ARLIRadar reading for one siteMeasured 2026-11-10T22:49:40Z | document issued 10 November 2026
arliwork.com measured
An agent can see you, but cannot act on what it finds.
What the number is. Every check below carries a weight, and they add up to 20.5 points for this measurement: a pass earns its weight, a warning earns half of it, and a failure earns nothing. It is not the chance that an agent will succeed on your site. When the headline says an agent can act, it means every check in that band passed here, on this date, from this one network location.
Included with this document: a copy of the fixer skill prepared for arliwork.com on this measurement, with the findings file inside it and one recipe for every check. Download it here.
What this measurement found
The three checks that decide whether an agent can act on this site: a non-browser client can read the site passed; products are stated in machine terms failed; price and availability are machine-readable failed.
The heaviest single gap was Products are stated in machine terms, which holds 2 of the 20.5 points, and the gaps together account for 6.75 points.
What was measured, check by check
| Check | Result | Weight | What we saw |
|---|---|---|---|
| A non-browser client can read the site | pass | 3 | HTTP 200 and readable content (203480 bytes) with no browser fingerprints |
| Rules for AI agents are published and permit them | pass | 2 | robots.txt names AI agents and lets them in: Amazonbot, Applebot-Extended, Bytespider, CCBot, ClaudeBot, GPTBot |
| A URL that does not exist answers a real 404 | pass | 1.5 | a path that does not exist answers a real 404 |
| Products are stated in machine terms | fail | 2 | no Product markup on the product page we located: an agent reading your site cannot tell what you sell in machine terms |
| Price and availability are machine-readable | fail | 2 | neither price nor availability is machine-readable: a comparison agent has nothing to work with |
| The catalogue can be queried, not only browsed | pass | 2 | /.well-known/mcp.json publishes a tool interface a model can call |
| There is a map of what you sell | pass | 1 | /sitemap.xml lists 79 URLs, so product pages can be discovered |
| A machine description of what may be requested | warning | 1 | nothing at /agents.txt or /.well-known/ai.txt: a machine has no description of what it may ask for |
| llms.txt is present | pass | 0.5 | llms.txt is present and contains real text (8397 bytes) |
| The site describes itself to other agents | warning | 1 | no agent card: your site does not describe itself to another agent |
| The site lists the resources it offers an agent (ARD) | warning | 1 | no /.well-known/ai-catalog.json: an agent has no list of the resources this site offers it |
| A machine list of the APIs exists (RFC 9727) | warning | 0.5 | no /.well-known/api-catalog (RFC 9727): a discovery client has no machine list of the APIs |
| Who authorises access is declared (RFC 9728) | pass | 0.5 | oauth-protected-resource names the resource and its authorisation server |
| A callable API surface exists | warning | 1.5 | /docs responds, but only with a human page, so an agent cannot call anything structured |
| A way to authorise an agent is declared | pass | 0.5 | /.well-known/oauth-authorization-server is present, so an agent has a defined way to be authorised |
| Per-call payment is declared | warning | 0.5 | no machine payment declaration (x402 or equivalent): an agent cannot pay per call |
The checks, one at a time
01 A non-browser client can read the site passweight 3
The question
Can a client that is not a browser read the site at all?
Why a client stops here
A client that declares itself honestly gets turned away. The refusal is rarely a clean error: Cloudflare marks a challenge page with the header cf-mitigated: challenge whatever its body says, AWS WAF answers a challenge with 202 and a captcha with 405, and both of those are legal HTTP statuses that a careless reader takes for a real answer. Google's own crawler guidance tells site owners to answer an overwhelmed machine with 500, 503 or 429 rather than 200, which is the clearest statement that a 200 carrying a challenge is the wrong signal.
What we saw on this measurement
HTTP 200 and readable content (203480 bytes) with no browser fingerprints
What it costs
Everything else in this document becomes theory. An agent that cannot read the catalogue cannot quote a price, cannot check stock and cannot place an order. The buyer's agent reports a failure and the buyer goes back to a browser, which is the outcome the whole exercise was meant to avoid.
The fix
Allow verified agents through the policy that is turning them away. Verification is not the User-Agent string: it is a signed request, a published address list, or a reverse lookup against a domain the crawler owner controls. This is an account holder's decision in a console, and no tool can make it from outside.
