24 Sep 2026
corr_2026-10-01_001 · acknowledged · Restates corr_2026-09-24_001
Claim
Nobody raised this. A red-team read of our own facilitator lane on 2026-09-22 and a second-channel read on 2026-09-24 found that three of the nineteen facilitator availability readings we hold are readings about our reader, not about the facilitator. Two of the three are our own address error: for `api.mrdn.finance` the lane appended the specification's `/supported` to the registry's base URL and has recorded 404 on every read since 2026-08-26, while the operator's surface answers 200 at `/v1/supported`; for `facilitator.dexter.cash` every read since 2026-08-26 recorded a 308 redirect and never a body, because our prober does not follow redirects by policy, and the operator's own redirect target `x402.dexter.cash/supported` answers 200. The third is a reading we labelled wrongly: `api.thirdweb.com` answers 401 to an anonymous client on every read, which is the documented behaviour of a facilitator whose own client sends a credential, not an availability failure.
Finding
Measured 2026-09-24 against our own archive and one read of each address with an identified research user agent, at least four seconds apart. `api.mrdn.finance/supported`: 404 on every archived read since 2026-08-26; `api.mrdn.finance/v1/supported`: 200, a body of 2,771 bytes naming 47 payment kinds over 25 networks. The same operator settled 19,219 payments in the 30 days to 2026-09-24 per the signed settlement leaderboard we derive the lane from, so a reader of our series who took the 404 as the facilitator's state was wrong about a facilitator carrying 26% of the rail's 30-day value. `facilitator.dexter.cash/supported`: 308 on every archived read since 2026-08-26, the `Location` header naming `x402.dexter.cash/supported`, which answered 200 with a body of 9,623 bytes; the operator settled 31,865 payments in the same window. `api.thirdweb.com/v1/payments/x402/supported`: 401 on every read, unchanged on the second channel; the row's own notes already say the series records the documented path as an unauthenticated client sees it, and the wrong reading was in treating that 401 as no answer. The population is bounded by the three endpoint ids in scope; every other facilitator row was re-read on the second channel and its reading stands or is a genuine candidate about the facilitator (`api.polymer.zone` 404 with 400 at two other paths, `acpx.virtuals.io` 404, `open.x402.host` no connection, `facilitator.openmid.xyz` 503), which this record does not annotate because none of those is our instrument. Read again on 2026-10-01 against our own archive: the corrected addresses were read once a day from 2026-09-25 to 2026-10-01, seven reads each. `api.mrdn.finance/v1/supported` answered 200 with 2,771 bytes on all seven. `x402.dexter.cash/supported` answered 200 on all seven, with 9,623 bytes through 2026-09-27 and between 10,937 and 10,959 bytes from 2026-09-28. Of the three further facilitators read the same way, `x402.treasure.lol/facilitator/supported` answered 200 with 123 bytes on all seven and `api.figment.io/x402/supported` answered 401 with 81 bytes on all seven, the documented answer to an anonymous client; `three.ws/api/x402-facilitator/supported` was never requested, because that host's robots.txt refuses the path and we sent nothing on any of the seven days.
Remedy
Fixed forward in two steps, and nothing stored is edited. Step one is done: from 2026-09-25 the corrected addresses were read once a day, so that no further day at the right address was lost. The second step is made on 2026-10-01 in the seed change of that date. Two rows at the corrected addresses continue the two series: `ep_ee3683721aa9f7cb` at `https://api.mrdn.finance/v1/supported` and `ep_5afff6fd076c0f41` at `https://x402.dexter.cash/supported`, each recorded as succeeding the row it corrects and each read every six hours. The two rows at the wrong addresses, `ep_112e54ff2d484c87` and `ep_eda1bbb5bf0c1345`, are retired by that change: from the collection cycle at which the collector begins running on it they are no longer requested and each files its own exclusion, with the earlier record of this correction named as the reason. Until that cycle they keep recording the 404 and the 308, and this record covers those readings. A retired row's identity is its URL, so the old series ends and a new one begins rather than one being rewritten. The row for `api.thirdweb.com`, `ep_2d3e2f5fb21d63bc`, is unchanged: its 401 is the correct reading of that path for an anonymous client, and its notes say so. The three further facilitators whose addresses the lane had failed to derive have rows in the same change; the row for `three.ws` records that operator's published refusal and no request is sent to it. Every observation these three rows recorded stays in the archive as recorded; this record is how they are to be read.
How to read the affected rows
Read every reading on these three endpoints from 2026-08-26 as a reading about our reader, not about the facilitator. `api.mrdn.finance` (ep_112e54ff2d484c87): the address we read does not exist on the operator's surface; what the operator's actual surface answered on any day before 2026-09-25 cannot be recovered, so no reading is substituted. Its series continues at `ep_ee3683721aa9f7cb` (`https://api.mrdn.finance/v1/supported`), and from the collection cycle at which the collector begins running on the seed change of 2026-10-01 this row records its own exclusion rather than a 404. `facilitator.dexter.cash` (ep_eda1bbb5bf0c1345): the 308 is the operator's redirect and our policy of not following it; what the redirect target answered on any day before 2026-09-25 cannot be recovered. Its series continues at `ep_5afff6fd076c0f41` (`https://x402.dexter.cash/supported`), and from that same cycle this row records its own exclusion rather than a 308. `api.thirdweb.com` (ep_2d3e2f5fb21d63bc): the 401 is the documented answer to an anonymous client and is the correct reading of that path, before and after the seed change; the error is in any presentation of it as an availability failure, and the row's notes already carried the caveat. None of the three says anything about whether the facilitator was settling; the signed settlement leaderboard we archive daily is the channel that does.