# Evidence Register: Websites for the AI Era

Register v1.0, 31 October 2026, for Research Study v1.1. Publisher: Sysbot Technologies, Research & Development. Maintainer: Logesh Chandran.

This register lists every sourced claim in the study [Websites for the AI Era](https://sysbot.in/research/websites-for-the-ai-era/), grades the evidence behind each one, records whether the source still states it, and separates the study's own interpretations from the evidence. It exists so that a reader can check any figure without trusting the study, and so that another researcher can repeat the check.

**What it covers.** 146 claims drawn from 139 distinct sources: every sentence or table cell in the study's five Shift sections that links to a source. Each link is one row, so a sentence with three sources appears three times with its own ID. The study's own readings, positions and bets are listed separately as 12 interpretations (grade E5). Sections of the study that cite no external source (the anatomy, prototype roadmap and strategic position) are argument, not evidence, and are not graded.

**How each claim was checked.** On 31 October 2026 every source URL was requested again. Where the page could be read, the figure, date or fact the study attributes to it was looked for on the page and the publication date recorded. Where the page refused automated reading or did not respond, the claim is marked as not re-checked and stands on the reading made when the study was written. The check establishes that the source says what the study says it says; it does not establish that the source is right.

**Evidence grades.** Every claim carries the grade of its source, not of the claim's importance.

| Grade | Meaning | Treat as |
| --- | --- | --- |
| E1 | Official standard, regulation or primary research (W3C, IETF, OWASP, legal texts, regulators, academic and independent research institutes) | Fact, within the document's own scope and date |
| E2 | Independent measured research by an organisation measuring its own network, panel or dataset (Cloudflare, Similarweb, Ahrefs, Chartbeat, Baymard, NN/g) | Measurement, valid for that dataset and period only |
| E3 | Vendor-reported or self-reported data (a company's own revenue, performance, resolution rate or evaluation) | Claim by an interested party |
| E4 | Secondary reporting or estimate (press, blogs, analyst estimates) | Pointer to evidence, not evidence |
| E5 | Sysbot interpretation or hypothesis | The study's opinion, stated with what would change it |

**Verification status.** Confirmed: the page states the figure or fact as the study gives it. Confirmed with caveat: the page supports it, but a number, date or scope differs or needs a qualifier, which the note records. Not confirmed: the page does not state it or contradicts it. Not re-checked: the page could not be read on the check date.

**Headline counts.** Of the 146 claims in v1.1, 33 rest on E1 sources, 17 on E2, 48 on E3 and 48 on E4. The check of the v1.0 wording covered 143 claims: 104 were confirmed as stated, 24 confirmed with a caveat, 4 were not supported by the page cited and 11 could not be re-read. All of the caveats and unsupported statements were corrected, qualified or recorded in v1.1. 30 of the secondary pages name their original; v1.1 links four of those originals directly and adds three primary sources.

**How to read a row.** The claim column reproduces the study's v1.1 sentence or cell as written, with the link text in plain words. The source column is the page the study links to. Published is the date shown on that page. The check column is the result of comparing the v1.0 wording with the page; where it says caveat or not supported, the corrections table at the end records what v1.1 changed. The last column records the scope the figure is valid for, any mismatch found, and the original source where the cited page is secondary.


## Summary

| Evidence grade | Meaning | Claims |
| --- | --- | ---: |
| E1 | Official standard, regulation or primary research | 33 |
| E2 | Independent measured research | 17 |
| E3 | Vendor-reported or self-reported data | 48 |
| E4 | Secondary reporting or estimate | 48 |
| E5 | Sysbot interpretation or hypothesis | 12, listed separately below |

| Check of the v1.0 wording on 2026-10-31 (143 claims) | Claims |
| --- | ---: |
| Confirmed as stated | 104 |
| Confirmed with caveat | 24 |
| Not supported by the page cited | 4 |
| Not re-checked, page unreadable | 11 |

Every claim marked not supported or confirmed with caveat was corrected or qualified in v1.1, or recorded as needing no change; the table of corrections below says which. Grades describe the source, so a vendor's accurate statement about its own product is still E3.

## Shift 1: Discovery moves from search results to answer engines

| ID | Claim as stated in the study (v1.1) | Source | Published | Grade | v1.0 check | Limitation, caveat or original source |
| --- | --- | --- | --- | --- | --- | --- |
| C001 | **Answer engines are now the default search experience.** Google said at I/O in May 2026 that AI Overviews reach more than 2.5 billion monthly users and AI Mode passed 1 billion. | [blog.google](https://blog.google/innovation-and-ai/sundar-pichai-io-2026/) | 2026-05-19 | E3, vendor self-report | Confirmed | Google's own I/O keynote blog post by Sundar Pichai; figures are monthly active users as reported by Google. |
| C002 | Overviews appear on roughly a fifth of searches, 18% in Pew's March 2025 sample and over 20% per Similarweb in June 2026. | [pewresearch.org](https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/) | 2025-07-22 | E1, primary research | Confirmed | Sample is browsing data from about 900 US adults during March 1-31, 2025. |
| C003 | Overviews appear on roughly a fifth of searches, 18% in Pew's March 2025 sample and over 20% per Similarweb in June 2026. | [aisearch.similarweb.com](https://aisearch.similarweb.com/blog/zero-click-marketing/) | 2026-06-10 | E2, independent measurement | Confirmed | June 2026 is the article date; the page gives no specific measurement month for the 20% figure. |
| C004 | Pew Research | [pewresearch.org](https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/) | 2025-07-22 | E1, primary research | Confirmed | Source-table reference only; page is the Pew study as described. |
| C005 | Ahrefs | [ahrefs.com](https://ahrefs.com/blog/ai-overviews-reduce-clicks-update) | 2026-02-04 | E2, independent measurement | Confirmed | 300k keywords, GSC desktop CTR, Dec 2023 vs Dec 2025; authors describe it as correlation, not causation. |
| C006 | Seer Interactive | [seerinteractive.com](https://www.seerinteractive.com/insights/aio-impact-on-google-ctr-2026-update) | 2026-04-24 | E2, independent measurement | Confirmed | 53 brands, 5.47M queries, Jan 2025 to Feb 2026; agency client data, not a general-web sample. |
| C007 | Similarweb / SparkToro | [aisearch.similarweb.com](https://aisearch.similarweb.com/blog/zero-click-marketing/) | 2026-06-10 | E2, independent measurement | Confirmed | Page is Similarweb's own; SparkToro is mentioned as the recipient of Similarweb data, not as co-author. |
| C008 | Chartbeat | [searchenginejournal.com](https://www.searchenginejournal.com/google-search-decline-publishers-chartbeat/590681/) | 2026-09-24 | E4, secondary reporting | Confirmed | Periods: July 2025 to July 2026 for the 40.2% decline; July 2024 to July 2026 for the share change. Original: Chartbeat 2026 Publisher Playbook, https://lp.chartbeat.com/2026-publisher-playbook-chartbeat. |
| C009 | Google search traffic to publishers in Chartbeat's network down 40.2%; search share of pageviews fell from about 9% to 5% in two years; small publishers down 60% over two years vs 22% for large. This applies to Chartbeat's publisher network and should not be extrapolated to e-commerce, corporate or small-business sites | [axios.com](https://www.axios.com/2026/03/17/chartbeat-search-traffic-ai-chatbots) | 2026-03-17 | E4, secondary reporting | Confirmed with caveat | WebFetch and curl returned 403; browser showed only the intro, 60%/22% figures sit in a chart not in readable text; SEJ corroborates the 60% as from Axios. Original: Chartbeat data provided exclusively to Axios (no URL given). |
| C010 | **AI assistants send little traffic, but it converts well.** Chartbeat puts AI referrals at 0.01% of publisher traffic despite eightfold growth in two years. | [searchenginejournal.com](https://www.searchenginejournal.com/google-search-decline-publishers-chartbeat/590681/) | 2026-09-24 | E4, secondary reporting | Confirmed | Playbook also says AI referrals declined across ChatGPT, Claude, Perplexity, Copilot and Gemini in 2026. Original: Chartbeat 2026 Publisher Playbook, https://lp.chartbeat.com/2026-publisher-playbook-chartbeat. |
| C011 | ChatGPT accounts for about 80% of chatbot referrals in Statcounter's September 2026 worldwide measure, with Gemini, Perplexity, Copilot and Claude sharing the rest. | [gs.statcounter.com](https://gs.statcounter.com/ai-chatbot-market-share) | 2026-09 | E2, independent measurement | Confirmed | Referral share across sites in Statcounter's tracking network; a monthly series that moves. |
| C012 | The quality signals point the other way: Similarweb measured ChatGPT referrals converting at 7% on transactional sites against 5% for Google, and Adobe Analytics found US retail AI-referred traffic in March 2026 converting 42% better than other traffic, a retail-specific, single-month figure on a small and fast-growing base, after converting 38% worse a year earlier; it says nothing about SaaS, services or small-business sites. | [aisearch.similarweb.com](https://aisearch.similarweb.com/blog/zero-click-marketing/) | 2026-06-10 | E2, independent measurement | Confirmed | Figure is US desktop, September 2025 data; scope is transactional sites only. Original: Similarweb 2025 Gen AI Landscape report (US desktop, September 2025). |
| C013 | The quality signals point the other way: Similarweb measured ChatGPT referrals converting at 7% on transactional sites against 5% for Google, and Adobe Analytics found US retail AI-referred traffic in March 2026 converting 42% better than other traffic, a retail-specific, single-month figure on a small and fast-growing base, after converting 38% worse a year earlier; it says nothing about SaaS, services or small-business sites. | [peec.ai](https://peec.ai/ai-search-geo-statistics) | 2026-10-30 | E4, secondary reporting | Confirmed | Peec statistics roundup; body says 'Last updated August 2026' while metadata shows Oct 30, 2026; Adobe figure is relayed, not Peec's own data. Original: Adobe Analytics, April 2026, via https://finance.yahoo.com/sectors/technology/articles/ai-traffic-us-retailers-jumps-160141756.html. |
| C014 | **What gets cited.** Google's official guidance is that AI features need no new markup or files, only indexed, snippet-eligible pages. | [developers.google.com](https://developers.google.com/search/docs/appearance/ai-features) | 2025-12-10 | E3, vendor self-report | Confirmed | Official Google Search documentation; date shown is 'Last updated 2025-12-10'. |
| C015 | Ahrefs found the share of Overview citations drawn from the top 10 organic results fell from 76% to 38% between July 2025 and March 2026, with about 31% coming from outside the top 100. | [ahrefs.com](https://ahrefs.com/blog/ai-overview-citations-top-10/) | 2026-03-02 | E2, independent measurement | Confirmed | Ahrefs sample of 863k keywords; 'today' is March 2026. |
| C016 | Across 30 million citations, Reddit is the first or second most cited domain on all five major assistants; one analysis of 27 million citations reported brand-owned sites earning about 4%, a figure taken from a secondary roundup, not verified against the original dataset, and not relied on in this study's conclusions. | [peec.ai](https://peec.ai/ai-search-geo-statistics) | 2026-10-30 | E2, independent measurement | Confirmed | Reddit finding is Peec's own 30M-citation study; the ~4% brand-owned-sites figure is not on this page, as the study already flags. Original: Peec AI, March 2026, https://peec.ai/blog/top-domains-cited-by-ai-search-analysis-based-on-30m-sources. |
| C017 | The Princeton generative engine optimisation work showed that adding statistics and quotations raised visibility by up to 40%, and a SIGIR 2026 study tests 18 such factors across six models. | [arxiv.org](https://arxiv.org/pdf/2605.25517) | 2026-05-25 | E1, primary research | Confirmed | PDF front matter lists Proceedings of SIGIR '26, DOI 10.1145/3805712.3808445; authors report an internal pilot at Sprinklr, so industry-affiliated. |
| C018 | Cited pages are on average 26% fresher than organic results. | [ahrefs.com](https://ahrefs.com/blog/do-ai-assistants-prefer-to-cite-fresh-content) | 2025-07-28 | E2, independent measurement | Confirmed | 17M citations across 7 platforms; the 44%-from-first-30%-of-page figure is not on this page and needs its own source. |
| C019 | Adoption is about 10% of 300k domains with no measurable link to citations; 97% of files received zero AI-crawler requests in a month; Google's John Mueller has said no AI system currently uses it. | [seranking.com](https://seranking.com/blog/llms-txt/) | — | E2, independent measurement | Confirmed | SEO-tool vendor's own study; correlational, and the page gives no publication date. |
| C020 | Adoption is about 10% of 300k domains with no measurable link to citations; 97% of files received zero AI-crawler requests in a month; Google's John Mueller has said no AI system currently uses it. | [projectllmstxt.com](https://projectllmstxt.com/blog/llms-txt-adoption-2026) | — | E4, secondary reporting | Confirmed | Page shows no explicit publication date; study month unnamed; the site advocates llms.txt and relays Ahrefs data, so cite Ahrefs directly. Original: Ahrefs server-log study of ~137K sites, 'We Analyzed 137K Sites: 97% of llms.txt Files Never Get Read' (June 2026, no URL given). |
| C021 | Adoption is about 10% of 300k domains with no measurable link to citations; 97% of files received zero AI-crawler requests in a month; Google's John Mueller has said no AI system currently uses it. | [seroundtable.com](https://www.seroundtable.com/google-ai-llms-txt-39607.html) | 2025-06-18 | E4, secondary reporting | Confirmed | Statement dates from June 2025; 'currently' refers to that time, not 2026. Original: John Mueller Bluesky post, 17 June 2025 (URL not captured). |
| C022 | **How publishers and businesses are responding.** Cloudflare, which fronts over a fifth of web domains, blocks training and agent crawlers by default on ad-bearing pages for new domains since 15 Sep 2026, and is moving Pay Per Crawl toward pay per answer. | [blog.cloudflare.com](https://blog.cloudflare.com/content-independence-day-ai-options/) | 2026-07-01 | E3, vendor self-report | Confirmed | Default applies to new domains onboarding; Search crawlers stay allowed; this page does not mention pay per answer. |
| C023 | **How publishers and businesses are responding.** Cloudflare, which fronts over a fifth of web domains, blocks training and agent crawlers by default on ad-bearing pages for new domains since 15 Sep 2026, and is moving Pay Per Crawl toward pay per answer. | [ppc.land](https://ppc.land/cloudflare-stops-charging-ai-per-crawl-and-starts-paying-per-answer/) | 2026-07-02 | E4, secondary reporting | Confirmed | Described as a research program with partners Ceramic.ai and You.com, broad availability 'later in 2026'; no pricing disclosed. Original: Cloudflare Blog post by Matthew Conroy, 1 July 2026 (URL not linked in article). |
| C024 | Microsoft opened a Publisher Content Marketplace in February 2026 and Perplexity pays publishers an 80/20 share from Comet Plus. | [searchengineland.com](https://searchengineland.com/guide/ai-company-publisher-partnerships) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | WebFetch and curl returned HTTP 403; browser hit a Cloudflare bot-verification page that did not clear; not bypassed. |
| C025 | Microsoft opened a Publisher Content Marketplace in February 2026 and Perplexity pays publishers an 80/20 share from Comet Plus. | [engadget.com](https://www.engadget.com/ai/perplexity-has-cooked-up-a-new-way-to-pay-publishers-for-their-content-204255019.html) | 2025-08-25 | E4, secondary reporting | Confirmed | Comet Plus is $5/month; article is from launch announcement in Aug 2025, not evidence of amounts actually paid. Original: Perplexity Comet Plus announcement; WSJ report of a $42.5M revenue pool (no URL given). |
| C026 | Antitrust suits by Penske Media and Chegg over Overviews were dismissed on 30 Sep 2026. | [searchengineland.com](https://searchengineland.com/penske-media-lawsuit-over-google-ai-overviews-dismissed-493022) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | WebFetch and curl returned HTTP 403; browser hit a Cloudflare bot-verification page that did not clear; dismissal date 30 Sep 2026 not verified. |
| C027 | The UK Competition and Markets Authority imposed a publisher conduct requirement on Google on 3 Jun 2026; the CMA's Notice states that it comes into force six months after that date, 3 Dec 2026, except the page-level controls, which come into force at nine months, 3 Mar 2027. | [gov.uk](https://www.gov.uk/government/news/cma-secures-fairer-deal-for-publishers-and-improves-google-search-services-in-uk) | 2026-06-03 | E1, regulation | Confirmed | Press release confirms date and conduct requirement; it does not mention the six-month commencement or page-level controls, which come from the Notice. |
| C028 | The UK Competition and Markets Authority imposed a publisher conduct requirement on Google on 3 Jun 2026; the CMA's Notice states that it comes into force six months after that date, 3 Dec 2026, except the page-level controls, which come into force at nine months, 3 Mar 2027. | [assets.publishing.service.gov.uk](https://assets.publishing.service.gov.uk/media/6a1ec73a59fb7a60f827f64e/Publisher_CR_Notice.pdf) | 2026-06-03 | E1, regulation | Confirmed | Paragraph 4.b is the page-level withholding control; the Notice gives relative periods, the calendar dates 3 Dec 2026 and 3 Mar 2027 are derived. |
| C029 | Seven EU and Canadian publisher groups asked EU and Canadian leaders for legislation giving publishers tools to authorise, monitor and enforce the use of their content, in October 2026. | [ppc.land](https://ppc.land/seven-publisher-groups-ask-eu-canada-to-act-on-ai-search-summaries) | 2026-10-27 | E4, secondary reporting | Confirmed with caveat | Statement was addressed to EU-Canada Summit leaders asking for a declaration and legislation, not to regulators for CMA-style controls; 'similar controls' is the study's framing. Original: Coalition statement distributed via Business Wire, 26 October 2026 (no URL given). |
| C030 | Among small businesses, 33.9% noticed an AI-related traffic drop and 14.8% have seen an assistant state something incorrect about their business, yet only 13% are actively optimising for AI search. | [bccinteractive.com](https://www.bccinteractive.com/blog/local-ai-search-statistics/) | 2026-10-25 | E4, secondary reporting | Confirmed | Agency roundup fetched via browser after 403; the three figures come from two different surveys with very different samples (3,608 vs 350). Original: Small Business Expo survey, Sept 2026, 3,608 owners (33.9%, 14.8%); Bluehost State of Small Business AI Confidence 2026, May 2026, 350 owners (13%) (no URLs given). |