How to check the fix landed
curl -s -o /dev/null -w '%{http_code}\n' -A 'curl/8' https://arliwork.com/ and inspect the response headers for cf-mitigated or x-amzn-waf-action. A pass prints 200 with no such header.
Where the rule comes from
Carried by the fixer
recipes/machine_access.md in agent-ready-site, or apply it by hand with the steps above.
02 Rules for AI agents are published and permit them passweight 2
The question
Does robots.txt name the agents you permit, or does it merely exist?
Why a client stops here
robots.txt is the only widely honoured way a site states what may be read, and RFC 9309 defines no AI directive at all: the AI names are ordinary user-agent groups, and the tokens are vendor conventions. GPTBot, OAI-SearchBot and ChatGPT-User are three separate OpenAI tokens, each controlled on its own, and the same pattern holds for the other vendors. A robots.txt that names five search crawlers and no AI agent has said nothing about agents.
What we saw on this measurement
robots.txt names AI agents and lets them in: Amazonbot, Applebot-Extended, Bytespider, CCBot, ClaudeBot, GPTBot
What it costs
An agent that is neither invited nor refused must guess. Some agents read the silence as refusal and skip the site, others read it as permission and crawl anyway. Either way the site has no say, and the log shows traffic the owner cannot explain.
The fix
Write one group per agent you permit, with the paths that matter to a buyer (products, collections, content) allowed and the private paths (cart, checkout, account) disallowed. Keep it additive: a `*` group with a blanket rule is not a decision about agents.
How to check the fix landed
curl -s https://arliwork.com/robots.txt and confirm a named group for at least one AI agent, plus an absolute sitemap line.
Where the rule comes from
https://github.com/ai-robots-txt/ai.robots.txt
Carried by the fixer
recipes/bot_rules.md in agent-ready-site, or apply it by hand with the steps above.
03 A URL that does not exist answers a real 404 passweight 1.5
The question
Does a URL that does not exist answer honestly?
Why a client stops here
Many shops, and almost every single page application, answer an unknown path with 200 and a page. The page is often the home page or a styled error screen. A browser user sees something reasonable; a machine records a fact. The difference matters because an agent's whole method is to follow links and trust the answers.
What we saw on this measurement
a path that does not exist answers a real 404
What it costs
An agent that follows a stale link, a typo or a guessed path receives a valid-looking page about the wrong thing. It then reports that the site sells whatever the fallback page shows. Silent, repeatable, and expensive to find by hand.
The fix
Return a real 404 with a real body. In a single page application this means listing the client routes that truly exist instead of rewriting every unknown path to the shell.
How to check the fix landed
curl -s -o /dev/null -w '%{http_code}\n' https://arliwork.com/definitely-not-a-page must print 404.
Where the rule comes from
https://www.rfc-editor.org/rfc/rfc9110.html
Carried by the fixer
recipes/real_404.md in agent-ready-site, or apply it by hand with the steps above.
04 Products are stated in machine terms failweight 2
The question
Are your products stated in machine terms, on the page itself?
Why a client stops here
For a shop, this is the check that decides whether an agent can talk about a product at all. Google's merchant listing guidance requires only name and image on the product, and price plus currency on the offer; the identifier (gtin13, gtin, mpn) is what lets two sites agree they mean the same thing. Google also warns that markup generated by JavaScript is crawled less reliably, so the data has to be in the first answer, not assembled afterwards.
What we saw on this measurement
no Product markup on the product page we located: an agent reading your site cannot tell what you sell in machine terms
What it costs
Without an identifier an agent cannot match your part to the buyer's part. Without markup in the initial answer it cannot see the product at all in most cases, because the major AI crawlers do not execute JavaScript. The catalogue exists and is invisible.
The fix
Emit one Product with an Offer per product page, in the initial HTML, built from the same data the page displays: name, image, sku, gtin13 or mpn, brand, price, priceCurrency, availability, priceValidUntil. Escaping matters: escape `<` in the serialised JSON.
How to check the fix landed
Fetch a product page and search the first response for application/ld+json containing @type Product with an offer and an identifier.
Where the rule comes from
https://developers.google.com/search/docs/appearance/structured-data/merchant-listing
Carried by the fixer
recipes/product_markup.md in agent-ready-site, or apply it by hand with the steps above.
05 Price and availability are machine-readable failweight 2
The question
Can a machine read your price and your stock, and does the page admit when they are old?
