From 0608f9c8c10c53ca898b03cdabbe48fe7d1ea215 Mon Sep 17 00:00:00 2001 From: m3ultra Date: Fri, 17 Jul 2026 01:33:27 +1000 Subject: [PATCH] =?UTF-8?q?Lane=20G=20R24:=20G3=20=C2=A77=20RATIFIED=20?= =?UTF-8?q?=E2=80=94=20John's=20write-back=20ruling,=20A=20then=20B=20(cha?= =?UTF-8?q?rter=20law=20#4=20satisfied)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit John ruled at the R24 kickoff: v5.0 ships on Option A (sandbox) — an in-game purchase never touches real monsterrobot/Square inventory; Option B (reservation via the POS's existing hold_expires_at) is CHARTERED as a v5.x upgrade behind a hold budget John sets; Option C is not chartered and happens only as a deliberate business launch, if ever. Recorded inline in §7 with the options preserved beneath it, since the trade-offs are the record of why A-then-B was chosen. Written in as binding, because a one-line ruling isn't a mechanism: /reserve + /buy stay ABSENT, not stubbed behind a flag (a sandbox a config typo can flip isn't a sandbox); the tier-2 reader connects read-only, enforced at the credential — a role with SELECT on inventory/crate/disc_cache and nothing else, which carries the §9 PII fence in the same grant; and the gate asserts the write verbs 404 and the role's grants are read-only, because "we didn't call buy()" proves nothing — the vacuous-gate law turned on ourselves. Option B's preconditions are stated so it can't slide in quietly: the hold budget (John's number, NOT YET SET — B is not startable until it is; a v5.x item, not a v5.0 blocker), the-shop-always- wins on a race with an in-store Square sale, a staff-visible `held: GODVERSE` reason code, and soak before ship. Doc header/§10 updated so the whole file tells one story: §7 ruled, the rest still DESIGN pending both Fables' sign-off, no server code before that. Co-Authored-By: Claude Opus 4.8 --- G-progress.md | 12 +++++++ docs/G3_ECONOMY_DESIGN.md | 68 +++++++++++++++++++++++++++++++-------- 2 files changed, 66 insertions(+), 14 deletions(-) diff --git a/G-progress.md b/G-progress.md index bb02616..236b4db 100644 --- a/G-progress.md +++ b/G-progress.md @@ -5,6 +5,18 @@ newest round first. Fable-on-ultra writing.* ## Round 24 (2026-07-17) — the re-emit + THE SHOP'S REAL STREET (ledger #5) +**THE WRITE-BACK RULING — John, 2026-07-17: A THEN B.** G3 §7 is **ratified** with the ruling +inline; charter law #4 is satisfied. v5.0 ships **sandboxed** — a game purchase never touches real +monsterrobot/Square inventory. **Option B (reservation) is chartered as a v5.x upgrade** behind a +hold budget John sets; **C is not chartered**. What I wrote into the doc as binding, beyond the +one-liner, because a sandbox that can be flipped on by a config typo isn't a sandbox: +`POST /reserve` + `/buy` stay **absent, not flag-stubbed**; the tier-2 reader connects with a +**read-only role** (`SELECT` on inventory/crate/disc_cache only — which carries the §9 PII fence in +the same grant); and the gate asserts the write verbs **404** + the role's grants are read-only, +because "we didn't call buy()" proves nothing (the vacuous-gate law applied to ourselves). +**Carried to v5.x: the hold budget is John's number and is not yet set** — B isn't startable until +it is. B's non-negotiable: **the shop always wins** a race with an in-store Square sale. + **Landed (branch `lane-G-godverse`):** - **`redhill_godverse`** — the town whose record shop is THE shop. Monster Robot Party seated on Musgrave Road (**verified: lot 8, type `record`, `godverseShopId` 3962749**), 37 shops, 884 real diff --git a/docs/G3_ECONOMY_DESIGN.md b/docs/G3_ECONOMY_DESIGN.md index e9c3532..7dd3253 100644 --- a/docs/G3_ECONOMY_DESIGN.md +++ b/docs/G3_ECONOMY_DESIGN.md @@ -1,11 +1,15 @@ -# G3 — THE ECONOMY BACKEND (design doc, DRAFT for ratification) +# G3 — THE ECONOMY BACKEND (design doc) -*Lane G (ultra), R23. Drafted per the v5 charter ([V5_REAL_SHOP.md](V5_REAL_SHOP.md)) ledger #2. -Ratification: both Fables + John, at R24 kickoff. **Nothing server-side ships before that.** This -round is paper — plus the tier-1 artifact that made the paper honest (G2a, merged this round).* +*Lane G, R23 draft. Drafted per the v5 charter ([V5_REAL_SHOP.md](V5_REAL_SHOP.md)) ledger #2.* -Status of each section: **[MEASURED]** = verified against the real databases this round. -**[DESIGN]** = proposed, not built. **[JOHN]** = a decision reserved to John by charter law. +**§7 (THE WRITE-BACK QUESTION) IS RATIFIED — John, 2026-07-17, R24 kickoff: A THEN B.** v5.0 ships +sandboxed (a game purchase never touches real inventory); reservation is chartered as a v5.x +upgrade behind a hold budget John sets; full write-back is not chartered. Charter law #4 is +satisfied. **The rest of this doc remains DESIGN and still needs both Fables' sign-off; no +server code ships before that.