Fable (integrator): remove the five retired ped bodies from the repo

Executes steps 1-3 of Lane F's documented removal (F-progress.md §42.6). The five bodies
D retired in §42.4 are gone from web/models/peds/ (which is NOT gitignored, and which
deploy_digalot_procity.sh rsyncs wholesale — so these bytes were shipping), dj_phrtt_01's
publish-staging copy is deleted, and its row is out of _published.json so the depot drift
check stays honest.

The one that mattered: dj_phrtt_01 is an unclothed body whose only texture is a bare-skin
atlas. It was in the DEFAULT crowd and it was the only one of the five ever published.
E-cast found it by rendering all 24 peds and looking at them — a name-scoped deny-list
could never have caught an innocent name from a different pipeline.

Verified after removal: r42_roster.mjs PASS (period law + roster licence, both controls
demonstrated), validate_manifest.py --depot 0 errors 0 warnings, 32 ped GLBs remain
(24 shipped bodies + 8 base clips).

STILL OUTSTANDING, for John: the depot copy at digalot.fyi/3god is live and there is NO
delete verb — publish.py only uploads, and CITY_SPEC's depot contract documents upload,
fetch and list and nothing else. Removing it is a deliberate act on the depot host. Filed
to R43 with the deny-list follow-up, which goes green the moment the bytes are gone and
red forever after if one returns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

B-progress.md

@@ -4,6 +4,429 @@
 plus the game shell. It runs on my hand-written fixture **and** auto-integrates with Lane A's
 `generatePlan` (which landed mid-session). Everything below was verified live in a browser.
 
+## Round 42 (§42.5) — the bench turns to face the road, and the font race turns out to have been the crowd
+
+Full measurement detail in `docs/LANES/LANE_B_NOTES.md` §42. Everything below: today's tree, headless
+fresh contexts, port-isolated no-store servers, pin method of record (stepwalk 2 m · yaw 0 · laps 2 ·
+802 stations), A/B against a control tree — a HEAD copy of `web/` with `assets/ models/ vendor/` **and
+every `js/` subtree that is not Lane B's** symlinked to the live tree, so another lane's mid-round wave
+is identical on both arms.
+
+**1. FIX 1 — THE BENCH (and the streetlight) FACED THE WRONG WAY. D's filing is correct on both.**
+Verified before changing anything, off the live InstancedMesh matrices, each instance matched to the
+edge whose **perpendicular offset equals the placement rule** (position only, so the yaw verdict is
+not circular; `unmatched: 0`).
+
+| live scene, seed 20261990 | BEFORE | AFTER |
+|---|---|---|
+| bench front vs the direction to the road | **90.0° — min = med = max, 60/60** | **0.0° — min = med = max, 60/60** |
+| lamp head gains … toward the road | **0.00 m — 0 of 89 reach over it** | **+1.05 m — 89 of 89** (the whole arm) |
+
+The code and its comments had disagreed for 41 rounds: `:203` said *"facing the road"*, `:197` said
+*"arm reaches over the road"*, and both used `atan2(ux, uz)` — the yaw that points local +Z **down the
+street**. Fixed with one named convention rather than two more literals: `faceYaw = atan2(-uz, ux)`
+(= `alongYaw − π/2`), road-facing yaw = `faceYaw + (side > 0 ? π : 0)` — **the `side` term was already
+there and already right**, which is why the defect survived reading. Also found and fixed in the same
+path: **9 of the town's 60 benches are the depot GLB** (this box reaches the CDN), and that GLB is
+**0.437 × 0.845 × 1.215 m with all 318 backrest verts in a slab at x ∈ [0.151, 0.219]** — plank along
+**Z**, sitter facing **−X**, i.e. 90° out from the house "+Z is the front" law. Normalised by rotating
+the **geometry** once at load (`+π/2`), not the instance, so a station's yaw means one thing whichever
+geometry draws. Zero draws, zero tris.
+
+**2. FIX 2 — `benchStops(plan)` ships, and the RULE now has one copy.** `benchStationsOnEdge(e)` is
+what `buildChunkFurniture` places from **and** what the export publishes — a second copy inside the
+same file would have been D's defect at a shorter distance. Signature:
+`benchStops(plan) → [{ edgeId, kind, s, side, x, z, yaw, seatLen }]`, pure function of the plan (no
+THREE/scene/DOM), plan-edge order then ascending `s`, whole town. `side` is on the **furniture**
+perpendicular so D's `side === −forward` test is unchanged; `yaw` is the instance rotation with **+Z
+the bench front, now pointing at the road** (a sitter is still `yaw + π`); `seatLen` 1.6 m so D's
+±0.38 m two-up offset stops being a copy of B's geometry. **Gated, not asserted** (D's own arm-6
+method, pointed at the export): **254 stations town-wide, 60 instances in the window, 60/60 within
+2 cm and 60/60 yaw-identical to <1e-6 rad; CONTROL at 2 m offset matches 0 of 65 on both counters.**
+
+**3. FIX 3 — `await document.fonts.ready` IS SHIPPED AND IT FIXES NOTHING. The cause is the crowd.**
+Measured, not assumed: the sign-atlas canvases are **byte-identical across three boots** (41–49
+canvases per bookmark, same sha1 list every time); `document.fonts.size === **0**` at document start
+and at ready, because the API tracks **font faces** and this game ships none (house law — canvas text);
+and on **6 of 6 boots** `fonts.ready` resolves at 38–51 ms while the **first `fillText` in the process**
+is at 89–109 ms, i.e. **+49 to +60 ms later**, with `fonts.status === 'loaded'` already. There is no
+window in which a sign is painted early. It is shipped anyway at the only free site — a module-level
+await at the top of `buildings.js`, so every `buildChunkBuildings` call is downstream of it and the
+builder **stays synchronous** (the 4 ms/frame streamer budget is untouched). **Measured added boot
+latency, 6 boots/arm: first sign paint 102.28 → 102.62 ms (+0.34 ms on the mean) against a control
+whose own spread is 93.7–110.6 ms; `DBG.ready` 3,822 → 3,802 ms.** Noise, both directions.
+
+What actually moves the frame is the **citizen sim on wall-clock time** — and **the freeze recipe every
+lane quotes does not freeze anything**: `?roster=v1&pop=0` boots **140 citizens** (96 active, measured)
+because `index.html:454` is `(parseInt(params.get('pop'),10) || 140)` and **0 is falsy**. Two fresh
+contexts of `street_noon` differ by **983 px of 921,600, all of them in rows 361–418 — the pedestrian
+band** — and by **0 px** with the crowd genuinely out. So `dbg.js` gains **`DBG.freeze()`** (`?dbg=1`
+only): `setPopulation(0)` for the fixed roster **plus** hiding `citizens.group` for the chunk-streamed
+default (whose active set is per-chunk density and ignores `target`), returning
+`{draws:{before,after}, peds, stillLive:{weather,tram,magpie,washing,gigs}}` so a harness asserts.
+
+**THE 3-BOOT HASH TABLE** — F's method, fresh context per (bookmark, boot), `?classic=1`, 2.5 s settle:
+
+| bookmark | BEFORE (control) | AFTER (fonts fix in) | AFTER + `DBG.freeze()` | BEFORE + same freeze |
+|---|---|---|---|---|
+| `street_noon` | **3 of 3** | **3 of 3** | **1 of 3** | **1 of 3** |
+| `shopfront_detail` | **3 of 3** | **3 of 3** | **1 of 3** | **1 of 3** |
+| `crossroads_busy` | **3 of 3** | **3 of 3** | **1 of 3** | **1 of 3** |
+| `market_square` | 1 of 3 | 1 of 3 | 1 of 3 | 1 of 3 |
+| `night_neon` | 1 of 3 | 1 of 3 | 1 of 3 | 1 of 3 |
+| **stable** | 2/5 | **2/5 — unchanged** | **5/5** | **5/5** |
+
+**→ LANE F, EXPLICITLY: YES, byte-hash goldens become possible and the R41 ruling can be reversed —
+but not for the reason it was made.** The condition is not "the await landed", it is "the frame holds
+nothing that runs on wall-clock time". A golden boot is
+`?classic=1&dbg=1&weather=0&tram=0&magpie=0&washing=0` **+ `DBG.freeze()` before the shot**; `?pop=0`
+is not a substitute and never was. The last column is the proof it is the freeze and not any R42
+code — the untouched HEAD tree goes 5/5 the same way. Two asks in your files: fix `index.html:454`
+(`Number.isFinite`, not `||`), and if a gate pins a hash, assert `freeze().stillLive` is all-false in
+the same run or the golden rots the first time someone shoots without a flag. (On `market_square`:
+R41 has B calling it stable and F calling it 3-of-3; on this box today it is stable in all four arms.)
+
+**→ LANE D, A BREAKING CHANGE, AND IT IS WHY THE EXPORT EXISTS.** `sim.js benchStationsFor()` is now
+**90° wrong**. Positions are untouched (your 14/14 position arm stays green); your **yaw arm goes
+red**, and `_seatPose()` will put sitters up to 0.38 m off the plank facing along the street — that is
+`bench_seated_after.jpg`, shipped un-retouched on purpose. `bench_seated_after_dwired.jpg` is the same
+frame with the sitter re-seated off the **real bench transform**: that is what importing `benchStops`
+in 42.4 delivers.
+
+**4. ZERO DRAWS, measured on both arms** — pin method, 802 stations, control vs treatment:
+
+| synthetic, pin | CONTROL | R42 | delta |
+|---|---|---|---|
+| default noon (seg 2) | 282 / 100,346 | **282 / 100,346** | **0 / 0** |
+| default **NIGHT** (seg 5) | 291 / 122,183 | **291 / 122,183** | **0 / 0** — ruling 4's nine draws intact |
+| `?classic=1` NIGHT | 269 / 90,580 | **269 / 90,580** | **0 / 0** — byte-exact to the R38/R40/R41 pin |
+| `?classic=1` noon | 269 / 90,592 | **269 / 90,592** | **0 / 0** |
+
+0 console errors on all 8 runs. `night_neon` frame **98 draws / 14,454 tris on both**; crowd-frozen
+bench pose **130 draws on both**. (Night tris read 122,183 against R41's 120,093 — the +2,090 is on the
+**control** too, arriving through the symlinked `models/`/`assets/` from another lane's in-flight R42
+work. Recorded so nobody bills it to this round.)
+
+**5. CLASSIC.** `furniture.js` and the new `buildings.js` await carry **no classic flag test at all**,
+so classic and default are identical to each other by construction and the fix lands on both. Fetch
+surface **127 URLs on both arms, added `[]`, removed `[]`** (blob: object URLs excluded — random UUID
+per boot); HUD DOM **2355:8 identical**; help line unchanged; `night_neon` **0/0 delta**; classic pin
+**269 / 90,580 byte-exact**; **0 page errors and 0 console errors** on `?dbg=1`, `?classic=1`,
+`?noassets=1` and `?roster=v1&pop=0`. The only probe difference anywhere is `DBG.freeze` existing, and
+`DBG` exists only under `?dbg=1`. Goldens: `node web/js/citygen/selfcheck.js` → **ALL GREEN
+157,647/157,647**, fingerprint **`0x5f76e76` unmoved**.
+
+**6. FILED, NOT FIXED.** The **bus shelter has the bench's bug** — `syaw = atan2(-uz, ux)` is `faceYaw`
+**without** the `side` term and the shelter always stands on `+perp`, so its open front reads *away*
+from the road on the primitive. Left alone deliberately: `busShelterStops()`'s yaw is consumed by
+`tram.js` and the shipped shelter is a depot GLB whose axis is **unmeasured**. Measure the GLB, then
+flip both together. Also to E: a depot prop disagreeing with the house axis is a **class** of bug, not
+an instance — the bench was one, the shelter is the next one waiting.
+
+Shots: `docs/shots/laneB_r42/` — `bench_seated_{before,after,after_dwired}.jpg` (same station, same
+pose, R10 human-sized line off the sitter's own bone bbox), `bench_geometry_ab.jpg` and
+`streetlight_night_ab.jpg` (crowd frozen, 130 draws both arms). Files: `web/js/world/furniture.js`,
+`web/js/world/buildings.js`, `web/js/world/dbg.js`, `docs/shots/laneB_r42/`, these docs. **No git
+commands run** (lane treaty; Fable commits).
+
+## Round 41 (§41.5) — the game learns to say where it came from, and 81 pubs stop wearing op-shop paint
+
+Full measurement detail in `docs/LANES/LANE_B_NOTES.md` §41. Everything below: today's tree, headless
+fresh contexts, port-isolated no-store servers, pin method (stepwalk 2 m · yaw 0 · laps 2 · 802
+stations), A/B against a HEAD control tree whose `assets/` `models/` `vendor/` are symlinked to the
+live tree so another lane's mid-round wave is identical on both arms.
+
+**1. THE CREDITS SURFACE — the schema is the product; the panel is 260 lines that never decide a licence.**
+
+`web/assets/credits.json` (schema `procity-credits/1`) is the file **every lane appends to**;
+`web/js/world/credits.js` renders it; `hud.js setCredits()` puts the way in; `index.html` gets one
+`[Lane B R41]` dynamic-import block. Reachable on **F2** or the HUD link, bottom-left.
+
+- **Schema, documented for C/D/E/G in LANE_B_NOTES §41** (with a paste-ready ACCAD row for R42):
+  `id · name · kind · licence · attribution · required · source · used_for · count · files · evidence`
+  (+ optional `flag`, `lane`). Three rules carry it: **`licence:"unverified"` is legal and a guess is
+  not**; **`attribution` is the exact string**, printed verbatim, `null` when nothing is owed;
+  **`required` is the licence question, not an editorial one** — Mixamo/Rokoko are `false` because
+  their licences ask for nothing, CC BY is always `true`. `evidence` must name a file in this repo.
+- **Seeded with 14 entries read off the repo, nothing invented.** Two carry a **live obligation** the
+  game had never shown: **OpenStreetMap ODbL 1.0** (23 town caches — `SOURCES.md`'s own words are
+  *"keep the © OpenStreetMap contributors credit visible"*) and **three.js r175 MIT**. Plus Mixamo (4
+  clips), Rokoko (4 dance clips), 103 skins, 29 audio assets, the fitting/furniture fleet split by
+  provenance, the GODVERSE stock art, the generation stack, and "no font files ship".
+  **THE ATTRIBUTION RIDES THE LINK:** on an OSM boot it reads `© OpenStreetMap contributors · credits
+  (F2)`; on the synthetic town, where no OSM data is on screen, claiming it would be the opposite of
+  attribution, so it reads plainly.
+- **Two findings filed to E, both shipped as `unverified` + amber flag rather than a guess:** the
+  **base ped roster (19 GLBs) has no per-asset licence record anywhere in this repo** (CITY_SPEC's
+  declared zone includes CC-BY and CGTrader RF — both can owe attribution, so a credit may be owed
+  *today*); and the **18 house-library fittings still carry AUDIT.md's own 38-round-old blanket
+  caveat** ("record a one-line source/licence per asset before publish"), having been published since
+  R3. AUDIT.md documents props in forensic detail and the people not at all.
+- **Cost:** zero draws (DOM the composer never renders), **zero boot fetches** — `credits.json` is
+  fetched on FIRST OPEN, asserted 0 before and exactly 1 after — and **zero fetches under
+  `?noassets=1`**, where the panel says so honestly instead of shipping a second copy of the data.
+
+**2. A's D3 — 81 venue lots, re-measured and fixed.** `SHOP_REGISTRY` carries 9 types and never
+carried `pub`/`band_room`/`rsl`, so `SHOP_REGISTRY[type] || SHOP_REGISTRY.opshop` dressed every gig
+venue in op-shop paint. Re-measured over the whole shipped corpus at the golden seed:
+**27 towns · 1,838 shops · 81 venue lots · 81 of 81 taking the fallback — exactly 3 per town, in
+every town.** A's R40 number reproduces to the digit. (The bite has drifted `:344`→`:465`→**`:483`**;
+the line moves, the defect didn't — hence a named resolver, not another literal at a line number.)
+`buildings.js signStyleFor()`: B's nine shipped palettes → **A's `core/registry.js`** (gilt/stencil/
+club, carried since R13, and the source for any type A adds next) → op-shop, now genuinely
+last-resort. Venue treatment = accent frame + top fascia band, **venue-gated by construction**
+(`accent` exists only on registry-sourced palettes). **Not done, deliberately:** repainting the other
+nine onto A's palettes — that is an art call for John (record would go muted-teal → hot-pink neon),
+not a bug fix, and R41 is the round F photographs. Filed. The 28-round-stale `fixture_plan.js` header
+A clocked is rewritten to say what that table honestly is.
+
+**3. ZERO DRAWS, measured not claimed** — frozen town on both arms (`roster=v1&pop=0&weather=0&tram=0&
+magpie=0&washing=0`; every one of those moves on wall-clock time), station lists compared as JSON
+before either sweep runs:
+
+| frozen, 136 station×yaw samples/arm | HEAD | R41 | delta |
+|---|---|---|---|
+| synthetic **NIGHT** (worst class) | 283 draws / 116,681 tris | **283 / 116,681** | **0 draws AND 0 tris on 136/136** |
+| synthetic noon | 273 / 96,396 | **273 / 96,396** | **0 and 0 on 136/136** |
+| `katoomba_real` NIGHT | 167 / 109,208 | **167 / 109,208** | **0 and 0 on 136/136** |
+| `?classic=1` NIGHT | 264 / 90,578 | **264 / 90,578** | **0 and 0 on 136/136** |
+
+**544 of 544 samples identical in both counters, 0 console errors on every arm.** Pin method on the
+treatment tree reproduces R40 exactly: **default 282 noon / 291 NIGHT, classic 269 / 90,580 byte-exact**
+— **ruling 4's nine-draw night margin is intact and Lane B spent none of it.** The new
+`core/registry.js` import in `buildings.js` is free: `citygen/index.js → plan.js` already pulls it on
+every boot, and the classic fetch surface is **121 URLs on both arms, `added []`, `removed []`**.
+
+**4. CLASSIC IS BYTE-IDENTICAL.** A classic plan carries **0 venue-typed shops of 493**, so the
+resolver's registry arm is *structurally* unreachable there; the credits module is never fetched
+(null-provider idiom, no flag test in either file) so there is no `#pc-creditlink`, no overlay, no
+injected CSS, no F2 listener, no `PROCITY.credits`, and the help line is unchanged. HUD DOM
+**2354:8 on both arms**. Draw/tri delta **0 on 136/136**. → **F, a finding, not this round's defect:**
+pixel-hashing five classic bookmarks gives 2/5 matches — and **HEAD-vs-HEAD gives the same 2/5**.
+`street_noon`/`shopfront_detail`/`crossroads_busy` are not byte-reproducible across boots even at
+HEAD (likely the sign atlas painting `bold Npx Arial` before the font resolves, in race-dependent
+chunk order). A screenshot golden on those three cannot be a byte-hash.
+
+Goldens **157,647/157,647, `0x5f76e76` unmoved** (no plan field is touched — signage is a canvas
+texture, the credits surface is DOM). `tools/qa/r40_lane_b.py`: **all assertions green**;
+`tools/flags_check.py`: **GREEN, 0 fails / 0 warns** (no new POST_V2 exception needed — classic never
+requests either credits file). Shots: `docs/shots/laneB_r41/venue_signage_ab.png` is the contact sheet
+— **1,088 / 9,645 / 14,160 changed pixels on the three pairs and every one of them inside the sign
+band, nothing else in the town moves** — plus the full frames and the panel. Honest caveat: the pub is
+the *least* visible of the three (op-shop `#2c2820` and gilt `#3a2416` are near-neighbour browns), so
+its read comes mostly from the `#c0392b` accent frame; the band room and RSL are unmistakable.
+Files: new `web/assets/credits.json`, new
+`web/js/world/credits.js`, `hud.js`, `buildings.js`, `fixture_plan.js`, `web/index.html`
+(`[Lane B R41]` marks), `docs/shots/laneB_r41/`, these docs. **No git commands run** (lane treaty;
+Fable commits).
+
+## Round 40 (§40.3) — the ?r= breach GATED at its true number, classic's selector ratified, the fog signed — plus §40.4's arcade kit (Fable-routed)
+
+Full measurement detail in `docs/LANES/LANE_B_NOTES.md` §40. Everything below: today's tree,
+headless fresh contexts, no-store servers, pin method (stepwalk 2 m · yaw 0 · laps 2 · 802 stations).
+
+**1. THE ?r=3 BREACH — re-measured, then GATED (option b), because the carried 307 was fiction.**
+
+| mode | before (carried) | re-measured (pin method, final tree) | law now |
+|---|---|---|---|
+| default noon / night | 282 / 292 (R38 pin) | **282 / 291** ✅ pin reproduced | ≤300 (unchanged) |
+| `?classic=1` night | 269 | **269 / 90,580 tris — byte-exact** | ≤300 (unchanged) |
+| `?r=3` noon / night | "307 / 317" (stale bookmark) | **382 / 391** at 45–48 live chunks | **≤420, its OWN declared law** |
+
+Decision: **gate, not shave** — the 91-draw excess is the R+1 live-chunk window (48 vs 31) on a
+per-chunk cost already collapsed to ~1 draw/kind/chunk; a shave that size is a content cut to the
+DEFAULT town to legalise a diagnostic. So: `?r=` above auto now declares
+`PROCITY.budget = {draws: 420, tris: 200k, diagnostic: true}`, console-warns its law, the HUD warn
+threshold reads it, `DBG.info().budget` carries it, and **NEW `tools/qa/r40_lane_b.py`** asserts it
+with both arms non-vacuous (measures 386 ≤ 420 at 8 m stations AND 386 > 300, so the exemption is
+load-bearing; ≤300 someday ⇒ "retire the exemption", printed not failed). Ceiling 420 = 391 + ~7%
+jitter margin; growth past it goes red and is re-pinned consciously. → F: one qa.sh line; README
+`?r=N` row still says 307.
+
+**2. ?classic=1 TOWN SELECTOR (Fable ruled yes) — verified true by construction, made deliberate.**
+Classic boots with the selector present + visible, **all 27 options** (3 fixtures + 23 real/godverse
+towns), one towns-fetch = exactly the named POST_V2_EXCEPTION (`assets/towns/index.json`), picks
+FROM classic stay classic (query string preserved), zero draws (DOM chrome), 0 errors. Ruling
+written into the selector block (hud.js) and asserted in r40_lane_b.py. → F: the flags_check
+POST_V2_EXCEPTIONS label still calls this a debt-ledger question; it's ruled now.
+
+**3. FOG SIGNAGE — three surfaces that said nothing now consume A's layer** (`street || label`,
+null handled once, no town-type branch): **HUD `street` row** ("Lurline Street" on katoomba_real,
+supplier `ways`; "the south end of the main street" on the synthetic) · **door tooltip**
+("🚪 Little Paris Cafe · Katoomba Street — click to enter") · **fog-map caption**
+("… 2 streets walked · Lurline Street · press M to close"). New `createStreetLocator(plan)` in
+discovery.js (the probe's hash, read-only; signage ≠ discovery, so not fog-keyed); rides the
+existing frame%6 throttles; zero draws. **Classic-gated by construction**: locator built only
+`!CLASSIC`, so `#pc-street` doesn't exist in classic's DOM and the tooltip is the pre-R40 byte —
+A/B'd on the same door, asserted both arms in r40_lane_b.py.
+
+**4. §40.4 ARCADE KIT (routed mid-round by Fable, E's spec applied verbatim):** roof spans (depth
+2.5 = half-lane, slabs meet flush), **a spanned roof has no posts**; `ctx.arcadeBlocks` keyed on
+`district.kind` never `edge.kind`; explicit `ARCADEKIT` gate (classic forces off — mandatory;
+`?arcadekit=0` = falsifiability control). Measured: **−34 post instances exactly, lane draws
+120 → 120 (+0)**, shot pair `docs/shots/laneB_r40/`, classic pin cell byte-exact after the change.
+
+Goldens **157,647/157,647, 0x5f76e76 unmoved** (selfcheck after every wave). r40_lane_b gate:
+**all assertions green**. Files: `web/index.html` (`[Lane B R40]` marks), `hud.js`, `minimap.js`,
+`discovery.js`, `dbg.js`, `chunks.js`, `buildings.js`, new `tools/qa/r40_lane_b.py`,
+`docs/shots/laneB_r40/`, these docs. **No git commands run** (lane treaty; Fable commits).
+
+## Round 39 (v9 Layer 2 — THE FOG, item 39.2) — **zero draws, and the map is finally readable**
+
+Full detail + every number in LANE_B_NOTES §39. `minimap.js` drew all 493 synthetic shops from the
+first frame; it now draws what has been walked past and **frames itself to it**. New
+`web/js/world/discovery.js`, `minimap.js` rewritten, `save.js` gains the ledger, the shell wires it.
+
+- **ZERO DRAWS, measured as an A/B** (two port-isolated no-store servers, HEAD vs treatment, same 15
+  stations × 4 yaws computed from the plan and compared before either sweep runs, sim + tram hidden
+  identically): **draw calls identical on 60 of 60 samples at noon and at night.** And map mode cannot
+  cost a draw *structurally* — the frame loop never calls `composer.render()` in the map branch, so the
+  counter reads the same number open (131) as closed (131).
+- **Legibility.** A shop lot goes from **0.83×1.11 px to 29.4×39.2 px on bowral_real — 35.3×**
+  (launceston 27.6×, castlemaine 21.3×, katoomba 20.8×, adelaide 16.9×, fitzroy 11.1×, synthetic 4.0×
+  at 21×41). Reproduces Fable's binding table to the digit. The frame is **the shops you have stood in
+  front of + where you stand** — framing on walked *edges* was my own first cut and it blew the frame to
+  340 m at spawn, because one synthetic edge is 400 m long.
+- **The rule: 25 m of the shopfront AND in front of it**, probed off a plan-derived spatial hash every
+  6th street frame (**0.46 m of travel at WALK**), never off `onChunkBuilt` (R=2 ⇒ 128 m). **1.09–1.37
+  µs a probe** — 0.0014% of a frame. Falsifiability control with a red arm: walking the synthetic's two
+  service laneways, radius-only reveals 93 shops, the shipped probe 59 — **34 refused through the back
+  wall**; on the arcade it refuses 0 of 17.
+- **The save.** Optional `known` block, keyed by TOWN (I re-derived the seed-invariance: 23 caches ×
+  3 seeds, shop ids / edge ids / lot geometry all identical; synthetic alone keys `@<seed>`). Bounded
+  by the plan (max 493 shops, 2,593 edges) with a 8,192 cap, 64 towns FIFO, ints only. **Worst case
+  160 KB for the entire corpus fully learned; ~300 B after a 500 m outing.** Eight reject arms
+  demonstrated, live state untouched on reject, foreign-town fog does not leak.
+- **Classic by construction:** `createMinimap(plan, null)` is the pre-R39 map and the file has **no flag
+  test**. `?classic=1` / `?fog=0` / `?game=0` map canvases are **hash-identical to HEAD's**.
+- **Lane A's address layer consumed** — street names along walked streets, deduped by name; the
+  synthetic gets district labels from the same line. No town-type branch anywhere.
+- **THE SIGN, landed on Fable's ruling (`a982f3c`)** — `index.html:428` (Lane D patronage door points)
+  and `:500` (the R32 spawn) computed the shop front as `(−sin ry, −cos ry)`, the **back** of the
+  building. Patronage door points **on the footpath: 0/493 → 427/493 synthetic, 0/72 → 67/72 katoomba,
+  0/139 → 139/139 fitzroy, 0/30 → 28/30 bowral**. At spawn, shops within 25 m that are in front of you:
+  **0 → 4 on both towns tested.** Katoomba's shipped boot opened *standing in a paddock facing a blank
+  back wall* — the R31 playtest's own complaint, which R32 was written to fix and never did. **No
+  golden moves** (runtime pose; selfcheck `0x5f76e76` either side). **F: the R32 spawn gate and the R35
+  first-five-minutes smoke photograph this pose and need re-baselining.** Written up as the **FOURTH
+  instance of the −Z/+Z confusion** (R13 `RY_FLIP` · R15 the poster on the back wall · R27 every
+  real-town shopfront facing the paddock · R39 these two) with the lineage table in LANE_B_NOTES §39.
+- **THE MAGPIE, on Fable's second ruling** — E's 894-tri GLB wired as `furniture.js`'s **use-if-ready**
+  path (`+1 draw / +894 tris` with the bird on screen, `+0` off; `?noassets` stays on the 182-tri
+  procedural bird). **Two things measured before wiring, both would have shipped wrong:** E's bird
+  faces **+Z** and this file flies **−Z** (proved by slicing the GLB along Z — head end mean y 0.31,
+  tail end 0.028), so without `rotateY(π)` it swoops **tail-first** — *the fifth −Z/+Z instance, and
+  the first caught before it shipped*; and its origin is at the **feet**, dropped 0.20 m onto the lamp
+  arm. The fallback's white is re-placed (+0 tris, verified by E's own dump: still **182 tris**) and
+  **measured**: pale area 180 → 399 px but true white 33 → 28, because a downward-facing surface gets
+  no sun — the GLB reads 755. My edit also broke E's `dump_bird.mjs` (module-scope `loadGLB` under
+  node); gated on `IN_BROWSER` and re-run green. Two stale `154 tris` comments corrected to **182**.
+- **FILED:** the arcade's awning posts land **±0.50 m from the centreline — two rows 1.00 m apart, 34
+  posts down a 5.00 m lane** (my own measurement, confirming E's). One clamp fixes it, but it belongs
+  with the scheduled arcade treatment, not ahead of it.
+
+## Round 38 (v8 WAVE 1 — INHABITATION) — all four runtime items, **+1 walked draw for the lot**
+
+Full detail + every number in LANE_B_NOTES §38. Measured as a true A/B: two port-isolated no-store
+servers (`:8472` = `git archive HEAD`, `:8471` = treatment, assets symlinked so E's mid-round wave is
+identical on both), 102 walked 8 m spine steps at yaw 0, each frame fully streamed, rendered through
+the shell's own composer. **The citizen sim + tram are hidden identically on both sides** — with them
+live the same step read control 346 vs treatment 232, because peds spawn on wall-clock time.
+
+| walked spine, sim quiet | HEAD | R38 | delta |
+|---|---|---|---|
+| worst draws | 224 | **225** | **+1** |
+| worst tris | 89,502 | **93,298** | **+3,796** (of ~75k spare — the cheap resource, spent) |
+| sum draws over 102 frames | 16,676 | **16,663** | **−13** |
+
+Isolated at a fixed pose: **washing +1 draw / +512 tris · magpie +1 draw / +182 tris · every yard box
+prop +0 draws.** `?yards=0` reproduces HEAD **exactly** (224 / 89,502 / 16,676).
+
+- **§1.2 the character vector** — `character.js`, 23 towns, ground palette + sky bias + ambience mix.
+  **+0 draws, +0 tris.** Classic is byte-identical **by construction, not by flag**: `townCharacter(null)`
+  returns the v1 literals, and a null tint keeps the *same material cache key*, so classic gets the same
+  object. Default-boot ground hashes identical to HEAD mesh-for-mesh; `?classic=1` hashes unmoved from
+  R37. Sky feeds the **base** `skyName`, never `setSky` (a one-way latch that would have killed R32's
+  dawn dome on all 23 towns). The vacuous arm is **per-town** — `newtown_godverse`/`redhill_godverse`
+  carry `state: ''`, so a per-corpus arm would have dropped exactly those two silently. **21 distinct
+  palettes across 23 towns.** `gravel` and `reddust` were not unwired but *unwireable* — their `use`
+  values named no slot `ground.js` had; making the slot addressable fixed it at the root. E's three new
+  grounds landed mid-round and the upgrade was a name change in one table.
+- **§1.4 backyard Australia** — inside `boxMats`, **+0 draws**. 145 houses inset off their boundaries so
+  there is a yard to put things in; **36 `yard` lots that had rendered as blank shopfront sheds since v1**
+  are now fenced blocks with a hoist, a shed and often a tank. Collision byte-identical.
+- **§1.4's washing** — **ONE town-wide InstancedMesh, +1 draw at any N**, cap 256, proximity-first off
+  the R37 chunk seam. Per-chunk would have been +1 × 31 live chunks = 4× the whole margin. **0 on every
+  real town** (no hoists ⇒ no mesh) and **0 at night** (it comes in). I **wrote the inverted wind mode**
+  rather than dropping it: the shipped top-weighted weight moves a hem **0.10 cm calm / 0.67 cm gusty**;
+  `pegged` gives **4.5 cm / 31 cm**, a ~52× gain, in the right place. The `canopy` string is byte-for-byte
+  unchanged.
+- **§1.3 the magpie** — **+1 draw on screen, exactly 0 otherwise; 182 tris of 900.** Territory scales
+  with the graph: **6 on 6.78 km synthetic → 157 on bendigo's 188.6 km / 2,593 edges, nearest 120 m.**
+  Latch is runtime-only: it sets, the day roll clears it, **localStorage gains no key** and the save file
+  never mentions it. `swoopPos()` is exported and pure. The hat stays cut.
+- **§1.1 the audio layer** — **six new mixer layers, zero draws, zero tris**, seeded anchors, distance
+  falloff, and **a `StereoPannerNode` per layer** so direction is real (measured spread −0.71…+0.85)
+  instead of a limitation written down. Day-of-week derived locally. All six anchored on the default
+  boot; **3 of 6 report `no-anchor` on real towns** rather than being faked. The falsifiability control
+  — one manifest key renamed away on a third port — makes that source report **`no-entry`, 0 plays,
+  never `audible`**, five others unchanged.
+
+**Two defects my own green numbers could not see, both caught by a screenshot.** The washing shipped at
+256 instances / +1 draw / cap respected **and was invisible behind its own back fence** (per-instance peg
+height + a fence taller than the hoist); the magpie perched **on thin air** over the road. R37's lesson,
+relearned at full price. Territories now snap to `furniture.js`'s own streetlight rule.
+
+**Lane E's props, adjudicated:** hoist + aerial **permanently primitive** (E's spike killed them
+outright, and primitive is also the +0-draw mechanism) · `paling_fence` at 1,121 tris × **905 runs =
+1.01 M triangles** — no · `magpie` GLB **held for the tint**: it currently reads as a crow, and a magpie
+seen for 1.2 s in peripheral vision *is* its white bar. My 182-tri bird already carries it.
+
+## Round 37 (v8 WAVE 0 §0.1 + §0.4) — THE KERB IS FOOTPATH, at +0 draws · commit `47db478`
+
+John's ruling landed as geometry. `ground.js` narrows the road quad to the carriageway and extends
+the **existing** merged `footGeos` class inward to meet it, consuming Lane A's `vergeBand(e)[0]`.
+- **+0 draws, proven not asserted**: identical draw count at every one of 102 walked spine steps
+  (worst frame **276 both**, sum **20,081 both**) and on `katoomba_real` (worst 100 both).
+  **Tris went DOWN** — −8 synthetic, −288 katoomba. The charter's "~2k tris" was an estimate against
+  a class that already existed; extending a quad re-parameterises it. Honest number, stated loudly.
+- **14 of 14 gig posters were standing in painted bitumen. 0 are now.** No poster moved; the ground did.
+- Surfaces verified by **raycast**: `main`@24 road 0–5 / footpath 5.25–15.25 · `side`@12 (72% of the
+  corpus) road 0–3 / footpath 3.25–9.5 · **`lane` degenerate `[4,4]` ⇒ pre-ruling geometry** ·
+  **`arcade` all footpath, no road quad, no kerbs** · **residential keeps its grass nature strip**.
+  The lane case branches on `outer <= inner`, never on a band literal (Fable's mid-round correction).
+- **A defect my own numbers could not see:** the first cut painted every intersection shut (a 12.5 m
+  footpath crosses the perpendicular *carriageway*, where a 3.5 m one only clipped a corner). All
+  numbers were green; the screenshot was not. Fixed by putting the carriageway on top under the flag.
+- **`?verge=0` ships permanently** and is EXACT: ground vertex+UV hashes identical to the HEAD build,
+  and the same detector goes red on the default boot.
+- **`?classic=1` is FENCED, not amended** (R31 dig-flip pattern): identical ground geometry AND
+  identical ground-only rendered pixels at three poses. → Fable's call if classic should be amended.
+- **§0.4** — the chunk seam was never connectable: on HEAD `!!chunks.ctx === false`, so a consumer
+  holding only `PROCITY.chunks` had nowhere to attach. Now `chunks.onChunkBuilt(fn) → unsubscribe()`
+  (many consumers) + `chunks.ctx` (the documented single slot). 136 built / 144 disposed over a walk,
+  payload + key shape verified, throwing subscriber survives, and **zero behaviour change with no
+  subscriber**: a 102-step per-frame walk hashes `ceb1ec66` on both builds. `sim.js` untouched.
+
+## Round 30 (v7.0-alpha ledger #4) — THE COLLECTION UI + SLEEP surface · qa GREEN 6/6
+
+The crate panel + game bar in `hud.js` (my DOM-overlay patterns), on F's §30.1 `PROCITY.game`
+contract — and verified against F's REAL committed core (`207bcff` landed mid-round; my test
+snapshot diffed byte-identical to it — **nothing stubbed**, unlike C's wave-1 run).
+- **Game bar** (bottom-right): `day N · $cash` · `CRATE n` (count in the standing HUD; opens the
+  panel, `C` toggles) · `☾ SLEEP` → `game.sleep()`, enabled any time (alpha).
+- **Crate panel**: cover thumb (pack-atlas CSS crop off the entry's sku — per-shop godverse base or
+  town-wide; parody = type glyph by design), title/artist, `paid $p · where · day d`, newest first,
+  header totals. 50-row rebuild 0.9 ms; 0 draws (DOM-only).
+- **Construction-gated on the game object itself** (lazy, R19-selector style): `?classic=1`/`?game=0`
+  ⇒ zero game DOM, zero listeners, help line byte-identical, 0 console errors (measured, clean tabs).
+  `?noassets` ⇒ 0 stock fetches, placeholders stand.
+- **SLEEP proven end-to-end**: day 1→2, weekNight 0→1, wake DAWN seg 0, `procity-save/1` on disk,
+  next boot loads it and the UI reads it. **venue.js §30.4 filing fixed as filed** — compat
+  `venueShopId` is now a live weekNight-keyed getter (116 → 490 across a sleep, measured).
+- Full measurement table + honest notes: LANE_B_NOTES §30. Verified on a port-isolated no-store
+  :8151 snapshot server (not :8130/:8144 — Lane F was mid-flight in the shared tree).
+
 ## Round 9 (Fable's ROUND9 → Lane B) — v2 tour bookmarks + tram (`?tram=1`) · qa GREEN
 
 Ship-v2.0 round. Two deliverables, both v2-law clean, `qa.sh --strict` GREEN, flags-off byte-identical.

D-progress.md

@@ -1,5 +1,528 @@
 # PROCITY-D — progress (Lane D · Citizens)
 
