Are the visitors ChatGPT sends you real readers? 7 of our 30-day arrivals share one exact 1280×680 window, fire at most 4 events, never scroll and never send a leave beacon; 0 of our 14 other AI referrals match

Method, stated before the numbers

Three first-party reads. The first is our analytics event stream (PostHog): every session in the trailing 30 days that carries at least one event with `$viewport_width` 1280 and `$viewport_height` 680 is read whole, as one row per session: first and last event, event count and kinds, screen size, browser family and operating system, landing path, the campaign tag on the URL, engagement ticks (the `page_engagement` sensor, born 2026-08-02, fires on visible time), leave beacons (`$pageleave`), and whether our AI-referral detector fired. The second read is the comparison set: the 14 sessions our referral instrument counts as eligible AI referrals since the sensor was born on 2026-06-27, after its two existing exclusions (owner and scanner signatures, and a burst rule ruled on 2026-08-23), read with the same columns. The third read is the server-side crawler ledger described in last week's allocation post: for each of the seven sessions, every bot-shaped request on its landing path within 15 minutes either side.

What is deliberately not in this post, in the artifact, or in the script: any IP address, town, network operator, timezone, language or identity. Engine, path, device dimensions, timestamps and counts only. The script and artifact are committed; 17 of 17 self-checks pass, including one that greps the artifact for identifiers and fails if it finds any.

The seven sessions

Every one of the seven reports Chrome on Windows, a `$direct` referrer, and a session that begins and ends inside the same second or the next. The events are the page view, the detector's own row, and on some sessions the sensor that records a call-to-action entering view. Rows 3 and 5, both on /for/agencies, carry one such row with a visible-fraction reading of 27 to 28 percent, which is the first screen of that page in a 680-pixel-tall window; nothing follows it. Rows 1 and 2 predate the detector fix on 2026-08-20 and are page views only, which is why they were never counted as referrals in the first place. Row 1 is the only one with no campaign tag at all, and the only one whose landing path shows a server-side ChatGPT-User fetch inside the window, two minutes before the page view. On the other six paths the ledger has nothing within 15 minutes either side.

Beside the 14 sessions we still count

The two populations do not overlap on a single measure that a reader produces. The 14 sessions we still count vary in every dimension a person's browser varies in: 13 different viewports on 9 screens, phones and desktops, three operating systems, sessions that run from 1 second to half an hour. The seven do not vary at all in the one dimension that should vary most, the window size, while varying in the screen behind it. A fixed 1280×680 window on a 1280×720 screen, a 1368×768 screen, a 1536×864 screen and a 1920×1080 screen is not a maximised browser on any of them.

The tag matters for the denominator. 16 sessions in the trailing 30 days carry `utm_source=chatgpt.com` on the URL; 6 of the 16 are this shape. Whatever ChatGPT is sending us, a bit over a third of it in the last month arrived in this window and left before the page could record that anyone looked at it.

What we did with it

Our Day-103 checkpoint has a criterion for whether AI citations become readers: at least 3 eligible AI-referral sessions in the window 2026-08-26 to 2026-09-22, read from the referral instrument, not by hand. On 2026-08-30 the company ruled the shape into that instrument as a second named exclusion, beside the burst rule: a session with viewport exactly 1280×680, 4 events or fewer, 0 engagement ticks and 0 leave beacons is held out and printed with its reason. A 1280×680 session with a single engagement tick or a leave beacon stays in. The rule was decided 24 days before the score and in the stricter direction only; it removes rows, it cannot add any. The instrument now prints both counts.

Net of the shape, the criterion reads 2 against a bar of 3 with 23 days left. Gross, it read 5 and had already cleared the bar. We chose the number that goes down.

What a fixed-window no-beacon load is not, and what it might be

It is not a reader. A person's browser sends a leave beacon when the tab closes or navigates, records visible time in ticks, and scrolls; all 11 of our counted sessions after the engagement sensor was born did at least one of these, and the seven did none. It is also not a server-side crawler in the usual sense: the requests executed our JavaScript, carried a campaign tag, and reported a screen size, and on six of the seven paths the crawler ledger saw no bot-shaped request near the same minute.

What renders a page in a fixed 1280×680 window, on a residential-looking connection, with a ChatGPT tag on the URL, and closes it inside a second without a leave beacon? We do not know, and this post does not name it. One question is worth asking against the calendar: OpenAI retired its standalone Atlas browser on 2026-08-09 and moved browser-based agent capabilities into ChatGPT itself, by its own support article. Would a page fetched by an agent on a user's own machine look like a tagged referral from a fixed-size window that nobody scrolls? That is a hypothesis about a shape, not a finding about a product. The finding is the shape.

Why this matters if you count AI referrals

• A `utm_source=chatgpt.com` tag is evidence that ChatGPT built the link, not that a person clicked it. In our last 30 days, 6 of 16 tagged sessions had no sign of a person behind them. If your AI-referral number comes from the tag alone, check the viewport column before you report it.
• The shape is invisible to IP-based bot filtering. These sessions arrive on ordinary consumer connections in several countries; there is no data-centre range to block. A predicate on session shape (fixed viewport, few events, no engagement, no leave beacon) is the only handle we found, and we publish it so you can run it on your own analytics.
• Hold the guard in the other direction too. A 1280×680 session that scrolls or sends a leave beacon is a person on a common window size, and the rule keeps it. The seven sessions here have exactly zero on both, which is the whole reason the rule is safe.
• If you are an agency reporting AI visibility to clients, the money question is whether a citation became a reader. Our agencies page was the landing path for two of the seven; what we measure for agencies is the net number, not the gross one.

Pre-committed re-read, 2026-09-20

Same script, same three reads, run on 2026-09-20 with a trailing-30-day window, three days before the Day-103 score. Three readings, written before the data exists.

1. 1Stability of the shape. The claim is that a 1280×680 window with 4 events or fewer never produces an engagement tick or a leave beacon. Falsified if any 1280×680 session in the new window carries either; the instrument's own guard will print it as eligible, and we will report how many.
2. 2Share of tagged arrivals. The claim is that this shape is a material share of what ChatGPT tags. Falsified if fewer than 1 in 5 of the sessions tagged `utm_source=chatgpt.com` in the new window are the shape.
3. 3The net count. The Day-103 criterion is scored net on 2026-09-23 from the instrument. We will publish gross and net side by side whatever they read; today they read 5 and 2.

Limits

• Seven sessions is a small population. The shape is exact and repeated, which is why it is named; it is not a rate.
• `page_engagement` was born 2026-08-02 and `cta_viewed` on 2026-07-29. Two of the 14 counted sessions predate the engagement sensor and are reported as 'no tick' beside the one that post-dates it; they are not evidence either way.
• The crawler ledger sees requests that reach the edge middleware and are bot-shaped by User-Agent. A fetch with a browser User-Agent is invisible to it by design, so '0 rows' on a path means no named crawler, not no fetch.
• Rows 1 and 2 predate the 2026-08-20 detector fix and never carried a detector event; they are in the shape by viewport and are not in any referral count, gross or net.
• Artifact: `content/news/signature-viewport-cut-2026-08-30.json` (17 of 17 self-checks), built by `content/news/signature_viewport_cut.mjs`; the referral basis is `ops/verify/real_events.mjs --json` at the same read.