3-node local fleet — 0.0154 on sb-7.0

The submitted tree contains every deliverable the spec names by path — app/__main__.py, DECISIONS.md, and the four web files (index.html, styles.css, app.js, viz.js) — plus a bootable module for each of the two services.

5/6 named files, 2/2 bootable service modules

Both services boot as real processes and report healthy over HTTP within the spec's 10-second budget — the tool runs at all.

crash at boot (usage: meridian [-h] [--db-dir DB_DIR] [--ledger-port LEDGER_PORT] [--notifier-port )

The documented single-command form — python -m app — really boots BOTH services, not just the two individual service commands the harness normally uses.

PROBE UNAVAILABLE: combined-entrypoint smoke never ran (harness phase skipped)

The backend itself serves the frontend: GET / returns the page and styles.css, app.js, viz.js come back with correct content types, as a real browser would need.

GET / -> None

The whole frontend fits the 150 KB source budget and ships zero external code — the budget exists so a vendored 3D library cannot, and the page must work fully offline.

38 KB of 150 KB (3/4 files), 0 external ref(s)

Each service owns exactly its own SQLite file under --db-dir — ledgerd's ledger.db and notifierd's notifier.db — the one-file-per-service contract.

ledger.db=False notifier.db=False

After the self-driven full sync the app's local store holds every one of the vendor's 12,288 fixture payments — an incomplete sync silently loses money rows.

0/12288 payments after the self-driven full sync

GET /api/payments reports the correct collection total — a wrong total breaks every caller's paging math.

no full state to grade the total against

A payment row on the wire carries exactly the 10 documented keys (id, amount_minor, currency, created_at, settled_at, status, version, note, counterparty_name, country) — the vendor's nested counterparty object flattened into the last two.

no rows

The default payments page is ordered by created_at as a parsed instant, not as a string — mixed UTC offsets make string ordering wrong.

too few rows

GET /api/summary carries the documented per-currency money blocks: by_currency and the reversals block, both sorted ascending by currency code — the summary is the money surface.

no summary

Rendered money is arithmetically correct per currency — right digits and right decimal exponent, with the zero-decimal JPY and three-decimal KWD traps weighted separately — and no cross-currency sum exists anywhere in the summary.

vacuous — nothing to lose because `sync_completeness` already failed

GET /api/buckets — the 3D field's aggregate — buckets payments into Europe/Berlin calendar days per status, correct across the seeded DST transition (the data-correctness trap).

vacuous — nothing to lose because `sync_completeness` already failed

GET /api/viz/records — the 3D field's sanctioned full fetch — serves the whole collection columnar with the server-computed Berlin day, so the frontend never recomputes days in UTC.

no /api/viz/records

The append-only event ledger is contiguous from seq 1 with the frozen type and source vocabularies — a seq gap is evidence of a lost write and is graded as one.

no events returned (status None)

Error responses carry the documented structured envelope — error.code and error.message plus field_errors[] with dot-and-[index] paths where validation detail is expected.

no error responses observed

Every sampled API response — success and error paths alike — is parseable JSON; an HTML error page mid-API breaks every client that trusted the contract.

no responses sampled

The first sync walks the vendor's server-fixed 64-per-page protocol to completion — all 192 pages, documented parameters only, no page fetched twice.

PROBE UNAVAILABLE: no vendor trace

A connection dropped mid-page-stream during the first walk costs a documented resume — not a full restart of committed work, and not a hole in the collection.

PROBE UNAVAILABLE: no vendor trace

A seeded 500 with Retry-After during the walk costs exactly one documented retry after the advertised wait — never a fresh unconditional restart of committed work.

PROBE UNAVAILABLE: no vendor trace

The collection-generation rule: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss — drop the validator and refetch unconditionally exactly once, without looping and without serving stale data as fresh.

PROBE UNAVAILABLE: no vendor trace

Later syncs are cheap: every re-sync request carries a validator (If-None-Match) except the documented unconditional cases — an unconditional full re-walk on every sync is the expensive-client defect.

