Changelog

A new-listings sweep probes the endpoints a pull has just added, in chunks of two hundred, and a run is closed only when its last chunk clears the queue. A run that fills its chunk is therefore left open on purpose and continued by the next one, which the status page already showed as such. Three rows were that. The other ten were not: the sweep worker stopped part-way through a chunk and restarted, and because a new-listings run takes its identifier from the clock, a restart opens a fresh run rather than resuming the old one, so the abandoned row stays open with nobody to close it. The worker event log shows the restarts that made them, on 11 and 12 September. The endpoints those runs had not reached were swept by the run that followed, so the measurement record has no hole; the run table does. They went unremarked for four days because the status page lists the ten most recent sweeps and eleven of the thirteen were older than that. It now states, as a figure of its own, how many run rows are open and not writing, how long the oldest has been silent, and how many others are open by design.

TOLL publishes the gaps in its collector and the gaps in its audit, so it publishes the failures of the tools that produce both. Seven on 15 September. The verification script cleared its port by matching a command line that stops matching once the server is up, so a full run — accessibility, design, colour, overflow, every page type — was measured against a server left from a run two and a half hours earlier whose build had since been overwritten, while the script reported that it was serving the build it had just made; it now clears the port by process id, refuses to continue if anything still holds it, and checks that the process answering is the one it started. The stale-stamp race was then diagnosed wrongly twice, once from a query ordered by identifier instead of by time, which hid the pull that had in fact run through the build, and once by blaming the writer, which already commits a pull in a single transaction; the fault was on the reading side, where a figure counted in one statement was stamped from another, and the stamp now travels inside the counting statement. And the figure gate itself had a hole older than any of this: it asked whether every source of a figure stood at its own instant, so two sources agreeing and a third adrift at an instant of its own was neither compared against them nor counted as unexplained, and a drifted source was invisible. It was found by planting exactly that and watching the gate pass. The gate now tests for an instant at which one source stands alone, and a figure may go uncompared only if the database attests to a reason: every instant a real pull boundary, or all of them inside a sweep that was running. Anything else fails the build. The last two were in the repair of the first: the verification script was edited while a run of it was in progress, and because a shell reads a script as it executes it, the run died on a line that was valid and five sections of completed work went with it; it runs from a copy of itself now, and the first version of that copy named itself with a template whose wildcard was not in the last position, so one fixed filename was created and the following run refused to start. Both are fixed and both are here, because a failure in the repair of a failure is the kind that goes unrecorded. Seven in a day is a class rather than a run of bad luck, and the class is worth more to a reader than the list. Four of the seven were a tool reporting a result it did not have: the verification script stating it was serving the build it had just made while a stale server answered; the figure gate stating that no figure went unexplained while a planted fault sat inside it; and two runs reported as under way, one already dead on an edited script and one never started at all. What they share is a silence that looks like a pass, because a tool that found nothing and a tool that did nothing print the same thing. Three of the four were caught by making the tool fail on purpose — planted faults, a figure stamped with an impossible date, an interrupted run and a restart — and the fourth only because a number moved when nothing should have moved it. Two more were not tool output but readings of evidence, each corrected by looking at the evidence a second time rather than trusting the first look. No new rule follows from any of this. The two already written down are enough: a tool proves it can fail before a zero is believed, and a run that happened before the change does not verify the change. What was new on 15 September was pointing them at the tools that enforce them, which is the one place they had never been pointed. The seventh is the reason that matters. The check written to abolish the excuse category contained a blanket excuse of its own: a sweep row left open was read as a sweep still running, and its window was taken to run from the row’s start to the present, so the oldest of thirteen rows abandoned days earlier would have excused any two instants in the last four days. The companion check that reports whether this is a quiet minute to build in read the same rows the same way and raised an alarm that could never clear, which carries as much information as one that never raises. A run’s window now ends at the last verdict it actually wrote. Three of the seven, counted this way, were a check excusing itself.

An em dash standing alone in a table cell means TOLL has no value to put there. It appears in twenty-three of the site's source files and the design detector counts every one of them as prose, reporting an overuse of em dashes on three pages. The finding is left standing rather than swept: replacing the dash properly means saying, at each site, which silence it is — a registry that publishes no such field, a field published empty, a figure that cannot be computed from what is on record — and those are different statements that only the page in question can make. The endpoint and comparison pages have been through that already and carry the words instead: no counters published, not yet swept, never swept, not ranked, not computable. The rest will be converted the same way as each page type is rebuilt, one at a time and with the reason stated, and until then the detector's count on those pages is expected rather than accepted silently.

Every page type now opens with the same head, tables sit in cards under a tinted head rather than a solid ink bar, and the listing and comparison pages carry the arrangement a buyer expects. Rearranging it surfaced three disagreements between pages. Sweeps run counted every validation that was not unobserved, so a comparison read 0 of 4 where the endpoint's own page read 0 of 0; both use the population the endpoint page uses. An endpoint with no counters was ranked against the endpoints that have them and came out 1,658th of 1,657; it is not ranked. A payee's reach counted declared payment options rather than endpoints. The comparison page's call and payer figures carry the same ids the endpoint pages carry, and the figure check reads it before every deploy.