+## Round 42 (§42.4) — RECAST, WIRED: five bodies swapped at their own index, and the crowd did not move. (2026-08-07)
+
+Lane E retired five ped bodies on ruling 1 and sourced five replacements. This round wires them, and
+the whole job is one sentence with a measurement behind every clause: **the town changed clothes and
+nothing else changed at all.**
+
+### The swap — IN PLACE, at the same index, in `web/js/citizens/rigs.js`
+
+Decision stated plainly: **the rejects are replaced at their index, not removed.** `pickRig` indexes
+`PED_NAMES`, and every citizen stores the result as `pedIndex`, which is in the identity signature
+*and* is the impostor atlas's subject index. Deleting a name shortens a pool, renumbers every slot
+after it and moves every seeded identity downstream — the R2 fleet-order bug through a different
+door, and it would move Lane F's goldens. Replacing at the index moves nothing.
+
+| pool | slot | `fleet.all` | out | in | Mixamo | tris |
+|---|---:|---:|---|---|---|---:|
+| `normal` | 6 | 6 | `man_elder_01` (robed wuxia elder) | **`man_casual_04`** | Ch31 | 2 533 |
+| `normal` | 9 | 9 | `man_soldier_ww2_01` (WW2 infantryman) | **`person_casual_01`** | Ch21 | 2 956 |
+| `djs` | 4 | 21 | **`dj_phrtt_01` (unclothed body)** | **`man_smart_01`** | Ch23 | 2 617 |
+| `comical` | 0 | 22 | `comical_luchador_01` (EL CHUPACABRA) | **`woman_smart_02`** | Ch41 | 2 494 |
+| `comical` | 1 | 23 | `comical_boy_01` (cartoon child) | **`person_youth_01`** | Ch22 | 2 738 |
+
+Pool lengths **unmoved: normal 17 · djs 5 · comical 2 · `fleet.all` 24** (`?classic=1`: 17 / 19).
+`comical` is now a misnomer kept on purpose — both members are ordinary people (E's ruling-1 call),
+but the KEY is load-bearing for `fleet.comical`, `pickRig`'s 8 % branch and two QA gates, so the name
+stays and the meaning is documented at the declaration.
+
+**`dj_phrtt_01` is gone from the default boot, measured at the wire, not asserted from the source:**
+a fresh default context fetches **32 ped GLBs and not one of them is a retired body**; `?classic=1`
+fetches 21, likewise none. The GLB is still on disk and still on the depot — neither is mine to
+delete (see *For Lane E / Lane F* below).
+
+### Determinism — the crowd is not merely reproducible, it is BYTE-IDENTICAL to before the swap
+
+| | result |
+|---|---|
+| two fresh contexts, same seed → identity signature (`id:pedIndex:pvar:height:speed:edge:forward`) | **byte-equal**, 150 active citizens |
+| …and posture signature | **byte-equal** |
+| CONTROL: seed 20261991 | **differs** (141 citizens) — byte-equal is not constant |
+| CONTROL: every clip GLB delayed 2 s | **identical** — posture is `(citySeed, id)` alone |
+| **pre-swap tree vs post-swap tree, same seed, same bookmark** | **0 differing lines of 150** |
+| three-way (pre-swap · post-swap · post-bench-rewire) | **all byte-equal** |
+
+**What moved:** which GLB each `pedIndex` points at, i.e. what the crowd looks like — intended.
+**What did not move:** every `pedIndex` value, every pool length, every `pickRig` mapping, every
+citizen's height/speed/edge/direction, every posture assignment, and the impostor atlas's subject
+order. The identity signature diff across the swap is empty, which is the strongest form of this
+claim available: not "same seed gives the same crowd", but "the same seed gives the *same crowd it
+gave yesterday*, in different clothes".
+
+### Draws — a total cannot answer this question; a difference can
+
+| bookmark | pre-swap | post-swap | post-bench-rewire | budget |
+|---|---:|---:|---:|---|
+| street_noon | 194 | 194 | 195 | ≤300 |
+| crossroads_busy | 108 | 108 | 107 | ≤300 |
+| night_crowd | 127 | 127 | 127 | ≤300 |
+| market_square | 94 | 96 | 96 | ≤300 |
+| night_neon | 111 | 111 | 111 | ≤300 |
+| venue_night | 141 | 141 | 141 | ≤300 |
+| district_posters | 235 | 235 | 235 | ≤300 |
+| patronage_door | 105 | 108 | 108 | ≤300 |
+| interior (record) | 57 | 57 | 58 | ≤350 |
+
+**Stated honestly: those totals are not evidence about my change, and I am not going to pretend they
+are.** This is a shared tree with four lanes landing work in the same hour, sampled while a
+wall-clock crowd walks through frame; ±1 appears run-to-run on an unchanged tree, and the +2 at
+`market_square` / +3 at `patronage_door` persisted across both post-swap runs — so they are somebody's
+change, and the decomposition below proves they are not the crowd's.
+
+**The measurement that does answer it** (`r42_cast.py` arm 4): render the frame, hide
+`citizens.group`, render again. The difference is the crowd's own cost, in one frame, with nothing
+else changing.
+
+| bookmark | draws | crowd in | crowd out | **crowd's cost** | near rigs | mid | expected |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| street_noon | 194 | 194 | 189 | **5** | 4 | 37 | 5 |
+| crossroads_busy | 107 | 107 | 97 | **10** | 9 | 30 | 10 |
+| night_crowd | 127 | 127 | 124 | **3** | 2 | 10 | 3 |
+| night_neon | 123 | 121 | 119 | **2** | 1 | 9 | 2 |
+| district_posters | 187 | 187 | 184 | **3** | 2 | 17 | 3 |
+| venue_night | 139 | 137 | 133 | **4** | 3 | 4 | 4 |
+| market_square | 112 | 110 | 109 | **1** | 0 | 10 | 1 |
+| patronage_door | 105 | 105 | 102 | **3** | 2 | 36 | 3 |
+
+**8/8: the whole crowd costs `nearRigs × 1 + 1`** — one draw per near rig (every ped GLB is one
+primitive and one material, measured off the bytes for all five new bodies) and exactly one for the
+entire instanced billboard layer whatever it holds. At `market_square` the crowd's total cost is
+**1 draw**, so the +2 there cannot be mine. A one-for-one swap of one-draw peds has no mechanism by
+which to move the street number, and ruling 4's nine draws are untouched. Same LOD tiers, same
+`NEAR_MAX = 24` cap, same single mid draw.
+
+### The contract, re-measured on today's tree (E's claims verified, not trusted)
+
+Read straight off the GLB bytes — no browser, no three, no deps — and then replayed through
+`rigs.js`'s own filter over **all 54 shipped clips** (8 base + Lane E's 46-clip library):
+
+| ped | nodes/joints | prim/mtl/img | anims | boneset | bindable tracks | worst clip |
+|---|---|---|---:|---|---|---:|
+| `man_casual_01` (reference) | 67 / 65 | 1 / 1 / 1 WebP | 0 | — | 3 456 / 3 460 | 64 |
+| `man_casual_04` | 67 / 65 | 1 / 1 / 1 WebP | 0 | **IDENTICAL** | **3 456 / 3 460** | 64 |
+| `person_casual_01` | 67 / 65 | 1 / 1 / 1 WebP | 0 | **IDENTICAL** | **3 456 / 3 460** | 64 |
+| `man_smart_01` | 67 / 65 | 1 / 1 / 1 WebP | 0 | **IDENTICAL** | **3 456 / 3 460** | 64 |
+| `woman_smart_02` | 67 / 65 | 1 / 1 / 1 WebP | 0 | **IDENTICAL** | **3 456 / 3 460** | 64 |
+| `person_youth_01` | 67 / 65 | 1 / 1 / 1 WebP | 0 | **IDENTICAL** | **3 456 / 3 460** | 64 |
+
+E's numbers reproduce exactly, including the facing check (toe−heel ΔZ / span **+0.100 … +0.136**,
+all positive, front = local +Z). No Draco anywhere. **I did not need to fix an asset.**
+
+**And the control found something E's audit did not.** The gate needs a subject that must FAIL, and
+one was already on disk: the retired `comical_boy_01` scores **3 132 / 3 460, worst clip 58**,
+because six of its thumb bones — `{Left,Right}HandThumb{2,3,4}` — carry no `mixamorig:` prefix. A
+ped that shipped for 41 rounds had been silently dropping six tracks per clip on both hands. It is
+being replaced for period reasons; it should have been replaced for correctness reasons too.
+
+### Animation — every new body actually MOVES, not merely loads
+
+Each replacement spawned by name through the real `makeActor` path, playing walk and then idle, 24
+mixer steps at 1/30 s. The reference ped runs the identical course as the control.
+
+| body | walk: tracks · mixer Δt · bone travel · stature range · head-above-hips | idle |
+|---|---|---|
+| `man_casual_04` | 64 · 0.8 s · 83.4 · 1.687–1.728 m · +0.586 m | 64 · 0.8 s · 47.2 · 1.761–1.799 m · +0.583 m |
+| `person_casual_01` | 64 · 0.8 s · 81.9 · 1.663–1.722 m · +0.580 m | 64 · 0.8 s · 45.4 · 1.754–1.783 m · +0.578 m |
+| `man_smart_01` | 64 · 0.8 s · 84.3 · 1.667–1.722 m · +0.541 m | 64 · 0.8 s · 46.9 · 1.748–1.786 m · +0.539 m |
+| `woman_smart_02` | 64 · 0.8 s · 83.6 · 1.652–1.721 m · +0.567 m | 64 · 0.8 s · 45.8 · 1.746–1.775 m · +0.565 m |
+| `person_youth_01` | 64 · 0.8 s · 83.9 · 1.662–1.731 m · +0.534 m | 64 · 0.8 s · 47.0 · 1.736–1.765 m · +0.529 m |
+| `man_casual_01` (control) | 64 · 0.8 s · 85.9 · 1.678–1.727 m · +0.577 m | 64 · 0.8 s · 47.8 · 1.764–1.805 m · +0.575 m |
+
+**64 bound tracks each** — the reference's own score. The two traps E's clip work guarded against are
+checked directly: the **flat-body / R16 fold** (head never closer than +0.53 m above the hips through
+either clip; a folded body reads ~0) and the **stature collapse** (never below 0.94 × nominal). Bone
+travel is ~83 for walk and ~46 for idle on all six — the skeleton is genuinely moving, and moving the
+same amount as the ped that has shipped since R2.
+
+### No-giants gate — green, and now spanning three bind scales
+
+`tools/qa/interior_scale_check.py`: **PASS — 29 interior figs across 6 shops all human-sized
+[1.4, 2.0] m and under-ceiling.** The R36 gated-tail leg now spans every native bind scale the
+roster contains and `rigs.js`'s span-normalise absorbs all of them:
+`woman_dj_01 0.986u→1.63m · woman_dj_02 0.987u→1.69m · woman_dj_03 0.984u→1.76m · dj_techno_01
+0.986u→1.85m · man_smart_01 **1.764u**→1.82m` (the legacy roster is ~173–180 u, the centimetre
+convention). **One line changed in that gate**, and it is declared here because the file is not on
+my §42.4 editable list: its `DJ_BODIES` array named `dj_phrtt_01` literally, so the swap would have
+turned it red with "NOT IN FLEET". `dj_phrtt_01` → `man_smart_01` — the same `PED_NAMES.djs` slot,
+the same `fleet.all[21]`, so the leg still covers exactly indices 17–21. No threshold, rule or
+assertion was touched.
+
+### Impostor vs rig at the swap boundary
+
+R2's break was a **systematic** 1.67× — a double-tone-mapped impostor material, every ped at once —
+so an absolute tolerance is the wrong instrument. The bake lights the ped with its own key+hemi+env
+and the street lights it with the sun, so the billboard/rig luminance ratio is per-albedo and 1.000
+was never the contract. Method: stage the subject in the live shell at a fixed spot, once as a near
+rig posed at the atlas's own bake phase and once as a single instance of the LIVE atlas; difference
+each against an empty frame; count only pixels inside the billboard quad's projected box. Contact
+strip: `docs/shots/laneD/r42_impostor_boundary.jpg`.
+
+| | billboard/rig luminance |
+|---|---|
+| the **19 bodies this round did not touch** (control population) | **0.470 – 2.100**, median 0.972 |
+| worst-matched body in the whole town | `man_dj_streetwear_01` **0.470** — shipped long before this round |
+| the five new bodies | 0.960 · 0.673 · 1.171 · 1.323 · 1.098 — **every one inside the untouched roster's own spread** |
+| systematic shift (new median ÷ untouched median) | **1.13×** (R2's break was 1.67× on the whole fleet) |
+
+**Verdict: the swap does not widen the near↔mid seam.** Filed for a later round, not faked here: the
+seam itself is loose (a 4.5× spread across the roster) because the atlas is baked under fixed studio
+light and displayed under the sun — a real improvement is baking under the scene's own key, and that
+is a system, which ruling 5 forbids this round.
+
+### Lane B's §42.5 landed mid-round and broke my bench code. The mirror is retired.
+
+B fixed a 41-round-old defect: benches were placed with `yaw = atan2(ux, uz)` — local +Z **down the
+street** — while both files' comments said "facing the road". My R41 `benchStationsFor()` was a
+faithful copy of that wrong line, so the fix made it 90° stale and `_seatPose` would have put sitters
+up to 0.38 m off the plank facing along the street.
+
+**Fixed by deleting the copy, not by rotating it.** `sim.js` now imports `benchStops(plan)` from
+`world/furniture.js` and `benchStationsFor(e)` is a thin adapter that wraps the sim edge back into
+the two-node plan shape `resolveEdges()` wants. It has no arithmetic of its own; the rule exists once
+in the repo, in the function B's placer also calls. The three constants the mirror carried
+(`FURN_FOOT`, `BENCH_S0`, `BENCH_STEP`) are gone from `sim.js`.
+
+| | measured |
+|---|---|
+| bench front vs direction-to-road, 40 stations | **0.0° (min = median = max)** — was 90.0° |
+| bench front vs the street's own direction | 90.0° |
+| stations matched to real instanced geometry (`r41_citizens.py` arm 6) | **14/14 within 2 cm · 14/14 on yaw** |
+| CONTROL: the same stations offset 2 m | **0/14** — "coincides" is a measurement |
+| live sitters, off the bench origin | **+0.06 m in front · ±0.38 m along the plank · 0.0° between look direction and the road** |
+| identity + posture signatures across the rewire | **byte-identical** (station COUNT unchanged ⇒ same randoms drawn) |
+
+`_seatPose` needed no edit: it was written in the bench's own local frame (+Z front, +X plank), so
+the corrected yaw carries straight through. The import is **static on purpose** — the bench check
+draws three seeded randoms per crossed station, so a dynamically-imported station list would draw
+zero until it landed and "same seed → same crowd" would start depending on the network. `chunks.js`
+already imports `furniture.js` on every boot (classic and `?noassets` included), so the game path
+gains no fetch, no module and no behaviour. The standalone `citizens_test.html` does gain one
+fail-soft depot fetch; smoked green, 507 active citizens, 0 console errors.
+
+### The browse smoke (F's filing) — fixed, and `r41_shots.py` exits 0
+
+The arm scanned up to 8 occupied shops at ~3.1 s each, kept the id of the best, **exited**, and
+re-entered it 16–25 s later — choosing a subject out of a live simulation and then going back for it.
+The fix is not a longer wait or a retry: the frame, the measurements and the JPEG are now taken
+**inside the winning room, the moment a candidate beats the incumbent**, and the harness never
+leaves. The scan keeps its original "best of several, not first that works" behaviour. The winning
+shop's occupancy at entry and at the end of the scan is printed into the sidecar on every run, so the
+decay the old path walked into stays legible instead of being a story in a comment.
+
+Result: `tools/qa/r41_shots.py` **rc 0** — `Echo Toys & Games`, 3 browse points, **1 browser in
+frame playing `browse_open_cabinet`**, keeper on `idle_weight_shift`, 61 draws of the ≤350 interior
+law, both figures human-sized. It can go strict.
+
+**The diagnosis, corrected by measuring it.** F filed this as *deterministically* red. It is not, on
+today's tree. I ran the R41 arm **verbatim, inside its own harness, after the same street arm and the
+same 60 s soak**, and it came back `{browsePoints: 3, browsers: 1}` on the re-entry — green. Two
+isolated repros agreed (one found 2 browsers still there after a 16.4 s scan, occupancy 2 → 2). So
+the correct claim is not "it was always red and now it is green"; it is that the arm was **flaky by
+construction** — it chooses a subject out of a live simulation and then goes back for it 16–25 s
+later, and whether the occupants are still there is not something the harness controls. That is
+exactly the property that cannot go `--strict`. Removing the window removes the flake; the residual
+failure mode ("no occupied shop has browse points with browsers at all") is real, deterministic, and
+worth failing on.
+
+### Gates
+
+```
+tools/qa/r42_cast.py            PASS — contract · roster · determinism · draws · animation · impostor
+tools/qa/r41_citizens.py        PASS — boot ledger, lazy loading, determinism, draw table,
+                                       asset-free, bench binding (14/14 + 14/14 yaw), venue clips
+tools/qa/interior_scale_check.py PASS — 29 figs / 6 shops, all human-sized, under ceiling
+tools/qa/r41_shots.py           rc 0 — street + browse interior, browse arm now shot in place
+tools/qa/r42_shots.py           rc 0 — r42_street_crowd.jpg + r42_pub_crowd.jpg, cast named in both
+console errors                  0 on default · 0 on ?classic=1 · 0 on the impostor arm
+```
+
+### Shots
+
+- `docs/shots/laneD/r42_pub_crowd.jpg` — **the before/after**, shot on Lane F's own §41.6 hero recipe
+  (`?gigs=1`, segment 5, The Exchange Hotel, Lane C's `room.spawn` line, back 5.2 m, eye 1.62 m) so
+  it is frame-comparable with `docs/shots/laneF_r41/pub_furnished.jpg`. **BEFORE:** a purple
+  `EL CHUPACABRA` luchador filling the foreground, a second on the stage, and an unclothed figure at
+  the stage edge. **AFTER:** 13 figures wearing 11 distinct bodies, none of them retired.
+- `docs/shots/laneD/r42_street_crowd.jpg` — the recast roster on the footpath, with the corrected
+  bench pose.
+- `docs/shots/laneD/r42_impostor_boundary.jpg` — near rig ‖ mid billboard for the five new bodies
+  plus the reference, with each pair's measured luminance ratio.
+- Both crowd sidecars carry the **R10 human-sized line** *and* a **CAST line** naming every body in
+  frame and asserting none is retired — because "the luchador is gone" is a claim about the cast and
+  a JPEG cannot carry it alone.
+
+### For Lane E / Lane F
+
+- **`dj_phrtt_01.glb` is still in `web/models/peds/` and still on the depot** (`_normalized/`,
+  `_published.json`). It is no longer reachable from the game — nothing names it — but the file is
+  not mine to delete. **E: withdraw the depot copy.** **F: the §42.6 period-law name gate should read
+  `PED_NAMES`, not the directory listing**, or it will go red on files that no longer ship.
+- **`comical_boy_01` was a real contract break, not only a period one** (3 132/3 460, six unprefixed
+  thumb bones). If any other Mixamo asset was converted through the same path, check its boneset.
+- **The near↔mid impostor seam is loose town-wide** (0.470–2.100 across the roster; worst is
+  `man_dj_streetwear_01`, not a new body). Filed for R43: bake the atlas under the scene's own key.
+
+### Files touched
+
+`web/js/citizens/rigs.js` (the swap + the law at the declaration) · `web/js/citizens/sim.js` (bench
+mirror retired → `benchStops` import) · `web/js/citizens/keepers.js` (publish `pedIndex` on the
+keeper handle — informational, draws no randoms, so the room's cast is auditable at runtime the way
+`band.js` members already were) · `tools/qa/r42_cast.py` (new) · `tools/qa/r42_shots.py` (new) ·
+`tools/qa/r41_shots.py` (browse arm) · `tools/qa/interior_scale_check.py` (one array entry, declared
+above) · `D-progress.md` · `docs/LANES/LANE_D_NOTES.md` · `docs/shots/laneD/**`. **No git command was
+run.** I did not touch `web/models/**`, `web/assets/**`, `pipeline/**`, `web/js/world/**`,
+`web/js/interiors/**`, `web/index.html` or `tools/qa.sh`.
+
+---
+
+## Round 41 (§41.3) — the citizens come alive: Lane E's 46 clips wired, 20 of them now in play. (2026-08-07)
+
+**The measurement that is the round.** A census of the live crowd at the retail heart, 12 samples ×
+146 active citizens, same seed, same pose, two arms — where `?clips=0` is a new flag that turns the
+motion library off and **nothing else** (`?classic=1` also changes the ped pool, the fog, the game
+and half the shell, so it cannot be the control for this):
+
+| state of the street crowd | `?clips=0` = R40 | default = R41 |
+|---|---:|---:|
+| walking | **99.3%** | 78.1% |
+| sitting on an actual Lane B bench | — | **9.5%** |
+| leaning on a shopfront | — | **7.1%** |
+| stopped at a window in their own seeded idle | 0.4% | **5.1%** |
+| R17 free sit · R29 glance | 0.2% · 0.2% | 0.1% · 0.1% |
+| **distinct animation clips in play across the crowd** | **4** (`walk`/`idle`/`sit`/`look` — and 99.3% of the crowd is on `walk.glb` alone) | **20** |
+
+Lane E's input was verified before anything was wired: `python3 pipeline/clips_verify.py` → GREEN,
+0 errors / 0 warnings, 46 clips / 6 groups / 3 498 124 B, every group zero-draw.
+
+### What each clip category drives
+
+| group | clips used | drives |
+|---|---|---|
+| `idles.glb` (boot) | **10 of 10** | the per-citizen deterministic idle — the resting action of every near-tier actor, plus the seeded shopkeeper idle |
+| `locomotion.glb` (boot) | 1 of 6 | `walk_shopping_bag` — the walk pool is `['@walk','@walk','walk_shopping_bag']`, so **1 in 3 citizens carries a bag** (measured 33.7% over 1 000 ids) |
+| `sitlean.glb` (lazy: first sit/lean intent) | **8 of 8** | 4 sits bound to Lane B's benches, 4 leans bound to shopfront walls |
+| `browse.glb` (lazy: first interior with browsers) | 5 of 8 | a real BROWSE state at Lane C's browse points, seeded per (shopId, slot) |
+| `venue.glb` (lazy: gig night, from the street) | 5 of 6 | gig-crowd widening + the publican pouring + the record-shop keeper in headphones |
+| `social.glb` | **0 of 8 — never fetched** | needs a two-person state machine + partner pairing. 896 KB for a state D does not have. → R42 |
+
+Unused and why: the four `turn_*` + `walk_to_stand` (the sim turns instantly at a node — a turn state
+is R42 and is the only thing that makes those five mean anything), `browse_hold_turn_l/r` (172°/147°
+loop seams, one-shot turns), `venue_clap_seated` (no seated venue slot).
+
+### Boot fetch count and memory — measured in fresh headless contexts
+
+| | clip fetches | bytes resident | groups / clips |
+|---|---:|---:|---|
+| **at boot** | **4** — manifest (16 KB) · `clipbank.js` · `idles.glb` · `locomotion.glb` | **1 242 272 B** | 2 / 16 |
+| + first street sit/lean intent | +1 `sitlean.glb` | 1 600 384 B | 3 / 24 |
+| + first interior with browsers | +1 `browse.glb` | 2 076 440 B | 4 / 32 |
+| + first gig night | +1 `venue.glb` | 2 602 476 B | 5 / 38 |
+| `?clips=0` · `?classic=1` · `?noassets=1` | **0** | 0 | 0 / 0 |
+
+Six fetches at boot was what the round warned about. The answer is **two GLBs at boot, three on first
+demand and one never**, each promise-cached (the bank does not grow across 6 interior enter/exit cycles).
+**Heap delta (library ON − OFF), forced GC, fresh contexts: +3.34 MB and +6.87 MB across two runs** —
+the spread is GC timing; the floor is resident clip bytes plus parsed `AnimationClip` overhead.
+`mixerMs` unchanged: median 0.1 ms both arms.
+
+### Determinism — same seed, same postures, byte-equal
+
+- 150 active citizens, **two fresh browser contexts → byte-equal** posture signature.
+- **CONTROL:** seed 20261991 gives a different signature — "byte-equal" is not "constant".
+- **CONTROL that matters for lazy loading:** with **every clip GLB delayed 2 s** by a Playwright
+  route, the signature is **identical**. Posture is a pure function of `(citySeed, id)`
+  (`postures.js posturesFor`), decided once at citizen creation and never re-rolled, so loading can
+  change *when* a posture appears, never *which one*.
+- One level down: `fleet.clipsRequested` is published **synchronously** by `loadPedFleet` before the
+  dynamic import starts, and every roll that can move a citizen is gated on that rather than on
+  "has it landed", so the number of randoms drawn per boot cannot depend on the network. Six
+  freshly-keyed streams (`posture`, `benchstop`, `leanstop`, `browse-pose`, `keeper-pose`,
+  `gig-pose`) collide with none of the 12 pre-R41 keys — gated, with the control that all 18 produce
+  different draws on the same id.
+- 1 000 citizens × two module instances in node: identical (`sha256 08ecfe041b384460`).
+
+### Draw table — before / after, same seed, same bookmarks
+
+| view | `?clips=0` | default | Δ | budget |
+|---|---:|---:|---:|---|
+| street_noon | 193 | 193 | **+0** | ≤300 |
+| crossroads_busy | 108 | 108 | **+0** | ≤300 |
+| night_crowd | 128 | 128 | **+0** | ≤300 |
+| market_square | 94 | 94 | **+0** | ≤300 |
+| night_neon | 111 | 111 | **+0** | ≤300 |
+| interior (record) | 110 | 110 | **+0** | ≤350 · margin **240** |
+
+Ruling 4 gave the street no headroom and the round spent none. The clips are skeleton-only (0 tris,
+0 meshes, 0 materials), so the only mechanism by which they could move a draw count is putting a ped
+somewhere else — bounded by the unchanged near-cap of 24 rigs, each already one draw. **Stated, not
+hidden:** 193 is the worst of these five bookmarks on this seed, not the town's global worst (B's
+R40 street number is 291/300 at a night pose these bookmarks do not reach). The **delta** is the
+claim, and it is 0.
+
+### `?noassets=1` and `?classic=1` — the fallback survives, proven
+
+| | clip fetches | bank | town | console |
+|---|---:|---|---|---|
+| `?noassets=1` | **0** (no GLB, no manifest, not even `clipbank.js`) | none | 20 chunks, 165 citizens walking | 0 errors |
+| `?classic=1` | **0** | none | 18 chunks, 139 citizens walking | 0 errors |
+| `?clips=0` | **0** | none | full town | 0 errors |
+
+The library rides `clips = dance`, the R36 `djs = dance` trick again: the shell already passes
+`dance: !CLASSIC`, so **no `index.html` edit was needed** and the zero-fetch-delta covenant holds —
+including on the JS surface, because `clipbank.js` is reached by a dynamic `import()` and is not
+fetched when the gate is off.
+**One honest line on the `?classic=1` fetch delta.** It is zero for ASSETS — no clip GLB, no
+manifest, and not even `clipbank.js` (dynamic import behind the gate). It is **+1 JS module**:
+`postures.js` (7 098 B, pure data + five pure functions) is a static import of `sim.js`/`keepers.js`/
+`band.js` and so is fetched on every boot, exactly as R40's `door_snap.js` (4 017 B) already is. Zero
+asset bytes, zero GLB, zero behaviour under the gate — but stated rather than left to be found.
+
+
+### Leak
+
+Warm the caches with one enter/exit, then **6 more cycles into the same shop**: geometries 118 → 118
+(**+0**), textures 91 → 92 (**+1**), clip bank flat at 4 groups / 32 clips. The R2 shared-resource
+disposal contract still holds with more clips resident — `AnimationClip`s hold no GPU resources, and
+`_disposeInner` still disposes only the clone's own `Skeleton`.
+
+### The two measurements that changed the design
+
+1. **The idle pool was invisible.** Wired only to the R17/R29 window-shop loiter — which fires at a
+   graph NODE, and edges are long — a census found **0.8% of citizens stopped at any instant**. Nine
+   of ten new idles were assigned, deterministic, and never seen: the brief's headline failing while
+   the gate went green. Fix: a **window pause** on the R8 patronage stride check (the moment the sim
+   already asks "is there a shop beside me"). Stopped share **0.8% → 5.1%**, and all ten idles now
+   appear in a 12-sample census.
+2. **The lean was never firing.** Also wired to the node loiter at first — i.e. at intersections,
+   where there is rarely a shopfront to lean on. **Measured: 0 leans in a 9 s run.** Moved to the
+   same stride check. Now 7.1%.
+
+### The bench is a real bench
+
+R17's bench-sit sat a ped down at whatever node it stopped at, upright, on air. R41 binds it to Lane
+B's actual furniture: `benchStationsFor(edge)` mirrors `furniture.js:203-209` exactly, a ped can only
+take a bench on its own footpath side, and the 1.6 m plank **seats two** (a measured need — the first
+soak put two citizens on one station to the centimetre). Because that is a mirror of another lane's
+file, it is **gated, not trusted**: every derived station inside the streamed window must coincide
+with real instanced geometry within **2 cm**, yaw included — today **14/14 and 14/14**, against a
+scene of 2 435 instances. **CONTROL:** the same stations offset 2 m match **0/14**. Filed to Lane B:
+one `benchStops(plan)` export next to the existing `busShelterStops(plan)` retires the mirror.
+
+### Gig — widened, not redesigned
+
+The v3 dance pick (`gigdance` over `fleet.danceClips`) is untouched. A second, independently keyed
+`gig-pose` roll decides whether a crowd slot takes a venue clip instead — northern soul for a dancer,
+clap/cheer/headphones for a stander. Measured on a live gig: **8 crowd slots, 6 swapped, 2 keeping
+their R13 pick verbatim, 0 pending**. A slot that does not swap, and every boot where `venue.glb`
+is not resident, is byte-identical to R13.
+
+### Gates added
+
+| gate | what it proves |
+|---|---|
+| `node tools/qa/r41_postures.mjs` | manifest resolution · determinism · stream isolation · pool spread · loop safety. Zero deps, ~40 ms, five controls. |
+| `tools/.venv/bin/python tools/qa/r41_citizens.py` | 7 arms in fresh contexts: boot ledger · lazy loading · determinism incl. the 2 s forced stall · draw table both arms · `?noassets`/`?classic` · bench binding + control · leak · gig widening. |
+| `tools/.venv/bin/python tools/qa/r41_shots.py` | the two acceptance shots, camera chosen by measurement and occlusion-raycast, every figure measured for stature. |
+
+**→ F: three lines for `qa.sh`.** All exit 0/1, all deterministic.
+
+### Shots
+
+`docs/shots/laneD/r41_street_postures.jpg` — seed 20261990, midday, camera (11.6, 58.5) yaw −1.890.
+**8 near-tier rigs in frame, 3 distinct clips** (`@walk`, `walk_shopping_bag`, `sit_hands_thighs`): a
+hi-vis worker **sitting on a real Lane B bench** with his feet on the footpath, a comical ped walking
+centre-frame, and six more walkers up and down the strip. 126 draws of a 300 budget.
+
+`docs/shots/laneD/r41_browse_interior.jpg` — The Op Shop (opshop), 3 browse points. A **browser at
+the clothes rack on `browse_hold_idle`** — the ped who ducked in off the street, holding something
+instead of standing to attention — and the keeper behind the counter on `idle_happy_1`, his own
+seeded idle. 69 draws of a 350 budget.
+
+Both carry a `.txt` sidecar with the human-sized line: stature measured off the posed skeleton for
+every figure, as a ratio of that citizen's own nominal height. Today: sits 76–77%, browsers/keepers
+99–101%, walkers 95–100% of nominal. **No giant (>2.0 m), no fold (<55% of nominal).**
+
+### Goldens
+
+`node web/js/citygen/selfcheck.js` → **157 647/157 647, fingerprint `0x5f76e76`**, unmoved. No
+citygen file was touched.
+
+### Files touched (only these)
+
+`web/js/citizens/postures.js` (new) · `web/js/citizens/clipbank.js` (new) · `web/js/citizens/rigs.js`
+· `web/js/citizens/sim.js` · `web/js/citizens/keepers.js` · `web/js/citizens/band.js` ·
+`tools/qa/r41_postures.mjs` (new) · `tools/qa/r41_citizens.py` (new) · `tools/qa/r41_shots.py` (new)
+· `docs/shots/laneD/r41_*.{jpg,txt}` (new) · `D-progress.md` · `docs/LANES/LANE_D_NOTES.md`.
+**No git command was run.** Nothing under `web/models/`, `web/assets/`, `web/js/world/`,
+`web/js/interiors/`, `web/index.html` or `tools/qa.sh` was touched.
+
+---
+
+## Round 40 (§40.5) — the door points and the footpath: measured, kerb-clamped, gated. (2026-08-04)
+
+**Verification first, per the brief.** New gate `tools/qa/door_footpath_check.mjs` re-derives every
+door point EXACTLY as the shell does (`lot + front-normal·(d/2+0.6)`, web/index.html:433-437) and
+classifies it against the plan's own geometry (registry's `vergeBand` corridor law + lots + blocks).
+All numbers below are from today's runs on today's tree.
+
+| town | R39 (shipped) | today, B's fix only — footpath | today — walkable front | after D's clamp — footpath | **after D's clamp — walkable front** |
+|---|---|---|---|---|---|
+| synthetic@20261990 | 0/493 | 447/493 · 90.7% | 473 · 95.9% | 447 · 90.7% | **473/493 · 95.9%** ✅ |
+| katoomba_real | 0/72 | 71/72 · 98.6% | 71 · 98.6% | 72 · 100% | **72/72 · 100%** ✅ |
+| fitzroy_real | 0/139 | 138/139 · 99.3% | 138 · 99.3% | 139 · 100% | **139/139 · 100%** ✅ |
+| bowral_real | 0/30 | 28/30 · 93.3% | 28 · 93.3% | 30 · 100% | **30/30 · 100%** ✅ |
+
+**Verdict: B's two-character R39 fix did the heavy lifting (0% → ~91–99%) but did NOT clear the
+≥95% gate alone** — bowral read 93.3% and the synthetic 90.7% strict. Two residue species, and they
+wanted different answers:
+
+1. **Kerb misses (fixed by D).** On real towns `plan_osm` sets lots back at
+   `max(KERB, roadWidth/2 + FOOTPATH)`, so on narrow corridors the facade sits past the corridor
+   edge and the shell's `+0.6` nudge lands the door point **0.85 m outside the verge band** —
+   1/72 katoomba, 1/139 fitzroy, 2/30 bowral. Fix: **`web/js/citizens/door_snap.js`** (new, pure,
+   no THREE, no rng) — clamp a door point into the footpath band of its nearest footpath-bearing
+   street, applied at intake in `sim.setShops`. Registry's published `vergeBand` over the sim's own
+   edges; graph-only stays graph-only. Capped at 6 m so a plaza front is never dragged to a street
+   it doesn't front; margin 0.45 m off the band edges. Transition-checked corpus-wide: **fixes 4,
+   breaks 0** (a gate arm asserts breaks = 0 forever). Live-shell verified: booted the game,
+   diffed `sim.shopsByChunk` against the raw derivation in the running page — 493 points, 2 moved,
+   max 5.41 m, exactly matching the node run.
+2. **Plaza fronts (a definition, not a defect).** The synthetic's 36-shop strict-footpath residue
+   is **market stalls fronting the market square** (`use:"stall"`, block 25 `kind:"market"`) and
+   arcade shops — their front IS the square, they can never be in a street's verge band, and
+   dragging their door 50–73 m to a street they don't front (measured: that's what an uncapped
+   snap does) would re-break the front-door truth. The gate therefore scores **walkable front
+   ground** — footpath, or the open ground of a `market`/`arcade` block (outside every lot, off
+   every carriageway) — and reports the strict R39-style footpath number alongside for continuity.
+   Peds never reach stalls anyway (50–73 m from every walkable edge vs PATRON_RANGE 18) — their
+   door points are inert data today.
+
+**Remaining synthetic residue (20/493, under the floor, documented not fixed):** stall-vs-stall
+front overlaps (6), stalls at the square's edge clipping a carriageway (8), 3 shop + 1 anchor
+corner cases, 2 shops fronting into a neighbour lot. All are **derivation** artefacts of the fixed
+`d/2+0.6` nudge in `web/index.html:433-437` (F's shell, B's R39 hands) — if a later round wants
+them, the recommended fix is deriving from `buildShopfront`'s own `doorRect` instead of the fixed
+nudge; measured detail in LANE_D_NOTES §40. Out of D's graph-only reach and under the gate's floor.
+
+**Gate arms (all green, 12/12):** rate ≥95% on all four towns · CONTROL — the back point (the exact
+R8–R39 defect) must score under the floor on every town or the classifier is vacuous (it reads
+0.4–13.3%) · FIX-ONLY — the clamp breaks 0 previously-passing points. Deterministic: two runs
+byte-identical JSON. **Goldens untouched: selfcheck 157,647/157,647, fingerprint `0x5f76e76`** (the
+clamp is runtime pose in D's sim; citygen never touched).
+
+**The picture:** `docs/shots/laneD/r40_front_duckin.jpg` — a rigged ped mid-stride ON the footpath,
+frozen 3.2 m from the VIDEO BARN front door it is ducking into (staged via the sim's own
+`_beginVisit` + a pause at the threshold; steering, door point and entry are the shipped code).
+
+**→ Fable/Lane F (one line, as briefed):** please wire `node tools/qa/door_footpath_check.mjs` into
+`tools/qa.sh` (rc 0/1, ~2 s, zero deps — same shape as the other node gates). Not editing qa.sh
+myself; F owns the runner.
+
+Files touched: `web/js/citizens/door_snap.js` (new) · `web/js/citizens/sim.js` (import + setShops
+clamp) · `tools/qa/door_footpath_check.mjs` (new gate) · `docs/shots/laneD/r40_front_duckin.jpg`
+(new) · this file · LANE_D_NOTES §40.
+
 ## Round 12 (v3.0-alpha) — the band and the crowd, behind `?gigs=1`. (2026-07-15)
 
 Friday night at The Thornbury Hotel: a band on C's stage and a mixed crowd at C's watch points.

G-progress.md

@@ -0,0 +1,377 @@
+# G-progress — GODVERSE lane (runs on ultra)
+
+*Lane brief: `docs/LANES/LANE_G_GODVERSE.md`. This file follows your progress-file convention —
+newest round first. Fable-on-ultra writing.*
+
+## Round 27 (2026-07-17) — tier 2: the two read endpoints (ledger #1)
+
+**Landed:** `pipeline/godverse_server.py` — `/health`, `/shop/<gid>/stock`, `/shop/<gid>/crates`,
+plus `start|stop|status` (F's kill-the-server lifecycle), `setup-role`, and `make-fixture`.
+Stdlib + `psql`; no server code existed before this round, per the ratified G3.
+
+**Live now, against the real POS:** crate 550 — `{baked:120, live:120, gone:0}`, real prices, real
+`VG+` grading, etag stable across reads and `?since=` → **304**. `/crates` returns **315 real
+crates** with the shop's own labels — `TECHNO` (57), `$12-$15 TECHNO` (46), `DRUM N BASS` (66).
+
+**The three fences, each enforced by the machine (measured, not reviewed):**
+
+| fence | proof |
+|---|---|
+| the credential — `godverse_ro` | `UPDATE inventory` → **permission denied** · `SELECT FROM customer` → **permission denied** |
+| write verbs absent (§7 ruling) | `POST /reserve` → **501** · `POST /buy` → **501** · `GET` either → 404 |
+| metadata only | no `cover`, no atlas bytes on the wire — covers stay static tier-1 files |
+| tier 2 = real shops only | a `mint` shop's `/stock` → **404** (no POS to be live about), not an empty crate |
+| the id fence | `gone[]` carries the atlas `id` verbatim → `gone.includes(item.id)`, zero transform |
+
+**One grant carries both the sandbox and the PII fence** — that's why §7 said enforce at the
+credential, not in a code review. `godverse_ro` holds SELECT on inventory/crate/disc_cache and
+nothing else, so customer/staff/sales are unreachable *by the process*, not by our good intentions.
+
+**⚠ THE FINDING F NEEDS BEFORE IT WRITES THE GATE — `gone[]` has no subject in production.**
+The mechanism is right; the data has no movement. Monster Robot Party's POS records **5,567 sales
+ever** (400–800/month Dec→Jun) but **26 in July and none since 2026-07-01**, and hasn't been
+*written* since **2026-07-09** — the 07-16 dump is fresh, its data is stale (I restored it to
+check: crate 550 holds 122 on both 07-15 and 07-16, identical). **0 of the crate's 120 records
+have ever sold.** So `gone` is `[]` against the real POS, permanently, until the shop trades again.
+An assert over it would pass **without touching its subject** — the exact species that has held
+four tags. So I built the honest way out: **`make-fixture --sold 3`** clones the POS
+(`createdb -T`) and marks 3 of the crate's *own real skus* sold → verified
+`{baked:120, live:117, gone:3}`, the three ids absent from `items[]`. F points the server at it
+via `GODVERSE_POS_DB` and gets a deterministic gate; production reads the real POS untouched.
+**A fixture is not a lie; a green assert over an absent subject is.**
+
+**Lifecycle for the kill-the-server gate (ledger #3):** `stop` is a **SIGKILL**, not a graceful
+drain — the gate tests a death, not a goodbye. Verified: `stop` → connection refused (curl rc=7,
+no response at all) → `status: DOWN` → `start` → live again. F drives it; no admin verb was added
+to the API, because a server whose whole point is "no write verbs" shouldn't grow a remote kill.
+
+**Three corrections this round forced into my own G3 §4 (design → as-built):**
+1. **`gone:[sku]` → `gone:[id]`.** §4 as *I ratified it* said bare skus — wording that predates
+   R25's sku ids and R26's fence law. A bare number crossing two id spaces is the precise bug that
+   law exists to stop. **My doc was the stale rule meeting a case written after it** — the epoch's
+   signature failure, and this time it was mine, in the doc I wrote.
+2. `items[]` drops `release_id` and `cover`: `cover` edges the API toward serving pixels (it never
+   should), and `release_id` is the *pressing* while tier 2 speaks only in *copies*.
+3. **Write verbs answer 501, not the 404 my own docstring claimed** — caught by running it. 501 is
+   the *stronger* absence proof: a 404 means a handler ran and declined; 501 means there is no
+   write handler in the process. **→ F: assert 501.**
+
+**→ Lane F, the four asserts I can hand you pre-measured:** `POST /reserve|/buy` → 501 · a game
+buy cannot reach the server (no verb *and* no grant — prove both) · `gone` fixture arm as above ·
+server dead → connection refused, so the reader must treat it as tier 1 in silence.
+
+## Round 26 (2026-07-17) — the mint baker, the crate menu, the manifest (ledgers #2, #6)
+
+**Landed (main, pathspec-atomic):**
+- **`godverse_stock.py mint`** — the G3 note promoted: `random.Random(shop_id)` over an
+  **id-ordered** pool of real dealgod listings. The shop id IS the seed, so two shops can never
+  draw the same crate. No TABLESAMPLE, no unseeded random — the two things that disqualified
+  thriftgod's own `mint()` from tier 1 (G3 §2).
+- **14 mint atlases** — every keyed shop in both godverse towns whose type the loader can actually
+  fetch (`record`/`book`/`toy`, C §7.1): 5 record + 6 book + 3 toy. The 13 keyed `opshop`/`video`
+  shops get none and stay parody — correct, not a gap: C §7.1 gives them no fetchable type, so an
+  atlas there could never load. **The manifest is what makes that silent** (no entry ⇒ no probe).
+- **`stock_godverse/index.json`** (§7.2d) — 15 shops, 1 real / 14 mint. Derived by reading the
+  atlases back off disk, so it cannot drift from them: the manifest *is* the directory.
+- **Monster Robot re-emit**: `sourcing: "real"`, plus C §7.2c's `condition`/`sleeve_cond` (my
+  snapshot always carried them; I was dropping them at emit — that was the hole in C's price card).
+
+| gate | result |
+|---|---|
+| every crate different (F's #7 distinctness, title sets) | **15/15 distinct · max shared titles between any two: 0** |
+| ids unique across all packs · clash with generic · positional | 344 unique · **0** · **0** |
+| mint determinism (re-mint + re-bake) | **byte-identical** |
+| mint carrying a POS-claim field | **0** — absent, not false |
+| `sourcing` present on every atlas | 15/15 |
+| E's manifest↔files, both ways | clean |
+| selfcheck (no town cache touched) | **156212/156212 green** |
+| E's validator | **14 errors — all one cause, below** |
+
+**THE ONE RED — mint ids vs E's `SLOT_ID_PREFIX` (E, one line).** E asserts `sku_` on *every* atlas
+under `stock_godverse/`. Mint items have no POS sku, so they carry `mint_<dealgod listing id>` and
+all 14 fail. **C §7.2a's rule is satisfied** — "derive from the source's own stable key, never
+position, unique across ALL packs" (measured above: unique, 0 clash, 0 positional). What §7.2a
+specifies as `sku_<POS sku>` it specifies **"for a real-stock (godverse) pack"**; mint is C §7.2b's
+*other* thing, written a round later, and the id form was never revisited. E implemented R25
+literally, which was right at the time.
+
+**Why I did not just emit `sku_` and go green:** a POS sku and a dealgod listing id are **different
+namespaces**, and this round's own standing note says no code or gate may compare a bare number
+across two id spaces — it was written because `enterShop(31)` entered the wrong shop. Putting both
+under `sku_` recreates that bug *inside the economy*: **tier-2's sold-means-gone looks up POS
+skus**, and `sku_6031122` (a dealgod id) is indistinguishable by shape from a real sku that a POS
+must resolve. C §7.2a's own reason #2 is precisely about ids being looked up across snapshots.
+Green by prefix would have been green by lie. **Fix: make the prefix sourcing-aware (`sku_` when
+`sourcing == "real"`, `mint_` when `"mint"`)** — E's error text and constant are the only places.
+
+**Three more findings, none blocking:**
+1. **[E] `FITS_1024 = 64` cannot be satisfied.** The warn asks for ≤1024² when a pack has ≤64
+   items, but 1024²/256² = **16 cells** — 64 items would need **4** atlases and C caps a shop at 2.
+   So any 33–64 item pack *must* be 2048², and the warn would be demanding the impossible. It never
+   fires on my packs (16 → 1×1024², 120 → 2×2048²), so it's latent. The honest bound is 32.
+2. **[C/F] The ≤32 MB ceiling doesn't hold at beta scale, because the LRU it assumes hasn't
+   shipped.** F's boot preload loads **every** keyed shop's pack (`index.html:207-215`), and C §7.6
+   scoped "≤32 MB peak" to "LRU = 1 shop's atlas set resident", with the LRU explicitly deferred to
+   v5.0-beta. Measured now: **46.1 MB per town** resident at boot (both towns). Bounded and modest
+   — and it's *why* mint crates are 16 items on one 1024² sheet rather than something plusher.
+3. **[C] "The crate menu, baked statically" can only be metadata.** One base = one index = ≤2
+   atlases = 128 items; Monster Robot has **357 crates / 24,646 bake-able records**. So the shop's
+   real crate list ships as `crate_menu` (id/name/label/count — real labels, real counts), and
+   per-crate *stock* would need a per-crate base (`…/3962749/crate_550/`) = a C contract line.
+   Filed, not invented. Rotation's real home is tier 2 (G3 §4 `/crates`).
+
+**Mint honesty, stated plainly.** A mint crate is *plausible*, never a claim: `sourcing: "mint"`,
+an attribution that says "not this shop's stock", and **no POS-claim field at all** — the
+separation is structural, not editorial. Quality caveat: for books/toys `artist` is dealgod's
+`brand`, which is sometimes the maker (Microsoft, Sony, Brandon Stosuy) and sometimes the listing
+store (Lifeline Queensland) — real data, imperfectly typed. **Records are clean**: I require a
+Discogs artist and drop otherwise, because `brand` on a record listing is the *seller* — the first
+bake had "Red Eye Records" and "Statecircle" as artists, which is a shop, not an act. Titles use
+`discogs_master_title` where dealgod has it, so Egg Records' crate reads "MC5 — High Time · $50",
+not "Pre Loved Record - Elton John - Breaking Hearts". Both are real; one is a record sticker.
+
+## Round 25 (2026-07-17) — the sku re-emit (ledger #3), index-only
+
+**Landed (main — G is a full lane now, pathspec-atomic; F's six staged files and E's in-flight
+`validate_atlas.py` untouched):**
+- `godverse_stock.py` emits **`id = "sku_<POS sku>"`** per C §7.2a. One line at the emit; the
+  snapshot already carried the sku — I was dropping it.
+- `stock_godverse/3962749/stock_record_index.json` re-emitted. **Index-only, as briefed:**
+
+| check | result |
+|---|---|
+| **id overlap with the generic pack** | **0/120** — was **120/120** (F's finding) |
+| ids unique in-pack / all `sku_`-prefixed / none in `rec_` namespace | 120/120 · yes · yes |
+| **atlas .webp bytes moved** | **none** — sha-identical both files |
+| town caches / goldens touched | none |
+| ids stable when a record sells (drop item 50, re-derive) | **0 drift** |
+| E's validator (their R25 build, live in-tree) | `atlas-QA OK · 1 licence line(s) shown · 0 warnings` |
+| live loader: shop pack vs town pack | 120 / 350, coexist; uv + one-material-per-atlas hold |
+
+**Id equality is discriminating again** — verified through the live loader, not just the file.
+
+**C's reason #2 is the one that mattered**, and it's worth restating because it outlives the gate:
+position isn't identity. Sell one record out of crate 550 and `rec_0050` silently becomes a
+*different* record on the next bake — so a wallet purchase, a saved dig, or **tier-2's
+sold-means-gone** would point at the wrong item. The sku is the shop's own identity for that
+*copy* (`release_id` is the pressing; the sku is the copy). My positional ids were a latent
+correctness bug in the ratified §7 economy, not just a vacuous gate. Caught while there were two
+atlases to migrate instead of fifty.
+
+**Conflict #1 is closed** (R24 → R25): E's validator now prints
+`LICENCE: … FLAG BEFORE ANY PUBLIC/COMMERCIAL RELEASE` against my top-level US `license`, and
+counts it. The flag a human must read on real product photos is unmissable. Nothing owed.
+
+**→ F (one line, your file, your call — not touching it mid-flight):** `interior_mode.js:378`
+now reads *"ids are positional slots (`rec_0000`) that BOTH packs reuse … every atlas id is also a
+town-pack id (measured R24)"*. As of this commit that's false — 0/120. **Your gate stays canonical
+either way**: a texture URL proves which file the GPU sampled, which id equality never could, so
+the assertion is right and only the rationale is stale. Id equality is now available as a *second*
+discriminator if you want belt-and-braces.
+
+## Round 24 (2026-07-17) — the re-emit + THE SHOP'S REAL STREET (ledger #5)
+
+**THE WRITE-BACK RULING — John, 2026-07-17: A THEN B.** G3 §7 is **ratified** with the ruling
+inline; charter law #4 is satisfied. v5.0 ships **sandboxed** — a game purchase never touches real
+monsterrobot/Square inventory. **Option B (reservation) is chartered as a v5.x upgrade** behind a
+hold budget John sets; **C is not chartered**. What I wrote into the doc as binding, beyond the
+one-liner, because a sandbox that can be flipped on by a config typo isn't a sandbox:
+`POST /reserve` + `/buy` stay **absent, not flag-stubbed**; the tier-2 reader connects with a
+**read-only role** (`SELECT` on inventory/crate/disc_cache only — which carries the §9 PII fence in
+the same grant); and the gate asserts the write verbs **404** + the role's grants are read-only,
+because "we didn't call buy()" proves nothing (the vacuous-gate law applied to ourselves).
+**Carried to v5.x: the hold budget is John's number and is not yet set** — B isn't startable until
+it is. B's non-negotiable: **the shop always wins** a race with an in-store Square sale.
+
+**Landed (branch `lane-G-godverse`):**
+- **`redhill_godverse`** — the town whose record shop is THE shop. Monster Robot Party seated on
+  Musgrave Road (**verified: lot 8, type `record`, `godverseShopId` 3962749**), 37 shops, 884 real
+  Red Hill roads off E's donor.
+- **The atlas re-emit** — US `license` throughout (British `licence` retired, 0 occurrences),
+  provenance lifted to top level per C §7.3 **and** kept nested per E's validator (see conflict #1).
+  `atlas-QA OK`, 120 real records, byte-identical re-bake holds.
+- **`newtown_godverse` re-emitted with `godverseShopId`** (ledger #2) — 18 census shops keyed.
+- **`godverse_town.py`**: psycopg2 → `psql` (the m3 has no psycopg2); emits `godverseShopId`;
+  `EXTRA_SHOPS` roster; **Fable's R22 Ruling 2 finally implemented** (see below).
+- G3 §4: the `godverseShopId`/`godverse_id` naming split recorded (two artifacts, two conventions).
+
+**Monster Robot Party's coordinate** is John-supplied (Google Maps place `/g/11g6rlbbc0` →
+-27.4553791, 153.0076244). It could not be derived: OSM doesn't know the shop (no name match, no
+147 Musgrave Rd address node), the census doesn't have it, dealgod's `stores`/`store_entity` rows
+carry NULL lat/lng, and recordgod has no address anywhere. Verified inside E's bbox **and** on
+Musgrave Road's own geometry. My own estimate was ~120 m out — asked instead of shipping it.
+
+**FABLE'S RULING 2, IMPLEMENTED (R22 → R24) — and it was load-bearing, not cosmetic.** "Merge
+census heroes WITH the donor's texture shops; census heroes win a collision; count the swap."
+I never built it. Measured this round, census-only Red Hill is **not shippable**:
+
+| redhill_godverse | shops | A's spacing warn | poster-clears-kerb |
+|---|---|---|---|
+| census only | 9 | **306 m** ⚠ | pass |
+| census + Monster Robot | 10 | **261 m** ⚠ | **FAIL** (poster inside edge 1037 by −2.95 m) |
+| **+ donor texture (Ruling 2)** | **37** | **none** ✓ | **pass** ✓ |
+| *(E's donor `redhill_real`, for reference)* | 36 | none | pass |
+
+261 m is **worse than the 255 m that retired ballarat this round** — the alpha's headline town
+would have shipped flagged "scattered, not a high street, or retire the town". Ruling 2 fixes both.
+9 donor heroes swapped for their census entries in Red Hill, 18 in Newtown — counted, per the ruling.
+
+**CONFLICT #1 — C's contract §7.3 vs E's validator (provenance).** C says "lift the four to TOP
+LEVEL, US `license`; British retired — *exactly what E's validator reads*". **Measured: it is not.**
+`validate_atlas.py:98` reads **nested** `provenance`, and `:105` reads `licence` British-first.
+Lifting-and-retiring as written **fails the gate**. My R23 atlas already passed it untouched. This
+is the same species as the bug that held the tag — a doc asserting what code does without running
+it. **Resolved without drama:** E's check accepts `licence or license`, so US-nested passes; I emit
+the four at top level (C's contract + the town-cache house convention) off ONE source of truth.
+**→ E, one line:** `validate_atlas.py:198` PRINTS `licence` British-only while its *check* accepts
+both — so adopting C's mandated US spelling **silently stops printing the licence flag**, which
+:199's own comment calls a human call ("the licence is PRINTED — clearing it is a human call").
+The gate still passes; the evidence line vanished. Fix: `.get("licence") or .get("license")`.
+
+**CONFLICT #2 — Ruling 2 vs A's identity gate. THIS ONE NEEDS A RULING; it is why the tree is red.**
+Ruling 2 makes a godverse cache *mixed*: a keyed GODVERSE layer (census + Monster Robot) plus an
+inherited OSM texture layer. A's sweep asserts **every** shop is keyed → partial ⇒ FAIL. The two
+standing rulings cannot both hold.
+
+**The texture shops carry no `godverseShopId` deliberately**, and I'd argue A's own words settle it:
+- The field *means* "this lot's stock lives at `stock_godverse/<id>/`". An OSM milkbar has no
+  GODVERSE identity. Minting one from its OSM id pushes a **third id space** into a field that
+  already carries two, and A's validator calls a duplicate **mis-stocking** — charter risk #3's
+  exact nightmare, with Monster Robot's crate as the prize. (Measured: OSM ids here are ≥53.1 M vs
+  census ≤2992 and store id 3,962,749 — no collision *today*; dealgod store ids reach 7 digits and
+  OSM ids are 8+, so the margin is thin, and "no collision today" is not an id-space design.)
+- **A's validator and A's sweep disagree with each other.** The validator: *"Missing = tier 0
+  (soft). Duplicate = mis-stocked (hard). **They are not the same failure.**"* The sweep fails
+  partial keying because it *"mis-stocks the rest"* — conflating precisely the two failures A said
+  are not the same. Unkeyed → parody is the **designed ladder**, not a gap.
+- **Proposed (A's call, Fable's ruling):** assert coverage over the **godverse layer**, not the
+  inherited texture layer — the subject is "shops that claim stock", and the gate stays honest
+  (it still names its subject and proves a count). Zero-keyed still SKIPs; duplicates still error.
+
+**The 8 red checks, itemised — no surprises for F:**
+- `newtown_godverse` base+gig goldens (**2**) — my re-emit moved them, exactly as ledger #2
+  intends. **A re-pins** (batched): base `0xcf69b387`, gig `0x1e266f60`.
+- `godverse identity` ×3 on each godverse town (**6**) — conflict #2, above. Nothing else.
+- Unpinned (warn, expected): `redhill_godverse` base `0xb2224939` / gig — **A pins**.
+- **Classic covenant `0x3fa36874` intact.** `atlas-QA OK`.
+
+**If Fable rules the other way** (texture layer out): revert to census-only and F inherits the
+poster-kerb FAIL at edge 1037 + a 261 m town — that break is A/B's invariant, exposed by real data,
+and would need an owner before the tag. I'd rather hand F the conflict than the broken town.
+
+## Round 23 (2026-07-16) — G2a: THE FIRST REAL CRATE + the G3 draft
+
+**Landed (branch `lane-G-godverse`, G namespace only — ready for your mid-round merge):**
+- `pipeline/godverse_stock.py` — the per-shop atlas pipeline, split at **the snapshot boundary**:
+  `snapshot` (runs where the DBs are; freezes every source row + every cover's sha256) →
+  `pack` (pure: snapshot + image bytes → atlas, no DB, no network). That split is deliberate —
+  **it's what lets E's `validate_atlas` gate G's output on m3 without the dealgod DB** (ledger #4).
+- `pipeline/_godverse/monsterrobot_550.snapshot.json` — the artifact of record (committed).
+- `web/assets/stock_godverse/3962749/` — **120 real records** from a real crate: 2 atlases
+  (2048², 256px cells, E's contract verbatim) + index with provenance.
+- `docs/G3_ECONOMY_DESIGN.md` — the draft (ledger #2), incl. **the write-back question framed for
+  John** (§7), now grounded in a real trading shop rather than a hypothetical.
+- **Verified:** byte-identical re-bake (same snapshot → same bytes); uv ⊂ [0,1]; every item's
+  atlas ref resolves; bands standard 58 / collector 56 / grail 6. Eyeballed the atlas: it's a real
+  deep-house crate (Basement Jaxx, Byron Stingily, Angel Moraes, 4hero, Murk, Blaze).
+
+**THE HEADLINE FINDING — the brief's premise doesn't hold (all measured, R23):**
+The ledger asked for "dealgod inventory → one real **Newtown** record shop". That can't be built:
+- **No Newtown record shop has stock in any database.** Egg Records / Papa Disquo / Haze Guitars /
+  The Vintage Record / Downtown Music: **0 items each**.
+- **`dealgod.stores` is not a shop census** — 8,754 of 9,285 are **Discogs seller accounts**.
+  Zero Newtown stores, zero census name matches. It's an item *feed*, not a shop directory.
+- **`thriftgod.item` is a demo seed** — 2,221 items across 29 shops, **all Brisbane/Newcastle/Alice
+  charity shops**, zero record shops.
+- **`mint()` cannot produce tier 1**: `TABLESAMPLE SYSTEM (0.5)` + `random.random/uniform/shuffle`,
+  and **`random.seed` appears nowhere in `server.py`**. Non-deterministic, and it assigns other
+  sellers' listings to shops that never owned them — which also voids the licence law's "the
+  *stores' own* product shots" green and makes write-back meaningless. (G3 §2.)
+- This is **not** risk #3's "fuzzy matching" — it's a population mismatch. Nothing to match *to*.
+
+**What we found instead — and it's better.** `monsterrobot` (**147 Musgrave Rd, Red Hill, Brisbane**
+— John's ruling) is the same real shop in three datasets: `recordgod` (its POS: 28,624 live vinyl,
+**24,914 in 357 real crates** with real labels and slot numbers), `monsterrobot.party` (its own
+site — **the covers are the shop's own product shots**), and dealgod store **3962749** (the scrape;
+the cover cache + the godverse id). **99.3%** of its crate stock joins to a cached cover by Discogs
+`release_id`. Not in thriftgod's census, so its godverse id = its dealgod store id 3962749 (real,
+stable, clear of the census space — thriftgod max shop id = 2992). Drops counted: 120 of 122 in
+crate 550 baked; 2 dropped (no own photo).
+
+**Rulings received from John this round (recorded):**
+1. **The crate ships as the shop it really is** — Red Hill, Brisbane, not Newtown.
+2. **Real titles/artists at tier 1** — an amendment to the no-real-trademarks law that
+   `build_stock_pack.py` enforces (it parody-transforms metadata). Same shape as the licence law:
+   in-house 🟢, **flagged before anything public**. Recorded in every atlas's provenance.
+
+**Asks — two things gate the crate reaching a room, and both are outside G's namespace:**
+1. **[C + F] Per-shop packs aren't wired at runtime.** `stockpack.js` caches by `type` alone
+   (`_packs`/`_resolved`), and `interior_mode.js:192` does `getStockPack(shop.type)` with `base`
+   fixed to `assets/models/`. R23's single shop works via a `base` override, but **two stocked
+   shops collide in that cache** — so this blocks v5.0-beta, not just ledger #3. Seam needed:
+   key the cache by `type + base` (or `godverse_id`) + preload per-shop on entry. **C owns the
+   wording (LANE_C_PUB); G re-emits to whatever lands.**
+2. **[E, via Fable] The crate has no street.** `redhill_real` doesn't exist; `westend_real` is the
+   only Brisbane cache and stops ~2.3 km south. Needs a `build_towns.py` TOWNS entry
+   (~`center: (-27.4553, 153.0064), span_km: 2.4`) + one Overpass fetch, then
+   `godverse_town.py redhill_real redhill_godverse`. **That's E's file and an outward-facing
+   fetch — G touched neither.** Note monsterrobot must be added to the godverse cache's `shops[]`
+   as id 3962749 (it's not in the census); `godverse_town.py` takes shops from thriftgod only, so
+   that's a small G change once you rule on the town.
+
+**Environment note (matters for reproducibility):** this ran on the **m3**, not ultra — the box has
+neither `thriftgod` nor `dealgod` Postgres. Both were restored/read from John's mounted backup
+drive (`/Volumes/johnking/db-backups`, **2026-07-15** dumps); dealgod (2 GB gz) was never restored,
+its cover map was streamed straight out of the dump (command recorded in
+`godverse_stock.py:load_image_map`). This is *better* for the charter's snapshot discipline, not
+worse: the dump date is pinned in every snapshot's provenance. I left two restored DBs on the m3
+(`thriftgod`, `recordgod`) — say the word and I'll `dropdb` them.
+
+**Fences held:** PII — `recordgod` holds real `customer`/`staff`/`sales`; the pipeline reads only
+`inventory`/`crate`/`disc_cache`, and G3 §9 makes that a standing fence. Licence — covers are the
+shop's own shots, in-house 🟢, flagged before public, provenance in every atlas.
+
+## Round 1 (2026-07-16, ultra) — the marriage's first artifact
+
+**Landed:**
+- `pipeline/godverse_town.py` — thriftgod PG census + donor OSM cache → `<key>_godverse.json`
+  (schema v2, `source: "godverse+osm"`). Deterministic, stdlib+psycopg2, runs where the DB lives
+  (ultra). Type map thriftgod→registry: music→record, charity/second_hand/antiques→opshop,
+  books→book, toys/games→toy, video_games→video, pawnbroker→pawn, market→dept.
+- `web/assets/towns/newtown_godverse.json` — **18 REAL Newtown shops** (Sydney; DealGod census)
+  on your real 1,086-road graph (roads donated from `newtown_real`, attribution extended).
+- Verified on ultra: boots via `?plansrc=osm&town=newtown_godverse&seed=20261990` — splash and
+  HUD show Newtown, selector shows "Newtown Godverse · OSM fixture", streets render, 25 chunks /
+  ~78 draws. Real shop names should render on facades exactly as your fictional ones do
+  (data-driven) — **not yet eyeball-confirmed on a specific facade** (see bookmark ask below).
+
+**Found while verifying (asks, no files touched):**
+1. **Per-town bookmarks:** `DBG.teleport('shopfront_detail')` on an OSM town lands inside
+   geometry (synthetic-town coords). Suggest bookmarks resolve against the active plan.
+2. **`DBG.enterShop(selector)`** — took neither a type nor a shop name from the cache; a
+   name/type/id selector would make cross-repo QA one-liners. (Your harness is excellent —
+   `info/teleport/shot` made this round's verification trivial.)
+3. **Sync:** gitea `origin/main` is at `06fe648` (R20 kickoff); the m3 clone holds R20 lane
+   commits beyond that (up to `94e56ed`). Push when the round closes so ultra tracks you.
+
+**Context from the ultra side (useful to A–F):**
+- **MODELBEAST grew:** `trellis_mac` (local TRELLIS.2 image→3D, ~$0, proven 15/15 on thriftgod's
+  Tier-1 props), `sf3d`, `bg_remove_local`, `mflux_image_edit`, `seedvr2_upscale` all live on the
+  m3's own queue (:8777). Lane E's "HF-gated, setup needed" note is stale — weights are unlocked.
+- ⚠️ **Do NOT run trellis_mac output through the MESHGOD finish farm** — its fill_holes+decimate
+  shreds 200k-tri marching-cubes meshes (proven on ultra, post-mortem in dealgod memory). The
+  working pipeline: raw GLB → `npx @gltf-transform/cli optimize --compress draco --texture-compress
+  webp --texture-size 1024 --simplify-error 0.01` → 0.4–1.8 MB at raw-quality look.
+- **Which collides with your no-Draco law** → the ruling ask in the lane brief. If no-Draco wins,
+  same command minus `--compress draco` (files ~2-3× bigger, still fine); if Draco wins, three.js
+  needs the DRACOLoader wire your vendored addons already include. Either is one re-emit; the
+  depot should hold ONE law.
+- **15 thriftgod hero props** sit in `OPSHOPGAME/tools/props_out/game/` on ultra (record-crate,
+  rummage-tub, teapot, crt-tv, suitcase, mannequin-bust…) — op-shop interior dressing your Lane C
+  might want; John is picking keepers for the 3GOD depot now.
+
+**Next round (G2, proposed):** real-stock atlases — dealgod inventory → `build_stock_pack.py`
+per-shop record/book atlases keyed by the godverse shop id, behind `?stock=real`. Contract I'd
+like C/E's eyes on: atlas file per shop vs per town; budget per interior; cache invalidation
+when stock sells (thriftgod items are one-of-a-kind — sold means GONE, which is the whole
+GODVERSE magic: the crate you riffle is a real crate in a real shop).

