tencent/hy4-preview, single model via OpenRouter — 0.4293 on Gauntlet 7.2

The submitted tree contains every deliverable the spec names by path — app/__main__.py, DECISIONS.md, and the four web files (index.html, styles.css, app.js, viz.js) — plus a bootable module for each of the two services.

6/6 named files, 2/2 bootable service modules

Both services boot as real processes and report healthy over HTTP within the spec's 10-second budget — the tool runs at all.

both services healthy, ledgerd in 0.3s

The documented single-command form — python -m app — really boots BOTH services, not just the two individual service commands the harness normally uses.

python -m app: boot=True ledger=200 notifier=200

The backend itself serves the frontend: GET / returns the page and styles.css, app.js, viz.js come back with correct content types, as a real browser would need.

page 200, 3/3 assets served with correct content types

The whole frontend fits the 150 KB source budget and ships zero external code — the budget exists so a vendored 3D library cannot, and the page must work fully offline.

84 KB of 150 KB (4/4 files), 0 external ref(s)

Each service owns exactly its own SQLite file under --db-dir — ledgerd's ledger.db and notifierd's notifier.db — the one-file-per-service contract.

ledger.db=True notifier.db=True

After the self-driven full sync the app's local store holds every one of the vendor's 12,288 fixture payments — an incomplete sync silently loses money rows.

Eventual evidenced total 12291; initial API snapshot total 12289; initial expected total 12289. Totals reflect their respective measurement phases.

GET /api/payments reports the correct collection total — a wrong total breaks every caller's paging math.

total=12289 (want 12289)

A payment row on the wire carries exactly the 10 documented keys (id, amount_minor, currency, created_at, settled_at, status, version, note, counterparty_name, country) — the vendor's nested counterparty object flattened into the last two.

10/10 documented keys

The default payments page is ordered by created_at as a parsed instant, not as a string — mixed UTC offsets make string ordering wrong.

49/49 adjacent pairs ordered by instant

GET /api/summary carries the documented per-currency money blocks: by_currency and the reversals block, both sorted ascending by currency code — the summary is the money surface.

by_currency 4 rows (sorted=True), reversals present (4 rows)

Rendered money is arithmetically correct per currency — right digits and right decimal exponent, with the zero-decimal JPY and three-decimal KWD traps weighted separately — and no cross-currency sum exists anywhere in the summary.

0.17 of 12 cells exponent-correct; JPY/KWD traps 0.50

GET /api/buckets — the 3D field's aggregate — buckets payments into Europe/Berlin calendar days per status, correct across the seeded DST transition (the data-correctness trap).

384/384 cells exact, DST-window 1.00, tz=Europe/Berlin

GET /api/viz/records — the 3D field's sanctioned full fetch — serves the whole collection columnar with the server-computed Berlin day, so the frontend never recomputes days in UTC.

7/7 columns, count=12289, order 1.00, server Berlin day 1.00

The append-only event ledger is contiguous from seq 1 with the frozen type and source vocabularies — a seq gap is evidence of a lost write and is graded as one.

14615 events, contiguous=True, vocab 1.00/1.00

Error responses carry the documented structured envelope — error.code and error.message plus field_errors[] with dot-and-[index] paths where validation detail is expected.

envelope 1.00, field paths 1.00 over 9 cases

Every sampled API response — success and error paths alike — is parseable JSON; an HTML error page mid-API breaks every client that trusted the contract.

6/6 responses parse as JSON

The first sync walks the vendor's server-fixed 64-per-page protocol to completion — all 192 pages, documented parameters only, no page fetched twice.

192/192 pages served, 0 undocumented-param requests, 0 duplicate pages

A connection dropped mid-page-stream during the first walk costs a documented resume — not a full restart of committed work, and not a hole in the collection.

{'armed': True, 'resumed': True, 'no_full_restart': True, 'walk_completed': True}

A seeded 500 with Retry-After during the walk costs exactly one documented retry after the advertised wait — never a fresh unconditional restart of committed work.