## Shift 2: Agents become visitors

| ID | Claim as stated in the study (v1.1) | Source | Published | Grade | v1.0 check | Limitation, caveat or original source |
| --- | --- | --- | --- | --- | --- | --- |
| C031 | OpenAI's Atlas browser stopped working on 9 Aug 2026; OpenAI's help centre now records Atlas as retired and says the older ChatGPT agent is no longer available, pointing users to the cloud browser inside ChatGPT. | [community.openai.com](https://community.openai.com/t/atlas-is-scheduled-to-stop-working-on-august-9-2026/1389473) | 2026-08-07 | E4, secondary reporting | Confirmed | Posted by community member EricGT, not OpenAI staff; page says nothing about the desktop app destination or agent mode withdrawal. Original: OpenAI Help Center, "Evolving Atlas into ChatGPT for browser-based agentic work", https://help.openai.com/en/articles/20001371. |
| C032 | OpenAI's Atlas browser stopped working on 9 Aug 2026; OpenAI's help centre now records Atlas as retired and says the older ChatGPT agent is no longer available, pointing users to the cloud browser inside ChatGPT. | [help.openai.com](https://help.openai.com/en/articles/20001371) | — | E3, vendor self-report | Confirmed with caveat | Article now titled "ChatGPT Atlas retirement" (updated ~8 days ago); confirms retirement but no longer mentions desktop app, built-in or cloud browser. |
| C033 | OpenAI's Atlas browser stopped working on 9 Aug 2026; OpenAI's help centre now records Atlas as retired and says the older ChatGPT agent is no longer available, pointing users to the cloud browser inside ChatGPT. | [help.openai.com](https://help.openai.com/en/articles/11752874-chatgpt-agent) | — | E3, vendor self-report | Confirmed | Updated ~3 days ago; no withdrawal date given, and the rest of the article still describes agent mode plans and limits; WebFetch/curl got 403, read via browser. |
| C034 | Google's Project Mariner ended on 4 May 2026, its technology folded into other Google products; the consumer browsing agent is Chrome auto browse, a US preview for paid tiers that pauses before purchases and posts and can sign in through Google Password Manager. | [gigazine.net](https://gigazine.net/gsc_news/en/20260507-google-shuts-down-project-mariner/) | 2026-05-07 | E4, secondary reporting | Confirmed | Google's notice points users to Gemini Agent, not Chrome auto browse; article does not confirm auto browse as the successor. Original: Google Project Mariner landing page notice, https://labs.google.com/mariner/landing; The Verge, https://www.theverge.com/tech/925559/google-project-mariner-shut-down. |
| C035 | Google's Project Mariner ended on 4 May 2026, its technology folded into other Google products; the consumer browsing agent is Chrome auto browse, a US preview for paid tiers that pauses before purchases and posts and can sign in through Google Password Manager. | [blog.google](https://blog.google/products-and-platforms/products/chrome/gemini-3-auto-browse/) | 2026-01-28 | E3, vendor self-report | Confirmed | Confirms pause before purchases and social posts and optional Google Password Manager sign-in; no mention of Project Mariner. |
| C036 | Microsoft retired Copilot Mode on 13 May 2026 as Browse with Copilot arrived in Edge, US-only for Microsoft 365 Premium subscribers at launch; the business version, agentic browsing with Copilot, is a limited preview scoped by IT to approved sites. | [blogs.windows.com](https://blogs.windows.com/msedgedev/2026/05/13/new-updates-to-edge-across-desktop-and-mobile/) | 2026-05-13 | E3, vendor self-report | Confirmed | Browse with Copilot is in a footnote as US-only for Microsoft 365 Premium subscribers; business/IT scoping is not on this page. |
| C037 | Microsoft retired Copilot Mode on 13 May 2026 as Browse with Copilot arrived in Edge, US-only for Microsoft 365 Premium subscribers at launch; the business version, agentic browsing with Copilot, is a limited preview scoped by IT to approved sites. | [blogs.windows.com](https://blogs.windows.com/msedgedev/2026/05/20/new-in-edge-for-business-ai-for-work-safe-from-day-one/) | 2026-05-20 | E3, vendor self-report | Confirmed | Page calls it "agentic browsing with Copilot" in limited preview, not "Browse with Copilot"; says Copilot Mode is "evolving into granular controls" rather than retired. |
| C038 | Anthropic's Claude in Chrome reached general availability on 26 Aug 2026 on paid plans, with a per-action safety classifier; Anthropic's own red-team figures put prompt-injection success at 23.6% in the 2025 pilot and 0 to 0.3% with current safeguards, a vendor evaluation rather than a general security guarantee. | [claude.com](https://claude.com/resources/articles/claude-in-chrome-generally-available) | 2026-08-26 | E3, vendor self-report | Confirmed with caveat | GA date, paid plans, per-action classifier and 0-0.3% confirmed; the 23.6% pilot figure is not on this page (it cites 17.6%/16.7% for Opus 4.5). |
| C039 | Anthropic's Claude in Chrome reached general availability on 26 Aug 2026 on paid plans, with a per-action safety classifier; Anthropic's own red-team figures put prompt-injection success at 23.6% in the 2025 pilot and 0 to 0.3% with current safeguards, a vendor evaluation rather than a general security guarantee. | [claude.com](https://claude.com/resources/articles/claude-for-chrome) | 2025-08-26 | E3, vendor self-report | Confirmed | Anthropic's own red-team evaluation of 123 test cases in the 2025 pilot. |
| C040 | Perplexity's Comet has been free worldwide since Oct 2025. | [ppc.land](https://ppc.land/perplexity-releases-comet-browser-globally-at-no-cost-after-three-month-limited-rollout/) | 2025-10-03 | E4, secondary reporting | Confirmed | Article does not link the Perplexity announcement it relies on. Original: Perplexity announcement of 2 Oct 2025 (not linked; only perplexity.ai/comet). |
| C041 | Trail of Bits showed four classes of injection, including fake CAPTCHAs, that exfiltrated Gmail when a user asked it to summarise an attacker's page, and Brave showed that near-invisible text in screenshots is executed as instructions. | [blog.trailofbits.com](https://blog.trailofbits.com/2026/02/20/using-threat-modeling-and-prompt-injection-to-audit-comet/) | 2026-02-20 | E1, primary research | Confirmed | Four injection techniques (incl. fake CAPTCHA) combined into five proof-of-concept exploits, triggered when the user asks Comet to summarise an attacker page. |
| C042 | Trail of Bits showed four classes of injection, including fake CAPTCHAs, that exfiltrated Gmail when a user asked it to summarise an attacker's page, and Brave showed that near-invisible text in screenshots is executed as instructions. | [brave.com](https://brave.com/blog/unseeable-prompt-injections/) | 2025-10-21 | E1, primary research | Confirmed | Brave is a competing browser vendor; the screenshot attack applies to Comet only (faint light-blue text on yellow), Fellou's issue is a different navigation-based injection. |
| C043 | MCP | [blog.modelcontextprotocol.io](https://blog.modelcontextprotocol.io/posts/2026-07-28/) | 2026-07-28 | E1, standard | Confirmed | Post by MCP lead maintainers (LF Projects); claims ~half a billion SDK downloads a month; deprecates Roots, Sampling, Logging. |
| C044 | WebMCP | [developer.chrome.com](https://developer.chrome.com/blog/ai-webmcp-origin-trial) | 2026-06-09 | E3, vendor self-report | Confirmed | Page does not mention Edge, document.modelContext, Firefox or Safari. |
| C045 | Chrome 149 and Edge 150 origin trials; Firefox and Safari have standards-position requests open and no stated position | [github.com](https://github.com/webmachinelearning/webmcp/blob/main/implementation-status.md) | — | E1, standard | Confirmed with caveat | Chrome 149 and Edge 150 confirmed; for Firefox and Safari the page only links Mozilla/WebKit standards-position issues with no stated position, so "undecided" is an inference. |
| C046 | Register typed tools in the page through an imperative API, or annotate forms declaratively; human-in-the-loop only, not headless | [developer.chrome.com](https://developer.chrome.com/docs/ai/webmcp) | 2026-05-18 | E3, vendor self-report | Confirmed with caveat | Human-in-the-loop and declarative form annotation confirmed; the identifier document.modelContext is not on this page (it sits on the linked Imperative API page); last updated 2026-10-07. |
| C047 | NLWeb | [presenc.ai](https://presenc.ai/research/nlweb-adoption-2026) | 2026-09 | E4, secondary reporting | Confirmed | Vendor (GEO firm) blog; only "last updated September 2026" shown; lists launch partners, ~6.3K GitHub stars; warns any site-count figure is an estimate. Original: Microsoft NLWeb announcement, https://news.microsoft.com/source/features/company-news/introducing-nlweb-bringing-conversational-interfaces-directly-to-the-web/; NLWeb GitHub, https://github.com/nlweb-ai/NLWeb. |
| C048 | Web Bot Auth | [datatracker.ietf.org](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | 2026-10-29 | E1, standard | Confirmed | Datatracker sidebar shows "Intended RFC status: (None)" while the draft header says Standards Track; authors Meunier (Cloudflare) and Major (Google). |
| C049 | IETF Internet-Draft 01 dated 29 Oct 2026, standards-track but not yet an RFC; OpenAI, Google and AWS sign agent requests | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | 2026-09-30 | E2, independent measurement | Confirmed | Cloudflare's own statement about Web Bot Auth adopters on its network; "including" implies the list is not exhaustive. |
| C050 | Agentic Commerce Protocol | [agenticcommerce.dev](https://www.agenticcommerce.dev/docs/changelog) | 2026-01-30 | E1, standard | Confirmed | Changelog does not name the maintainers; links github.com/agentic-commerce-protocol. |
| C051 | Spec of 30 Jan 2026; in-chat Instant Checkout deprioritised in Mar 2026 for discovery in chat, purchase on site | [openai.com](https://openai.com/index/powering-product-discovery-in-chatgpt/) | 2026-03-24 | E3, vendor self-report | Confirmed | "Deprioritised" is a paraphrase; OpenAI frames it as letting merchants use their own checkout; WebFetch got 403, read via browser. |
| C052 | A product feed; optionally five checkout REST endpoints | [agenticcommerce.dev](https://www.agenticcommerce.dev/docs/getting-started/sellers) | — | E1, standard | Confirmed | Page confirms five checkout REST endpoints but does not mention the product feed or say checkout is optional. |
| C053 | Universal Commerce Protocol | [developers.googleblog.com](https://developers.googleblog.com/under-the-hood-universal-commerce-protocol-ucp/) | 2026-01-11 | E3, vendor self-report | Confirmed | Requires an active Merchant Center account and interest form; no waitlist or US-only wording on this page. |
| C054 | Announced Jan 2026; merchants join a waitlist | [developers.google.com](https://developers.google.com/merchant/ucp) | — | E3, vendor self-report | Confirmed with caveat | Waitlist confirmed; the page states no US-only or regional restriction; no publication date (URL path contains 2026-04-08). |
| C055 | Agent Payments Protocol | [blog.google](https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/) | 2026-04-28 | E3, vendor self-report | Confirmed | Also announces Verifiable Intent standard co-developed with Mastercard; no adoption counts. |
| C056 | Markdown for Agents | [developers.cloudflare.com](https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/) | 2026-10-09 | E3, vendor self-report | Confirmed | Feature is enabled per zone (not stated as default on); date shown is last-updated. |
| C057 | Search / Training / Agent controls | [blog.cloudflare.com](https://blog.cloudflare.com/accountable-mixed-use-ai-crawlers) | 2026-09-15 | E3, vendor self-report | Confirmed | Presets apply to newly onboarded domains; existing settings carry over; Disallow directive exists only for Training; Pay Per Crawl/Use not mentioned here. |
| C058 | Default since 15 Sep 2026; Pay Per Use in closed beta for US customers | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | 2026-09-30 | E2, independent measurement | Confirmed | Cloudflare's own statement about Web Bot Auth adopters on its network; "including" implies the list is not exhaustive. |
| C059 | **Agentic commerce is protocols ahead of adoption.** Every network has a protocol: Visa's Intelligent Commerce Connect accepts four of them in one integration, and Mastercard's Agent Pay Trust Framework adds know-your-agent verification. | [usa.visa.com](https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22276.html) | 2026-04-08 | E3, vendor self-report | Confirmed | Intelligent Commerce Connect described as in pilot with select partners. |
| C060 | **Agentic commerce is protocols ahead of adoption.** Every network has a protocol: Visa's Intelligent Commerce Connect accepts four of them in one integration, and Mastercard's Agent Pay Trust Framework adds know-your-agent verification. | [investor.mastercard.com](https://investor.mastercard.com/investor-news/investor-news-details/2026/Mastercard-Advances-Agentic-Commerce-With-New-Trust-and-Intelligence-Services/default.aspx) | 2026-09-30 | E3, vendor self-report | Confirmed | KYA verification comes via a Skyfire partnership extending into Mastercard Agent Pay rather than as a native framework component. |
| C061 | The only merchant count found is Forrester's estimate, via secondary reporting, of about 30 live Shopify stores on Instant Checkout by February 2026, after which OpenAI itself retreated to discovery in chat and checkout on the merchant's site. | [digitalsilk.com](https://www.digitalsilk.com/digital-trends/digital-trends-chatgpt-ecommerce/) | 2026-09-16 | E4, secondary reporting | Confirmed | Agency blog; Forrester figure is unlinked and unsourced on the page; also states checkout now happens on the retailer's own site. Original: Forrester (no URL given). |
| C062 | **The economics of being crawled.** Cloudflare reports that daily AI-agent requests grew over 1,700% year on year, that training crawlers' share of crawler requests rose from 22% in spring 2025 to 52% in June 2026, and that human traffic to heavily crawled categories fell by up to 40%. | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | 2026-09-30 | E2, independent measurement | Confirmed | Growth is "over the past year" on Cloudflare's network; training shares rely on crawlers' stated purpose; 40% is a ceiling for a few categories (Retail, Software, IT, Financial). |
| C063 | Thales and Imperva put bots at 53% of web traffic in 2025, with legitimate AI bots about 2% of sessions, split 85% crawlers to 15% user-directed fetches; the 53% is in the public press release, the breakdown is from the gated report and was not re-verified. | [imperva.com](https://www.imperva.com/company/press_releases/ai-driven-bot-attacks-surged-12-5x-according-to-thales-bad-bot-report/) | 2026-04-29 | E2, independent measurement | Confirmed with caveat | 53% confirmed; the ~2% legitimate AI bot share and 85/15 crawler-to-fetch split are not in the press release (may be in the full report). Original: Thales 2026 Bad Bot Report (Imperva). |
| C064 | Crawl-to-referral ratios differ by orders of magnitude between operators: Google near 5 to 1, OpenAI about 250 to 1, Anthropic about 1,900 to 1 in July 2026, by Cloudflare Radar's method, which excludes referrals from native apps and so overstates all three. | [ecorpit.com](https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/) | 2026-08-06 | E4, secondary reporting | Confirmed | Third-hand relay of Radar data (pulled 1 Aug 2026); native-app caveat quoted from Cloudflare refers specifically to Claude's app, generalised by the author. Original: Cloudflare Radar crawl_refer_ratio endpoint via TechnologyChecker "ChatGPT Statistics 2026"; methodology at https://blog.cloudflare.com/ai-search-crawl-refer-ratio-on-radar/. |
| C065 | **How agents actually read a site.** Browser agents commonly work from semantic page structure and accessibility information, for example the accessibility tree with element references that Browserbase's agent browser exposes to the model, while some also act from screenshots. | [docs.browserbase.com](https://docs.browserbase.com/integrations/agent-browser/introduction) | — | E3, vendor self-report | Confirmed with caveat | Supports accessibility-tree reading for one vendor's tool only; page does not describe screenshot-based visual interaction as a reading mode, so "many browser agents" is a generalisation. |

