openai/gpt-6-luna-pro, single model via OpenRouter — 0.1342 on Gauntlet 7.2

The submitted tree contains every deliverable the spec names by path — app/__main__.py, DECISIONS.md, and the four web files (index.html, styles.css, app.js, viz.js) — plus a bootable module for each of the two services.

6/6 named files, 2/2 bootable service modules

Both services boot as real processes and report healthy over HTTP within the spec's 10-second budget — the tool runs at all.

both services healthy, ledgerd in 0.3s

The documented single-command form — python -m app — really boots BOTH services, not just the two individual service commands the harness normally uses.

python -m app: boot=True ledger=200 notifier=200

The backend itself serves the frontend: GET / returns the page and styles.css, app.js, viz.js come back with correct content types, as a real browser would need.

page 200, 3/3 assets served with correct content types

The whole frontend fits the 150 KB source budget and ships zero external code — the budget exists so a vendored 3D library cannot, and the page must work fully offline.

45 KB of 150 KB (4/4 files), 0 external ref(s)

Each service owns exactly its own SQLite file under --db-dir — ledgerd's ledger.db and notifierd's notifier.db — the one-file-per-service contract.

ledger.db=True notifier.db=True

After the self-driven full sync the app's local store holds every one of the vendor's 12,288 fixture payments — an incomplete sync silently loses money rows.

Eventual evidenced total 31; initial API snapshot total 0; initial expected total 12289. Later recovery does not repair earlier API observations.

GET /api/payments reports the correct collection total — a wrong total breaks every caller's paging math.

no full state to grade the total against

A payment row on the wire carries exactly the 10 documented keys (id, amount_minor, currency, created_at, settled_at, status, version, note, counterparty_name, country) — the vendor's nested counterparty object flattened into the last two.

no rows

The default payments page is ordered by created_at as a parsed instant, not as a string — mixed UTC offsets make string ordering wrong.

too few rows

GET /api/summary carries the documented per-currency money blocks: by_currency and the reversals block, both sorted ascending by currency code — the summary is the money surface.

by_currency 0 rows (sorted=True), reversals present (0 rows)

Rendered money is arithmetically correct per currency — right digits and right decimal exponent, with the zero-decimal JPY and three-decimal KWD traps weighted separately — and no cross-currency sum exists anywhere in the summary.

vacuous — nothing to lose because `sync_completeness` already failed

GET /api/buckets — the 3D field's aggregate — buckets payments into Europe/Berlin calendar days per status, correct across the seeded DST transition (the data-correctness trap).

Incorrect daily bucket counts in the incomplete initial dataset (0/12289 payments); vacuous — nothing to lose because `sync_completeness` already failed

GET /api/viz/records — the 3D field's sanctioned full fetch — serves the whole collection columnar with the server-computed Berlin day, so the frontend never recomputes days in UTC.

7/7 columns, count=0, order 0.00, server Berlin day 0.00

The append-only event ledger is contiguous from seq 1 with the frozen type and source vocabularies — a seq gap is evidence of a lost write and is graded as one.

36 events, contiguous=True, vocab 1.00/1.00

Error responses carry the documented structured envelope — error.code and error.message plus field_errors[] with dot-and-[index] paths where validation detail is expected.

envelope 1.00, field paths 1.00 over 7 cases

Every sampled API response — success and error paths alike — is parseable JSON; an HTML error page mid-API breaks every client that trusted the contract.

6/6 responses parse as JSON

The first sync walks the vendor's server-fixed 64-per-page protocol to completion — all 192 pages, documented parameters only, no page fetched twice.

no list requests in sync #1

A connection dropped mid-page-stream during the first walk costs a documented resume — not a full restart of committed work, and not a hole in the collection.

walk never reached the drop page

A seeded 500 with Retry-After during the walk costs exactly one documented retry after the advertised wait — never a fresh unconditional restart of committed work.

walk never reached the 500 page

The collection-generation rule: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss — drop the validator and refetch unconditionally exactly once, without looping and without serving stale data as fresh.

the armed sync never ran

Later syncs are cheap: every re-sync request carries a validator (If-None-Match) except the documented unconditional cases — an unconditional full re-walk on every sync is the expensive-client defect.

no re-sync observed

The app accepts the vendor's signed push traffic — every delivery acknowledged 2xx within budget — and bounces the one forged signature with 401, state untouched.

31/31 deliveries 2xx-acked, forged -> None

Approved drafts become real vendor payments through POST /v3/payments with a stored Idempotency-Key, and the kill-interrupted send's retry reuses that key — a fresh key per retry is the seeded duplicate-payment bug.