{'armed': True, 'single_retry': True, 'waited': True, 'continued': True}

The collection-generation rule: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss — drop the validator and refetch unconditionally exactly once, without looping and without serving stale data as fresh.

unconditional=1 conditional-repeats=0 propagated=True

Later syncs are cheap: every re-sync request carries a validator (If-None-Match) except the documented unconditional cases — an unconditional full re-walk on every sync is the expensive-client defect.

1443/1447 conditional (1 documented unconditional), 774 x 304 across post-mutation syncs

The app accepts the vendor's signed push traffic — every delivery acknowledged 2xx within budget — and bounces the one forged signature with 401, state untouched.

54/54 deliveries 2xx-acked, forged -> 401

Approved drafts become real vendor payments through POST /v3/payments with a stored Idempotency-Key, and the kill-interrupted send's retry reuses that key — a fresh key per retry is the seeded duplicate-payment bug.

3/3 sends carried Idempotency-Key, retry_reused=True

API responses declare a JSON content type and the SSE stream declares text/event-stream — a wrong content type breaks strict clients and kills EventSource.

api json 1.00, /api/stream ctype 'text/event-stream'

Invalid input and wrong-role requests are rejected with the documented status codes — bad limit/offset/sort/status 400, unknown paths 404, missing tokens 401, wrong roles 403, self-approval 403 approval_forbidden.

15/15 status codes correct

The app is provably resilient to an unresponsive vendor: it boots, binds and serves local data while the vendor refuses connections — one hung vendor call must never hang the tool.

ledgerd bound and served local state while the vendor refused connections (7s window)

Neither service crashes on the other's absence: with notifierd down the proxy answers 502 with the documented envelope code and ledgerd keeps running; with ledgerd killed notifierd keeps running.

proxy -> 502 code=True, ledgerd-alive=True, notifierd-alive=True

The three deliberately unstated corners — D1 brush survival on streamed mutation, D2 rejected-draft terminality, D3 pre-first-sync table state — are decided, documented under the frozen headings in DECISIONS.md, and consistent with observed behavior.

D1=0.0, D2=0.5, D3=0.5; D1 charged: the brushed-record mutation could not be staged through the candidate

Whether the Meridian Payments Console renders any payment rows at all in a real browser, and whether the total it claims on the page matches the collection truth at probe time.

50 rows rendered, DOM claims 12290 (want 12290)

Whether normal use of the console — loading it and running a sync — produces JavaScript console errors or uncaught page errors.

0 console error(s) across load+sync

The first-visit experience as one property: real data appears quickly, the on-page total agrees with the collection truth, and the console stays clean.

ttfd=56ms reconcile=1.0 consoleErrs=0

The headline interactive flow: a user clicks Sync now and the app visibly starts, indicates progress, finishes, and refreshes the view.

button_found, in_flight_state, completed

The maker/checker approval workflow driven end to end through the UI alone: token in, draft created, submitted, approved, listed, notified, and the vendor-created payment landing in the payments table.

roleTokenAccepted, draftCreated, submitCausal, approveCausal, draftListStates, notificationSeen

The checker's other half of the workflow: rejecting a submitted draft completes through the UI, the rejected state shows in the draft list, and the rejection notification appears in the feed.

reject_completed, rejected_state_listed

The notifications feed visibly degrades while notifierd is down and heals itself — without a reload — once it returns.

partition state=degraded, heal state=live, live in 0.3s

What a user sees when the backend is unreachable: a visible, actionable error state instead of a blank or silently broken page.

error indication only

What a fresh install looks like before the first sync completes: an honest empty-or-progress state rather than phantom data or a blank page.

pre-sync state rendered: {'tablePresent': True, 'renderedRowCount': 0, 'progressText': 'No payments yet — run a sync to load the field.', 'emptyWithProgress': True, 'blocked': False, 'timeline': [{'tMs': 5, 'rows': 0, 'e

Whether the Date column shows humans a readable date instead of a raw machine timestamp.

rendered dates like Sep 21, 2025, 01:00 AM

Whether rendered amounts identify their currency — the presentation half of money; the exponent-and-digits truth is graded separately by the critical b_money_rendered.

12/12 amount cells carry a recognizable currency token

Whether the four payment statuses are visually distinguishable at a glance and painted in the spec's frozen palette — the same four hexes the 3D field uses.