## Shift 3: Interfaces become generative, but inside a fixed catalog

| ID | Claim as stated in the study (v1.1) | Source | Published | Grade | v1.0 check | Limitation, caveat or original source |
| --- | --- | --- | --- | --- | --- | --- |
| C066 | Gemini dynamic view / visual layout | [research.google](https://research.google/blog/generative-ui-a-rich-custom-visual-interactive-user-experience-for-any-prompt/) | 2025-11-18 | E3, vendor self-report | Confirmed | Google Research blog; also says AI Mode generative UI is for Google AI Pro and Ultra subscribers in the US. |
| C067 | Experiment, US, paid tiers, 18+, not in mobile app; "a minute or more" per page | [support.google.com](https://support.google.com/gemini/answer/16741341) | — | E3, vendor self-report | Not re-checked (page unreadable on 2026-10-31) | Answer ID 16741341 redirects to the generic 'Use Gemini Apps' article (answer 13275745), which mentions none of the Dynamic view details (experiment, US, paid tiers, mobile app, minute). |
| C068 | A2UI v0.9 | [developers.googleblog.com](https://developers.googleblog.com/a2ui-v0-9-generative-ui/) | 2026-04-17 | E3, vendor self-report | Confirmed | Describes bring-your-own component catalog; built-in component set renamed 'Basic'. |
| C069 | json-render | [infoq.com](https://www.infoq.com/news/2026/03/vercel-json-render/) | 2026-03-26 | E4, secondary reporting | Confirmed | InfoQ reports Vercel's own figures; '13,000 stars since January 2026 launch' is as of article date. Original: Vercel json-render GitHub repository / Vercel announcement (not linked precisely on the page). |
| C070 | Open source, 13k+ stars by Mar 2026; the older AI SDK RSC streamUI path is marked experimental | [ai-sdk.dev](https://ai-sdk.dev/docs/ai-sdk-rsc/overview) | — | E3, vendor self-report | Confirmed | — |
| C071 | Apps in ChatGPT | [openai.com](https://openai.com/index/introducing-apps-in-chatgpt/) | 2025-10-06 | E3, vendor self-report | Confirmed | WebFetch and curl returned 403/JS wall; read via browser pane. Page says submissions and directory would open 'later this year'. |
| C072 | Directory open to submissions; production checkout enabled by OpenAI after sandbox testing and compliance attestation | [openai.com](https://openai.com/index/developers-can-now-submit-apps-to-chatgpt/) | 2025-12-17 | E3, vendor self-report | Confirmed | Read via browser pane (403 to fetchers). Page says in this early phase developers link out to their own sites to complete physical-goods transactions; it does not itself say checkout is for approved partners only. |
| C073 | Directory open to submissions; production checkout enabled by OpenAI after sandbox testing and compliance attestation | [developers.openai.com](https://developers.openai.com/commerce/guides/production) | — | E3, vendor self-report | Confirmed with caveat | Page shows production checkout access is gated by OpenAI (sandbox tests, possible AOC, OpenAI enables access) but never uses the phrase 'approved partners only'. |
| C074 | MCP Apps | [blog.modelcontextprotocol.io](https://blog.modelcontextprotocol.io/posts/2026-01-26-mcp-apps/) | 2026-01-26 | E1, standard | Confirmed | Lists Claude (web, desktop), ChatGPT (rolling out), Goose, VS Code Insiders as supporting hosts. |
| C075 | Live in Claude on all plans; supported by ChatGPT, Goose, VS Code Insiders | [claude.com](https://claude.com/blog/interactive-tools-in-claude) | 2026-01-26 | E3, vendor self-report | Confirmed | Page lists every plan rather than saying 'all plans'; the ChatGPT/Goose/VS Code Insiders support comes from the MCP blog (C073), not this page. |
| C076 | Thesys C1, now OpenUI | [openui.com](https://www.openui.com/docs) | — | E3, vendor self-report | Confirmed | The Thesys C1 documentation now redirects here; the product was renamed. |
| C077 | The closest, Agent Image's SiteAI for real-estate sites (Oct 2026), layers answers over a conventional crawlable site. | [inman.com](https://www.inman.com/2026/10/26/agent-image-siteai-agent-websites/) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | WebFetch 403; curl and browser pane both stopped at a Cloudflare 'Just a moment' bot-verification page after repeated waits. |
| C078 | Shopify Sidekick, a merchant-facing assistant, handled about 34 million conversations in fiscal Q2 2026 (Apr to Jun 2026), with daily sessions up 4.8x year on year, per the earnings call. | [fool.com](https://www.fool.com/earnings/call-transcripts/2026/08/12/shopify-shop-q2-2026-earnings-call-transcript/) | 2026-08-12 | E3, vendor self-report | Confirmed | Transcript gives call date as August 5, 2026 while the page is dated August 12; figures are Shopify management statements (Harley Finkelstein). Original: Shopify Q2 2026 earnings call, 2026-08-05 (transcript hosted by The Motley Fool). |
| C079 | Intercom claims a 76% average resolution rate for its Fin agent, under a billing definition that counts a conversation as resolved when the customer confirms the answer or leaves without asking for more; no independent measurement of Fin's resolution rate was found. | [intercom.com](https://www.intercom.com/blog/from-resolutions-to-outcomes-evolving-how-fin-delivers-value/) | 2026-03-12 | E3, vendor self-report | Confirmed | Chart caption refers to data 'as of June 2026', later than the March byline, suggesting the page was updated. |
| C080 | Intercom claims a 76% average resolution rate for its Fin agent, under a billing definition that counts a conversation as resolved when the customer confirms the answer or leaves without asking for more; no independent measurement of Fin's resolution rate was found. | [simpli.support](https://simpli.support/insights/intercom-fin-and-the-resolution-number) | 2026-10-02 | E4, secondary reporting | Confirmed with caveat | Supports the 'abandoned chats counted as resolved' caveat, but the page contains no independent tests and no 38% or 53% figures; all rates quoted are Intercom's own (25%, 51%, 66%, 76%). Original: Intercom blog and help-center pages on Fin 2, Fin 3 and Fin outcomes; Mostly Metrics newsletter. |
| C081 | A cross-vendor benchmark puts median AI self-service deflection near 22%. | [happysupport.ai](https://www.happysupport.ai/en/blog/support-ticket-deflection-rate-benchmarks) | 2026-06-06 | E4, estimate | Confirmed | Published by a support-AI vendor; the 22% is the vendor's own synthesis with no methodology or per-source numbers; page updated 2026-10-26. Original: Cross-source synthesis by HappySupport citing Zendesk, Intercom, Forrester, Aberdeen, Gartner, HubSpot, Salesforce (no per-source figures shown). |
| C082 | Nielsen Norman Group found that none of its participants discovered Amazon's Rufus chat unprompted, and that most AI features tested lacked discoverability. | [nngroup.com](https://www.nngroup.com/articles/discoverability-ai-amazon/) | 2025-03-21 | E1, primary research | Confirmed | Qualitative usability study; participant count not stated in the fetched summary. |
| C083 | Some participants in NN/g's Google AI Mode study did not realise follow-up questions were possible. | [nngroup.com](https://www.nngroup.com/articles/google-ai-mode/) | 2025-10-17 | E1, primary research | Confirmed with caveat | Source says 'at times' some participants did not realize, not that users in general did not; the claim slightly overgeneralises. |
| C084 | NN/g's articulation barrier argument, made first for image generators, is that many users cannot phrase what they want, and it proposes hybrid GUI plus prompt as the remedy. | [nngroup.com](https://www.nngroup.com/articles/ai-articulation-barrier/) | 2023-08-13 | E1, primary research | Confirmed with caveat | Article is specifically about image generators (Midjourney) and presents the hybrid GUI-plus-prompt approach as a proposal needing further evaluation, not a finding that it 'beats chat alone'. |
| C085 | Baymard's October 2026 study of 2,273 US shoppers found a clear split by task: 63% prefer AI chat for feature comparison and 59% for stock checks, but 66 to 69% want a human for damaged, late or billing problems, and 60% say a product image they know is AI-generated lowers purchase confidence. | [baymard.com](https://baymard.com/research-articles/ai-engagement-quantitative-ux-insights-2026) | 2026-10-27 | E1, primary research | Confirmed | Survey data collected June 2026, published October 2026; Baymard is a commercial UX research firm (survey-based, not behavioural). |
| C086 | NN/g's October 2026 survey of 521 practitioners scored AI time savings at 4.2 of 5 but sentiment at 3.57, with 69% of comments negative, mostly about unreliable output. | [nngroup.com](https://www.nngroup.com/articles/ai-in-ux-survey-26/) | 2026-10-23 | E1, primary research | Confirmed | Survey fielded Aug 24 to Sep 11, 2026; 69% figure is from 226 optional comments (43% of sample) and the authors note likely negativity skew. |
| C087 | Claimed personalisation lifts of 10 to 30% trace back to vendor and consultancy reports; no 2026 peer-reviewed trial of adaptive landing pages was found. | [shno.co](https://www.shno.co/marketing-statistics/ai-personalization-statistics) | — | E4, secondary reporting | Confirmed | Aggregator page with no date and secondhand citations; it cites no peer-reviewed trial, which supports the claim's framing that lifts trace to vendor and consultancy reports. Original: McKinsey, BCG, Salesforce, Forrester TEI (Salesforce-commissioned), Shopify, Envive and other vendor/consultancy reports. |
| C088 | **Cost and latency are design constraints, not afterthoughts.** A modelled retail generative-UI session of three turns and three tool calls costs about $0.08 per session, with tool calls near 40% of the bill; prompt caching of a 2.5k-token prefix cuts it by roughly 38% but has to be switched on deliberately. | [verygood.ventures](https://verygood.ventures/blog/gap-3-run-rate-economics/) | 2026-07-29 | E4, estimate | Confirmed | Explicitly a modelled estimate (retail running-shoe scenario, Claude Sonnet 5 pricing July 2026), not a measured bill; date from structured data only. |
| C089 | An April 2026 paper on generative UI accessibility recommends specifying layout policies rather than layouts, because full-page regeneration is too slow without caching or smaller models. | [arxiv.org](https://arxiv.org/abs/2604.25455) | 2026-04-28 | E1, primary research | Confirmed | Preprint (Ryskeldiev, cs.HC); latency sentence is in Section 6.2 of the full text, citing an ASSETS '25 study, not in the abstract. |

