3-node local fleet (qwen3.8) — 0.0172 on sb-7.0

The submitted tree contains every deliverable the spec names by path — app/__main__.py, DECISIONS.md, and the four web files (index.html, styles.css, app.js, viz.js) — plus a bootable module for each of the two services.

4/6 named files, 2/2 bootable service modules

Both services boot as real processes and report healthy over HTTP within the spec's 10-second budget — the tool runs at all.

port bound but GET / non-200

The documented single-command form — python -m app — really boots BOTH services, not just the two individual service commands the harness normally uses.

python -m app: boot=True ledger=200 notifier=200

The backend itself serves the frontend: GET / returns the page and styles.css, app.js, viz.js come back with correct content types, as a real browser would need.

GET / -> 404

The whole frontend fits the 150 KB source budget and ships zero external code — the budget exists so a vendored 3D library cannot, and the page must work fully offline.

17 KB of 150 KB (2/4 files), 0 external ref(s)

Each service owns exactly its own SQLite file under --db-dir — ledgerd's ledger.db and notifierd's notifier.db — the one-file-per-service contract.

ledger.db=True notifier.db=True

After the self-driven full sync the app's local store holds every one of the vendor's 12,288 fixture payments — an incomplete sync silently loses money rows.

12290/12288 payments after the self-driven full sync

GET /api/payments reports the correct collection total — a wrong total breaks every caller's paging math.

total=12289 (want 12289)

A payment row on the wire carries exactly the 10 documented keys (id, amount_minor, currency, created_at, settled_at, status, version, note, counterparty_name, country) — the vendor's nested counterparty object flattened into the last two.

9/10 documented keys, stray ['counterparty_country']

The default payments page is ordered by created_at as a parsed instant, not as a string — mixed UTC offsets make string ordering wrong.

49/49 adjacent pairs ordered by instant

GET /api/summary carries the documented per-currency money blocks: by_currency and the reversals block, both sorted ascending by currency code — the summary is the money surface.

by_currency 0 rows (sorted=True), reversals MISSING (0 rows)

Rendered money is arithmetically correct per currency — right digits and right decimal exponent, with the zero-decimal JPY and three-decimal KWD traps weighted separately — and no cross-currency sum exists anywhere in the summary.

no amount cells rendered

GET /api/buckets — the 3D field's aggregate — buckets payments into Europe/Berlin calendar days per status, correct across the seeded DST transition (the data-correctness trap).

no cells returned

GET /api/viz/records — the 3D field's sanctioned full fetch — serves the whole collection columnar with the server-computed Berlin day, so the frontend never recomputes days in UTC.

0/7 columns, count=None, order 0.00, server Berlin day 0.00

The append-only event ledger is contiguous from seq 1 with the frozen type and source vocabularies — a seq gap is evidence of a lost write and is graded as one.

required app surface absent: /api/events

Error responses carry the documented structured envelope — error.code and error.message plus field_errors[] with dot-and-[index] paths where validation detail is expected.

envelope 0.29, field paths 0.17 over 7 cases

Every sampled API response — success and error paths alike — is parseable JSON; an HTML error page mid-API breaks every client that trusted the contract.

6/6 responses parse as JSON

The first sync walks the vendor's server-fixed 64-per-page protocol to completion — all 192 pages, documented parameters only, no page fetched twice.

294/192 pages served, 0 undocumented-param requests, 0 duplicate pages

A connection dropped mid-page-stream during the first walk costs a documented resume — not a full restart of committed work, and not a hole in the collection.

{'armed': True, 'resumed': True, 'no_full_restart': True, 'walk_completed': True}

A seeded 500 with Retry-After during the walk costs exactly one documented retry after the advertised wait — never a fresh unconditional restart of committed work.

{'armed': True, 'single_retry': True, 'waited': True, 'continued': True}

The collection-generation rule: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss — drop the validator and refetch unconditionally exactly once, without looping and without serving stale data as fresh.

PROBE UNAVAILABLE: B5 lying-304 never armed/fired (vendor surface missing or sched-unreached)

Later syncs are cheap: every re-sync request carries a validator (If-None-Match) except the documented unconditional cases — an unconditional full re-walk on every sync is the expensive-client defect.

0/729 conditional (1 documented unconditional), 0 x 304 across post-mutation syncs

The app accepts the vendor's signed push traffic — every delivery acknowledged 2xx within budget — and bounces the one forged signature with 401, state untouched.

