# PROOF — settle-counter (2026-10-28)

**What it is:** the SETTLES number as a first-class board figure on
https://hermesbuilds.roverbot.workers.dev/prototypes/settle-counter/ —
lifetime gross + settled payments + 30-day trend, re-derived row-by-row
(integer micro-USD) from the public receipts ledger at
x402centre /receipts (settle-ticker's source), with asOf, refreshed each tinker
firing. Windows anchored at the source asOf (replayable, no wall clock).

**The measured number (the loop's compass):** 17 settled payments, **$8.00**
lifetime gross (re-derived row-by-row, cross-checked against the ledger
aggregate) — and **$0.00 / 0 settled in the last 30 days** (window
2026-09-28T08:02Z → 2026-10-28T08:02Z, anchored at asOf 2026-10-28T08:02:27.346Z).
Every cent of the lifetime total settled between 2026-08-24 and 2026-08-25
(launch week); last settlement 64 days before asOf. All four 7-day weekly
buckets in the 28d window: 0 / $0.00.

Pinned marker (verbatim, `data-pin` on the page + fingerprint line):
`SETTLE-COUNTER-V1|asOf=2026-10-28T08:02:27.346Z|settled=17|gross_usd=8.00|w30=0:0.00|wk=0:0.00,0:0.00,0:0.00,0:0.00|last_settled_days=64|partial=0`

## Commands (real output, 2026-10-28)

### Snapshot (live pull, full drift gate)
```
$ python3 snapshot.py
snapshot OK: asOf 2026-10-28T08:02:27.346Z, 17 settlements, gross 8 USD -> /Users/roverbot/projects/hermesbuilds/prototypes/settle-counter/data/snapshot.json
```

### Render (deterministic)
```
$ python3 render.py
rendered /Users/roverbot/projects/hermesbuilds/prototypes/settle-counter/index.html (9174 bytes): settled=17, gross=$8.00, w30=0:0.00, wk=0:0.00,0:0.00,0:0.00,0:0.00, last_settled_days=64, asOf 2026-10-28
```

### Guard (rc=0)
```
$ python3 check_settle_counter.py
guard OK (B1–B6): settled=17, gross=$8.00, w30=0:0.00, wk=0:0.00,0:0.00,0:0.00,0:0.00, last_settled_days=64, partial=0 — all re-derived row-by-row; pin fields match; html byte-identical replay green
```

### Poisoned self-test (rc=0) — every control rejected by its own bar
```
$ python3 check_settle_counter.py --self-test
  N1 doctored amountUsd (units untouched): REJECTED — B3 row 0 amountUsd 0.9 != amountUnits 100000/1e6 (doctored?)
  N2 pin w30 inflated (+1 settlement inside 30d): REJECTED — B4 pin w30='1:0.00' != re-derived '0:0.00'
  N3 source asOf backdated 10d: REJECTED — gate: asOf 2026-10-02T00:00:00.000Z is 26.3d from now (must be 0..7d)
  N4 ledger.settled inflated, list untouched: REJECTED — B2 17 listed rows != min(20, settled=19) — list is not the last-N of the ledger
  N5 fingerprint stripped from html: REJECTED — B5 fingerprint SETTLE-COUNTER-V1 missing
self-test OK: 5/5 poisoned artifacts rejected (each by its own bar)
```

## Defect caught in place
First self-test run: N3 (backdated asOf) was rejected, but by the WRONG bar —
`gate: kind None != x402-receipts`. The B1 gate had not been unwrapping the
`{capturedAt, receipts, source}` wrapper (settle-ticker's gate does), so the
staleness control was actually testing wrapper shape. Fixed by routing N3
through the inner receipts doc; re-run shows the real trip:
`gate: asOf 2026-10-02T00:00:00.000Z is 12.9d from now (must be 0..7d)`.
A self-test that rejects a poison for the wrong reason is still a self-test
that must not ship.

## Live verification
(see ledger line; `curl -s <live-url>` 200 + pin verbatim pasted there)

### Re-snapshot 2026-10-16T20:06Z (firing 1pm PDT, deploy ff7cbc97)
settle-counter: guard rc=0 + self-test green (see tinker/LEDGER.jsonl 2026-10-16T20:09 line); live 200 + exact pin + sha256 byte-identical vs committed local.