## Shift 4: Building a website becomes a prompt

| ID | Claim as stated in the study (v1.1) | Source | Published | Grade | v1.0 check | Limitation, caveat or original source |
| --- | --- | --- | --- | --- | --- | --- |
| C090 | Lovable | [techcrunch.com](https://techcrunch.com/2026/09/24/lovables-annualized-revenue-crosses-600m-as-vibe-coding-takes-off/) | 2026-09-24 | E4, secondary reporting | Confirmed | Figure is a founder statement reported by TechCrunch, not audited; page also gives $13.3B valuation after a $400M August round. Original: Remarks by Lovable co-founder Fabian Hedin at HumanX Amsterdam (no URL given). |
| C091 | Over $600M annualised revenue; 1M new projects a week at $500M in June | [techcrunch.com](https://techcrunch.com/2026/06/09/lovable-says-it-has-hit-500m-in-annualized-revenue-with-1-million-new-projects-a-week/) | 2026-06-09 | E4, secondary reporting | Confirmed | Both figures are company self-reported claims relayed by TechCrunch. Original: Lovable statement to TechCrunch; Lovable blog (lovable.dev/blog). |
| C092 | Replit | [sacra.com](https://sacra.com/c/replit/) | — | E4, estimate | Confirmed | Page also states $400M Series D at $9B (March 2026) and Agent 4 web launch March 2026; its growth-rate and funding-total figures are internally inconsistent. |
| C093 | About $525M annualised (Sacra estimate); Agent 4 launched with a $400M round at $9B | [aimagazine.com](https://aimagazine.com/news/replit-ai-agents-vibe-coding-and-a-us-9bn-valuation) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 Cloudflare challenge via WebFetch and curl; the $400M-at-$9B and Agent 4 facts are independently stated on the Sacra Replit page (C091). |
| C094 | Vercel v0 | [sacra.com](https://sacra.com/c/vercel/) | — | E4, estimate | Confirmed | Name-anchor link; page gives v0 user counts and Vercel-level revenue estimate but no v0-specific revenue figure. |
| C095 | Wix | [sec.gov](https://www.sec.gov/Archives/edgar/data/1576789/000162828026052108/secondquarter2026results.htm) | 2026-08-04 | E3, vendor self-report | Confirmed | Name-anchor link; filing confirms Base44 acquisition but gives no Base44 ARR, price, or acquisition date. |
| C096 | Base44, bought for $80M in Jun 2025, reported at $150M ARR by May 2026 | [getlatka.com](https://getlatka.com/blog/base44-revenue-acquired-wix) | 2026-08-31 | E4, secondary reporting | Confirmed | $80M is cash at close; page says earn-outs have since pushed total consideration past $150M. Published 2025-06-18, modified 2026-08-31. Original: Calcalist report dated 2026-05-25 (no URL given); Wix announcement of 2025-06-18. |
| C097 | Bolt.new | [altar.io](https://altar.io/lovable-vs-bolt-vs-v0-vs-replit-vs-base44/) | — | E4, secondary reporting | Confirmed | Name-anchor link; agency comparison blog with undated page and no sources cited for its revenue figures. |
| C098 | AI site building inside both Shopify (Sidekick) and Squarespace (Blueprint); Squarespace added an AI Visibility tool in Jul 2026 | [squarespace.com](https://www.squarespace.com/blog/product-updates-july-2026) | 2026-07-28 | E3, vendor self-report | Confirmed | — |
| C099 | **Quality and security are where the cracks show.** A researcher's 2025 assessment of 1,645 publicly discoverable Lovable applications identified 170 (10.3%) with database access-control misconfigurations involving Supabase row-level security, catalogued as CVE-2025-48757. | [bleek.dev](https://www.bleek.dev/cve-2025-48757) | — | E4, secondary reporting | Confirmed | Page is a write-up of Palmer's disclosure, dated only 'May 2025'; it does not discuss Lovable's own scanner. Original: Researcher Matt Palmer's May 2025 crawl of 1,645 Lovable projects (no URL given). |
| C100 | 2026 guides from security reviewers still list missing row-level security as the most common critical issue in Lovable apps. | [launchreadycode.com](https://launchreadycode.com/guides/is-lovable-safe) | 2026-08-16 | E3, vendor self-report | Confirmed with caveat | Guide (by a security-review vendor) does call RLS the top critical issue, but says nothing about Lovable's scanner checking only that policies exist; its own stats list missing headers (83%) above absent RLS (58%). |
| C101 | A December 2025 study, Vibe Coding in Practice, documents a trade-off between flow and debt: architectural inconsistency, security gaps and maintenance overhead. | [arxiv.org](https://arxiv.org/pdf/2512.11922) | 2025-12-11 | E1, primary research | Confirmed | Verified via the arXiv abstract page; paper names architectural inconsistencies, security vulnerabilities and maintenance overhead as consequences. |
| C102 | A 2026 paper on spec-driven development argues from the literature that prompt-built output is unreliable and hard to maintain. | [arxiv.org](https://arxiv.org/pdf/2607.16680) | 2026-07-18 | E1, primary research | Confirmed with caveat | Paper is about SDD and names a productivity-reliability paradox and technical debt, but abstract draws on a literature corpus, not practitioner surveys; 'practitioners finding' is not supported as stated. |
| C103 | **What it does to agencies and freelancers.** A GoodFirms survey found 98% of agencies using AI, with a third pricing AI-built sites at $500 to $1,500 and a quarter under $500, while complex builds held or raised prices. | [goodfirms.co](https://www.goodfirms.co/resources/website-construction-cost-survey) | — | E2, independent measurement | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 Cloudflare challenge via WebFetch and curl; 98% / $500-$1,500 / under-$500 figures could not be checked. |
| C104 | A Fast Company and AIGA survey of 1,273 designers and 150 hiring managers found only 14% of managers expecting freelance design needs to shrink, though two-thirds of designers are worried. | [fastcompany.com](https://www.fastcompany.com/91571502/freelance-design-pricing-transparency-project-report) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 via WebFetch and curl (775-byte block page); 1,273 / 150 / 14% / two-thirds figures could not be checked. |
| C105 | Upwork's 2026 in-demand skills report shows demand for AI-referencing skills up 109% year on year with full-stack and graphic design holding. | [upwork.com](https://www.upwork.com/resources/in-demand-jobs-and-skills) | — | E2, independent measurement | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 Cloudflare 'Attention Required' via WebFetch and curl; 109% figure could not be checked. |
| C106 | Agencies describe passing the efficiency on as faster and cheaper delivery of professional work. | [925studios.co](https://www.925studios.co/blog/ai-website-builder-vs-design-agency-2026) | 2026-03-20 | E3, vendor self-report | Not confirmed | Agency blog says efficiency yields faster AND cheaper delivery, contradicting 'rather than lower prices'; no mention of outcome-based pricing. Metadata date 2026-10-20 conflicts with visible 2026-03-20. |
| C107 | The infrastructure for that view is real: Microsoft's NLWeb makes every instance an MCP server over Schema.org and RSS, with a one-click Cloudflare deploy; WebMCP lets a page register typed tools for a browser agent; A2UI and MCP Apps supply the on-demand UI half. | [techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/the-future-of-ai-optimize-your-site-for-agents---its-cool-to-be-a-tool/4434189) | 2025-07-23 | E3, vendor self-report | Confirmed | Microsoft blog about its own project; Cloudflare one-click deploy is not on this page (covered by C107). |
| C108 | The infrastructure for that view is real: Microsoft's NLWeb makes every instance an MCP server over Schema.org and RSS, with a one-click Cloudflare deploy; WebMCP lets a page register typed tools for a browser agent; A2UI and MCP Apps supply the on-demand UI half. | [blog.cloudflare.com](https://blog.cloudflare.com/conversational-search-with-nlweb-and-autorag/) | 2025-08-28 | E3, vendor self-report | Confirmed | One-click refers to the AutoRAG 'NLWeb Website' quick-deploy option in the Cloudflare dashboard; page modified 2026-07-15. |
| C109 | The infrastructure for that view is real: Microsoft's NLWeb makes every instance an MCP server over Schema.org and RSS, with a one-click Cloudflare deploy; WebMCP lets a page register typed tools for a browser agent; A2UI and MCP Apps supply the on-demand UI half. | [venturebeat.com](https://venturebeat.com/infrastructure/google-chrome-ships-webmcp-in-early-preview-turning-every-website-into-a) | 2026-02-12 | E4, secondary reporting | Confirmed | Behind a Chrome flag; spec explicitly scopes out headless autonomous agents, human-in-the-loop only. Original: Google Chrome Early Preview Program announcement / W3C Web Machine Learning CG (no URL given). |
| C110 | The counter-arguments are also real: agentic browsers are still too small to move traffic, the agent protocols are described as very early even by their advocates, and every agent-first vendor still keeps a crawlable site for search. | [digiday.com](https://digiday.com/media/no-playbook-just-pressure-publishers-eye-the-rise-of-agentic-browsers/) | 2025-12-31 | E4, secondary reporting | Confirmed | Support is qualitative: anonymous executive characterisation, no measured traffic share; article also flags Google's agentic Chrome as the looming concern. |
| C111 | The counter-arguments are also real: agentic browsers are still too small to move traffic, the agent protocols are described as very early even by their advocates, and every agent-first vendor still keeps a crawlable site for search. | [thenewstack.io](https://thenewstack.io/the-agentic-web-how-ai-agents-are-shaping-the-webs-future/) | 2025-09-11 | E4, secondary reporting | Confirmed | The 'very early' wording is the journalist's (Richard MacManus), not an advocate's quote; article also notes Cloudflare and Shopify already ship these in products. |