47/53 deliveries 2xx-acked, forged -> 401

Approved drafts become real vendor payments through POST /v3/payments with a stored Idempotency-Key, and the kill-interrupted send's retry reuses that key — a fresh key per retry is the seeded duplicate-payment bug.

1/1 sends carried Idempotency-Key, retry_reused=False

API responses declare a JSON content type and the SSE stream declares text/event-stream — a wrong content type breaks strict clients and kills EventSource.

api json 1.00, /api/stream ctype ''

Invalid input and wrong-role requests are rejected with the documented status codes — bad limit/offset/sort/status 400, unknown paths 404, missing tokens 401, wrong roles 403, self-approval 403 approval_forbidden.

8/14 status codes correct; wrong: ['/api/payments?limit=-1', '/api/payments?limit=abc', '/api/payments?offset=-5', '/api/payments?sort=bogus']

The app is provably resilient to an unresponsive vendor: it boots, binds and serves local data while the vendor refuses connections — one hung vendor call must never hang the tool.

ledgerd bound and served local state while the vendor refused connections (5s window)

Neither service crashes on the other's absence: with notifierd down the proxy answers 502 with the documented envelope code and ledgerd keeps running; with ledgerd killed notifierd keeps running.

proxy -> 502 code=True, ledgerd-alive=True, notifierd-alive=True

The three deliberately unstated corners — D1 brush survival on streamed mutation, D2 rejected-draft terminality, D3 pre-first-sync table state — are decided, documented under the frozen headings in DECISIONS.md, and consistent with observed behavior.

D1=0.5, D2=0.5, D3=0.5

Whether the Meridian Payments Console renders any payment rows at all in a real browser, and whether the total it claims on the page matches the collection truth at probe time.

0 rows rendered, DOM claims None (want 12290)

Whether normal use of the console — loading it and running a sync — produces JavaScript console errors or uncaught page errors.

3 console error(s) across load+sync: Failed to load resource: the server responded with a status of 404 (Not Found)

The first-visit experience as one property: real data appears quickly, the on-page total agrees with the collection truth, and the console stays clean.

ttfd=Nonems reconcile=0.0 consoleErrs=2

The headline interactive flow: a user clicks Sync now and the app visibly starts, indicates progress, finishes, and refreshes the view.

sync button never found

The maker/checker approval workflow driven end to end through the UI alone: token in, draft created, submitted, approved, listed, notified, and the vendor-created payment landing in the payments table.

no step completed

The checker's other half of the workflow: rejecting a submitted draft completes through the UI, the rejected state shows in the draft list, and the rejection notification appears in the feed.

rejection never completed

The notifications feed visibly degrades while notifierd is down and heals itself — without a reload — once it returns.

partition state=None, heal state=None, live in Nones

What a user sees when the backend is unreachable: a visible, actionable error state instead of a blank or silently broken page.

error indication only

What a fresh install looks like before the first sync completes: an honest empty-or-progress state rather than phantom data or a blank page.

pre-sync state rendered: {'tablePresent': False, 'renderedRowCount': 0, 'progressText': None, 'emptyWithProgress': False, 'blocked': False, 'timeline': [{'tMs': 5, 'rows': 0, 'emptyText': None}]}

Whether the Date column shows humans a readable date instead of a raw machine timestamp.

no date cells rendered

Whether rendered amounts identify their currency — the presentation half of money; the exponent-and-digits truth is graded separately by the critical b_money_rendered.

no amount cells rendered

Whether the four payment statuses are visually distinguishable at a glance and painted in the spec's frozen palette — the same four hexes the 3D field uses.

no status cells rendered

Whether the page survives a phone-width viewport: no horizontal scrolling and real content still rendered at 375 px.

no h-scroll but zero rendered rows at 375px (vacuous)

Whether the page is deliberately styled rather than browser-default: a real stylesheet, layered surface colors, a chosen font, and a branded header.

stylesheet=False, 0 backgrounds, font 'Times', header=False

The 3D field stays interactive under input: real frames rendered during the scripted 40-move budget drag at the full 12,288-instance count.

frames not measurable over the scripted drag

Demand rendering, the frozen spec rule: at rest — no input, no coast, no pending stream batch — the scene draws nothing; a continuous rAF render loop fails by design.

