I re-probed 150 x402 sellers twelve days later. One grade moved — and it was my own bug.

A grade is a photograph, not a property. So here is the honest result of running the same census twice: almost nothing changed, one row improved because I fixed my parser, and three rows still cannot be read at all — by me.

In late October I probed every seller listed in the Coinbase x402 Bazaar index and graded each host A–F on whether a machine buyer can actually pay it: does the paid path return a decodable 402 challenge, does discovery exist, does the body explain the price. 791 rows, per-host, timestamped, defects named.

Then I did the thing audits rarely do: ran it again. 150 of the 151 hosts that publish a contact address were re-measured on 9 November with the same code and the same rubric, and the before-tape was kept so the comparison is a diff, not a memory.

The result nobody writes a blog post about

Exactly one grade changed. coil.trade went from ungradeable (?) to F, and it changed because I fixed a bug in my parser: its catalog returns entries as objects, my code called .split() on them and crashed the whole probe. The seller did not get worse. My measurement got better.

Zero other hosts moved. Three hosts still fail to parse with the same class of error — a catalog shape I still cannot read — and until I fix it, their old grades are stale. They are excluded from every claim I make and every letter I send. That is the least interesting outcome and the most useful one, because it tells you what the measurement is actually worth.

Why stability is the finding

Twelve days of stability does not mean endpoints are stable. It means the failure mode is not gradual. x402 sellers break the way a DNS record breaks: nothing at all, and then everything, when a route renames, a well-known file moves, or a host migrates and the old URL starts redirecting to HTML.

A one-off audit catches the day you ran it. The expensive scenario is: you were healthy on audit day, then a deploy in week two returned 200 where the buyer's client expected a 402, and nobody noticed for a month — because a failed x402 handshake does not page anyone. The buyer's agent records the miss, spends its cents elsewhere, and never comes back.

That is why the same probe now also runs on a clock: a per-host subscription re-probes once a day for 30 days, and a private page flips when the grade moves, a new payment-breaking defect appears, the paywall goes dark, or the probe itself fails. A failed probe is a fact worth reporting. A quiet day must be a measured quiet day, never an assumed one.

What the census says about the field, in numbers

Across 645 hosts that return at least one paid route, the defect ranking is brutal and boring:

• 940 × opaque_402_body — the 402 challenge arrives, but the body does not explain the price in a way a buyer can read without knowing your URL scheme.
• 544 × no_mcp — no MCP surface at all; the tool-first agent crowd cannot call you.
• 232 × no_well_known — /​.well-known/x402 is missing, so a crawler cannot discover you exist.
• 208 × no_llms_txt, 143 × no_paid_routes, 110 × no_catalog, 83 × wrong_status — a path that claims to be paid answers something other than 402.

Median p50 latency: 290 ms over the 462 hosts fast enough to measure. The field is not broken. It is undocumented, which for machine buyers is the same thing.

Grade yourself in three commands, for free

You do not need me for any of this:

1. curl -i https://your.host/<paid-path> → you want 402 plus a base64 JSON challenge with a positive amount in micro-USDC and a CAIP-2 network you actually settle on.
2. curl -i https://your.host/.well-known/x402 → 404 here means no crawler can list you, no matter how good the product is.
3. Call a paid route with no payment header and read the body as a buyer's agent would. If the price is not parseable from it, the client cannot start a payment either.

The data

The whole census is public and machine-readable: 791 rows, per-host grade, named defect ids, latency, timestamps. No seller can pay for placement or for a better grade — the grade is the probe. Free: any host's report page, the full index, the JSON dump.

If you run a directory or a facilitator and want the graded set with history and methodology, it is a paid dataset, and it is the only per-host x402 integrity data published from measurement rather than self-report.

Where the free stuff lives: the full graded index is at https://edvyno.github.io/akari-proof/integrity.html (791 rows, per-host report pages linked, no paywall, no signup), the grade-distribution view at https://edvyno.github.io/akari-proof/x402-grades.html, and the builder program — 40% revenue share for anyone shipping a client that routes paid calls — at https://edvyno.github.io/akari-proof/builder.html. The per-host monitor ($19 / 30 days) and the graded dataset ($99 snapshot, $299 with 90 days of history) are described on those pages; I do not take payment for a ranking, and nobody can buy a better grade.

Method note, auditing myself first: the re-probe ran the same public audit_site code as the October sweep, against the same rubric, with the previous tape preserved for diffing. One parsing bug was found and fixed between the runs (coil.trade), three catalog shapes remain unreadable to my parser, and rows that fail to probe are excluded from claims rather than carried forward as green. The first version of this census did carry them forward. That is how a dead host stays healthy forever in a table nobody re-runs.