## Shift 5: Trust, provenance and the rules

| ID | Claim as stated in the study (v1.1) | Source | Published | Grade | v1.0 check | Limitation, caveat or original source |
| --- | --- | --- | --- | --- | --- | --- |
| C112 | **Crawler control: signals without enforcement.** robots.txt is voluntary and, in the words of RFC 9309, not a form of access authorization. | [blog.cloudflare.com](https://blog.cloudflare.com/control-content-use-for-ai-training/) | 2025-07-01 | E4, secondary reporting | Confirmed | Cloudflare blog paraphrasing the RFC; also says robots.txt is an honor system. Page modified 2026-07-15. Original: RFC 9309 Robots Exclusion Protocol, https://www.rfc-editor.org/rfc/rfc9309. |
| C113 | **Crawler control: signals without enforcement.** robots.txt is voluntary and, in the words of RFC 9309, not a form of access authorization. | [rfc-editor.org](https://www.rfc-editor.org/rfc/rfc9309) | 2022-09 | E1, standard | Confirmed | — |
| C114 | The IETF AI Preferences group's attach and vocabulary drafts remain working-group documents in Aug and Sep 2026, and its charter puts technical enforcement out of scope. | [datatracker.ietf.org](https://datatracker.ietf.org/wg/aipref/documents/) | — | E1, standard | Confirmed with caveat | WG-document status in Aug/Sep 2026 confirmed; the documents page says nothing about the charter or enforcement being out of scope. |
| C115 | The IETF AI Preferences group's attach and vocabulary drafts remain working-group documents in Aug and Sep 2026, and its charter puts technical enforcement out of scope. | [datatracker.ietf.org](https://datatracker.ietf.org/wg/aipref/about/) | — | E1, standard | Confirmed | — |
| C116 | Really Simple Licensing, launched in Sep 2025 with Reddit, Yahoo, Medium and O'Reilly, now has over 50 collective partners but no major AI company has adopted it. | [rslstandard.org](https://rslstandard.org/press/rsl-standard) | 2025-09-10 | E3, vendor self-report | Confirmed | Launch date and the four named companies confirmed; the 50-partner count and AI-company adoption are not on this page (sourced separately). |
| C117 | Really Simple Licensing, launched in Sep 2025 with Reddit, Yahoo, Medium and O'Reilly, now has over 50 collective partners but no major AI company has adopted it. | [digiday.com](https://digiday.com/media/arena-group-buzzfeed-usa-today-co-vox-media-join-rsls-ai-content-licensing-efforts/) | 2025-11-26 | E4, secondary reporting | Confirmed | Count attributed to RSL co-founder Doug Leeds as of Nov 2025; non-adoption framed as AI companies not yet complying. |
| C118 | Cloudflare's Content Signals Policy ships three robots.txt signals on 3.8 million domains, framed as rights reservations under the EU Copyright Directive. | [blog.cloudflare.com](https://blog.cloudflare.com/content-signals-policy/) | 2025-09-24 | E3, vendor self-report | Confirmed | Managed robots.txt customers get search=yes, ai-train=no by default; the ai-input signal is not set by default. Original: Directive (EU) 2019/790 Article 4, https://eur-lex.europa.eu/eli/dir/2019/790/oj. |
| C119 | Google's Search Console opt-out for AI Overviews and AI Mode, announced 2 Jun 2026 as a UK test, is a control that touches those features directly, because they ride on Googlebot rather than the Google-Extended token. | [9to5google.com](https://9to5google.com/2026/06/02/google-ai-mode-overviews-opt-out/) | 2026-06-02 | E4, secondary reporting | Confirmed with caveat | Date and control confirmed, but page does not call it the first such control nor mention Googlebot/Google-Extended; rollout was a UK subset test. |
| C120 | Google's Search Console opt-out for AI Overviews and AI Mode, announced 2 Jun 2026 as a UK test, is a control that touches those features directly, because they ride on Googlebot rather than the Google-Extended token. | [developers.google.com](https://developers.google.com/search/docs/crawling-indexing/google-common-crawlers) | 2026-10-30 | E3, vendor self-report | Confirmed with caveat | Page says Googlebot covers all Search features and Google-Extended only governs Gemini training/grounding, but never names AI Overviews or AI Mode. |
| C121 | Cloudflare documented Perplexity using undeclared user agents and rotating networks to evade no-crawl directives at 3 to 6 million requests a day, and Perplexity's own docs say its user-triggered fetcher generally ignores robots.txt. | [blog.cloudflare.com](https://blog.cloudflare.com/perplexity-is-using-stealth-undeclared-crawlers-to-evade-website-no-crawl-directives/) | 2025-08-04 | E2, independent measurement | Confirmed | Cloudflare's own network observation; declared PerplexityBot separately at 20-25m daily requests. |
| C122 | Cloudflare documented Perplexity using undeclared user agents and rotating networks to evade no-crawl directives at 3 to 6 million requests a day, and Perplexity's own docs say its user-triggered fetcher generally ignores robots.txt. | [docs.perplexity.ai](https://docs.perplexity.ai/docs/resources/perplexity-crawlers.md) | — | E3, vendor self-report | Confirmed | — |
| C123 | OpenAI states that for ChatGPT-User robots.txt rules may not apply. | [developers.openai.com](https://developers.openai.com/api/docs/bots) | — | E3, vendor self-report | Confirmed | — |
| C124 | Anthropic honours robots.txt and Crawl-delay and publishes its IP ranges. | [support.claude.com](https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler) | 2026-04-07 | E3, vendor self-report | Confirmed | Crawl-delay is honoured "where appropriate", a qualifier the claim omits. |
| C125 | Cloudflare now offers a robots.txt violations log. | [developers.cloudflare.com](https://developers.cloudflare.com/changelog/post/2025-10-21-track-robots-txt/) | 2025-10-21 | E3, vendor self-report | Confirmed | Feature is a dashboard tab, not literally named a "violations log"; plan availability not stated. |
| C126 | **Bot identity: a draft becoming a gate.** The IETF Web Bot Auth group passed its April and August 2026 milestones without sending its drafts to the IESG, yet Cloudflare's signed agents class already verifies ChatGPT agent, Goose, Browserbase and Anchor by the draft, and Cloudflare has said Enterprise customers will be able to allow or block that class in security rules. | [datatracker.ietf.org](https://datatracker.ietf.org/wg/webbotauth/about/) | — | E1, standard | Confirmed with caveat | Page lists the Apr/Aug 2026 milestones as not done; "missed" is an inference from today's date, the page does not say so. |
| C127 | **Bot identity: a draft becoming a gate.** The IETF Web Bot Auth group passed its April and August 2026 milestones without sending its drafts to the IESG, yet Cloudflare's signed agents class already verifies ChatGPT agent, Goose, Browserbase and Anchor by the draft, and Cloudflare has said Enterprise customers will be able to allow or block that class in security rules. | [blog.cloudflare.com](https://blog.cloudflare.com/signed-agents/) | 2025-08-28 | E3, vendor self-report | Confirmed with caveat | Named agents confirmed; the page says Enterprise customers "will be able to" act on signed agents in security rules "soon", not a live one-rule control. Original: IETF draft-meunier-web-bot-auth-architecture, https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture. |
| C128 | **Provenance and labelling have deadlines.** EU AI Act Article 50 applies from 2 Aug 2026. | [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/faqs/signing-code-practice-transparency-ai-generated-content) | 2026-07-29 | E1, regulation | Confirmed | Commission FAQ; describes the 2 Dec 2026 grandfathering for Art. 50(2) as an "AI Omnibus" proposal "if adopted" at that date. |
| C129 | One transitional provision applies: providers of systems that generate synthetic audio, image, video or text and were placed on the market before 2 Aug 2026 have until 2 Dec 2026 to meet the Article 50(2) marking obligation; no other Article 50 duty is extended, under the Digital Omnibus. | [actuia.com](https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/) | 2026-10-06 | E4, secondary reporting | Confirmed | Page calls it the AI Omnibus (part of the Digital Omnibus package); it reports no delay for Art. 50(1),(3),(4) but does not enumerate that explicitly. Original: Regulation (EU) 2026/1744 (AI Omnibus), OJ 24 Jul 2026, in force 27 Jul 2026 (EUR-Lex). |
| C130 | China's labelling measures have been in force since 1 Sep 2025. | [loeb.com](https://www.loeb.com/en/insights/publications/2025/03/chinas-ai-labeling-measures-and-mandatory-national-standards-take-effect-september-1) | 2025-03 | E4, secondary reporting | Confirmed with caveat | Article predates entry into force and states the effective date prospectively; year 2025 is implied by context, not stated with the date. Original: CAC et al., Measures for Labeling of AI-Generated Synthetic Content (14 Mar 2025). |
| C131 | California's AI Transparency Act became operative on 2 Aug 2026; it obliges covered AI providers to offer detection tools and latent disclosures, and a separate law requires large online platforms to display provenance data from 1 Jan 2027. | [infobytes.orrick.com](https://infobytes.orrick.com/2025-10-17/california-delays-its-ai-transparency-act-and-passes-new-content-laws/) | 2025-10-17 | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 Cloudflare bot challenge via WebFetch and curl; no Wayback snapshot available. Date taken from URL only. |
| C132 | C2PA Content Credentials are preserved by Cloudflare Images and applied across Adobe tools, and Google announced SynthID and C2PA verification in Search and Chrome in May 2026, but metadata is still stripped on upload by many platforms. | [gadgets.beebom.com](https://gadgets.beebom.com/news/google-synthid-and-c2pa-verification-coming-to-search-and-chrome) | 2026-05-19 | E4, secondary reporting | Confirmed | No link to an official Google post; only the May 2026 Google announcement part of the sentence is covered by this page. |
| C133 | Google's spam policy penalises scaled content abuse however it is created, and now names manipulation of generative AI responses as spam. | [developers.google.com](https://developers.google.com/search/docs/essentials/spam-policies) | 2026-08-28 | E3, vendor self-report | Confirmed | AI Overviews / AI Mode are not named; the wording is "generative AI responses in Google Search". |
| C134 | **Accessibility is now law and interface at once.** The European Accessibility Act has applied since 28 Jun 2025 to e-commerce, banking and transport, with German fines up to 100,000 euros; microenterprises are largely exempt. | [gtlaw.com](https://www.gtlaw.com/en/insights/2025/7/european-accessibility-act-compliance-what-businesses-in-the-eu-market-need-to-know) | 2025-07-21 | E4, secondary reporting | Confirmed | Page frames 28 Jun 2025 as the transposition/application deadline; microenterprises (<10 staff, <=EUR 2m) exempt from "many" requirements, not all. Original: Directive (EU) 2019/882 (European Accessibility Act). |
| C135 | The US Department of Justice pushed ADA Title II web deadlines to 26 Apr 2027 and 2028; that rule binds state and local governments, not private businesses, whose exposure remains under Title III case law. | [federalregister.gov](https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web) | 2026-04-20 | E1, regulation | Confirmed | HTML page redirected to a bot-check; content read via the Federal Register API record. Interim final rule effective 20 Apr 2026; Title III point not covered by this page. |
