Item 2 — founder counter is REAL or hidden (kills the hardcoded 47/100)

ClaimMeter rendered a fabricated "47 / 100 CLAIMED" (a hardcoded default; the
comment even said "Cosmetic conversion driver… Static here"). Now:

- GET /api/founders/count counts ONLY real paying founders — user_profiles
  where founder_pricing = true AND subscription_status = 'active' (the
  Stripe-webhook-synced mirror, so we never hammer the Stripe API). Cached 5
  min in Redis on top of that.
- If the source is unavailable (Supabase unconfigured, query error, column not
  migrated, client throws) the endpoint returns { available: false } and the
  ClaimMeter renders NOTHING — counter and progress bar both hidden. We never
  fall back to a number.
- A low real count is shown honestly (0 → "0 / 100"); the truth is the feature.

Next proxy at app/api/founders/count. 6 route tests cover real count, low
count, error/unconfigured/throw → hidden, and cache-hit. Suite 271/3260 green,
web build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app.js

@@ -215,6 +215,7 @@ app.use('/api/internal', internalRoutes);
 // A1 S3 — partner attribution report. Internal-key gated (router-level
 // requireInternalAuth); no Next proxy on purpose — never browser-facing.
 app.use('/api/partners', require('./routes/partners'));
+app.use('/api/founders', require('./routes/founders'));
 
 // Session 10 — Sentry's Express error handler catches uncaught
 // errors from every route mounted above. Must come AFTER routes but

src/routes/founders.js

@@ -0,0 +1,70 @@
+/**
+ * GET /api/founders/count — the REAL founder-seat counter.
+ *
+ * TRUTH LAW (Truth-Everywhere Part 2, item 2): the ClaimMeter used to render a
+ * hardcoded "47 / 100 CLAIMED". This counts ONLY real paying founders — the
+ * Stripe-synced subscription records in Supabase (`user_profiles` where
+ * founder_pricing = true AND subscription_status = 'active'). Counting the
+ * webhook-synced mirror, not the Stripe API, is the cache — we never hammer
+ * Stripe. Cached 5 min in Redis on top of that.
+ *
+ * If the source is unavailable (Supabase unconfigured, query error, column not
+ * migrated), we return { available: false } and the UI HIDES the counter — we
+ * never fall back to a number. A low real count is fine; the truth is the feature.
+ */
+
+const express = require('express');
+const { getSupabaseServiceClient } = require('../utils/supabase');
+const { cacheGet, cacheSet } = require('../utils/redis');
+
+const router = express.Router();
+
+const TOTAL = Number(process.env.FOUNDER_SEATS_TOTAL || 100);
+const CACHE_KEY = 'founders:count';
+const CACHE_TTL = 300; // 5 min — the founder count moves slowly
+
+// Injectable for tests (never hits network in the unit suite).
+let _getClient = getSupabaseServiceClient;
+let _cacheGet = cacheGet;
+let _cacheSet = cacheSet;
+function __setDeps({ getClient, cacheGet: cg, cacheSet: cs } = {}) {
+  _getClient = getClient || getSupabaseServiceClient;
+  _cacheGet = cg || cacheGet;
+  _cacheSet = cs || cacheSet;
+}
+
+router.get('/count', async (req, res) => {
+  // Cache first — don't recount on every landing hit.
+  try {
+    const cached = await _cacheGet(CACHE_KEY);
+    if (cached && typeof cached.claimed === 'number') {
+      return res.json({ available: true, claimed: cached.claimed, total: TOTAL });
+    }
+  } catch { /* cache miss/degraded — fall through to a live count */ }
+
+  let supabase;
+  try {
+    supabase = _getClient();
+  } catch {
+    return res.json({ available: false }); // unconfigured → hide, never a number
+  }
+  if (!supabase) return res.json({ available: false });
+
+  try {
+    const { count, error } = await supabase
+      .from('user_profiles')
+      .select('id', { count: 'exact', head: true })
+      .eq('founder_pricing', true)
+      .eq('subscription_status', 'active');
+    if (error) return res.json({ available: false }); // column missing / query error → hide
+    const claimed = Math.max(0, Number(count) || 0);
+    try { await _cacheSet(CACHE_KEY, { claimed }, CACHE_TTL); } catch { /* best-effort */ }
+    return res.json({ available: true, claimed, total: TOTAL });
+  } catch {
+    return res.json({ available: false }); // any failure → hide, never fabricate
+  }
+});
+
+router.__setDeps = __setDeps;
+router.__internals = { TOTAL, CACHE_KEY, CACHE_TTL };
+module.exports = router;