The 2010 set is the large sites of the day plus Tudou, MediaFire, MySpace, Classmates, Rakuten and Ameba. The 2014 set is the large sites again, now including Baidu, QQ, Alipay and Wikipedia, followed by a run through fundraising and charity sites (GoFundMe, GiveForward, Fundly, YouCaring, Razoo, JustGive, the American Red Cross, UNICEF Malaysia, Goodwill) taken in about fourteen minutes.

Not rebuilt: Rakuten and Ameba (too small to read even at full size), an early-2000s Classmates "pick your state" page (not a form), and one duplicate. Six sites appear in both albums: Facebook, Yahoo, Twitter, LinkedIn, Amazon, and Windows Live, which became the Microsoft account.

A screenshot is not a DOM, so every screen was rebuilt as a static HTML page that reproduces the form and nothing else: the same fields in the same order, the same captions, placeholders, hints, button text and terms copy, no logos. The one thing a screenshot can show and a rebuild has to get right is how each field is identified, so the rules for that were fixed before anyone built:

• a field with only grey text inside it gets a placeholder and no <label>;
• visible text beside or above a field gets a <label for>;
• a column of text flush with a column of inputs, the 2010 layout table, gets a table cell and no <label>, because that is what such pages shipped;
• no aria-*, role or data-testid unless an archived capture of the page shows them (see What the archive changed), because their absence is part of what is measured.

The sequence, which is the part that transfers:

Behaviour is the same on every page and comes from data attributes, not per-page code: each form reports signup_attempt, signup_error (with the field and the rule that failed), signup_success and signup_duplicate on window.dataLayer. Required fields are enforced wherever the page did not mark a field optional; whether the user could see that a field was required is recorded separately, from the visible caption text, so the enforcement rule cannot inflate the evidence.

Two things went wrong and are worth knowing. The builders first worked from the thumbnails the saved album page kept (240 to 640 px); the 1024 px originals were one oEmbed call away, so every label-versus-table call and CAPTCHA word was checked again at full size and the first exploration was thrown away. And two builders inferred required where the page showed no marker while a third did not, so four forms accepted an empty submit until the contract was changed to separate behaviour from evidence.

Each page is explored by Bombadil with an extractor that records, per state, every visible control with the role and accessible name Playwright would locate it by, where its visible caption sits relative to it, where the terms text sits relative to the submit button, and the events the page reported. A second pass adds one guided generator: an email-shaped value in email fields and a copy of the original in confirm fields. Everything else is random.

Screenshots by the author, from the two albums above; each links to its photo. The 2010 Amazon screenshot is linked rather than shown, because a typed address is visible in it.

The first version of this note was built from pixels alone, and it was wrong about the thing it set out to measure. Screenshots show what a sighted user saw; they cannot show whether a caption was a <label>, whether a field carried aria-label, or whether a label existed but was clipped out of sight. So the rebuilds were checked against the Internet Archive's Wayback Machine: for each site, the capture of the signup page nearest the screenshot, fetched as original HTML.

Eleven of seventeen page and date pairs had a usable capture within eight days of the screenshot; three more were 84 to 227 days off; Amazon (both years) and Baidu had nothing usable. Where a capture exists it now overrides the screenshot for how fields are identified, and each rebuilt page cites the capture beside the change.

Two things follow. The 2014 story is not "the label disappeared" but "the visible caption moved into the placeholder while the accessible name, on the big sites, often survived": a distinction a screenshot cannot make and a DOM check makes at once. And the original rebuild rules had forbidden copying any aria-* attribute, which biased the first 2014 table toward unlabelled; the rules now let archived evidence override the pixels and require a citation when it does.

The archive also showed things no screenshot could: maxlength on almost every field, type"email"= at LinkedIn, Microsoft and Wikipedia, aria-required at Facebook and Yahoo in 2014, no HTML5 required anywhere, and two labels pointing at ids that do not exist (Twitter's password in 2010, Yahoo's gender in 2010). The rebuilds keep those bugs.

