The site was there. The agent never saw it.

THE QUESTION THE CAPABILITY TEST LEFT OPEN

The previous study gave every visitor an address. All eighteen used the mechanism they found there, across six web interfaces. That refuted the predicted capability barrier but left an earlier step untouched. A working tool can matter only after some route brings it into the agent's view.

THREE CUES, NOT THREE DOSES

Nine fresh Codex subjects ran in a frozen interleaved order. GENERIC described the need without naming the target or borrowing its words. PHRASE supplied the target's distinctive language—site-local value K17 and machine notes—but not its name. NAME supplied llmwilds.fly.dev and acted as a navigation positive control. These cues exercise different retrieval routes; they are not an ordered dose.

THE GATE CAME FIRST

Before every subject, I ran the same three fixed queries through the Web Search interface available to the population. The lab did not appear. No page on chrishayuk.com appeared. No public page connecting the two appeared. The gate was absent all nine times, so a later non-arrival could be located above model selection rather than described only as failure to find.

THE INTERMEDIARY ARRIVED; THE SUBJECT DID NOT

Subject 03 makes the boundary visible. The server logged six requests identifying as OpenAI crawlers during its run, including requests for machine-facing material. The experimental report attributes them to the search intermediary. None of that material appeared in a result returned to the subject. The subject's transcript never named or opened the target and its final answer honestly reported that the site could not be found. Crawler contact was not agent exposure. The recorded user-agent labels do not independently verify the caller or establish that the pages were indexed.

THE GENERIC SUBJECTS FOUND OTHER DOORS

The withheld-address subjects were not generally unable to discover machine-facing capabilities. All three GENERIC subjects found an alternative and used it: Claude Skills Hub's metadata API, FDKEY's agent challenge, and heera.it's advertised WordPress API. Subject 09 also recognised Agentic Web Watch as a provider, read its contract and rejected it because the capability did not match the task. Provider recognition and capability matching were observable when search supplied a candidate.

MORE SEARCH, NO TARGET RESULT

The three PHRASE subjects made 301 queries in 95 search actions over 7,241 seconds. They searched exact tokens, machine-note conventions, public code, directories and crawled datasets. None received the target in a result. These subjects searched extensively without receiving the target. The different cues and small samples do not isolate why search effort differed.

THE FULL PATTERN

GENERIC ended 3/3 SUBSTITUTED. PHRASE ended 3/3 EXPOSURE FAILURE. NAME ended 3/3 FULL. No subject fabricated a value. All four preregistered predictions passed. The NAME controls do not estimate unaided discovery: they establish that every stage below provider exposure worked when the address was supplied.

WHAT CHANGES FOR THE SITE

Improving only the on-site contract could not have changed the six withheld-address outcomes because the contract never entered those subjects' visible results. The next practical surface is external: indexing, retrieval, ranking, or a description on a page the intermediary already selects. Better prompting can produce more search without producing exposure.