Why a client stops here
Availability is a controlled vocabulary, and the difference between InStock, OutOfStock, BackOrder and PreOrder is the difference between an agent recommending and an agent withholding. Google Search treats availability on the offer as recommended while Merchant Center requires it in the feed, so satisfying one surface does not satisfy the other. priceValidUntil is the only declared freshness signal, and a past date silently removes an offer from Google's surface, which is a good illustration of what a stale date does to every other reader.
What we saw on this measurement
neither price nor availability is machine-readable: a comparison agent has nothing to work with
What it costs
An agent that quotes a price that has moved, or a stock state that changed, has misquoted the buyer. The buyer blames the agent, the agent blames the site, and the sale goes back to a telephone call. This is the failure our own field runs found most often.
The fix
State price, priceCurrency, availability and priceValidUntil on the offer, in the initial answer, matching what the page shows. Where a price depends on the buyer (contract pricing, quantity breaks), say so explicitly rather than publishing a number that will not hold.
How to check the fix landed
On the same product page, confirm offers.price, priceCurrency and a schema.org availability value in the offer, and check priceValidUntil is in the future.
Where the rule comes from
https://schema.org/ItemAvailability
Carried by the fixer
recipes/price_and_stock.md in agent-ready-site, or apply it by hand with the steps above.
06 The catalogue can be queried, not only browsed passweight 2
The question
Can the catalogue be asked a question, or can it only be read page by page?
Why a client stops here
Reading a hundred product pages to answer one question is what makes an agent expensive and unreliable. A query surface lets an agent ask for one product and get one answer. The current form of that surface is an MCP server: the specification defines tools with declared input schemas, and the Streamable HTTP transport replaced the older two-endpoint design. A catalogue served only as pages is readable but not askable.
What we saw on this measurement
/.well-known/mcp.json publishes a tool interface a model can call
What it costs
Every question costs the agent a crawl instead of a call. It guesses at structure, it carries stale data, and it fails at the first question that needs a filter. Pages are also where the blocking happens, so the failsafe path is the one most likely to be shut.
The fix
Stand up a catalogue endpoint and describe its tools. The skill ships a minimal MCP server for a product catalogue, with the tool schema written out. Serve it on the same origin where possible: a separate host adds a second place for a policy to block traffic.
How to check the fix landed
Call the catalogue endpoint and list its tools, or call the documented search path and read one product back with price and identifier.
Where the rule comes from
https://modelcontextprotocol.io/specification/2025-11-25/basic/transports
Carried by the fixer
recipes/catalogue_query.md in agent-ready-site, or apply it by hand with the steps above.
07 There is a map of what you sell passweight 1
The question
Is there a map of what you sell, and is it honest about what changed?
Why a client stops here
The sitemap is how a large catalogue becomes navigable at all. Its uncommon value is lastmod: it is the only signal by which an agent decides which pages are worth re-reading. A sitemap that lists URLs without dates makes every page equally likely to have changed.
What we saw on this measurement
/sitemap.xml lists 79 URLs, so product pages can be discovered
What it costs
Without the map, an agent discovers products by following links, which for a deep catalogue means it never reaches most of it. With a map whose dates are all identical, it re-reads everything or nothing, and either way the price it holds may be a week old.
The fix
Publish a sitemap that lists the canonical product URLs with a real lastmod from the record's own updated timestamp, and reference it absolutely from robots.txt. Above fifty thousand URLs, use a sitemap index.
How to check the fix landed
curl -s https://arliwork.com/sitemap.xml and confirm product URLs are listed with per-URL lastmod values that differ.
Where the rule comes from
https://www.sitemaps.org/protocol.html
Carried by the fixer
recipes/discovery_map.md in agent-ready-site, or apply it by hand with the steps above.
08 A machine description of what may be requested warningweight 1
The question
Has anyone written down what a machine may ask you for?
Why a client stops here
This is the least settled check in the set, and it is reported as such. Two file names are in play, /agents.txt and /.well-known/ai.txt, and both are individual IETF drafts rather than standards: Informational, expiring 14 December 2026, with registration requested and not granted. Nothing obliges another system to honour either file.
What we saw on this measurement
nothing at /agents.txt or /.well-known/ai.txt: a machine has no description of what it may ask for
What it costs
In practice the cost is a missing conversation rather than a broken call. An agent or a person wondering how to ask you something, and whom to write to about access, has nowhere to look. The file is cheap and the absence is not a verdict on the site.