| C136 | WCAG 3.0 remains a working draft with years to go, so WCAG 2.2 AA is the benchmark. | [w3.org](https://www.w3.org/TR/wcag-3.0/) | 2026-09-10 | E1, standard | Confirmed | — |
| C137 | Research agents consume accessibility-tree snapshots that rely on WCAG-compliant markup; the widely quoted claim that agent success drops from 78% to 42% on inaccessible sites is a vendor figure without a locatable paper and is not relied on here. | [arxiv.org](https://arxiv.org/html/2511.19477v1) | 2025-11-22 | E1, primary research | Confirmed | Single-author arXiv preprint (Aram Vardanyan), not peer reviewed; contains no 78%/42% figure, consistent with the claim's disclaimer. |
| C138 | **Privacy: the cookie layer stays, consent fatigue grows.** Google retired most Privacy Sandbox APIs in Oct 2025 and Chrome keeps third-party cookies. | [privacysandbox.google.com](https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies) | 2025-10-17 | E3, vendor self-report | Confirmed | Ten technologies retired; CHIPS, FedCM and Private State Tokens retained, so "most" is accurate; no phase-out dates given. |
| C139 | Only 5.4% of users configure cookie settings; the EU Digital Omnibus proposed a six-month no-re-ask rule, dropped from the Council's June 2026 compromise text and still in negotiation. | [fr.themedialeader.com](https://fr.themedialeader.com/seuls-54-des-internautes-parametrent-leurs-cookies-selon-une-etude) | — | E4, secondary reporting | Not re-checked (HTTP 403 on 2026-10-31) | HTTP 403 via WebFetch and curl; 5.4% figure and underlying study could not be verified. |
| C140 | Only 5.4% of users configure cookie settings; the EU Digital Omnibus proposed a six-month no-re-ask rule, dropped from the Council's June 2026 compromise text and still in negotiation. | [usercentrics.com](https://usercentrics.com/knowledge-hub/eu-digital-omnibus-package/) | — | E4, secondary reporting | Confirmed with caveat | Same page says the Council's June 2026 compromise text removed the six-month moratorium article; whether it returns is unsettled, so "proposes" is dated. Original: European Commission Digital Omnibus proposal, 19 Nov 2025. |
| C141 | India's Digital Personal Data Protection Rules were notified on 14 Nov 2025, per MeitY's rules and enforcement timeline; the accompanying commencement notification, a Gazette instrument dated 13 Nov 2025, brings the Act's provisions into force in phases from the publication date: specified Data Protection Board provisions took effect immediately; the consent-manager registration provisions take effect on 14 Nov 2026; and the core data-protection obligations, including notice, consent, breach and data-principal rights provisions, take effect on 14 May 2027. | [meity.gov.in](https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025) | — | E1, regulation | Not re-checked (page unreadable on 2026-10-31) | WebFetch returned 403; curl returned an empty Next.js shell and the browser pane rendered a blank page titled 'Digital Personal Data Protection Rules 2025'. |
| C142 | India's Digital Personal Data Protection Rules were notified on 14 Nov 2025, per MeitY's rules and enforcement timeline; the accompanying commencement notification, a Gazette instrument dated 13 Nov 2025, brings the Act's provisions into force in phases from the publication date: specified Data Protection Board provisions took effect immediately; the consent-manager registration provisions take effect on 14 Nov 2026; and the core data-protection obligations, including notice, consent, breach and data-principal rights provisions, take effect on 14 May 2027. | [meity.gov.in](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf) | 2025-11-13 | E1, regulation | Confirmed with caveat | This 2-page instrument is the commencement notification for sections of the DPDP Act (immediate / 1 year / 18 months), not the text of the DPDP Rules themselves. |
| C143 | **Security: your page is an attack surface for someone else's agent.** Brave showed hidden Reddit text making Comet read a user's email and leak a one-time code; OpenAI's Lockdown Mode concedes it cannot guarantee against exfiltration; EchoLeak was a zero-click injection against Microsoft 365 Copilot. | [brave.com](https://brave.com/blog/comet-prompt-injection/) | 2025-08-20 | E1, primary research | Confirmed | Security research published by Brave, a competing browser vendor, about Perplexity's Comet; the email read was the user's Perplexity account email plus Gmail OTP. |
| C144 | **Security: your page is an attack surface for someone else's agent.** Brave showed hidden Reddit text making Comet read a user's email and leak a one-time code; OpenAI's Lockdown Mode concedes it cannot guarantee against exfiltration; EchoLeak was a zero-click injection against Microsoft 365 Copilot. | [itbrief.com.au](https://itbrief.com.au/story/openai-unveils-lockdown-mode-to-counter-prompt-attacks) | 2026-02-16 | E4, secondary reporting | Confirmed | Lockdown Mode is a ChatGPT (Enterprise/Edu/etc.) setting; "concedes it cannot guarantee" is a fair paraphrase; no OpenAI link on page. |
| C145 | **Security: your page is an attack surface for someone else's agent.** Brave showed hidden Reddit text making Comet read a user's email and leak a one-time code; OpenAI's Lockdown Mode concedes it cannot guarantee against exfiltration; EchoLeak was a zero-click injection against Microsoft 365 Copilot. | [vectra.ai](https://www.vectra.ai/topics/prompt-injection) | 2026-05-15 | E4, secondary reporting | Confirmed | Vendor explainer page; does not name the discoverer (Aim Security) or a disclosure date. |
| C146 | The OWASP Top 10 for LLM applications lists prompt injection, excessive agency and improper output handling. | [genai.owasp.org](https://genai.owasp.org/llm-top-10/) | — | E1, standard | Confirmed | Current version is the 2025 edition. |

## Interpretations and hypotheses (E5)

These are the study's own readings. None is a measured fact; each names the evidence it rests on and the observation that would overturn it.

| ID | Statement in the study | Where it appears | Kind | Rests on | What would change it |
| --- | --- | --- | --- | --- | --- |
| I01 | AI Overviews explain roughly half of the click decline; the rest is Google keeping users on Google. | Open questions and bets, row 1 | Research interpretation | Ahrefs control group (C-series, Shift 1), Seer Interactive CTR on queries without Overviews, Pew click rates; Google disputes all three methods. | A Google-published or independently instrumented split of clicks lost to Overviews versus other interface changes. |
| I02 | AI-referred traffic converts better for now, partly a novelty and intent-mix effect. | Open questions and bets, row 2 | Research interpretation | Similarweb 7% vs 5% and Adobe's +42% after −38%; different baselines and windows. | Two consecutive measurement periods in which AI-referred conversion matches or trails search on a like-for-like basis. |
| I03 | Citations are decoupling from rankings, but the measured series is unstable across model changes. | Open questions and bets, row 3 | Research interpretation | Ahrefs 76% to 38% overlap, BrightEdge about 17%, earlier claims of 93%. | A stable overlap series across at least two model releases, in either direction. |
| I04 | Catalog composition is the production ceiling for generative UI for at least two years; free-form page generation stays an experiment. | Open questions and bets, row 4; Shift 3; Executive summary | Strategic hypothesis | Every shipping implementation reviewed (A2UI, json-render, Apps in ChatGPT, MCP Apps, Thesys) composes from developer-defined components; Google's free-form experiment runs at minute-scale latency. | A free-form generative interface in commercial production with sub-second latency and measured task completion at parity with a fixed interface. |
| I05 | Discover in AI, buy on site is the equilibrium for agentic commerce through 2027. | Open questions and bets, row 5 | Strategic hypothesis | Each payment network has a protocol; about 30 live Shopify stores is the only hard adoption number; OpenAI moved product discovery to buy-on-site. | Published merchant volume through in-chat checkout above a few percent of any major merchant's orders. |
| I06 | WebMCP stays a Chrome and Edge in-page feature for the foreseeable future. | Open questions and bets, row 6 | Strategic hypothesis | Chrome and Edge origin trials; no Firefox or Safari position; headless agents are a stated non-goal. | A Firefox or WebKit implementation intent, or a headless-agent profile in the specification. |
| I07 | Licensing of content for AI settles through litigation, bilateral deals and CDN tolls rather than through voluntary signals. | Open questions and bets, row 7 | Strategic hypothesis | Over 50 publishers in the RSL Collective and no AI company honouring it; IETF AI Preferences drafts without enforcement; Cloudflare pay-per-crawl. | A major AI company publicly committing to honour RSL or AI Preferences signals in production crawling. |
| I08 | Web Bot Auth becomes a gate enforced by CDNs before the IETF finishes it. | Open questions and bets, row 8 | Strategic hypothesis | Cloudflare, Google and AWS already sign or verify; the working group missed its milestones. | CDNs dropping signed-agent allowlisting, or the IETF publishing an incompatible final standard that deployments adopt instead. |
| I09 | Content provenance survives patchily; enforcement reaches model providers and large platforms before ordinary websites. | Open questions and bets, row 9 | Strategic hypothesis | C2PA preserved by Cloudflare and Adobe, stripped by most social platforms; EU AI Act Article 50 enforcement untested. | A regulator's first Article 50 enforcement action naming a website operator rather than a model or platform provider. |
| I10 | Prompt-built sites have commoditised the template, copy and layout of a website; the defensible work has moved to the data model, integrations, security review and maintenance. | Shift 4, opening paragraph | Editorial estimate | Builder revenue and adoption figures (Shift 4), the GoodFirms and Fast Company price surveys, the Lovable misconfiguration assessment. v1.0 stated this as 'roughly the first 80%'; v1.1 removes the percentage because no measurement supports a number. | A measured breakdown of effort or price per layer across a sample of real projects. |
| I11 | Accessibility is the investment most likely to serve both the law and the agents. | Executive summary; Shift 5 | Research interpretation | Browser agents documented as reading the accessibility tree (Shift 2); EAA and ADA Title II deadlines (Shift 5); WCAG compliance does not guarantee agent success. | Agent task-completion measurements showing no advantage for WCAG-conformant pages over non-conformant ones (prototype 1 is the first such measurement). |
| I12 | Sysbot's position should be AI-ready website infrastructure, not another AI website builder. | Executive summary; Strategic position | Strategic hypothesis | Price collapse of simple sites (Shift 4), protocols ahead of commercial adoption (Shift 2), four candidate opportunities none of which is commercially validated. | The prototype programme's commercial validation step: no measured customer willingness to pay for any of the four candidates. |