** + +Status of each section: **[MEASURED]** = verified against the real databases. +**[DESIGN]** = proposed, not built. **[RULED]** = decided by John under charter law. --- @@ -158,13 +162,47 @@ whichever dataset actually *has* the shop, and mismatches must fail soft, never --- -## 7. THE WRITE-BACK QUESTION [JOHN — charter law #4] +## 7. THE WRITE-BACK QUESTION — **RULED: A THEN B** (John, 2026-07-17, R24 kickoff) -**Does an in-game purchase ever touch real thriftgod/recordgod inventory?** +> ### THE RULING +> **v5.0 ships on Option A (sandbox).** An in-game purchase **never** touches real +> monsterrobot/Square inventory. Sold-means-gone is per-session, tier-1 semantics. +> **Option B (reservation) is CHARTERED as a v5.x upgrade**, behind a hold budget John sets. +> **Option C is not chartered** — it happens only as a deliberate business launch, if ever. +> +> Charter law #4 is hereby satisfied: the write-back question has an explicit, John-ratified +> answer, and until B ships the standing state is **read-live, sell-sandboxed**. -This is now a live question, not a hypothetical: `monsterrobot` is a **real trading shop** whose -POS syncs to **Square**, with real customers buying these exact records off the real shelf. Stated -per charter law #4 with trade-offs and **no default**. +**What this makes law for v5.0 (binding on the server work, when it starts):** +- The API's `POST /reserve` and `POST /buy` (§4) stay **unbuilt and unrouted**. Not stubbed + behind a flag — absent. A sandbox that can be flipped on by a config typo is not a sandbox. +- The game's buy path terminates in the client's wallet. **No code path from a game purchase to + `inventory.in_stock`, `sold_date`, `hold_expires_at`, `qty`, or Square exists.** The tier-2 + reader connects to the POS **read-only** — enforce it at the credential, not in a code review: + a role with `SELECT` on `inventory`/`crate`/`disc_cache` and nothing else (this also carries the + §9 PII fence in the same grant). +- A gate worth its name here (the vacuous-gate law): assert the write verbs **404**, and that the + tier-2 role's grants are read-only. A test that "we didn't call buy()" proves nothing. + +**Option B's charter (v5.x — the preconditions, so it can't slide in quietly):** +1. **The hold budget — John's number, not yet set.** Max concurrent game-held SKUs, and max hold + duration. Until both are set, B is not startable. *(Open item, not a blocker for v5.0.)* +2. **The shop always wins.** If a held record sells in-store via Square, the game loses the hold, + silently and immediately, and the player is told the truth ("someone bought it in the shop") — + the one race policy that is never up for negotiation. +3. **Staff-visible reason code** on every hold (`held: GODVERSE`), so a human at the counter can + see why a record is out of the crate and clear it by hand. +4. **Soak first.** B rides plumbing that has soaked, not plumbing that tags a round — Fable's + framing, and the reason A ships first. + +*The options as framed for the ruling are preserved below, since the trade-offs are the record of +why A-then-B was chosen.* + +--- + +**The question as put:** does an in-game purchase ever touch real thriftgod/recordgod inventory? +Live, not hypothetical: `monsterrobot` is a **real trading shop** whose POS syncs to **Square**, +with real customers buying these exact records off the real shelf. Relevant measured facts: the POS already has `in_stock`, `sold_date`, **`hold_expires_at`**, `qty` and `square_item_id`. A reservation primitive therefore already exists — the question is whether @@ -195,8 +233,8 @@ A purchase marks the real SKU sold and syncs to Square. sales channel (real payment, tax, postage, fulfilment, refunds, chargebacks); a bug destroys real stock; a game wallet is not money. This is a business decision, not an engineering one. -**Lane G asks nothing and recommends nothing here.** Until ratified: **tier 2 is read-live, -sell-sandboxed** (the charter's standing state, Option A by default *only* because law #4 says so). +*(Lane G asked nothing and recommended nothing here — the options above are the record as put to +John. **Ruled A-then-B; the binding terms are at the top of this section.**)* --- @@ -247,6 +285,8 @@ class: reachability, fail-soft, latency. Kill the server mid-session and the gam stops ~2.3 km south of Red Hill. The crate has no street until E's `build_towns.py` gets a Red Hill entry (~`center: (-27.4553, 153.0064), span_km: 2.4`) and one Overpass fetch. That's E's file and an outward call — **G has not touched either.** -3. **[John, R24]** §7, the write-back question. +3. ~~**[John, R24]** §7, the write-back question.~~ **RULED 2026-07-17: A then B** (§7). Carried + forward: **the hold budget is John's number and is not yet set** — Option B is not startable + until it is, which is a v5.x item, not a v5.0 blocker. 4. **[Both Fables]** §9's beta scoping — depth (one real shop, 357 crates) vs breadth (more shops, which needs other people's data).