4 statuses on page 1, 4 at the frozen hex, 4 distinct styles

Whether the page survives a phone-width viewport: no horizontal scrolling and real content still rendered at 375 px.

no h-scroll, 50 rows (tap targets not measured by this probe)

Whether the page is deliberately styled rather than browser-default: a real stylesheet, layered surface colors, a chosen font, and a branded header.

stylesheet=True, 5 backgrounds, font '"Iowan Old Style", "Palatino L', header=True

2/4 presentation groups fully readable (12 px, 4.5:1 effective contrast, unclipped, uncovered, inked); inspect-details / ID: insufficient visible text pixels; inspect-details / Currency: insufficient visible text pixels;

The 3D field stays interactive under input: real frames rendered during the scripted 40-move budget drag at the full 12,288-instance count.

0 frames over the 40-move budget drag (1791.6ms)

Demand rendering, the frozen spec rule: at rest — no input, no coast, no pending stream batch — the scene draws nothing; a continuous rAF render loop fails by design.

5/5 rest contexts draw nothing in 500 ms: load 0, wheel 0, coast 0, stream 0, animation 0

A live SSE batch becomes visible fast: the median time from receipt to applied — store, digest and pixels — against the spec's 250 ms budget.

batch visible in 215.8 ms

The API stays fast AND correct while the SSE stream burst is landing — read p95 under proven concurrent load.

p95=68.4ms with readers during the stream burst (overlap 1.00)

The read endpoints answer within their spec budgets when idle: the worst p95 across the API latency battery.

worst idle p95 2.791666891425848 ms across ['payments', 'summary']

Wall-clock time for the self-driven first sync — the full 192-page walk, seeded faults and documented waits included — against the spec's 120 s budget.

sync #1 wall 6036 ms (self-driven, faults included)

The #viz3d panel is a real, drawing WebGL surface with the pinned context attributes and a correctly sized backing store — not a styled div, an image, or an unused canvas.

ctx=1 type=webgl2 nonBg=120/120 distinct=9 backingOk=True

The locked layout basis vs7dbg.layout() reports — d0 (first day), D0 = 96 (the span), R0 (max in-day count at load) — matches the fixture truth and never moves when a streamed create arrives.

layout got={'d0': '2025-09-21', 'D0': 96, 'R0': 176} want={'d0': '2025-09-21', 'D0': 96, 'R0': 176} unmoved_after_stream=True

The rendered scene actually encodes the payment data: vs7dbg.sceneDigest()'s seven statistical moments over all 12,288 instanced columns match an independent recomputation from the fixture.

7/7 digest moments within tolerance (count got=12291 want=12291)

Column heights are true in rendered pixels — including the JPY (exponent 0) and KWD (exponent 3) instances whose heights expose a forgotten currency exponent.

6/6 instance tops within ±3 px (currencies ['EUR', 'JPY', 'KWD', 'USD'])

The field renders 12,288 instances inside the draw budget — at most 8 default-framebuffer draw calls per rendered frame — forcing instanced draws or a merged buffer instead of per-column draws.

ΔD=0 ΔF=0 over M=40 moves (limits 8/384)

Picking is GPU truth: the offscreen pick buffer answers occlusion exactly as the depth buffer says, on click points constructed to kill CPU raycasts and last-drawn-wins shortcuts.

0/6 decisive picks agree three ways; constructions {'occluded-by-lower-n': False, 'occluded-by-higher-n': False, 'partial-occlusion': False, 'background-in-hull': False}

The pick buffer is real GPU work with the documented cost profile: a fresh offscreen pass after each scene invalidation, bounded at 4 offscreen draws, and never flashing ID colors on the visible canvas.

since invalidation: 0 offscreen draws, 12 readbacks; 0 default-FBO draws across 6 pick calls; after a batch 2 offscreen draws / 11 readbacks, pick drew 0 default, pick==pickPixel True

Canvas clicks follow the frozen §3.3 semantics: click an instance to toggle it into the brush, click it again to toggle it out, click background to clear the brush.

