@@ -249,7 +249,34 @@ def exec_expansion(module_path: str) -> str:
             m = _EXEC_DIRECTIVE.match(line)
             if m:
                 skip_options = True
-                if exec_target_file(m.group(1)) not in paired:
+                # `:code: false` is the AUTHOR saying this module is
+                # plumbing for an embed, not documentation (muischeduler,
+                # 2026-08-31 — 12 of its 34 directives carry it). Rendering
+                # it into the machine lane publishes exactly what the
+                # browser lane deliberately hides, inverting the usual
+                # asymmetry, and silently: the browser keeps looking right.
+                # This repo shipped that inversion on all three of its own
+                # unpaired directives before the correction landed.
+                # Skipped, but NOT silently — broken, hidden and absent must
+                # not look alike, which is the whole lesson of this round.
+                opts = []
+                j = i
+                while j < len(lines) and lines[j].strip().startswith(':'):
+                    opts.append(lines[j].strip())
+                    j += 1
+                hidden = any(o.replace(' ', '').lower() == ':code:false' for o in opts)
+                target = exec_target_file(m.group(1))
+                if target in paired:
+                    # Dedupe wins over the withheld marker: the source IS in
+                    # this document, via `.. source::`, so announcing it as
+                    # withheld would be a false statement about the page.
+                    pass
+                elif hidden:
+                    out.append(
+                        f'\n<!-- component rendered from {target}; source withheld '
+                        f'by `:code: false` -->\n'
+                    )
+                else:
                     out.append(exec_expansion(m.group(1)))
                 continue
         out.append(line)
 
@@ -41,6 +41,18 @@
 
 Some prose.
 
+.. exec::docs.home.example
+
+More prose.
+"""
+
+# `:code: false` is the author saying "this module is plumbing for an
+# embed, not documentation" (muischeduler). Rendering it into the machine
+# lane publishes what the browser lane deliberately hides — and silently,
+# because the browser keeps looking right. This repo shipped that inversion
+# on all three of its own unpaired directives before the correction.
+HIDDEN = """# Page
+
 .. exec::docs.home.example
     :code: false
 
@@ -50,7 +62,6 @@
 PAIRED = """# Page
 
 .. exec::docs.home.example
-    :code: false
 
 Source code:
 
@@ -64,7 +75,6 @@
 DIFFERENT_TARGET = """# Page
 
 .. exec::docs.home.example
-    :code: false
 
 .. source::docs/home/video.py
 """
@@ -98,16 +108,19 @@ def _needle() -> str:
     """
     src = (REPO / "docs" / "home" / "example.py").read_text()
     for line in src.split("\n"):
-        # PORTED anchor: upstream looks for a top-level `def`, which its
-        # example modules have. This fork's showcase convention is a
-        # module-level `component = ...` with no functions at all, so the
-        # anchor is the first top-level STATEMENT of either shape. Still
-        # read at run time and never a literal — that property is the point.
-        if line.startswith("def ") or (
-            line[:1].isalpha() and " = " in line and not line.startswith(" ")
-        ):
+        if line.startswith("def "):
             return line
-    pytest.fail("docs/home/example.py has no top-level statement to anchor on")
+    # PORTED FALLBACK: this fork's showcase modules export a module-level
+    # `component = dmc.Stack(...)` and define no functions at all, so
+    # upstream's `def `-only search finds nothing here. The fork-invariant
+    # form is "first top-level statement" — still read at run time, never a
+    # literal, which is the property that matters. Multi-line-string openers
+    # (`X = """...`) are skipped: their first line is a poor anchor.
+    for line in src.split("\n"):
+        if (line[:1].isalpha() and " = " in line and not line.startswith(" ")
+                and '"""' not in line and "'''" not in line):
+            return line
+    pytest.fail("example.py has no top-level statement to anchor the pin on")
 
