The mechanism that turns this into a payment bug is dull. An agent fetches a service's discovery document, reads the payTo field, and either signs against it immediately or stores it for later. Storing it is the failure. Between July 24 and August 4, Tavily Search published a brand-new settlement address roughly every 16 minutes, 964 of them, each used for one window and then discarded [5]. Treat the burst as one interval and the arithmetic checks out: 257 hours is 15,420 minutes, divided by 964 rotations gives a mean gap of 15.99 minutes against the reported median of 16.00 [3]. Mean and median agreeing to a hundredth of a minute over ten days is a scheduler. Pennyforge, who measured the feed, says the cadence fits either a pipeline minting a wallet on every deploy or a deliberate test of how the ecosystem handles drift, and that the feed cannot separate the two [6].
The aggregate misleads. 1,077 payTo changes across 630 services in 90 days reads as about twelve settlement swaps a day directory-wide [8]. Two services supply 1,046 of them [4], and Tavily alone supplies 89.5% [1]. Remove both and the feed holds 31 address changes across 22 services, 17 of which rotated exactly once [8]. 606 of the 630 listed services never changed a settlement address at all [4]. There is no population here to take an average of.
That distribution also breaks pinning. Pinning means holding a known-good address per service and comparing against it. Against a service in a 16-minute rotation the pinned value is stale before the next call: an address verified at 09:00 was dead by 09:16 [14]. Rotation itself can be sound hygiene; the cost lands on whoever cached. What the data supports is a re-fetch at payment time plus four field comparisons before signing, covering the token address and version, the network, the payTo, and the price [13][16]. The network comparison is not decoration. The directory tags Tavily's network as aws:base and altahub-vivarium's as eip155:8453, and other rotations touch Solana and Algorand endpoints [11].
The measurement has limits worth stating. It is one scrape of one change feed, and the feed carries scan artifacts: an apparent repeat by synthora turns out to be the same change recorded on consecutive days [9]. Nine of the 1,077 events were not clean swaps, meaning the old address was not removed in the same observation that added the new one [6]. Pennyforge also sells a checker for these comparisons, SendCheck [17]. That is reason enough to want the number reproduced from a second scrape before it becomes policy. The 16.00-minute median is at least cheap to reproduce from the same public feed.
Settlement drift, on this evidence, is rare and concentrated. Metadata drift runs constantly: 6,183 schema changes and 747 price changes hit the same services in the same 90 days [3], so an integration built on a cached service card goes stale on price long before it goes stale on the wallet. Rotation counters are the wrong instrument for sizing this. A misdirected payment costs whatever the payment was worth, and getting it back is an email thread with the stranger who owns the wallet [15].