The script that produces every clean claim about this site cleared its port with a pattern match on the command line. Once it is up, the server's process is named next-server, so the pattern matched nothing: the previous run's server survived, the new one exited with the port already in use, and the readiness check — a connection rather than a status — was answered by the survivor. A full run on 15 September reported 509 design findings and horizontal overflow on thirty page types, all of it measured against a server left from a run two and a half hours earlier whose build had since been overwritten on disk, while the script printed that it was serving the build just made. The port is now cleared by process id, the run stops if anything still holds it, readiness means a 200, the process answering is checked against the one the run started, and the server is stopped when the run ends. Published here because a site that reports its collector's gaps reports its auditor's.

Below 640px three tables stack their columns so a sentence column is readable on a phone. Two things about that were wrong. The row headers and cells used display:contents, which removes an element from the accessibility tree outright rather than restyling it, and the substitute column labels were generated content, which is not read reliably, not copyable and not translated. The cells are ordinary blocks now with explicit table, rowgroup, row and cell roles so the semantics do not depend on how a browser treats a display override, and every substitute label and unit is an element in the page. Verified against the accessibility tree at 375 pixels.

Drawing which networks are declared together surfaced a number that recurs: 851 listed endpoints declare almost every pair of the twelve largest networks, and the figure is the same for pairs that otherwise have nothing in common. A single seller listing the same endpoints on every network it can would produce exactly that signature, and so would several other arrangements. It is recorded here as an open question rather than a finding: TOLL has not investigated it, states nothing about who or why, and will publish what it finds when it does, upheld or not.

The published Pearson's r rose from 0.11 on 10 September to 0.40 on 14 September. Investigated: the same endpoints present at the first and last snapshot show the same rise, so it is not the index changing composition; the rank correlation held between 0.64 and 0.66 at every snapshot, and Pearson across the endpoints outside the top 1% by calls held between 0.53 and 0.56. One endpoint, q verdict resource on www.ax1.vc, grew from 3,147 calls and 246 payers to 52,038 calls and 1,985 payers and now holds 13.3% of all calls counted; removing it alone returns r to 0.10. Nothing in the collector changed. Pearson stays the published figure and is not restated; the rank correlation and the trimmed figure are published beside it, and the sentence each page states is now chosen from the value. All four measurements at every snapshot are published on a page of their own, /ledger/correlation, with the endpoint named and the right of reply.

Screen-reader testing on 14 September found that a reading's value could be announced without the label before it, and the finding was deferred and published here unresolved. Rebuilding the readings as panels did not fix it: the panel flattened to loose text with nothing tying the number to what it measured. Each reading is now a named group, and the value carries its label in its own accessible name, so landing on the figure announces what it is and then what it reads. Verified against the accessibility tree on 14 September 2026.

Pass share is passing over observed on every page; the home and category index had divided by listed. Raw delistings count every endpoint absent at the last pull on every page and in the JSON, which had counted only the unconfirmed ones and now names those as not_yet_confirmed. The curated count includes listed endpoints only. Every figure that appears on more than one page carries its id and snapshot in the markup, and a check that one snapshot yields one value everywhere runs before every deploy. Links in prose are underlined; report outcomes are announced and land on the docket; the measure is recorded as a stated exception.

From 13 to 14 September the design detector used on every redesign phase failed to launch a browser on the build machine and reported an empty list; phases 3 to 6 were recorded as having zero detector findings on that basis. Run against a working browser on 14 September, the same pages carried 42 axe-core violations and real line-length and overflow findings. The violations are fixed; the audit is in the repository as ops/audit-2026-09-14.md.

Pages per payment asset with an index that names every asset TOLL cannot price; a canonical cheapest page per category; three question pages answered from the data; /data, llms.txt and an Atom feed carrying changelog entries, changed snapshots and confirmed delistings; social images per page type with a delisted variant; structured data; a sitemap index; and a footer that reaches every page.

Three comparison pages, each with its check date first and a 30-day re-verification rule; a status page showing every pull, sweep, restart and alert as a row, with the performance baseline.

A delisted endpoint's page opens with a banner, states once that every figure is final, and keeps the presence timeline; the URL never goes away. Every endpoint page gains a pinned form at a snapshot stamp and a citation. Verdicts everywhere are pen marks with their word; the folded rows on ranking pages are drawn as a line where they would have been, naming the wallet and linking its seller page.

The seller cap of three rows now applies to ranking pages only, as Section 6.3 of the specification states. Category, network and seller lists show every endpoint, 100 to a page by path segment; before this they were capped and cut at 300 rows, so most of the index was reachable only through the sitemap. Search gains trigram indexes and a ten-minute cache per query.

Every pull appends each endpoint's full accepts array when it changes, so price and payee changes are dated. Every Ledger page gains a pinned form at its snapshot stamp and a citation with the pinned URL. The JSON under /api/v1 publishes every Ledger page, the delistings and every endpoint, under CC BY 4.0.

Category rules version 1. The site goes live.

Thresholds as stated under burst windows on the method page. First full daily sweep the same day.

A raw delisting is confirmed after 2 consecutive successful pulls without the endpoint. Confirmed is the headline figure, raw beside it.

First quality snapshot at 19:08 UTC. Every listing present at that pull carries it as its first-observed date.