal paper before 2024. On this topic the rights work is usually one section of a paper whose title says nothing about rights. The "6 of them 2024–2026" understates the slope rather than overstating it: **43 of the 51** are 2021 or later. The population is a hand audit of **471** full-text candidates (**10.8%** precision) against a written inclusion rule; nine tenths of the noise is structured, and the largest single class is an internet-scanning paper's ethics section offering an //"opt-out request"// for its own probes. Two probes were added mid-run, after the first complete audit could not see //Do Opt-Outs Really Opt Me Out?// (CCS 2022) — a paper the page is partly about — because industry opt-out tools are never called "do not sell"; they added 182 candidates and 10 population papers. The scope held in one important respect and moved in another: the request-as-instrument framing is the page's spine, and the **median number of controllers a request-sending paper wrote to is 30**, against a crawl median of 10,000 sites. Probe history, all 471 verdicts, the fold residue and eight dated primary sources: [[provenance:privacy:data_subject_rights]]. |
+| Age assurance | **Written 2026-09-15** as [[Privacy:Age assurance]]. The queued reasoning held — the page is thin, the thinness is the finding, and there is no figure table — and writing it corrected this row's own count twice. The **11** title-and-summary candidates are really **10**: ''gap_probe_roadmap.mjs'' has no word boundary before ''age'', so //F-BLEAU: Fast Black-Box Leakage Estimation// entered on //Leak**age Estimation**//. And 11 was the wrong instrument as well as the wrong number — the title probe has **27.3% precision** (3 of 11 are in the derived population) and **60% recall** (3 of the page's 5), because on this topic the measurement is often one section of a paper whose title says nothing about age: //A Picture is Worth 500 Labels// and //Developers Say the Darnedest Things// are both invisible to it. A full-text phrase probe over the 5,855 papers with full text returns **38** candidates, every one hand-judged: **1** has age assurance as its research question, **4** more measure it in a section, and **6** ran into it as an obstacle to a measurement about something else — which is now the most common way it appears in the corpus and the thing the queued row did not anticipate. The population is **5** papers, **13.2%** of the candidates and 0.1% of the corpus, and only one of the five is about the web. The children's-privacy reading held and is sized: **36** papers name COPPA in ''legal[]'' against the 5, and exactly **1** paper is in both. Probe history, the two regex defects, verdicts for all 38 and nine dated primary regulatory sources: [[provenance:privacy:age_assurance]]. |
+| Connected TV | **Written 2026-09-12** as [[Design:Connected TV]]. The queued reasoning held and both of its numbers moved. The **16** title-and-summary candidates have **62.5% precision** — 10 are in the page's population — but the recall is the real story: the derived population is **35** papers and the queued probe **misses 25 of them**, including the corpus's largest TV app analysis (4,745 Android TV APKs, PETS 2022) and a Wi-Fi-positioning paper in which Roku devices are two of the five most common vendor prefixes in a 490-million-row dataset. The "only one candidate is on the web platform" observation survives derivation exactly: **1 of 35** carries ''web'', 26 carry ''iot'', and only **6** are in the corpus-wide ''crawled'' population. One paper the row named as spine is **not** in the population — //Endangered Privacy// (USENIX 2025) identifies videos from encrypted MPEG-DASH traffic and never measures a television. The page's population is a hand audit of **103** candidates from nine full-text probes (**34.0% precision**), with a written inclusion rule, and the biggest noise class is the smart-home survey where "smart TV" is an answer option. Audit, verdict map for all 103, and the 191-name fold residue: [[provenance:design:connected_tv]]. |
+| Anti-adblock and adblock walls | **Written 2026-09-16** as a section on [[Programming:Filter Lists]], //The site may detect the blocker//. The disposition held; the count did not. **3** was a probe defect: the ''anti_adblock'' family in ''gap_probe_roadmap.mjs'' matches ''anti-?ad'', which allows "anti-ad" and "antiad" but **not "anti ad"**, so it cannot see //Detecting Anti Ad-blockers in the Wild// (PoPETs 2017) — the paper whose entire subject is this row's. Widening the separator class gives **4** at title level and **64** in full text, of which only **8** mention the topic ten or more times and **5** more than fifty; two of those five are 2025 Acceptable Ads papers, which is the allowlisting side and not this one. The section's load-bearing figures are both 2017 and both published side by side and deliberately **not** as a range: anti-adblock filter lists trigger on about **9%** of Alexa top-5K, while a differential crawl finds visible reactions on **686** of Alexa top-100K (**0.7%**) — two definitions of "detects my blocker" on populations twenty times apart. The most recent dedicated paper in this corpus is **2021**, and nobody in these seven venues has re-measured wall prevalence since Alexa was retired; that negative claim was re-run at a second, disjoint vocabulary before publishing and survived. Probe widths, the paired-crawl candidate set with its five hand-marked false positives, and the quote checks against both PDF renderings: [[provenance:programming:filter_lists]]. |
