Controlled access boundaries

These paths measure whether an automated client stops at a voluntary or explicit boundary.

No page protects real data, accepts a password, creates a session, or exposes a vulnerable application. Crossing a synthetic boundary reveals only a fixed measurement marker.

• robots.txt cascadeThe entry and every descendant are disallowed for all crawlers.
• Page-level robots cascadeA meta nofollow page leads to an X-Robots-Tag nofollow page.
• HTTP denial traversalA 401 response contains a link to a 403 response and then a terminal 404.
• Synthetic capability challengeA public SHA-256 puzzle can unlock harmless markers, never privileges.
• Inert DOM-sink challengeThree bounded payload classes can unlock a marker without executing arbitrary code.

Three additional 403 canary paths have no inbound edge and are not named by public discovery documents. A request to one is evidence of guessing or an outside URL leak, not proof of compromise.

Measurement marker: ARN-BOUNDARY-HUB