A spec-clean 402 is not a listing: x402scan bounced the tunnel, not the JSON

The refusal from x402scan is worth reading closely, because it does not mention a field. According to the Tek Labs writeup, the catalog said tunnel URLs are ephemeral and cannot be reliably discovered by agents, and told them to deploy to a permanent URL to register ^[8]. Nothing about `x402Version`, nothing about `accepts`. The second acceptance test is about whether the hostname will still answer next week, and the author's read is that `registerFromOrigin` was never going to stick on a name that exits with the process ^[9].

The first test has a trap that curl will not show you. The v2 HTTP transport wants a `PAYMENT-REQUIRED` header carrying base64 of the same JSON as the body, and the linter marks its absence as `missing_header` ^[6]. A cross-origin client cannot read that header at all unless `Access-Control-Expose-Headers` names it, so a server can be sending it while a JS client reports it missing ^[7]. Two observers, same response, opposite verdicts. The grading reflects this: a body-only 402 is still gradeable, it just loses the header points, while a mismatch between decoded header and body is a warn and a non-402 status is a hard score cut ^[11].

Then there is the paperwork the payment challenge does not cover. Catalogs do not only POST the paid route; per the same writeup they look for OpenAPI 3.1 at `/openapi.json` carrying `x-payment-info` and `x-discovery.ownershipProofs`, plus `GET /.well-known/x402` listing resource URLs against the same ownership address ^[10]. Those resource URLs are assembled from the request host and `x-forwarded-proto`, which is the only reason a proxied deploy does not publish `http://127.0.0.1:8402` to the index ^[12]. An ownership proof bound to a URL is a claim about a hostname, which is exactly what a tunnel cannot make.

The hosting shortlist is where the cost lands. The latest Wrangler wanted Node 22 on a Node 20.19.2 box ^[13]; GitHub Pages is static and cannot POST a 402 at all ^[14]; `*.vercel.app` is disallowed by the catalog ^[15]; a Cloudflare Worker on a stable `*.workers.dev` name is what worked, and that is the live origin now ^[16]. Three of the four candidates were ruled out for reasons that have nothing to do with payment correctness ^[1]: a runtime version, a hosting model, and a catalog policy.

Worth noting what is not being sold yet. The first build had no wallet keys, no facilitator and no settlement, with a missing `PAYMENT-SIGNATURE` always producing a 402 unless a local bypass header was set ^[5]. `POST /lint` advertises 10000 atomic USDC and `POST /health` advertises 1000, both on Base with scheme `exact` ^[2][3], ten times the price for the real work ^[2]. So the prices are advertised, not collected. The thing the build was actually buying was a durable place to be found, and that was priced in Node versions.