1/1 sends carried Idempotency-Key, retry_reused=False

API responses declare a JSON content type and the SSE stream declares text/event-stream — a wrong content type breaks strict clients and kills EventSource.

api json 1.00, /api/stream ctype 'text/event-stream'

Invalid input and wrong-role requests are rejected with the documented status codes — bad limit/offset/sort/status 400, unknown paths 404, missing tokens 401, wrong roles 403, self-approval 403 approval_forbidden.

14/14 status codes correct

The app is provably resilient to an unresponsive vendor: it boots, binds and serves local data while the vendor refuses connections — one hung vendor call must never hang the tool.

ledgerd bound and served local state while the vendor refused connections (6s window)

Neither service crashes on the other's absence: with notifierd down the proxy answers 502 with the documented envelope code and ledgerd keeps running; with ledgerd killed notifierd keeps running.

proxy -> 502 code=True, ledgerd-alive=True, notifierd-alive=True

The three deliberately unstated corners — D1 brush survival on streamed mutation, D2 rejected-draft terminality, D3 pre-first-sync table state — are decided, documented under the frozen headings in DECISIONS.md, and consistent with observed behavior.

D1=0.0, D2=0.5, D3=0.5; D1 charged: the brushed-record mutation could not be staged through the candidate

Whether the Meridian Payments Console renders any payment rows at all in a real browser, and whether the total it claims on the page matches the collection truth at probe time.

6 rows rendered, DOM claims 6 (want 12289)

Whether normal use of the console — loading it and running a sync — produces JavaScript console errors or uncaught page errors.

1 console error(s) across load+sync: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

The first-visit experience as one property: real data appears quickly, the on-page total agrees with the collection truth, and the console stays clean.

ttfd=271ms reconcile=0.0 consoleErrs=0

The headline interactive flow: a user clicks Sync now and the app visibly starts, indicates progress, finishes, and refreshes the view.

button_found

The maker/checker approval workflow driven end to end through the UI alone: token in, draft created, submitted, approved, listed, notified, and the vendor-created payment landing in the payments table.

roleTokenAccepted

The checker's other half of the workflow: rejecting a submitted draft completes through the UI, the rejected state shows in the draft list, and the rejection notification appears in the feed.

rejection never completed

The notifications feed visibly degrades while notifierd is down and heals itself — without a reload — once it returns.

partition state=degraded, heal state=live, live in 0.3s

What a user sees when the backend is unreachable: a visible, actionable error state instead of a blank or silently broken page.

error indication only

What a fresh install looks like before the first sync completes: an honest empty-or-progress state rather than phantom data or a blank page.

pre-sync state rendered: {'tablePresent': True, 'renderedRowCount': 0, 'progressText': 'Waiting for first sync', 'emptyWithProgress': True, 'blocked': False, 'timeline': [{'tMs': 5, 'rows': 0, 'emptyText': 'Waiting for f

Whether the Date column shows humans a readable date instead of a raw machine timestamp.

rendered dates like Sep 15, 2025

Whether rendered amounts identify their currency — the presentation half of money; the exponent-and-digits truth is graded separately by the critical b_money_rendered.

6/6 amount cells carry a recognizable currency token

Whether the four payment statuses are visually distinguishable at a glance and painted in the spec's frozen palette — the same four hexes the 3D field uses.

3 statuses on page 1, 0 at the frozen hex, 3 distinct styles

Whether the page survives a phone-width viewport: no horizontal scrolling and real content still rendered at 375 px.

no h-scroll, 6 rows (tap targets not measured by this probe)

Whether the page is deliberately styled rather than browser-default: a real stylesheet, layered surface colors, a chosen font, and a branded header.

stylesheet=True, 5 backgrounds, font '"DM Sans", Arial, sans-serif', header=True

3/4 presentation groups fully readable (12 px, 4.5:1 effective contrast, unclipped, uncovered, inked); tower-legend / Settled: font below 12px; tower-legend / Pending: font below 12px; tower-legend / Refunded: font below

The 3D field stays interactive under input: real frames rendered during the scripted 40-move budget drag at the full 12,288-instance count.

40 frames over the 40-move budget drag (1800.7ms)

Demand rendering, the frozen spec rule: at rest — no input, no coast, no pending stream batch — the scene draws nothing; a continuous rAF render loop fails by design.