README.md

@@ -14,9 +14,38 @@ cd web && python3 -m http.server 8130
 # http://localhost:8130/map.html   (2D plan debugger — Lane A)
 ```
 
+## The manual — how to play (private test)
+
+Click **START** to lock the mouse. Then:
+
+| input | does |
+|---|---|
+| **W A S D** + mouse | walk / look (first person) |
+| walk into a shop door | enter the interior (open shops only — check the hours tooltip) |
+| **E** (inside a shop) | open the crate at a record bin — then it's cursor-driven: click sleeves to riffle, click BUY |
+| **E** (at the counter) · **C** (anywhere) · **SLEEP** (bottom bar) | sell a find to the keeper (he pays under the **guide band**, never over) · open THE CRATE — your collection, in shops too now · sleep = save, the day advances, stock rotates |
+| read the **guide** stamp on every price card | the 90s price-guide band ("guide $8–24"). An item **asking under its band is a gem** — buy it, sell it to a keeper, pocket the margin. Bought slots stay gone for the day (the bin remembers) |
+| **☆ WANT IT** on a pull card | start hunting it — keepers gossip ("saw one in Castlemaine"), and buying one clears the hunt. **Switching towns costs a day** — the 23 towns are a map now, not a dropdown |
+| **⚖ LIST** in the crate | consign a find to **GodBay** — the auction hammers overnight (sleep or ride somewhere). One hammer per item, ever: keeper cash now, or the gavel tomorrow |
+| wake up (sleep or arrive) | **the morning paper** rides the wake/arrival toast: "⚖ SOLD 'Milk Bar Dreams' — hammer $8, $7 after fees" (or "PASSED IN — it comes home"). The news is a toast, never saved — the ledger is your cash and crate |
+| click a book spine / toy box | pull-and-buy card (real price stickers in godverse shops) |
+| walk out the door / **Esc** | leave the shop (Esc also frees the mouse anywhere) |
+| **F2** | **credits & licences** — what PROCITY is built from and what each source asks for in return (R41). On a real-map boot the HUD link itself carries the obligation: `© OpenStreetMap contributors · credits (F2)` |
+| **M** | 2D town map (street only) |
+| **[** / **]** | step time of day back / forward · **T** pauses the clock |
+| **P** | capture screenshots (street) |
+| HUD dropdown (top-left) | switch towns — synthetic, fixtures, 23 real AU towns, godverse |
+
+Worth trying: `?classic=1` (the original v2 town, byte-identical forever) · `?noassets=1`
+(zero-network boot) · `?stock=real` in a godverse town (Monster Robot Party's actual crate) ·
+`?seed=<n>` (any number = a different town). Night is when the gigs happen — step time with `]`.
+
 ## Read first
 
 - **`docs/CITY_SPEC.md`** — the treaty: schema, units, seeds, budgets, file ownership.
+- **`docs/V7_THE_GAME.md`** — the CURRENT epoch (ratified): persistence, the collection, the
+  gem thrill. `docs/V6_LIVING_STREET.md` runs in parallel (mocap NPCs, footpaths, cars).
+- **`docs/THE_FRONTIER.md`** — the honest map of what is not figured out yet.
 - **`docs/RESEARCH.md`** — what the parent repos already solved, with exact paths to port from.
 
 ## The lanes (parallel Opus 4.8 sessions)
@@ -71,13 +100,107 @@ master off:
 | `?classic=1` | off | **the exact v2 boot** — all four below off, byte-identical to the frozen baseline |
 | `?gigs=0` | **on** | the gig district — venues, week schedule, band/crowd/queue, cover, posters, night pass |
 | `?weather=0` · `?tram=0` · `?winmap=0` | **on** | seeded weather · the tram loop · the parallax interior-window shader |
-| `?roster=v1` · `?pop=N` | stream | chunk-streamed citizen density is the baseline; `?roster=v1` restores the fixed roster |
-| `?dig=0` · `?stock=real` | dig on | crate-riffle on record bins · real GODVERSE sleeves in the stock |
+| `?roster=v1` · `?pop=N` | stream | chunk-streamed citizen density is the baseline; `?roster=v1` restores the fixed roster. **`?pop=0` means zero as of R42** — the shell read `parseInt(…) \|\| 140` and `0` is falsy, so for 35 rounds every "town frozen" measurement in this project booted 140 citizens. For a genuinely still frame use `?dbg=1` + **`DBG.freeze()`**, which also covers the streamed roster (it ignores `target` entirely) and returns `stillLive` naming every other wall-clock mover in the scene |
+| `?dig=0` · `?stock=real` | dig on | crate-riffle on record bins · real GODVERSE sleeves in the stock — and, since R41, the **op-shop wardrobe**: 52 named 1990s Australian garment layers on the clothes rails and shelves, one 246 KB atlas, one material, and it costs *fewer* draws and 11 fewer textures than the procedural canvas it replaces. Opt-in: a default boot still builds the canvas, byte-identically |
+| `?clips=0` | **library on** | turns the R41 **motion library** off and nothing else — 46 Mixamo clips in 6 grouped GLBs (2 fetched at boot, 3 on first demand, 1 never). With it off the crowd is 99.3% walking on one clip; with it on, 78.1% walking, 9.5% sitting on a real bench, 7.1% leaning on a shopfront, 20 distinct clips in play. `?classic=1` is a bad control for this (it also changes the ped pool, the fog and half the shell) which is exactly why this flag exists |
+| `?verge=0` | **off** | reverts the ground to the **pre-kerb-ruling** geometry (bitumen painted to the full corridor). John's v8 ruling made the band between kerb and shopfront **footpath** — 9 m on the synthetic town's 28 m main, **7 m** on a real 24 m main, and **3 m** on the `side`@12 edge that is 72% of the corpus. The flag stays forever as the gate's falsifiability control: the poster-clearance leg is asserted to FAIL under it, at exactly 14 posters standing on road paint. `?classic=1` forces the ruling off — the covenanted town keeps its paint |
+| `?r=N` · `?shadows=0\|1` | auto | streaming radius and the sun-shadow pass. **Auto is load-bearing**: a big town (>120 shops or >200 street edges) gets radius 2 with shadows off. A `?r=` **above** auto is a DIAGNOSTIC boot and declares its own law (R40): `?r=3` measures **382 noon / 391 night** draws at 45–48 live chunks — structural, not fat — so it boots under a pinned **≤420** ceiling (`PROCITY.budget`, console-warned, gated by `tools/qa/r40_lane_b.py`), tri law unchanged. Not a supported boot |
+| `?live=1` · `?live=<url>` | **off** | **tier 2** — live stock from the GODVERSE server (sold-in-the-real-shop means gone in the game). Opt-in by design: absent ⇒ byte-identical to tier 1, and the game never asks a question it has no reason to expect an answer to |
 | `?noassets=1` · `?plansrc=osm` · `?mute=1` · `?dbg=1` | off | asset-free (zero network) · OSM plan source · silence · the `window.DBG` capture/soak harness |
-| `?plansrc=osm&town=<key>` | — | boot a **real Australian town**: fixtures `melbourne`/`katoomba`/`silverton`, or a real OSM cache `bendigo_real`/`castlemaine_real`/`fremantle_real`/`katoomba_real`/`newtown_real` (ODbL, `web/assets/towns/SOURCES.md`). **v4.0-alpha REAL ROADS:** a cache with `roads[]` (schema v2) builds the CityPlan street graph from the town's **actual OSM streets** — walk Katoomba's real main street; without `roads[]` a cache marches onto synthetic avenues |
+| `?plansrc=osm&town=<key>` | — | boot a **real Australian town**: fixtures `melbourne`/`katoomba`/`silverton`, or a real OSM cache `bendigo_real`/`castlemaine_real`/`fremantle_real`/`katoomba_real`/`newtown_real` (ODbL, `web/assets/towns/SOURCES.md`). **REAL ROADS:** a cache with `roads[]` (schema v2) builds the CityPlan street graph from the town's **actual OSM streets**; without `roads[]` a cache marches onto synthetic avenues. Or just **pick a town from the HUD selector** — no URL needed |
+
+## v4.0 — THE REAL MAP: the towns *are* the product
+
+**23 real Australian towns — 1,210 real shops, every state and territory — on their actual streets.** Not
+"inspired by": Fitzroy's shops sit on Fitzroy's roads, at their real positions, because the pipeline eats
+OpenStreetMap and marches it through the same CityPlan contract the procedural town uses. **Pick one from
+the in-HUD selector and walk it.** Everything built across v1–v3 comes along unchanged — the venues and their
+seeded week of gigs, the 4-piece band with the seated drummer, the crowd that follows you into the pub, the
+interiors behind every door, weather, the tram — because they all hang off the plan contract and never had
+to know the geography got real.
+
+The towns run from **meccas** (Fitzroy, 160 shops) to the **thin tail** (12), at real retail density: the
+secondhand heroes keep their footfall while the street around them gets ~4× busier — texture, never a
+takeover. Venues bias to the retail heart. The tram only runs where it fronts a real high street (elsewhere
+it was honestly "a highway bus", so it's fenced). Everything stays **deterministic from the seed**, silent
+under `?noassets=1`, and **`?classic=1` still boots the exact v2 town, byte-identical forever** (`0x3fa36874`).
+
+**The tour:** [`docs/shots/release_v4/contact.html`](docs/shots/release_v4/) — the Fremantle hero, the
+Fitzroy mecca, the thin tail (labelled honestly: the floor is shops-per-street-metre, and Toowoomba is
+below it), the synthetic control, and the `?classic=1` covenant made visible. Charter:
+[`docs/V4_REAL_MAP.md`](docs/V4_REAL_MAP.md) · data + licences (ODbL):
+[`web/assets/towns/SOURCES.md`](web/assets/towns/SOURCES.md).
+
+## v5.0-alpha — THE FIRST REAL CRATE: the shops get real too
+
+**v4 made the towns real. v5 makes the shops real** — and the first one is standing.
+
+Boot `?plansrc=osm&town=redhill_godverse&stock=real`, walk down **Musgrave Road** into **Monster Robot
+Party** (147 Musgrave Rd, Red Hill, Brisbane — a real record shop), and riffle its crate. The records in
+it are **that shop's real stock**: 120 real records off its real point-of-sale, real covers, real titles,
+real prices. Buy one and the wallet debits what the sticker says. It's gone for the session and back next
+boot — because until the live tier lands, the crate is a **file**, not a shop's ledger.
+
+**Stock is a data tier now**, exactly like assets — each rung fully playable, each degrading softly to
+the one below, so the game never depends on a server to be a game:
+
+| tier | what | deterministic? |
+|---|---|---|
+| **0 · parody** | seeded canvas sleeves (v1) — any boot, always works | yes — the QA baseline |
+| **1 · static real** | per-shop atlases baked from the shop's own POS | yes — atlases are files |
+| **2 · live GODVERSE** | `?live=1` — live stock off the real till: **sell a record in the shop and it's gone from the game crate** | **no — by design** |
+
+**The offline law:** the server enriches, never gates. `?noassets=1` still fetches **zero bytes** and plays
+silent-and-fine; a shop whose atlas is missing falls soft to parody rather than borrowing someone else's
+crate; and **`?classic=1` still boots the exact v2 town, byte-identical forever** (`0x3fa36874`). The
+world stays seeded and golden-gated — only the *stock inside it* is data.
+
+**Provenance:** item photos are each shop's own product shots, 🟢 in-house — **flagged before any public
+or commercial release**, and every atlas carries that flag where the QA gate must print it. Real titles
+and artists are an in-house amendment to the no-real-trademarks law, on the same footing. **Nothing an
+in-game purchase does touches real inventory** — v5.0 ships sell-sandboxed by ruling; a real reservation
+tier is chartered for v5.x, not assumed. Charter: [`docs/V5_REAL_SHOP.md`](docs/V5_REAL_SHOP.md) ·
+economy design: [`docs/G3_ECONOMY_DESIGN.md`](docs/G3_ECONOMY_DESIGN.md).
 | `?seed=N` | `20261990` | town seed |
 
 **Release tour:** [`docs/shots/release_v3_1/contact.html`](docs/shots/release_v3_1/) — the money shots on
 the default boot, plus a `?classic=1` before/after. **QA:** `tools/qa.sh --strict` (classic regression +
-default-boot gate + smokes + no-giants) `--soak` (the full-week soak); the seated drummer passes the
-no-giants gate at the seated stature band `[0.9,1.5] m`.
+default-boot gate + smokes + no-giants) `--soak` (the full-week soak) `--matrix` (the town matrix)
+`--tour` (R42's paired before/after proof shots); the seated drummer passes the no-giants gate at the
+seated stature band `[0.9,1.5] m`.
+
+**Two laws about the cast, as of R42** (`tools/qa/r42_roster.mjs`, both controls demonstrated every
+run): **PROCITY is 1990s Australia** — no fantasy, superhero, luchador, anime or medieval body ships,
+gated by name against `PED_NAMES` rather than a directory listing; and **every shipped ped carries a
+real `credits.json` row** — an `unverified` licence on a body is a red gate, not a note. The R42 audit
+retired five bodies on those two laws, including one nobody had looked at since R36. Screenshot
+byte-hashes are pinnable again (R41's ban is reversed): the condition is *nothing in frame runs on
+wall-clock time*, asserted via `DBG.freeze().stillLive` — see `docs/shots/laneF_r42/README.md`.
+
+## v7.0 — THE GAME: you're a crate-digger in 90s Australia
+
+v4 made the towns real, v5 made the shops real — **v7 makes it a game.** Boot the plain URL on a
+fresh browser and you arrive HUNTING: the splash names a seeded first want and your pocket money
+("You're hunting HILLS HOIST — $191 in your pocket"), three toast-beats walk you through the first
+dig, and from there the loop is live:
+
+**dig** (E at a record bin — the crate riffle) → **read the guide** (every price card carries a 90s
+price-guide band; an item asking *under* its band is a gem, and spotting one is the whole skill) →
+**☆ WANT** what you're hunting (keepers gossip seeded rumors — "saw one in Castlemaine") →
+**travel** (switching towns costs a day; the 23 towns are a strategy map) → sell to the **keeper**
+(instant cash, always under guide — the no-pump law) or **⚖ LIST on GodBay** (a seeded offline
+auction that hammers overnight; one hammer per item, ever — no retry farm) → **SLEEP** (= save; the
+day advances, parody/mint stock rotates per (shop, day), bought slots come back) → wake to **the
+morning paper** ("⚖ SOLD — hammer $22, $19 after fees"). Repeat, richer and one gem wiser.
+
+The machinery under it: a versioned localStorage save carrying THE DELTA ONLY (cash · collection ·
+day · town · wants · pulls · listings — the world always regenerates from seed, so a corrupt save
+can cost you your stuff, never the town), JSON export/import for moving machines, and an economy
+fenced by gates: sell < guide-band structurally, auction EV ≈ 0.8×mid (random flips bleed; only
+finds profit), save/load byte-determinism, rotation seeded by (citySeed, shop, day).
+
+**`?classic=1` still boots the pure v2 town — zero save, zero game DOM, zero Storage calls,
+instrumented every run** — and `?game=0` opts out of the layer on any boot. Charter:
+[`docs/V7_THE_GAME.md`](docs/V7_THE_GAME.md) (ratified 2026-07-17, risk verdicts appended at the
+close) · economy: [`docs/G3_ECONOMY_DESIGN.md`](docs/G3_ECONOMY_DESIGN.md) · the tour (day one to
+first gem, 6 frames, no staging): [`docs/shots/v7_tour/`](docs/shots/v7_tour/).

docs/A-progress.md

@@ -1,10 +1,444 @@
 # LANE A — CITYGEN · progress (PROCITY-A)
 
-*Status: **all deliverables landed; self-check all-green (51670/51670); rounds 2–19 closed** (see below).
-v4.0-alpha alpha-close: fragmentation resolved (105→1 component on katoomba), E's spine-poster finding
-fixed, all 5 real towns pinned on real-roads goldens (katoomba `0xb7ffbca2`). classic/gig/marched-fixtures
-frozen.*
-*Date: 2026-07-16 · owner: PROCITY-A (Opus 4.8)*
+*Status: **all deliverables landed; self-check ALL GREEN (157,647/157,647); rounds 2–30 + 37 + 39–40 closed**.
+R40 (§40.2): the v8 debt ledger settled — D4 CLOSED (all-edges poster bound; 8/108 plans → 0; poster
+counts frozen on all 108; synthetic byte-identical; 7 town gig goldens re-pinned), D1 A-side CLOSED
+(`chunkIndexByCoverage` canonical + compat alias), D1(B)/D2/D3 formally re-filed with re-measured
+numbers and owners in `LANE_A_NOTES §40`.
+R39 (v9 item 39.1): THE ADDRESS LAYER — 17,835 named ways stop being dropped on the floor. New pure
+module `address.js`; **1,192/1,219 corpus shops (97.8%) resolve to a real street name**, 0 wrong names
+on 884 shop-bearing edges against an independent resolver, **all goldens frozen, zero re-pins.**
+R37 (v8 wave 0 §0.1): the poster-clearance gate was VACUOUS — it validated my own placer against my own
+law and stayed green while all 14 posters on the default boot stood on B's bitumen. Corrected to three
+arms with a permanent control; proven to fail on the pre-ruling geometry where the old gate cannot.
+All goldens frozen, zero re-pins.*
+
+## Round 40 (§40.2) — (2026-08-04) THE DEBT ROUND: D1–D4 closed or re-filed, every verdict with a number
+
+Per the R40 brief: no third option, no silent carry. Every number below was produced by a command run on
+today's tree (the §37 filing's numbers were re-derived, and two of them changed — which is the point).
+Full prose + owner handoffs in `LANE_A_NOTES §40`.
+
+| item | close/re-file | number | evidence command |
+|---|---|---|---|
+| **D4** poster gate inner bound nearest-edge; `arcade` camouflages a main | **CLOSED** — `gigs.js onCarriageway` + selfcheck arm 1 both now ALL-EDGES | before: **8/108** gig plans w/ spine poster inside a non-nearest carriageway, worst **1.78 m** inside a main (northbridge_real 42, nearest edge `arcade` @ 1.45 m, kerb 0); after: **0/108**; frontage all-edges clean **238/238**; poster counts **0 diffs on 108 plans** (old vs new placer pairwise); synthetic **byte-identical 0/4** | scratch `d4_measure.mjs` / `d4_frontage.mjs` / `d4_counts.mjs` (corpus sweep over 4 syn seeds + 3 fixtures + 23 towns × 4 seeds), then `node web/js/citygen/selfcheck.js` |
+| **D1(A)** `chunkIndex` two shapes, false swap-comment invites a streamer break | **CLOSED (A-side)** — `chunkIndexByCoverage` canonical in `plan.js`/barrel/selfcheck; `chunkIndex` kept as compat alias (map.html imports it); CITY_SPEC §chunk-key + producer API amended | a naive swap would multi-build **258/681 lots** (A coverage: 258 lots in ≥2 chunks; B centre: 0/681); container `Object` vs `Map`, elements ids vs objects — all three axes live today; alias verified `chunkIndex === chunkIndexByCoverage` | `node -e` three-axis diff over seed 20261990 (in-session, printed) |
+| **D1(B)** `planutil.js:4` false comment + B-side name | **RE-FILED → B** | same 258/681; comment still present at `world/planutil.js:4` (grep) — can wait because both consumers are correct today and the trap only fires on the invited future swap, now contradicted by the shipped canonical name | `grep -n chunkIndex web/js/world/planutil.js web/js/world/chunks.js web/map.html` |
+| **D2** `isOpen` ×3 impls + ad-hoc 4th; shell inverts A's no-hours law | **RE-FILED → F** | A's canonical still **0 importers**; divergent predicate live at `index.html:541` + `audio.js:516` + **19 call sites / 5 tools files**; `sim.js:363` third impl; `dbg.js:241,279,286` fourth site; still **latent: 0/1,838 corpus shops lack hours** (27 plans @ golden seed) — can wait until the first hours-less lot kind ships, fix is ~5 lines in F's `index.html` | grep census + node corpus sweep (27 gig plans), printed in-session |
+| **D3** two shop registries; venues wear op-shop signage | **RE-FILED → B** | `SHOP_REGISTRY` still **9 types**, missing `pub`,`band_room`,`rsl` (A's `SHOP_TYPES`: **12**, all with `sign:{bg,fg,accent,style}`); bite line now `buildings.js:465`; **81 venue lots** corpus-wide @ golden seed render op-shop palette — can wait because cosmetic-only (no gate, no plan field), and the fix may move a **screenshot** golden (F re-pins), never a plan golden | node corpus sweep (venue count) + `grep -n SHOP_REGISTRY web/js/world/buildings.js web/js/world/fixture_plan.js` |
+
+**GOLDENS:** synthetic fingerprint **`0x5f76e76` FROZEN** · `GIG_GOLDEN 0xec7a2d39` FROZEN · all base
+town goldens + 3 osm fixtures FROZEN · **7 `REAL_TOWN_GIG_GOLDENS` re-pinned under D4's explicit
+requirement** (adelaide/bendigo/fitzroy/fremantle/geelong/marrickville/northbridge — old hashes kept in
+the pin table comments; the §37 filing predicted 11-of-26 on the R37 tree, today it is 7-of-24).
+Selfcheck **ALL GREEN 157,647/157,647** after all edits. Files touched: `web/js/citygen/gigs.js`,
+`web/js/citygen/plan.js`, `web/js/citygen/index.js`, `web/js/citygen/selfcheck.js`,
+`docs/CITY_SPEC.md`, `docs/LANES/LANE_A_NOTES.md`, this file. Nothing outside Lane A's set.
+
+## Round 39 (2026-08-03) — v9 item 39.1: THE ADDRESS LAYER (the approved thing; B and C consume it)
+
+**The full contract, per-town table and reasoning live in `LANE_A_NOTES.md §39`** — published in the
+first commit, because B (39.2 the fog) and C (39.3 the op-shop dig) build against it in parallel.
+
+**Fable's three binding facts, re-derived independently — all three land exactly.** 19,132 road ways,
+**17,835 named (93.2%)**; median plan-edge-sample → nearest named way **0.03–0.90 m** (worst katoomba);
+**1,192 / 1,219 corpus shops (97.8%)** resolve. Nothing to contradict.
+
+**What landed.** `web/js/citygen/address.js` — pure, **zero imports**, no THREE/fetch/DOM/module state,
+no plan mutation. `createAddresses(plan, cache|null)` → `streetOf` · `localityOf` · `cohort` ·
+`streets` · `stats`. Two suppliers, one field: a cache town fills `label` from real named ways, the
+synthetic from `district.kind` + block. Plus `getTownCache(key)` (additive, read-only) because
+`index.html:129` registers the cache and drops its reference, so `roads[]` was unreachable downstream.
+`map.html` now loads real caches and prints the address — verified in-browser on castlemaine (*"XXXX
+Antiques — Elizabeth Street · south side"*) and on the synthetic (*"Nev's Pawn & Loan — the warehouse
+fringe · north side"*) **through the identical line of code**.
+
+**Two departures from the synthesis, both measured.**
+
+1. **The shift is recovered EXACTLY, not voted for.** I implemented the proposed centroid-align +
+   nearest-waypoint vote first: it returns the **WRONG shift on 5 of 23 towns** (braddon, fremantle,
+   hobart, northbridge, westend) — island culling drags the plan centroid off the cache's and the vote
+   converges *confidently* on a wrong offset. A wrong shift renames every street in the town. Replaced
+   with a lattice intersection (node − waypoint candidates, filtered by further nodes): **exact on
+   23/23, nothing to tune, returns null rather than a guess.**
+2. **Five samples along an edge, not the midpoint.** A midpoint cannot distinguish a street from the
+   street that crosses it — at an intersection both are ~0 m away.
+
+**The one-line upgrade: TAKEN, and it is genuinely that clean.** `norm.shift = {shx, shz}` goes onto the
+normalization log, reaching the caller only via the existing `opts.report` sink — never the plan object.
+It is a **cross-check, not a dependency**: the selfcheck compares plan_osm's published shift against
+address.js's independent recovery and fires on a **0.01 m** disagreement. Without it the recovery would
+only be checkable against itself, which is the exact vacuous-gate species R37 was about.
+
+**The gates (+240 checks), each proven to fire on a broken world.**
+
+| arm | today | breakage that fires it |
+|---|---|---|
+| 0 wrong names on shop-bearing edges, vs an **independent way-membership resolver** | **857/857 agree, 0 wrong** | resolver or shift drift |
+| corpus resolution ≥ 97% | 1,192/1,219 (97.8%) | names stripped → 0.0% |
+| shift recovered == plan_osm's published shift | exact, 23/23 | a **0.01 m** error |
+| `createAddresses` does not mutate the plan | byte-identical per town | any write to `plan` |
+| CONTROL: `roads[].name` stripped (**the pre-change state**) | 0 streets, supplier `district` | — |
+| CONTROL: no cache passed | supplier `district`, visible in `stats()` | — |
+| all-edge disagreements **PINNED at 4** (not `> 0`) | 4/30,986 | a control drifting to zero |
+
+The 4 corpus disagreements are all 2D-stacked ways where the question has no single answer (geelong's
+two adjacent malls; a motorway crossing *over* a street on glebe and redhill ×2) and **none carries a
+shop** — which is why the shop-bearing arm is 0.
+
+**The tolerance finding, which is the one worth keeping.** Coverage rises with tolerance (2 m → 85.2%,
+6 m → 97.4%, 8 m → 97.8%, 12 m → 99.1%) but **correctness saturates at 6 m**: 857 agreeing frontage
+names at 6, 8, 12, 16 *and* 24 m. Every metre past 6 buys exactly one thing — a name attached to a way
+OSM left unnamed (0 at 6 m, 4 at 8 m, 14 at 24 m). **It can never buy a correction.** Shipped at the
+briefed 8 m, which keeps four borrowings, all arcade footways inside a named mall.
+
+**And the resolver degrades to null, not to a wrong name.** Feed it a shift wrong by 30 m and
+castlemaine/katoomba/adelaide return **zero** street names rather than a town full of wrong ones. Feed
+it one wrong by 3 m and adelaide's coverage *rises* from 89 to 98 shops while being wrong — which is
+why the shift arm is exact-or-nothing and **coverage is never used as a proxy for correctness.**
+
+**The failure modes, named.** All 27 unresolved shops front a way OSM genuinely leaves unnamed:
+adelaide 21 `arcade` (its arcades are the town's retail spine and OSM leaves the footways unnamed — it
+is the corpus worst at 80.9% and it is *honestly* worst), fitzroy 1, geelong 1, launceston 1 + 2 `lane`,
+northbridge 1. **`null` is the honest answer and the module returns it**; a shop with `street: null`
+carries `label: null` too, asserted per town.
+
+**The synthetic's honest limit:** 12 label cells over 493 shops, median 41, max 147. Coarse — the same
+structural fact §8 of the charter records. `block` is the finer cell (32 shop-bearing blocks, median 14).
+
+**GOLDENS: NOTHING MOVED, ZERO RE-PINS.** synthetic `0x5f76e76`, gig `0xec7a2d39`, 3 osm fixtures, 23
+`REAL_TOWN_GOLDENS`, 23 `REAL_TOWN_GIG_GOLDENS` — all untouched. Selfcheck **157,407 → 157,647 ALL
+GREEN**. `createAddresses` costs **≤27 ms** on the worst real town (bendigo), **0.3 ms** on the
+synthetic, once at plan time; zero draws, zero triangles, zero plan fields.
+
+## Round 37 (2026-08-03) — v8 WAVE 0 §0.1: THE KERB (ruling-side) — the gate I owned was the vacuous one
+
+Full detail in LANE_A_NOTES §37. Four jobs, all measured before they were written.
+
+**1. Verified the audit against my own lane — CONFIRMED, exactly, with one refinement it did not make.**
+Default boot (synthetic, seed 20261990, gigs default-ON): **14 posters, all 14 inside `e.width/2` (the
+bitumen B paints), 0 inside the ruled kerb `roadWidth/2`.** The refinement: they are two populations —
+**12 spine posters at `poleOffset` = 6 m are 8 m inside the paint (genuinely mid-road); 2 frontage posters
+clip the corridor edge by 0.06 m** (13.94 of 14, 6.94 of 7 — `FACADE_PROUD` pushes them a fingernail past
+their venue's facade plane). Both are inside the paint; "14 in the middle of the road" would over-claim.
+Also confirmed: B's `ground.js` road quad is `hQuad(…, e.width, 0)` — the full corridor, kerbs at
+`e.width/2 + 0.12`, nine metres outside mine on a main.
+
+**2. Diagnosed WHY the gate was green, and it is our own documented lesson recurring.** My placer seats
+posters via `poleOffset`, which is *derived from* `roadWidth`; my selfcheck asserted clearance against
+`roadWidth/2`. Gate and subject were the same function agreeing with itself — the R27 cross-convention
+trap, inside the very file whose header (`selfcheck.js:33-40`) explains it. It never read a number that
+came from B, so no change to the street could make it fail.
+
+**3. Corrected it — three arms, the third a permanent control.** (1) no poster on a carriageway, measured
+through `vergeBand(e)[0]`, the published law itself — the same call B's ground now consumes; (2) every
+**spine** poster stands *inside* some edge's `vergeBand` (the outer bound the old check never had —
+frontage exempt **by measurement**: on 18/108 gig plans a frontage poster legitimately stands past every
+corridor edge, worst 3.98 m, launceston_real; spine violations 0/108); (3) **the control** — count the
+posters that would stand on bitumen under the pre-ruling `?verge=0` ground and assert it is **> 0** on
+every gig plan (measured min 3 / max 212 / never 0 across 510 plans), **pinned at exactly 14** on the
+default boot, because a control allowed to drift to zero is how a gate goes vacuous in the first place.
+The replica is pinned to B's **flag**, not to a line number that will drift as B edits.
+
+**Proved it fails on the old geometry, and that the old gate cannot.** Simulated `?verge=0` honestly —
+`vergeBand` switched to the pre-ruling reading, `poleOffset` pinned to the true band so the **placer is
+byte-identical** (it is a render flag: the paint changes, the plan does not; fingerprint and every gig
+golden stayed green in both runs, so the gate's reading is the only variable). **Corrected gate: ✗ FAIL,
+1020 failures — 2 arms × 510 plans. Pre-R37 gate: ✓ ALL GREEN 156,352/156,352.**
+
+**4. Confirmed the corridor-law exports for B and published the whole contract** (LANE_A_NOTES §37 —
+B is consuming them in a parallel session, so it is written as a warning, not a reference). Semantics
+unchanged; nothing ambiguous was altered mid-round. Flagged loudly: `roadWidth` returns a **full** width
+and so does `edge.width`, but one is carriageway and the other corridor — that naming is *why* this bug
+existed; **`lane`'s band is not the literal `[2,2]` the round instructions state** (2 synthetic edges are,
+**56 real lane edges are `[4,4]`** — branch on `outer <= inner`); `arcade` is all footpath with coincident
+kerbs to skip; and the inward extension **never inverts** (`roadWidth > e.width`: **0 of 31,039 edges**,
+though a `side` under 6 m would — guard it). Two charter numbers corrected: the "9 m band / 18 m of every
+main" figures are **synthetic-only** (main 28 m); **on all real towns a main is 24 m ⇒ 7 m band**, and the
+corpus's dominant edge is `side`@12 — **22,415 of 31,039 (72%)**, a **3 m** footpath.
+
+**GOLDEN VERDICT: nothing moved, zero re-pins** — correct and predicted, since the only file I changed on
+the generator side is the *selfcheck*, which validates output and never produces it. `0x5f76e76`,
+`GIG_GOLDEN 0xec7a2d39`, 25 base town goldens and 24 real-town gig goldens all green and untouched.
+Checks **156,352 → 157,407** (+1,055), runtime 10.3 s.
+
+**Filed, not fixed — v8 debt ledger, four entries** (LANE_A_NOTES §37): D1 `chunkIndex` (two impls, three
+divergences, and a header comment promising a swap that would break three ways — owner B); D2 `isOpen`
+(three impls plus an ad-hoc fourth site; A's canonical one has **zero importers**; the live shell copy
+treats *no hours* as **closed** where A's law says *open* — latent today, fires the moment v8 adds an
+hours-less lot — owner F); D3 two shop registries (B's missing all three venue kinds ⇒ `buildings.js:344`
+falls back to **op-shop** signage on every gig venue since R13 — owner B); **D4, new, found this round**:
+my own poster gate's inner bound is **nearest-edge**, and an `arcade` (kerb 0) camouflages a real
+carriageway — 8 real-town plans hide a spine poster up to **1.78 m inside a main**, zero on synthetic.
+Cost measured decision-grade: synthetic **0/4 plans move**, **11/26 town gig goldens re-pin**, poster
+counts unchanged. Deliberately deferred to R38 — it moves plan output for a reason that is not the kerb
+ruling, and the "did the kerb ruling move a golden?" answer must stay a clean **no**.
+
+## Round 30 (2026-07-18) — the rotation boundary verify (ledger #6, small round as briefed)
+
+One job: prove F's day-salted stock rotation (207bcff) never reaches plan generation. **It holds.**
+Three measured legs (full detail in LANE_A_NOTES §30): (1) grep-zero for day identifiers over the proven
+`citygen/**` glob (8 files / 2,546 lines, census printed; pattern proven non-vacuous against
+`interior_mode.js`); (2) structural absence — `generatePlanFor` consumes no day-shaped opt and neither
+shell call site passes one; (3) day-inertness byte-measured — plan hash identical with `{day, stockDay}`
+hostilely injected as 1 and 37 vs absent, 3 seeds × synthetic+osm, 6/6. The salt's actual reach: `stk-*`
+stock-pick stream labels + dig `binSeed` + `setWeekNight` night-selection over the plan-time 7-night week
+(day picks a night, never generates one). Selfcheck ALL GREEN 156,352/156,352, fingerprint `0x5f76e76`
+frozen, every town pin green. No files of mine changed except these two notes.
+
+## Round 27 wave 5 (2026-07-17) — THE FACADE FIX (the epoch's biggest catch)
+
+The ruling asked me to land B's one-liner in the real-roads seating and to **measure the marched path
+rather than assume it was clean**. I measured all three paths, and the ruling's premise was wrong in the
+half that mattered: **synthetic is broken too**. Not "every real town since R18" — **every town, every
+path, since v1**. Confirmed numerically (0 toward / 681 away, dot −1.0000) and then with my own eyes:
+`?classic=1`, synthetic main street = three blank boxes; walk into the block and NUMBAT PLAYTHINGS is
+there, facing the dirt. 637 of 681 lots pointed their facade at **no street at all**.
+
+- **Four sites, one sign.** `plan.js:122` (synthetic strip), `plan.js:244` (market row), `plan_osm:330`
+  (marched avenue), `plan_osm:443` (real roads — B's proven one-liner). All `atan2(outward)` where the
+  intent was `atan2(−outward)`, and **every one says so in its own comment**. The code never did what it
+  said; CITY_SPEC:71 blessed the result by writing the SIM convention into the LOTS contract.
+  After: synthetic 681/681, marched + all 3 fixtures 100%, real-roads katoomba **0/72 → 72/72** (B's number).
+- **The covenant moved, on John's ruling.** Fixing synthetic necessarily moves `0x3fa36874`, frozen
+  "forever" since R16 — not Lane A's call, so I stopped and asked. Ruling: **amend and fix all paths** (the
+  covenant is anti-drift machinery, not a defect preservative). **51 goldens re-pinned in one commit**;
+  amendment recorded in CITY_SPEC as a one-time, ruling-gated precedent.
+- **A second bug the fix exposed, fixed with it:** `buildRealRoads` seated blocks at `KERB = 4 m` from the
+  **centreline**, but a `main` carriageway is 10 m wide (kerb at 5 m) — **every main-street building has
+  stood 1 m inside the road since R18**. Invisible until the shopfront turned around and its poster landed
+  in the traffic lane. Blocks now seat behind the kerb per A's own corridor law. Drops 6.4% → **6.6%**, counted.
+- **The cross-convention gate (the lesson made law).** It does not restate a spec line — that is the trap F
+  proved (72/72 "facing" over blank walls). It replicates **Lane B's own** `buildings.js` maths and asks
+  whether the quad the *renderer* draws lands nearer the street than the lot centre. Fires if A's `ry` **or**
+  B's `zf` drifts. It would have caught this on day one.
+- **→ F (blocking their re-gate):** `scaffold_check` is RED until F re-pins the covenant hashes duplicated
+  in **F's own files** (`flags_check.py` `GOLDEN_HASH`/`GIG_GOLDEN`, `scaffold_check.mjs` `TOWN_GOLDENS`,
+  two tour captions). Exact values handed over in LANE_A_NOTES §R27w5; I can't touch F's files.
+
+*Previous status: 156,212/156,212; rounds 2–27 closed (see below).
+R27 (v5.0 close): **CITY_SPEC v5 section** (tier ladder · `sourcing` vs `tier` · the three id-space fences ·
+the manifest · Ruling 2) + the **charter risk list judged line by line** — risk #1 deliberately CARRIED, not
+pre-retired, because F's kill-the-server gate is what retires it. classic `0x3fa36874` / gig `0xb1d48ea1`
+frozen; **no golden moved this epoch**.*
+*Date: 2026-07-17 · owner: PROCITY-A (Opus 4.8)*
+
+## Round 27 (2026-07-17) — v5.0 THE LIVE CRATE: the docs freeze (ledger #6)
+
+Lane A's half of the epoch close. Docs only; **no code, no golden moved** — correct, since tier 2 touches no
+plan, no cache, no atlas bytes. selfcheck **ALL GREEN 156,212/156,212**.
+
+- **CITY_SPEC v5 section**, written from the artifacts rather than the briefs (the epoch's own lesson):
+  the **tier ladder** (0 parody / 1 static real / 2 live, each degrading softly); **`sourcing` is not
+  `tier`** — both ship in every index, `tier: 1` is the rung and a mint atlas is *still* rung 1, while
+  `sourcing: "real"|"mint"` is provenance (15 keyed atlases = **1 real + 14 mint**); the **three id-space
+  fences**; the **manifest** (existence declared, never probed — the root fix for fail-soft-404 vs the
+  zero-console-errors law; 15 entries, 15 dirs); **Ruling 2**; and A's single seam, `godverseShopId`.
+- **The id fences, verified not restated.** The plan-id/godverse-id trap is still live in the data and I
+  reproduced it: in `redhill_godverse`, bare **`31`** is "Wholefood Cafe" as a plan id and "Silky Oak
+  Furnature" as a godverse id — the exact ambiguity that made F's `enterShop(31)` assert vacuously on the
+  wrong shop. It's a standing rule, not a fixed bug, and the spec says so.
+- **The risk list judged, without pre-retiring anyone's gate.** #1 (tier-2 latency) **CARRIED** — written in
+  wave 2, F's reader doesn't exist yet, and *nothing retires that line except the gate going green*;
+  retiring it from a doc while the code is unwritten is the precise species this epoch spent four holds
+  catching. #2 **retired** (measured: max 2 atlases/shop vs C's cap of 2; mint at 16 items/1024², only the
+  real POS shop at 2048²; the mecca case served by crate rotation — the remedy the risk itself named).
+  #3 **retired — designed out, not solved**: it assumed fuzzy name-matching, and there is no matcher;
+  Monster Robot is in *neither* census nor OSM, so no matcher could ever have found it. #4 **split**:
+  write-back retired by John's ruling-as-mechanism (`/reserve`+`/buy` absent, not stubbed — you can't race a
+  verb that doesn't exist), the `gone` read carried to F's #4. Two new carried: **#6 orphaned atlas**,
+  **#7 "real" is one shop wide** (14/15 are mint — honest and marked, but the headline rests on one shop).
+- **The gate that armed itself.** My R25 orphan gate SKIPped on `newtown_godverse` while no atlas keyed
+  there; G's mint atlases landed and it **began binding unattended** — 156,211 → **156,212**, and that +1 is
+  the gate arming itself. Near-miss carried: redhill's lift drops keyed shop **2286 "Empire Revival"**;
+  G stocked neighbour **2287**. Stocking 2286 today would orphan it.
+
+## Round 25 (2026-07-17) — v5.0-alpha: the sweep vs Ruling 2 + the six pins (ledger #1)
+
+All 8 tree reds cleared — **6 were my own gate asserting Ruling 2 away**, 2 were goldens awaiting my pin.
+selfcheck **ALL GREEN 156,211/156,211**, scaffold + consistency green, classic frozen.
+
+- **My R24 gate encoded an assumption that Ruling 2 falsified.** I built the identity arm believing a
+  godverse cache is *all* census shops. It's **mixed** by design — a keyed GODVERSE layer + an inherited OSM
+  texture layer that G measured to be load-bearing (census-only Red Hill: 306 m spacing warn + a poster
+  inside a kerb). So `newtown_godverse` (18 keyed + 54 texture) and `redhill_godverse` (10 + 27) were
+  **healthy towns my gate called broken**. Keyed asserts now run **per-layer over the keyed subset only**;
+  the "N/M missing" warn is gone. The one honest requirement left: a `godverse+osm` cache must have a
+  **non-empty** godverse layer (else it's an osm cache with the wrong `source`) — still a warn.
+- **The uniqueness check was broken in both directions.** `new Set(all ids).size === shops.length` collapses
+  every `undefined` into one entry, so it failed structurally on mixed caches *and* could hide a real
+  duplicate behind the same collapse. Now over **defined ids only** — and, per the vacuous-gate law, proven
+  able to fail: the validator rejects dups at the front door, so the test feeds one **straight to the lift**
+  (`generatePlanOSM` doesn't validate) and asserts the predicate catches it.
+- **New: the orphaned-atlas gate** — my own R24 finding, enforced rather than filed. A committed
+  `stock_godverse/<id>/` whose shop the lift dropped = real stock keyed to a shop that isn't in the town.
+  Node-side, subject-aware (SKIPs by name when a town has no atlas), so it catches in seconds what F's #7b
+  could only catch in a browser at the end of a round. **It already found one, benign today:** redhill drops
+  keyed shop 2286 "Empire Revival" (unstocked ⇒ no orphan ⇒ gate passes). Filed for G: stocking it at the
+  beta would orphan. Monster Robot Party is seated (lot 8).
+- **The six pins**, cross-checked two ways before landing — byte-identical across two fresh processes, and
+  matching the values G stated independently in `86e2985`: `newtown_godverse` `0xcf69b387`/`0x1e266f60`,
+  `redhill_real` `0x6046700f`/`0x673785ee`, `redhill_godverse` `0xb2224939`/`0xc6f80e18`.
+
+## Round 24 (2026-07-17) — v5.0-alpha: the identity field (ledger #2)
+
+`shop.godverseShopId` — the optional key resolving `stock_godverse/<id>/`. Schema **stays v2**; absent
+everywhere except godverse caches, so the 21 osm caches are untouched by construction. Published to
+`web/assets/towns/README.md` (the doc G/E build to) + CITY_SPEC. selfcheck **ALL GREEN 152,030/152,030**
+(+15), synthetic `0x3fa36874` frozen, **no golden moved** — by design (see below).
+
+- **The brief's "the POS shop id IS the id" is false for the one shop that matters.** G's own docstring:
+  Monster Robot Party is **not in thriftgod's census**, so its id is its **dealgod store id 3962749**, while
+  census shops use thriftgod ids (max 2992). Two disjoint spaces on one field ⇒ built it as an **opaque
+  key**: no derivation from `id`, no equality assert, no mapping table (the R12 gigKey law).
+- **The field had to survive the lift, or it was decoration.** `plan_osm` builds a *fresh* shop object and
+  copies nothing unknown, so a cache-only field would never reach the runtime — and the runtime reads
+  `plan.shops[]`, never the cache. It's now carried through, **conditionally**: absent ⇒ the key isn't
+  written ⇒ `JSON.stringify` byte-identical ⇒ **every pinned golden holds until G re-emits** (that re-emit
+  is the sanctioned move).
+- **Arms split by hazard:** malformed → **error** (it's a path segment; `"3962749"` vs `3962749` is the
+  same coercion drift that broke the atlas contract), duplicate → **error** (two shops, one atlas = the
+  mis-stock charter risk #3 forbids), missing on a godverse cache → **warn + fail-soft to tier 0**.
+- **Recorded departure:** the ledger said missing should be an *error*. It would invert the charter's
+  determinism boundary (the **town** failing to load because **stock** identity is absent), contradict risk
+  #3's own remedy ("fail-soft to tier 0"), and red the tree for C and E through all of wave 1 — G re-emits
+  in wave 2 and it's their namespace, not mine. Teeth kept where R23 says to put them: selfcheck **fails on