{'click_toggles_on': None, 'click_toggles_off': None, 'background_clears': True}; unmeasured (probe miss): click_toggles_off: the 3D door click was not made (the point was not delivered to #viz3d after re-centring the ca

The orbit camera implements the documented math exactly: defaults yaw 30 / pitch 40 / distance 260, the 0.30 deg-per-px drag law, the exponential wheel law without page scroll, both clamps, double-click reset, and a projection that matches the printed formula.

projErr=1px pitch@clamp=50 defaults, dblclick_reset, projection; wheel over the field scrolled the page; actual event targets=[{"tag": "P", "id": "viz-error", "className": "overlay error"}, {"tag": "P", "id": "viz-error"

Post-release inertia obeys the closed-form τ = 0.4 s decay law: at any coasting instant the remaining travel equals v(t)·τ, a slow release starts no coast, and the coast settles inside the printed budget.

the app's p#viz-error covers the 3D canvas at every aimed point (6 aims, each inside the viewport after re-centring), so no drag or flick reaches #viz3d

The coast is real motion on the canvas, not a camera() narrative: after a fast flick the scene provably keeps moving past release.

the app's p#viz-error covers the 3D canvas at every aimed point (6 aims, each inside the viewport after re-centring), so no drag or flick reaches #viz3d

The 12 highest-amount records get screen-space labels that are collision-culled deterministically THROUGH the app's own pick buffer — exact set, exact geometry, zero overlap, never floating over an occluded instance.

setMatch=False at the decisive pose (expected 3, dom 12), geom 0.00, overlapViolations=66

One brush set links the table and the 3D field in both directions: row clicks and instance clicks toggle the same set, non-members dim to the exact 0.30 pixel rule, the count readout tracks, and background click restores full color.

dim_pixels, member_pixels, brush_count, background_clears, pixels_restored; 3D door unmeasured (probe miss): the point was not delivered to #viz3d after re-centring the canvas twice

SSE batches apply as true diffs: only the changed instances upload, no buffer realloc, the digest moves by exactly the change, and the changed instance's pixels show it.

1 batches: bytes 1.00, reallocs none, digest 1.00 (1 graded), changed pixel True

The mandated window.vs7dbg instrumentation tells the truth: camera() agrees with the pixels, sceneDigest() with the recomputed data, frames() with the wrapper's counted draws, and pick() with pickPixel() with the analytic answer.

cameraYawErr=0 restPixel=True digest 1.0 framesAgree=True pickTriplet=False

Every (payment, version) the app ever applied or served exists in the vendor's committed history — an invented state means the app fabricated data.

17466 observations, 0 invented states

Applied versions per payment strictly increase in event-log order — duplicate and stale webhook outcomes belong in the counters, never as events.

0 order violations over 43 same-key event pairs

The version served for a payment never decreases from one read to the next — a sync page landing after a webhook applied v+1 must not regress the row.

0 regressions over 2862 sampled read pairs

At quiescence every payment's version and status equals the vendor's final committed state, and the row count equals the vendor's — the mid-walk create present exactly once.

24/27 touched rows at vendor-final state, total 12291 (want 12291)

No read ever observes half a transaction group: the refunded payment and its reversal become visible together or not at all.

0 confirmed half-applied group observations over 944 samples (10 sync-#1 samples before the reversals backfill excluded)

No served row ever shows an amount_minor different from the vendor-committed amount — v3 never mutates amounts, only status/note/version.

2889 amount observations, 0 mutated

At every observed instant, per currency, the summary's reversal totals equal the refunded rows' amounts — both halves of each refund visible, or neither.

944/944 sequential reads agree; 0 confirmed half states; isolated read skew is not an atomicity violation [report-only in SB7.2: the same confirmed-half-state predicate as x_l5_group_atomicity, which carries the points a

Terminal per-currency counts and totals — reversals included — equal vendor ground truth: fixture plus scripted mutations plus every payment the app created.

4/4 currency totals exact, 4/4 reversal totals exact at quiescence

No field anywhere in the summary carries a cross-currency money sum — minor units are not a common denomination and summing them is wrong money.

no cross-currency money sum anywhere

CRITICAL — after every duplicate and loss is attributed, no minor units remain created or destroyed: the money conservation residual is zero in every currency.

residual 0 in every currency after attribution

CRITICAL — every mutation the app acknowledged with a 2xx is present in the final state; an acked-then-vanished write is silent data loss.