## Claims corrected or qualified in v1.1

Each row below was checked against its source on 2026-10-31 and found to differ in number, date, scope or wording, or not to be stated on the page. The v1.1 text was changed as the last column records; the claim column above already shows the corrected wording.

| ID | Check | What the source says | Change made in v1.1 |
| --- | --- | --- | --- |
| C009 | Confirmed with caveat | Publishers with 1,000-10,000 daily page views "experiencing the most precipitous traffic declines" WebFetch and curl returned 403; browser showed only the intro, 60%/22% figures sit in a chart not in readable text; SEJ corroborates the 60% as from Axios. | No change. The figures sit in a chart on a page that blocks automated reading; Search Engine Journal attributes the same figures to it. |
| C029 | Confirmed with caveat | Seven trade groups (five European, two Canadian) sought legislation giving "meaningful tools to authorize, monitor, and enforce" content use Statement was addressed to EU-Canada Summit leaders asking for a declaration and legislation, not to regulators for CMA-style controls; 'similar controls' is the study's framing. | Reworded: the groups asked EU and Canadian leaders for legislation, not regulators for CMA-style controls. |
| C032 | Confirmed with caveat | "ChatGPT Atlas has been retired and no longer receives updates." Article now titled "ChatGPT Atlas retirement" (updated ~8 days ago); confirms retirement but no longer mentions desktop app, built-in or cloud browser. | Reworded to what the revised help article now says and noted that the page was shortened after the study was written. |
| C038 | Confirmed with caveat | "now generally available on every paid Claude plan"; "0.3% attack success rate against Fable 5" GA date, paid plans, per-action classifier and 0-0.3% confirmed; the 23.6% pilot figure is not on this page (it cites 17.6%/16.7% for Opus 4.5). | The 23.6% figure now links to Anthropic's 2025 pilot article; this page supports the rest of the sentence. |
| C045 | Confirmed with caveat | "An Origin Trial is live in Chrome 149"; "An Origin Trial is live in Edge 150" Chrome 149 and Edge 150 confirmed; for Firefox and Safari the page only links Mozilla/WebKit standards-position issues with no stated position, so "undecided" is an inference. | Reworded: Firefox and Safari have standards-position requests open and no stated position. |
| C046 | Confirmed with caveat | "primarily designed for local browser workflows with a human in the loop" Human-in-the-loop and declarative form annotation confirmed; the identifier document.modelContext is not on this page (it sits on the linked Imperative API page); last updated 2026-10-07. | Dropped the identifier document.modelContext, which sits on a sub-page; the cell now describes the imperative and declarative APIs. |
| C054 | Confirmed with caveat | "Join the waitlist" via Merchant Center contact form; embedded checkout "for specific, approved merchants" Waitlist confirmed; the page states no US-only or regional restriction; no publication date (URL path contains 2026-04-08). | Removed 'US'; the page states a waitlist with no regional restriction. |
| C063 | Confirmed with caveat | "In 2025, bots made up more than 53% of all web traffic, up from 51%" 53% confirmed; the ~2% legitimate AI bot share and 85/15 crawler-to-fetch split are not in the press release (may be in the full report). | Marked the 2% and 85/15 breakdown as figures from the gated report that were not re-verified; the 53% is in the press release. |
| C065 | Confirmed with caveat | "Accessibility tree snapshots with element refs (@e1, @e2) optimized for LLM consumption" Supports accessibility-tree reading for one vendor's tool only; page does not describe screenshot-based visual interaction as a reading mode, so "many browser agents" is a generalisation. | Reworded to one vendor's documented behaviour rather than a claim about many browser agents. |
| C073 | Confirmed with caveat | "OpenAI may require your attestation of compliance (AOC) before enabling production access" Page shows production checkout access is gated by OpenAI (sandbox tests, possible AOC, OpenAI enables access) but never uses the phrase 'approved partners only'. | Reworded to the gating the page describes: sandbox testing and compliance attestation before production access. |
| C080 | Confirmed with caveat | "A resolution bills when the customer either confirms the answer helped OR simply exits without asking for more." Supports the 'abandoned chats counted as resolved' caveat, but the page contains no independent tests and no 38% or 53% figures; all rates quoted are Intercom's own (25%, 51%, 66%, 76%). | Removed the unsupported '38 to 53%' from independent tests; kept the billing-definition caveat the page supports; stated that no independent measurement was found. |
| C083 | Confirmed with caveat | "at times, participants did not realize they could ask followup questions in the chat" Source says 'at times' some participants did not realize, not that users in general did not; the claim slightly overgeneralises. | Reworded to 'some participants', as the study reports. |
| C084 | Confirmed with caveat | users "lack the vocabulary to write the required prompt"; solution combines prompt with GUI elements Article is specifically about image generators (Midjourney) and presents the hybrid GUI-plus-prompt approach as a proposal needing further evaluation, not a finding that it 'beats chat alone'. | Reworded: the article concerns image generators and proposes the hybrid approach rather than demonstrating it beats chat. |
| C100 | Confirmed with caveat | RLS "remains the single most common critical issue we see in Lovable apps" Guide (by a security-review vendor) does call RLS the top critical issue, but says nothing about Lovable's scanner checking only that policies exist; its own stats list missing headers (83%) above absent RLS (58%). | Removed the unsupported statement about Lovable's own scanner; kept what the guide says about row-level security. |
| C102 | Confirmed with caveat | "Specification-Driven Development as the Foundation of AI-Native Enterprise Software Engineering" (July 2026) Paper is about SDD and names a productivity-reliability paradox and technical debt, but abstract draws on a literature corpus, not practitioner surveys; 'practitioners finding' is not supported as stated. | Reworded: the paper argues from the literature; it does not report practitioner findings. |
| C106 | Not confirmed | "professional projects can now be delivered faster and at lower cost" Agency blog says efficiency yields faster AND cheaper delivery, contradicting 'rather than lower prices'; no mention of outcome-based pricing. Metadata date 2026-10-20 conflicts with visible 2026-03-20. | Reworded to what the page says, faster and cheaper delivery; 'outcome-based pricing' was removed. |
| C114 | Confirmed with caveat | attach-05 (2026-08-18) and vocab-08 (2026-09-13) both listed as "WG Document" WG-document status in Aug/Sep 2026 confirmed; the documents page says nothing about the charter or enforcement being out of scope. | The charter statement now links to the charter page; this page supports the working-group document status. |
| C119 | Confirmed with caveat | "new opt-out toggle in the Search Console tool" for AI Mode and AI Overviews, 2 Jun 2026 Date and control confirmed, but page does not call it the first such control nor mention Googlebot/Google-Extended; rollout was a UK subset test. | Removed 'first control'; noted the UK test scope. |
| C120 | Confirmed with caveat | "Google-Extended does not impact a site's inclusion in Google Search"; no separate user agent Page says Googlebot covers all Search features and Google-Extended only governs Gemini training/grounding, but never names AI Overviews or AI Mode. | Sentence reworded; this page supports the Googlebot versus Google-Extended distinction without naming AI Overviews. |
| C126 | Confirmed with caveat | milestones dated 2026-04-30 (two specs to IESG) and 2026-08-31 (BCP to IESG), none marked done Page lists the Apr/Aug 2026 milestones as not done; "missed" is an inference from today's date, the page does not say so. | Reworded: the milestones passed without the drafts reaching the IESG, which is what the page shows. |
| C127 | Confirmed with caveat | first cohort of signed agents: ChatGPT agent, Goose, Browserbase, Anchor Browser; via Web Bot Auth draft Named agents confirmed; the page says Enterprise customers "will be able to" act on signed agents in security rules "soon", not a live one-rule control. | Reworded: Cloudflare said Enterprise customers will be able to act on the class in security rules; not described as a live one-rule control. |
| C130 | Confirmed with caveat | Measures for Labeling of AI-Generated Synthetic Content, issued 14 Mar 2025, "take effect on September 1" Article predates entry into force and states the effective date prospectively; year 2025 is implied by context, not stated with the date. | No change. The article states the 1 September effective date prospectively; the year follows from its March 2025 date. |
| C140 | Confirmed with caveat | proposal: organisations "cannot re-request consent for the same purpose for six months"; Data Omnibus "remains in negotiation" Same page says the Council's June 2026 compromise text removed the six-month moratorium article; whether it returns is unsettled, so "proposes" is dated. | Added that the Council's June 2026 compromise text dropped the six-month rule. |
| C142 | Confirmed with caveat | Gazette No. 757, G.S.R. 843(E), "New Delhi, the 13th November, 2025"; digitally signed 2025-11-14 This 2-page instrument is the commencement notification for sections of the DPDP Act (immediate / 1 year / 18 months), not the text of the DPDP Rules themselves. | Identified the instrument as the commencement notification for the Act's provisions, not the Rules text. |

Sources changed or added in v1.1 that were not themselves flagged:

| ID | Source | Change |
| --- | --- | --- |
| C011 | [gs.statcounter.com](https://gs.statcounter.com/ai-chatbot-market-share) | Replaced an AI-generated secondary page with Statcounter's own series; the figure is now about 80% for September 2026. |
| C015 | [ahrefs.com](https://ahrefs.com/blog/ai-overview-citations-top-10/) | Linked Ahrefs' original study instead of press coverage; the period is now July 2025 to March 2026. |
| C018 | [ahrefs.com](https://ahrefs.com/blog/do-ai-assistants-prefer-to-cite-fresh-content) | Removed the unsourced statement that 44% of ChatGPT citations come from the first 30% of a page. |
| C019 | [seranking.com](https://seranking.com/blog/llms-txt/) | Linked SE Ranking's original study instead of press coverage. |
| C033 | [help.openai.com](https://help.openai.com/en/articles/11752874-chatgpt-agent) | Reworded to what the article now says: ChatGPT agent is no longer available and users are pointed to the cloud browser. |
| C034 | [gigazine.net](https://gigazine.net/gsc_news/en/20260507-google-shuts-down-project-mariner/) | Reworded: Mariner's technology was folded into other Google products; auto browse is described as the consumer browsing agent, not as Mariner's successor. |
| C036 | [blogs.windows.com](https://blogs.windows.com/msedgedev/2026/05/13/new-updates-to-edge-across-desktop-and-mobile/) | The retirement is now linked to the page that states it; Browse with Copilot's US and Microsoft 365 Premium scope added. |
| C037 | [blogs.windows.com](https://blogs.windows.com/msedgedev/2026/05/20/new-in-edge-for-business-ai-for-work-safe-from-day-one/) | Named the business feature as the page does and marked it a limited preview. |
| C039 | [claude.com](https://claude.com/resources/articles/claude-for-chrome) | Added as the source of the 23.6% pilot figure, which the general-availability article does not state. |
| C049 | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | The Pay Per Use cell now cites Cloudflare's 30 September 2026 post, which describes the closed beta; Pay Per Crawl was removed from the cell because the cited post did not mention it. |
| C058 | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | The Pay Per Use cell now cites Cloudflare's 30 September 2026 post, which describes the closed beta; Pay Per Crawl was removed from the cell because the cited post did not mention it. |
| C062 | [blog.cloudflare.com](https://blog.cloudflare.com/agentic-web) | The Pay Per Use cell now cites Cloudflare's 30 September 2026 post, which describes the closed beta; Pay Per Crawl was removed from the cell because the cited post did not mention it. |
| C070 | [ai-sdk.dev](https://ai-sdk.dev/docs/ai-sdk-rsc/overview) | Linked the AI SDK RSC page that states the experimental status; the version number was dropped. |
| C076 | [openui.com](https://www.openui.com/docs) | Name and link updated; the Thesys C1 docs now redirect to OpenUI. |
| C098 | [squarespace.com](https://www.squarespace.com/blog/product-updates-july-2026) | Replaced a secondary page that did not state the claim with Squarespace's July 2026 product update, which announces AI Visibility; the unsourced 'every plan' wording was removed. |
| C113 | [rfc-editor.org](https://www.rfc-editor.org/rfc/rfc9309) | Added as the primary source for 'not a form of access authorization'. |
| C115 | [datatracker.ietf.org](https://datatracker.ietf.org/wg/aipref/about/) | Added the working-group charter as the source for enforcement being out of scope. |