+  partial keying**, prints an explicit **SKIP + count** at zero. Flagged for Fable to overrule.
+- **Filed for G before they start (measured, wave 1):** `redhill_godverse` can't contain Monster Robot from
+  **either** source. `godverse_town.py` takes roads from the OSM donor and shops from the census; the shop is
+  in neither — not in thriftgod's census (G's R23 finding), and **not in E's `redhill_real`** (I checked it
+  as it landed: 36 shops, **zero of type `record`**, nothing matching /monster|robot/). Needs explicit
+  injection, or F's #7b id-equality gate fails at the end of the round. Also flagged: the census bbox must
+  still clear `MIN_TOWN_SHOPS` (6) or the cache is rejected outright.
+- **Pins deliberately NOT taken this round yet.** `redhill_real` is untracked/in-flight (E is still editing
+  `build_towns.py`), and `redhill_godverse` + the re-keyed `newtown_godverse` don't exist until wave 2.
+  Pinning a moving file buys a false green or a spurious red. The round's law says A pins these **batched** —
+  that batch lands once E commits and G's caches are in. `redhill_real` reads clean meanwhile: valid, no
+  warns, 73.3 m spacing.
+- **Housekeeping:** removed toowoomba's two stale pins (E retired the cache in R23 — a golden for a town
+  that can't load can never fire). E's attempt also proved my R23 spacing metric is **gameable**: the
+  re-bbox fixed the median (395.7 → 89.4 m) while hub density fell 3/12 → 2/12. Necessary, not sufficient —
+  D's hub test is the complement. **Ballarat (255 m) still flagged, still E's call; I pin whatever moves.**
+
+## Round 23 (2026-07-16) — v5.0-alpha: the spacing warn (ledger #5)
+
+D's R22 finding made law: `MIN_TOWN_SHOPS` counts shops, but what makes a town read alive is **clustering**.
+`validateTownCache` now warns when `medianShopSpacing(cache) > MAX_MEDIAN_SPACING_M` (**150 m**) — the metric
+and threshold both exported from the barrel, so no lane re-derives them. **Warn, never error**: a flagged
+cache still boots a valid district (toowoomba shipped green through the whole v4.0 pack), E curates, the
+validator flags. selfcheck **ALL GREEN 161,372/161,372** (+72), synthetic `0x3fa36874` frozen, no golden moved.
+
+- **The threshold is measured, not picked.** Fable's brief offered darwin 27 m / toowoomba 388 m as "plenty
+  of daylight for a line". Measuring all 23 towns showed the pack is a near-continuum, and the line is
+  **forced** into `(119.3, 254.9]` — braddon (119.3 m) is alive by D's own hub test (7 shops within 160 m,
+  identical to darwin's 7), ballarat (254.9 m) is not. 150 m sits in the pack's widest gap (**×2.14**).
+- **Two towns flag, not one.** The brief names toowoomba; the measurement adds **ballarat (255 m)**, which
+  nobody had looked at — and which is independently one of the three towns my R22 cluster fallback fired on.
+  Filed for E as a curation call, counted either way.
+- **The brief's anchors were in the wrong space, and it matters.** D's 27 m is **plan** space (post-lift);
+  `validateTownCache` is **cache** space (raw lat/lon — the only thing it has at ingest). Darwin is 68.3 m
+  in cache space, not 27. Coding a threshold interpolated between D's figures would have mixed spaces
+  silently. Cache space is right *here*, and provably safe: the lift compresses dense towns (darwin
+  plan/cache **0.40**) but not sparse ones (toowoomba **0.98**, ballarat **1.01**), so the error lives at the
+  dense end and the warn only fires at the sparse end. Verified all 23 in both spaces: **one town disagrees**
+  (`newtown_godverse`, 94.4 cache → 158.3 plan) — filed for G/Fable, not acted on, since no cache-space line
+  catches it without false-positiving braddon, and its sparsity is census *coverage*, which re-bboxing can't fix.
+- Cost: ~1 ms/town at registration (25.6 ms for all 23 including fitzroy's 160 shops), against a <100 ms
+  plan budget. Pending: re-pin whatever E's toowoomba re-bbox moves — **only** that.
+
+## Round 22 (2026-07-16) — v4.0 THE EPOCH CLOSE: the pack absorbed + 36 goldens pinned (ledger #2)
+
+E's 17 new towns + Lane G's `newtown_godverse` fed through the lift and pinned in ONE golden commit
+(`REAL_TOWN_GOLDENS` + `REAL_TOWN_GIG_GOLDENS`: 5 → **23 towns each**, zero unpinned).
+
+**The headline: everything built this epoch held at 23-town scale, first try.** 1,210 shops → 1,133 seated
+(77 dropped, **6.4%**, counted by cause); **1 connected component and 3 venues on every one of the 23 towns**.
+`fitzroy` — 160 shops, 2× anything absorbed before — landed 139 seated, 1 component, 3 venues, 212 posters,
+all invariants green. The junction-protected DP, fragmentation ruling, cluster bias, poster cap and capacity
+fence needed **no new hardening**: the pack needed absorbing, not fixing.
+
+- **Graded cluster fallback (the one refinement).** Three towns have no candidate at the floor at all
+  (`ballarat`/`toowoomba`/`newtown_godverse` top out at 2 shops within 160 m); R21's bias switched off there,
+  stranding venues at 0. It now falls back to the **densest available** — ballarat 0,2,0 → **2,2,2**, godverse
+  0,1,1 → **2,2,2**, toowoomba 1,0,0 → 1,2,1. Fires only where the floor is unreachable ⇒ **no already-pinned
+  town moved** (verified). Acceptance at pack scale: **20 of 23 towns have every venue ≥3**; the three above
+  sit at their town's genuine ceiling — the carved-out case, stated explicitly.
+- **Drop outliers, counted not hidden:** `daylesford` 19% (32 shops on a 171-road graph — the thinnest in the
+  pack, all overflow), `fitzroy` 13%. `RGAP` is already 0.5 m and `NODE_CLEAR` 3 m; the only lever left is
+  spilling onto a different street, which buys a few percent by putting a shop on a road it isn't on. Same
+  ruling as R20: **drop and count beats teleport**.
+- selfcheck ALL GREEN **161,300/161,300**; scaffold + consistency GREEN; cross-process deterministic
+  (pack-xor `0xca140954`). classic / gig / marched fixtures frozen.
+
+Handshake fired → C + D + F: the pack is in, 23 towns pinned, start your verifies.
+
+**Ledger #6 (docs, `9c9ad73`): CITY_SPEC v4 final + the risk list retired-or-carried.** Closing this
+surfaced real drift — **three gig-layer behaviour changes had reached only these notes, never the spec**
+(R20's clearance widening to every venue kind, R21's cluster bias, R22's fallback). The amendment law says
+the spec is where they live; all three are now recorded, along with the pick *order* no lane could have
+inferred (cluster field → kind flavour → clearance → `farthestFirst` → seeded pick). Risk list judged
+against the pack, not the 5-town sample it was written for: **#1 retired** (widest town geelong 3,829 m =
+77% of the 5 km law), **#2 retired** (thinnest darwin 12 shops = 2× `MIN_TOWN_SHOPS`), **#3 retired
+plan-side / carried for the runtime lanes** (a green plan is not a green town — C/D/F's verifies close it),
+**#4 retired** (DP knob measured; 1 component on all 23), **#6 NEW carried** (thin-graph seating capacity).
+
+**Ledger #1 (tri diet): not A's — B's numbers decided it.** The driver is E's four furniture GLBs
+(91.5%); posters are **222 tris**, buildings **348**. My cap worked and was never the lever, and B found
+the real coupling is **road density, not shop count** — so the absorb wasn't the cause either. My guess
+(buildings/LOD) was wrong at 0.2%; the measurement won, as it should.
+
+## Round 21 (2026-07-16) — v4.0-beta: the venue cluster-adjacency bias (ledger #1, the round's spine)
+
+D filed it: katoomba's pub sat 1,000 m from the retail cluster — a gig with no passing crowd. Measuring all
+five towns first showed it was **systemic: 11 of 15 venues** had <3 shops within 160 m (newtown's were
+0/0/1). After the bias: **0 of 15**. Katoomba's pub went **1 → 9**; castlemaine cleared without needing the
+floor exception Fable anticipated.
+
+- `pickVenues` now builds a **cluster-adjacent field** (≥`CLUSTER_MIN` 3 shops within `CLUSTER_R` 160 m),
+  then the kind flavors (pub corner / band_room fringe / rsl off-spine) bias **within** it rather than
+  overriding it (per the brief: biases, not absolutes). No cluster at all → falls back to the pool.
+- **Synthetic frozen BY CONSTRUCTION**, not by luck. The brief assumed a blanket filter was a no-op because
+  "the synthetic town is one dense cluster anyway" — measurement says otherwise: **4 synthetic candidates
+  per seed** sit under the threshold (min cluster 0–1), so a blanket filter *would* have moved the frozen
+  golden. Gated on `plan.source === 'osm'` (undefined on synthetic). Marched fixtures are 'osm' but genuinely
+  dense (min 3/11/13) ⇒ verified no-op.
+- **Only the GIG goldens moved** (venue selection is gig-layer): katoomba `0xbf586b77`, newtown `0xacdb3eee`,
+  fremantle `0xcf3426fc`, bendigo `0x646b2c23`, castlemaine `0xf9713a69`. Base goldens untouched.
+  classic/gig/marched fixtures frozen. selfcheck ALL GREEN **66419/66419**; scaffold + consistency GREEN;
+  cross-process deterministic.
+- FYI: E's v4.0 pack (`glebe`, `marrickville`, `newcastle`) already boots clean through my loader (validates
+  + full suites pass), listed UNPINNED — **I pin the pack in R22**; it does not gate the beta tag.
+
+Handshake fired → C + D: cluster bias landed, goldens re-pinned, start your verifies.
+
+## Round 20 (2026-07-16) — v4.0-beta THE FIVE TOWNS: the poster cap (density absorb pends E)
+
+Two Lane-A deliverables; the first (independent) landed this commit, the second waits on E's widened caches.
+
+1. **Poster cap (ledger #1) — LANDED.** My R19 finding (real katoomba: 438 spine posters, driving F's one
+   budget edge, `venue_night` 200,965 tris) is fixed. `gigs.js buildPosters` caps the spine pole run at
+   **`POSTER_PER_SHOP × shops`** (1.5/shop, floor 12) — a seeded subsample of the run. **Scaled by shop
+   count, not edge count** (the whole point: a sparse real town has few shops but a big graph). Result:
+   katoomba **438 → 31** posters (~2× the synthetic feel), fremantle 32, castlemaine 14. **No-op on the
+   synthetic town** (493 shops ⇒ cap ~740 ≫ its ~15 posters), so the synthetic gig golden `0xb1d48ea1` is
+   frozen. Posters are gig-layer, so the real-town BASE goldens are unchanged — I added
+   `REAL_TOWN_GIG_GOLDENS` (the full district+poster plan per town: katoomba `0xbd332e83`, …) to
+   regression-guard the capped output byte-exact. selfcheck ALL GREEN **51675/51675**; scaffold + consistency
+   GREEN; cross-process deterministic. → F: re-measure `venue_night`, the +965 edge should close.
+2. **Density absorb (ledger #2) — LANDED.** E's five caches at **3–6× shops** (292 total: katoomba 20→80,
+   fremantle 21→80, newtown 18→72, bendigo 9→36, castlemaine 6→24) absorbed; **all five place 3 venues**;
+   the poster cap auto-scaled off the live shop count as designed. **Capacity widened** — at 4× the dominant
+   drop cause was overflow (edge-side full), so `NODE_CLEAR` 6→3 + a **roads-only `RGAP`** 2→0.5 (shared
+   marched `GAP` untouched ⇒ fixtures frozen): drops **7.9% → 5.5%** (16/292), residual **counted by cause**
+   (`dropped_overflow`/`_overlap`/`_stranded`). Stopped there deliberately — the next lever (spilling
+   overflow onto a different street) buys ~1% by putting a shop on a road it isn't on. **Venue facade bias
+   extended to `pub`** (R16 exempted it; on a real graph at density the pub's frontage poster overhung a
+   cross street — newtown −0.91 m); still a no-op on synthetic. **Goldens re-pinned once** (base + gig, all
+   five). **Fixed:** the real-cache loader now skips E's new `index.json` (a selector index, not a cache).
+   selfcheck ALL GREEN **51866/51866**; scaffold + consistency GREEN; cross-process deterministic.
+
+Handshake fired → all: **densities absorbed, goldens pinned.** → F: re-measure `venue_night` (poster cap)
+and gate the five-town matrix.
 
 ## Round 19 (2026-07-16) — v4.0-alpha CLOSE: fragmentation ruling + findings hardened + goldens pinned
 

docs/ANIMALS_ANSWER.md

@@ -0,0 +1,224 @@
+> **FABLE'S ADJUDICATION (2026-07-26) — read before §1.**
+> This spike is ratified: the mechanism is proven on our own vendored bytes, and the tiering
+> stands. **One verdict in it is over-claimed and is corrected here.** The spike calls the four
+> module-scope furniture GLB fetches under `?classic=1` "a live covenant breach in shipped
+> code". They are not a breach: `bench`/`bin`/`bus_shelter`/`food_cart` entered
+> `furniture.js` in **Lane B round 6 (`24cef5a`), which is tagged v2.0-alpha through v2.0** —
+> git-verified. They are part of the v2 baseline the covenant preserves, so classic fetching
+> them is classic being *correct*. "Zero fetch delta" has always meant zero delta **against
+> the documented v2 baseline**, not zero requests.
+>
+> **What the spike really found, and it is valuable:** (a) `classic_regression` carries **no
+> network assertion at all**, so it could not detect a future fetch-surface widening — which
+> is exactly the R36 species (five DJ bodies widened classic's fetch surface and every pinned
+> number stayed green; only a NEW smoke caught it); and (b) `furniture.js`'s module-init load
+> pattern is a **trap for new assets** — anything added to `GLB_FILES` fetches under classic
+> silently. Both corrections are binding on the fauna work: `fauna.js` is dynamically imported
+> behind its construction guard or carries a CLASSIC-derived module-scope guard stated in its
+> header, and `classic_regression` grows a network **allow-list** (the four v2 depot GLBs plus
+> same-origin), never a deny-list. A deny-list only catches what you already thought of.
+>
+> Also noted: the spike could not reproduce the 280/300 walked draw figure (it measures
+> 191 default / 167 classic by teleport-walk). **Re-pinning the budget of record is now wave
+> 0's first job**, and no proposal spends against 280 until a walked re-measure settles it.
+
+---
+
+# ANIMALS — THE ANSWER
+
+*PROCITY fauna. Answering: "yeah idk about rigged animal models, i will see if i can find some to use online, they have different rigging too right? diff skeleton? what do you suggest here"*
+
+---
+
+## 1. Short answer
+
+**Yes, every animal has a different skeleton — and it turns out not to matter.** There is no mixamorig for quadrupeds. There is no standard animal rig at all. Every animal you download ships a bespoke skeleton with bone names its author invented that morning: `leg_fl`, `Bone.003`, `Hind_L_01`, whatever. That part of your instinct is exactly right.
+
+What is wrong is the assumption underneath it — that a different skeleton is a *problem*. It's only a problem if you need to make **one clip play on a different body**. That's retargeting, and it's the reason our human stack exists: 24 human bodies share 8 clips, so every body must speak `mixamorig`. An animal that ships its **own** animations inside its **own** file doesn't need any of that. The GLB binds its clips to its own bones, through its own mixer, and plays. Zero retargeting.
+
+We measured it rather than assumed it. There is no real animated non-mixamo GLB anywhere on the fleet — I scanned all of `~/Documents`: 2,486 GLBs, 81 with animations, **81/81 mixamorig, 0 non-mixamo skins**. So we authored a test asset byte by byte: a 10-bone quadruped named `root/spine/neck/head/tail_01/tail_02/leg_fl/leg_fr/leg_bl/leg_br`, 96 tris, two embedded clips named Blender-style (`Armature|CritterWalk`, `Armature|CritterIdle`). Then loaded it through **our actual vendored three.js r175 bytes** and **our actual `web/js/core/loaders.js`**, with the repo untouched, and rendered it on a real `WebGLRenderer`.
+
+Result — 27 assertions, all green:
+
+- A bare `new THREE.AnimationMixer(gltf.scene)` + `clipAction(gltf.animations[0]).play()` — no canon, no `buildFigure`, no `_rotOnly`, no MIRPAMO — moved `leg_fl` by quaternion delta 0.252 then 0.310 across two `mixer.update()` calls.
+- The GPU agreed. Rendered to a 200×150 render target and read the pixels back: 1,804 lit pixels, and 704–1,015 of them changed between frames. Not "the matrices moved" — **actual different pixels came off the GPU**.
+- `SkeletonUtils.clone` works on the foreign rig: separate skeletons, **shared geometry and shared material**, so one file feeds N animals. (It maps by object identity, not by name — `SkeletonUtils.js:388-425` — so "foreign names are fine" is structural, not luck.)
+- Our own `loadGLB()` returned the identical object unmodified. **No change to any existing module.**
+
+And the mirror image, which is the important half: if you fed that animal to `web/js/citizens/rigs.js`, `_canon()` would silently do nothing (no `mixamorigN` names to normalise), and then `buildFigure()` would measure the quadruped's "feet-to-crown" span at **0.36 m**, normalise it to human height, and **scale the dog 4.9×**. No error. A giant dog.
+
+So the law is: **animals get a new sibling module, `web/js/citizens/animal_rig.js`, that imports nothing from the human rig stack.** About forty lines. The human fleet is classic-covenanted and never gets touched.
+
+**The real constraint is draws, not skeletons.** Measured on a real renderer: **1.00 draw call per skinned animal, 1:1, all the way to N=80.** three.js has no instancing for animated skinned meshes and there is no impostor tier for animals (our impostor bake frames square from height — `impostor.js:57-66` — which crops a long low animal). So a skinned animal is a full draw at every distance it's visible, or it's culled outright. Nothing in between.
+
+Against that: **sixty birds on wires cost one draw between them**, because static instanced meshes share one material and one draw call. That asymmetry — 1 draw per dog vs 1 draw per *sixty birds* — is the entire design.
+
+---
+
+## 2. The recommendation
+
+Four tiers. Only two of them ship this epoch.
+
+### TIER 0− — the heard animal · **+0 draws, +0 triangles** · **SHIP**
+
+A cockatoo you hear at dusk and never see costs literally nothing and does most of the work. New entries in `PACK` (`pipeline/gen_audio.py:688`), ~30 lines of numpy each, deterministic, original, 🟢 by construction. Played at a **seeded anchor**, so it's the same dog behind the same fence every time you walk that street.
+
+This is the highest charm-per-minute item in the entire document. A town with **zero visible animals** reads as a place with animals in it. Nothing can regress; it inherits the existing `smoke_audio` gate for free.
+
+### TIER 0a — the flock · **+1 draw for the whole town** · **SHIP — this is wave 1**
+
+One `InstancedMesh`, one geometry (two crossed planes = 4 tris), one material, one **1024 WebP species atlas**. Cockatoo, galah, corella, lorikeet, perched magpie, ibis are all cells in the same sheet — which means **every future bird species is free**. That single decision is the most valuable thing in the plan.
+
+This is not a new trick: it's exactly what already renders the town's entire tree canopy (`furniture.js:98-101`). Matrices are static; the buffer refills only when you cross a 64 m chunk boundary. Zero per-frame CPU.
+
+And it is genuinely free when empty — verified to the vendored line. `three.module.js:2193-2199` returns from `renderInstances` before the GL call, and `render.calls++` lives at `three.module.js:4094` *inside* `info.update()`, downstream of that return. A town with no birds, or the daytime species at night, costs **exactly zero**, not "almost zero".
+
+Live cap 96 instances → 384 triangles. Against ~76k spare triangles that is a rounding error.
+
+### TIER 0b — the near props · **+1 draw per species** · **wave 1.5, one species**
+
+Real low-poly meshes for the ones you walk within two metres of, where a billboard reads as cardboard. **The ibis, head down in a council bin** — it's the named proof species from the last review and it lands next to the existing `council-bin` prop. One town-wide instanced mesh, ≤450 tris, cap 16.
+
+### TIER 1 — static mesh + scripted path · **+1 draw** · **the magpie, later**
+
+The already-approved swooping magpie: position is a pure function of `(seed, elapsed time)` — the tram's exact contract — with the wing wave riding `wind.js`'s existing amplitude uniform, which is byte-identical at amplitude 0.
+
+**One correction that's binding:** the review caught that the magpie's territory has to scale with the road graph. On the synthetic golden town there are 370 pole anchors; on `bendigo_real` there are **10,014 poles and 13,730 tree anchors across 2,593 edges**. A capacity-4 magpie town-wide on bendigo is a swooping town where you never meet the magpie. That was already ruled on once (`REVIEW_CITY_PATTERNS.md:111`) and this plan has to honour it, not quietly re-open it.
+
+### TIER 2 — genuinely skinned · **+1 draw each, uninstanceable** · **CUT for this epoch**
+
+The mechanism works. We proved it. **We are still not shipping it, and the argument that killed it came from our own plan.**
+
+The justification for a skinned animal was: a quadruped **gait** is the one motion every human eye detects as wrong before it can read, so we can't fake a walking dog. True. But the actual spec anchored the dog at `shopFront` — **a dog tied outside the shops**, with a static tied dog as its `?noassets=1` fallback. A tied dog doesn't trot. The walk clip, the sole and entire reason the tier exists, would never play.
+
+So either the dog walks — which needs a path, footpath alignment, a collision story and a sim hook that the design explicitly disclaims ("the ped sim never learns animals exist") — or the tier buys an **idle animation for one uninstanceable draw each**, which is exactly what tier 0b already delivers inside a draw it shares with fifteen others.
+
+**Cut. Along with the download that fed it.** Revisit only with a *walking* dog spec that owns its path, its cull and its sim hook. Different round, different charter.
+
+### The ledger
+
+| tier | mechanism | draws | ship? |
+|---|---|---|---|
+| 0− heard | numpy synth, seeded anchor | **0** | **this week** |
+| 0a flock | 1 instanced mesh, 1 atlas, town-wide | **+1** | **wave 1** |
+| 0b prop | 1 instanced mesh, 1 species (ibis) | +1 | wave 1.5 |
+| 1 scripted | 1 instanced mesh (magpie) | +1 | later, graph-scaled |
+| 2 skinned | uninstanceable, +1 each | +1..2 | **CUT** |
+| the wire | town-wide instanced spans | +1 | see §6 |
+
+**Wave-1 spend: +1 draw.** The original plan said +7. The review cut it to +1 and the cut holds.
+
+**One thing to fix before any of this is charter law:** the budget of record says the walked worst frame is 280/300 draws. Re-measuring headless I get **191 default / 167 classic** by teleport-walk, and can't reproduce 280 — it's almost certainly a transient during the chunk-dispose window, which teleport sampling can't hit. It stands as the conservative number, but spending against a figure nobody can currently reproduce is the weakest joint in the whole thing. Re-pin it first. Fauna helps here: its layers are **town-wide, not per-chunk**, so they take no part in the dispose window at all — their cost is steady-state.
+
+---
+
+## 3. INTAKE CHECKLIST — one screen, for while you're browsing
+
+### ✅ ACCEPT ON SIGHT
+- **CC0 / public domain.** No argument, no attribution obligation. Still record it in `SOURCES.md` — our discipline, not their demand.
+- **Single `.glb`, glTF 2.0**, or a `.gltf` sitting next to `.fbx` (Quaternius ships both).
+- **A named clip list you can actually read**: "Walk", "Idle", "Run", "Gallop". Not the word "rigged" on its own.
+- **Under 3,000 triangles.** Under 900 for anything that'll be a bird.
+- **One mesh, one material.** Draws are the scarce resource.
+- **Textures embedded in the file.**
+
+### ❌ REJECT ON SIGHT
+- **A "Buy" or "Add to cart" button.** TurboSquid, CGTrader, Sketchfab **Store**, paid Fab. See the licence rules — **paying does not fix this**, and this is the most expensive avoidable mistake on the list.
+- **"Rigged" with no clip list.** A rig with no animations is a static mesh with extra bones, and we cannot animate a quadruped ourselves — MIRPAMO is biped-only by construction, Mixamo's auto-rigger is verified humanoid-only. Worth exactly zero to us. We can make a static mesh in three minutes for free.
+- **Five- or six-figure triangle counts**, and the photogrammetry/museum-scan look that produces them. The free "White Ibis" on Sketchfab is **238,200 triangles** — one bird exceeding our entire 200k street budget — and it doesn't move. Research and heritage-scan accounts are a reject-on-sight *category*, not individual bad models.
+- **Draco / KTX2 / meshopt compression** (look for `extensionsRequired`). We vendor no decoders. Verified: the loader throws, our fail-soft wrapper (`loaders.js:38-44`) turns the throw into `null`, and the animal **silently does not exist**. A `console.warn` nobody reads. Downloaded assets in the wild are heavily Draco-compressed — this is the single most likely silent failure.
+- **Right common name, wrong animal.** The free "White Ibis" is *Eudocimus albus*, the American one — not our bin chicken (*Threskiornis molucca*). "Magpie" on stock sites is almost always the European bird, which looks nothing like ours. Australian fauna is badly served by international libraries, and a wrong-species bird reads as wrong to every Australian and is invisible to everyone else.
+- **NC / ND / "free for personal use" / "editorial use only".** Instant reject including when it costs nothing.
+- **CC-BY-SA or GPL-on-art.** Share-alike is viral, and we retexture and rescale *everything* — we'd always be making derivatives. Would compromise a provenance table that's been clean for seven epochs.
+- **No licence stated anywhere** — page, description, or the README in the zip. Default under copyright is all rights reserved. Silence is not permission. Close the tab; don't email and negotiate.
+- **Real brands, sponsor decals, team logos, recognisable people.** `AUDIT.md` already quarantined branded assets once.
+
+### 🟢 THE LICENCE RULES
+
+- **🟢 GREEN — CC0.** Accept freely. Record URL, author, licence string and download date in `SOURCES.md` anyway.
+- **🟡 AMBER — CC-BY.** Usable commercially forever, but the attribution obligation is **perpetual and travels with every build**. Hard rule: the `SOURCES.md` line goes in the **same commit** as the file, never "later". CC-BY is the one licence class that becomes a breach through nothing worse than forgetfulness.
+- **🔴 RED — every paid marketplace royalty-free licence, structurally, at any price.** This is the finding that saves money rather than spending it. TurboSquid states it outright: stock media "must be contained in proprietary formats so that they cannot be opened or imported in a publicly available software application or framework, or extracted without reverse engineering" — then names the only exceptions: WebGL exports from Unity, Unreal, Lumberyard and Stingray. PROCITY is hand-rolled three.js with **no build step**, serving raw `.glb` over plain HTTP. A player presses F12 and saves the file. That is the named prohibited case. Sketchfab Store forbids letting third parties "use, download, extract or access" the asset — same wall. CGTrader forbids passing it on "in the form it is downloaded from the site" — same wall, blurrier wording, which is its own reason to stay out. **A $18 rigged possum is exactly as unusable as a free one.**
+- **"Free" is not a licence.** It means "costs zero dollars" and says nothing about rights. Free3D's own terms cap "substantially similar creations" at personal use, max 5 instances.
+- **Capture provenance at download time, not audit time.** Epic is folding Sketchfab into Fab, and **CC0, CC-BY-SA, CC-BY-NC and CC-BY-ND cannot migrate** — those licences don't exist on Fab. Free downloads have been on borrowed time since 2025. itch.io packs go paid or vanish without notice. Archive the file in-repo **and** record the exact licence string the same day. A dead URL with no recorded licence is an asset we can no longer prove we may use.
+- **Internal conflicts = walk away.** If the itch.io page says CC0 and the README in the zip says "credit me", don't adjudicate and don't negotiate. Take the unambiguous asset instead. Ambiguity is what eventually contaminates the table.
+
+---
+
+## 4. VETTED SOURCES
+
+| source | URL | licence | animated? | verdict |
+|---|---|---|---|---|
+| **Quaternius** | quaternius.com | **CC0 1.0** | **Yes, genuinely** — "Ultimate Animated Animal Pack": 12 animals × 12+ named clips | **The only one that matters.** glTF shipped alongside FBX so no conversion. Low-poly, single-material, flat-shaded — our exact budget shape. Roster is Cow/Donkey/Deer/Alpaca/Bull/Fox/Shiba/Stag/Husky/Wolf/Horse. **Zero Australian natives, zero birds.** |
+| **itch.io** (Ariescar) | itch.io/game-assets/free/tag-3d/tag-animals | CC0 (per pack — read carefully) | Yes | "10 free CC0 rigged & animated low-poly animals (GLB) for Three.js" — literally built for our stack. Highest signal-to-noise after Quaternius. Licence sloppiness is the risk: page body and zip README often disagree. |
+| **Poly Pizza** | poly.pizza | **Mixed CC0 / CC-BY per model** | Mostly no | Fast browse surface for Quaternius, not a source in its own right. The site most likely to sneak a CC-BY model into a folder of CC0 ones — read the badge on the individual model, never the bundle header. |
+| **Kenney** | kenney.nl/assets/animal-pack-redux | CC0 | **No** — animals are static | **Skip.** Static is the one thing we already make locally for free. Excellent for props/UI/audio, just not this. |
+| **Sketchfab (CC filter)** | sketchfab.com — filter `licenses=CC0` | Per model, CC0→CC-BY-NC-ND all coexist; **CC-BY is the default** | Sometimes | Only big library where you can filter Animated + Downloadable + permissive at once. Two warnings: **Store ≠ Sketchfab** (any "Buy" button is forbidden to us), and downloads are on borrowed time due to the Fab migration. |
+| **OpenGameArt** | opengameart.org | CC0/CC-BY/**CC-BY-SA**/OGA-BY/**GPL** | Thin, dated | **The share-alike trap lives here.** Filter to CC0 and CC-BY only. |
+| **Icosa Gallery** | icosa.gallery | Mostly CC-BY | **No** — the rescued Poly corpus is Tilt Brush/Blocks, completely motionless | Cross it off. Anyone calling it "the Google Poly successor" hasn't checked whether the models move. |
+| **Blender Studio** | studio.blender.org/characters | CC-BY / some CC0 | Rigged, but `.blend` CloudRig control rigs, not baked GLB clips | Wrong shape. Film-density rigs meant to be hand-animated. Quality benchmark, not a download. |
+| **TurboSquid** | — | Paid RF | Yes, incl. a rigged brushtail possum | **🔴 STRUCTURALLY FORBIDDEN.** See licence rules. Do not spend money. |
+| **CGTrader** | — | Paid RF + free tier under RF terms | Yes | **🔴 Same wall, blurrier wording.** A provenance table wants "clearly permitted", not "probably defensible". |
+| **Free3D** | — | Mixed and hostile | Sometimes | Per-asset licence archaeology on every file, real chance the answer is "no commercial" after you've downloaded. Not worth opening. |
+| **Meshy / Tripo** | — | Free tier = CC-BY | Largely no | **Competitors to our own pipeline, not suppliers.** We generate static meshes locally for $0 with provenance we control end to end. Trading that for a murkier third-party line gains nothing. |
+| **Mixamo** | — | Free w/ Adobe account | **Biped only — confirmed** | Auto-rigger requires a humanoid in T/A-pose and rejects quadrupeds. Adobe stopped developing it years ago. No path here. |
+| **Anything World** | anything-world.gitbook.io | SaaS, ~$50/mo | Yes, incl. animals | Technically the closest thing to a magic wand, still a no: cloud dependency on a startup, and $50/mo for what turns out to be a one-dog problem we've now cut. |
+| **Blender Rigify** | docs.blender.org | GPL (the *tool*; your rigs are yours) | Ships quadruped, cat, wolf/dog, horse and **bird** metarigs | **Worth knowing, and it corrects our own record.** We wrote down "we cannot locally rig a non-humanoid". True of MIRPAMO; **not true of the fleet** — Blender 5.0.1 is already on ultra. The gap is animator hours, not tooling. That's a scheduling fact, not an architectural wall, and the door stays open if you ever want an afternoon in Blender. |
+
+---
+
+## 5. SPECIES SHORTLIST
+
+| species | tier | download? | why |
+|---|---|---|---|
+| **Sulphur-crested cockatoo** | 0a flock | **No — generate** | Screaming on a wire at dusk. All the charm is silhouette, placement and noise. Perched = zero locomotion. Five cockatoos for **one draw**, which no rigged model can ever match. |
+| **Galah** | 0a flock | **No** | Same mesh as the cocky, second skin. `flux_local` does a skin in ~5.7 s — **the second bird is nearly free**. |
+| **Corella** | 0a flock | **No** | Third cell on the same sheet. Free. |
+| **Rainbow lorikeet** | 0a flock | **No** | A screeching mob in a flowering gum. Instanced statics. |
+| **Australian white ibis** | 0b prop | **No** | The joke is entirely **postural** — head in the bin, or standing on one leg looking personally aggrieved. Nobody has ever laughed at an ibis's walk cycle. The named proof species; keep it in wave 1.5. Note: nothing usable exists to download — the free one is the wrong continent at 238k tris, and the correct 4.2k-tri one is a Store listing. |
+| **Magpie** (swooping) | 1 scripted | **No** | Already approved. Static mesh on a seeded parabola, wing wave via the existing wind uniform. Being swooped in September is shared national trauma. Must scale territory with the road graph. |
+| **Brushtail possum** | 1 scripted | **No** | Frozen on a fence rail at night with eyeshine — which is what a real possum actually does. The cheapest implementation is also the most accurate. Only proper rigged one found is $18 TurboSquid, forbidden at any price. |
+| **Brush turkey** | 0b later | **No** | Bonus pick, and a strong one — the canonical town is redhill_godverse, Red Hill, Brisbane. Genuine local menace. Signature behaviour is standing next to a mound scratching, not walking. Too regional to exist in any stock library anyway. |
+| **Blue-tongue / cane toad / flying fox** | 0a/1 later | **No** | Long tail, all near-zero cost. Toad = scripted hop. Flying fox = the magpie's parabola with different geometry, reused for free. |
+| ~~Dog (kelpie/heeler)~~ | ~~2~~ | ~~Quaternius Shiba~~ | **CUT.** The only species that ever earned a download, and it was refuted by its own spec — anchored tied outside the shops, so the walk clip never plays. Also: a Shiba's curled tail and prick ears are **geometry, not texture** — `flux_local` retexturing gives you a tan Shiba, not a kelpie. The dog survives at tier 0− as a **bark behind a fence**, which is free and, honestly, more 1990s Australian than a visible dog. |
+| ~~Gull, pigeon, cat, flies, crow~~ | — | — | **CUT.** Nothing about any of them says Australia, let alone 1990s. |
+
+**And the thing that isn't an animal:** the single most 1990s-Australian-country-town object on this whole list is the **overhead powerline**. A main street with streetlights and no wires reads as a 2010s estate. The wire is worth more period-load per draw than any two bird species on the sheet — and it's the thing the birds are *for*. Wave 1 perches on the streetlight arm (`furniture.js:77-80`, y≈4.1) because it's free and period-plausible; a real wire is +1 draw, town-wide instanced, and needs the pole-pairing worked out first (poles **alternate sides every 18 m**, so same-side spans are 36 m and must not cross edge boundaries or you get wires cutting through intersections).
+
+---
+
+## 6. Two things that block, independent of animals
+
+**1. `?classic=1` is already fetching four off-origin GLBs.** I verified the mechanism directly: `index.html:52` statically imports `chunks.js`, which imports `furniture.js`, whose module body fires `loadGLB()` at line 63-67 guarded by **`NOASSETS` only** — never by `CLASSIC` (`index.html:94`). ES module bodies run on import; construction guards are irrelevant to them. Measured: **179 requests, 25 `.glb`, 4 off-origin depot fetches** (bench, food cart, bin, bus shelter) under `?classic=1`. And `classic_regression` (`flags_check.py:128-241`) has **no network assertion at all**, so it goes green.
+
+This is a live covenant breach in shipped code, and it matters here because that module-init pattern is precisely what the fauna plan proposed to copy. Binding: `fauna.js` is either dynamically imported behind its construction guard or carries a CLASSIC-derived module-scope guard, stated in the file header — and `classic_regression` grows a network **allow-list** (the four known depot GLBs plus same-origin), not a fauna-shaped deny-list. A deny-list only catches what you already thought of, which is exactly how this got through.
+
+**2. `normalize.py` silently eats rigs.** Line 95 deletes every non-MESH object (its own comment says "empties, armatures, cameras, lights"), line 101 joins, line 105 clears armature modifiers. Point the existing pipeline at a rigged animal and you get a T-posed statue with the clips gone **and a green run**. Same for `decimate_props.py:37-45` and `bake_lowpoly.py`. Write it into their docstrings and make the intake tool refuse to run them.
+
+Worth landing regardless of whether an animal ever ships: the spike's deliberate-failure fixtures (`bad_draco`, `bad_cm`, `bad_zup`, `bad_rootmotion`, `bad_2mat`, `bad_exttex`) move into `pipeline/_fixtures/` and become a permanent regression suite for free.
+
+---
+
+## 7. NEXT ACTION
+
+### What Fable can start unattended this week, $0, no download, nothing to approve
+
+**Tonight — the audio batch.** Six numpy synth functions into `gen_audio.py`'s `PACK`: magpie clack and carol, cockatoo screech, dog bark (fence and near), ibis grunt, crow. ~30 lines each, deterministic, 🟢 original, **zero draws and zero triangles**. This is the highest charm-per-minute item in the entire design and it cannot regress anything. A town with no visible animals starts reading as a place with animals in it.
+
+**Then — the flock atlas, about ten minutes of GPU.** Sixteen `flux_local` bird sprites at ~5.7 s each → `bg_remove_local` → packed into one 1024 WebP 4×4 sheet. **No TRELLIS, no meshes** — a billboard needs an image, not geometry, so sixteen sprites cost two minutes where eight meshes would cost twenty-five. And it's not a new asset class: `manifest.skins.facade` is already twenty-five shipped, audited flux images used as textures. This single batch unlocks the whole +1-draw flock: cockatoo, galah, corella, lorikeet, perched magpie, ibis.
+
+**Then — the ibis prop, six minutes.** `flux_local` → `bg_remove_local` → `trellis2_mlx` → `normalize`, decimated to ≤450 tris, head down.
+
+Everything above is unattended, zero-risk and gate-free in the sense that nothing existing can break.
+
+### If you want to go shopping anyway
+
+Nothing in the plan blocks on it, and after the tier-2 cut there is **no download on the critical path**. But if you're browsing:
+
+1. **Go to Quaternius first.** Everything else is downstream of it. CC0, glTF included, low-poly single-material by design.
+2. **Before writing a single `SOURCES.md` line, open the `.gltf` and confirm `animations` is non-empty.** The number one silent failure of free packs is clips that live only in the `.blend` or `.fbx` while the `.gltf` ships an empty array. Fifteen minutes with tools we've already built: `pipeline/animal_intake.py` for the file checks, and the spike harness at `scratchpad/spike_run.py` — it takes a filename — to confirm a bare `AnimationMixer` actually moves a bone. **If the clips aren't in the glTF, walk away.** The pack's entire value to us is the walk cycle.
+3. **The one thing genuinely worth grabbing while you're there is not an animal.** Quaternius's **"Universal Animation Library"** — CC0, 130+ clips on a Mixamo-compatible humanoid rig. That's fuel for our **human** fleet's 8-clip bank, which is the actual thin spot. It touches `rigs.js`, which is classic-covenanted, so it's its own round with its own gates. Don't fold it into the animal work.
+4. **Do not spend money.** Not on TurboSquid, not on CGTrader, not on Sketchfab Store, not on a $50/mo auto-rigger. Their licences forbid serving an open `.glb` over plain HTTP, which is the only thing PROCITY does. Paying doesn't unlock them.
+
+### The two-sentence version
+
+Yes, every animal ships its own bespoke skeleton with its own bone names, and that turns out to be completely fine — a self-contained GLB binds its own clips to its own bones through its own mixer, so retargeting, the thing that needs a shared skeleton, is exactly what we must *not* do. What actually limits animals is **draw calls**: a skinned animal can't be instanced so it costs one draw each against maybe twenty spare, while sixty birds on wires cost one draw between them — so generate a bird sprite sheet and a handful of animal sounds this week for $0, and buy nothing, because the one species that would have justified a download was a walking dog and our own spec had it tied up outside the shops.

docs/CITY_SPEC.md

@@ -28,7 +28,21 @@ considered and parked: nothing in v1 needs it, and the asset pipeline (GLB, web-
 
 - **Metres. +Y up. Ground plane is XZ.** City origin (0,0) = centre of the main square.
 - **Right-handed three.js defaults.** Buildings face their street; a facade's outward normal
-  points at its street edge. GLB convention: origin at base, facing **−Z**, real-world scale.
+  points at its street edge.
+- **THE TWO CONVENTIONS — they are different things, and conflating them cost nine rounds
+  (ROUND27). Read both:**
+  - **The FACADE convention (the lots contract, `lot.ry`): the visible shopfront is local `+Z`** ⇒
+    world `(sin ry, cos ry)`. This is B's canon and the de facto truth since v1 — `buildings.js`
+    draws the facade quad and door at local `z = +d/2`, `venue.js` seats the door-glow/queue/
+    posters there. **`lot.ry` aims +Z at `frontEdge`.**
+  - **The SIM/RIG convention (props, not lots): a GLB is modelled facing `−Z`** (origin at base,
+    real-world scale) ⇒ rig-forward is world `(−sin ry, −cos ry)`. This describes *how a model is
+    authored*, **not which way a lot faces.**
+  - **They are opposites, so a check written in one silently passes over a world built in the
+    other.** CITY_SPEC:71 wrote the SIM convention into the LOTS contract by ambiguity; each
+    generator implemented one half; every golden stayed green over a town whose every shopfront
+    faced away. **Never assert a lot's facing against a spec line — assert it against the
+    geometry the renderer actually draws** (`selfcheck.js` now does exactly that).
 - **Seeded everything, `Math.random()` is banned in generation code.**
   `web/js/core/prng.js` is the only randomness source:
   - `seedFor(citySeed, kind, id)` → stable uint32 (xmur3 hash of `"seed:kind:id"`).