no idle windows sampled

A live SSE batch becomes visible fast: the median time from receipt to applied — store, digest and pixels — against the spec's 250 ms budget.

no stream batch applied

The API stays fast AND correct while the SSE stream burst is landing — read p95 under proven concurrent load.

p95=198.4ms with readers during the stream burst (overlap 1.00)

The read endpoints answer within their spec budgets when idle: the worst p95 across the API latency battery.

worst idle p95 32.6278752181679 ms across ['payments', 'summary']

Wall-clock time for the self-driven first sync — the full 192-page walk, seeded faults and documented waits included — against the spec's 120 s budget.

sync #1 wall 31884 ms (self-driven, faults included)

The #viz3d panel is a real, drawing WebGL surface with the pinned context attributes and a correctly sized backing store — not a styled div, an image, or an unused canvas.

ctx=0 type=None nonBg=None/None distinct=None backingOk=None

The locked layout basis vs7dbg.layout() reports — d0 (first day), D0 = 96 (the span), R0 (max in-day count at load) — matches the fixture truth and never moves when a streamed create arrives.

layout got={'d0': None, 'D0': None, 'R0': None} want={'d0': '2027-01-23', 'D0': 96, 'R0': 175} unmoved_after_stream=None

The rendered scene actually encodes the payment data: vs7dbg.sceneDigest()'s seven statistical moments over all 12,288 instanced columns match an independent recomputation from the fixture.

0/7 digest moments within tolerance (count got=None want=12290)

Column heights are true in rendered pixels — including the JPY (exponent 0) and KWD (exponent 3) instances whose heights expose a forgotten currency exponent.

no height-pixel cases measured

The field renders 12,288 instances inside the draw budget — at most 8 default-framebuffer draw calls per rendered frame — forcing instanced draws or a merged buffer instead of per-column draws.

wrapper counted no draws over the budget window

Picking is GPU truth: the offscreen pick buffer answers occlusion exactly as the depth buffer says, on click points constructed to kill CPU raycasts and last-drawn-wins shortcuts.

no graded pick points

The pick buffer is real GPU work with the documented cost profile: a fresh offscreen pass after each scene invalidation, bounded at 4 offscreen draws, and never flashing ID colors on the visible canvas.

no pick-refresh counter windows

Canvas clicks follow the frozen §3.3 semantics: click an instance to toggle it into the brush, click it again to toggle it out, click background to clear the brush.

click semantics never exercised

The orbit camera implements the documented math exactly: defaults yaw 30 / pitch 40 / distance 260, the 0.30 deg-per-px drag law, the exponential wheel law without page scroll, both clamps, double-click reset, and a projection that matches the printed formula.

camera math never exercised

Post-release inertia obeys the closed-form τ = 0.4 s decay law: at any coasting instant the remaining travel equals v(t)·τ, a slow release starts no coast, and the coast settles inside the printed budget.

no coast evidence at all

The coast is real motion on the canvas, not a camera() narrative: after a fast flick the scene provably keeps moving past release.

no flick-coast evidence

The 12 highest-amount records get screen-space labels that are collision-culled deterministically THROUGH the app's own pick buffer — exact set, exact geometry, zero overlap, never floating over an occluded instance.

no decisive label pose graded (tried None)

One brush set links the table and the 3D field in both directions: row clicks and instance clicks toggle the same set, non-members dim to the exact 0.30 pixel rule, the count readout tracks, and background click restores full color.

neither brush door works

SSE batches apply as true diffs: only the changed instances upload, no buffer realloc, the digest moves by exactly the change, and the changed instance's pixels show it.

no SSE batch observed applying

The mandated window.vs7dbg instrumentation tells the truth: camera() agrees with the pixels, sceneDigest() with the recomputed data, frames() with the wrapper's counted draws, and pick() with pickPixel() with the analytic answer.

required app surface absent: window.vs7dbg

Every (payment, version) the app ever applied or served exists in the vendor's committed history — an invented state means the app fabricated data.

no (payment, version) observations at all

Applied versions per payment strictly increase in event-log order — duplicate and stale webhook outcomes belong in the counters, never as events.

no events

The version served for a payment never decreases from one read to the next — a sync page landing after a webhook applied v+1 must not regress the row.

read stream empty

At quiescence every payment's version and status equals the vendor's final committed state, and the row count equals the vendor's — the mid-walk create present exactly once.

no final spot reads

No read ever observes half a transaction group: the refunded payment and its reversal become visible together or not at all.

