Appendix A · Method and Limitations

✓You are reading the complete text — not a summary. All 13 chapters are published in full, free, no registration. The PDF is a print edition of the same content.

A.1 Agent-readiness audit (Section 5.3)

Collection date: 11 August 2026 Sample: 50 independent storefronts operated by Chinese cross-border DTC brands; 47 reachable Method: Read-only HTTP requests. Checked /.well-known/ucp, /.well-known/agent-payments, /llms.txt, /.well-known/ai-plugin.json, /.well-known/mcp.json, /robots.txt, and JSON-LD / microdata structured data on the homepage and on one product page discovered from the homepage. Single request, 12-second timeout, concurrency capped at 8, carrying an identifiable User-Agent and contact email. No authentication, no form submission, no write operations.

Content validation (critical): HTTP 200 was not counted as a hit. UCP and other JSON endpoints had to parse as a JSON object containing the relevant keys; llms.txt had to be plain text and not HTML. An initial pass without validation overstated UCP readiness at 59.6%; with validation it is 53.2% — the entire difference comes from SPA soft 404s (returning homepage HTML with a 200 status for any path).

Known limitations:

1. Convenience sample, not a random sample. Sites were selected manually for category representativeness and cannot be extrapolated to Chinese cross-border DTC brands as a whole.
2. Single collection, single vantage point. No repeat runs across regions or time windows; regional routing differences or anti-scraping blocks may have caused missed detections.
3. Structured data covers two pages only. Homepage plus one product page; this is not site-wide coverage. Product pages were discovered by regex over homepage links and may have missed the primary PDP template on some sites.
4. Merchant Center status cannot be detected externally. The presence of a UCP manifest does not mean integration on Google’s side is complete — that additionally requires a valid Merchant Center account with checkout-eligible products, which this audit cannot verify. “UCP-ready” should therefore be read as “meets the manifest precondition”, not “can already be transacted by a Google agent”.
5. Platform attribution is heuristic. Based on markers such as cdn.shopify.com in the homepage source; sites using a custom CDN may be misclassified.

Raw data and script: _source/agent_readiness_results.json, _source/agent_readiness_audit.py

A.2 Sampling-round calibration (Section 4.2)

Data: 503 archived responses from a single client audit; the API-layer samples among them were OpenAI 240 + Gemini 240 (227 each retrieval-enabled), across 60 engine × layer × question combinations, 58 of them with ≥ 5 rounds; 3,821 citation instances, 409 unique domains. Collection cost USD 86.

Known limitations: One brand, one vertical, one market. Both observed values for brand mention rate (0/262 and 192/192) are saturated endpoints; the dataset contains no mid-range samples. The conclusion that “one round is sufficient” therefore holds only for the saturated case and cannot be extrapolated to brands with mention rates in the 30–60% band. Filling in mid-range calibration is the primary research gap this report has identified in its own work.

A.3 Cross-layer agreement (Section 4.4)

Data: A single client audit, n = 12 questions, with the same queries submitted simultaneously to the API layer (Gemini 8 rounds + OpenAI 8 rounds = 16 samples) and the browser layer.

Known limitations: Small sample. The 95% confidence interval around the mean Jaccard value of 0.103 is [0.074, 0.132]; the confidence interval on brand-hit agreement is 40 percentage points wide (83.3% overall, Wilson 95% CI [55.2%, 95.3%]). These findings should be cited as a structural directional judgement, not as precise measurement. One brand, one vertical.

A.5 Cross-client two-layer comparison (section 8.5)

Collected: secondary analysis of archived data; analysis date 13 August 2026; no new collection cost.

Sample: 64 pairs drawn from three real client audit archives (MathleteTraining / OpenKids / Canlah’s own self-audit) in which the same query exists in both a browser-layer and an API-layer record. Browser layer: google_ai_mode and serpapi_ai_overview. API layer: gemini and openai.

Method: queries matched after normalisation (whitespace collapsed, lower-cased); cited domains per layer taken as a union, then compared by Jaccard similarity. Domains normalised by stripping the www. prefix.

One implementation detail we must disclose: the two layers store their sources in entirely different places — the browser layer in a flat sources list, the API layer buried in the provider’s raw grounding payload. Every Gemini citation URI is wrapped in a Vertex redirect (vertexaisearch.cloud.google.com/...), and the real domain survives only in the web.title field. Our first version of the script read the URI alone, so every citation resolved to the same redirect host and the Jaccard score was silently computed as 0.000. Corrected, it is 0.096. We record the error because it belongs to the same class as the soft 404 in section 5.3: an external source “returning something” is not the same as returning the thing you asked for, and the wrong version looks entirely normal.

Known limitations:

1. 3 brands, 64 pairs, all our own clients, not a random sample. Not generalisable to the industry.
2. Pairing relies on query-text matching. Wording may differ slightly between layers, so a small number of pairs may not be strictly the same question.
3. Rounds and engine mixes are not symmetric between layers (multiple rounds on the API layer, single round on the browser layer), so the comparison is of the union of domains each layer cited for that query, not a round-by-round comparison.
4. Archive contamination, found on re-run (1 September 2026). Re-running the pairing script to draw this report’s figures showed that the MathleteTraining archive also contained a full OpenKids probe run, misfiled there by a concurrency defect in our own pipeline on 29 July 2026; 16 of the 32 pairs attributed to MathleteTraining were in fact OpenKids queries. The 64 pairs, the mean (0.096), the median, sd, CI and the 21 zero-overlap pairs are unaffected — none of them depends on which client a pair belongs to. What changes: per-client n becomes 16 / 32 / 16 and per-client means 0.114 / 0.100 / 0.070; brand-hit disagreements are 15 rather than 11, and all 15 are API-hit / browser-miss; and the sample spans two verticals and two markets, not three — the earlier “three verticals, three markets” line is withdrawn. We publish the correction rather than the tidier version because that is the standard this report asks of everyone else.

Script and results: _source/browser-vs-api-comparison.py, _source/browser-vs-api-results.json. Both can be re-run directly.

A.4 On the evidentiary composition of this report

Of the academic literature cited here, exactly one item is peer-reviewed (Aggarwal et al., KDD ’24). All other academic citations are 2026 preprints and are labelled A− without exception. This is not concealment; it is the state of the field: research is moving faster than the peer-review cycle. Readers should calibrate their confidence in the associated conclusions accordingly.