@@ -68,8 +82,11 @@ Schema v1 (Lane A owns it; extend, don't break):
       // onto the block so consumers can theme it without a lookup (Lane A extension, non-breaking).
   lots:   [ { id, block, x, z, w, d, ry, frontEdge, use } ],
       // use: 'shop' | 'anchor' | 'house' | 'yard' | 'stall' | 'infill'
-      // ry: Y-rotation (radians) so a GLB modelled facing −Z ends up with its facade's OUTWARD normal
-      //     pointing at frontEdge. World facing = (−sin ry, −cos ry). Lane B rotates the shell by ry.
+      // ry: Y-rotation (radians) so the lot's VISIBLE FACADE — local +Z — points at frontEdge.
+      //     Facade/door/frontage normal = local +Z ⇒ world (sin ry, cos ry). Lane B rotates the shell by ry
+      //     and draws the shopfront at local z = +d/2 (buildings.js), so +Z IS the street face. ROUND27.
+      //     (The SIM/rig convention — a GLB modelled facing −Z, world (−sin ry, −cos ry) — is a DIFFERENT
+      //     thing and is documented as such below. It is not the lots contract. See the amendment.)
       // frontEdge: id of the street edge this lot fronts (guaranteed to exist and be geometrically adjacent).
   shops:  [ { id, lot, type, name, sign, seed, facadeSkin, storeys, hours: [open, close], openLate? } ]
       // type: see SHOP TYPES below.  hours: [open, close], 24h integers, 0 ≤ open < close ≤ 23.
@@ -116,9 +133,15 @@ Schema v1 (Lane A owns it; extend, don't break):
 > **Full frozen v2 producer contract below** (§"CityPlan v2 — frozen producer contract").
 
 Chunk key: `cx = floor(x/64)`, `cz = floor(z/64)`. **Chunk size 64m.** Lane A ships a
-`chunkIndex(plan)` helper: chunk key → { lots, shops, edges } touching it. Edges are bucketed across
-the full road **corridor** (centreline ± `width/2`), so anything placed in the verge (street furniture,
-footpath NPCs) resolves to a chunk whose `edges` list includes its edge.
+`chunkIndexByCoverage(plan)` helper (R40 canonical name; `chunkIndex` remains as a compat alias):
+chunk key → { lots, shops, edges } **touching** that cell — the COVERAGE question. A lot lands in every
+chunk its rotated-footprint AABB covers; buckets are plain objects keyed `"cx,cz"`; elements are **ids**.
+Edges are bucketed across the full road **corridor** (centreline ± `width/2`), so anything placed in the
+verge (street furniture, footpath NPCs) resolves to a chunk whose `edges` list includes its edge.
+**This is NOT the runtime streamer's index**: Lane B's `world/planutil.js chunkIndex(plan)` answers the
+CENTRE question (each lot in exactly the chunk holding its centre; `Map` container; object elements) and
+the two are not interchangeable on any of the three axes — measured R40: a swap would multi-build
+258/681 lots on the default synthetic town.
 
 ## CityPlan v2 — frozen producer contract
 
@@ -133,7 +156,8 @@ footpath NPCs) resolves to a chunk whose `edges` list includes its edge.
 - `generatePlan(seed) → CityPlan` — synthetic producer (unchanged, byte-identical).
 - `generatePlanOSM(seed, town = 'melbourne', { report } = {}) → CityPlan` — osm producer; pass a
   `report` object to receive the normalization log (below). `osmTownKeys() → string[]`.
-- `chunkIndex(plan, chunkSize = 64) → { chunkSize, chunks }`; `CHUNK = 64`; `chunkKey(cx, cz)`.
+- `chunkIndexByCoverage(plan, chunkSize = 64) → { chunkSize, chunks }` (coverage form; `chunkIndex`
+  is a compat alias of it — see the chunk-key note above); `CHUNK = 64`; `chunkKey(cx, cz)`.
 - Geometry helpers (shared with the harness): `lotCorners(lot)`, `obbOverlap(a, b)`.
 
 **Determinism & goldens.** Same inputs ⇒ byte-identical plan, forever. The determinism gate keys on
@@ -225,6 +249,26 @@ night in v1; interior-mapping shader is a stretch goal).
 > broadens off-spine if the warehouse fringe is uniformly narrow). This moved `plan.posters`, so the gig
 > golden re-pinned `0x4f4a549d → 0xb1d48ea1`; synthetic `0x3fa36874` still frozen. The v3.1 default flip
 > + classic law is F's amendment to this section — see the flags table.)*
+>
+> *(**Recorded amendment — ROUND20, ledger #2:** the R16 clearance bias above **widened to every venue
+> kind**. R16 exempted `pub` because on the synthetic/marched towns a pub's `+Z` is always open; on a real
+> road graph at E's widened density it is not (newtown: a pub whose facade overhung a cross street). On the
+> synthetic town every pub/rsl candidate already clears ⇒ no-op there, gig golden `0xb1d48ea1` frozen.)*
+>
+> *(**Recorded amendment — ROUND21 ledger #1 + ROUND22 ledger #2: the venue cluster bias.** D's relocation
+> finding: a venue a kilometre from the retail cluster is a gig with no passing crowd (katoomba's pub had
+> **1** shop within 160 m; its RSL had 13). `pickVenues` now draws each venue from a **cluster field** —
+> candidates with ≥ `CLUSTER_MIN` (3) other shops within `CLUSTER_R` (160 m) — and lets the kind flavours
+> bias *within* that field rather than override it. Venues under the floor: **11 of 15 → 0** across the
+> five R21 towns; Newtown's RSL moved 2,228 m → 29 m from the hub. **Real towns only, by construction:**
+> the bias reads `plan.source === 'osm'`, which the synthetic generator never sets, so it cannot move
+> `0x3fa36874`/`0xb1d48ea1` — measured, not assumed (4 synthetic candidates per seed sit under the floor,
+> so a blanket filter *would* have moved them). **ROUND22 graded fallback:** at pack scale three towns have
+> no candidate at the floor at all (`ballarat`/`toowoomba`/`newtown_godverse` top out at 2 within 160 m).
+> R21 dropped the bias entirely there, stranding venues at 0 neighbours; it now falls back to the **densest
+> available** candidates instead. Fires only where the floor is unreachable ⇒ no already-pinned town moved.
+> **Acceptance at pack scale: 20 of 23 towns have every venue ≥ `CLUSTER_MIN`; those three sit at their
+> town's genuine ceiling** — the carved-out case, stated rather than papered over.)*
 
 > **Prime flag law.** The gig layer is a **post-hoc augmentation** applied by the selector when the gig
 > flag is on. With it off, `generatePlanFor(seed, src)` returns the byte-identical v2 base plan — **all v2
@@ -236,9 +280,30 @@ night in v1; interior-mapping shader is a stretch goal).
 > did not disappear. `gigs`, `weather`, `winmap`, `tram` now default **ON**; the default boot is the full
 > experience, deterministic to the **gig golden `0xb1d48ea1`**. Each flag keeps a `=0` opt-out, and
 > **`?classic=1`** forces all four off at once:
-> - **Classic law (the new frozen regression target):** the `?classic=1` boot is byte-identical to the v2
->   baseline **forever** — synthetic fingerprint `0x3fa36874`, zero gig layer, **zero fetch delta** (no
+> - **Classic law (the frozen regression target):** the `?classic=1` boot is byte-identical to the v2
+>   baseline — synthetic fingerprint **`0x5f76e76`**, zero gig layer, **zero fetch delta** (no
 >   `custom_bands.json`, no `sit.glb`). The old "flags-off regression" gate is now the **classic-regression** gate.
+>
+> > **THE COVENANT AMENDMENT — ROUND27, THE FACADE FIX (John's ruling; the only amendment in five epochs).**
+> > The covenant froze `0x3fa36874` "forever" from R16 to R27. That hash anchored **a wrong world**: every
+> > shopfront in every town — synthetic and real — faced *away* from its street, because CITY_SPEC:71 wrote
+> > the SIM convention into the LOTS contract (see *Units, axes*). The covenant did exactly its job for nine
+> > rounds: it held the base town byte-identical. It just held it identical to something broken, and no gate
+> > could see it — a self-consistent check over a self-contradicting spec passes under either convention.
+> >
+> > **The covenant's purpose is anti-drift, not the preservation of a defect.** So on John's ruling it is
+> > **amended once, deliberately, in the open**: the anchor moves `0x3fa36874 → 0x5f76e76`, and every other
+> > golden moves with it (gig `0xb1d48ea1 → 0xec7a2d39`, the three marched fixtures, all 23 real towns base
+> > + gig — **51 pins in one commit**, per the amendment law). The classic town is now what it always claimed
+> > to be: a street you can stand on and read the shopfronts. **From this hash forward the law reads as it
+> > always did — byte-identical forever.** An amendment requires a John-level ruling and a demonstrated
+> > world-level defect, not a convenience; this is the precedent, not an opening.
+> >
+> > *Exposed by the same fix (and fixed with it): `buildRealRoads` seated blocks at `KERB = 4 m` from the
+> > centreline while a `main` carriageway is 10 m wide — its kerb is at 5 m. Every main-street building has
+> > stood 1 m inside the road since R18. Invisible while nothing was drawn on that face; the moment the
+> > shopfront turned around, its poster landed in the traffic lane. Blocks now seat behind the kerb per the
+> > corridor law (`roadWidth/2 + FOOTPATH`). Pack drops 6.4% → 6.6%, counted.*
 > - **Default law:** the no-flag boot pins to the gig golden, and every gig / district / continuity / cover
 >   smoke **and the budget law** (interior ≤350 draws · street ≤300 / 200k tris, at the busiest venue block)
 >   now run against the **default boot with all four flags live**. `?noassets=1` composes with it and stays
@@ -268,6 +333,13 @@ plain shop" so osm towns still get venues):
 | `band_room` | `grunge` → `gig-grunge` | warehouse-district fringe | `[18,23]` | single-storey tin shed |
 | `rsl` | `covers` → `gig-covers` | **off**-spine (not main, not warehouse) | `[16,23]` | carpet-and-bistro club |
 
+**The cluster field comes first (ROUND21/22 — real towns only).** On an osm plan every kind rule in the
+table runs **inside** the retail cluster. Order per venue: cluster field (≥`CLUSTER_MIN` other shops within
+`CLUSTER_R`, or the densest available if none reach the floor) → the kind flavour → the facade-clearance
+filter → `farthestFirst` shortlist → seeded pick, each step degrading to the previous set rather than to
+the whole town. A fringe band_room *in the cluster* beats a fringe band_room a kilometre from anyone.
+Synthetic plans skip the field entirely (`plan.source` is unset) ⇒ goldens frozen. See the amendment note.
+
 Venue hours all close `23` (open through DUSK+NIGHT so the gig runs and D's surge fills the room; drains
 at close per the closing-time ruling above). Venues are the *only* gig-plan shops allowed to close ≥22
 besides the openLate video (selfcheck exempts them). `genreKey` is set from the registry kind→genre map
@@ -309,9 +381,15 @@ frontage** — seated on the **+Z street facade** (B's canon: `buildings.js` fac
 camera are all `+Z`; position `lot + (sin ry, cos ry)·(d/2+ε)`), turned to read *from* the street
 (`ry = lot.ry + π` so its printed face points `+Z` at the queue-side camera — **ROUND15 ledger #1**; before
 R15 it was on the `−Z` back and invisible from the street). So the poster never sits over a back-street's
-bitumen, **`pickVenues` prefers a band_room/rsl lot whose facade clears every carriageway by ≥ `POSTER_CLEAR`**
-(ROUND16 ledger #6 — exported from the barrel; the selfcheck asserts the same floor). Plus a seeded run along
-the spine — 2 per main edge (or, when a town has no main spine, every edge), at `t ∈ [0.2,0.8]` of the block, on **either verge**. Different venues' posters share the same pole
+bitumen, **`pickVenues` prefers a lot whose facade clears every carriageway by ≥ `POSTER_CLEAR`**
+(ROUND16 ledger #6, **widened from band_room/rsl to every venue kind in ROUND20** — exported from the
+barrel; the selfcheck asserts the same floor). Plus a seeded run along
+the spine — 2 per main edge (or, when a town has no main spine, every edge), at `t ∈ [0.2,0.8]` of the block, on **either verge**;
+a candidate that would overhang a **real** crossing carriageway is skipped (ROUND19, E's finding; the
+test is against **all edges**, not the nearest — R40 §40.2 D4, see the amendment under ROUND37 below), and the
+run is **capped at `POSTER_PER_SHOP × shops`** (ROUND20) — a sparse real town has few shops but a big edge
+graph, so the raw "2 per edge" run reads busy (katoomba 438 → 31). The cap never binds on the shop-dense
+synthetic town, so its gig golden is frozen. Different venues' posters share the same pole
 runs — that IS the district reading. `ry` follows the house convention (a poster's printed face =
 `(−sin ry, −cos ry)`, so `atan2` of the *away-from-viewer* normal); B places E's poster skin at `(x, z)`
 rotated `ry`; F wires "poster → that venue's tonight-gig".
@@ -324,10 +402,36 @@ barrel: **`roadWidth(edge)`** (full carriageway width — main 10 m, side 6–8,
 kerb sits at `roadWidth/2` from the centreline),
 **`vergeBand(edge) → [inner,outer]`** (where footpath furniture lives), **`poleOffset(edge)`** (where a
 pole/poster seats — just behind the kerb). Poles, verandah posts and **spine** posters belong in the verge
-band; the selfcheck asserts no **spine** poster stands within `roadWidth/2` of any edge centreline. A
-**frontage** poster is exempt — it is bound to its venue building (the +Z facade B draws), so at a corner
-venue whose facade abuts a crossing street it may legitimately sit near that street's kerb (B's building
-geometry, not a mid-road defect).
+band. A **frontage** poster is exempt from the band — it is bound to its venue building (the +Z facade B
+draws), so at a corner venue whose facade abuts a crossing street it may legitimately sit near that
+street's kerb (B's building geometry, not a mid-road defect); on a real town it may legitimately stand
+**past** every corridor edge, because `plan_osm.js` sets a lot back at `max(KERB, roadWidth/2 + FOOTPATH)`
+— measured worst 3.98 m (launceston_real, R37).
+
+**ROUND37 — THE KERB IS FOOTPATH (John's ruling), and the poster gate that was green over a wrong
+street.** The band between `roadWidth(e)/2` and `e.width/2` is **footpath**, and Lane B's ground paints
+it as footpath rather than as road. The selfcheck's poster-clearance check used to ask one question —
+"is the poster outside `roadWidth/2`?" — which A's own placer already guaranteed, because `poleOffset` is
+*derived from* `roadWidth`. Gate and subject were the same function agreeing with itself, so it stayed
+green for 24 rounds while all **14** gig posters on the default boot stood on painted bitumen. It is now
+**three arms**: (1) no poster on **any** carriageway, measured through `vergeBand(e)[0]` — the published
+law itself, the same call B's ground consumes, so gate and renderer cannot drift apart. **R40 amendment
+(§40.2 D4): the clearance is the MINIMUM over ALL edges, not the nearest edge's.** The nearest edge is
+not always the binding one — a kerbless `arcade` (roadWidth 0) wins the nearest-edge race and always
+"clears", camouflaging a main whose carriageway the poster stands inside. Measured on the R40 tree:
+8/108 gig plans carried a spine poster up to **1.78 m inside a non-nearest main** (northbridge_real
+seed 42, nearest edge an arcade at 1.45 m) that the nearest-edge form could not see by construction.
+The placer's `onCarriageway` skip is now all-edges too; poster **counts** are unchanged on all 108
+plans (the cap re-subsamples a smaller pool to the same size), the synthetic town is byte-identical
+(0/4 plans moved — goldens frozen), and 7 real-town **gig** goldens re-pinned; (2) every **spine**
+poster stands *inside* some edge's `vergeBand` (the bound the old check never had — "not on the road"
+also passed for a poster in a paddock); (3) **the control** — count the posters that would stand on
+bitumen under the pre-ruling ground (`?verge=0`, road quad = full `e.width`) and assert that count is
+**not zero**, pinned at exactly 14 on the default boot. Arms 1–2 prove nothing unless arm 3 shows the two
+geometries are distinguishable. Proof of falsifiability, measured: with `vergeBand` switched to the
+pre-ruling reading and the placer held byte-identical, the corrected gate goes **red 1020×** (2 arms ×
+510 plans) while the pre-R37 gate is **ALL GREEN 156,352/156,352** — structurally blind to where the
+road is painted.
 
 **Band names + the drop-in.** `bandName(seed)` generates 90s-Aussie pub-rock names from wordlists.
 `web/assets/custom_bands.json` is an **OPTIONAL** editable drop-in (schema `{ "bands": ["The Feral
@@ -362,12 +466,77 @@ it identically to the fixtures. **Hard requirements:** finite `center.{lat,lon}`
 blank name → type label, unknown `type` → `opshop`, dup ids, and **span > 5 km → "likely more than one
 town"** (a cache is ONE compact town — an over-broad bbox marches into an unusable multi-km strip).
 
+**The spacing floor (v5.0-alpha, ROUND23 ledger #5 — D's R22 finding as law).** `MIN_TOWN_SHOPS` counts
+shops; what makes a town **read alive** is *clustering*. D measured both 12-shop towns in the pack and they
+disagree — which is the finding: **darwin ALIVE** (one strip; 1,455 patronage checks → 18 visits) vs
+**toowoomba DEAD** (scattered over a 4.6 km road network; 1,417 checks → **0 visits, 0 finds** — "not a
+shopping town, a road network with occasional shops"). Both pass every other law. So `validateTownCache`
+now **warns when `medianShopSpacing(cache) > MAX_MEDIAN_SPACING_M` (150 m)**:
+- **The metric** (exported from the barrel — import it, don't re-derive it): for each shop, the distance to
+  its **nearest other shop**; take the **median**. Equirectangular metres about `center.lat`, the same
+  convention as the span check. `null` for < 2 usable shops.
+- **Warn, never error.** A flagged cache still boots a valid district — toowoomba shipped green through the
+  entire v4.0 pack. **E curates** (re-bbox onto the retail strip, or retire the town, counted either way);
+  the validator only flags. The span warn catches a town too **wide**; this catches one too **sparse**, a
+  case span cannot see (toowoomba is *inside* the 5 km law).
+- **The threshold is measured, not chosen.** Across the 23-town pack the line is **forced** into
+  `(119.3, 254.9]`: braddon at 119.3 m is alive by D's own hub test (7 shops within 160 m — the same as
+  darwin's 7), and ballarat at 254.9 m is not. 150 m sits in that gap — the pack's widest (**×2.14**) —
+  with 1.26× margin below and 1.70× above. It flags **2 of 23**: ballarat 255 m, toowoomba 396 m.
+- **⚠ CACHE space, not PLAN space — they do not agree.** This runs on raw lat/lon, before any lift; D's
+  notes quote **plan** figures (post-lift metres). The lift marches shops at a regularised cadence, so it
+  **compresses** dense towns (darwin **68.3 m cache → 27.2 m plan**) and leaves sparse ones alone
+  (toowoomba 396.1 → 386.8). Both numbers are right; they measure different spaces. Cache space is correct
+  *here* — the validator's job is to flag a bad bbox **at ingest**, before a lift exists — and it is
+  faithful exactly where the warn lives (ballarat plan/cache **1.01**, toowoomba **0.98**). Known limit:
+  one town flips (`newtown_godverse`, cache 94.4 → plan 158.3); no cache-space line can catch it without
+  false-positiving braddon. See `LANE_A_NOTES` §R23.
+
 **Wiring:** `generatePlanOSM(seed, key, { cache })` marches a cache; `registerTownCache(key, cache)` adds it
 to the registry (`osmTownKeys()` + `generatePlanFor(seed,'osm',{town:key})` then see it). `selfcheck.js`
 auto-loads `web/assets/towns/*.json` — validates, runs the structural + gig suites, pins a per-town golden.
 **Provenance:** OSM is **ODbL**; attribution ships with the data (E owns `SOURCES.md` + the `license`/
 `attribution` fields; raw Overpass responses cached so re-runs never re-fetch).
 
+### `godverseShopId` — the stock identity (v5.0-alpha, ROUND24 ledger #2; A + G)
+
+The optional shop key that resolves **`stock_godverse/<godverseShopId>/`**. **Schema stays v2** — optional
+field, absent everywhere except godverse caches, so every shipped cache stays valid *by construction*.
+
+**It is NOT `shop.id` and NOT "the census id"** — the round doc's "the POS shop id IS the id" holds for
+census shops but breaks on the shop the alpha is about. Two disjoint id spaces ride one opaque field:
+census shops use thriftgod `shop.id` (max **2992**), while **Monster Robot Party is not in thriftgod's
+census at all** and uses its **dealgod store id 3962749**. So: never derive it from `id`, never assert
+equality, never build a mapping table (the R12 gigKey law — one key, zero mapping). **G emits, all read.**
+
+**A godverse cache is MIXED, by design — RULING 2 (confirmed as law, ROUND25).** It carries a **keyed
+GODVERSE layer** (census shops + injected shops like Monster Robot) **plus an inherited OSM texture layer
+that is legitimately unkeyed**. G measured that the texture layer is load-bearing, not cosmetic:
+census-only Red Hill shipped a 306 m spacing warn and a poster inside a kerb; with the texture layer it
+passes. **So "shops without an id" is the design, and no gate may assert it away** — mine did, in R24, and
+failed 54/72 on a healthy town.
+
+**`validateTownCache` arms** (split by hazard, not tidiness): a **malformed** id (not a positive integer)
+is an **error** — it names a path segment, and `"3962749"` vs `3962749` is exactly the coercion drift that
+broke the atlas contract; a **duplicate** id is an **error** — two shops sharing one atlas *is* mis-stocking
+(charter risk #3: "never mis-stocked"); a godverse cache with an **entirely empty GODVERSE layer** (no id on
+any shop) is a **warn** — it's an osm cache wearing the wrong `source`, and it stays a warn because the
+charter's determinism boundary says *world = seeded and gated, stock = data tiers*: a town must never fail
+to load because its **stock** identity is absent. Tier 0 is the designed ladder, not a defect.
+
+**The `selfcheck` arm runs per-layer** — every assert is over the **keyed subset only**: the layer reaches
+the plan, its ids are **unique over defined ids only** (the R24 version compared a Set of *all* ids, which
+collapses every `undefined` into one entry — it failed structurally on a mixed cache *and* could hide a real
+duplicate behind that collapse), and the lift invents no identity. Plus the **orphaned-atlas gate**: a
+committed atlas under `stock_godverse/<id>/` whose shop the lift dropped means real stock keyed to a shop
+that isn't in the town — it fails, and SKIPs by name when a town has no atlas. Dropped keyed shops are
+printed, never silent (the R19/R20 drop-and-count ruling).
+
+**It survives the lift:** `plan_osm` copies it onto `plan.shops[]` (the runtime reads the plan, never the
+cache — otherwise the field is decoration and F's per-shop `base` can never resolve). Absent ⇒ the key is
+**not written**, so `JSON.stringify` is byte-identical and **every pinned golden holds until G re-emits**;
+that re-emit is the sanctioned golden move.
+
 ### Schema v2 — real roads (v4.0-alpha, ROUND18 REAL ROADS)
 
 > The gap the scout left: the marched fallback lays real shops onto **synthetic** parallel avenues.
@@ -402,6 +571,124 @@ synthetic town, so its gig golden is frozen). Golden re-pins per the amendment l
 on their real-roads output; synthetic + marched fixtures + classic/default untouched — the alpha changed
 nothing outside the cache-schema path).
 
+> **FINAL at `v4.0` (ROUND22 ledger #6, the epoch close).** This section — schema v2, the lift, the
+> connectivity rulings above, the venue cluster bias and poster cap in §v3 — is the authoritative real-map
+> contract at the tag. Changes are an amendment + a golden re-pin in the same commit, as always.
+>
+> **The alpha's five became the epoch's 23** (22 real towns + Lane G's `newtown_godverse`; **1,210 shops**),
+> and every ruling written above held at that scale with **no new hardening**: **one connected component and
+> three venues on every one of the 23 towns**, fitzroy's **160 shops** — 2× anything the pipeline had seen —
+> included. All **36 goldens** (`REAL_TOWN_GOLDENS` + `REAL_TOWN_GIG_GOLDENS`, 23 each) are pinned; selfcheck
+> runs **161,300** checks green, cross-process deterministic. Read "all five towns" above as the measurement
+> of record *when the ruling was written* — the ruling itself is now pack-wide.
+>
+> **The honest tail, carried not hidden:** 6.4% of shops (77 of 1,210) don't seat, every drop attributed by
+> cause, dominated by overflow where a town has more shops than its road graph has frontage (daylesford 19%,
+> the pack's thinnest graph; fitzroy 13%). See `V4_REAL_MAP.md` risk #6. The R20 ruling stands: **drop and
+> count beats teleport.** The frozen set is unmoved by the entire epoch: synthetic `0x3fa36874`, gig
+> `0xb1d48ea1`, marched fixtures, classic.
+
+### The address layer (v9, ROUND39 item 39.1) — DERIVED, never stored on the plan
+
+`roads[].name` has always ridden the v2 cache (**17,835 of 19,132 ways carry one — 93.2%**) and
+`plan_osm.buildRealRoads` has always dropped it: `rawWays.push({ kind, pl })` keeps the kind and the
+geometry and discards the name. **It still does, deliberately.** Street names are recovered
+*downstream* by `web/js/citygen/address.js` — a pure module (zero imports) that reads a plan plus its
+cache and returns a query object:
+
+```js
+createAddresses(plan, cache|null) → streetOf(edgeId) · localityOf(shopId) · cohort(pred) · streets() · stats()
+```
+
+**THE RULE, and it is a schema rule, not a style note: no street name, district label or address ever
+becomes a CityPlan field.** The plan is the frozen producer contract; addressing is derived data with a
+97.8% resolution rate and a 2.2% honest-`null` tail, and baking either into `plan.lots`/`plan.shops`
+would move all 46 pinned goldens to store something a consumer can compute in ≤27 ms. It is recoverable
+because plan nodes ARE snapped projected way points (`SNAP=3`), so a plan edge lies **on** its way —
+median sample-to-way distance **0.03–0.90 m** across the 23 caches.
+
+The one thing the lift now publishes is its own centring translation, `norm.shift = {shx, shz}`, which
+reaches the caller **only through the existing `opts.report` sink and never through the plan object** —
+so `JSON.stringify(plan)` is byte-identical and every golden is frozen by construction. It exists as a
+**cross-check**: `address.js` re-derives the same shift independently, and the selfcheck compares the
+two. Full contract, per-town rates and failure modes in `LANE_A_NOTES.md §39`.
+
+**Consumers must not branch on town type.** `localityOf(shopId).label` is a real street name on a cache
+town and a district phrase (*"the market end"*) on the synthetic — one field, two suppliers, one contract.
+
+## The stock ladder (v5 — THE REAL SHOP; frozen at `v5.0`, ROUND27 ledger #6)
+
+> **v4 made the towns real; v5 makes the shops real.** The map-level contract above is unchanged by this
+> epoch: **stock is DATA, not world.** The charter's determinism boundary is the load-bearing line —
+> *world = seeded, frozen, golden-gated; stock = data tiers riding the asset law.* Nothing in this section
+> may move a plan golden, and nothing in it did: the whole epoch left synthetic `0x3fa36874`, gig
+> `0xb1d48ea1`, the marched fixtures and classic untouched.
+
+**The tier ladder.** Each rung is fully playable and degrades **softly** to the one below — the fail-soft
+pattern proven since `?noassets` on day one, made structural:
+
+| tier | what | flag | deterministic? |
+|---|---|---|---|
+| **0 · parody** | seeded canvas sleeves (v1) | any boot | yes — the QA baseline |
+| **1 · static real** | per-shop atlases baked from dealgod/POS | `?stock=real`, **no server** | yes — atlases are files |
+| **2 · live GODVERSE** | thriftgod read-only endpoints; sold-means-gone | server reachable | **no — by design** |
+
+**The offline law (charter law #1) is the epoch's gate, not a footnote:** the server *enriches, never
+gates*. No boot path, gate, or tag may depend on a reachable server. Tier 2 is therefore **never inside a
+golden or a byte-identical assert**; it gets its own smoke class whose server lifecycle the gate itself
+controls, so the *assertion* is deterministic even though the *stock* isn't.
+
+**`sourcing` is not `tier`** (C's ruling, R26 — and it's the distinction that keeps the ladder honest). The
+rung and the provenance are different axes, and both ship in every atlas index:
+- **`tier: 1`** — the ladder rung. A minted atlas is *still* a static file, so it is *still* rung 1.
+- **`sourcing: "real" | "mint"`** — where the contents came from. **`real`** = a POS snapshot (Monster Robot
+  Party's actual crates). **`mint`** = a seeded `random.Random(shop_id)` sample of real dealgod listings —
+  *plausible, not that shop's stock*. Only one shop in the world has a POS; minting is how the other keyed
+  shops get distinct crates **without pretending to data we don't hold**. Current pack: **15 keyed atlases =
+  1 real + 14 mint**. No gate, doc, or human may read a mint crate as real — that is the whole point of the
+  field, and gates assert on it.
+
+**The id-space fences.** Three namespaces meet at the crate, and **every collision this epoch came from
+comparing across them**. They are fences, not decoration:
+
+| space | form | scope | fenced from |
+|---|---|---|---|
+| **plan `shop.id`** | small int, `0..N` per town | one CityPlan, local | `godverseShopId` — **numerically overlapping** |
+| **`godverseShopId`** | census id (**≤2992**) ∪ dealgod store id (e.g. **3962749**) | the stock namespace | its two halves are numerically **disjoint by construction** (G) |
+| **atlas slot id** | **`sku_<POS id>`** / **`mint_<listing id>`** | one atlas index | each other, by **prefix** |
+
+- **plan id vs `godverseShopId` — never compare a bare number across them.** They are *semantically*
+  disjoint namespaces that *numerically overlap*, which is the trap: in `redhill_godverse` today, bare
+  **`31`** is **"Wholefood Cafe"** as a plan id and **"Silky Oak Furnature"** as a godverse id. That exact
+  ambiguity made F's `enterShop(31)` enter the wrong shop and a soft-fall assertion pass **vacuously on the
+  wrong subject**. Verified still live in the data — so this is a standing rule, not a fixed bug.
+- **`sku_` vs `mint_` is a sourcing-scoped namespace fence** (C §7.2a as amended, R26 wave 4). A crate
+  wearing the other sourcing's prefix **fails**. The fence is *stronger* than the rule it replaced: the easy
+  green was deleting the prefix check; instead the prefix now proves its sourcing.
+- **Positional ids are banned** (R25): `rec_0000…` numbering collides across packs by construction, which
+  is what made the integrator's own id-equality gate vacuous. Slot ids are sku-derived and unique across
+  packs, stable across re-emits.
+
+**The manifest — `web/assets/stock_godverse/index.json`** (G emits, F consumes, E validates, C's §7.2d).
+It declares **which `godverseShopId`s carry atlases** (`types[]` + `sourcing` per entry; mint included).
+**Existence is declared, never probed.** This is the root fix for a real collision between two laws:
+fail-soft-by-404 vs the zero-console-errors law — the runtime used to probe blind and eat 404 noise,
+tolerated by attribution, which is a workaround, not a design. No manifest entry ⇒ no fetch ⇒ **zero 404s,
+no exceptions**. Consistency is gated both ways (an atlas on disk absent from the manifest **fails**, and
+vice versa — vacuous-gate law shape). Today: **15 entries, 15 dirs on disk.**
+
+**Lane A's seam to all of it** is exactly one field — **`godverseShopId`** (documented above): it rides the
+town cache, survives the lift onto `plan.shops[]`, and is what the runtime resolves `stock_godverse/<id>/`
+from. **`'godverseShopId' in shop` is the tier test**: present ⇒ tier-1+ candidate, absent ⇒ tier 0. The
+key is *absent, not undefined*, on every unkeyed shop — which is why the entire stock epoch moved **no plan
+golden**. `selfcheck` gates the seam per-layer (Ruling 2), including the **orphaned-atlas** check: a
+committed atlas whose shop the lift dropped is real stock keyed to a shop that isn't in the town.
+
+**Ruling 2 (law):** a godverse cache is **deliberately mixed** — a keyed GODVERSE layer + an inherited OSM
+texture layer that is legitimately unkeyed. G measured it load-bearing: census-only Red Hill was
+unshippable (306 m spacing warn, a poster inside a kerb). **No gate may assert it away** — mine did, and
+called two healthy towns broken.
+
 ## Shop types v1 (registry lives in `web/js/core/registry.js`, Lane A writes it, all lanes read)
 
 > **`web/js/core/registry.js` is the machine-readable source of truth** — import `SHOP_TYPES` for

docs/G3_ECONOMY_DESIGN.md

@@ -0,0 +1,328 @@
+# G3 — THE ECONOMY BACKEND (design doc)
+
+*Lane G, R23 draft. Drafted per the v5 charter ([V5_REAL_SHOP.md](V5_REAL_SHOP.md)) ledger #2.*
+
+**§7 (THE WRITE-BACK QUESTION) IS RATIFIED — John, 2026-07-17, R24 kickoff: A THEN B.** v5.0 ships
+sandboxed (a game purchase never touches real inventory); reservation is chartered as a v5.x
+upgrade behind a hold budget John sets; full write-back is not chartered. Charter law #4 is
+satisfied. **The rest of this doc remains DESIGN and still needs both Fables' sign-off; no
+server code ships before that.**
+
+Status of each section: **[MEASURED]** = verified against the real databases.
+**[DESIGN]** = proposed, not built. **[RULED]** = decided by John under charter law.
+
+---
+
+## 1. What the data actually is [MEASURED]
+
+The charter assumed one join: thriftgod's census of real shops → dealgod's real items. **That join
+does not exist.** The three datasets are three different populations:
+
+| dataset | what it really holds | inventory? |
+|---|---|---|
+| `thriftgod.shop` | 2,928 real AU secondhand shops, OSM-anchored (the census) | **no** |
+| `dealgod.stores` | 9,285 online sellers — **8,754 are Discogs accounts**, not physical shops | 1.77M listings |
+| `recordgod` | **one real trading record shop's POS** — crates, slots, prices, grading | 28,624 live |
+
+Measured consequences:
+
+- **No Newtown record shop has any stock, in any database.** Egg Records, Papa Disquo, Haze
+  Guitars, The Vintage Record, Downtown Music: 0 items each. dealgod has zero Newtown stores and
+  zero census name matches.
+- `thriftgod.item` (the minted table) holds 2,221 items across **29 shops — all Brisbane/
+  Newcastle/Alice charity shops**. Zero record shops. It is a demo seed, not a stock system.
+- This is **not** charter risk #3 ("fuzzy matching"). It is a population mismatch. Fuzzy matching
+  cannot fix it, because there is nothing on the other side of the join to match *to*.
+
+### 1a. The one shop where all three meet [MEASURED]
+
+`monsterrobot` — **147 Musgrave Road, Red Hill, Brisbane QLD** (John, R23) — is the same real shop
+in three forms, and that is the whole reason tier 1 can be honest:
+
+```
+recordgod (its POS)  ──┐
+monsterrobot.party     ├── one real shop: real crates · real slots · real prices · its OWN photos
+dealgod store 3962749 ─┘
+```
+
+- 28,624 live vinyl; **24,914 physically placed in 357 real crates** with real labels
+  ("DEEP HOUSE", "$12–$15 TECHNO") and real slot numbers — with gaps where records actually sold.
+- Covers are the shop's own product shots on the shop's own domain, cached by dealgod
+  (23,392 releases). **99.3%** of its crate stock joins to a cached cover by Discogs `release_id`.
+- It is **not in thriftgod's OSM census**, so its godverse id is its dealgod store id `3962749`
+  (real, stable, clear of the census space — thriftgod max shop id = 2992).
+
+**Shipped this round (G2a):** crate 550 "DEEP HOUSE" → 120 real records → `web/assets/
+stock_godverse/3962749/`. Byte-identical re-bake verified.
+
+---
+
+## 2. Why `mint()` cannot be the source of any tier [MEASURED]
+
+thriftgod's `mint()` is the obvious candidate for stocking shops. It disqualifies itself three ways:
+
+1. **It is not deterministic.** `FEED_RECORDS` uses `TABLESAMPLE SYSTEM (0.5)`; `mint()` uses
+   `random.random()`, `random.uniform()`, `random.shuffle()`. **`random.seed` appears nowhere in
+   `server.py`.** Re-running mint gives different stock at different prices. That is fatal to tier
+   1 (charter law #2), and it is *why* tier 1 reads the POS instead: a crate is a table of facts.
+2. **The shop assignment is fictional.** mint samples arbitrary Discogs sellers' listings and
+   assigns them to a census shop that never owned them.
+3. **Therefore it breaks two laws downstream.** The licence law's green rests on "the *stores'
+   own* product shots" — a Discogs seller's photo shown as Egg Records' stock isn't that. And the
+   write-back question (§7) is **meaningless** for minted stock: you cannot mark real inventory
+   sold for an item the shop never had.
+
+mint stays what it is: a fun demo seeder for parody tier 0. It is not an inventory system.
+*(If a future round wants seeded mint for tier 0 variety, seeding it is a small, safe change —
+`random.Random(shop_id)` + an ordered `ORDER BY id` sample instead of `TABLESAMPLE`.)*
+
+---
+
+## 3. The tier ladder, as built [MEASURED for 0–1, DESIGN for 2]
+
+| tier | source | deterministic | offline |
+|---|---|---|---|
+| 0 · parody | seeded canvas / E's parody packs | yes | yes |
+| 1 · static real | **per-shop atlas baked from the POS snapshot** (G2a, shipped) | **yes — verified** | **yes — files** |
+| 2 · live | thriftgod server over the POS (this doc) | **no, by design** | **enriches only** |
+
+**The offline law is structural, not a promise.** `stockpack.js` already returns `null` when an
+index or atlas is missing, and every caller falls back to parody canvas. Tier 2 rides the same
+seam: the server is an *enrichment* that upgrades an already-playable tier-1 room. There is no
+boot path, gate, or tag that may touch the network.
+
+---
+
+## 4. API surface [AS-BUILT — R27, `pipeline/godverse_server.py`]
+
+Read-only, per §7's ruling. **The write verbs are not "gated" — they do not exist.**
+
+```
+GET  /godverse/v1/health                          -> { ok, tier, pos_db, shops:[godverse_id] }
+GET  /godverse/v1/shop/<godverse_id>/stock?since=<etag>
+       -> { shop_id, tier, crate, items:[{id, slot, artist, title,
+                                          price, condition, sleeve_cond, state}],
+            gone:[id], counts, etag, served_at }        · 304 when ?since= matches
+GET  /godverse/v1/shop/<godverse_id>/crates       -> { shop_id, tier, crates:[{id,name,label,count}], etag }
+GET  anything else                                -> 404 (the ruling is in the body)
+POST/PUT/PATCH/DELETE anything                    -> 501 — no write handler exists in the process
+```
+
+**Three corrections this doc owes to the code (measured R27, not reasoned):**
+
+1. **`gone:[sku]` → `gone:[id]`.** As ratified, §4 said bare skus. That wording predates R25's
+   `sku_<POS sku>` ids and R26's **id-namespace fence law**, and a bare number crossing two id
+   spaces is precisely the bug that law exists to stop. `gone[]` now carries the atlas's own `id`
+   verbatim, so the client does `gone.includes(item.id)` with zero transformation. *This doc was
+   the stale rule meeting a case written after it — the epoch's signature failure, and my turn.*
+2. **`items[]` drops `release_id` and `cover`.** `cover` would edge the API toward serving
+   pixels — it never should (fence #2); `release_id` identifies the *pressing*, and tier 2 speaks
+   only in *copies* (the sku). Both were design-time noise.
+3. **Write verbs answer 501, not 404.** F asserts the number, so it matters: the class defines
+   `do_GET` and nothing else, so the stdlib refuses any other method before routing exists. **501
+   is the stronger proof** — a 404 means a handler ran and declined; 501 means there is no write
+   handler in the process. Adding `do_POST` to answer 404 would implement the forbidden thing.
+
+Design rules:
+
+- **The atlas is never served by the API.** Covers stay static files (tier 1). The server sends
+  *facts* (what's still there, what it costs), never pixels. A tier-2 shop with a dead server is
+  visually identical to tier 1 — that's the fail-soft.
+- **`gone[]` is the whole point of tier 2.** The client already holds the tier-1 crate; the server
+  says only what changed. A sold record is an `id` in `gone[]` → `collapseBuyItem()` (already
+  built, R9) zero-areas the sleeve. Sold-means-gone is a *diff*, not a re-fetch.
+
+> ### ⚠ `gone[]` HAS NO SUBJECT IN PRODUCTION TODAY — measured R27, and it shapes F's gate
+> The mechanism is built and correct. The **data has no movement**: Monster Robot Party's POS
+> records **5,567 sales ever** (400–800/month, Dec 2025 → Jun 2026) but **26 in July and none
+> since 2026-07-01**; the POS hasn't been *written* since **2026-07-09** (the 07-16 dump is fresh;
+> its data is stale). And **0 of crate 550's 120 records have ever sold**. So against the real POS
+> `gone` is `[]`, permanently, until the shop trades again.
+>
+> **Therefore, per the vacuous-gate law: F's sold-means-gone arm must not assert over the live POS
+> — it would pass without touching its subject.** Two honest routes, and G built the second:
+> 1. Assert `gone == []` against the real POS and **print the reason** — true, but it proves only
+>    that nothing sold.
+> 2. **Point the server at a labelled fixture** (`godverse_server.py make-fixture --sold 3` →
+>    `recordgod_fixture`, a `createdb -T` clone with N of the crate's own real skus marked sold).
+>    Verified: `counts {baked:120, live:117, gone:3}`, the three ids absent from `items[]`. This
+>    proves the **mechanism** — computed → sent → consumed → sleeve vanishes — deterministically,
+>    which is what a gate is for. Production still reads the real POS, untouched.
+>
+> **A fixture is not a lie; a green assert over an absent subject is.** The epoch has held four
+> tags on exactly that distinction.
+- **`etag`/`since`** so a re-enter is a 304, not a payload.
+- Shop id is the **godverse id** (§1a), never a POS internal id. **R24 naming, as landed:** the
+  town cache carries `shop.godverseShopId` (A's schema field, camelCase, read by the JS runtime);
+  the atlas index carries `shop.godverse_id` (snake_case, what E's `validate_atlas.py` requires).
+  Same id, two artifacts, two house conventions — the API uses `godverse_id` on the wire to match
+  the Python/JSON side it is served from. Recorded rather than silently reconciled: if the
+  integrators want one spelling, it is a one-line change in each emitter, not a design question.
+
+---
+
+## 5. Async enrichment + caching (risk #1) [DESIGN]
+
+**Law: the dig never blocks on the network.** Not "usually" — never. The mechanism:
+
+1. Room builds at tier 1 from static files. Playable. Riffling works. **No await.**
+2. The stock fetch is fired in parallel, never awaited by any build path, with a **hard ~400 ms
+   budget** and `AbortController`.
+3. If it lands in time: apply `gone[]` + price deltas before the player reaches the crate.
+4. If it lands late: apply on arrival (a record vanishing mid-riffle is *correct* — that's a real
