Eight receipts so far in this series: 44,583 citations at BC ESG, 109,844 at Healthcare Facility Hub, 813,426 on this site, 50,607 at Risk Coverage Hub, 57,798 at Continuity Hub, 111 at Restoration Intel, 295 earned by Claude’s own pasted error messages, and a weekly rhythm that keeps office hours. The ninth receipt is a first: the first AI Performance measurement we have ever pulled for theuniversalcommerceprotocol.com — the site we built to teach the Universal Commerce Protocol, the standard AI shopping agents use to buy things. Ninety days, August 8 to November 5, 2026. What the machines cite there is not what we would have guessed — and one thing they cite most was teaching a model the protocol itself had already replaced. Both below.
Watch the 60-second version: Why do three pages hold half of this site’s AI citations? — the same receipts in 59 seconds, chapters matched to the sections below.
Three questions hold half the site
The page view of the export lists 117 cited pages holding 9,628 citations between them. Half of that total sits on three pages. Our agent authentication and identity verification guide leads the site at 1,668 citations (17.3%). The agent payment failures and recovery guide is ten citations behind it at 1,658 (17.2%). The UCP compliance and risk checklist holds third at 1,444 (15.0%). Together: 4,770 citations, 49.5% of everything the site earned. The top ten pages hold 7,748 — 80.5%. The other 107 pages share the remaining fifth.

Read the three pillars as questions and they are the three questions every merchant actually asks about agent commerce: how do I know this agent is who it claims to be, what happens when its payment fails, and what do the rules require of me? Identity, failure, compliance. Not how the protocol works in the abstract — what breaks, who’s responsible, and what’s allowed. On the query side, the single biggest question in the window says the same thing in the searcher’s own words: “agentic commerce frameworks payment exceptions handling” — 1,334 citations, at a 44.11% share of that query’s citation pool. The machines are not citing our explainers. They are citing our answers to things going wrong.
The front door is fifth
The page we built as the site’s front door — the complete guide to the Universal Commerce Protocol — holds 611 citations, 6.3% of the page view, good for fifth place. Each of the three pillars out-cites it roughly two and a half times over. The consent-management guide sits between them and it at 1,058.
We do not read that as the guide failing. A complete guide is what a person reads when they arrive already curious. A citation is what a machine reaches for when it needs one fact to finish an answer — and the facts it needs are specific: an authentication model, a failure procedure, a checklist item. The front door is for arriving. The pillars are for answering. This site was named for the protocol and built around the guide; the citations went to the troubleshooting shelf anyway.
Three views, three totals — and the widest gap in the fleet
Every receipt in this series carries the same disclosure, and this one carries it largest. The export’s three views do not agree with each other. The daily view sums to 12,105 citations over the ninety days. The page view sums to 9,628. The query view sums to 8,755 across 121 queries. Three views of the same window, three different totals — and the widest gap, daily against page, is 2,477 citations, 20.5%.

For scale: the same disagreement on our other sites ran 2.6% (this site, No. 3), 5.7% (Risk Coverage Hub, No. 4), 4.8% (Continuity, No. 5) and about 0.9% (Restoration Intel, No. 6). UCP’s 20.5% is four times the next widest. We do not know why this site’s views diverge so much further than the others’ — the export does not say, and we will not invent a mechanism. What we can do is refuse to blend them: every page share in this piece is a share of the page view’s 9,628; every daily figure is from the daily view’s 12,105; the query numbers are the query view’s own. If you only remember one number from this receipt, remember that the report disagrees with itself by a fifth, and plan your confidence accordingly.
The shape: a sag, then a climb back past the start
The daily view does not run flat. The first forty-five days average 144 a day; the second forty-five average 125 — a decline, if you stop reading there. Keep reading and the line turns: the first fourteen days average 139 a day, the last fourteen average 169. The smoothed line tells it cleanest — the fourteen-day average sinks to a floor of 75 a day in mid-October, then climbs for three straight weeks to the window’s peak day, Thursday, October 29, at 269 citations, with 255 the day after. A U, not a slide: strong open, a sag through September into mid-October, and a climb back that ends higher than it started.

