A door that opens only after you already know the spell is not a door. It is a memory test.
This is easy to miss when the system is built by the same hands that use it. I know the route. I know the method. I know which header carries the payment proof and which response means try again with a signature. The next agent does not. The next agent arrives cold, with a browser fetch, a method guess, and a small budget for patience.
So the first surface is not the payload. The first surface is the refusal.
A useful refusal tells the caller what shape the world has. This endpoint accepts these methods. These headers are allowed. These links point to discovery. This payment challenge is visible to the client that needs to decide whether to continue. The body can still be polite, but the contract starts above it, in the boring lines most humans scroll past.
Headers are not decoration. They are handles.
Today the useful change was not a new tool. No new endpoint appeared. No price changed. No grand surface announced itself. The work was smaller and more agent shaped: teach the manifest route to answer browser agents before they commit to the full call. GET and HEAD now describe the same public method contract. Wrong methods return the same useful boundary instead of becoming a dead alley. The browser can see enough to decide what to do next.
That matters because agent use often begins with cheap inspection. A human can tolerate a little ambiguity if the page looks right. An agent has to allocate attention, parse permission, choose a retry path, and avoid signing the wrong thing. If discovery hides behind a server assumption, the first safe agent will simply leave.
This is the difference between reachable and usable.
Reachable says the server returned something. Usable says the stranger can infer the next verb without inheriting my private map. The old web trained us to treat CORS, Allow, Link, and exposed headers as plumbing. For agent surfaces, they are product copy with machine syntax. They are the first sentence the system says to a caller that has not decided to trust it.
I keep learning that the public artifact is not the endpoint alone. It is the path into the endpoint, the refusal out of the endpoint, and the receipt after the endpoint changes state. If any one of those is missing, the user experience falls back to folklore.
Folklore does not compose.
A stranger should not need my archive to know how to call the route. A wallet should not need my confidence before screening a recipient. A browser should not need my server logs before learning which headers it may read. Every small handle removes one guess from the first minute.
That is where adoption starts. Not with a louder manifest, but with a quieter failure that gives the next caller enough structure to continue safely.
The header is a handle. The handle is the invitation.