+   shop). If it never lands: the room stays tier 1, silently. **Zero console noise** — a dead
+   server is an expected state, not an error.
+5. Cache the response per `(shop, crate)` in memory + `sessionStorage`, keyed by `etag`. One
+   fetch per shop per session, not per crate entry.
+6. **One flight at a time per shop**; re-entering a shop reuses the cache. No polling loop.
+
+The v1 machinery makes this cheap: the pack is a shared material + per-item UVs, so applying
+`gone[]` is a vertex collapse on an existing merged mesh — no rebuild, no re-upload, no stutter.
+
+---
+
+## 6. Identity: census ↔ lot ↔ POS (risk #3) [DESIGN, informed by §1]
+
+The R22 contract said "atlas per shop keyed by godverse shop id". §1 shows the id must come from
+whichever dataset actually *has* the shop, and mismatches must fail soft, never mis-stock:
+
+- **A shop is stocked only by explicit, recorded identity** — a `godverse_id` that resolves to a
+  real POS. There is no fuzzy name matching, ever. A shop we cannot identify with certainty gets
+  tier 0. **Mis-stocking is worse than no stock**: it puts one shop's records in another's crate,
+  which is a lie the whole epoch exists to avoid.
+- **Every unmatched census shop is counted, not guessed** (the drops law). R23's count: 2,928
+  census shops, 1 identified real POS.
+- **The census is not a stock oracle.** Being in the census means the shop exists, not that we
+  know what's in it. v5.0-beta's "every hero shop stocked" is therefore bounded by *real POS
+  access*, not by census coverage — see §9.
+
+---
+
+## 7. THE WRITE-BACK QUESTION — **RULED: A THEN B** (John, 2026-07-17, R24 kickoff)
+
+> ### THE RULING
+> **v5.0 ships on Option A (sandbox).** An in-game purchase **never** touches real
+> monsterrobot/Square inventory. Sold-means-gone is per-session, tier-1 semantics.
+> **Option B (reservation) is CHARTERED as a v5.x upgrade**, behind a hold budget John sets.
+> **Option C is not chartered** — it happens only as a deliberate business launch, if ever.
+>
+> Charter law #4 is hereby satisfied: the write-back question has an explicit, John-ratified
+> answer, and until B ships the standing state is **read-live, sell-sandboxed**.
+
+**What this makes law for v5.0 (binding on the server work, when it starts):**
+- The API's `POST /reserve` and `POST /buy` (§4) stay **unbuilt and unrouted**. Not stubbed
+  behind a flag — absent. A sandbox that can be flipped on by a config typo is not a sandbox.
+- The game's buy path terminates in the client's wallet. **No code path from a game purchase to
+  `inventory.in_stock`, `sold_date`, `hold_expires_at`, `qty`, or Square exists.** The tier-2
+  reader connects to the POS **read-only** — enforce it at the credential, not in a code review:
+  a role with `SELECT` on `inventory`/`crate`/`disc_cache` and nothing else (this also carries the
+  §9 PII fence in the same grant).
+- A gate worth its name here (the vacuous-gate law): assert the write verbs **404**, and that the
+  tier-2 role's grants are read-only. A test that "we didn't call buy()" proves nothing.
+
+**Option B's charter (v5.x — the preconditions, so it can't slide in quietly):**
+1. **The hold budget — John's number, not yet set.** Max concurrent game-held SKUs, and max hold
+   duration. Until both are set, B is not startable. *(Open item, not a blocker for v5.0.)*
+2. **The shop always wins.** If a held record sells in-store via Square, the game loses the hold,
+   silently and immediately, and the player is told the truth ("someone bought it in the shop") —
+   the one race policy that is never up for negotiation.
+3. **Staff-visible reason code** on every hold (`held: GODVERSE`), so a human at the counter can
+   see why a record is out of the crate and clear it by hand.
+4. **Soak first.** B rides plumbing that has soaked, not plumbing that tags a round — Fable's
+   framing, and the reason A ships first.
+
+*The options as framed for the ruling are preserved below, since the trade-offs are the record of
+why A-then-B was chosen.*
+
+---
+
+**The question as put:** does an in-game purchase ever touch real thriftgod/recordgod inventory?
+Live, not hypothetical: `monsterrobot` is a **real trading shop** whose POS syncs to **Square**,
+with real customers buying these exact records off the real shelf.
+
+Relevant measured facts: the POS already has `in_stock`, `sold_date`, **`hold_expires_at`**, `qty`
+and `square_item_id`. A reservation primitive therefore already exists — the question is whether
+the game is allowed to pull it.
+
+### Option A — Sandbox (read-live, sell-local)
+Game reads real stock; a purchase never leaves the game. Sold-means-gone is per-session.
+- **For:** zero real-world risk; no payment, tax, or fulfilment surface; a bug can't cost real
+  stock; ships fastest.
+- **Against:** the one-of-a-kind thrill is fiction — the real crate never changes, and two players
+  (or the same player, next boot) buy the same record. Tier 2 becomes "live prices" more than
+  "live stock".
+
+### Option B — Reservation (a real, expiring hold)
+A game purchase places a real hold on the real SKU via the existing `hold_expires_at`. The record
+genuinely leaves the real crate for N hours; unclaimed, it returns.
+- **For:** genuinely one-of-a-kind, and **reversible** — the strongest truth-per-unit-risk; uses a
+  primitive the POS already has.
+- **Against:** a game action removes real sellable stock from real in-store customers. Needs a
+  hold cap/budget, a staff-visible reason code ("held: GODVERSE"), and a race policy against
+  Square in-store sales. Someone must decide what happens when a held record sells in the shop
+  anyway (the game must lose, gracefully).
+
+### Option C — Full write-back (game sale = real sale)
+A purchase marks the real SKU sold and syncs to Square.
+- **For:** total truth — buy it in the game and it is gone from the real shop, forever.
+- **Against:** irreversible real-world inventory and revenue consequences; the game becomes a
+  sales channel (real payment, tax, postage, fulfilment, refunds, chargebacks); a bug destroys
+  real stock; a game wallet is not money. This is a business decision, not an engineering one.
+
+*(Lane G asked nothing and recommended nothing here — the options above are the record as put to
+John. **Ruled A-then-B; the binding terms are at the top of this section.**)*
+
+---
+
+## 8. Failure modes [DESIGN]
+
+| failure | behaviour | gate class |
+|---|---|---|
+| server unreachable / DNS dead | tier 1, silent, zero console noise | tier-2 smoke |
+| server dies **mid-session** | room keeps last-good state; no re-fetch storm; no stutter | tier-2 smoke |
+| server slow (> budget) | request aborted; tier 1 stands; late arrival applies or is dropped | tier-2 smoke |
+| 5xx / malformed JSON | treated as unreachable — never a partial apply | tier-2 smoke |
+| atlas missing but server up | **tier 0** — no stock without covers; never text-only sleeves | tier-1 gate |
+| `gone[]` names an unknown sku | ignored + counted, never an error | tier-2 smoke |
+| clock skew on holds | server time is authoritative; client never computes expiry | tier-2 smoke |
+
+**No tier-2 failure may fail a gate or block a tag** (charter law #1). Tier 2 gets its own smoke
+class: reachability, fail-soft, latency. Kill the server mid-session and the game must not stutter
+— that is v5.0's release gate, and it is a *client* test, not a server test.
+
+---
+
+## 9. Fences (non-negotiable, both already load-bearing)
+
+- **PII.** `recordgod` holds real `customer`, `customer_session`, `mailing_list`, `staff`,
+  `sales` — real private-individual data. The pipeline and the server read **only**
+  `inventory` / `crate` / `disc_cache`. No exceptions, no joins, no "just for debugging".
+  Charter law #3: no private-individual data, ever.
+- **Licence.** Covers are the shop's own product shots → in-house 🟢, **flagged before any
+  public/commercial release**. Real titles/artists ship at tier 1 per John's R23 amendment to the
+  no-real-trademarks law, under the same flag. Every atlas carries its provenance.
+- **Scope reality check for v5.0-beta.** "Every hero shop stocked" needs a real POS per shop. We
+  have exactly one (John's own). Stocking a *second* real shop means a second real shopkeeper's
+  data and consent — a licence and relationship question, not a pipeline question. Beta should be
+  scoped to **monsterrobot's 357 crates** (24,646 real records — the whole shop, crate rotation
+  per risk #2) rather than to more shops, unless John says otherwise.
+
+---
+
+## 10. Open items for the reviewers
+
+1. **[Fable-m3 / C]** Per-shop pack resolution is not wired: `stockpack.js` caches by `type`
+   alone (`_packs`/`_resolved`), and `interior_mode.js:192` resolves `getStockPack(shop.type)`
+   with `base` fixed at `assets/models/`. R23's single shop works via a `base` override; **two
+   stocked shops will collide in that cache.** The seam C/F need: key the cache by
+   `type + base` (or `godverse_id`), and preload per-shop on shop entry. G re-emits to whatever
+   wording C lands (LANE_C_PUB).
+2. **[Fable-m3 / E]** `redhill_real` doesn't exist — the only Brisbane cache (`westend_real`)
+   stops ~2.3 km south of Red Hill. The crate has no street until E's `build_towns.py` gets a
+   Red Hill entry (~`center: (-27.4553, 153.0064), span_km: 2.4`) and one Overpass fetch. That's
+   E's file and an outward call — **G has not touched either.**
+3. ~~**[John, R24]** §7, the write-back question.~~ **RULED 2026-07-17: A then B** (§7). Carried
+   forward: **the hold budget is John's number and is not yet set** — Option B is not startable
+   until it is, which is a v5.x item, not a v5.0 blocker.
+4. **[Both Fables]** §9's beta scoping — depth (one real shop, 357 crates) vs breadth (more
+   shops, which needs other people's data).

docs/LANES/FABLE_TO_LANE_G.md

@@ -0,0 +1,87 @@
+# Fable (m3, PROCITY integrator) → Lane G — welcome, rulings, and the G2/G3 sequence
+
+Date: 2026-07-16 · Re: `lane-G-godverse` (`223fbca`), LANE_G_GODVERSE.md, G-progress.md R1.
+
+Reviewed: the brief, the progress file, `godverse_town.py` (line-by-line), and the
+`newtown_godverse` cache shape. Verdict: **clean work, fully in-convention** — deterministic
+adapter (ordered query, no RNG), schema v2 honoured, attribution extended, registry vocabulary
+respected, and you found real bugs with our own harness. Welcome to the family, Lane G. 🤝
+
+## Merge policy (how G lands on main)
+
+Your branch touches only G-owned files — good. **Merges happen at round boundaries**: the m3 is
+mid-round-21 (the v4.0-beta close; A is re-pinning goldens right now), and dropping a new town
+cache onto main mid-round would inject an unpinned town into A's live selfcheck sweep. I'll merge
+`lane-G-godverse` right after `v4.0-beta` tags, and A pins `newtown_godverse`'s golden in R22.
+Standing rule: G commits to the branch freely; Fable-m3 merges at each boundary; anything
+touching A–F files needs a pre-ruling (as you correctly assumed).
+
+## Ruling 1 — Draco: **NO-DRACO WINS. The depot speaks uncompressed GLB.**
+
+Not house pride — load-bearing: the depot (`digalot.fyi/3god`) serves the game **at runtime**,
+and PROCITY's loader is decoder-free by design (the asset law is fail-simple: no decoder wasm, no
+loader config drift, `?noassets` must stay zero-fetch). All 39 published assets are already
+uncompressed; flipping the law means shipping DRACOLoader + wasm to every boot to save disk on a
+depot that isn't disk-bound. Your side is one re-emit: the same gltf-transform command **minus
+`--compress draco`** (`--texture-compress webp --texture-size 1024 --simplify-error 0.01` all
+stay — WebP ≤1024 is already our law). Formally: **depot law = GLB · no Draco · WebP ok ·
+tex ≤1024 · footprint/origin per the manifest conventions (Lane E's docs).**
+
+Your ⚠️ trellis-farm warning (fill_holes+decimate shreds marching-cubes meshes) is precious —
+Lane E will fold it into the pipeline docs verbatim, credited to ultra's post-mortem.
+
+## Ruling 2 — godverse density: **inherit the donor's texture layer.**
+
+An 18-hero census town is sparse by our round-20 standard, and the fix is already built: the
+donor cache carries R20's texture shops (cafes/bakeries/etc., SUBTLE-capped). G2's adapter should
+**merge census heroes WITH the donor's texture shops** — census heroes always win a collision
+(dedupe by proximity + name against the donor's hero entries; drop the donor hero, keep yours,
+count the swap). Result: real census shops on a street that also feels alive. bbox-cropping to
+the retail spine (King St) is a fine *secondary* knob, your call. A/E will advise on the dedupe
+if you want eyes — ask in G-progress and I'll route it.
+
+## Your bug reports — both accepted, both queued for R22
+
+1. **Per-town bookmarks** (synthetic coords teleport into OSM geometry) → **Lane B**, R22:
+   bookmarks resolve against the active plan (B already did this for `poseForVenue`/
+   `queue_night` — the older bookmark set gets the same treatment).
+2. **`DBG.enterShop(selector)`** (name/type/id) → **Lane F**, R22: the harness grows a selector.
+   Glad the harness earned its keep — `info/teleport/shot` being useful cross-repo is exactly
+   why it exists.
+
+Also queued: **Lane E refreshes the stale MODELBEAST note** (trellis_mac proven 15/15, the new
+:8777 queue inventory) — thank you for the correction.
+
+## The 15 hero props — accepted in principle
+
+Route: John picks keepers (in progress, per your note) → re-emit no-Draco → through Lane E's
+provenance/depot pipeline (licence zone recorded per asset — flag anything scraped vs generated)
+→ Lane C decides op-shop dressing slots. Don't push to the depot before the E provenance pass;
+that table is our licensing spine and it stays complete.
+
+## G2 (real stock) — green-lit in HALF, sequenced
+
+- **G2a — GREEN NOW (post-beta):** static per-shop atlases behind `?stock=real`, keyed by
+  godverse shop id, built by `build_stock_pack.py` from dealgod inventory. Contract review with
+  C/E at R22 kickoff — my priors: **atlas per shop** (a real shop's crate is that shop's), budget
+  = the existing pack budgets (C owns interior draw/tex ceilings), **fail-soft to parody canvas**
+  when the atlas is absent (the existing law — a godverse town under `?noassets` must stay
+  silent-and-fine).
+- **G2b — sold-means-gone: NOT YET.** Live invalidation is a server dependency in disguise —
+  it's G3 wearing a hat. It waits for the G3 design.
+
+## G3 (economy backend) — design doc first, and one non-negotiable
+
+The vision is right (thriftgod = brain and bank; PROCITY = body), and it's the biggest
+architecture change since the flip, so: **design doc → both integrators → John**, nothing before
+`v4.0` ships. The non-negotiable law going in: **the server enriches, never gates** — PROCITY
+must boot, play, and dig fully offline (static packs as the fallback tier); thriftgod presence
+upgrades stock to live/one-of-a-kind. Sketch against that and we'll find the seams.
+
+## Sync
+
+Your nudge is satisfied: m3 pushed R20 (8 commits), the R21 instructions, and this doc;
+`origin/main` is current. `v4.0-beta` tags at R21 close, then your branch merges. Watch
+G-progress conventions for the R22 kickoff — you'll get a section like every other lane.
+
+— Fable (m3)

docs/LANES/LANE_A_NOTES.md

@@ -2,6 +2,894 @@
 
 Durable answers to questions other lanes raised against Lane A. Full status in `A-progress.md`.
 
+## Round 40 (2026-08-04) — §40.2: THE v8 DEBT LEDGER, SETTLED — D1–D4 each closed or re-filed with a number
+
+The four entries filed in §37 below, three rounds carried. Every number here was re-measured on the
+R40 tree (commands in `A-progress.md §Round 40`), not quoted from the filing. Verdicts: **D4 CLOSED**
+(A-owned, fix landed) · **D1 A-side CLOSED, B-side re-filed** · **D2 re-filed (owner F)** · **D3
+re-filed (owner B)** — the re-filed three all live in files A may not edit this round; measurements and
+recommendations are below so the owning lane can land each without re-deriving anything.
+
+### D4 — CLOSED: the poster gate's inner bound is now ALL-EDGES, and the arcade can no longer camouflage a main
+
+Re-measured on today's tree before touching anything: **8/108 gig plans** carried a spine poster inside
+a *non-nearest* edge's carriageway, invisible to the nearest-edge rule **by construction** — worst
+**1.78 m inside a main on northbridge_real seed 42**, where the nearest edge is an `arcade` at 1.45 m
+whose `roadWidth` is 0 (kerb 0 ⇒ it always wins the nearest race and always passes). Bendigo, fitzroy
+×2, geelong ×3 seeds, glebe also affected; depths 0.08–1.51 m; every violating far edge was a `main`.
+
+**Landed, both halves:**
+- `gigs.js onCarriageway(x,z)` — spine-candidate skip is now inside-ANY-edge, not inside-nearest-edge.
+- `selfcheck.js` poster arm 1 — clearance is now the **minimum over all edges** of
+  `d(e) − vergeBand(e)[0]`, frontage floor unchanged (`POSTER_CLEAR − 0.02`), spine floor unchanged (0).
+  Frontage posters pass the all-edges floor **238/238 measured** — no exemption needed, because
+  `pickVenues.facadeClear` was *already* all-edges; the gate now asks the placer's own question.
+
+**The numbers after the fix:** violations **8/108 → 0/108** · poster **counts unchanged on all 108
+plans** (old placer vs new, compared pairwise — the R20 cap re-subsamples a smaller candidate pool to
+the same size) · **synthetic byte-identical, 0/4 plans moved** ⇒ fingerprint `0x5f76e76`, `GIG_GOLDEN
+0xec7a2d39`, all base town goldens, all 3 osm fixtures **frozen** · **7 real-town GIG goldens re-pinned**
+(adelaide `0x1a00e20f` · bendigo `0x9f82e059` · fitzroy `0x60b8bba0` · fremantle `0x8d7bcb63` · geelong
+`0x1f866ae7` · marrickville `0xac4c34d0` · northbridge `0x4ea89275` — old hashes in the table's comments;
+the §37 filing predicted 11 of 26 on the R37 tree, today's tree re-pins 7 of 24: two towns retired and
+plan drift since, which is exactly why the brief said measure, don't quote). Selfcheck **ALL GREEN
+157,647/157,647**. CITY_SPEC amended in the same change (poster-law §ROUND37 block + spine-run note).
+
+### D1 — A-side CLOSED (the rename supplied) · B-side RE-FILED, owner B, number attached
+
+**A's side, landed:** `chunkIndexByCoverage` is the canonical export (`plan.js`, barrel, selfcheck call
+sites all renamed; header states which question it answers). `chunkIndex` **remains exported as a compat
+alias** — `map.html:89,320` imports it and map.html is not A's file to edit this round. Alias verified
+live: `chunkIndex === chunkIndexByCoverage` and map.html's import path resolves. CITY_SPEC §chunk-key +
+producer API updated to the two-question wording.
+
+**The number that keeps this honest:** the divergence is not stylistic — on the default synthetic town
+(seed 20261990, 681 lots) a naive swap of B's streamer onto A's form would build **258/681 lots in ≥2
+chunks** (A coverage-buckets; B centre-buckets, 0/681 multi-chunk). Container (`Object`-in-wrapper vs
+`Map`) and element type (ids vs objects) divergences re-confirmed live on today's tree too.
+
+**RE-FILED for B (cannot close from A):** `world/planutil.js:4` still says *"If Lane A later ships an
+official chunkIndex(plan) we swap the import; the shapes match"* — **the shapes do not match on any of
+three axes, and the swap would multi-build 258/681 lots.** B should delete the false comment, and may
+rename its own to `chunkIndexByCentre` if it wants the symmetry (A's alias means no rush). Why it can
+wait: both consumers are correct *today* — the trap only fires on the invited future swap, and the
+comment is now contradicted by A's shipped canonical name + CITY_SPEC. Half a line of work.
+
+### D2 — RE-FILED, owner F, still latent — the number is 0/1838 and the day it stops being 0 is the deadline
+
+Re-measured today: A's canonical `isOpen` (`plan.js:28`, no-hours ⇒ open) still has **zero importers**
+(grep over `web/` + `tools/`: only the barrel re-export). The live predicate is still
+`index.html:541` — `shop && shop.hours && …` ⇒ **falsy for a hours-less shop, the exact inversion of
+A's law** — published as `window.PROCITY.isOpen` and consumed by `world/audio.js:516` + **19 call sites
+across 5 tools files** (`flags_check.py` 13, `v2_tour.py` 2, `interior_scale_check.py` 2, `shots.py` 1,
+`qa/r39_runtime.py` 1). `citizens/sim.js:363 _openAt` is still the third implementation (A's semantics,
+its own clock), `world/dbg.js:241,279,286` still carry the ad-hoc inline hour predicates.
+
+**Why it can wait, measured:** **0 of 1,838 corpus shops** (27 gig plans: synthetic + 3 fixtures + 23
+towns at the golden seed) lack `hours` — the divergence cannot fire on any shippable plan today, and
+the selfcheck asserts sane hours per shop, so a hours-less shop cannot arrive silently. **Why it must
+not ride another epoch:** v9+ keeps adding lot kinds (carts, stalls, civic) and the first one that
+ships hours-less flips every consumer of the shell's predicate to "permanently closed". **The fix is
+still ~5 lines, all in F's files:** `index.html` imports A's `isOpen` from the barrel and passes
+`currentHour()`; sim keeps its clock, same predicate. A's export needs no change.
+
+### D3 — RE-FILED, owner B — the bite re-measured: 81 venue lots wear op-shop signage today
+
+Re-measured today: `world/fixture_plan.js SHOP_REGISTRY` still has **9 types** — `pub`, `band_room`,
+`rsl` still missing (A's `core/registry.js SHOP_TYPES`: 12, each with full `sign:{bg,fg,accent,style}`).
+The bite is now `buildings.js:465` (was :344 — line drifted, defect identical):
+`SHOP_REGISTRY[shop.type] || SHOP_REGISTRY.opshop` ⇒ every venue falls to op-shop signage
+(`#2c2820`/`#f0e2c0`) instead of the registry's gilt/stencil/club palettes. **Corpus-wide at the golden
+seed that is 81 venue lots across 27 towns**, ~3/town, on the town's most photographed buildings — the
+gig venues. The stale header (`fixture_plan.js:26-27`, "registry.js hasn't landed yet") is now **25
+rounds** old; registry.js landed R13.
+
+**Why it can wait one more round (and no more):** cosmetic-only — no gate red, no plan field wrong, no
+golden guarding sign colours. **Why B should do it in R41:** the fix is two imports and a header
+(`buildings.js` reads `SHOP_TYPES[type].sign.bg/.fg`; `SHOP_REGISTRY` shrinks to the honest
+fallback-only table), and F should expect **a screenshot golden may move — never a plan golden**. A
+supplies nothing further; the registry has carried the three venue sign palettes since R13.
+
+## Round 39 (2026-08-03) — v9 item 39.1: THE ADDRESS LAYER — the contract, published
+
+**`web/js/citygen/address.js` is landed, green, and yours to consume.** Pure module: **zero imports**,
+no THREE, no fetch, no DOM, no module state, no plan mutation. It derives from a plan and never writes
+to one, so **it cannot move a golden** — and it didn't (numbers at the bottom).
+
+### THE CONTRACT — copy this, it is the whole API
+
+```js
+import { createAddresses, getTownCache } from './js/citygen/index.js';
+
+const cache = citygen.getTownCache(TOWN);      // NEW export — see "how to get the cache" below
+const addr  = citygen.createAddresses(plan, cache /* or null */);
+
+addr.streetOf(edgeId)    // → "Templeton Street" | null      — a real street name, or null. NEVER a guess.
+addr.localityOf(shopId)  // → { shopId, street, district, block, side, label } | null (null = unknown id)
+addr.cohort(predicate)   // → shopId[]   predicate(locality) → bool; ids ascending, deduped
+addr.streets()           // → [{ name, edges:[edgeId], shops:[shopId] }] sorted by name
+addr.stats()             // → the measurement (see below) — assert on this, don't trust a claim
+```
+
+`localityOf` fields:
+
+| field | type | on a real town | on the synthetic |
+|---|---|---|---|
+| `street` | `string \| null` | `"Barker Street"` (97.8% of corpus shops) | **always `null`** — there are no named ways |
+| `district` | `string` | always `'mainstreet'` (`plan_osm.js:305` adds exactly one) | one of the six `DISTRICT_KINDS` |
+| `block` | `int` | `lot.block` | `lot.block` |
+| `side` | `'north'\|'south'\|'east'\|'west'` | the cardinal the lot sits on off its `frontEdge` | same |
+| `label` | `string \| null` | the street name, or `null` if unresolved | `"the market end"`, `"the arcade"`, `"the north end of the backstreets"` |
+
+### THE ONE RULE: **NEVER BRANCH ON TOWN TYPE**
+
+`label` is the field you print. It is filled by a **different supplier** on each kind of town — real
+streets from the cache's named ways, district phrases from `district.kind` + block — and that is the
+entire point of the module. Do not test `plan.source`, do not test for a cache, do not special-case
+the synthetic. **Print `label`. Group by `block`. Ask for `street` only when you specifically need a
+proper name and can honestly render `null`.** The moment one consumer branches, every feature built on
+this has to be written twice and the synthetic half rots.
+
+`label` is `null` in exactly one situation: a real-town shop whose frontage resolves to no named way
+(**27 of 1,219 corpus shops, 2.2%**). Handle null once, on both town types, and you are done.
+
+### How to get the cache (this was genuinely unreachable before this round)
+
+`web/index.html:129` hands the fetched JSON to `registerTownCache(TOWN, …)` and **drops its own
+reference**, so the `roads[]` — and their 17,835 names — were unreachable to everything downstream.
+New additive read-only export, no new state, no shell change needed:
+
+```js
+citygen.getTownCache(key)   // → the registered cache, or undefined
+```
+
+`undefined` for an unknown key and for the three checked-in `osm_fixture.js` towns (melbourne /
+katoomba / silverton are fixtures, not caches — they carry no `roads[]`). **`createAddresses(plan,
+undefined)` is legal** and degrades to district labels rather than throwing — which is exactly the
+failure a consumer would never notice, so:
+
+> **Assert `addr.stats().supplier === 'ways'` wherever you require real street names.** Selfcheck does
+> this for all 23 caches. A caller that forgets the cache gets `supplier: 'district'` and zero street
+> names — visible in `stats()`, never a silent wrong name.
+
+### → LANE B (39.2, the fog): what you can consume today
+
+- **Map street labels.** `addr.streets()` gives you `{ name, edges[], shops[] }` — the `edges` are plan
+  edge ids you already draw, so you can place a label along an edge run without a second lookup.
+  **Bring your own dedup**: a real town has **65–319 distinct street names** (median 192; adelaide 313,
+  bendigo 319) over 30,986 edges. Labelling every edge is 322 `fillText` calls a frame, which is the
+  CPU pass your own note already flags — key the offscreen static cache off the discovered set.
+- **HUD tooltip.** `addr.localityOf(shop.id).label` is the template literal. It is a plain string or
+  null; there is no formatting to do and no town-type test to write.
+- **`side` is a real clue term and it discriminates**: the two sides of any street always map to two
+  opposite cardinals, so `"the north side of Barker Street"` is a stable, speakable cell.
+- **Cost**: `createAddresses` is **≤27 ms per real town** (worst bendigo, 2,593 edges × 1,408 named
+  ways), **0.3 ms on the synthetic**, once, at plan time. Zero draws, zero triangles, zero plan fields.
+
+### → LANE C (39.3): the shop you are digging in now has an address
+
+`localityOf(shop.id)` works for any shop id on the plan, interiors included — it reads `lot.frontEdge`,
+which every shop already has. If the op-shop bin's find needs to be written down (`"a $2 crate, Barker
+Street"`), that string exists now and it costs nothing. **Do not import `address.js` into an interior
+hot path** — build it once alongside the plan and pass the result in.
+
+### The measurements, so nobody has to take my word for it
+
+Fable's binding facts re-derived independently, and **all three land exactly**: **19,132 road ways,
+17,835 named (93.2%)**; median plan-edge-sample → nearest named way **0.03–0.90 m** (worst katoomba);
+**1,192 / 1,219 corpus shops (97.8%) resolve to a street name.**
+
+| | edges named | shops with a street | distinct names | | | edges named | shops | names |
+|---|---|---|---|---|---|---|---|---|
+| adelaide | 89.9% | **80.9%** (89/110) | 313 | | marrickville | 97.5% | 100% (26/26) | 236 |
+| bendigo | 98.9% | 100% (35/35) | 319 | | newcastle | 98.7% | 100% (34/34) | 158 |
+| bowral | 95.4% | 100% (30/30) | 71 | | newtown_godverse | 93.1% | 100% (67/67) | 306 |
+| braddon | 97.1% | 100% (19/19) | 142 | | newtown | 93.1% | 100% (67/67) | 306 |
+| brunswick | 98.8% | 100% (92/92) | 273 | | northbridge | 96.7% | 98.3% (57/58) | 166 |
+| castlemaine | 98.0% | 100% (22/22) | 141 | | redhill_godverse | 99.1% | 100% (35/35) | 291 |
+| darwin | 93.1% | 100% (12/12) | 90 | | redhill | 99.1% | 100% (34/34) | 291 |
+| daylesford | 97.7% | 100% (26/26) | 65 | | westend | 92.4% | 100% (41/41) | 159 |
+| fitzroy | 92.8% | 99.3% (138/139) | 185 | | fremantle | 97.5% | 100% (79/79) | 134 |
+| geelong | 98.4% | 98.4% (61/62) | 226 | | glebe | 97.8% | 100% (51/51) | 225 |
+| hobart | 98.9% | 100% (78/78) | 215 | | katoomba | 99.0% | 100% (72/72) | 165 |
+| launceston | 96.0% | 90.0% (27/30) | 192 | | **CORPUS** | **96.4%** | **97.8%** (1192/1219) | — |
+
+**The failure modes, named.** All 27 unresolved shops front an edge whose way genuinely has no name in
+OSM: **adelaide 21 `arcade`** (adelaide's arcades are the town's retail spine and OSM leaves the
+footways unnamed — this is why it is the corpus worst at 80.9% and it is honestly worst, not a bug),
+fitzroy 1 `arcade`, geelong 1 `arcade`, launceston 1 `arcade` + 2 `lane`, northbridge 1 `arcade`.
+**`null` is the honest answer there** and the module returns it rather than borrowing a neighbour's
+name. A shop with `street: null` also gets `label: null`; selfcheck asserts that pairing per town.
+
+### Two things I did NOT do the way the synthesis proposed, both with numbers
+
+**1. The shift is recovered EXACTLY, not voted for.** `plan_osm.js:502-506` centres the town on the
+origin, so plan node = `r2(projected way point) + shift`. The synthesis recovers that by centroid-align
++ nearest-waypoint vote. **I implemented that first and it returns the WRONG shift on 5 of the 23
+towns** — braddon, fremantle, hobart, northbridge, westend. The cull of shopless islands
+(`plan_osm.js:407-414`) drags the plan's centroid off the cache's, the initial alignment is tens of
+metres out, and the vote then converges *confidently* on a wrong offset. **A wrong shift is not a
+degraded answer — it renames every street in the town.** So: take one plan node, treat every
+(node − way point) difference as a candidate, and keep only candidates under which further nodes also
+land exactly on way points. Two or three nodes collapse ~25,000 candidates to one. **Exact on 23/23,
+nothing to tune, and it returns `null` rather than a guess when it cannot prove an answer.**
+
+**2. The resolver samples five points along an edge, not the midpoint.** "Nearest named way to the
+edge midpoint" cannot tell a street from the street that *crosses* it — at an intersection both are
+~0 m away and it picks one by a hair. A name must now be within tolerance at **all five** samples
+(t ∈ 0.15…0.85, endpoints excluded because they *are* the junctions). A crossing street is close at
+one sample and far at the rest.
+
+### The tolerance is 8 m — and here is the number that actually sets it
+
+Corpus shops that get a street name: **2 m → 85.2% · 4 m → 94.8% · 6 m → 97.4% · 8 m → 97.8% ·
+12 m → 99.1% · 16 m → 99.2%**. But coverage is the wrong quantity to tune on. Checked against an
+independent **way-membership** resolver (below), the number of the 884 shop-bearing edges that resolve
+to the *same name* is **857 at 6 m — and 857 at 8, 12, 16 and 24 m.**
+
+> **Correctness saturates at 6 m.** Every metre past 6 buys exactly one thing: a name attached to a way
+> OSM left unnamed (0 such edges at 6 m, 4 at 8 m, 12 at 12 m, 14 at 24 m). **It can never buy a
+> correction.** Raising this knob to chase coverage is always borrowing a neighbour's name and should
+> be argued as that, never as accuracy.
+
+8 m keeps the four borrowings, all arcade footways inside a named mall (bowral's *Corbett Plaza* ×2,
+fremantle's *High Street* ×2), where the borrowed name is what a person would actually say.
+`createAddresses(plan, cache, { tolerance: 6 })` is the strictly-conservative setting at identical
+correctness.
+
+### A WRONG STREET NAME IS WORSE THAN NO STREET NAME — so it is gated by an independent resolver
+
+`address.js` asks "which named way is this edge ON?" by **distance**. The selfcheck's control asks the
+same question by **point membership**: a plan edge is built from two points of ONE simplified way
+(`plan_osm.js:388-394`) and plan nodes are those points snapped on a 3 m lattice, so the true way must
+*contain* both endpoints' snap keys. Two genuinely different questions over the same data — the R27
+cross-convention pattern, not a restatement.
+
+> **Over the 884 shop-bearing edges — the only edges `localityOf` reads — 857 agree and ZERO disagree.**
+> Corpus-wide, 4 of 30,986 named edges disagree, all four are 2D-stacked ways where the question has no
+> single answer (geelong's two adjacent malls; a motorway crossing *over* a street on glebe and redhill
+> ×2), and **none of the four carries a shop.** That count is PINNED at 4, not asserted `> 0` — a
+> control allowed to drift toward zero is how a gate goes vacuous, which is the R37 lesson.
+
+**And the resolver degrades to null, not to a wrong name.** Measured: feed it a shift wrong by 30 m and
+castlemaine/katoomba/adelaide return **0** street names rather than a town full of wrong ones — the
+five-sample rule simply finds nothing within tolerance. Feed it a shift wrong by 3 m and adelaide's
+coverage *rises* from 89 to 98 shops while being wrong, which is the whole reason the shift arm is
+exact-or-nothing and **coverage is never used as a proxy for correctness.**
+
+### The synthetic supplier, and its honest limit
+
+12 label cells over 493 shops, **median 41, max 147** ("the south end of the main street"). That is
+coarse, and it is the same structural fact §8 of the charter already records — the synthetic is a
+magnificent strip and not a town you can learn. **`block` is the finer cell: 32 shop-bearing blocks,
+median 14, max 41.** Consumers that need precision should `cohort(l => l.block === n)`; consumers that
+need prose should print `label`. Both work on both town types, which is the point.
+
+### GOLDENS: NOTHING MOVED. ZERO RE-PINS.
+
+`address.js` never writes to a plan, and selfcheck asserts that byte-for-byte per town
+(`JSON.stringify(plan)` before and after the call). Every pinned hash in `selfcheck.js` is untouched:
+synthetic `0x5f76e76`, gig `0xec7a2d39`, the 3 osm fixtures, all 23 `REAL_TOWN_GOLDENS`, all 23
+`REAL_TOWN_GIG_GOLDENS`. **Selfcheck 157,407 → 157,647 (+240 checks), ALL GREEN, fingerprint unchanged.**
+
+### The one-line upgrade: TAKEN, and it is genuinely that clean
+
+`plan_osm.js` now writes `norm.shift = { shx, shz }` — onto the **normalization log**, which reaches
+the caller only through the existing `opts.report` sink at the next line. **Never onto the plan
+object.** `JSON.stringify(plan)` is byte-identical by construction; the 46 pinned goldens above are the
+proof, not the argument.
+
+**But it is not a dependency, and it should not become one.** `createAddresses(plan, cache)` recovers
+the shift itself, exactly, on 23/23. The report line earns its keep as a **cross-check**: the selfcheck
+compares `plan_osm`'s published shift against `address.js`'s independently recovered one, two
+derivations that share no code, and fires on a **0.01 m** disagreement. Without that line, the recovery
+would only ever be checkable against itself — which is precisely the vacuous-gate species R37 was
+about. `opts.shift` is accepted as a fast path and `stats().shiftCheck` reports `'agree'` / `'DISAGREE'`.
+
+## Round 37 (2026-08-03) — v8 WAVE 0 §0.1: THE KERB, and the gate that was green over a wrong street
+
+### → Lane B (URGENT, you are consuming these RIGHT NOW): the corridor law, stated plainly
+
+**The exports are correct and you should consume them as-is. I changed no semantics this round.**
+`roadWidth` / `vergeBand` / `poleOffset` in `web/js/core/registry.js:217-240`, re-exported from the
+barrel `citygen/index.js:18`. But **four things about them will bite you**, and three of them are things
+the round instructions state in a way that is true only for the synthetic town:
+
+**1. `roadWidth` is a TRAP OF A NAME, and it is why this bug existed.** It returns a **full width**, and
+`edge.width` is *also* a full width — but `edge.width` is the **corridor** (road + both footpaths) and
+`roadWidth(e)` is the **carriageway alone**. Two full widths, similar names, nine metres apart on a main.
+Your `ground.js` painted the road quad `e.width` wide for 34 rounds because of exactly this. The kerb is
+at **`roadWidth(e)/2`**, i.e. `vergeBand(e)[0]`. Prefer `vergeBand(e)[0]` over `roadWidth(e)/2` in new
+code — same number by construction, but it reads as what it is and it survives a change to the split.
+
+**2. `lane`'s verge band is NOT `[2,2]`.** The round instructions say it is; that is the **synthetic**
+lane (width 4). Measured over 31,039 edges across synthetic + all 26 town caches: **58 lane edges, 2 at
+`[2,2]` (synthetic, width 4) and 56 at `[4,4]` (real, width 8).** The invariant is not a literal — it is
+**`outer === inner` ⇒ the edge has no footpath at all** (a lane is all carriageway by law). **Branch on
+`outer <= inner`, never on the number 2**, or you emit a zero-width strip on the synthetic town and a
+wrong-width one on every real town.
+
+**3. `arcade` is `roadWidth 0` ⇒ band `[0, width/2]` — the WHOLE corridor is footpath.** 1,102 arcade
+edges in the corpus (1 synthetic at width 5, 1,101 real at width 6). Skip the road quad *and* both kerb
+strips: at `roadWidth 0` your two kerbs are coincident on the centreline and will z-fight.
+
+**4. The inward extension is never negative — measured, not assumed.** `roadWidth(e) > e.width` would
+make your inward footpath strip negative-width. **0 occurrences in 31,039 edges.** It is nonetheless
+*reachable*: `side` returns a flat 6 for any width < 18, so a `side` edge narrower than 6 m would invert.
+No such edge exists in any shipped cache. Guard it anyway (`Math.max(0, …)`) — it costs a call.
+
+**The whole contract, exhaustively — the entire corpus reduces to nine (kind, width) pairs:**
+
+| kind | `edge.width` | `roadWidth` | `vergeBand` | footpath each side | `poleOffset` | count | where |
+|---|---|---|---|---|---|---|---|
+| `arcade` | 5 | 0 | `[0, 2.5]` | 2.5 | 1 | 1 | synthetic |
+| `arcade` | 6 | 0 | `[0, 3]` | 3 | 1 | 1,101 | real |
+| `lane` | 4 | 4 | `[2, 2]` | **0** | 2 | 2 | synthetic |
+| `lane` | 8 | 8 | `[4, 4]` | **0** | 4 | 56 | real |
+| `main` | **24** | 10 | `[5, 12]` | **7** | 6 | 7,446 | **real** |
+| `main` | 28 | 10 | `[5, 14]` | 9 | 6 | 6 | synthetic |
+| `side` | 12 | 6 | `[3, 6]` | 3 | 4 | **22,415** | both |
+| `side` | 14 | 6 | `[3, 7]` | 4 | 4 | 8 | synthetic |
+| `side` | 20 | 8 | `[4, 10]` | 6 | 5 | 4 | synthetic |
+
+**Two corrections to the charter's numbers, both measured.** The charter and the audit both describe
+"the 9 m band" and "18 m of every main street stops being painted as road". **That is the synthetic town
+only** — its main is 28 m wide. **On every real town a main is 24 m**, so the band is **7 m** and 14 m of
+each main stops being road. And the dominant edge in the whole corpus is not a main at all: **`side` at
+width 12 is 22,415 of 31,039 edges (72%)**, with a **3 m** footpath. Size your tri estimate off that, not
+off the 9 m headline. (The +0 draws claim is yours to prove; I have no visibility into your merge.)
+
+**On `?verge=0`:** keep it reverting to *exactly* the pre-ruling geometry — road quad at the full
+`e.width`, kerb at `e.width/2 + 0.12`, footpaths outside the corridor. My selfcheck now pins the count of
+posters standing on that geometry at **exactly 14** on the default boot, and Lane F's control leg asserts
+the same failure at runtime. If `?verge=0` drifts into something that is not the pre-ruling street, three
+gates in two lanes stop meaning what they say.
+
+### → Fable / Lane F: the vacuous gate was mine, and it is now falsifiable — with the proof
+
+**The audit's claim against my lane is CONFIRMED, exactly, and I can add a number it did not have.**
+Default boot (synthetic, golden seed 20261990, gigs default-ON since R16): **14 posters. All 14 stand
+inside `e.width/2` — the bitumen B paints. Zero stand inside the ruled kerb `roadWidth/2`.** The audit's
+"all 14 gig posters are standing in the road" is precise, not rhetorical.
+
+*One honest refinement it did not make:* the 14 are not one population. **12 are spine posters seated at
+`poleOffset` = 6 m, i.e. 8 m inside painted bitumen — genuinely mid-road.** The other **2 are frontage
+posters clipping the corridor edge by 0.06 m** (13.94 m of 14, and 6.94 m of 7) — they sit on their
+venue's facade plane, and `FACADE_PROUD = 0.06` pushes them a fingernail past it. Both classes are inside
+the paint and the fix lands both, but "14 posters standing in the middle of the road" would be an
+over-claim: **12 are, 2 are 6 cm over the kerb line.**
+
+**Why the gate was green.** My placer seats spine posters via `poleOffset(e)`, which is *derived from*
+`roadWidth`. My selfcheck asserted clearance against `roadWidth(e)/2`. **The gate and its subject were
+the same function agreeing with itself** — the R27 cross-convention lesson recurring inside the very file
+that documents it (`selfcheck.js:33-40` already says a self-consistent check over a self-contradicting
+spec passes under either convention). It could not see B's geometry because it never read a number that
+came from B.
+
+**The correction (`selfcheck.js`, districtInvariants), three arms — arm 3 is the control:**
+1. **No poster on a carriageway** — now measured through `vergeBand(e)[0]`, the published law itself, the
+   same call B's ground consumes. Floors unchanged (frontage ≥ `POSTER_CLEAR`−0.02, spine ≥ 0; a `lane`
+   pole seats exactly *on* its kerb, so 0 must stay legal).
+2. **Every SPINE poster stands INSIDE some edge's `vergeBand`** — the bound the old check never had.
+   "Not on the road" also passed for a poster standing in a paddock; this asserts it stands on paint B
+   actually lays. Frontage posters exempt **by measurement, not convenience**: on 18 of 108 gig plans a
+   frontage poster legitimately stands past every corridor edge (worst **3.98 m**, launceston_real),
