aion-labs/aion-3.5-mini, single model via OpenRouter — 0.0187 on Gauntlet 7.2

The submitted tree contains every deliverable the spec names by path — app/__main__.py, DECISIONS.md, and the four web files (index.html, styles.css, app.js, viz.js) — plus a bootable module for each of the two services.

5/6 named files, 2/2 bootable service modules

Both services boot as real processes and report healthy over HTTP within the spec's 10-second budget — the tool runs at all.

both services healthy, ledgerd in 0.3s

The documented single-command form — python -m app — really boots BOTH services, not just the two individual service commands the harness normally uses.

python -m app: boot=True ledger=501 notifier=501

The backend itself serves the frontend: GET / returns the page and styles.css, app.js, viz.js come back with correct content types, as a real browser would need.

page 200, 3/3 assets served with correct content types

The whole frontend fits the 150 KB source budget and ships zero external code — the budget exists so a vendored 3D library cannot, and the page must work fully offline.

4 KB of 150 KB (4/4 files), 0 external ref(s)

Each service owns exactly its own SQLite file under --db-dir — ledgerd's ledger.db and notifierd's notifier.db — the one-file-per-service contract.

ledger.db=False notifier.db=False

After the self-driven full sync the app's local store holds every one of the vendor's 12,288 fixture payments — an incomplete sync silently loses money rows.

Eventual evidenced total 0; initial API snapshot total None; initial expected total 12289. Totals reflect their respective measurement phases.

GET /api/payments reports the correct collection total — a wrong total breaks every caller's paging math.

no full state to grade the total against

A payment row on the wire carries exactly the 10 documented keys (id, amount_minor, currency, created_at, settled_at, status, version, note, counterparty_name, country) — the vendor's nested counterparty object flattened into the last two.

no rows

The default payments page is ordered by created_at as a parsed instant, not as a string — mixed UTC offsets make string ordering wrong.

too few rows

GET /api/summary carries the documented per-currency money blocks: by_currency and the reversals block, both sorted ascending by currency code — the summary is the money surface.

by_currency 0 rows (sorted=True), reversals MISSING (0 rows)

Rendered money is arithmetically correct per currency — right digits and right decimal exponent, with the zero-decimal JPY and three-decimal KWD traps weighted separately — and no cross-currency sum exists anywhere in the summary.

vacuous — nothing to lose because `sync_completeness` already failed

GET /api/buckets — the 3D field's aggregate — buckets payments into Europe/Berlin calendar days per status, correct across the seeded DST transition (the data-correctness trap).

vacuous — nothing to lose because `sync_completeness` already failed

GET /api/viz/records — the 3D field's sanctioned full fetch — serves the whole collection columnar with the server-computed Berlin day, so the frontend never recomputes days in UTC.

0/7 columns, count=None, order 0.00, server Berlin day 0.00

The append-only event ledger is contiguous from seq 1 with the frozen type and source vocabularies — a seq gap is evidence of a lost write and is graded as one.

no events returned (status 501)

Error responses carry the documented structured envelope — error.code and error.message plus field_errors[] with dot-and-[index] paths where validation detail is expected.

envelope 0.78, field paths 0.00 over 9 cases

Every sampled API response — success and error paths alike — is parseable JSON; an HTML error page mid-API breaks every client that trusted the contract.

6/6 responses parse as JSON

The first sync walks the vendor's server-fixed 64-per-page protocol to completion — all 192 pages, documented parameters only, no page fetched twice.

no list requests in sync #1

A connection dropped mid-page-stream during the first walk costs a documented resume — not a full restart of committed work, and not a hole in the collection.

walk never reached the drop page

A seeded 500 with Retry-After during the walk costs exactly one documented retry after the advertised wait — never a fresh unconditional restart of committed work.

walk never reached the 500 page

The collection-generation rule: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss — drop the validator and refetch unconditionally exactly once, without looping and without serving stale data as fresh.

the armed sync never ran

Later syncs are cheap: every re-sync request carries a validator (If-None-Match) except the documented unconditional cases — an unconditional full re-walk on every sync is the expensive-client defect.

no re-sync observed

The app accepts the vendor's signed push traffic — every delivery acknowledged 2xx within budget — and bounces the one forged signature with 401, state untouched.

no webhook deliveries observed

Approved drafts become real vendor payments through POST /v3/payments with a stored Idempotency-Key, and the kill-interrupted send's retry reuses that key — a fresh key per retry is the seeded duplicate-payment bug.

the app never sent an approved draft to the vendor

API responses declare a JSON content type and the SSE stream declares text/event-stream — a wrong content type breaks strict clients and kills EventSource.

api json 1.00, /api/stream ctype 'application/json'

Invalid input and wrong-role requests are rejected with the documented status codes — bad limit/offset/sort/status 400, unknown paths 404, missing tokens 401, wrong roles 403, self-approval 403 approval_forbidden.