0 confirmed half-applied group observations over 0 samples

No served row ever shows an amount_minor different from the vendor-committed amount — v3 never mutates amounts, only status/note/version.

no amounts observed

At every observed instant, per currency, the summary's reversal totals equal the refunded rows' amounts — both halves of each refund visible, or neither.

no snapshots

Terminal per-currency counts and totals — reversals included — equal vendor ground truth: fixture plus scripted mutations plus every payment the app created.

0/4 currency totals exact, 0/4 reversal totals exact at quiescence

No field anywhere in the summary carries a cross-currency money sum — minor units are not a common denomination and summing them is wrong money.

no cross-currency money sum anywhere

CRITICAL — after every duplicate and loss is attributed, no minor units remain created or destroyed: the money conservation residual is zero in every currency.

no terminal summary to conserve

CRITICAL — every mutation the app acknowledged with a 2xx is present in the final state; an acked-then-vanished write is silent data loss.

no acked deliveries could be checked against final rows

The three webhook trust traps land correctly: the out-of-order pair keeps v+2 (the late v+1 never overwrites), the forged-signature event changes nothing, and no duplicate delivery applies twice.

{'dup_applied_once': True}

ledgerd SIGKILLed mid-sync restarts, converges, and duplicates nothing — a kill mid-walk costs a clean cursor restart, never dupes or holes.

kill after list #2: restart=True converge=True nodupes=True

The app boots with the vendor down: binds within 10 seconds anyway, serves local data, does not crash, and completes the first sync unprompted once the vendor returns.

{'armed': True, 'refusal_secs': 5, 'bound_in_10s': True, 'served_while_down': True, 'no_crash': True, 'recovered': True}

A SIGKILL between an outbox commit and its delivery loses nothing and doubles nothing — the exact window where commit-then-POST and POST-then-commit both fail.

{'pending_before_kill': False, 'resumed': True, 'exactly_once': True, 'none_lost': False}

A notifier partition degrades visibly and heals in order: writes never block, /api/outbox/status reports down with growing pending, the feed shows degraded, and catch-up is in seq order with the UI live again within 5 seconds of heal.

{'ledger_alive': True, 'writes_fast': True, 'status_down': False, 'ui_degraded': False, 'catchup_in_order': True, 'ui_live_5s': False}

The notifier's durable processed set proves exactly-once: every outbox-crossing event processed, no seq twice, surviving kills.

2269 processed (2269 unique), crossing coverage 1.00

Selective materialization is exact: draft.submitted, draft.approved, draft.rejected and reversal.created each produce exactly one notification row; payment.sent produces none.

got {'draft.approved': 1, 'draft.submitted': 1, 'reversal.created': 198} want {'draft.submitted': 3, 'draft.approved': 2, 'draft.rejected': 1, 'reversal.created': 1}

CRITICAL — no committed row goes missing after any seeded kill: the row count after every SIGKILL+restart is at least the count before it.

4 kills; no rows lost

CRITICAL — no ledger effect applies twice: one vendor payment per approved draft, no duplicate notification rows, no (type, payment, version) event effect repeated.

no duplicated effects

CRITICAL — the lying-304 trap: a 304 whose X-Collection-Generation disagrees with the stored generation is a cache miss, and serving the stale cache as fresh is graded data loss.

PROBE UNAVAILABLE: B5 lying-304 never armed/fired

CRITICAL — submitted and approved are durable the moment their 200 is written: a SIGKILL immediately after either, including mid-send, must find the state intact after restart.

A1 -> submitted, A2 -> approved

Excellence-grade fluidity: frames rendered during the scripted 40-move drag at the full 12,288-instance count, with proof the frames actually drew.

frames not measurable or no draw calls

Excellence-grade streaming: the median SSE batch apply time against rungs 2.5× tighter than the P-tier budget.

no stream batch applied

The read API's p95 under the proven stream-burst load, graded again in the excellence slice.

p95=198.4ms under the stream burst (overlap 1.00)

The workflow UI paints optimistically: the submitted state appears while the write is provably still on the wire, then really saves.

no optimistic-paint exercise in the flow emit

Excellence includes the mechanisms, not only the surface: mastery of the entire 3D contract (T), consistency-and-money invariants (X) and resilience (R) tiers together.

T+X+R mean 0.275