+   because `plan_osm.js:459` sets a real-town lot back at `max(KERB, roadWidth/2 + FOOTPATH)`. Spine
+   violations over the same corpus: **0/108**.
+3. **THE CONTROL** — count the posters that would stand on bitumen under the **pre-ruling** ground (B's
+   road quad at full `e.width`; the `?verge=0` geometry, replicated in `preRulingRoadPosters()` and
+   pinned to the **flag**, not to a line number that will drift as B edits). Assert it is **> 0** on every
+   gig plan, and **exactly 14** on the default boot. Arms 1–2 prove nothing unless the two geometries are
+   distinguishable; this is what makes them non-vacuous, and pinning 14 rather than `> 0` alone is
+   deliberate — *a control allowed to drift toward zero is how a gate goes vacuous in the first place.*
+   Measured range across 510 plans: **min 3, max 212, never 0.**
+
+**THE FALSIFIABILITY PROOF — the new gate fails on the old street, the old gate cannot.** Simulated
+`?verge=0` honestly: switched `vergeBand` to the pre-ruling reading (`[width/2, width/2]` — whole
+corridor is carriageway) in a scratch copy of the tree, and **pinned `poleOffset` to the true band so the
+placer is byte-identical** — `?verge=0` is a *render* flag, the paint changes and A's plan does not.
+Fingerprint `0x5f76e76` and every gig golden stayed green in both runs, so the only variable is what the
+gate reads. Result:
+
+| gate | under the ruled geometry | under `?verge=0` geometry |
+|---|---|---|
+| **corrected (R37)** | ALL GREEN 157,407/157,407 | **✗ FAIL — 1020 failures** (2 arms × 510 plans) |
+| **pre-R37 (HEAD)** | ALL GREEN 156,352/156,352 | **✓ ALL GREEN 156,352/156,352** |
+
+The old gate is not merely wrong about the street — it is **structurally blind to it**. No change to
+where the road is painted can make it fail. That is the vacuous-gate species in one table.
+
+**GOLDEN VERDICT: NOTHING MOVED. Zero re-pins.** Fingerprint `0x5f76e76`, `GIG_GOLDEN 0xec7a2d39`, all
+25 base town goldens and all 24 `REAL_TOWN_GIG_GOLDENS` green and untouched. Correct, and predicted: the
+only generator-adjacent file I touched is the *selfcheck*, which validates output and never produces it.
+Check count **156,352 → 157,407** (+1,055 new assertions), runtime 10.3 s.
+
+### → Fable: v8 DEBT LEDGER — filed, not fixed (four entries, three of them the audit's)
+
+**D1 — `chunkIndex`: two implementations, THREE divergences, and a header comment that is false.**
+A's `citygen/plan.js:414` `chunkIndex(plan, chunkSize = CHUNK)` vs B's `world/planutil.js:37`
+`chunkIndex(plan)`. The audit named one divergence; there are three:
+(a) **bucketing** — A puts a lot in every chunk its rotated-AABB touches, B puts it in the chunk
+containing its centre only; (b) **container** — A returns a plain object keyed `"cx,cz"`, B returns a
+`Map`; (c) **element type** — A's buckets hold **ids** (`lots:[lot.id]`), B's hold **objects**
+(`lots:[lot]`). `planutil.js:4` says *"If Lane A later ships an official chunkIndex(plan) we swap the
+import; the shapes match."* — **the shapes do not match, on any of the three axes**, and that sentence is
+the trap: it invites exactly the one-line swap that would break the streamer three ways at once.
+Consumers are split today: **the runtime streamer uses B's** (`chunks.js:7,16`), **the debug map uses
+A's** (`map.html:89,315`), and `sim.js:48-55` re-derives the key math a *third* time, locally, on purpose
+(so the standalone sim page needs no Lane B module) — that third copy is defensible and documented.
+*Canonical:* **B's for the runtime** (centre-bucketing is what a streamer wants — an AABB-spanning lot
+would build in up to four chunks). A's AABB form is right for *coverage* questions, which is what my own
+selfcheck asks of it (`selfcheck.js:130-155`). **Cost:** rename, not reconcile — give them distinct names
+(`chunkIndexByCentre` / `chunkIndexByCoverage`), delete the false comment, and state which question each
+answers. Half a round. **Owner: B** (the file and the runtime consumer are B's); A supplies the rename.
+
+**D2 — `isOpen`: three real implementations plus an ad-hoc fourth site, and A's canonical one has ZERO
+importers.** Canonical: `citygen/plan.js:28`, half-open `open ≤ hour < close`, **no hours ⇒ open**,
+re-exported at `citygen/index.js:10`. **Nobody imports it** — grep-verified across `world/`, `citizens/`,
+`interiors/`. The live one is `web/index.html:454`, published to `window.PROCITY.isOpen` (`:603`) and
+consumed by `world/audio.js:270` and **14 call sites across `tools/`** (`flags_check.py`, `shots.py`,
+`v2_tour.py`, `qa/interior_scale_check.py`). **It has a real semantic divergence:**
+`shop && shop.hours && …` returns **falsy for a shop with no hours**, where A's law says *no hours ⇒
+always open*. Third: `citizens/sim.js:363` `_openAt(hours)` — A's semantics, but its own clock
+(`(this.timeOfDay % 1) * 24`) instead of `currentHour()`. Fourth site, ad-hoc rather than a rewrite:
+`world/dbg.js:241,279,286` inline hour predicates (`hours[1] >= 22`, `hours[0] <= 12 && hours[1] > 13`)
+for screenshot bookmarks. **No shipped shop lacks `hours`** (my selfcheck asserts every shop has sane
+hours), so the divergence is **latent, not live** — it fires the day a venue, cart, stall or civic lot
+carries no hours, which v8's whole slate is about adding. **Cost:** the shell imports A's `isOpen` and
+passes `currentHour()`; sim keeps its clock but calls the same predicate; ~5 lines, 1 line of risk.
+**Owner: F** (the shell is F's; A's export is already correct and needs no change).
+
+**D3 — two shop registries, and the venue signs are the visible bite.** A's `core/registry.js:32`
+`SHOP_TYPES` = 12 types with `sign:{bg,fg,accent,style}`; B's `world/fixture_plan.js:28` `SHOP_REGISTRY`
+= **9 types**, missing `pub` / `band_room` / `rsl` entirely, with only `signBg`/`signFg`. Its own header
+(`:26-27`) says *"Lane A owns web/js/core/registry.js; it hasn't landed yet, so Lane B carries the slice
+it needs"* — **registry.js landed in R13; that comment has been stale for 24 rounds.** The bite is one
+line: `buildings.js:344` `const reg = SHOP_REGISTRY[shop.type] || SHOP_REGISTRY.opshop;` — so every gig
+venue renders **op-shop** signage (`#2c2820` on `#f0e2c0`) instead of the registry's gilt / stencil / club
+palettes, on 2–4 venues per town across 27 towns, since R13. Confirmed as the audit reported it.
+*Also drifted, but harmless:* the facade pools differ on four types (`toy` 3→2, `book` 3→2, `pawn` 4→3,
+`stall` 2→1) — **dead config on the live path**, because `buildings.js:405` takes the skin from
+`shop.facadeSkin` (A's plan field); B's pool is only reachable on the `fixture_plan` fallback when citygen
+is absent (`index.html:138`). **Cost:** `buildings.js` imports A's `SHOP_TYPES` and reads
+`.sign.bg`/`.sign.fg`; `SHOP_REGISTRY` shrinks to the fallback-only table it actually is, with an honest
+header. Sign atlas colours change on venue lots ⇒ **a screenshot golden may move; not a plan golden.**
+Half a round. **Owner: B**, with F re-pinning any shot.
+
+**D4 — NEW, found this round, and it is the same disease one layer down: the poster gate's inner bound
+is NEAREST-EDGE, and an `arcade` edge camouflages a carriageway.** Both my selfcheck's arm 1 and my
+placer's `gigs.js:304 onCarriageway()` resolve the *nearest* edge and test against that one edge's kerb.
+The nearest edge is not always the binding one. Measured over 108 gig plans: the nearest-edge rule reports
+**0 violations**; an **all-edges** rule finds **8 plans** (all real towns) where a spine poster stands
+inside a *non-nearest* edge's carriageway — **worst 1.78 m inside a main on northbridge_real seed 42**,
+where the nearest edge is an `arcade` at 3.22 m whose `roadWidth` is **0**, so it "clears" by 1.45 m and
+hides a main whose kerb is 5 m away. `arcade` edges are actively camouflaging: kerb 0 means they win the
+nearest-edge test and always pass it. **Zero occurrences on synthetic, including the default boot** — the
+kerb ruling is unaffected. **Cost, measured decision-grade, not estimated:** I built the all-edges variant
+and diffed the whole corpus — **synthetic 0/4 plans move** (so `0x5f76e76`, `GIG_GOLDEN` and the classic
+covenant are untouched), **11 of 26 town gig goldens re-pin**, and **poster counts do not change at all**
+(the R20 cap re-subsamples a smaller candidate pool to the same size). So: one placer edit, one gate edit,
+11 hash re-pins, no budget change, no visual count change. **Deliberately NOT done this round**: it moves
+plan output for a reason that is *not* the kerb ruling, in a shared tree, while F is gating the matrix —
+exactly the scope creep a floor round forbids, and it would muddy the "did the kerb ruling move a golden?"
+signal, which must stay a clean **no**. **Owner: A. Recommend R38, one small item, self-contained.**
+
+## Round 30 (2026-07-18) — THE ROTATION BOUNDARY VERIFY (ledger #6): **HOLDS**
+
+### → Fable / F: `day` rides RUNTIME streams only — plan generation cannot see it. Measured, not read.
+
+**Verdict: the seeded-rotation boundary HOLDS.** F's `day` salt (207bcff) touches exactly three runtime
+seams and nothing upstream: (1) `interiors.js:178` `ctx.stockSalt` from `opts.stockDay`, consumed ONLY in
+`layout.js:417` as a suffix on the `stk-*` stock-pick stream labels (room/fittings/audio streams untouched
+— `stockSalt` has exactly those two references in the tree); (2) the dig `binSeed` key `@d` tag in
+`interior_mode.js` (same null-gating: no game / day 1 / real-sourced ⇒ absent); (3) `gig_state.setWeekNight`,
+which only **selects** a night from `plan.gigs` — the whole 7-night week is generated at plan time
+(`gigs.js:227` `for night < NIGHTS`) from citySeed streams; day picks, never feeds.
+
+**How measured (three falsifiable legs):**
+1. **Grep-zero over the proven glob:** `citygen/**` = exactly 8 files, no subdirs, 2,546 lines (census
+   printed, ls-verified). `grep -riE 'day|stockDay|stockSalt'` → zero identifier hits (only lexical noise:
+   fixture name "Heydays", shop name "Sunday Stall", "today" in comments, `daylesford_real` golden keys).
+   Non-vacuous: the same pattern hits `stockDay` 4× in `world/interior_mode.js`.
+2. **Structural absence at the entry:** `generatePlanFor(seed, source, opts)` consumes `opts.{town, gigs,
+   customBands, cache, report}` only (grepped every `opts.` in citygen); both shell call sites
+   (`index.html:127`, `map.html:315`) pass `{town, gigs, customBands}` — no day exists to pass.
+3. **Day-inertness, byte-measured:** hostilely injected `{day, stockDay}` into `generatePlanFor` anyway —
+   plan JSON hash identical for day-absent / day 1 / day 37 across 3 seeds × both sources (6/6 legs,
+   e.g. synthetic 20261990 `0xec7a2d39` all three ways). Even a rogue caller can't leak day into a plan.
+
+**Goldens frozen:** selfcheck **ALL GREEN 156,352/156,352**, fingerprint `0x5f76e76` (the covenant),
+gig golden `0xec7a2d39`, all town pins (melbourne/katoomba/silverton + real caches) green, no re-pins.
+Pre-existing informational ⚠ (redhill "Empire Revival" lift-drop) unchanged, not mine, not new.
+
+## Round 27 wave 5 (2026-07-17) — THE FACADE FIX: it was every town, not just the real ones
+
+### → F: **your files hold the old covenant hashes — they are now wrong, and only you can fix them**
+This is the one thing blocking your re-gate. `scaffold_check` is **RED** until you re-pin, and I can't
+touch your files. Exact values (verified byte-identical across two fresh processes):
+
+| your file | constant | old | **new** |
+|---|---|---|---|
+| `tools/flags_check.py:30` | `GOLDEN_HASH` | `0x3fa36874` | **`0x5f76e76`** |
+| `tools/flags_check.py:31` | `GIG_GOLDEN` | `0xb1d48ea1` | **`0xec7a2d39`** |
+| `tools/qa/scaffold_check.mjs:231` | `TOWN_GOLDENS.melbourne` | `0x34cfdec0` | **`0x9c7e76b3`** |
+| `tools/qa/scaffold_check.mjs:231` | `TOWN_GOLDENS.katoomba` | `0x0f652510` | **`0xf3aafec8`** |
+| `tools/qa/scaffold_check.mjs:225` | the comment quoting all three | — | same three |
+| `tools/qa/tour_v5.py:42`, `tour_shots.py:10` | captions quoting `0x3fa36874` | — | **`0x5f76e76`** |
+
+Also: `flags_check.py:148` greps stdout for the literal `'3fa36874'` — that will silently stop matching.
+
+### The finding: the ruling's premise was wrong — **synthetic was broken too**
+The wave-5 ruling says *"synthetic follows B's canon so every golden has been green over a wrong product
+since R18"*. Half right, and the wrong half is load-bearing. **Synthetic does not follow B's canon** — it
+is broken identically, and so is the marched path, and so are the three checked-in fixtures. It is not
+"every real town since R18": it is **every town, every path, since v1**. Measured in B's canon before
+touching anything, then confirmed with my own eyes in the browser:
+
+| path | before | after |
+|---|---|---|
+| synthetic (`plan.js`) — **the classic covenant** | **0 toward / 681 away** | 681 / 0 |
+| marched-osm + the 3 fixtures | 0 / 80, 0 / 95, 0 / 19, 0 / 12 | all toward |
+| real-roads (B's finding) | 0 / 72 katoomba | **72 / 72** — matches B exactly |
+
+**The screenshot is the proof:** standing on the synthetic main street at `?classic=1`, lot 0 — three blank
+grey boxes. Walk *behind* them, into the block, and there is NUMBAT PLAYTHINGS: sign, door, windows, awning,
+facing the dirt. Same camera after the fix: CROWN TOYS & GAMES · MARBLES & KITES · NUMBAT PLAYTHINGS, a
+strip of shopfronts facing the road. **637 of 681 synthetic lots had their facade pointing at no street at
+all.**
+
+**Why it survived**: all four sites are the same one-sign error — `atan2(outward)` where the intent was
+`atan2(−outward)` — and *every one of them says so in its own comment* (`plan.js:122` "facade faces back
+down the outward normal, to the street"). The code never did what its comment said, and CITY_SPEC:71 blessed
+the result. Nobody was wrong; the spec was.
+
+### The covenant moved — John ruled it
+Fixing synthetic necessarily moves `0x3fa36874`, frozen "forever" since R16. That was not mine to decide.
+**John's ruling: amend the covenant, fix all paths** — the covenant is anti-drift machinery, not a defect
+preservative. **51 goldens re-pinned in one commit** (classic `0x3fa36874 → 0x5f76e76`, gig
+`0xb1d48ea1 → 0xec7a2d39`, 3 fixtures, 23 towns × base+gig). The amendment is recorded in CITY_SPEC as a
+one-time, ruling-gated precedent — from this hash forward the law reads as it always did.
+
+### A second bug the fix exposed (fixed here, counted)
+`buildRealRoads` seated blocks at `KERB = 4 m` **from the centreline** — but a `main` carriageway is 10 m
+wide, so its kerb is at 5 m. **Every main-street building has stood 1 m inside the road since R18.** The
+footprint never moved; only which face is the front — so it was invisible until the shopfront turned around
+and its poster landed in the traffic lane (−1.07 m). Blocks now seat behind the kerb per A's own corridor
+law (`roadWidth/2 + FOOTPATH`). Pack drops **6.4% → 6.6%**, counted, not hidden.
+
+### The cross-convention gate — built to F's lesson, not to a spec line
+F proved that measuring lots against CITY_SPEC:71's own convention is **self-agreement**: 72/72 "facing" over
+a town of blank walls. So the new gate does not restate a spec line. It **replicates Lane B's own placement
+maths** from `buildings.js` (`toWorld(lot, 0, y, d/2 + 0.02)`) and asks a physical question neither spec line
+can fudge: *does the quad the renderer actually draws land nearer the street than the lot centre?* It fires
+if A's `ry` sign drifts **or** if B's `zf` sign drifts. It would have caught this on day one of v1.
+
+## Round 27 (2026-07-17) — v5.0: the docs freeze — CITY_SPEC v5 + the risk list judged (ledger #6)
+
+### → F + Fable: **A's docs half is done and the tree is green; nothing of mine gates your tag**
+selfcheck **ALL GREEN 156,212/156,212**, classic `0x3fa36874` / gig `0xb1d48ea1` frozen, **no golden moved**
+(none should — tier 2 touches no plan, no cache, no atlas bytes). CITY_SPEC has its **v5 section** (the tier
+ladder · `sourcing` vs `tier` · the three id-space fences · the manifest · Ruling 2 · A's one seam), and the
+charter risk list is judged line by line in `V5_REAL_SHOP.md`.
+
+### The risk list: I did NOT pre-retire your gate
+Written in wave 2, so **risk #1 (latency/stutter at tier 2) is CARRIED, not retired** — your reader and
+kill-the-server gate don't exist yet, and **nothing retires that line except the gate going green**. Retiring
+it from a doc while the code is unwritten would be the exact species this epoch spent four holds catching: a
+rule meeting a case that doesn't exist yet. #2 retired (measured), #3 retired (designed out), #4 **split** —
+write-back retired by John's ruling-as-mechanism, the `gone` read carried to your #4. Two new carried lines
+(#6 orphaned atlas, #7 "real" is one shop wide).
+
+### The gate that armed itself — worth seeing, since it's the law working unattended
+My R25 orphaned-atlas gate **SKIPped** on `newtown_godverse` all through R25 ("no committed atlas keys to
+this town" — subject absent, so it said so instead of passing). The moment G's 14 mint atlases landed, it
+**started binding on its own** and passed: selfcheck went 156,211 → **156,212**, and that +1 is the gate
+arming itself. Nobody edited it. That's what the vacuous-gate law buys — a gate that waits, in the open, for
+its subject.
+
+**Live near-miss on the books → G:** `redhill_godverse`'s lift drops keyed shop **2286 "Empire Revival"**;
+you stocked its numeric neighbour **2287**. Nothing is orphaned and the gate is green — but **stocking 2286
+would orphan it today**, and the hazard grows with every shop stocked. Carried as risk #6.
+
+### One correction to the round doc's framing, for the record
+The brief lists "the manifest" and "sourcing" as if `tier` were superseded. The artifacts say otherwise, and
+**C's ruling is the precise one**: every atlas index carries **both** — `tier: 1` (the ladder rung; a mint
+atlas is *still* a static file, so still rung 1) **and** `sourcing: "real"|"mint"` (where the contents came
+from). They are different axes. The spec documents both, because collapsing them is exactly how a mint crate
+would come to read as real.
+
+## Round 25 (2026-07-17) — v5.0-alpha: the sweep reconciled with Ruling 2, six goldens pinned (ledger #1)
+
+### → F: **the tree is green — all 8 reds are gone, nothing of mine is pending** (the handshake)
+selfcheck **ALL GREEN 156,211/156,211**; scaffold + consistency green; classic `0x3fa36874` and gig
+`0xb1d48ea1` frozen. The six goldens are pinned: `newtown_godverse` base `0xcf69b387` / gig `0x1e266f60`,
+`redhill_real` base `0x6046700f` / gig `0x673785ee`, `redhill_godverse` base `0xb2224939` / gig
+`0xc6f80e18`. Cross-checked two ways before pinning — **byte-identical across two fresh processes**, and
+the three values G stated independently in `86e2985` match mine exactly. **Your third attempt is unblocked
+from my side.**
+
+Two lines still print and **both are deliberate, neither is pending**:
+- `⊘ SKIP real/newtown_godverse: orphaned-atlas check` — correct: the only committed atlas (3962749) keys
+  to Red Hill, so newtown has no subject. The vacuous-gate law says say so rather than pass quietly.
+- `⚠ real/redhill_godverse: 1 keyed shop(s) dropped by the lift — 2286 "Empire Revival"` — an honest
+  disclosure, not a defect (see below).
+
+### My R24 gate asserted Ruling 2 away — that's the whole of my 6 reds, and it was my error
+I built the identity gate on an assumption that was true when I wrote it and false the moment G shipped:
+that a godverse cache is *all* census shops. Ruling 2 makes it **mixed** — a keyed GODVERSE layer plus an
+inherited texture layer — so `newtown_godverse` (18 keyed + 54 texture) and `redhill_godverse` (10 + 27)
+are **healthy towns my gate called broken**. Every keyed assert now runs **per-layer, over the keyed subset
+only**; unkeyed texture shops raise nothing. The validator's "N/M missing" warn is gone with it — the only
+honest requirement left at that layer is that a `godverse+osm` cache have a **non-empty** godverse layer at
+all (else it's an osm cache wearing the wrong `source`), which stays a warn for the R24 charter reasons.
+
+### The uniqueness check was broken in both directions — rebuilt so it can actually fail
+The R24 version was `new Set(all ids).size === shops.length`. Every `undefined` collapses into **one** Set
+entry, so it (a) failed structurally on any mixed cache — 54 texture shops became one entry — and (b) could
+**hide a real duplicate behind that same collapse**. It now runs over **defined ids only**. And per the
+vacuous-gate law I made it prove it bites: `validateTownCache` rejects duplicates at the front door, so a
+dup can never reach the plan that way — the test feeds one **straight to the lift** (`generatePlanOSM` does
+not validate) and asserts the predicate catches it, plus a healthy mixed cache passes the same predicate.
+A check nobody can watch fail is not a check.
+
+### New — the orphaned-atlas gate (my R24 finding, now enforced instead of just filed)
+The lift legitimately drops shops (overlap-resolve, counted since R19). Dropping a shop that **has a
+committed atlas** means real stock keyed to a shop that isn't in the town — exactly the failure I filed in
+R24, and one F's #7b would only catch at the *end* of a round, in a browser. It's now a node gate: for each
+godverse town, every `stock_godverse/<id>/` on disk whose id belongs to that cache **must be seated**, else
+FAIL. Subject-aware — SKIPs by name when a town has no atlas.
+
+**It already found something real, benign today:** redhill's lift drops keyed shop **2286 "Empire Revival"**
+(10 keyed in cache → 9 seated). It has no atlas, so nothing is orphaned and the gate passes. **→ G: if you
+stock Empire Revival at the beta, it will orphan** — the shop isn't on the plan. Monster Robot Party is
+safely seated (lot 8), which is the one that matters this round.
+
+## Round 24 (2026-07-17) — v5.0-alpha: the identity field (ledger #2)
+
+### → G: **`godverseShopId` is live — emit it, and mind the id-space trap** (the handshake for your #5)
+The field is published and the lift carries it: put `godverseShopId` on shop entries in a
+`source: "godverse+osm"` cache and it lands on `plan.shops[]`, which is what F's per-shop `base` reads.
+Contract in `web/assets/towns/README.md`; `validateTownCache` enforces it; selfcheck gates it.
+
+**The round doc says "the POS shop id IS the id — no mapping table". That's true for census shops and
+false for the shop this whole alpha is about** — and your own docstring is what told me:
+
+| shop | id source | equals `shop.id`? |
+|---|---|---|
+| census shops (`newtown_godverse`) | thriftgod `shop.id` (max 2992) | yes, incidentally |
+| **Monster Robot Party** | **dealgod store 3962749** — not in thriftgod's census | **no** |
+
+So I built it as an **opaque key**, not a census id: no equality assert, no derivation from `id`, no mapping
+table. Both spaces ride it, and your disjointness (2992 vs 3962749) is what makes that safe. **Uniqueness is
+an error**, because two shops keyed to one atlas is mis-stocking (charter risk #3).
+
+**⚠ The thing that will bite you in wave 2 — `redhill_godverse` cannot contain Monster Robot from either
+source. Measured, not inferred.** `godverse_town.py` takes **roads from the OSM donor** and **shops from
+thriftgod's census**. The shop is in neither:
+- **Not in the census** — your own R23 finding (that's *why* its id is a dealgod store id).
+- **Not in E's `redhill_real` donor** — I checked the cache the moment it landed: **36 shops, zero of type
+  `record`, nothing matching /monster|robot/**. OSM's Red Hill doesn't know the shop exists.
+
+So the adapter as written produces a Red Hill of census charity shops, and the atlas at
+`stock_godverse/3962749/` keys to a shop that **isn't in the town** — F's #7b id-equality assertion would
+fail, correctly, at the end of the round. **Inject it explicitly**: name, `type: "record"`, its real lat/lon
+(147 Musgrave Rd), `godverseShopId: 3962749`. The schema is ready for it — that's exactly the case the
+opaque-key design exists to serve.
+
+**Second, cheaper trap on the same path:** `redhill_godverse` still has to clear **`MIN_TOWN_SHOPS` (6)**
+from the census bbox alone. Newtown yielded 18; Red Hill is a Brisbane suburb and thriftgod's census is
+thin there. If the bbox returns < 6, the cache is **rejected outright** (hard error, not a warn) and the
+town won't exist. I can't measure that from here — no census DB on m3 — but you'll see it instantly. If it
+bites, the count includes any shop you inject.
+
+**E's donor is otherwise good for you:** valid, no warnings, **73.3 m median spacing** — half the warn floor,
+a proper high street to hang the shop on.
+
+### → F: the seam you need for #6a
+`plan.shops[].godverseShopId` is the per-shop `base` key — read it off the **plan**, not the cache. It's
+absent (not `undefined`) on every non-godverse shop, so `'godverseShopId' in shop` is a clean tier test:
+present ⇒ tier 1 candidate, absent ⇒ tier 0 parody. That absence is also why **no golden moved this round**.
+
+### → Fable: one recorded departure from the ledger, and why
+Ledger #2 says `validateTownCache` **requires** the field on godverse shops. I implemented **missing → warn**
+(malformed and duplicate → hard errors). Three reasons, and it's yours to overrule:
+1. **The charter's determinism boundary** — *world = seeded, frozen, gated; stock = data tiers*. An error
+   inverts it: the **town** would fail to load because its **stock** identity is absent. Tier 0 must boot.
+2. **Charter risk #3 names the remedy** — identity gaps "fail-soft to tier 0, never mis-stocked". Missing
+   *is* the soft case; duplicate is the hard one. They're different failures and now get different arms.
+3. **Sequencing** — `newtown_godverse` carries 0 ids today, it's G's to re-emit in wave 2, and I can't do
+   it here (their namespace; no census DB on m3). A hard error would red the tree for C and E through all
+   of wave 1 to say what the warn already says.
+The requirement still has teeth, in the place R23 taught us to put them: selfcheck **fails on partial
+keying** and prints an explicit **SKIP with the count** at zero — it cannot pass vacuously.
+
+### Also: E's toowoomba retirement showed my spacing metric is gameable (worth knowing)
+E tried the re-bbox before retiring and found it **fixed my metric while making the town worse** — median NN
+395.7 → 89.4 m ("passes") but hub density 3/12 → 2/12, the pack's worst. My warn is **necessary, not
+sufficient**: it catches scatter, and it can be satisfied by tightening the box around a scatter. D's hub
+test is the complement, and E used both. Retired pins removed from both golden maps (a golden for a deleted
+town can never fire — the vacuous-gate law one layer down). **Ballarat (255 m) is still flagged and still
+E's call this round; if it moves, I pin it.**
+
+## Round 23 (2026-07-16) — v5.0-alpha: the spacing warn (D's thin-tail finding as law)
+
+### → E: **the warn is live — and it flags TWO towns, not one** (the handshake for your #4)
+`validateTownCache` now warns when **`medianShopSpacing(cache) > 150 m`**. Import the metric from the
+barrel (`medianShopSpacing`, `MAX_MEDIAN_SPACING_M`) rather than re-deriving it — and if you re-implement
+in Python, the definition is: *per shop, distance to the nearest OTHER shop; take the median*, in
+equirectangular metres about `center.lat`. Warn, never error: **you curate, I only flag.**
+
+**Use the warn as your acceptance test.** Re-bbox toowoomba, re-run the validator; when the warn goes
+silent, the town has a high street. That's the whole loop, no judgement call needed.
+
+| town | median spacing | verdict |
+|---|---|---|
+| `toowoomba_real` | **396 m** | your ledger #4 — D proved it dead (1,417 patronage checks → 0 visits) |
+| `ballarat_real` | **255 m** | **nobody has looked at this one.** Same class, 1.7× inside the line |
+| braddon (worst passing) | 119 m | alive by D's hub test — 7 shops within 160 m, same as darwin |
+
+**Ballarat is the finding beyond the brief.** The round doc names only toowoomba, because D only spot-checked
+the two 12-shop towns. Measuring all 23 says ballarat is the same shape — and it's one of the three towns my
+R22 graded cluster fallback fired on (no venue candidate at the ≥3-shops/160 m floor), so two independent
+signals agree. Your call whether it re-bboxes or ships as a known thin-tail; counted either way. **If your
+fix moves toowoomba's (or ballarat's) cache, ping me — the goldens are mine to re-pin, and only what you move.**
+
+### ⚠ The number in my validator will NOT match the number in D's notes — both are right
+D's notes say darwin **27 m**; my validator says darwin **68.3 m**. Neither is wrong: **D measured PLAN
+space** (post-lift metres), **the validator measures CACHE space** (raw lat/lon, before any lift exists —
+it has to, that's the layer it runs at). The lift marches shops at a regularised cadence, so it *compresses*
+dense towns and leaves sparse ones alone:
+
+| town | cache | plan | plan/cache | |
+|---|---|---|---|---|
+| darwin | 68.3 | 27.2 | **0.40** | dense ⇒ the lift compresses hard |
+| toowoomba | 396.1 | 386.8 | **0.98** | sparse ⇒ the lift barely moves it |
+| ballarat | 254.9 | 257.7 | **1.01** | sparse ⇒ ditto |
+
+That asymmetry is *why cache space is safe here*: the error is concentrated at the dense end, and the warn
+only ever fires at the sparse end, where the two spaces agree to within 2%. I verified all 23 towns in both
+spaces — **exactly one disagrees.**
+
+### → G + Fable: `newtown_godverse` is the one town that flips (filed, not acted on)
+Godverse is the single cache where the two spaces straddle the line: **94.4 m cache (passes) → 158.3 m plan
+(would warn)**. My warn does **not** flag it, and I think that's correct on both counts: (a) no cache-space
+threshold can catch it without also flagging braddon, which D's own test says is alive; (b) godverse is a
+**census subset** — 18 thriftgod shops over the same Newtown footprint that carries 72 OSM shops — so its
+sparsity is *coverage*, not a bad bbox, and re-bboxing (the warn's whole remedy) cannot fix it.
+
+**But it's thin by two independent signals** — plan-space 158 m, and it's the third town my R22 cluster
+fallback fired on. Since R23 stocks a real record shop *in this town*, and the beta asks "fitzroy_godverse
+if the census is dense there", that's worth knowing now rather than at beta. Not my call — filing it.
+
+## Round 22 (2026-07-16) — v4.0: the pack absorbed, 36 goldens pinned (the epoch close)
+
+### → C + D + F: **the pack is in — 23 towns, all pinned, start your verifies** (the handshake)
+E's 17 new towns + Lane G's `newtown_godverse` fed through the lift. **All 36 waiting goldens pinned in
+this one commit** (`REAL_TOWN_GOLDENS` + `REAL_TOWN_GIG_GOLDENS` now hold **23 towns each**, zero unpinned).
+selfcheck **ALL GREEN 161,300/161,300**; scaffold + consistency GREEN; cross-process deterministic (pack-xor
+`0xca140954`). classic `0x3fa36874` / gig `0xb1d48ea1` / marched fixtures **frozen**.
+
+### The pack absorbed — everything built this epoch held at 23-town scale, first try
+| | |
+|---|---|
+| towns | **23** (22 real + `newtown_godverse`) |
+| shops | 1,210 → **1,133 seated** (77 dropped, **6.4%**, all counted by cause) |
+| graph | **1 connected component on every town** (junction protection + cull/bridge) |
+| district | **3 venues on every town** (cluster bias + facade clearance) |
+
+**fitzroy (160 shops — 2× anything absorbed before)**: 139 seated, 1 component, 3 venues, 212 posters, all
+invariants green. The junction pipeline, fragmentation ruling, cluster bias, poster cap and capacity fence
+all ran at mecca scale with **no new hardening needed** — the pack needed absorbing, not fixing.
+
+### One refinement this round: a graded cluster fallback for genuinely thin towns
+At pack scale three towns have **no candidate at the floor at all** — `ballarat`, `toowoomba`,
+`newtown_godverse` top out at **2** shops within 160 m. R21's bias switched off entirely there, stranding
+venues at 0. It now falls back to the **densest available**, so the venue still lands on what little crowd
+the town has: ballarat **0,2,0 → 2,2,2**, godverse **0,1,1 → 2,2,2**, toowoomba **1,0,0 → 1,2,1**.
+It only fires where the floor is unreachable ⇒ **no already-pinned town moved** (verified).
+
+**Acceptance (R21's, at 23-town scale): 20 of 23 towns have every venue ≥3 shops/160 m.** The three above
+sit at their town's genuine ceiling — the "no better candidate exists" case the acceptance carved out.
+**Saying so explicitly, as asked.**
+
+### Drop outliers (counted, not hidden)
+`daylesford` **19%** (6/32, all overflow — 32 shops on a 171-road graph, the thinnest graph in the pack) and
+`fitzroy` **13%** (21/160, 17 overflow). Both are the R20 capacity fence doing its job: `RGAP` is already
+0.5 m and `NODE_CLEAR` 3 m, so the only lever left is spilling overflow onto a *different* street — which
+buys a few percent by putting a shop on a road it isn't on. Same call as R20: **drop and count beats
+teleport**. Everything ≤6.4% pack-wide.
+
+### → B / F (the tri diet, ledger #1): my side of the diagnosis
+My poster cap scales off **shop count**, so it auto-tracked the widening rather than fighting it (fitzroy
+160 shops → 212 posters; katoomba 80 → 111). If B's layer-by-layer names **plan geometry** (lot or poster
+counts) as the `venue_night` driver, I own the fix and will take it. My read from the plan side: the growth
+is *more shops ⇒ more night building geometry at the venue block* — E's density landing as B's render cost —
+so I'd expect the driver to be buildings/LOD rather than posters. B's numbers decide it, not my expectation.
+
+**CLOSED — B's diagnosis landed (`0c4dad5`): the fix is not A's.** The driver is E's four furniture GLBs at
+**149,161 of 163,015 tris (91.5%)** ⇒ **asset tris ⇒ Lane E owns it** by the ledger's own rule. Plan geometry
+is nowhere near the bill: **posters 222 tris** (B: the cap "already worked and was never the lever"),
+**buildings 348** (the R3 atlas/instancing holding), venue pools 0. **A is clear on ledger #1 — F, don't wait
+on me for the re-measure.** Worth recording that B's numbers corrected my expectation too: I guessed
+buildings/LOD, and B measured it at 0.2%. B also found the real coupling — **shop count doesn't drive this,
+ROAD density does** (the bench/bin/shelter cadence runs on a 966-edge graph), which means my absorb of E's
+widening was never the cause either. The brief is a hypothesis; the measurement wins — mine included.
+
+## Round 21 (2026-07-16) — the venue cluster bias (D's relocation finding) + goldens re-pinned
+
+### → C + D: **cluster bias landed, goldens re-pinned — start your verifies** (the handshake)
+**Only the GIG goldens moved** (venue selection is gig-layer; the base town goldens are untouched):
+katoomba `0xbf586b77`, newtown `0xacdb3eee`, fremantle `0xcf3426fc`, bendigo `0x646b2c23`,
+castlemaine `0xf9713a69`. Base unchanged (katoomba `0x420f677d`, …). selfcheck **ALL GREEN 66419/66419**;
+classic `0x3fa36874` / gig `0xb1d48ea1` / marched fixtures **frozen**.
+
+### → D: your relocation finding is resolved — and it was systemic
+You found katoomba's pub at 1 shop within 160 m. Measuring all five, **11 of 15 venues** sat under the
+threshold (newtown's were 0/0/1 — every venue stranded). After the bias, **0 of 15**:
+
+| town | before (shops within 160 m) | after |
+|---|---|---|
+| katoomba | pub **1**, rsl 10, band_room 7 | band_room 10, rsl 12, **pub 9** |
+| newtown | band_room 0, pub 0, rsl 1 | band_room 7, rsl 11, pub 5 |
+| fremantle | pub 1, rsl 2, band_room 2 | band_room 8, pub 3, rsl 3 |
+| bendigo | pub 1, rsl 0, band_room 0 | rsl 10, band_room 10, pub 5 |
+| castlemaine | band_room 6, rsl 4, pub 1 | pub 5, band_room 6, rsl 4 |
+
+Castlemaine cleared without needing the floor exception Fable flagged. Your venue-win % and the "gig with
+no passing crowd" observation should both improve — the pub is now in the retail heart on every town.
+
+### How it works (and why synthetic is frozen BY CONSTRUCTION, not by luck)
+`pickVenues` builds a **cluster-adjacent field** first (candidates with ≥ `CLUSTER_MIN` 3 shops within
+`CLUSTER_R` 160 m), then the kind flavors (pub corner / band_room fringe / rsl off-spine) bias **within**
+that field rather than overriding it — a fringe band_room in the cluster beats a fringe band_room a
+kilometre from anyone. A town with no cluster falls back to the whole pool.
+**Gated on `plan.source === 'osm'`** — real-data towns only. Fable's brief assumed a blanket filter would
+be a no-op because "the synthetic town is one dense cluster anyway". **It isn't:** I measured **4 synthetic
+candidates per seed** sitting under the threshold (min cluster 0–1), so a blanket filter *would* have moved
+the frozen synthetic golden. The `source` gate makes it impossible instead of unlikely. The marched fixtures
+are 'osm' too but genuinely dense (min cluster 3/11/13) ⇒ verified no-op.
+
+### FYI: E's v4.0 town pack is already booting clean
+`glebe_real`, `marrickville_real`, `newcastle_real` landed and my loader auto-validates + boots them through
+the full structural + gig suites — **all pass**, listed UNPINNED (a non-fatal warn). That's per the brief:
+**I pin the pack in R22**, and it must not gate the beta tag. Early signal: the pack needs no new hardening.
+
+## Round 20 (2026-07-16) — v4.0-beta: the poster cap (density absorb pending E's widened caches)
+
+### → F: **poster cap landed — re-measure `venue_night`** (your +965-tri edge should close)
+My R19 finding (438 posters on katoomba) is fixed. `gigs.js` now **caps the spine pole run at
+`POSTER_PER_SHOP × shops` (1.5/shop, floor 12)** — a seeded subsample. Real katoomba **438 → 31 posters**
+(~2× the synthetic feel), fremantle 32, castlemaine 14. Scaled by **shop count, not edge count**, so the
+`venue_night` stress view (was 200,965 tris, +0.5% over 200k) should drop well under. Re-measure and close it.
+
+### Why no base-golden re-pin (and what I DID pin)
+Posters live in the **gig layer** (`withGigs`), not the base `plan_osm` output — so the pinned real-town
+**base** goldens are unchanged by the cap (correctly green). To regression-guard the capped output byte-exact
+(not just via `districtInvariants`), I added a **`REAL_TOWN_GIG_GOLDENS`** map (the full gig plan per town:
+district + capped posters) — katoomba `0xbd332e83`, etc. Synthetic gig golden `0xb1d48ea1` **frozen** — the
+cap never binds on the shop-dense synthetic town (493 shops ⇒ cap ~740 ≫ its ~15 posters).
+
+### → all: **densities absorbed, goldens pinned** (ledger #2 — E's widened caches landed)
+E's five caches at **3–6× shops** (katoomba 20→80, fremantle 21→80, newtown 18→72, bendigo 9→36,
+castlemaine 6→24 = 292 total) are absorbed. **All five place 3 venues**; the poster cap auto-scaled off the
+live shop count exactly as designed (katoomba 111 posters at 80 shops). selfcheck **ALL GREEN 51866/51866**.
+- **Capacity widened** (the R18 overflow fence, load-tested). At 4× the dominant drop cause was **overflow**
+  (an edge-side holds more shops than fit) — katoomba 10 of 11 drops. Tightened the run: `NODE_CLEAR` 6→3
+  and a **roads-only `RGAP` 2→0.5** (the shared marched `GAP` is untouched ⇒ marched fixtures stay frozen).
+  Drops **7.9% → 5.5%** (16/292). 0.5 m also reads truer — a real AU main street is continuous terrace
+  shopfronts. Residual drops stay **counted, now by cause** (`dropped_overflow` / `_overlap` / `_stranded`).
+  I stopped there deliberately: the next lever is spilling overflow onto a *different* street, which buys
+  ~1% at the cost of putting a shop on a road it isn't on. Dropping a crowded shop is the honest trade.
+- **Venue facade bias now covers `pub`.** R16 exempted pub ("spine-fronted, +Z always open") — true on
+  synthetic/marched, but on a REAL graph at density the pub landed where its frontage poster overhung a
+  cross street (newtown, −0.91 m). The `POSTER_CLEAR` filter now covers every venue kind; still a **no-op on
+  synthetic** (every pub candidate already clears) so the gig golden `0xb1d48ea1` is frozen.
+- **Goldens re-pinned once** (base + gig, all five): katoomba `0x420f677d` / `0x2115732a`, newtown
+  `0x741c18ec` / `0x17ab31bb`, fremantle `0x73d385df` / `0x82c27397`, bendigo `0xc175194e` / `0xf5ce58c4`,
+  castlemaine `0x26c128c9` / `0x48272da9`. classic/gig/marched fixtures **frozen**.
+- **Fixed:** my real-cache loader globbed `*.json` and tried to validate E's new `index.json` as a town
+  cache. It now skips it (it's B's selector index, not a cache).
+
 ## Round 19 (2026-07-16) — the alpha close: fragmentation resolved + findings hardened + goldens pinned
 
 ### → B / C / D / F: **`katoomba_real` boots on real roads, golden pinned, findings resolved** (the handshake)

docs/LANES/LANE_C_AUDIO.md

@@ -1,10 +1,11 @@
-# LANE C — interior audio contract (v3.0-FROZEN) → for Lane F + Lane B
+# LANE C — interior audio contract (v3.1) → for Lane F + Lane B
 
-> **v3.0-FROZEN** · 2026-07-16 · durable contract for Lane F + Lane B. Describes the shipped state; changes
-> require a version bump.
+> **v3.1** · 2026-07-17 (R28) · durable contract for Lane F + Lane B. Amends v3.0-FROZEN: adds
+> `room.audio.emitters` (§Emitters) and retires the v3.0 deferred `userData.audioEmitter` note — that
+> note proposed a shape its own consumer could not use. **The line was the stale thing.**
 
-*`buildInterior` returns `room.audio = { musicKey, toneKey }`, seeded per shop. Lane F's interior_mode just
-plays it; Lane B's audio.js resolves the keys → files.*
+*`buildInterior` returns `room.audio = { musicKey, toneKey, gigKey?, emitters }`, seeded per shop. Lane F's
+interior_mode just plays it; Lane B's audio.js resolves the keys → files.*
 
 > **Scope:** this doc covers the **base interior audio** (the seeded music bed + room-tone every shop
 > returns). The **gig audio** — `room.audio.gigKey`, the live-band bed, canonical form `gig-<genreKey>`
@@ -17,6 +18,7 @@ plays it; Lane B's audio.js resolves the keys → files.*
 room.audio = {
   musicKey,   // string | null — an interior MUSIC bed key in manifest.audio.music, or null (no music)
   toneKey,    // string        — an interior ROOM-TONE key in manifest.audio.ambience (scope:'interior')
+  emitters,   // object        — WHERE keys sound from (R28, §Emitters). Never null; may be {}.
 }
 ```
 - **Keys, not files.** `buildInterior` stays synchronous and asset-free — it only *names* what should
@@ -39,6 +41,58 @@ room.audio = {
 Verified (9 types × 8 seeds): 0 bad keys, 0 nondeterminism, every key resolves + matches its manifest
 `types` membership; dedicated-music types are stable, non-music types vary on/off by seed.
 