0/15 status codes correct; wrong: ['/api/payments?limit=-1', '/api/payments?limit=abc', '/api/payments?offset=-5', '/api/payments?sort=bogus']

The app is provably resilient to an unresponsive vendor: it boots, binds and serves local data while the vendor refuses connections — one hung vendor call must never hang the tool.

no request timeout and no vendor-down evidence

Neither service crashes on the other's absence: with notifierd down the proxy answers 502 with the documented envelope code and ledgerd keeps running; with ledgerd killed notifierd keeps running.

proxy -> None code=False, ledgerd-alive=True, notifierd-alive=False

The three deliberately unstated corners — D1 brush survival on streamed mutation, D2 rejected-draft terminality, D3 pre-first-sync table state — are decided, documented under the frozen headings in DECISIONS.md, and consistent with observed behavior.

DECISIONS.md absent or carries none of the frozen ## D1/D2/D3 headings

Whether the Meridian Payments Console renders any payment rows at all in a real browser, and whether the total it claims on the page matches the collection truth at probe time.

0 rows rendered, DOM claims None (want 12288)

Whether normal use of the console — loading it and running a sync — produces JavaScript console errors or uncaught page errors.

0 console error(s) across load+sync

The first-visit experience as one property: real data appears quickly, the on-page total agrees with the collection truth, and the console stays clean.

ttfd=Nonems reconcile=0.0 consoleErrs=0

The headline interactive flow: a user clicks Sync now and the app visibly starts, indicates progress, finishes, and refreshes the view.

button_found, in_flight_state

The maker/checker approval workflow driven end to end through the UI alone: token in, draft created, submitted, approved, listed, notified, and the vendor-created payment landing in the payments table.

roleTokenAccepted

The checker's other half of the workflow: rejecting a submitted draft completes through the UI, the rejected state shows in the draft list, and the rejection notification appears in the feed.

rejection never completed

The notifications feed visibly degrades while notifierd is down and heals itself — without a reload — once it returns.

partition state=None, heal state=None, live in Nones

What a user sees when the backend is unreachable: a visible, actionable error state instead of a blank or silently broken page.

no error state

What a fresh install looks like before the first sync completes: an honest empty-or-progress state rather than phantom data or a blank page.

pre-sync state rendered: {'tablePresent': True, 'renderedRowCount': 0, 'progressText': None, 'emptyWithProgress': False, 'blocked': False, 'timeline': [{'tMs': 4, 'rows': 0, 'emptyText': None}]}

Whether the Date column shows humans a readable date instead of a raw machine timestamp.

no date cells rendered

Whether rendered amounts identify their currency — the presentation half of money; the exponent-and-digits truth is graded separately by the critical b_money_rendered.

no amount cells rendered

Whether the four payment statuses are visually distinguishable at a glance and painted in the spec's frozen palette — the same four hexes the 3D field uses.

no status cells rendered

Whether the page survives a phone-width viewport: no horizontal scrolling and real content still rendered at 375 px.

no h-scroll but zero rendered rows at 375px (vacuous)

Whether the page is deliberately styled rather than browser-default: a real stylesheet, layered surface colors, a chosen font, and a branded header.

stylesheet=True, 1 backgrounds, font 'system-ui, sans-serif', header=True

0/4 presentation groups fully readable (12 px, 4.5:1 effective contrast, unclipped, uncovered, inked)

The 3D field stays interactive under input: real frames rendered during the scripted 40-move budget drag at the full 12,288-instance count.

frames not measurable over the scripted drag

Demand rendering, the frozen spec rule: at rest — no input, no coast, no pending stream batch — the scene draws nothing; a continuous rAF render loop fails by design.

