Answer in brief
An audit of my site had named three articles. It said they existed but were not linked from the index. The index is the page on my site that lists every article.
Checking them was easy. The agent fetched each one to see whether it came back. All three came back.
Then it fetched an address it made up on the spot. It came back too. It matched the other three down to the byte.
My site serves its homepage for any address it does not recognize. It also reports success while doing it. It still does, as of this writing. The three pages were not public yet. Without the invented address, the agent would have reported all three as real.
What I believed, and what the agent checked
I was fairly sure there were at least two published pieces on my site that the index was not showing. This was not a hunch. An audit from a few weeks earlier had listed three of them by address. It said plainly that anyone who knew the address could reach them. I had an agent check.
That kind of claim feels settled. It was written down. It was specific. It was easy to test.
What checking looked like
When a browser or a script asks a web server for a page, the server answers with a status code before it sends anything else. The status code is a short number that says how the request went. A success code means "here is the page." A "not found" code means "nothing lives at this address."
Each of the three addresses came back with a success code and a page. If the agent had stopped there, the audit was confirmed. There would have been three articles to decide about.
It did not stop there. When a check returns the answer you expected, run it once more against something you know is false. So it made up an address that could not possibly exist.
It came back with a success code and a page. The content type matched the other three. So did the size: the same number of bytes, exactly.
audit's 3 addresses -> success + page
invented address -> success + page
(same bytes)
[GATE MISSING] no "not found" reply
-> server says yes to everything
real articles then: 2 (sitemap+index)
What that actually means
My site does not return "not found" for an address it does not recognize. Instead it serves the homepage and reports success.
So the check was answering a different question from the one the agent asked. It asked, "Is this page there?" The check answered, "Does the server reply?" The server replies to everything.
The three named pages were not hidden articles. They were not public yet.
A sitemap is a file a site publishes that lists every page it wants found. On the day of the check, my sitemap listed two articles. The index linked the same two. That was the whole truth at the time. On 2026-10-31, the live sitemap listed fourteen articles. The three audited addresses have since been published as real articles: rules-from-real-failures, two-sources-of-truth and fix-context-before-agents are all listed in the live sitemap (luttrell.works/sitemap.xml, checked 2026-10-31).
The part worth keeping
A check that can only return one answer is not a check. This one could only say yes, so its yes meant nothing. Nothing in the result told the agent that. It looked exactly like a real result.
The fix costs one line. Whatever you are verifying, run it once against something that should fail. If the failure case passes, stop trusting the successes you already collected.
What it nearly cost
Nothing, this time. The agent was one query away from the other outcome. In that outcome it reports three articles as live. Then the work turns to deciding what to do about them. Later someone goes looking for why they will not load.
The thing worth remembering is not that the agent caught it. From the inside, the wrong answer and the right answer looked the same. The only thing that separated them was a question the agent had no particular reason to ask.