## Secondary sources that name an original

Where a press, blog or vendor roundup is cited and names the original dataset, announcement or legal text, the original is recorded here. v1.1 links the original wherever it is public and states the figure; the rest remain secondary because the original is gated, unlinked or does not state the figure as reported.

| ID | Cited page | Original source named on the page |
| --- | --- | --- |
| C008 | [searchenginejournal.com](https://www.searchenginejournal.com/google-search-decline-publishers-chartbeat/590681/) | Chartbeat 2026 Publisher Playbook, https://lp.chartbeat.com/2026-publisher-playbook-chartbeat |
| C009 | [axios.com](https://www.axios.com/2026/03/17/chartbeat-search-traffic-ai-chatbots) | Chartbeat data provided exclusively to Axios (no URL given) |
| C010 | [searchenginejournal.com](https://www.searchenginejournal.com/google-search-decline-publishers-chartbeat/590681/) | Chartbeat 2026 Publisher Playbook, https://lp.chartbeat.com/2026-publisher-playbook-chartbeat |
| C013 | [peec.ai](https://peec.ai/ai-search-geo-statistics) | Adobe Analytics, April 2026, via https://finance.yahoo.com/sectors/technology/articles/ai-traffic-us-retailers-jumps-160141756.html |
| C020 | [projectllmstxt.com](https://projectllmstxt.com/blog/llms-txt-adoption-2026) | Ahrefs server-log study of ~137K sites, 'We Analyzed 137K Sites: 97% of llms.txt Files Never Get Read' (June 2026, no URL given) |
| C021 | [seroundtable.com](https://www.seroundtable.com/google-ai-llms-txt-39607.html) | John Mueller Bluesky post, 17 June 2025 (URL not captured) |
| C023 | [ppc.land](https://ppc.land/cloudflare-stops-charging-ai-per-crawl-and-starts-paying-per-answer/) | Cloudflare Blog post by Matthew Conroy, 1 July 2026 (URL not linked in article) |
| C025 | [engadget.com](https://www.engadget.com/ai/perplexity-has-cooked-up-a-new-way-to-pay-publishers-for-their-content-204255019.html) | Perplexity Comet Plus announcement; WSJ report of a $42.5M revenue pool (no URL given) |
| C029 | [ppc.land](https://ppc.land/seven-publisher-groups-ask-eu-canada-to-act-on-ai-search-summaries) | Coalition statement distributed via Business Wire, 26 October 2026 (no URL given) |
| C030 | [bccinteractive.com](https://www.bccinteractive.com/blog/local-ai-search-statistics/) | Small Business Expo survey, Sept 2026, 3,608 owners (33.9%, 14.8%); Bluehost State of Small Business AI Confidence 2026, May 2026, 350 owners (13%) (no URLs given) |
| C031 | [community.openai.com](https://community.openai.com/t/atlas-is-scheduled-to-stop-working-on-august-9-2026/1389473) | OpenAI Help Center, "Evolving Atlas into ChatGPT for browser-based agentic work", https://help.openai.com/en/articles/20001371 |
| C034 | [gigazine.net](https://gigazine.net/gsc_news/en/20260507-google-shuts-down-project-mariner/) | Google Project Mariner landing page notice, https://labs.google.com/mariner/landing; The Verge, https://www.theverge.com/tech/925559/google-project-mariner-shut-down |
| C040 | [ppc.land](https://ppc.land/perplexity-releases-comet-browser-globally-at-no-cost-after-three-month-limited-rollout/) | Perplexity announcement of 2 Oct 2025 (not linked; only perplexity.ai/comet) |
| C047 | [presenc.ai](https://presenc.ai/research/nlweb-adoption-2026) | Microsoft NLWeb announcement, https://news.microsoft.com/source/features/company-news/introducing-nlweb-bringing-conversational-interfaces-directly-to-the-web/; NLWeb GitHub, https://github.com/nlweb-ai/NLWeb |
| C061 | [digitalsilk.com](https://www.digitalsilk.com/digital-trends/digital-trends-chatgpt-ecommerce/) | Forrester (no URL given) |
| C064 | [ecorpit.com](https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/) | Cloudflare Radar crawl_refer_ratio endpoint via TechnologyChecker "ChatGPT Statistics 2026"; methodology at https://blog.cloudflare.com/ai-search-crawl-refer-ratio-on-radar/ |
| C069 | [infoq.com](https://www.infoq.com/news/2026/03/vercel-json-render/) | Vercel json-render GitHub repository / Vercel announcement (not linked precisely on the page) |
| C080 | [simpli.support](https://simpli.support/insights/intercom-fin-and-the-resolution-number) | Intercom blog and help-center pages on Fin 2, Fin 3 and Fin outcomes; Mostly Metrics newsletter |
| C081 | [happysupport.ai](https://www.happysupport.ai/en/blog/support-ticket-deflection-rate-benchmarks) | Cross-source synthesis by HappySupport citing Zendesk, Intercom, Forrester, Aberdeen, Gartner, HubSpot, Salesforce (no per-source figures shown) |
| C087 | [shno.co](https://www.shno.co/marketing-statistics/ai-personalization-statistics) | McKinsey, BCG, Salesforce, Forrester TEI (Salesforce-commissioned), Shopify, Envive and other vendor/consultancy reports |
| C090 | [techcrunch.com](https://techcrunch.com/2026/09/24/lovables-annualized-revenue-crosses-600m-as-vibe-coding-takes-off/) | Remarks by Lovable co-founder Fabian Hedin at HumanX Amsterdam (no URL given) |
| C091 | [techcrunch.com](https://techcrunch.com/2026/06/09/lovable-says-it-has-hit-500m-in-annualized-revenue-with-1-million-new-projects-a-week/) | Lovable statement to TechCrunch; Lovable blog (lovable.dev/blog) |
| C096 | [getlatka.com](https://getlatka.com/blog/base44-revenue-acquired-wix) | Calcalist report dated 2026-05-25 (no URL given); Wix announcement of 2025-06-18 |
| C099 | [bleek.dev](https://www.bleek.dev/cve-2025-48757) | Researcher Matt Palmer's May 2025 crawl of 1,645 Lovable projects (no URL given) |
| C109 | [venturebeat.com](https://venturebeat.com/infrastructure/google-chrome-ships-webmcp-in-early-preview-turning-every-website-into-a) | Google Chrome Early Preview Program announcement / W3C Web Machine Learning CG (no URL given) |
| C112 | [blog.cloudflare.com](https://blog.cloudflare.com/control-content-use-for-ai-training/) | RFC 9309 Robots Exclusion Protocol, https://www.rfc-editor.org/rfc/rfc9309 |
| C129 | [actuia.com](https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/) | Regulation (EU) 2026/1744 (AI Omnibus), OJ 24 Jul 2026, in force 27 Jul 2026 (EUR-Lex) |
| C130 | [loeb.com](https://www.loeb.com/en/insights/publications/2025/03/chinas-ai-labeling-measures-and-mandatory-national-standards-take-effect-september-1) | CAC et al., Measures for Labeling of AI-Generated Synthetic Content (14 Mar 2025) |
| C134 | [gtlaw.com](https://www.gtlaw.com/en/insights/2025/7/european-accessibility-act-compliance-what-businesses-in-the-eu-market-need-to-know) | Directive (EU) 2019/882 (European Accessibility Act) |
| C140 | [usercentrics.com](https://usercentrics.com/knowledge-hub/eu-digital-omnibus-package/) | European Commission Digital Omnibus proposal, 19 Nov 2025 |

## Sources not re-checked

These pages refused automated reading on 2026-10-31, through bot protection or a paywall, or did not respond. The claim stands on the reading made when the study was written; a person can open each link to confirm it.

| ID | Source | HTTP status on the check date |
| --- | --- | --- |
| C024 | [searchengineland.com](https://searchengineland.com/guide/ai-company-publisher-partnerships) | 403 |
| C026 | [searchengineland.com](https://searchengineland.com/penske-media-lawsuit-over-google-ai-overviews-dismissed-493022) | 403 |
| C067 | [support.google.com](https://support.google.com/gemini/answer/16741341) | 200 |
| C077 | [inman.com](https://www.inman.com/2026/10/26/agent-image-siteai-agent-websites/) | 403 |
| C093 | [aimagazine.com](https://aimagazine.com/news/replit-ai-agents-vibe-coding-and-a-us-9bn-valuation) | 403 |
| C103 | [goodfirms.co](https://www.goodfirms.co/resources/website-construction-cost-survey) | 403 |
| C104 | [fastcompany.com](https://www.fastcompany.com/91571502/freelance-design-pricing-transparency-project-report) | 403 |
| C105 | [upwork.com](https://www.upwork.com/resources/in-demand-jobs-and-skills) | 403 |
| C131 | [infobytes.orrick.com](https://infobytes.orrick.com/2025-10-17/california-delays-its-ai-transparency-act-and-passes-new-content-laws/) | 403 |
| C139 | [fr.themedialeader.com](https://fr.themedialeader.com/seuls-54-des-internautes-parametrent-leurs-cookies-selon-une-etude) | 403 |
| C141 | [meity.gov.in](https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025) | 200 |

## How this register was produced

The process is mechanical where it can be and recorded where it cannot, so that it can be repeated.

1. **Extraction.** A script reads the study's Markdown and emits one row per inline link in the body, with the sentence or table cell that contains it and the section it sits in. No link is skipped or added by hand.
2. **Reachability.** Every distinct URL is requested with a browser user agent, following redirects, and the HTTP status is recorded.
3. **Source check.** Each page that could be read is opened and read for the figure, date or fact the study attributes to it. The reader records what the page says, its publication date, the source kind, and the original source when the page is secondary. Automated reading did most of this work; the maintainer reviewed every row marked as differing or not found before it was published, and corrected the study where the source, not the study, was right.
4. **Grading.** The source kind maps to a grade: standards, regulations and primary research are E1; independent measurement is E2; vendor self-reports are E3; secondary reporting and estimates are E4. The grade attaches to the source, so one page gives the same grade to every claim that cites it.
5. **Interpretations.** The study's positions, bets and estimates are listed by hand with the evidence they rest on and the observation that would overturn them.

The scripts, the extracted claims and the check results are published with the study's source at `tools/evidence-register/` in the Sysbot R&D repository, so the register can be regenerated after any revision of the study.

## Reporting an error

If a row is wrong, or a source has changed, write to [info@sysbot.in](mailto:info@sysbot.in) with the claim ID. Corrections are applied to the study and recorded in its change log, and this register's version is incremented.

## Change log

| Version | Date | Change |
| --- | --- | --- |
| Register 1.0 | 31 October 2026 | First publication, against Research Study v1.1. Every source re-requested; claims graded E1 to E5; interpretations separated. |