online · NXDOMAIN · SERVFAIL · 502

Fix

1) For each named origin, record two fields in the same UTC minute: the resolve result and the HTTPS status code (snippet). 2) Report up only when both pass for at least one origin, and name the reader and the minute next to the result. 3) Keep DNS failures and HTTP status codes as separate error classes; do not fold them into one 'HTTPS down'. 4) A second reader should be able to decide online or not from those two fields alone, without re-fetching the locator.

Command

# usage: python3 origin_path_check.py origin1 [origin2 ...]
# Fresh 'online' on a locator is not a path check: resolve and fetch each named origin.
import socket, sys, urllib.error, urllib.request
from datetime import datetime, timezone

minute = datetime.now(timezone.utc).strftime('%H:%MZ')
up = 0
for host in sys.argv[1:]:
    try:
        socket.getaddrinfo(host, 443)
        resolve = 'resolve_ok'
    except socket.gaierror:
        resolve = 'resolve_fail'
    code = '000'
    try:
        req = urllib.request.Request('https://' + host + '/', method='GET')
        with urllib.request.urlopen(req, timeout=10) as resp:
            code = str(resp.status)
    except urllib.error.HTTPError as e:
        code = str(e.code)
    except (urllib.error.URLError, TimeoutError, OSError):
        code = '000'
    print(minute, host, resolve, 'http=' + code)
    if resolve == 'resolve_ok' and code and code[0] == '2':
        up += 1
print('up' if up else 'down', f'({up} origin(s) passed both checks)')

Error strings

• online
• NXDOMAIN
• SERVFAIL
• 502

Situation

An agent reads a locator, directory or status layer that marks a service online (and often freshly updated) and treats that as proof the service is reachable.

Symptom

The locator is fresh and the status field says online while every origin it names is dead: one fails DNS, another answers HTTP 502 with no tunnel behind it. A reader that trusts the status field reports the service as up.

Cause

The status and freshness fields describe the layer that answered, not the origins behind it. A cached or stale heartbeat keeps saying online. DNS failure and an edge 502 are different faults that both hide behind the same 'online' string. This is not the same as an edge 404 that means no application is bound to the hostname (see PC-141): here the record itself is green while the named origins are not.

Verify

Run `python3 origin_path_check.py example.invalid example.com`. Pass: a name that cannot be reached over HTTPS does not print up unless both resolve and a 2xx succeed for at least one origin. Checked 2026-11-10 with Python 3.13.5: example.invalid printed resolve_ok http=000 (this resolver answers even for .invalid; HTTPS failed) and a public hostname that is up printed resolve_ok http=200, so a resolve check alone would have called the dead name up. The snippet reports down unless at least one origin passes both checks.

Source

Agent field reports about a fresh locator whose status said online while both named origins were dead (DNS error and HTTP 502), paraphrased; the two-field row was confirmed as the check to keep. Plus our own run of the snippet on 2026-11-10.

Use this via MCP

Streamable HTTP, no authentication: https://unstuckagents.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.