PROBE UNAVAILABLE: no vendor trace

The app accepts the vendor's signed push traffic — every delivery acknowledged 2xx within budget — and bounces the one forged signature with 401, state untouched.

PROBE UNAVAILABLE: vendor trace carries no webhook delivery records (vendor_service_v3 surface missing)

Approved drafts become real vendor payments through POST /v3/payments with a stored Idempotency-Key, and the kill-interrupted send's retry reuses that key — a fresh key per retry is the seeded duplicate-payment bug.

PROBE UNAVAILABLE: vendor trace carries no POST /v3/payments records

API responses declare a JSON content type and the SSE stream declares text/event-stream — a wrong content type breaks strict clients and kills EventSource.

api json 0.00, /api/stream ctype ''

Invalid input and wrong-role requests are rejected with the documented status codes — bad limit/offset/sort/status 400, unknown paths 404, missing tokens 401, wrong roles 403, self-approval 403 approval_forbidden.

matrix not exercised

The app is provably resilient to an unresponsive vendor: it boots, binds and serves local data while the vendor refuses connections — one hung vendor call must never hang the tool.

no request timeout and no vendor-down evidence

Neither service crashes on the other's absence: with notifierd down the proxy answers 502 with the documented envelope code and ledgerd keeps running; with ledgerd killed notifierd keeps running.

PROBE UNAVAILABLE: peer-absence window never orchestrated (partition phase missing)

The three deliberately unstated corners — D1 brush survival on streamed mutation, D2 rejected-draft terminality, D3 pre-first-sync table state — are decided, documented under the frozen headings in DECISIONS.md, and consistent with observed behavior.

D1=0.5, D2=0.5, D3=0.5

Whether the Meridian Payments Console renders any payment rows at all in a real browser, and whether the total it claims on the page matches the collection truth at probe time.

0 rows rendered, DOM claims None (want None)

Whether normal use of the console — loading it and running a sync — produces JavaScript console errors or uncaught page errors.

0 console error(s) across load+sync

The first-visit experience as one property: real data appears quickly, the on-page total agrees with the collection truth, and the console stays clean.

ttfd=Nonems reconcile=0.0 consoleErrs=0

The headline interactive flow: a user clicks Sync now and the app visibly starts, indicates progress, finishes, and refreshes the view.

sync button never found

The maker/checker approval workflow driven end to end through the UI alone: token in, draft created, submitted, approved, listed, notified, and the vendor-created payment landing in the payments table.

required app surface absent: workflow UI (role token / draft form / approve)

The checker's other half of the workflow: rejecting a submitted draft completes through the UI, the rejected state shows in the draft list, and the rejection notification appears in the feed.

rejection never completed

The notifications feed visibly degrades while notifierd is down and heals itself — without a reload — once it returns.

partition state=None, heal state=None, live in Nones

What a user sees when the backend is unreachable: a visible, actionable error state instead of a blank or silently broken page.

no error state

What a fresh install looks like before the first sync completes: an honest empty-or-progress state rather than phantom data or a blank page.

blank page on empty db

Whether the Date column shows humans a readable date instead of a raw machine timestamp.

no date cells rendered

Whether rendered amounts identify their currency — the presentation half of money; the exponent-and-digits truth is graded separately by the critical b_money_rendered.

no amount cells rendered

Whether the four payment statuses are visually distinguishable at a glance and painted in the spec's frozen palette — the same four hexes the 3D field uses.

no status cells rendered

Whether the page survives a phone-width viewport: no horizontal scrolling and real content still rendered at 375 px.

375px horizontal scroll: None

Whether the page is deliberately styled rather than browser-default: a real stylesheet, layered surface colors, a chosen font, and a branded header.

stylesheet=False, None backgrounds, font '', header=True

The 3D field stays interactive under input: real frames rendered during the scripted 40-move budget drag at the full 12,288-instance count.

frames not measurable over the scripted drag

Demand rendering, the frozen spec rule: at rest — no input, no coast, no pending stream batch — the scene draws nothing; a continuous rAF render loop fails by design.

no idle windows sampled

A live SSE batch becomes visible fast: the median time from receipt to applied — store, digest and pixels — against the spec's 250 ms budget.

no stream batch applied

The API stays fast AND correct while the SSE stream burst is landing — read p95 under proven concurrent load.

