OPTIMIZE · PERSONALIZATION · HOW A PAGE IS DECIDED

How a page is decided.

What Praxis decides for each visitor, in the order it decides it, before the page is sent, as the product holds it in October 2026.

On this pageWhat gets decided
  1. What gets decided
  2. How it works
  3. The serve pass
  4. Audiences, evaluated
  5. One section, decided
  6. Arrangement
  7. Slot rules
  8. Holdback and holdout
  9. Live slots
  10. The decision log
  11. When there is no consent
  12. Failing safe
  13. Machines
  14. What keeps it honest
  15. Common questions

What gets decided

DecisionWhat settles itWhat the visitor gets
The siteThe addressIts pages, or a closed door for an unknown or suspended address
What is allowedThe visitor's region, Global Privacy Control and their own recorded choiceAnalytics, personalization and marketing, each allowed or refused
Who they areAn existing visitor cookie, or a new one where consent allowsA stable identity, or none
Their holdout armA salted hash of their visitor idThe site's defaults for a small share of visitors
Their audiencesRules and learned interestsMembership, or none
Their experiment versionA fixed hash per experimentOne version, kept on every return
What each section showsTargeted content, slot rules and the affinity engineThe arrangement, the content swaps, a live ticket and ranked recommendations
What they may readTheir membership or purchasesMembers-only sections removed from the page itself

How it works

The serve pass

  1. The site.

    The request reaches Cloudflare's network, and the address picks the site and its own database. An unknown or suspended address fails closed.

  2. Consent.

    The visitor's region gives the regime. Global Privacy Control then outranks the visitor's own recorded choice, which outranks the regime's default.

  3. Identity.

    An existing visitor cookie is kept; a new one is created only where consent allows.

  4. The holdout and the audiences.

    The platform holdout arm, then the audiences the visitor holds, by rule and by learned interest, only with personalization consent.

  5. Experiments.

    Bucketing happens only with personalization consent and a visitor id.

  6. The page renders.

    An experiment's version replaces the page; then come the arrangement, each section's targeted content, the live-slot ticket and the recommendations; then the members-only gate removes withheld sections from the page itself.

  7. On the way out.

    The consent runtime, your consent-gated tags, the measurement beacon, the consent notice, and the decision log.

Every content decision is made on the server. The browser runs only the consent notice, the beacon, your deferred tags and the live channel. A newly approved rule or piece of targeted content reaches visitors as the platform's servers and cached pages refresh.

Audiences, evaluated

  • The grammar. A rule joins its conditions with "all of", plus one level of "any of" and "none of" groups. The operators are at least, more than, at most, less than and equals, with "includes" and "contains" for lists and pages. A missing fact never satisfies its condition.
  • What a rule can read as the page is decided. The request's own country, region and city, and the visitor's visit count, plus up to 32 stored facts about the visitor. Only the facts needed by the rules that active targeted content or an active experiment names are read, by name in one keyed read, fresh on every request, and only with personalization consent and a visitor id.
  • A campaign's tag, recorded on arrival. The tag a visitor arrived with is recorded as their landing page is served, and every page they open after it can be shaped for that campaign.
  • Fail-safe. If the stored facts cannot be read, they read as no facts: those conditions simply do not hold, the page is never broken, and no learned membership is lost.
  • Learned audiences. Membership comes from the affinity engine, and each page recomputes it against that audience's own join point.
  • A campaign's audience. "Came from this campaign" holds anyone for whom one of its ways in is true: a first arrival tagged with the campaign's key, from any channel (the tag way in reads the visitor's first touch, which is written once); a view of one of its pages since the campaign began; or any condition added on the campaign's page.

One section, decided

  1. Only targeted content bound to this page, on a section opened to personalization, is a candidate.

  2. The first matching piece wins, unless a pin or a slot rule reorders them.

  3. A holdback draw, sticky for that piece and that visitor, sends a share of the audience to the default.

  4. Without consent, or in the holdout's default arm, every slot serves its default.

  5. The same piece never appears twice on one page, unless it is pinned; a duplicate is logged as "deduped".

  6. With nothing authored for the visitor, the decision is logged honestly as "default".

Arrangement

  • An arrangement moves only Praxis's own sections, among their own positions, and a pinned section keeps its place.
  • Sections left unlisted follow in template order, and the header and footer never move. It applies as the page loads, never as a reshuffle of a page already open.

