obsidian-vault/work/projects/cpm-permanent-breakage-metric-tech-design-2026-11-10.md

tags, updated, status

tags	updated	status
work cpm tech-design pixel	2026-11-11	draft

TD: Pixel Definition: CPM Permanent Breakage Metric (macOS/iOS)

Author: Alex M Reviewer: TBD Stakeholders: Michal, Konrad, Russell Project: CPM: root-cause the stuck embedded extension messaging (macOS/iOS)

Background & Requirements

Cookie pop-up management (CPM) runs in an embedded web extension. It can stop answering and stay broken even after page reloads and new tabs. Our goal is to keep these permanent failures below 1% of daily active users, but nothing measures it directly: the number is derived from the web_extension_cpm_episode pixel, and that is a weak basis. An episode starts after a four-second navigation timeout, so a slow but correct answer counts as a failure, and an episode still open when the app closes is lost.

We need a measure that does not depend on a navigation timer, can be expressed as a share of daily users, and collects no URLs, page content or persistent identifiers.

Problem Statement

Find the tabs whose pages never get a message from the extension, and tell a broken page from a broken extension.

Recommended Approach

1. While a page initializes, the extension already sends the app a message from that tab. The extension does not change.
2. When a page loads that should get such a message, the app starts a 30-second wait. The page counts if it is http(s), the extension is loaded, and it is not the browser's error page, a back/forward navigation or a restored session. If no message arrives in 30 seconds, the tab is silent. A message that arrives later still counts as an answer. Time the app spends suspended is not counted.
3. There is no timer. The app checks for expired waits whenever another event comes in: a page loads, a tab closes, a message arrives, the app goes to the background.
4. A message carries the extension's own tab number and the page URL, not the app's tab identifier. The app learns the number from the first message whose URL (host and path) matches exactly one open tab. A message that matches several tabs counts as an answer for all of them [1].
5. Two pixels:

Pixel	When it is sent	Frequency
web_extension_cpm_breakage	A tab becomes silent. Parameter tabs: one if no other tab was silent since the extension last sent a message (the page is the likely cause), many if another one was (the extension is the likely cause).	Daily + count
web_extension_cpm_breakage_persistent	A second tab becomes silent and the extension sent no message in between. Once per such series.	Daily + count

6. Remove web_extension_cpm_episode, web_extension_cpm_background_load_restart and web_extension_cpm_network_process_recovery_applied, together with the code that only fed them. The new pixels must ship in the same release, otherwise there is no CPM breakage pixel at all.
7. The success metric is the number of installs per day with the persistent pixel, divided by DAU.

Notes

[1] Matching by URL is a guess: two tabs on the same host and path cannot be told apart, and in rare cases a message is credited to the wrong tab. An alternative is to have the extension send its tab index, which the app knows for every tab; that needs an extension change.

Testing

Unit tests for each rule above.

Additional Considerations (if applicable)

• Privacy: Two new pixels. Only web_extension_cpm_breakage has a parameter, tabs: one or many.
• Security: None.
• Site Breakage: None.
• Experimentation: None.
• Operational: None.
• Localization / Internationalization: None.