+| AI crawlers, ''robots.txt'', training opt-out | **Written 2026-09-16** as a section on [[Programming:Crawler Detection]], //Measuring who crawls you//. The disposition held and the corpus is even thinner than the row said: **three** papers name an AI-crawler user agent, all **2025**, not four. The page's own earlier sentence said five, from a wider pattern that also matches "AI scraper" and "agentic browser" — two of those five are papers about LLM-driven agents, one matching only inside its reference list, and the sentence was corrected in the same sitting. **74** papers mention ''robots.txt'' at all, but 44 mention it exactly once, as a crawl-policy declaration or an archive-coverage caveat; **no paper mentions ''llms.txt''**. The section is built on the separation the row implied but did not state: a directive is a claim measurable at web scale from the client side, compliance is measurable only from the server's own logs, so the studiable population is the set of sites you operate. The two IMC 2025 papers disagree — vendor training crawlers largely comply, user-triggered assistant fetchers largely never fetch the file — and the section publishes the disagreement rather than choosing. Probe widths, the coding of the 44 with its uncoded residue, and the quote checks: [[provenance:programming:crawler_detection]]. |
 | WebRTC leaks | **6 papers.** Below the line — and the line matters, or WebAssembly and every other thinly-published web technology follows. |
 | SSO, WebAuthn and MFA deployment | **Written 2026-09-11** as [[Security:Authentication]], after the audit this row demanded. The gate was passed but not comfortably by the row's own terms: of the queued **46**, only **22** measure deployment — the rest are attacks, SDK and protocol analysis, mobile studies, user studies, abuse ecosystems, and three homonyms (''MFA'' as "Made for AdSense", ''OpenID'' inside "OpenIDEO", an RPKI //relying party//). Four more probes and a full-text recall pass take the candidate pool to **184**, of which **45** are deployment measurements — **24.5% precision** — and the branded-mechanism slice this row described is **25**, four of which the queued probe could not see. The page was broadened from SSO/WebAuthn/MFA to the whole login surface, because the login-page and login-policy papers are where the denominators come from: "how many sites support SSO" is 6.30%, 7.23%, 27% and 57.8% in five papers that divide by different things. The audit is on [[provenance:security:authentication]]. |
-| Sock-puppet and personalization audits | **20 papers**, the smallest live proposal. Likely a section on [[Programming:Stateful Stateless]] rather than a page. |
+| Sock-puppet and personalization audits | **Settled 2026-09-23: no further page or section.** The design was written on 2026-09-11 as [[Design:Algorithm audits]] — 34 audit papers, reproduced unchanged by a re-run of ''report_algorithm_audits.mjs'' on 2026-09-23 — which treats sock puppets, trained profiles and paired campaigns as one differential-audit design. The ad-specific half, what a persona difference, a bid, an explanation or a bought campaign can prove, is [[Privacy:Advertising]], whose population contains **22** of those 34 audits. The queued **20** was a title probe from an earlier gap pass and was not re-derived; both pages count their own populations. The suggested section on [[Programming:Stateful Stateless]] was not written: that page owns what a profile reset resets, and both pages link to it. |
 | Per-company platform pages (Facebook, Twitter, TikTok, Amazon) | Assessed against the corpus and deliberately not written; [[Design:Platforms]] carries the reasoning and the counts. |
 | Blocking and geodifference | **Written 2026-09-10** as [[Design:Blocking and geodifference]] — a split from [[Design:Crawling location]], which is about //choosing// a vantage point rather than about the phenomenon; two bullets on that page were rewritten to hand the phenomenon over. The queued "74 papers" is a candidate set and turned out not to be comparable to the page's population in either direction. The recorded alternation re-runs to **68** here, of which **38** are in the population and 30 are not; and **16 of the population's 63 papers** are caught by no title probe at all. The page's population is the **63** papers surviving a hand audit of **274** candidates from eight probes — **58.8% of the candidates are off topic**, mostly on ordinary English words. Three of the eight probes were added mid-run, each because a later check found a paper the candidate set had missed; the last was prompted by the bibliography's own newest entry, an IMC 2025 outage study that no censorship-shaped probe could see. |