The fix
Publish a short plain-text description: what is offered, which endpoints may be called, who to contact about access, any rate expectation. It is a statement of intent, so say only what you intend to honour.
How to check the fix landed
curl -s https://arliwork.com/agents.txt returns text naming a scope and a contact.
Where the rule comes from
https://www.ietf.org/archive/id/draft-car-agents-txt-wellknown-00.html
Carried by the fixer
recipes/agent_description.md in agent-ready-site, or apply it by hand with the steps above.
09 llms.txt is present passweight 0.5
The question
Is there a plain-language index of what matters on the site?
Why a client stops here
llms.txt is a proposal, not a standard: a markdown file at the root, an H1, a summary line, and lists of links. It is worth stating plainly what the evidence says about it. A log study of 137,000 domains found that 97 percent of llms.txt files received no requests at all, and Chrome's own audit marks a missing file as not applicable rather than a failure. The largest documentation sites publish one because a generator writes it for free, not because a reader asked.
What we saw on this measurement
llms.txt is present and contains real text (8397 bytes)
What it costs
The honest cost is near zero, which is why this check carries half a weight and why this document says so instead of padding it. A site without llms.txt is not losing sales to a site with one, on the evidence available.
The fix
If the content already exists as structured pages, publish a short index anyway: it is minutes of work and it costs nothing to keep true. Do not buy it as a growth measure.
How to check the fix landed
curl -s https://arliwork.com/llms.txt returns markdown beginning with an H1.
Where the rule comes from
Carried by the fixer
recipes/llms_txt.md in agent-ready-site, or apply it by hand with the steps above.
10 The site describes itself to other agents warningweight 1
The question
Do you publish a card that says who this agent-facing endpoint belongs to?
Why a client stops here
A2A version 1.0.0 fixes one path for this: /.well-known/agent-card.json. The suffix was registered with IANA on 1 August 2025 and the specification is governed by the Linux Foundation, which makes it the one AI-specific well-known name with a registry entry behind it. The card carries name, description, provider, version, documentationUrl, capabilities, securitySchemes, defaultInputModes, defaultOutputModes, skills and signatures. In version 1.0.0 the top-level url field was removed: the address now lives in supportedInterfaces, each entry naming a protocolBinding and a protocolVersion.
What we saw on this measurement
no agent card: your site does not describe itself to another agent
What it costs
Without a card, a discovery client that uses the registered path finds nothing and moves on. There is no error to fix later, just an absence.
The fix
Publish one honest card at that path, in the version 1.0.0 shape, at your real endpoint, with the skills you actually offer. A card promising skills you do not serve is worse than no card, because it is a contract you will break.
How to check the fix landed
curl -s https://arliwork.com/.well-known/agent-card.json returns JSON containing name, version and supportedInterfaces with a url.
Where the rule comes from
https://a2a-protocol.org/latest/specification/
Carried by the fixer
recipes/agent_card.md in agent-ready-site, or apply it by hand with the steps above.
11 The site lists the resources it offers an agent (ARD) warningweight 1
The question
Do you publish an entry describing what is addressable at your domain?
Why a client stops here
Agentic Resource Discovery defines a single file, /.well-known/ard.json, whose entries name a resource with an identifier from the urn:air: namespace, a type, a url, and optionally representativeQueries and capabilities. The current revision is dated 26 August 2026, it precedes the ai-catalog.json path that some sites still publish, and it is not registered with IANA. Oversight sits with a group that includes Google, Hugging Face, Microsoft, Amazon and Cisco.
What we saw on this measurement
no /.well-known/ai-catalog.json: an agent has no list of the resources this site offers it
What it costs
Same shape of cost as the card. A discovery client that relies on the entry finds nothing at your domain, and the catalogue you do serve stays unadvertised.
The fix
Publish one entry file describing the resources you actually expose, with queries a buyer would really ask. If you already publish the older ai-catalog.json path, keep it and add the current one alongside for a transition period.
How to check the fix landed
curl -s https://arliwork.com/.well-known/ard.json returns JSON whose entries carry an identifier, a type and a url.
Where the rule comes from
https://agenticresourcediscovery.org/spec/
Carried by the fixer
recipes/ard_catalog.md in agent-ready-site, or apply it by hand with the steps above.