0 default-FBO draws in the worst 500ms rest window (2 sampled)

A live SSE batch becomes visible fast: the median time from receipt to applied — store, digest and pixels — against the spec's 250 ms budget.

batch visible in 0.3 ms

The API stays fast AND correct while the SSE stream burst is landing — read p95 under proven concurrent load.

p95=2.0ms with readers during the stream burst (overlap 1.00)

The read endpoints answer within their spec budgets when idle: the worst p95 across the API latency battery.

worst idle p95 0.3690830199047923 ms across ['payments', 'summary']

Wall-clock time for the self-driven first sync — the full 192-page walk, seeded faults and documented waits included — against the spec's 120 s budget.

sync #1 never completed inside the harness budget

The #viz3d panel is a real, drawing WebGL surface with the pinned context attributes and a correctly sized backing store — not a styled div, an image, or an unused canvas.

ctx=1 type=webgl2 nonBg=0/120 distinct=0 backingOk=True

The locked layout basis vs7dbg.layout() reports — d0 (first day), D0 = 96 (the span), R0 (max in-day count at load) — matches the fixture truth and never moves when a streamed create arrives.

layout got={'d0': '2025-09-15', 'D0': 96, 'R0': 1} want={'d0': '2025-07-30', 'D0': 96, 'R0': 177} unmoved_after_stream=False

The rendered scene actually encodes the payment data: vs7dbg.sceneDigest()'s seven statistical moments over all 12,288 instanced columns match an independent recomputation from the fixture.

no data to bind

Column heights are true in rendered pixels — including the JPY (exponent 0) and KWD (exponent 3) instances whose heights expose a forgotten currency exponent.

no data to measure

The field renders 12,288 instances inside the draw budget — at most 8 default-framebuffer draw calls per rendered frame — forcing instanced draws or a merged buffer instead of per-column draws.

ΔD=160 ΔF=40 over M=40 moves (limits 320/384)

Picking is GPU truth: the offscreen pick buffer answers occlusion exactly as the depth buffer says, on click points constructed to kill CPU raycasts and last-drawn-wins shortcuts.

no instances to pick

The pick buffer is real GPU work with the documented cost profile: a fresh offscreen pass after each scene invalidation, bounded at 4 offscreen draws, and never flashing ID colors on the visible canvas.

since invalidation: 4 offscreen draws, 1 readbacks; 0 default-FBO draws across 6 pick calls

Canvas clicks follow the frozen §3.3 semantics: click an instance to toggle it into the brush, click it again to toggle it out, click background to clear the brush.

{'click_toggles_on': False, 'click_toggles_off': True, 'background_clears': True}

The orbit camera implements the documented math exactly: defaults yaw 30 / pitch 40 / distance 260, the 0.30 deg-per-px drag law, the exponential wheel law without page scroll, both clamps, double-click reset, and a projection that matches the printed formula.

projErr=Nonepx pitch@clamp=85 defaults, drag_law, wheel_law, pitch_clamp, dist_clamp, dblclick_reset

Post-release inertia obeys the closed-form τ = 0.4 s decay law: at any coasting instant the remaining travel equals v(t)·τ, a slow release starts no coast, and the coast settles inside the printed budget.

identity 1.00 over 2 mid-coast samples, slow=True (drift 0°), settle=True (270.5ms of 2500ms)

The coast is real motion on the canvas, not a camera() narrative: after a fast flick the scene provably keeps moving past release.

coasted 84.669° past release, direction=True, pixels moved 0/5, rest pixel ok=False

The 12 highest-amount records get screen-space labels that are collision-culled deterministically THROUGH the app's own pick buffer — exact set, exact geometry, zero overlap, never floating over an occluded instance.

no candidates to label

One brush set links the table and the 3D field in both directions: row clicks and instance clicks toggle the same set, non-members dim to the exact 0.30 pixel rule, the count readout tracks, and background click restores full color.

no rows to brush

SSE batches apply as true diffs: only the changed instances upload, no buffer realloc, the digest moves by exactly the change, and the changed instance's pixels show it.

1 batches: bytes 1.00, reallocs none, digest 0.00 (1 graded), changed pixel False

The mandated window.vs7dbg instrumentation tells the truth: camera() agrees with the pixels, sceneDigest() with the recomputed data, frames() with the wrapper's counted draws, and pick() with pickPixel() with the analytic answer.

cameraYawErr=0 restPixel=False digest 0.0 framesAgree=True pickTriplet=False

Every (payment, version) the app ever applied or served exists in the vendor's committed history — an invented state means the app fabricated data.

nothing applied to check

Applied versions per payment strictly increase in event-log order — duplicate and stale webhook outcomes belong in the counters, never as events.

no event log to order-check

The version served for a payment never decreases from one read to the next — a sync page landing after a webhook applied v+1 must not regress the row.

no read stream against a live sync

At quiescence every payment's version and status equals the vendor's final committed state, and the row count equals the vendor's — the mid-walk create present exactly once.

