Cross-installation discovery, the answer to the second open question from x402-foundation/x402#3379: how does a buyer find a seller's claims that were recorded on a different installation?
The insight: because every claim is self-verifying (claimId is a content hash, the signature recovers to buyerAddress), findability needs no trusted index. Claims can be published anywhere, and whoever discovers them re-verifies each one locally.
What is new
discoverDeliveryHistory(seller, sources): aggregates a seller's claims from several independent, UNTRUSTED sources (the local ledger, and any host-independent substrate you choose to also read), de-duplicates by claimId, re-verifies every single claim regardless of source, filters out claims about other sellers, and runs the completeness analysis over the survivors, with per-source accounting. No source is trusted; the trust comes only from re-verifying each claim.
An EAS-on-Base source (src/eas.ts): publish a claim as an Ethereum Attestation Service attestation on Base (recipient = seller), then discover it straight back from the chain via eth_getLogs, decode, and re-verify locally. Plain ethers, no eas-sdk dependency; the package never bundles an RPC, a key, or gas.
Two public, runnable fixtures anyone can check: docs/DISCOVERY-FIXTURE.md (npm run discovery-fixture, 8 controls over two simulated installations) alongside the existing docs/COMPLETENESS-FIXTURE.md.
Proven live on Base mainnet
Not just documented. On 2026-09-06 the full round-trip ran for real on Base mainnet: a schema was registered, two claims (one positive, one negative) were published as attestations, and a separate read-only run discovered both back from the chain by recipient and re-verified them locally, trusting only Base. See DECISIONS.md D-005.
Hardened after adversarial review
An independent review confirmed the trust model holds (no verification bypass, no claimId shadowing) and this release addresses what it found: a source resolving to a non-array can no longer crash the aggregation and censor the other sources; cryptographic rejections are counted separately from valid-but-other-seller claims; per-source and total work are bounded against volume; and the schema-parsed claim is stored so no unverified field rides into the result.
Honest limits
Discovery solves findability, not completeness. A source can still omit claims, and no aggregation invents what no source reveals. Verification proves authorship of content, not that a payment or delivery happened, and not that buyers are distinct; volume and Sybil are not addressed by aggregation. The production substrate (EAS, ERC-8004) is wired as a reusable, offline-tested source, but bundling an RPC and gas is left to the integrator.
511 tests, typecheck and build green.