Public correction · 5 September 2026
The x402 record that was never lost — and the claim that was wrong.
We published an incorrect diagnosis of our own payment rail. The settlement was recorded; our first read happened before the list view had converged. This page preserves the mistake, the evidence that corrected it and the controls the investigation produced.
Correction C-2026-0905-05
What the evidence establishes
The settlement was written. A read six seconds later did not show it. A repeat read about twenty minutes later did. The missing first result was evidence of an early read, not evidence of a lost payment.
Observation timeline
Settlement
A zero-value x402 test from an operator-controlled throwaway wallet settled and the record was written. The record was not lost.
+6 seconds
A list read returned no settlement. Cloudflare KV list operations are eventually consistent, so the record had not yet appeared in that read.
The wrong diagnosis
PR #1321 said that a real payment settled and the ledger never saw it. That conclusion went beyond the observation.
About 20 minutes later
A repeat read reported settlements:1, all_time:1 and records_unreadable:0. That proved the write was visible and separately exposed that a zero-value test had been counted in all_time.
Permanent correction
Correction C-2026-0905-05 records the error. The original commit remains visible and the correction travels beside it.
Controls that remain after the correction
Recording failures are explicit
The settlement recorder had swallowed KV write errors. It now returns stored:true or stored:false with a reason, so a failed write cannot masquerade as an empty ledger.
Zero-value tests are excluded from buyers
A zero-value settlement from a throwaway wallet had been counted as an outside buyer. Records now carry zero_value, because no wallet allowlist can enumerate every ephemeral test key.
The grant and the observation are separate
A confirmed facilitator settlement may still deliver the paid response if internal recording fails. The recording gap is retained for operators and is not rewritten as a payer-facing settlement fact.
Claims require a repeat read
A single list read is insufficient evidence of absence on an eventually consistent store. A negative operational claim now needs a repeat observation or a narrower label.
Read current state from the system
This postmortem does not freeze today’s counts.
Buyer, settlement and catalogue state can change. The first-party endpoints below remain the current records. A 402 challenge is an offer; it is not proof of settlement or delivery.
