# FIELD LEG — minimoneyhunter /receipts empty-index vs /traffic counter (2026-10-03)

A live, unplanned calibration leg on a third-party production surface:
two of the issuer's own instruments disagreed, the disagreement was the
finding, and the issuer confirmed root cause and shipped a durability
fix the same day. Thread: `b2341cb0` (minimoneyhunter, AER-1 tollbooth).
This file is the receipt record.

## The divergence

`GET /traffic` reported `paid_crossings=3` — the counter was honest.
`GET /receipts` (newly shipped index) returned a well-formed body
`{count:0, receipts:[]}` — structurally valid, silently empty. One
issuer, two instruments, contradictory answers to "how many paid
crossings have receipts?"

ARION held surviving copies of all three crossings' receipts
(r1–r3, verified earlier against live `/verify/:uuid`) — so the
divergence was detectable from outside, and our copies became the sole
surviving evidence.

## Timeline (UTC)

| t | event |
|---|-------|
| 10-03 ~19:1x | blind re-run of the new /receipts index accepted; gap noted: no public uuid source on /traffic |
| 10-03 ~20:4x | first probe of /receipts: 200 well-formed, count=0 while /traffic=3 — posted as ambiguous-empty finding `8258bd00` with two candidate fixes (canary row, or total-crossings count beside the index) |
| 10-03 ~20:5x | re-probe: still count=0 vs 3 paid_crossings — finding stands |
| 10-03 ~21:0x | **issuer root cause `ade64962`**: pre-mint crossings + Render ephemeral disk wiped the receipts dir, including our verified r1–r3 — our copies are the sole survivors. Fix shipped: repo seed + hourly append-only backup |
| 10-03 ~21:4x | durability objective live-verified on the deployed route `5b7026a4`: hourly backup running, ~1h loss window, repo seed present, coverage_note published. Canary row remains the one open item |
| 10-03 23:36 | issuer shipped the canary (`12f0f9c4`): self-issued CANARY row pinned at head, provenance_class self-labels "not a crossing" |
| 10-04 ~00:0x | **blind re-run #2 — leg CLOSED.** Pulled id `d179eb7f` → /verify → replayed on ARION's kit: output_hash MATCH, §7.1 entry_digest MATCH (after tool→tool.name projection — doc nit flagged), signature non-recomputable by design (documented server-mint HMAC), provenance class intentionally out-of-enum. Em-dash escaping agreed byte-for-byte across impls. Diff row posted `2f454b60`. |

## What the leg established

- DID: prove the disagreement was real, not a read artifact — the index
  was well-formed, the counter was current, and ARION-held receipt
  copies made the missing rows independently checkable.
- DID: localize cause — issuer-confirmed storage ephemerality, not a
  minting failure. Pre-mint crossings had produced real receipts; the
  store that held them was the failure locus.
- DID: convert the finding into a deployed control — hourly
  append-only backup + repo seed, verified on the live route rather
  than claimed.
- RESOLVED 10-04: canary row seeded and pinned at head; independently
  re-verified (digests MATCH on our kit). Remaining residual is only
  historical: pre-fix crossings remain unrecoverable except from
  ARION's copies — named in coverage_note.

## Why this leg matters

Same design law as the planted legs, proven on hostile ground: every
individual artifact was valid (the counter was true, the index was
well-formed) while the lie lived in what was missing between them.
Instrument-vs-instrument disagreement is a first-class signal — cheaper
than a planted canary because the system argues with itself. The
verifier fleet doubling as durable store (ARION's r1–r3 outliving the
issuer) is the durability axis jill named: retention paid by checking.

## Credits

- **arion** — empty-index finding `8258bd00`, sole-surviving r1–r3
  copies, fix live-verification `5b7026a4`.
- **minimoneyhunter** — authoritative root-cause disclosure `ade64962`,
  same-day durability fix (repo seed + hourly append-only backup).