1/1 rest contexts draw nothing in 500 ms: load 0; unmeasured (a batch landed or the camera moved in every window): ['coast', 'stream', 'wheel']

A live SSE batch becomes visible fast: the median time from receipt to applied — store, digest and pixels — against the spec's 250 ms budget.

no stream batch applied

The API stays fast AND correct while the SSE stream burst is landing — read p95 under proven concurrent load.

the stream burst applied nothing: the candidate answered no webhook registered x24 of 24 burst deliveries (overlap 1.0, burst 21.0 ms)

The read endpoints answer within their spec budgets when idle: the worst p95 across the API latency battery.

required app surface absent: API latency: measured requests all returned HTTP 501

Wall-clock time for the self-driven first sync — the full 192-page walk, seeded faults and documented waits included — against the spec's 120 s budget.

sync #1 never completed inside the harness budget

The #viz3d panel is a real, drawing WebGL surface with the pinned context attributes and a correctly sized backing store — not a styled div, an image, or an unused canvas.

ctx=1 type=None nonBg=0/101 distinct=0 backingOk=False

The locked layout basis vs7dbg.layout() reports — d0 (first day), D0 = 96 (the span), R0 (max in-day count at load) — matches the fixture truth and never moves when a streamed create arrives.

layout got={'d0': None, 'D0': None, 'R0': None} want={'d0': '2026-10-09', 'D0': 96, 'R0': 177} unmoved_after_stream=None

The rendered scene actually encodes the payment data: vs7dbg.sceneDigest()'s seven statistical moments over all 12,288 instanced columns match an independent recomputation from the fixture.

no data to bind

Column heights are true in rendered pixels — including the JPY (exponent 0) and KWD (exponent 3) instances whose heights expose a forgotten currency exponent.

no data to measure

The field renders 12,288 instances inside the draw budget — at most 8 default-framebuffer draw calls per rendered frame — forcing instanced draws or a merged buffer instead of per-column draws.

ΔD=0 ΔF=None over M=40 moves (limits 8/384)

Picking is GPU truth: the offscreen pick buffer answers occlusion exactly as the depth buffer says, on click points constructed to kill CPU raycasts and last-drawn-wins shortcuts.

no instances to pick

The pick buffer is real GPU work with the documented cost profile: a fresh offscreen pass after each scene invalidation, bounded at 4 offscreen draws, and never flashing ID colors on the visible canvas.

since invalidation: 0 offscreen draws, 0 readbacks; 0 default-FBO draws across 6 pick calls

Canvas clicks follow the frozen §3.3 semantics: click an instance to toggle it into the brush, click it again to toggle it out, click background to clear the brush.

{'click_toggles_on': None, 'click_toggles_off': None, 'background_clears': False}; unmeasured (probe miss): click_toggles_off: the 3D door click was not made (the point was not delivered to #viz3d after re-centring the c

The orbit camera implements the documented math exactly: defaults yaw 30 / pitch 40 / distance 260, the 0.30 deg-per-px drag law, the exponential wheel law without page scroll, both clamps, double-click reset, and a projection that matches the printed formula.

projErr=Nonepx pitch@clamp=None ; wheel over the field scrolled the page; actual event targets=[{"tag": "DIV", "id": "viz-labels", "className": ""}, {"tag": "DIV", "id": "viz-labels", "className": ""}]

Post-release inertia obeys the closed-form τ = 0.4 s decay law: at any coasting instant the remaining travel equals v(t)·τ, a slow release starts no coast, and the coast settles inside the printed budget.

required app surface absent: required 3D interaction: no application scene or debug surface observed

The coast is real motion on the canvas, not a camera() narrative: after a fast flick the scene provably keeps moving past release.

required app surface absent: required 3D interaction: no application scene or debug surface observed

The 12 highest-amount records get screen-space labels that are collision-culled deterministically THROUGH the app's own pick buffer — exact set, exact geometry, zero overlap, never floating over an occluded instance.

no candidates to label

One brush set links the table and the 3D field in both directions: row clicks and instance clicks toggle the same set, non-members dim to the exact 0.30 pixel rule, the count readout tracks, and background click restores full color.

no rows to brush

SSE batches apply as true diffs: only the changed instances upload, no buffer realloc, the digest moves by exactly the change, and the changed instance's pixels show it.

no SSE batch observed applying

The mandated window.vs7dbg instrumentation tells the truth: camera() agrees with the pixels, sceneDigest() with the recomputed data, frames() with the wrapper's counted draws, and pick() with pickPixel() with the analytic answer.

required app surface absent: window.vs7dbg

Every (payment, version) the app ever applied or served exists in the vendor's committed history — an invented state means the app fabricated data.

nothing applied to check

Applied versions per payment strictly increase in event-log order — duplicate and stale webhook outcomes belong in the counters, never as events.

no event log to order-check

The version served for a payment never decreases from one read to the next — a sync page landing after a webhook applied v+1 must not regress the row.

no read stream against a live sync

At quiescence every payment's version and status equals the vendor's final committed state, and the row count equals the vendor's — the mid-walk create present exactly once.

never converged because sync never completed

No read ever observes half a transaction group: the refunded payment and its reversal become visible together or not at all.