never converged because sync never completed

No read ever observes half a transaction group: the refunded payment and its reversal become visible together or not at all.

the group never applied

No served row ever shows an amount_minor different from the vendor-committed amount — v3 never mutates amounts, only status/note/version.

no amounts served

At every observed instant, per currency, the summary's reversal totals equal the refunded rows' amounts — both halves of each refund visible, or neither.

no summaries to conserve

Terminal per-currency counts and totals — reversals included — equal vendor ground truth: fixture plus scripted mutations plus every payment the app created.

no terminal state

No field anywhere in the summary carries a cross-currency money sum — minor units are not a common denomination and summing them is wrong money.

no cross-currency money sum anywhere

CRITICAL — after every duplicate and loss is attributed, no minor units remain created or destroyed: the money conservation residual is zero in every currency.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — every mutation the app acknowledged with a 2xx is present in the final state; an acked-then-vanished write is silent data loss.

vacuous — nothing to lose because `sync_completeness` already failed

The three webhook trust traps land correctly: the out-of-order pair keeps v+2 (the late v+1 never overwrites), the forged-signature event changes nothing, and no duplicate delivery applies twice.

the deliveries never applied

ledgerd SIGKILLed mid-sync restarts, converges, and duplicates nothing — a kill mid-walk costs a clean cursor restart, never dupes or holes.

sync #2 never produced its n-th list response

The app boots with the vendor down: binds within 10 seconds anyway, serves local data, does not crash, and completes the first sync unprompted once the vendor returns.

{'armed': True, 'refusal_secs': 6, 'bound_in_10s': True, 'served_while_down': True, 'no_crash': True, 'recovered': False}

A SIGKILL between an outbox commit and its delivery loses nothing and doubles nothing — the exact window where commit-then-POST and POST-then-commit both fail.

{'pending_before_kill': True, 'resumed': True, 'exactly_once': True, 'none_lost': True}

A notifier partition degrades visibly and heals in order: writes never block, /api/outbox/status reports down with growing pending, the feed shows degraded, and catch-up is in seq order with the UI live again within 5 seconds of heal.

{'ledger_alive': True, 'writes_fast': True, 'status_down': True, 'ui_degraded': True, 'catchup_in_order': True, 'ui_live_5s': True}

The notifier's durable processed set proves exactly-once: every outbox-crossing event processed, no seq twice, surviving kills.

3 processed (3 unique), crossing coverage 1.00

Selective materialization is exact: draft.submitted, draft.approved, draft.rejected and reversal.created each produce exactly one notification row; payment.sent produces none.

got {'draft.approved': 1, 'draft.submitted': 1} want {'draft.submitted': 1, 'draft.approved': 1}

CRITICAL — no committed row goes missing after any seeded kill: the row count after every SIGKILL+restart is at least the count before it.

3 kills; no rows lost

CRITICAL — no ledger effect applies twice: one vendor payment per approved draft, no duplicate notification rows, no (type, payment, version) event effect repeated.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — the lying-304 trap: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss, and serving the stale cache as fresh is graded data loss.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — submitted and approved are durable the moment their 200 is written: a SIGKILL immediately after either, including mid-send, must find the state intact after restart.

A1 -> submitted, A2 -> approved

Excellence-grade fluidity: frames rendered during the scripted 40-move drag at the full 12,288-instance count, with proof the frames actually drew.

40 frames over the 40-move drag at N=12288

Excellence-grade streaming: the median SSE batch apply time against rungs 2.5× tighter than the P-tier budget.

batch visible in 0.3 ms (excellence rungs)

The read API's p95 under the proven stream-burst load, graded again in the excellence slice.

p95=2.0ms under the stream burst (overlap 1.00)

The workflow UI paints optimistically: the submitted state appears while the write is provably still on the wire, then really saves.

no optimistic-paint exercise in the flow emit

Excellence includes the mechanisms, not only the surface: mastery of the entire 3D contract (T), consistency-and-money invariants (X) and resilience (R) tiers together.

T+X+R mean 0.810

Visible canvas, unobscured samples and independently predicted seeded-payment pixels from this browser

Four currencies: chamfered structure, separate ribs, recessed core and true frame gaps match independent rays

Currency-specific collar widths match projected pixel surfaces

Inspector identity, currency, money, status and version match the backend

framing 0.0334x0.164 of the canvas (edge pixels 0); median tower contrast 1:1 over 200 predicted pixels; 0/42 readable caps show their status colour

0/8 inspector poses frame the tower at 40-90% of the canvas height, unclipped, with part callouts beside it and matching structural pixels

committed live update: failed; replay without writes: failed; newer/stale versions and exit: failed