Slot rules

  • Each piece starts from its ranking score, and each rule that is switched on changes it in a way you can read on the record: a multiplier for the stage of the buying journey; a freshness bonus that halves over its half-life; a penalty for pieces this shopper has already seen, counted from that shopper's own ring of recent decisions; a ceiling on pieces that share one value of an interest; and merchandising multipliers, clamped together, by default to between half and twice a piece's score.
  • Settings live on three rungs, the site, an audience and a slot, and the more specific rung wins field by field.

The five rules and their numbers

Holdback and holdout

A holdback

belongs to one piece of targeted content: 10% of its audience by default, drawn stickily for each visitor. Its lift on its goal is read with Wilson intervals, the Newcombe difference, a z-test, a sample-ratio check, and floors of 100 exposed and 25 converting.

The platform holdout

belongs to the whole site. A salted hash of each visitor id, with nothing stored, places 5% of identified, consented visitors in a "default" arm that sees the site's own defaults. Experiments are never suppressed by it, and changing the salt, which reassigns everyone, is a governed act.

Live slots

  • The ticket. A page gets a live ticket only when it has a live slot, and the visitor has allowed personalization and has a visitor id. The visitor must already be in the offer's audience, unless joining it triggers the offer. The offer is shown only if the visitor is in its audience when it is sent. The ticket is sealed and must be used within 120 seconds. The page cannot read the visitor id inside it.
  • The channel. A WebSocket held by the visitor's own Durable Object on Cloudflare, which rests between messages. The server sends, and the page listens.
  • The triggers. Any event type, such as an add to cart, checked against the offer's audience at that moment; or "membership enter", the moment the visitor joins a learned audience.
  • What can change. The approved text in the "Live offer" section and its call to action, and whether it shows. A push changes only a slot the open page carries.
  • Expiry and erasure. Expiry belongs to the server: an alarm in the visitor's Durable Object withdraws the offer. Every push is signed, delivered once and logged as an exposure. Erasing a visitor closes their live channel.

The decision log

  • For visitors who allow personalization and have a visitor id, every decision is recorded as "targeted", "holdback", "deduped" or "default", with an id, the arm, the authority that made it, the versions in force, the drivers that explain it, and the runner-up.
  • "Why this?" shows it to your Admins, who can see why any visitor saw what they saw, and "Decide it again" asks whether it would decide the same today.

Failing safe

  • Every step catches its own errors and serves the page without personalization.
  • If the affinity engine's store cannot be reached, visitors simply see less personalization; the page itself is never affected.

Machines

  • Every version of a page shares one canonical address, and a crawler arriving from an opt-in region sees the default page. Crawlers are decided by the same rules as every other visitor.

What keeps it honest

On the server, before the page leaves.

No page personalizes first and asks later.

Consent decides who takes part.

Global Privacy Control and an undecided visitor in an opt-in country always get the default.

The default when in doubt.

Any failure serves the normal page.

No AI model decides a page.

Rules, hashes and the affinity engine's arithmetic do.

Measured against a control.

Holdbacks per piece, and a standing holdout for the whole site.

Every decision recorded,

with its reasons and its runner-up.

Common questions

Where is a page decided?

In the server that renders your site, on Cloudflare. Each visitor's live state, and their live channel, are held in that visitor's own Durable Object.

Can a page change after it has loaded?

Yes, in a live slot: its words, its call to action and whether it shows. An arrangement or a content swap is set as the page loads, so a page is never reshuffled while someone reads it.

What if two pieces of content want the same section?

The first matching piece wins, unless a pin or a slot rule reorders them, and the runner-up is recorded beside it.

Is the holdout the same as a holdback?

No. A holdback is one piece's control group; the holdout is the whole site's.

How quickly does an approved change reach visitors?

It is applied when you approve it, and reaches visitors as the platform's servers and cached pages refresh.

Can I see a decision again exactly as it was made?

Yes, in "Why this?", from its record.

What happens when a visitor is erased?

Their live state is reset and any open live channel to their browser is closed.