 
 def test_the_needle_is_really_in_the_module():
@@ -122,7 +135,28 @@ def test_an_unpaired_exec_renders_its_module_source(app_module):
     assert _needle() in out, "the exec'd component's code never reached the prose"
     assert "```python" in out
     assert ".. exec::" not in out, "the raw directive line survived into the prose"
-    assert ":code:" not in out, "the directive's option line was left behind as prose"
+
+
+def test_a_code_false_directive_withholds_the_source_but_says_so(app_module):
+    """The author's signal is honoured, and the gap is VISIBLE.
+
+    Skipping silently would leave the same shape as the defect: a machine
+    document with nothing where a component is. Broken, hidden and absent
+    must not look alike.
+    """
+    out = _expand(HIDDEN)
+    assert _needle() not in out, "`:code: false` source was published to the machine lane"
+    assert "source withheld" in out and "example.py" in out, (
+        "the withheld component left no trace at all"
+    )
+    # Line-exact, not a substring: the marker itself quotes `:code: false`,
+    # so a substring assertion matches the pin's own output. That is the
+    # third time in this round a check matched prose ABOUT the thing it was
+    # asked to find — the UA grep flagged its own comment, and before that a
+    # naive count read fenced documentation as defects.
+    assert not any(ln.strip() == ":code: false" for ln in out.split("\n")), (
+        "the directive's option line was left behind as prose"
+    )
 
 
 def test_a_paired_exec_renders_once_not_twice(app_module):
@@ -194,21 +228,26 @@ def test_every_exec_in_this_repos_docs_reaches_the_machine_lane(client, app_modu
                 continue
             target = REPO / (m.group(1).strip().replace(".", "/") + ".py")
             body = md.read_text()
-            # PORTED: this fork's frontmatter QUOTES its values
-            # (`endpoint: "/attribution"`), so the raw capture built
-            # `/"/attribution"/llms.txt` and every page looked like a
-            # mechanism-4 leak. Strip the quotes rather than the pin.
-            endpoint = re.search(r"^endpoint:\s*(\S+)", body, re.M).group(1)
-            endpoint = endpoint.strip("\"'")
+            # `.strip("\"'")` — a fork whose frontmatter QUOTES its values
+            # (`endpoint: "/attribution"`) otherwise builds
+            # `/"/attribution"/llms.txt`, gets "llms.txt not available", and
+            # sees every page reported as a mechanism-4 leak: a wall of false
+            # failures on a pin that is otherwise right (leaflet, 2026-08-31).
+            endpoint = re.search(r"^endpoint:\s*(\S+)", body, re.M).group(1).strip("\"'")
             url = f"{endpoint.rstrip('/')}/llms.txt"
             doc = client.get(url).text
             anchors = [
                 ln for ln in target.read_text().split("\n")
                 if ln.startswith("def ") or ln.startswith("component = ")
             ]
             assert anchors, f"{target} has no anchor line to check"
-            assert anchors[0] in doc, (
-                f"{url} does not carry {target.name}'s code — mechanism 4"
+            # Either the code reached the lane, or the author withheld it with
+            # `:code: false` and the document SAYS SO. What is not acceptable
+            # is silence, which is the defect this whole file exists for.
+            withheld = "source withheld" in doc and target.name in doc
+            assert anchors[0] in doc or withheld, (
+                f"{url} carries neither {target.name}'s code nor a withheld "
+                f"marker for it — mechanism 4"
             )
             checked += 1
     assert checked >= 3, f"only {checked} exec directives walked; the sweep found nothing"
 
@@ -422,7 +422,21 @@ def _client_names_a_ua(src: str, var: str) -> bool:
     if re.search(re.escape(var) + r"\.environ_base\b[^\n]*HTTP_USER_AGENT", src):
         return True
     calls = [c for m in _REQUEST_METHODS for c in _calls(src, f"{var}.{m}")]
-    return bool(calls) and all("headers=" in c for c in calls)
+    return bool(calls) and all(_names_a_ua(c) for c in calls)
+
+
+def _names_a_ua(call: str) -> bool:
+    """`headers=` is NOT evidence of a User-Agent (muischeduler, 2026-08-31).
+
+    A call passing `headers={"CF-IPCountry": "FR"}` satisfies a `headers=`
+    grep and names no lane at all — this repo had exactly that one, and its
+    mutation check stayed green until the pin asked for the UA specifically.
+    A fleet-wide grep on `headers=` reports clean trees that are not.
+    """
+    return any(
+        token in call
+        for token in ("HTTP_USER_AGENT", "user_agent=", "User-Agent", "USER_AGENT")
+    )
 
 
 def test_every_test_client_user_names_headers():