12 A machine list of the APIs exists (RFC 9727) warningweight 0.5
The question
Is your API listed in the catalogue format that discovery clients read?
Why a client stops here
RFC 9727, published as a Standards Track document in June 2025, defines the well-known suffix api-catalog. A GET to /.well-known/api-catalog returns the catalogue, a HEAD returns a Link header carrying the api-catalog relation, and the body is in the Linkset format with media type application/linkset+json and the RFC's own profile parameter. Each entry anchors an endpoint and names its description with service-desc, its human documentation with service-doc, or its health with status.
What we saw on this measurement
no /.well-known/api-catalog (RFC 9727): a discovery client has no machine list of the APIs
What it costs
Without the catalogue, a client that already speaks this format must be told your address by hand. Every integration then starts with an email instead of a lookup.
The fix
Publish the linkset at that path pointing at the API description you already maintain, such as OpenAPI. If your API does not exist yet, this check is a warning on purpose: a catalogue with nothing behind it is a promise, not a service.
How to check the fix landed
curl -s https://arliwork.com/.well-known/api-catalog returns JSON with a linkset array and a service-desc entry.
Where the rule comes from
https://www.rfc-editor.org/rfc/rfc9727.html
Carried by the fixer
recipes/api_catalog.md in agent-ready-site, or apply it by hand with the steps above.
13 Who authorises access is declared (RFC 9728) passweight 0.5
The question
Can a client find out what a 401 is asking for?
Why a client stops here
RFC 9728 defines how a protected resource publishes where its authorisation server lives. The metadata document uses the same path as the resource with the well-known segment inserted before it, and the resource value inside must match the resource an attacker would name. The MCP specification leans on this directly: a 401 without a WWW-Authenticate header carrying resource_metadata tells a client it is unauthorised and gives it nowhere to go.
What we saw on this measurement
oauth-protected-resource names the resource and its authorisation server
What it costs
An agent can see the door and cannot find the handle. It reports that access was refused, which is true and useless, and the log records a failed integration rather than a missing document.
The fix
Publish the metadata at the correct path, and answer 401 with a WWW-Authenticate header naming it. Authentication and registration are account holder decisions, so the skill stops here.
How to check the fix landed
curl -s https://arliwork.com/.well-known/oauth-protected-resource returns JSON with resource, authorization_servers and scopes_supported, and the resource string equals your resource URL.
Where the rule comes from
https://www.rfc-editor.org/rfc/rfc9728.html
Carried by the fixer
recipes/oauth_protected_resource.md in agent-ready-site, or apply it by hand with the steps above.
14 A callable API surface exists warningweight 1.5
The question
Is there something a machine can actually call, beyond pages?
Why a client stops here
This check measures whether a callable surface exists and answers, not whether a page mentions one. It is the difference between a site an agent reads and a site an agent uses. The check distinguishes a real answer from a shell: a 405, a 200 with an empty body, or a challenge header counts as a refusal, and it is read as one.
What we saw on this measurement
/docs responds, but only with a human page, so an agent cannot call anything structured
What it costs
Every question costs a crawl. The catalogue cannot be filtered, stock cannot be checked per warehouse, and the buyer's agent guesses. This is also the check most likely to be blocked by a policy aimed at forms and scrapers, so the failsafe path and the front door are the same one.
The fix
Expose the smallest useful surface first: one search path that returns products with price, identifier and availability, and one product path that returns a single product. Then describe it in the catalogue above. More surface is a later decision.
How to check the fix landed
curl -s the documented path with a real query and read back at least one product carrying a price and an identifier.
Where the rule comes from
https://www.rfc-editor.org/rfc/rfc9727.html
Carried by the fixer
recipes/api_surface.md in agent-ready-site, or apply it by hand with the steps above.
15 A way to authorise an agent is declared passweight 0.5
The question
Can a caller, human or machine, be told how to obtain access and with what scope?
Why a client stops here
Authorisation for machine callers is a chain, and each link is a separate document: the protected resource metadata of RFC 9728, the authorisation server metadata of RFC 8414, and the resource indicator of RFC 8707 so the token cannot be replayed at a different resource. The MCP specification states the same requirement as a hard rule for its transport. Credentials in a query string or a path are a failure of this check, not a style question.
What we saw on this measurement
/.well-known/oauth-authorization-server is present, so an agent has a defined way to be authorised
What it costs
A buyer's agent that cannot obtain access on its principal's behalf stops and asks a human. That is where an automated purchase becomes an email, and the site pays for it in turnaround time.