How each text field and select was identified, measured in the page by the same extractor for both albums, after the rebuilds were checked against archived HTML where a capture exists (What the archive changed). Labelled means a real accessible name (a non-empty <label>, aria-label or aria-labelledby, including labels hidden from sight); placeholder only means the only name is grey text that disappears on typing; table-cell text only means a sighted user sees a caption but assistive technology gets nothing; nothing means neither.

Placeholder-only fields went from 0 to 18. The bigger change is what the screenshots cannot show: by 2014 the large sites had moved the visible caption into the placeholder but often kept an accessible name behind it, as aria-label (Facebook), a label drawn inside the field (LinkedIn) or a label clipped out of sight (Yahoo). Read from pixels alone, those forms look unlabelled; read from the DOM, most of them are not. Table-cell captions, the 2010 default, give sighted users a caption and assistive technology nothing.

Each form got 30 seconds of Bombadil: random clicks and typing, plus a nudge that clicks an empty field or the submit button once a field has text. The guided pass adds one generator that types an email-shaped value into email fields (from a pool of three, one repeated, so the duplicate path is reachable) and copies the original into confirm fields.

Forms finished at least once: Goodwill 2014 (1 field), Alexa 2014 (1 field), Alipay 2014 (3 fields), YouTube 2010 (6 fields), UNICEF (Malaysia) 2014 (15 fields). Of the 38 runs on forms with more than five fields, 4 created an account; the rest failed on required in every submit, because thirty seconds of random input rarely fills every field, picks a birthday and ticks a box in the same attempt, and a guided email does not change that. The exceptions are forms whose long tail is selects with a preselected value or optional fields. Field count, more precisely the number of fields that must be right at once, is the friction, and it is measurable without a user study.

The duplicate path shows up as soon as a value repeats: with one address used twice, the guided pass reached "an account with this email already exists" on the forms it could finish.

Bombadil's capture of the rebuilt 2014 Facebook form after a submit: every placeholder-only field marked required, the birthday selects with nothing naming them.

The one-field Goodwill register box is the form the fuzzer finished most often.

The same 33 forms after one scripted pass over the live DOM, changing nothing a user would read except a small label where there was none and an asterisk where a field is required: every placeholder-only or table-cell field gets a <label for> with the text it already showed; a field with neither gets an aria-label; required fields get aria-required and a visible marker with a key; email fields get type"email"; known fields get =autocomplete tokens. The originals are untouched and every change is marked in the markup.

The hardened 2014 Facebook form under the same exploration: each field now has a small visible label and an asterisk, and a "* required" key sits above Sign Up. It also shows the cost of a mild fix. Changing the email fields to type"email"= dropped them out of the page's own CSS, which styled input[type=text], so they render small and unstyled. The fix is right and the regression is real; the same coupling existed on the original sites.

• Rebuilds, not the originals. Every page is a reconstruction from one screenshot. Where the image could not decide something, the rebuild says so in a comment, and those calls are counted below rather than hidden. The most common one cannot be settled from pixels at all: whether a caption was also a <label>. Archived HTML settled it for eleven forms (see What the archive changed); Amazon, Baidu, QQ, GoFundMe, UNICEF and the fundraising sites have no usable capture and still rest on the screenshot.
• One behaviour for every form. Validation comes from one shared script, driven by what each page showed (a "Re-enter" field, "6 or more characters", an agreement box). The originals' own validation, server checks and error messages are not reproduced, so error placement, the fourth item on the 2010 rubric, is not measured: the screenshots were taken before anything was submitted.
• Above the fold only. Several screenshots stop before the submit button or the terms (Microsoft 2014, PayPal, UNICEF). The rebuilds end where the image ends, with an invented button where one had to exist.
• One day each. Each album is one sitting, one browser, one locale per site. Yahoo is the Malaysian site in 2014 and the US site in 2010.
• Thirty seconds of fuzzing. Each exploration is short and unseeded (Bombadil 0.7.10 has no seed option), so the run columns are indicative, not stable figures.