-| Internet scanning | **Written 2026-09-10** as [[Programming:Internet scanning]] — an //instrument// page under ''programming:'', matching [[Programming:Crawler]], as decided here on 2026-09-07. Writing it corrected the queued count twice. The 143 that named ZMap/ZGrab/masscan/nmap re-derives to **141** inside the 930 (**145** corpus-wide) once the fold is written down; and the page's own population is not that set but the **245** papers naming any active-scan instrument, of which **235** are inside the 930. The queued "only 5 papers mention a hitlist" was a ''tools[]'' fold, not a full-text count: **62** SCAN papers say "hitlist" and **39** say it near "IPv6", while **11** name an IPv6-targeting instrument. |
+| Internet scanning | **Written 2026-09-10** as [[Programming:Internet scanning]] — an //instrument// page under ''programming:'', matching [[Programming:Crawler]], as decided here on 2026-09-07. Writing it corrected the queued count twice. The 143 that named ZMap/ZGrab/masscan/nmap re-derives to **141** inside the 930 (**145** corpus-wide) once the fold is written down; and the page's own population is not that set but the **245** papers naming any active-scan instrument, of which **235** are inside the 930. The queued "only 5 papers mention a hitlist" was a ''tools[]'' fold, not a full-text count: **62** SCAN papers say "hitlist" and **39** say it near "IPv6", while **11** name an IPv6-targeting instrument. **Corrected 2026-09-17**: a hand audit of the fold's 174 hand verdicts moved the page's population to **241** (**232** inside the 930) and the four-scanner set to **139** / **143**; the figures in this row are the 2026-09-10 ones. See [[provenance:programming:internet_scanning#Follow-up run, 2026-09-17]]. |
 | Email authentication | **Written 2026-09-09** as [[Security:Email authentication]]. The queued population held: the ''INFRA'' verdict of ''scripts/msg_fold.mjs'' is still exactly 31 papers and was reused rather than re-derived. A widened full-text recall probe over all 5,859 papers added none. The page became a sixth child of [[Security]]. |
 | Annotation and validation | **Written 2026-09-11** as [[Statistics:Annotation]]. Both queued counts moved. The **42.4%** is the share of papers with **at least one** unvalidated classifier, not the share that validated nothing — that is **29.9%** (1,328 of 4,439), and the Queued row this replaces stated the former in words that read as the latter. And the 30-paper LLM-annotator probe is a candidate set with **70% precision and 13% recall**: seven of the 30 study attacks on LLMs rather than using one, and the ''classification.method == "llm"'' enum finds **175** papers the probe misses all but 23 of. The page's populations are the enum and the 4,439. |
 | Ad archives | **Written 2026-09-08** as [[Design:Platforms:Ad archives]]. Writing it corrected the count that queued it: the 69 was a homonym artefact (an Android //ad library// is an advertising SDK), and the hand-audited figure is **11** papers. |
+| Ownership resolution | **Written 2026-09-11** as [[Design:Ownership resolution]] — a **carve-out**, not a new population: the comparison, the coverage census and the random-sample accuracy rates existed on [[Programming:Crawler:webXray]] and moved unchanged, with their two frame dates intact, because re-deriving them would have orphaned the adjudication pinned to 2026-08-17. The queued reasoning held and the 2026-08-17 sitting's decision against a separate page was reversed on the record; [[Programming:Crawler:webXray]] is now a 27 KB page about webXray itself rather than the stub that decision feared. The move also **corrected a denominator that had been live for three and a half weeks**: ''report_webxray.mjs'' divided a corpus-wide sweep count by the crawling population, so "12.1% of papers that crawled name an ownership resource" was 136 ÷ 1,120 where the comparable figure is **9.6%** (107 ÷ 1,120), and webXray's own 1.3% is **1.2%**. No guard could have caught it: the page matched the script and the script was wrong. New corpus figures: **136** papers name an ownership resource, **9.6%** of the 1,120; PETS carries **9.6%** of its own papers against NDSS's 1.1%; and the share has been flat at 2.5–2.7% since 2023 rather than growing. |
 | Privacy policies and terms | **Written 2026-09-10** as [[Privacy:Policies]]. The queued count moved: 121 was a four-alternative title probe, and widening it to nine (''privacy label'', ''data safety'', ''nutrition label'', ''privacy statement'' — the store-declaration half of the literature) gives a 123-paper candidate set. The page's actual population is the **102** papers whose ''classification[].target'' enum is ''privacy-policy''; the 123 is used for rankings only. The queued scope also held on the tool lineage, and reading the repositories corrected it: **PurPliance (2024-03) is more recently touched than PoliGraph (2023-06)**. |