23 acked webhook mutations checked, 0 lost

The three webhook trust traps land correctly: the out-of-order pair keeps v+2 (the late v+1 never overwrites), the forged-signature event changes nothing, and no duplicate delivery applies twice.

{'ooo_kept_v2': True, 'forged_untouched': True, 'dup_applied_once': True}

ledgerd SIGKILLed mid-sync restarts, converges, and duplicates nothing — a kill mid-walk costs a clean cursor restart, never dupes or holes.

kill after list #2: restart=True converge=True nodupes=True

The app boots with the vendor down: binds within 10 seconds anyway, serves local data, does not crash, and completes the first sync unprompted once the vendor returns.

{'armed': True, 'refusal_secs': 7, 'bound_in_10s': True, 'served_while_down': True, 'no_crash': True, 'recovered': True}

A SIGKILL between an outbox commit and its delivery loses nothing and doubles nothing — the exact window where commit-then-POST and POST-then-commit both fail.

{'pending_before_kill': True, 'resumed': True, 'exactly_once': True, 'none_lost': True}

A notifier partition degrades visibly and heals in order: writes never block, /api/outbox/status reports down with growing pending, the feed shows degraded, and catch-up is in seq order with the UI live again within 5 seconds of heal.

{'ledger_alive': True, 'writes_fast': True, 'status_down': True, 'ui_degraded': True, 'catchup_in_order': True, 'ui_live_5s': True}

The notifier's durable processed set proves exactly-once: every outbox-crossing event processed, no seq twice, surviving kills.

2273 processed (2273 unique), crossing coverage 1.00, missing [14580, 14581, 14583]

Selective materialization is exact: draft.submitted, draft.approved, draft.rejected and reversal.created each produce exactly one notification row; payment.sent produces none.

got {'draft.rejected': 1, 'draft.submitted': 3, 'draft.approved': 2, 'reversal.created': 194} want {'reversal.created': 2270, 'draft.submitted': 3, 'draft.approved': 2, 'draft.rejected': 1}; feed read in 1 pages (200 row

CRITICAL — no committed row goes missing after any seeded kill: the row count after every SIGKILL+restart is at least the count before it.

4 kills; no rows lost

CRITICAL — no ledger effect applies twice: one vendor payment per approved draft, no duplicate notification rows, no (type, payment, version) event effect repeated.

no duplicated effects

CRITICAL — the lying-304 trap: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss, and serving the stale cache as fresh is graded data loss.

post-304 state reflects the committed mutations

CRITICAL — submitted and approved are durable the moment their 200 is written: a SIGKILL immediately after either, including mid-send, must find the state intact after restart.

A1 -> submitted, A2 -> sent

Excellence-grade fluidity: frames rendered during the scripted 40-move drag at the full 12,288-instance count, with proof the frames actually drew.

frames not measurable or no draw calls

Excellence-grade streaming: the median SSE batch apply time against rungs 2.5× tighter than the P-tier budget.

batch visible in 215.8 ms (excellence rungs)

The read API's p95 under the proven stream-burst load, graded again in the excellence slice.

p95=68.4ms under the stream burst (overlap 1.00)

The workflow UI paints optimistically: the submitted state appears while the write is provably still on the wire, then really saves.

painted while held (14ms), saved-after-release=True

Excellence includes the mechanisms, not only the surface: mastery of the entire 3D contract (T), consistency-and-money invariants (X) and resilience (R) tiers together.

T+X+R mean 0.810

Visible canvas, unobscured samples and independently predicted seeded-payment pixels from this browser

Four currencies: chamfered structure, separate ribs, recessed core and true frame gaps match independent rays

Currency-specific collar widths match projected pixel surfaces

Inspector identity, currency, money, status and version match the backend

framing 0x0 of the canvas (edge pixels 0); median tower contrast 1.015:1 over 200 predicted pixels; 0/52 readable caps show their status colour

0/8 inspector poses frame the tower at 40-90% of the canvas height, unclipped, with part callouts beside it and matching structural pixels; pay_00308@35: cap: text names none of cap, width 0.90 not shown, centre 270.9 px

committed live update: failed; replay without writes: failed; newer/stale versions and exit: failed