Two cautions belong on this chart, and we put them on the chart. The daily line is spiky at a level the other sites’ lines are not — it touches zero on Saturday, August 22, with zero cited pages, and several other days land under 25 while their neighbors run ten times higher. And the final three days of the window (14, 28, 14) drop off a cliff that is almost certainly the export’s edge, not the site’s collapse — the fourteen-day average was still climbing when the data ran out. On a small site’s report, single days are close to noise; the averages are the claim.
The second act: the authentication shelf taught a replaced model
Here is what we did about all this — because the first measurement arrived in the middle of a full refresh of this site, and the two collided in an uncomfortable place. Between October 27 and 31, Google rewrote its UCP documentation: the UCP-Agent request header — the identifier a page of ours taught merchants to trust — was demoted to routing and analytics only, spoofable by anyone, never authentication. The settled model is cryptographic: RFC 9421 request signatures (ES256) verified against the keys in the protocol profile, with mTLS at the transport layer. Spec version 2026-08-25; Canada live for shoppers since November 4.
Our AI agent verification guide — a cited page on the authentication shelf — taught the old model in so many words: the agent’s identifier “travels in the UCP-Agent request header alongside a request-signature.” That sentence is the superseded model, stated as instructions. On November 8, in Wave 4 of the refresh, that page was republished teaching the RFC 9421 model instead, along with the endpoint shelf (the discovery-endpoint guides corrected to the same authentication model) and the flagship — the complete guide itself, republished the same day with its capability model corrected to spec version 2026-08-25 and the live US and Canada checkout status added. Fourteen pages in the wave. The measurement said the authentication shelf is what the machines cite; the documentation said the shelf was teaching last month’s answer; the refresh fixed the teaching.
One part of that story we will not tidy up: the number-one page itself has not been fixed yet. The authentication leader at 1,668 citations still carries its pre-correction text — it was not one of Wave 4’s fourteen pages, and its own audit has not run. Its shelf got corrected around it. It is named, queued, and owed — and this receipt records it as open rather than pretending the leader and the lesson are the same page. They are one shelf apart.
What we can’t claim
- No baseline. This is the site’s first AI Performance pull, ever. Every shape in this piece — the U, the sag, the climb — is one window with nothing before it. A second pull may redraw all of it.
- The views disagree by a fifth, and we don’t know why. Daily 12,105, page 9,628, query 8,755. We report each figure from its own view and never blend them, but a report that argues with itself this loudly caps how hard any single number can be leaned on.
- No cause for the sag or the climb. Not Google’s October documentation rewrite — tempting as that timing is, with the peak landing October 29 — not crawl cycles, not the refresh (the refresh published November 8, after the window closed). The line moved; the export is silent about who moved it.
- Single days are nearly noise here. A zero day (August 22), neighbors ten times apart, a cliff at the data’s edge — on a site this size the daily grain is too coarse to carry conclusions. We claim the averages and the shares, not the spikes.
- The refresh’s effect is unmeasured. Wave 4 published November 8, outside this window entirely. Whether corrected pages hold or grow their citations is a question for the next pull — claiming it now would be grading our own homework before the test.
- One engine, one window. Microsoft Copilot and partner citations as Bing reports them, ninety days, one small technical site. Another engine’s report could tell a different story about the same pages.
What we do now
- Audit the leader. Post 4105 — the most-cited page on the site — gets its own audit-and-refresh pass, first in the next tranche, alongside the unaudited high-traffic shelf. The shelf around it is corrected; it is the remaining open item from this receipt, and it closes next.
- Pull the second measurement. Same window method, same three-view disclosure. The first re-measure after a refresh is the one that says whether teaching the current model changes what the machines cite.
- Keep the shares straight. Page shares from the page view, daily shape from the daily view, query figures from the query view — and the 20.5% disagreement printed wherever the totals are quoted. The receipts rule holds: the recount wins, and so does the disclosure.
9,628 page citations, and half of them sit on three troubleshooting pages — while the shelf those pages stand on was teaching last month’s authentication model until the morning of November 8. The machines told us what they read. Then they told us, indirectly, that some of it was out of date. Both were receipts.
Download the field-report PDF — the same receipts in a printable report.
Update history
November 8, 2026 — Published.
November 8, 2026 — The video version went live on YouTube the same morning. Article published earlier the same day.
November 8, 2026 — The fix this piece promised shipped the same day: the protocol’s #1 page (Agent Authentication & Identity Verification in Agentic Commerce, post 4105) was refreshed in UCP Wave 5 and now teaches the settled RFC 9421 model; the unverifiable vendor passages named in its audit are out. Wave 5 refreshed nine pages in total; the two remaining pillars followed in Wave 6 — so the correction it promised is done.
Method note: All figures are from the Bing Webmaster Tools AI Performance exports for theuniversalcommerceprotocol.com — daily, page and query views — window August 8–November 5, 2026 (90 days), pulled November 8, 2026; this is the site’s first-ever pull. The three views sum to 12,105 (daily), 9,628 (page) and 8,755 (query); the 20.5% gap is the daily-minus-page difference as a share of the daily sum. “Pillars” are single exact pages — the most-cited page in each of the site’s three leading subjects — not keyword groupings. Page shares are shares of the page-view sum; daily means are means of the daily view; a query’s “share” is the export’s own printed figure. The authentication correction is documented in the UCP refresh programme’s Wave 4 record (addendum AUTH-2026-11, November 8, 2026): Google’s rewritten UCP FAQ (changed October 27–31, 2026) makes RFC 9421 ES256 signatures plus mTLS the authentication model, with the UCP-Agent header demoted to routing and analytics. Citation counts are Microsoft Copilot and partner citations as Bing reports them. The field-report PDF is at https://tygartmedia.com/wp-content/uploads/2026/11/half-the-citations-ucp-field-report.pdf. One site, one engine’s report, one first window — and a fifth of it disagrees with itself.





