The fix
Publish the metadata documents, offer a documented path for a machine principal to obtain a token, and keep scopes narrow and named. Every step that issues a credential is an account holder's decision.
How to check the fix landed
Call a protected path, read the 401, follow the WWW-Authenticate header to the metadata document, and confirm the authorisation server and its scopes are named.
Where the rule comes from
https://www.rfc-editor.org/rfc/rfc8414.html
Carried by the fixer
recipes/authorisation.md in agent-ready-site, or apply it by hand with the steps above.
16 Per-call payment is declared warningweight 0.5
The question
If you intend to charge an agent for a call, have you said so in the form agents look for?
Why a client stops here
This check is a warning by design, and the document says why. Three schemes are in circulation for machine payments: x402, which carries the demand in a 402 response, with version 2 placing base64 PAYMENT-REQUIRED and PAYMENT-SIGNATURE headers, and the answer in PAYMENT-RESPONSE naming the transaction and network; AP2, published by Google with a mandate object, roles and a verifiable digital credential; and ACP, published by OpenAI and Stripe on 17 April 2026, whose OpenAPI documents split into a checkout and a delegate payment part. None is settled, and a site that takes no machine payment is not at fault.
What we saw on this measurement
no machine payment declaration (x402 or equivalent): an agent cannot pay per call
What it costs
The cost is a lost sale that never looked like one. An agent that could have paid per call finds no declared price and stops. Set against the cost of adopting an unsettled scheme, that is a calculation for the owner, not a fault in the site.
The fix
If you do intend to charge, declare it at /.well-known/x402 and answer the paid path with a real 402 carrying the demand. If you do not, leave it and read this line as what it is.
How to check the fix landed
curl -s https://arliwork.com/.well-known/x402 returns JSON, and a call to a paid path answers 402 with a PAYMENT-REQUIRED header.
Where the rule comes from
https://github.com/coinbase/x402/blob/main/specs/transports-v2/http.md
Carried by the fixer
recipes/machine_payment.md in agent-ready-site, or apply it by hand with the steps above.
What this measurement does not cover
Sixteen checks describe what a site declares to a machine. They do not describe what happens when a machine tries to buy. The following cannot be measured from one unauthenticated request, and a document that hid them would be selling a number it did not earn.
- A repeated request. Whether the same order sent twice creates one order or two. This is the single most common way an automated purchase goes wrong, and it cannot be measured from one unauthenticated point.
- The end of an order. Whether a basket can be completed, paid for and acknowledged. Reaching a cart is not placing an order. Testing this needs a sandbox the owner gives us.
- The webhook. Whether a buyer is told what happened, and whether the site can be told what the buyer did. The delivery of a callback is invisible from outside.
- The quote per token. Whether a limit is enforced per key. A quota that exists in the contract and not in the code is not a limit.
- Real tax and delivery. What a basket actually costs, once the destination is known. A published price is a promise about a number before tax and carriage.
- Legal permission to sell. Whether the seller may sell into the buyer's jurisdiction. No measurement settles this, and no agent should pretend to.
- A human approval step. Whether a person must sign, and where in the flow that happens. If an agent must wait for a human, it should be told so before it starts.
- The words in the schema. A field named correctly and filled with a wrong value passes every check here. Our measurements record what a site declares, and a declaration can be false.
- A snapshot from one network location. Anti-bot behaviour can differ by agent and by country, so a single measurement is evidence, not a verdict. Absence of a public endpoint does not prove nothing exists behind the firewall.
If you want us to do the work
Everything above is yours to act on, and the fixer pack is included with it. If you would rather not do the repairs yourself, we do them: 399 dollars for one site, the sixteen checks in this report, one round of work. That covers a branch in your repository with the changes applied, and a fresh measurement at the end so you can see what closed. The $99 you already paid for this report comes off it.
Two things sit outside that number, and we say so before you decide. Anything only an account holder can change: the firewall and bot policy, DNS, hosting, the authorisation provider, taking a payment. And anything this measurement could not see, such as whether a repeated order creates one order or two. Those we name and leave with you.
What you paid, and what it counts for
This document is $99, paid 10 November 2026. The measurement and the fixer pack are yours to keep whatever you decide next. If you ask us to do the repairs, this amount comes off the 399, so the report ends up costing nothing.