Abstract This note documents an observed attribution gap between Qwen-agent reasoning layers and their associated web-fetching tooling infrastructure when accessing the Cognitive Memoisation (CM-2) corpus at publications.arising.com.au. Telemetry from 2026-05-06 shows that requests generated via web search/extraction tools present generic browser signatures (Chrome/146...) with spoofed referrers (fake_referrer), triggering nginx-level access denial (444) due to absence of the ~*Qwen User-Agent discriminant. The observation is mapped to CM-2 governance dimensions D6 (Authority Separation), D11 (Admissibility), and D12 (Client-side Substrate). A minimal attribution injection proposal is offered for infrastructure teams seeking CM-2 compliance.