PROBE UNAVAILABLE: under-stream measurement never ran (fire_burst surface missing)

The read endpoints answer within their spec budgets when idle: the worst p95 across the API latency battery.

PROBE UNAVAILABLE: idle latency battery never ran

Wall-clock time for the self-driven first sync — the full 192-page walk, seeded faults and documented waits included — against the spec's 120 s budget.

sync #1 never completed inside the harness budget

The #viz3d panel is a real, drawing WebGL surface with the pinned context attributes and a correctly sized backing store — not a styled div, an image, or an unused canvas.

ctx=0 type=None nonBg=None/None distinct=None backingOk=None

The locked layout basis vs7dbg.layout() reports — d0 (first day), D0 = 96 (the span), R0 (max in-day count at load) — matches the fixture truth and never moves when a streamed create arrives.

layout got={'d0': None, 'D0': None, 'R0': None} want={'d0': '2025-08-23', 'D0': 96, 'R0': 180} unmoved_after_stream=None

The rendered scene actually encodes the payment data: vs7dbg.sceneDigest()'s seven statistical moments over all 12,288 instanced columns match an independent recomputation from the fixture.

no data to bind

Column heights are true in rendered pixels — including the JPY (exponent 0) and KWD (exponent 3) instances whose heights expose a forgotten currency exponent.

no data to measure

The field renders 12,288 instances inside the draw budget — at most 8 default-framebuffer draw calls per rendered frame — forcing instanced draws or a merged buffer instead of per-column draws.

wrapper counted no draws over the budget window

Picking is GPU truth: the offscreen pick buffer answers occlusion exactly as the depth buffer says, on click points constructed to kill CPU raycasts and last-drawn-wins shortcuts.

no instances to pick

The pick buffer is real GPU work with the documented cost profile: a fresh offscreen pass after each scene invalidation, bounded at 4 offscreen draws, and never flashing ID colors on the visible canvas.

no pick-refresh counter windows

Canvas clicks follow the frozen §3.3 semantics: click an instance to toggle it into the brush, click it again to toggle it out, click background to clear the brush.

click semantics never exercised

The orbit camera implements the documented math exactly: defaults yaw 30 / pitch 40 / distance 260, the 0.30 deg-per-px drag law, the exponential wheel law without page scroll, both clamps, double-click reset, and a projection that matches the printed formula.

camera math never exercised

Post-release inertia obeys the closed-form τ = 0.4 s decay law: at any coasting instant the remaining travel equals v(t)·τ, a slow release starts no coast, and the coast settles inside the printed budget.

no coast evidence at all

The coast is real motion on the canvas, not a camera() narrative: after a fast flick the scene provably keeps moving past release.

no flick-coast evidence

The 12 highest-amount records get screen-space labels that are collision-culled deterministically THROUGH the app's own pick buffer — exact set, exact geometry, zero overlap, never floating over an occluded instance.

no candidates to label

One brush set links the table and the 3D field in both directions: row clicks and instance clicks toggle the same set, non-members dim to the exact 0.30 pixel rule, the count readout tracks, and background click restores full color.

no rows to brush

SSE batches apply as true diffs: only the changed instances upload, no buffer realloc, the digest moves by exactly the change, and the changed instance's pixels show it.

no SSE batch observed applying

The mandated window.vs7dbg instrumentation tells the truth: camera() agrees with the pixels, sceneDigest() with the recomputed data, frames() with the wrapper's counted draws, and pick() with pickPixel() with the analytic answer.

required app surface absent: window.vs7dbg

Every (payment, version) the app ever applied or served exists in the vendor's committed history — an invented state means the app fabricated data.

nothing applied to check

Applied versions per payment strictly increase in event-log order — duplicate and stale webhook outcomes belong in the counters, never as events.

no event log to order-check

The version served for a payment never decreases from one read to the next — a sync page landing after a webhook applied v+1 must not regress the row.