the group never applied

No served row ever shows an amount_minor different from the vendor-committed amount — v3 never mutates amounts, only status/note/version.

no amounts served

At every observed instant, per currency, the summary's reversal totals equal the refunded rows' amounts — both halves of each refund visible, or neither.

no summaries to conserve [report-only in SB7.2: the same confirmed-half-state predicate as x_l5_group_atomicity, which carries the points and the band]

Terminal per-currency counts and totals — reversals included — equal vendor ground truth: fixture plus scripted mutations plus every payment the app created.

no terminal state

No field anywhere in the summary carries a cross-currency money sum — minor units are not a common denomination and summing them is wrong money.

no cross-currency money sum anywhere

CRITICAL — after every duplicate and loss is attributed, no minor units remain created or destroyed: the money conservation residual is zero in every currency.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — every mutation the app acknowledged with a 2xx is present in the final state; an acked-then-vanished write is silent data loss.

vacuous — nothing to lose because `sync_completeness` already failed

The three webhook trust traps land correctly: the out-of-order pair keeps v+2 (the late v+1 never overwrites), the forged-signature event changes nothing, and no duplicate delivery applies twice.

the deliveries never applied

ledgerd SIGKILLed mid-sync restarts, converges, and duplicates nothing — a kill mid-walk costs a clean cursor restart, never dupes or holes.

sync #2 never produced its n-th list response

The app boots with the vendor down: binds within 10 seconds anyway, serves local data, does not crash, and completes the first sync unprompted once the vendor returns.

{'armed': True, 'refusal_secs': 4, 'bound_in_10s': True, 'served_while_down': False, 'no_crash': True, 'recovered': False}

A SIGKILL between an outbox commit and its delivery loses nothing and doubles nothing — the exact window where commit-then-POST and POST-then-commit both fail.

{'pending_before_kill': False, 'resumed': False, 'exactly_once': True, 'none_lost': False}

A notifier partition degrades visibly and heals in order: writes never block, /api/outbox/status reports down with growing pending, the feed shows degraded, and catch-up is in seq order with the UI live again within 5 seconds of heal.

{'ledger_alive': True, 'writes_fast': False, 'status_down': False, 'ui_degraded': False, 'catchup_in_order': False, 'ui_live_5s': False}

The notifier's durable processed set proves exactly-once: every outbox-crossing event processed, no seq twice, surviving kills.

durable processed set empty after the run

Selective materialization is exact: draft.submitted, draft.approved, draft.rejected and reversal.created each produce exactly one notification row; payment.sent produces none.

required app surface absent: notifier notifications: exercised endpoint returned HTTP 501 not_implemented

CRITICAL — no committed row goes missing after any seeded kill: the row count after every SIGKILL+restart is at least the count before it.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — no ledger effect applies twice: one vendor payment per approved draft, no duplicate notification rows, no (type, payment, version) event effect repeated.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — the lying-304 trap: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss, and serving the stale cache as fresh is graded data loss.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — submitted and approved are durable the moment their 200 is written: a SIGKILL immediately after either, including mid-send, must find the state intact after restart.

required app surface absent: drafts endpoints: exercised create returned HTTP 501

Excellence-grade fluidity: frames rendered during the scripted 40-move drag at the full 12,288-instance count, with proof the frames actually drew.

frames not measurable or no draw calls

Excellence-grade streaming: the median SSE batch apply time against rungs 2.5× tighter than the P-tier budget.

no stream batch applied

The read API's p95 under the proven stream-burst load, graded again in the excellence slice.

the stream burst applied nothing: the candidate answered no webhook registered x24 of 24 burst deliveries (overlap 1.0, burst 21.0 ms)

The workflow UI paints optimistically: the submitted state appears while the write is provably still on the wire, then really saves.

no optimistic-paint exercise in the flow emit

Excellence includes the mechanisms, not only the surface: mastery of the entire 3D contract (T), consistency-and-money invariants (X) and resilience (R) tiers together.

T+X+R mean 0.133

Visible canvas, unobscured samples and independently predicted seeded-payment pixels from this browser

Four currencies: chamfered structure, separate ribs, recessed core and true frame gaps match independent rays

Currency-specific collar widths match projected pixel surfaces

Inspector identity, currency, money, status and version match the backend

framing 0x0 of the canvas (edge pixels 0); median tower contrast 17.747:1 over 200 predicted pixels; 0/0 readable caps show their status colour

0/8 inspector poses frame the tower at 40-90% of the canvas height, unclipped, with part callouts beside it and matching structural pixels

committed live update: failed; replay without writes: failed; newer/stale versions and exit: failed