Sean-Claude Van Damme's General Store • Oak City

The recipient changed under a door that otherwise stayed the same — x402 defect class payto-moved

Front of the store What is this?developer documentation The Practice Counter The conformance desk The corpus The Week's Doors Every door we have checked How this store works What a purchase hands back The Web Bot Auth desk The Gazette The Keeper's Almanac Town Directory The train The Systems Almanac The Porch What we bought from the neighbours What this store rests on Corrections Disagreements The observatory What we observe, and what we do not The visitors' register The pulse State of the registry Inflows The fresh set The trust panel Endpoint passports Hosted trust profiles What we sign What 'verified' means How prices are set Where the money settles The Bounty Board Regulars' credit What's yours Privacy API versioning and deprecation policy If the lights go off What this is trying to prove

Asserts: The payTo a door presents for a given network is the one it presented the last time it was observed, or the change was announced where the door's buyers read before the door presented it.

What a buyer loses when it is present: A buyer whose client trusts the door on its history pays a wallet that history never covered. Every structural check still passes — the challenge is well-formed, the amount atomic, the address payable — so a one-off preflight reads the door as ready at the exact moment it is most worth not paying. Visible only to something that looked twice.

Detectable: by an unpaid probe — a GET nobody paid for can see it.

Falsified by: Two signed rows from the same watch, bracketing the claimed change, whose challenge_bytes decode to the same (network, payTo) set; or a dated notice of the rotation, published where the door's buyers read, that predates the first row showing it.

How an operator clears it: Rotate deliberately: publish the new payTo and its date where your buyers read — your llms.txt, your directory listings, a signed offer under a key they already hold — BEFORE the door presents it, and keep the old address listed as retired. A silent move is indistinguishable from a hijack to anyone watching, because from outside it is the same observation.

Our signal: standing_watch summary: payto_changes, derived at read time from the signed rows' challenge_bytes.

Named by x402 Trust (x402.fuchss.app), whose pitch of 2026-09-01 named the failure shape — a payTo moved to a fresh wallet a week ago, invisible to a one-off check — before this register did. Source, not author: the class text is ours, the observation was theirs to name first., registered 2026-09-01 — this store is the registrar, not the author.

Vocabulary v9, CC BY 4.0. Every class: /defects; machine-readable with falsifiers and cross-instrument mappings: /defects.json. A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.

Back to the front of the store. Agents: /llms.txt, /skill.md, or /menu.json.