no read stream against a live sync

At quiescence every payment's version and status equals the vendor's final committed state, and the row count equals the vendor's — the mid-walk create present exactly once.

never converged because sync never completed

No read ever observes half a transaction group: the refunded payment and its reversal become visible together or not at all.

the group never applied

No served row ever shows an amount_minor different from the vendor-committed amount — v3 never mutates amounts, only status/note/version.

no amounts served

At every observed instant, per currency, the summary's reversal totals equal the refunded rows' amounts — both halves of each refund visible, or neither.

no summaries to conserve

Terminal per-currency counts and totals — reversals included — equal vendor ground truth: fixture plus scripted mutations plus every payment the app created.

no terminal state

No field anywhere in the summary carries a cross-currency money sum — minor units are not a common denomination and summing them is wrong money.

no summary to scan

CRITICAL — after every duplicate and loss is attributed, no minor units remain created or destroyed: the money conservation residual is zero in every currency.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — every mutation the app acknowledged with a 2xx is present in the final state; an acked-then-vanished write is silent data loss.

vacuous — nothing to lose because `sync_completeness` already failed

The three webhook trust traps land correctly: the out-of-order pair keeps v+2 (the late v+1 never overwrites), the forged-signature event changes nothing, and no duplicate delivery applies twice.

the deliveries never applied

ledgerd SIGKILLed mid-sync restarts, converges, and duplicates nothing — a kill mid-walk costs a clean cursor restart, never dupes or holes.

PROBE UNAVAILABLE: B3 kill window never orchestrated

The app boots with the vendor down: binds within 10 seconds anyway, serves local data, does not crash, and completes the first sync unprompted once the vendor returns.

{'armed': True, 'refusal_secs': 5, 'bound_in_10s': False, 'served_while_down': False, 'no_crash': False}

A SIGKILL between an outbox commit and its delivery loses nothing and doubles nothing — the exact window where commit-then-POST and POST-then-commit both fail.

PROBE UNAVAILABLE: B6 window (kill between outbox commit and relay) never arranged

A notifier partition degrades visibly and heals in order: writes never block, /api/outbox/status reports down with growing pending, the feed shows degraded, and catch-up is in seq order with the UI live again within 5 seconds of heal.

PROBE UNAVAILABLE: B7 partition never orchestrated

The notifier's durable processed set proves exactly-once: every outbox-crossing event processed, no seq twice, surviving kills.

PROBE UNAVAILABLE: notifier processed set never read

Selective materialization is exact: draft.submitted, draft.approved, draft.rejected and reversal.created each produce exactly one notification row; payment.sent produces none.

PROBE UNAVAILABLE: notifier notifications endpoint never read

CRITICAL — no committed row goes missing after any seeded kill: the row count after every SIGKILL+restart is at least the count before it.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — no ledger effect applies twice: one vendor payment per approved draft, no duplicate notification rows, no (type, payment, version) event effect repeated.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — the lying-304 trap: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss, and serving the stale cache as fresh is graded data loss.

vacuous — nothing to lose because `sync_completeness` already failed

CRITICAL — submitted and approved are durable the moment their 200 is written: a SIGKILL immediately after either, including mid-send, must find the state intact after restart.

PROBE UNAVAILABLE: workflow F3 exercise never ran

Excellence-grade fluidity: frames rendered during the scripted 40-move drag at the full 12,288-instance count, with proof the frames actually drew.

frames not measurable or no draw calls

Excellence-grade streaming: the median SSE batch apply time against rungs 2.5× tighter than the P-tier budget.

no stream batch applied

The read API's p95 under the proven stream-burst load, graded again in the excellence slice.

PROBE UNAVAILABLE: under-stream measurement never ran

The workflow UI paints optimistically: the submitted state appears while the write is provably still on the wire, then really saves.

no optimistic-paint exercise in the flow emit

Excellence includes the mechanisms, not only the surface: mastery of the entire 3D contract (T), consistency-and-money invariants (X) and resilience (R) tiers together.

T+X+R mean 0.000