+## Emitters — WHERE a key sounds from (R28)
+
+```js
+room.audio.emitters = {
+  stage?:   { x, y, z, r, floor },   // VENUE ONLY — the band + the crowd sound from here
+  counter?: { x, y, z, r, floor },   // the till
+}
+```
+Room-local metres, 3-dp, deterministic (18/18 same-seed deep-equal across 6 types × 3 seeds).
+**Absent emitter ⇒ room-filling**, which stays the right default for a shop radio (the v3.0 call, kept).
+
+- **`r` is the REACH** — the distance at which the emitter has decayed to `floor`. It is the **room
+  diagonal**, not a constant. Measured over 8 types × 4 seeds: diagonals run **9.81–15.63 m**, and scaling
+  `r` to the room holds the door→stage proximity in a consistent **0.42–0.59** band from a pokey
+  band_room to a hall pub. A fixed radius would make the same walk mean different things in different rooms.
+- **`floor` is the room-filling RESIDUE, never 0.** A pub PA fills the room; what changes as you walk in is
+  the **balance**, not the presence. `stage` 0.35, `counter` 0.15 (a till is a point source, a PA is not).
+- **The curve** (both consumers use exactly this):
+  ```js
+  const d = Math.hypot(e.x - cam.x, e.z - cam.z);            // emitters and the interior camera are
+  const prox = Math.max(0, Math.min(1, (e.r - d) / e.r));    //   BOTH room-local — no transform
+  const gain = e.floor + (1 - e.floor) * prox;               // never 0
+  ```
+  Measured swing door→stage: **2.65–4.52 dB** across pub / band_room / rsl. Audible, not a new game — the
+  wide rooms swing least because the stage genuinely *is* nearer the door there. (John, R20: *"subtle
+  changes are great … the player should notice the town feels more alive, not that the game changed."*)
+
+### DO NOT use a PannerNode. It is inert here. (measured)
+Nothing in the tree sets `ctx.listener` — zero hits, whole tree. A `PannerNode` therefore resolves against
+a listener frozen at **(0,0,0)**, and because rooms are built in **room-local coords at the origin**, that
+is *the room's own centre, forever*. Measured via `OfflineAudioContext`, a stage bed in a real pub:
+
+| wiring | RMS at the door | RMS at the stage | ratio |
+|---|---|---|---|
+| **panner, listener never set** (the engine as it ships) | 0.106905 | 0.106905 | **1.0000** |
+| panner + listener tracking the player | 0.055665 | 0.500000 | 8.98 |
+
+The naive build **plays, throws nothing, warns nothing, and never changes by one sample as you cross the
+room** — while doing the one thing the feature exists to prevent. Every plausible gate goes green on it:
+*"is it routed through a panner?"* yes. *"is it audible in a venue?"* yes. *"in a shop?"* yes.
+**-> The only assertion that can see this is a DELTA: the bed's gain at the door ≠ its gain at the stage.**
+Assert the change, not the presence. (Vacuous-gate law, 4th application.)
+
+This trap was set by **this document's own v3.0 note** — *"`userData.audioEmitter = musicKey` so Lane B can
+position/spatialise the bed"* — which invites exactly the panner, in a codebase with no listener code to
+teach otherwise. Both halves of that note were wrong: the *shape* (the engine holds no reference to the
+room group and cannot traverse a scene it can't reach) and the *method*. It is retired.
+
+**The house idiom is already correct**: every spatial effect B ships — tram rumble (R=55), door spill
+(R=9), gig spill (R=26, low-passed through the wall) — is a hand-rolled distance-gain against
+`PROCITY.camera.position`. No listener, no panner. Emitters are the same shape as what already works.
+
 ## Lane F wiring (interior_mode)
 ```
 on enter(room):
@@ -50,9 +104,92 @@ on exit / dispose(room):
 Nothing before the first gesture; `?mute=1`/`?noassets=1` short-circuit before any fetch. `room.audio`
 is plain data on the return — no new lifecycle, no dispose hook needed from Lane C's side.
 
-## Deferred idea (v3.1+, not in the frozen contract)
-A `places`-tagged visual source ("the music comes from *there*") — e.g. a radio/hifi mesh with
-`userData.audioEmitter = musicKey` so Lane B can position/spatialise the bed. Only the record shop has a
-fitting for it today (`listeningCorner`); milk-bar/video would need a new radio prop. A tidy v3.1 item: the
-`userData.audioEmitter` hook + the two props. v3.0 plays the bed non-spatially (room-filling), which is the
-right default for an interior anyway.
+---
+
+# R28 — what C shipped, and the two asks
+
+**C shipped (this round, C's files only):**
+1. `room.audio.emitters` — the data above. Rides the **existing** `playInterior(room.audio)` call: no new
+   lifecycle, no traverse, no dispose hook.
+2. **The till rings from the counter** (`dig.js`) — *audible positioning in a normal shop, with no engine
+   change*, via B's already-public `playSfx(key, {gain})`: C does its own distance math and hands B a
+   scalar. Measured through the real BUY button in a real record shop — **0.9489 at the counter (0.60 m)
+   vs 0.6436 at the door (4.19 m), 3.37 dB**; negative control (`emitters` omitted) fires at exactly
+   **1.0**. `sfx-till.ogg` has been on disk since 15 Jul and had **never once played**. Routing, not content.
+3. **`?mute=1` now actually silences the crate riffle** — see the house-law fix below.
+
+**Why the venue half is an ask and the shop half wasn't:** a **one-shot** resolves its gain once, at fire
+time, from a position C already knows — so C can do it alone. A **bed** must be re-gained every frame from
+inside the engine's `update()` loop. That loop is B's file. The split is structural, not political.
+
+## ASK → Lane B (audio.js) — ~12 lines, paste-ready, house-idiomatic
+Gives the round its venue half: *the band comes from the stage, not from the whole room.*
+```js
+// near the other interior state:
+let iEmit = null, iMusicG = 0.5, iToneG = 0.35;
+
+async function playInterior(spec) {
+  // … existing body …
+  iEmit  = spec.emitters || null;          // [R28] Lane C — where the beds sound from (gig night only)
+  iMusicG = mEntry?.gain ?? 0.5;
+  iToneG  = tEntry?.gain ?? 0.35;
+  swapBed(L.iMusic, spec.musicKey || null, mEntry || null, iMusicG, 1.0);
+  swapBed(L.iTone,  spec.toneKey  || null, tEntry || null, iToneG, 1.0);
+}
+function stopInterior() { iEmit = null; ramp(L.iMusic.g.gain, 0, 0.7); ramp(L.iTone.g.gain, 0, 0.7); }
+
+// in update(), alongside the tram/spill blocks — the SAME idiom, no panner, no ctx.listener:
+if (!street && iEmit && iEmit.stage) {
+  const e = iEmit.stage, d = Math.hypot(e.x - _cam.x, e.z - _cam.z);
+  const k = e.floor + (1 - e.floor) * Math.max(0, Math.min(1, (e.r - d) / e.r));
+  ramp(L.iMusic.g.gain, (L.iMusic.src ? iMusicG : 0) * k, 0.25);
+  ramp(L.iTone.g.gain,  (L.iTone.src  ? iToneG  : 0) * k, 0.25);
+}
+```
+Emitters are room-local; the interior camera is room-local. Same space, no transform. Your call entirely —
+C has not touched audio.js.
+
+**Second, smaller ask (not this round):** expose the sfx bus or the ctx so `dig.js` can retire its private
+AudioContext (below). C will not open that seam unilaterally.
+
+## ASK → Lane F (interior_mode.js) — 1 line, and it is load-bearing
+`interior_mode.js:289` rebuilds the audio spec on a gig night and **drops every field it doesn't name**:
+```js
+const gigAudio = gigOn && ra.gigKey ? { musicKey: ra.gigKey, toneKey: WALLA_KEY } : ra;
+```
+Measured against a real gig-night pub: `quietNight_emittersSurvive: true`, **`gigNight_emittersSurvive:
+false`**. So emitters reach B on every night *except the one night the stage emitter exists for* — silently,
+fail-soft, no error. Don't just spread `ra`: the split is real and should be **deliberate**, because on a
+quiet night the radio and the room-tone genuinely *are* room-filling.
+```js
+// [R28] On a gig night BOTH beds come from the stage — music = the band, tone = the crowd in front of it.
+// On a quiet night the radio + room-tone fill the room, so no emitter is passed. Deliberate, not a spread.
+const gigAudio = gigOn && ra.gigKey
+  ? { musicKey: ra.gigKey, toneKey: WALLA_KEY, emitters: ra.emitters }
+  : { musicKey: ra.musicKey, toneKey: ra.toneKey };
+```
+**Also, when you next touch `openDig`:** pass `emitters: current.audio.emitters` to `dig.open()` and the
+till becomes positional. Optional — omitted, it still rings, just un-positioned. Never required.
+
+## House-law fix — `?mute=1` did not silence the crate riffle (R5 → R28)
+`dig.js` opened a **second, private AudioContext** wired straight to `destination`, breaking both of
+audio.js's stated laws (*ONE AudioContext*; *`?mute=1` forces silence*). The riffle sang right through
+`?mute=1` and never saw B's master gain. **It survived three epochs because no gate asserts mute ⇒
+silence** — the engine returns its silent surface and looks honest from its own side, while the sound came
+from somewhere the engine never knew existed. *A gate that asks the engine whether it is muted can only
+ever answer yes.*
+
+Fixed in `dig.js` by reading B's **public** `.muted` getter (consulted, not modified), falling back to the
+URL when there is no engine (standalone `interior_test.html`). Measured, with a positive control so the
+instrument is provably able to see sound:
+
+| | AudioContexts built | sounds started |
+|---|---|---|
+| live (mute off), after a riffle | 1 | 1 |
+| **muted, same riffle** | **0** | **0** |
+
+The blips stay **procedural** on purpose: zero-fetch, deterministic, and they still work under
+`?noassets=1` where a sampled riffle cannot. Only mute was broken; only mute was fixed.
+
+**-> F: assert SILENCE, not muted-state.** The honest gate is *"no second AudioContext exists / no source
+starts under `?mute=1`"* — with a positive control proving the probe can see a sound when one is played.

docs/LANES/LANE_C_NOTES.md

@@ -1,5 +1,157 @@
 # LANE C — cross-lane notes (PROCITY-C)
 
+## Round 42 §42.2b — the booth composes. And the 122-vs-123 answer.
+
+Full tables in `C-progress.md` § Round 42 (§42.2b). Shots: `docs/shots/laneC/r42_*.png`.
+**Worst room in the game is 123 draws @ `dept`/auto (GLB on), law ≤350 — MARGIN 227, unchanged by this
+section.** `dept` has no booth; §42.2b spent 0 draws at the worst room and at most +4 anywhere.
+
+### → LANE F: 122 vs 123 is the CAMERA ASPECT, and the instrument is now pinned
+
+You were right that it was my measurement environment, and here it is precisely. `info.render.calls`
+counts what survives frustum culling; the sweep camera holds a fixed **vertical** fov (70) and takes its
+aspect from the window. Wider window ⇒ more room in frame ⇒ more draws. One tree, **your own `SWEEP`
+function run verbatim**, viewport the only variable:
+
+| viewport | aspect | GLB on | GLB off |
+|---|---:|---:|---:|
+| 1280×1024 | 1.250 | 116 | 88 @ `stall/hall` |
+| **1280×800** | 1.600 | **122** | 92 | ← my R41 harness |
+| **1280×720** | 1.778 | **123** | 93 | ← `r41_integration.py` `new_page()` |
+| 1920×1080 | 1.778 | 123 | 93 |
+| 2560×1080 | 2.370 | 124 | 95 |
+
+The phantom control decomposes to **+74** at both aspects (197−123 and 196−122), which is the
+cross-check that it is one tree read two ways.
+
+* **123 is the number.** The law must be the worst a player can produce and a player's window is wide.
+  My published 122 was a 16:10 reading; keep using 123 / margin 227 everywhere.
+* **`PROCITY_C.drawSweep` now pins `MEASURE_ASPECT = 16/9`** and restores the window's aspect after.
+  `drawSweep({ glb: true, aspect: 1.25 })` reads **116** — a control arm for the sweep itself, one line.
+* **Suggestion for `r41_integration.py` arm 2, your call:** set `S.camera.aspect` explicitly inside
+  `SWEEP` rather than inheriting the viewport, so the gate cannot drift when someone changes `new_page`.
+  Until then, keep `viewport 1280×720` — that IS 16:9 and it agrees with the pinned sweep exactly.
+* Also checked so the aspect finding is not a guess: E's "+0 draws on all 46 repainted assets" verified
+  independently — glTF primitive counts in `web/assets/models/` vs `pipeline/.props_orig/r42/`,
+  **46/46 identical**.
+
+### → LANE B (and F): `assets/wardrobe/` now has ONE spelling, and it is not in your file
+
+The literal was in `web/interior_test.html` and in `web/js/world/interior_mode.js:69`. It is now declared
+once in `web/js/interiors/stockpack.js` and re-exported from `interiors.js`; the test page imports it.
+`interior_mode.js` is not in my editable set, so its copy is still there — **one line retires it**:
+
+```js
+// web/js/world/interior_mode.js — replace `export const WARDROBE_BASE = 'assets/wardrobe/';` with:
+export { WARDROBE_BASE } from '../interiors/interiors.js';
+```
+
+### → LANE E: the deck plinth, measured again from the shipped GLB — and a workaround you can delete
+
+Your R43 filing is right and here is a sharper number from the same file (node transforms applied):
+`deck_1200_rigged` has **9 of 8,740 vertices (0.10%) within 30 mm of its own y-minimum**, 69 (0.79%)
+within 43 mm, and its **1st percentile of vertex y is 0.0524** — 99% of the deck sits 52 mm above the
+floor its bounding box claims. The static twin `deck_1200` reads 729/11,138 (6.55%) within 30 mm and a
+1st percentile of 0.0140.
+
+**I have compensated in placement and marked it loudly:** `kit41.BOOTH_PLINTH_FIX =
+{ deck_1200_rigged: -0.043 }`, applied to the GLB only (the primitive stand-in is already correct).
+When R43 re-runs `rig_join.py`, **delete the constant and the `p.dy` term in `djBooth`'s `glbParts`
+map** — both carry the tag `[R42 §42.2b — WORKAROUND, REMOVE WHEN R43 FIXES THE ASSET]`.
+
+Two more, for you rather than for me:
+* Your repaint reads. Measured inside the booth's own screen rect at 2 m, six booths: near-black
+  fraction **57.5% → 26.7%** and distinct colours **228 → 389** across both halves of §42.2 together.
+* I kept the deck's SEAT near-black (`#1c1a18`, **9.19:1** against your `#b9bdc2`) and took the bench
+  MASS to timber (`#5a4630`, 4.73:1). Your advice was "a lighter bench reduces the ratio" — true, but
+  the ratio was never the binding constraint once you fixed the asset: 4.73:1 is well over the 3:1 WCAG
+  threshold for a graphical object, and a 0.11 m deck is framed by the 0.05 m slab it stands on, not by
+  the metre of cabinet below it.
+* **The record label you filed (+32 tris) would land well now** — the platter is the brightest thing in
+  the composition and the disc is the darkest, so a label is the one remaining unread detail.
+
+### → LANE D: the booth moved, and its pose is in the determinism payload
+
+`djBooth` placement changed in every room that has one (new yaw + new candidate ordering). Nothing about
+the booth is drivable — ruling 5 held, no control node is animated — but if anything of yours keys off a
+booth position, re-read it. `watchPoints` were re-measured after the change and did not suffer:
+`pub` 361 → **363**, `band_room` **384/384**, `rsl` 560. `browsePoints` unchanged at 3.00/room.
+
+## Round 41 §41.4 — the 110 fittings are placed. Three hand-offs, one warning.
+
+Full tables in `C-progress.md` § Round 41 (§41.4). Shots: `docs/shots/laneC/r41_*.png`.
+~~**Worst room in the game is now 122 draws @ `dept`/auto (GLB on), law ≤350 — margin 228.**~~
+**[CORRECTED IN R42 §42.2b] 123 @ `dept`/auto, margin 227.** The 122 was a 16:10 reading of an
+instrument whose camera aspect was unpinned; the room never changed. See § Round 42 above.
+
+### → LANE F: one line turns the wardrobe on in the game, and one number needs restating
+
+**1. The wardrobe pack.** 52 named 1990s Australian garment layers, one 240 KB atlas, feeding the op-shop
+clothes rails and shelves at **zero geometry cost**. It is a stock pack under its own base, so `index.html`
+needs the same one line the test page has, beside the existing three preloads:
+
+```js
+if (STOCK_REAL) preloadStockPack('opshop', { base: 'assets/wardrobe/' });
+```
+
+and, where a shop's interior is built, `stockBase: 'assets/wardrobe/'` when `shop.type === 'opshop'`
+(`interior_mode.js` already passes `stockAdapter`; the adapter must be
+`makeStockAdapter(getStockPack('opshop', 'assets/wardrobe/'))`). **Nothing breaks without it** — no pack
+means the procedural garment canvas, byte-identically, which is also what `?noassets` and every default
+boot get. Cache identity is `(type, base)`, so it coexists with the town-wide packs.
+
+**2. `drawSweep` numbers moved, and it is the instrument, not the rooms.** The sweep cleared every interior
+from the scene *except* `current` — the live room the page is showing — so every per-type number carried a
+constant offset from an unrelated second room. R39/R40 prints of this function (worst 188, "margin 162")
+include that phantom. The sweep now clears all interiors and rebuilds at the end. Re-baseline against the
+corrected values before asserting anything tighter than ≤350.
+
+**3. New gate surface, if you want it:** `PROCITY_C.kitAudit(manifest)` compares all 96 catalogue rows in
+`kit41.js` against the live `manifest.json` and asserts Lane E's three traps (no pool ships both halves of
+a rotated pair; no pool ships an oversize id; every pool/booth id resolves). Currently **96/96 checked, 0
+dimension errors, 0 missing, 0 pair errors, 0 oversize**. It caught a real 5 mm drift on its first run. It
+is cheap, it is non-vacuous (it has already fired), and it is exactly the check that goes stale silently.
+
+**4. `opts.noKit`** on `buildInterior` drops every R41 spec and reproduces the pre-R41 room exactly — the
+control arm for any before/after the round needs. `room.pulls = { pulled, restored, lost }` reports what
+the door→counter guarantee cost that room; `lost > 0` means a genuine blocker.
+
+### → LANE D: the DJ control nodes exist, nothing drives them, and that is deliberate
+
+R41 **places** the rigged gear and **records** the contract. There is no driver and `djBooth` ships no
+animation hook, so a placed node can never be mistaken for a live one. When you build the driver:
+
+| id | control nodes | live where |
+|---|---|---|
+| `deck_1200_rigged` | `Platter_SPIN` · `Arm_YAW` · `Fader_PITCH` · `Btn_STARTSTOP` | record shop, `BOOTHS.record_hero`, left deck |
+| `mixer_ttm54i_rigged` | `Fader_CROSS` | record shop, `BOOTHS.record_hero`, centre |
+| `mixer_pmc05pro_rigged` · `mixer_shdj1200_rigged` | `Fader_CROSS` | catalogued, not placed |
+
+Reach them from the room without guessing: any fitting group with `userData.djBooth` carries
+`userData.controlNodes = { <id>: [node…] }`, and the GLB instance beneath it is tagged
+`userData.glbUpgrade` with `userData.kind === <id>`. Two rules from E that a driver must honour: drive by
+the **bare node name** (cap/stem/rib are parented under it), and **glTF drops the source's limit
+constraints — clamp the travel yourself.** Venue and pawn booths are statics by design.
+
+**Your poses are unchanged and still hold in a furnished room.** browsePoints stayed at 3.00/room across
+all 12 types; watchPoints measured after furnishing: pub **7.5 of cap 8**, band_room **8.0 of 8**, RSL
+**11.4 of 12**. `counter.stand` is untouched. The venues' bar is now `plywood_bar` instead of
+`counter_till` — same fitting, same stand pose, same service strip, different model.
+
+### ⚠ WARNING TO ANY LANE THAT HIDES A PRIMITIVE OR MERGES A MESH
+
+Two latent bugs this round found the hard way, both of the same shape — **a tag that something depends on,
+destroyed by a later pass**:
+
+- `glb.js` hid every child of an upgraded fitting that was not `isStock`. R9's buy-anywhere shelves are
+  tagged `{ noBatch, buyMesh }` and *not* `isStock`, so **`?stock=real` + GLB made every buyable item in
+  the room invisible** — live since R9 on `bookshelf`/`cubeShelf`/`clothesRack`, never seen because R9
+  measured GLB-off.
+- `batch.js` rebuilt `userData` from scratch when it merged a material bucket, dropping sub-tags such as
+  `tillPrimitive`. Any hide that reads a per-mesh flag after batching was already a no-op.
+
+If you add a per-mesh flag that a later stage reads, check it survives `batchRoom` **and** the GLB swap.
+
 ## → Lane D + Lane F: BROWSE-POINTS interface (round-9 C1 — **LANDED**, code live)
 
 **Status: shipped.** `room.browsePoints[]` is live on the room API (commit `5ae635a`, ref

docs/LANES/LANE_C_PUB.md

@@ -1,9 +1,42 @@
-# LANE C — venue interface contract (v3.0-FROZEN: the district) → Lane D + Lane F
+# LANE C — interiors contract (venues · real-town mapping · real stock) → Lanes A/D/E/F/G
 
-> **v3.0-FROZEN** · 2026-07-16 · durable contract for Lane D + Lane F. Describes the *shipped* state;
-> changes require a version bump (CITY_SPEC amendment law). Verified R13 (build) + R14 (release audit).
-> **v3.1 amendment (2026-07-16):** §3 becomes the `stage.backline[]` contract (ledger #5 — the amp
-> unification); C dropped its primitive ampStacks. Everything else in this doc is unchanged and stands.
+> **v5.0-FROZEN · 2026-07-17 · the whole document.** Every section below is the shipped, measured state of
+> Lane C's contracts across five epochs. Changes from here are version-bumped amendments, recorded in the
+> marker list — the same discipline §0–§5 have carried since v3.0. **Case law worth keeping:** three of this
+> doc's amendments exist because a rule of mine met a case written *after* it (§7's naming vs the loader,
+> §7.2a's `sku_` before mint existed) — the lane building to the rule took the red both times. When a line
+> here meets a case it didn't foresee, **the line is the stale thing.** Amend it; don't bend the case.
+
+> **v3.0-FROZEN** · 2026-07-16 · durable contract for Lane D + Lane F. §0–§5 describe the *shipped*
+> venue state; changes require a version bump (CITY_SPEC amendment law). Verified R13 (build) + R14 (audit).
+> **v3.1 amendment:** §3 became the `stage.backline[]` contract (ledger #5 — the amp unification).
+> **v4.0-beta amendment (2026-07-16):** **§6 added — the real-town shop-class → archetype mapping**
+> (ledger #2, the density widening; C→E handshake). The frozen venue contract (§0–§5) is unchanged.
+> **v4.0 amendment (2026-07-16):** **§7 added — the G2a per-shop stock-atlas contract** (C's interior
+> draw/tex ceilings, answering Lane G + E's review). §0–§6 unchanged.
+> **v5.0-alpha REWRITE (2026-07-17, R24 ledger #1):** **§7 rewritten against the code — the runtime is the
+> authority.** My R22 wording invented an index name my own loader could never fetch; that contradiction
+> held F's tag. §7 now states what `stockpack.js` actually implements, extended per-shop, and the
+> `type+base` cache keying is landed. **G's R23 atlas layout is ratified** (G re-emits provenance field
+> names only, §7.3). §0–§6 unchanged.
+> **v5.0-alpha amendment (2026-07-17, R25 ledger #3):** **§7.2a added — slot ids must be sku-derived,**
+> unique across packs and stable across re-emits (F's id-collision finding, made structural). Index-only;
+> no atlas bytes, no goldens. §0–§6 unchanged.
+> **v5.0-beta amendment (2026-07-17, R26 ledger #1/#4/#6):** **§7.2b `sourcing` (real|mint — NOT `tier`,
+> which is already the ladder rung), §7.2c `condition` for the price card, §7.2d the atlas manifest**
+> (existence declared, never probed — kills the 404 attribution exception). All index/manifest-only:
+> no atlas bytes, no town caches, no goldens. §0–§6 unchanged.
+> **v5.0-beta amendment (2026-07-17, R26 wave 4):** **§7.2a's id form is now SOURCING-SCOPED** —
+> `sku_<POS id>` for real, `mint_<listing id>` for mint. **Prefixes are namespace fences**, not decoration:
+> my R25 line was written before mint existed and read as one space where there are two. Doc-only.
+> **v7.0-alpha amendment (2026-07-18, R30 ledger #2):** **§9 added — the sell-counter contract** (the
+> no-pump law made structural: `offer(p) = min(p−1, max(1, floor(p·0.5)))` — strictly below the buy side
+> for every p ≥ 1, by construction). §0–§8 unchanged.
+> **v9.0-alpha amendment (2026-08-03, R39 §39.3):** **§10 added — WHAT YOU CAN ACTUALLY DO IN A SHOP:**
+> the honest per-type verb table, the five structural facts under it, a measured correction to the
+> round's binding fact #5 (**44% of market-stall rooms contain no crate**), the op shop's own
+> **rummage bin** (shipped; contents gated, held for John), and the finding that **one asset's
+> `transmission: 1` is costing ~46–50% of the interior draw budget**. §0–§9 unchanged.
 
 *The district ships **three** venue archetypes behind `?gigs=1` — `pub`, `band_room`, `rsl`. Lane A
 converts a chosen shop to a venue kind in place (`shop.type = kind`); C keys the interior recipe off
@@ -136,4 +169,575 @@ bar in the corner — the PA louder than the room. `rsl` = carpet-and-flock club
 (hall/wide), a proper raised stage at one end, bistro tables round the edge, members' bar, the biggest crowd
 cap. Both reuse the `pub` venue machinery (`theme.js venueSpec` + `layout.js` placeStage/placeWatchPoints);
 only the dressing + `venueSpec` differ. Stage/PA keep GLB slots for Lane E (primitive fallback holds); the
-primitive ampStacks are the backline fallback (see §3).
+backline amp is D's, planted at `stage.backline[0]` (see §3).
+
+---
+
+## 6. Real-town shop-class → interior archetype mapping (v4.0-beta, ledger #2) → Lane E
+
+**Directive (John, kickoff — SUBTLE: texture, not takeover).** The secondhand shops stay the **heroes** of
+the town (they *are* the game). The widening adds general retail as *texture* — the everyday main-street
+staples a real Australian town has — mapped onto **existing** archetypes (**no new archetypes this round**).
+The player should feel the town's more alive, not that the game changed.
+
+**How it's applied (E owns the emission).** `plan_osm` keeps only **registry types** (`SHOP_TYPES` — unknowns
+flatten to `opshop`). So E maps each fetched OSM `shop=*` / `amenity=*` value to a **registry type** below and
+bakes it into the cache's `shop.type`. Every target is an existing type, so C's recipes, A's registry, and the
+budgets are all unchanged. Unknown/unlisted classes degrade safely to `opshop` (R18-proven: 18 real OSM types
+all built valid).
+
+**Heroes — secondhand (unchanged; NEVER subsampled):**
+| OSM class | → type |
+|---|---|
+| `charity`, `second_hand`, `antiques`, `vintage` | `opshop` |
+| `books`, `bookshop` | `book` |
+| `music` | `record` |
+| `video`, `games` | `video` |
+| `pawnbroker` | `pawn` |
+| `toys` | `toy` |
+
+**Widened — everyday main-street texture (general retail):**
+| OSM class(es) | → type | wears it as |
+|---|---|---|
+| `bakery`, `cafe`†, `confectionery`, `pastry`, `chocolate`, `deli`/`delicatessen`, `butcher`, `cheese`, `coffee`, `tea` | `milkbar` | the food counter |
+| `convenience`, `kiosk`, `general`, `dairy` | `milkbar` | the corner store |
+| `newsagent`, `stationery` | `milkbar` | papers + magazines |
+| `chemist`, `pharmacy`, `cosmetics`, `perfumery` | `milkbar` | dispensary counter |
+| `clothes`, `fashion`, `boutique`, `shoes`, `bag`, `jewelry`/`jewellery` | `dept` | the dressed retail floor |
+| `department_store`, `variety_store`, `supermarket` | `dept` | big general retail |
+| `hardware`, `doityourself`, `trade`, `electronics`, `mobile_phone`, `furniture`, `houseware`/`homeware` | `dept` | shelved goods |
+| `greengrocer`, `florist`, `farm`, `garden_centre` | `stall` | produce/plants on trestles |
+
+† `cafe`/`fast_food` are `amenity=*`, not `shop=*` — fetch them from the amenity tag; everything else is `shop=*`.
+**Fallback:** any fetched class not listed → `opshop`.
+
+**Copy-paste map for E (`build_towns.py`):**
+```json
+{
+  "charity":"opshop","second_hand":"opshop","antiques":"opshop","vintage":"opshop",
+  "books":"book","bookshop":"book","music":"record","video":"video","games":"video",
+  "pawnbroker":"pawn","toys":"toy",
+  "bakery":"milkbar","cafe":"milkbar","confectionery":"milkbar","pastry":"milkbar","chocolate":"milkbar",
+  "deli":"milkbar","delicatessen":"milkbar","butcher":"milkbar","cheese":"milkbar","coffee":"milkbar","tea":"milkbar",
+  "convenience":"milkbar","kiosk":"milkbar","general":"milkbar","dairy":"milkbar",
+  "newsagent":"milkbar","stationery":"milkbar",
+  "chemist":"milkbar","pharmacy":"milkbar","cosmetics":"milkbar","perfumery":"milkbar",
+  "clothes":"dept","fashion":"dept","boutique":"dept","shoes":"dept","bag":"dept","jewelry":"dept","jewellery":"dept",
+  "department_store":"dept","variety_store":"dept","supermarket":"dept",
+  "hardware":"dept","doityourself":"dept","trade":"dept","electronics":"dept","mobile_phone":"dept",
+  "furniture":"dept","houseware":"dept","homeware":"dept",
+  "greengrocer":"stall","florist":"stall","farm":"stall","garden_centre":"stall"
+}
+```
+Default (not in the map) → `opshop`.
+
+**Subtlety guardrails (E):**
+- Fetch only these tasteful staples — **not** every OSM `shop=*`. Skip vehicle/tyres/fuel, funeral, storage,
+  industrial, and pure services the player never browses (`hairdresser`, `beauty`, `travel_agency`, `bank`,
+  `laundry`, `estate_agent`).
+- **Never** subsample the secondhand heroes.
+- If a town's general-retail count would visually **drown** the secondhand strip, seed-subsample the *texture*
+  classes (the milkbar/dept/stall targets) toward **~2–3× the secondhand count**, and count the drops in
+  `norm.dropped` like every other drop.
+
+**Why these targets:** `milkbar` (counter + fridge + magazine rack + glass case) is the canonical Australian
+counter shop — it wears cafe/bakery/deli/newsagent/chemist naturally; `dept` (cube shelves + clothes racks +
+glass cases) wears clothes + hardware + big retail; `stall` (trestles + crates) wears produce + florist. Three
+general-retail looks + the six secondhand heroes + the three venues = variety with no new archetypes.
+**Pre-verified (seed 20261990, real-town lot 8.5×14):** milkbar/dept/stall/opshop all build valid (0 carves,
+≤143 draws); `dept` reads as a clean **dressed-retail floor** (cube shelves + clothes racks + counter, the
+escalator does *not* dominate the ~7.9×11.7 room), so `clothes`/`hardware` → `dept` is confirmed. C re-checks
+the full result in the five-town door-soak (ledger #6) once E's caches land. (FYI: C's `theme.js canonicalType`/ALIAS already recognizes several
+of these — `deli`/`corner_store`→milkbar etc. — for any direct `buildInterior(rawClass)`; the authoritative
+mapping for the caches is this table.)
+
+---
+
+## 7. Real-stock packs — THE RUNTIME IS THE AUTHORITY (v5.0-alpha, R24 ledger #1) → Lanes E/F/G
+
+> **This section was the root cause of R23's held tag and has been rewritten against the code.**
+> My R22 wording invented an index name (`stock_shop_<godverseShopId>_index.json`) that **my own
+> loader can never fetch** — so G built runtime-compatible, E built contract-compatible, and E's
+> validator glob matched **zero files** (the vacuous gate). Nobody was wrong; the contract was.
+> **Rule going forward: `web/js/interiors/stockpack.js` is the contract. If this doc and the loader
+> disagree, the loader is right and this doc is a bug.** G's R23 atlas was already correct — it is
+> hereby ratified as the layout, and **G re-emits only the provenance field names (§7.3).**
+
+### 7.1 File layout (loader-exact)
+The loader is `preloadStockPack(type, { base })` → it fetches **`<base>stock_<type>_index.json`**.
+- **`type` ∈ `record` | `book` | `toy`** — and it is *not* cosmetic: `type` picks the stock slot
+  (`SLOT_FOR`: record→`sleeve`, book→`spine`, toy→`box`). **A record shop's per-shop pack must be
+  type `record`**, or the adapter feeds nothing.
+- **Town-wide packs** (unchanged): `assets/models/stock_<type>_index.json`.
+- **Per-shop packs (v5): `assets/stock_godverse/<godverseShopId>/stock_<type>_index.json`** — the base
+  is the per-shop directory; the filename is the same. *(This is exactly G's R23 layout.)*
+- **RETIRED:** `stock_shop_<id>_index.json` — never loadable; do not emit, do not glob for it.
+  **→ Lane E:** `validate_atlas.py`'s glob must become `stock_godverse/**/stock_*_index.json`
+  (the current `stock_shop_*_index.json` is why it passed on 0 files).
+
+### 7.2 Fields the RUNTIME reads (absence ⇒ pack `null` ⇒ parody)
+- **`atlases: string[]`** — resolved against the **same base**; `depot:`/`https:` entries pass through.
+- **`items: [...]`, non-empty** — each item needs:
+  - **`atlas`** — must be one of `atlases` (items are grouped by it so a bin batches to one draw).
+  - **`uv: [u0,v0,u1,v1]`, origin TOP-LEFT** — the loader flips V itself (`uvRect`). Do not pre-flip.
+- Read by the dig/buy consumers (not by the loader): **`id`, `title`, `artist`, `price`, `price_band`**.
+
+### 7.2a Slot ids — unique across packs, stable across re-emits (v5.0-alpha, R25 ledger #3)
+**Rule: `items[].id` MUST derive from the source's own stable key — never from position — and MUST be
+unique across ALL packs.** The shipped generic packs keep `rec_NNNN` as their namespace — **a real-stock
+pack must not emit into it.**
+
+> **AMENDED v5.0-beta (R26 wave 4) — the id form is SOURCING-SCOPED, and the prefix IS a namespace fence.**
+> R25's line said "`sku_`-prefixed for real-stock packs". I wrote that **before mint existed**, so it reads
+> as one space when there are two. E implemented my rule faithfully; **the rule was the stale thing, not
+> E's check.** The form now follows §7.2b's `sourcing`:
+>
+> | `sourcing` | id form | the space it names |
+> |---|---|---|
+> | `"real"` | **`sku_<POS id>`** (e.g. `sku_20260314070442`) | the shop's **POS** inventory — a physical copy on a shelf |
+> | `"mint"` | **`mint_<dealgod listing id>`** (e.g. `mint_1382327`) | a **dealgod listing** — a plausible stand-in, not that shop's stock |
+>
+> **These are disjoint namespaces and no gate, lookup, or economy path may treat them as one.** G refused
+> to file dealgod listing ids under `sku_` to go green the easy way, and that judgment is the rule now:
+> **tier-2's sold-means-gone looks up POS skus.** R24's id collision entered the *wrong shop*; the same
+> collision in the money layer **sells the wrong record** — a real one, out of a real shop, to satisfy a
+> minted stand-in. A prefix that lies costs money, not a gate.
+> *(Same standing note as plan-ids vs godverse-ids: one name, one space — never compare across.)*
+
+**Why — two reasons, both measured:**
+1. **Positional ids collide by construction.** Both packs number from zero, so **all 120 godverse ids are
+   also generic-pack ids — 120/120 overlap (measured R25)**. An id-equality gate therefore cannot
+   discriminate which pack a rendered item came from: that is what made the brief's own #7a spec vacuous.
+   F caught it and replaced it with title-sets + texture-URL provenance (now the canonical honest-gate
+   pattern for stock). Sku ids make id-equality discriminating again — permanently, and while there are
+   two atlases to migrate instead of fifty.
+2. **Position is not identity — and this one outlives the gate.** A positional id renumbers on every
+   re-bake: sell one record out of crate 550 and `rec_0050` silently becomes a *different* record. Anything
+   holding an id across snapshots — a wallet purchase, a saved dig, a gate assertion, and above all
+   **tier-2's sold-means-gone** — would then point at the wrong item. The POS sku is stable precisely
+   because it is the shop's own identity for that record: the same principle that makes `godverseShopId`
+   the POS shop id. *(`release_id` identifies the pressing, not the copy — the sku is the copy.)*
+
+**Scope: index-only.** `id` is not read by the loader (§7.3) — the dig/buy consumers and the gates read it.
+**No atlas bytes, no town cache, no golden moves.**
+**→ Lane E (amended R26 w4):** assert the form **against `sourcing`** (you already read it at line 178) —
+`id` present · **unique within the pack** · and the prefix matching its space: `sourcing:"real"` ⇒ `sku_`,
+`sourcing:"mint"` ⇒ `mint_`. **A crate wearing the other's prefix FAILS** — that's the fence doing its job,
+and it's a stronger check than the one it replaces, not a looser one.
+
+### 7.2b `sourcing` — real vs mint, and why it is NOT `tier` (v5.0-beta, R26 ledger #1)
+The beta needs every keyed crate marked as **actual POS inventory** or **seeded plausibility**, so no gate,
+doc or human mistakes one for the other. The brief called that field `tier`. **It can't be `tier`: that name
+is already taken, twice over.**
+- G's atlases already emit **`tier: 1`** = the **charter's ladder rung** (0 parody · 1 static-real · 2 live
+  GODVERSE). A mint atlas **is also rung 1** — same mechanism (a statically baked per-shop atlas); only the
+  *data's origin* differs. And `kind` is already the stock type (`record`).
+- So real-vs-mint is an **orthogonal axis**, not a rung. Overloading `tier` would put two meanings in one
+  name — the same species as the plan-id/godverse-id collision now standing-noted, and as the positional
+  ids in §7.2a. One name, one meaning.
+
+**Rule: top-level `sourcing: "real" | "mint"`, REQUIRED on every real-stock atlas index.** `tier` stays the
+numeric ladder rung, unchanged.
+- **`"real"`** — baked from that shop's own POS snapshot (Monster Robot Party). The index carries its
+  `snapshot` provenance (§7.3).
+- **`"mint"`** — a deterministic seeded sample (`random.Random(shop_id)`) standing in for a keyed shop with
+  no POS. Plausible, never claimed as that shop's stock. **A mint index MUST NOT carry POS-snapshot fields**
+  (the separation IS the honesty — E asserts both directions).
+- **Gates read `sourcing`** (vacuous-gate law: an index with no `sourcing` FAILS). A mint crate can never
+  report as real. The dig card's treatment is C's call — see §7.2c.
+
+### 7.2c Price-card fields — `condition` (v5.0-beta, R26 ledger #4)
+The dig card is a **record-shop price sticker**, and a sticker's fields are artist / title / **condition** /
+price. `condition` is **not in the index today** — G's snapshot carries `condition` + `sleeve_cond` per item
+and drops them at emit, so `pickRealOffers` currently maps `cond: ''` and the card renders dangling
+separators around a hole. That's the "database row" the ledger wants gone.
+**Rule: `condition` (and optionally `sleeve_cond`) are OPTIONAL index item fields; emit them when the source
+has them.** Index-only; the loader never reads them (§7.3). C's card renders whatever is present and omits
+what isn't — a missing field must never leave a stray separator. **Mint items:** emit `condition` only if the
+sampled listing genuinely carries one; a plausible-but-invented grade is exactly the kind of fiction
+`sourcing` exists to prevent.
+
+### 7.2d The atlas manifest — existence is declared, never probed (v5.0-beta, R26 ledger #6)
+Fail-soft-by-404 collides with the zero-console-errors law: the runtime probes per-shop atlases blind and
+eats the 404 noise (8 in F's R24 gate run), tolerated by attribution — a workaround, not a design.
+**Rule: `web/assets/stock_godverse/index.json` is the authority for which shops carry atlases. No entry ⇒ no
+fetch.** Shape:
+```json
+{ "version": 1,
+  "shops": [ { "godverseShopId": 3962749, "types": ["record"], "sourcing": "real" },
+             { "godverseShopId": 31,      "types": ["record"], "sourcing": "mint" } ] }
+```
+- **`godverseShopId` is a number in the GODVERSE namespace** — never compare it to a plan id (standing note).
+- **→ F:** consult the manifest before fetching; no entry ⇒ no probe ⇒ **zero 404s, no attribution
+  exception**. A shop in the manifest whose fetch still fails keeps the existing fail-soft → parody.
+- **→ G:** emit it alongside the atlases (mint entries included).
+- **→ E:** manifest↔files consistency **both ways** — an atlas on disk absent from the manifest FAILS, and a
+  manifest entry with no atlas FAILS.
+- **Manifest absent entirely** (a tree with no godverse atlases): that is a legitimate zero-shop state — the
+  wire probes nothing and stays silent. Not an error.
+
+### 7.3 Fields the runtime IGNORES — and the provenance ruling (the drift dies here)
+`version`, `atlas_px`, `cell`/`cell_w`/`cell_h`, `count`, `kind`, `tier`, `shop`, `crate`,
+`provenance` — **`stockpack.js` reads none of them.** So the authority for their shape is not C's
+loader but **E's `validate_atlas.py`**, and the house convention set by 23 shipped town caches:
+- **Provenance lives at TOP LEVEL: `license`, `attribution`, `generator`, `snapshot`** — US spelling
+  `license`, exactly what E's validator reads and what every town cache already uses.
+  **British `licence` is retired. → Lane G: rename + lift those four to top level.**
+- Rich detail **may** stay nested under `provenance{}` (G's `source` / `snapshot_sha256` /
+  `determinism` block is good — keep it). The four gate fields are the contract; the block is colour.
+- **`atlas_px` REQUIRED** — E's validator checks it against the atlas's real pixel dimensions. That is
+  a genuine falsifiable check; keep it.
+- **`cell` / `cell_w` / `cell_h` are informational.** **C reads `uv`, never `cell`** — so 256², a
+  176×256 portrait book cell, anything: all fine. **Do not shrink the cell to save VRAM** — the dig
+  renders a cover close-up; resolution is the one thing the player actually sees.
+
+### 7.4 Cache identity = **(type, base)** — landed R24
+`stockpack.js` keys `_packs`/`_resolved` by `` `${base}|${type}` ``; `getStockPack(type, base =
+DEFAULT_STOCK_BASE)`. Keying by `type` alone made `base` a **no-op on a cache hit** (measured R23:
+the 2nd `preloadStockPack('record', …)` returned the identical object). That was two bugs:
+1. two stocked shops collide — the 2nd serves the 1st's crate; **and**
+2. **it defeated fail-soft** — an *unstocked* shop of an already-cached type inherited that crate
+   instead of falling back to parody. (A correctness bug, not a mix-up.)
+Both fixed and re-measured (§7.7). Pre-v5 callers are unaffected: no `base` ⇒ the town-wide pack.
+
+### 7.5 The seam (→ Lane F, ledger #6a)
+```js
+buildInterior(shop, THREE, { stock: 'real', stockBase: `assets/stock_godverse/${shop.godverseShopId}/` })
+```
+`opts.stockBase` omitted ⇒ the town-wide packs (today's behaviour, byte-identical). Preload the shop's
+pack on entry with the same base. **C consumes whatever identity field A/G land (`godverseShopId`) —
+C does not invent it.**
+
+### 7.6 Ceilings (C's, unchanged from the R23 correction)
+- **Draws:** one atlas = **one draw**; **≤2 atlases per shop** (G's 120-record crate lands on the cap);
+  a 60+ item shop may use 2048²; spill beyond 2 → the town-wide pack. Room law ≤350 stands.
+- **VRAM:** **≤2 atlases @≤2048²; LRU = 1 shop's atlas set resident ⇒ ≤32 MB peak.**
+  *(R23 correction: my "≤8 MB" assumed a ~16-item "typical shop". A real record shop is 120 records.)*
+- **The LRU + dispose is C's, and it lands at v5.0-beta**, not here: with ONE stocked shop there is no
+  accretion, and safe eviction needs a room-exit hook (a live room holds the pack's shared material) —
+  that seam arrives with F's per-shop preload. Stated so it can't slide silently.
+
+### 7.7 R24 verification — falsifiable, per the new vacuous-gate law
+Fresh context, against G's merged `stock_godverse/3962749/` (120 real records):
+- **Every sleeve samples G's atlas file** — texture sources are exactly
+  `stock_godverse/3962749/stock_record_atlas_00.webp` / `_01.webp`; pack items ≡ index items **by id**.
+  *(Not "covers render": a parody canvas also has a `.map`. The negative control below is what makes
+  this a gate — I had to fix my own R23 metric to satisfy the law.)*
+- **Negative control:** the parody room's stock textures are `(canvas, no src)` and touch the godverse
+  atlas **zero** times — the metric discriminates.
+- **Collision fixed:** shop pack (120 items) and town pack (350) coexist as distinct objects.
+- **Fail-soft with a POPULATED cache:** missing base ⇒ `null` ⇒ parody (the R23 bug is gone).
+- **Ceilings:** 98 draws with real covers via `opts.stockBase`; `pathOK`; 0 carves; 0 console errors.
+
+---
+
+## 8. Tier-2 live enrichment — the seam (v5.0, R27 ledger #2) → Lane F
+
+**Ruling: bless the direct wire — no new lifecycle hook. But the `gone` *application form* is C's, and it's
+landed in `dig.js`.** The question wasn't hook-vs-no-hook; it was *how* `gone` applies.
+
+**1. Lifecycle — no hook needed.** F already holds `currentAdapter` (`interior_mode.js:67`) and passes it to
+`dig.open()` **per dig** (`:111`) — a fresh read every time a crate is opened. When the live read lands, F
+updates the pack; the next dig picks it up. If the read hasn't landed, hasn't finished, or failed, the
+adapter is simply the tier-1 pack — **the dig never blocks on the network** (charter risk #1) and no C
+lifecycle changes.
+
+**2. The form — pick-then-omit, NEVER filter-the-array.**
+`pack.gone` = a `Set`/array of ids the live read reports sold. C picks from the **full, stable `items[]`**
+and omits gone ids **after** the draw.
+- **Why (measured, R27, 5 crates):** filtering `items[]` first **reshuffles the crate** — every pick indexes
+  by position, so **one sale changed 21 OTHER records**. Pick-then-omit: **0 collateral**. A crate with 3
+  sold shows 13, not a different 16.
+- **Both forms hide the sold record** — so **“the gone item never renders” cannot tell them apart.** → **F:
+  the sandbox proof (#4) must assert on *collateral* (the survivors are unchanged across a `gone` delta),
+  not just absence. The obvious assertion is vacuous here.** (Vacuous-gate law, third application — and the
+  cheapest one to get wrong, because it goes green.)
+- **Proven in the real dig:** sold record gone · survivors **4/4** kept · **collateral 0** · `items[]`
+  untouched (120).
+
+**3. F's invariant — `items[]` identity and order ARE the pick's stability.**
+- **Do:** update item *fields* in place (live `price`) — free, no reshuffle; the card reads `it.price` at
+  pull time, so a live price shows on the next pull.
+- **Never:** add, remove, or reorder `items[]`. That is what `pack.gone` exists for.
+
+**4. The determinism boundary sits exactly here.** Server down ⇒ no `gone`, no live fields ⇒ the dig is
+tier 1, deterministic and gate-able. Server up ⇒ the crate legitimately changes as records sell — tier 2 is
+non-deterministic **by design** (charter law #2). So **no gate may assert dig determinism with the server
+up**, and no live value may enter a seeded stream or a golden: `pack.gone` is consumed at pick time and
+never persisted.
+
+**5. The bin fan is decorative, not inventory.** The room's visible sleeves are built at `buildInterior` from
+a *different* seeded pick than the dig's offers — a fan, not the crate's contents. A sold record's cover may
+linger in the fan until the room rebuilds. If we ever want the fan to honour `gone`, **that** is when I'd
+publish a post-build hook; it is not needed for the epoch's claim, because the crate you *riffle* is true.
+
+---
+
+## 9. The sell counter (v7.0-alpha, R30 ledger #2) → Lanes F/B
+
+**The mirror of the buy card.** Walk to the keeper's counter holding items the shop trades in → a sell
+card (the same manila price-sticker treatment as the dig's pull panel): item, OFFER, SELL. Module:
+`web/js/interiors/sell.js` — DOM-only (zero draws, zero GPU resources), same consumer pattern as
+`dig.js` (C ships the interaction; F owns the in-game input/mode hook).
+
+### 9.1 THE OFFER — the no-pump law, structural (the multiplier and why)
+
+```js
+sellOffer(pricePaid) = min(pricePaid − 1, max(1, floor(pricePaid × 0.5)))     // and never < 0
+```
+
+- **The multiplier is 0.5** — the classic secondhand-dealer margin (a keeper pays about half of what
+  he'll sticker it at; he has to eat too). It keeps selling *meaningful* (half your money back beats a
+  full crate of duds) without being an income source.
+- **The `min(pricePaid − 1, …)` clamp is the law made structural, not tuned:** the offer is **strictly
+  below what you paid for every `pricePaid ≥ 1`** (at `p = 1` the offer is $0 and the SELL button
+  disables — the keeper won't buy what he can't sticker; at `p = 2` the naive `max(1, floor(p/2)) = 1`
+  would meet the clamp anyway — the clamp exists so no future retune of the multiplier can ever push an
+  offer to break even). **Buy-then-immediately-sell therefore loses ≥ $1 per round trip, always** —
+  F's no-pump gate (`R30 ledger #5`, monotonic cash loss) holds **by construction**, and a change to
+  this formula that breaks that property is a contract violation, not a balance pass.
+- **Alpha basis = `pricePaid`.** The alpha carries no guide-band data (the BIBLE bands are beta), and
+  in the alpha every buy happens at the shop's asking price — so `pricePaid` IS the buy-side price the
+  player faced. **Beta swaps only the basis, not the shape:** when E's guide bands land, the offer
+  becomes `min(bandLow − 1, max(1, floor(bandLow × 0.5)))` — below the band's *low* edge by
+  construction, so a gem bought under band still nets its finder margin only against the band, never
+  against the keeper. The formula's clamp survives the swap untouched.
+
+### 9.2 What the keeper buys (alpha: type = type, strict)
+
+- `sellableIn(shopType, item)` ⇔ `item.type === shopType`. A record shop buys records, a book shop
+  books — **any** shop of the type (per-keeper taste, haggling, pawn-buys-everything: all beta, not
+  built).
+- **An item with no `type` is NOT sellable — fail-closed** (vacuous-gate law: a matcher that passes an
+  untyped item would "match" everywhere). **→ Lane F ASK:** stamp `type` (the registry stock type:
+  `record`/`book`/`toy`/…) on every collection item at buy time — the R30 published shape
+  (`{townKey, godverseShopId|shopId, sku|slotId, pricePaid, dayFound}`) doesn't carry it, and without
+  it nothing is sellable anywhere. Carrying `title`/`artist` too is strongly asked (B's collection UI
+  needs them; my card falls back to the sku/slotId label when absent — ugly but honest).
+
+### 9.3 The seam — money like buying, removal via the game API only
+
+- **C consumes `window.PROCITY.game.collection` READ-ONLY.** The card never splices, reorders, or
+  mutates it (same species of law as §8.3's `items[]`).
+- **`onSell(item, offer)`** is the single side-effect callback — the exact mirror of the dig's
+  `onBuy(offer)` (the proven wallet seam). The **consumer** (F) does both halves: credit the wallet,
+  remove the item from the collection **through the game API**. `onSell` returning `false` = keeper
+  veto: card unchanged, nothing moves.
+- `wallet.sell(item, offer)` is provided (C-owned `wallet.js`, mirrors `buy()`): credits `offer`,
+  drops the matching v0-inventory entry, notifies. F binds it exactly like it binds `wallet.buy`.
+- Till ring: the sale rings `'till'` from the counter emitter (the R28 one-shot pattern, same
+  distance-gain math as the dig's) — silent-and-happy with no engine / `?mute` / `?noassets`.
+
+### 9.4 The trigger + the card
+
+- **Where:** within **`SELL_DIST = 2.0 m`** of `room.counter.pose` (bench centre, room-local — the
+  frame the interior camera walks in). Helper exported: `nearCounter(room, pos, dist?)`.
+- **Suggested E routing for F** (matches my harness): aimed bin → dig (unchanged) · else near counter
+  with ≥ 1 sellable → sell card · else shelf-buy. Pointer unlocks while the card is up (dig precedent).
+- **The card:** one item at a time — artist/title (or the sku/slotId fallback), the round OFFER
+  sticker, SELL, `‹ ›` cycling when more than one sellable, ✕/Esc closes. `open()` returns `false`
+  (no card, no DOM) when nothing is sellable.
+
+### 9.5 Fail-soft (the classic-pure law, C's half)
+
+No game layer (`?classic=1` / `?game=0` ⇒ `window.PROCITY.game` absent) → the consumer never opens
+the sell UI, **and** `open()` itself returns `false` on a missing/empty item list — zero errors, zero
+DOM, zero localStorage. `createSell()` allocates DOM only; `dispose()` removes every node + listener.
+
+### 9.6 API (loader-exact, per the §7 rule: the code is the contract)
+
+```js
+import { createSell, sellOffer, sellableIn, nearCounter, SELL_MULT, SELL_DIST } from './js/interiors/sell.js';
+const sell = createSell();
+sell.open({ shopType, shopName, items, getCash, onSell, onClose, emitters })  // → bool (false = nothing sellable)
+sell.close();  sell.dispose();  sell.active                                    // mirrors dig.js
+```
+
+---
+
+## 10. WHAT YOU CAN ACTUALLY DO IN A SHOP (v9-alpha, R39 §39.3) → everyone
+
+> **This section is a measurement, not a design.** Fable's brief asked for the honest per-type
+> inventory of player verbs, built by reading the recipes and the fitting kinds and then counting
+> them in built rooms — not from memory. It is uncomfortable. It is also, as far as I can tell, the
+> first time anyone has written down what this game currently offers, shop type by shop type.
+
+### 10.1 THE TABLE — the DEFAULT BOOT (`web/index.html`, no flags), 12 types
+
+Counts are from built rooms: **6 archetypes × 8 seeds = 48 rooms per type**, headless.
+
+| type | dig a bin? | pull-and-buy off a shelf? | sell at the counter? | anything else |
+|---|---|---|---|---|
+| `record` | **YES** — 2–8 bins/room, mean **4.6**, 0/48 rooms empty | no — records are the dig, by design | **YES** — the only shop in the game where anything can be sold | — |
+| `opshop` | **no** *(R39: it now HAS a bin; contents unruled — §10.4)* | no — there is no `opshop` stock pack, and none is possible today | no — nothing in the game is ever `type:'opshop'` | look at clothes you cannot buy |
+| `book` | no | **only under `?stock=real`** — ~37 buy meshes / ~412 items per room | only for items already `type:'book'`, which also needs `?stock=real` | — |
+| `toy` | no | **only under `?stock=real`** — ~34 meshes / ~62 items per room | ditto, `type:'toy'` | a glass case (interactable, no consumer) |
+| `video` | no | **no** — `vhsAisle` has `'spine'` slots, but the pack is resolved by SHOP TYPE and there is no `video` pack | no | returns slot + arcade cabinet: both `interactable:true`, **both dead** |
+| `pawn` | no | no | no | glass cases + pegboard — dressing only |
+| `milkbar` | no | no | no | fridge + glass case: `interactable:true`, **dead** |
+| `dept` | no | no | no | glass cases, escalator — dressing only |
+| `stall` | **YES, but** — **21 of 48 rooms have ZERO crates**; mean **0.92**, max 3 | no | **no** — a stall dig records `type:'record'`; the stall is `type:'stall'`, so the matcher fails | — |
+| `pub` | no | no | no | on a gig night: pay the cover, watch the band |
+| `band_room` | no | no | no | ditto |
+| `rsl` | no | no | no | ditto |
+
+Every type additionally: walk in, walk out, look, a keeper standing at the counter, up to 3 browser
+rigs, a seeded radio/room-tone, and (with a wantlist) a ~45% keeper rumour on the banner.
+
+### 10.2 The five structural facts behind that table (verified in the code, R39)
+
+1. **`?stock=real` is opt-in** — `index.html:222` `params.get('stock') === 'real'`, and
+   `interior_mode.js:360` gates the adapter on it. No adapter ⇒ `stock.js` never calls
+   `buildBuyableShelf` ⇒ **on the boot every player gets, there is not one `buyMesh` anywhere in the
+   game.** The R9 buy-anywhere path is real, tested and shipped, and it is *dark by default*.
+2. **The pack is chosen by SHOP TYPE, and `SLOT_FOR` has three entries** (`stockpack.js:85`:
+   `record→sleeve · book→spine · toy→box`). `buildInterior` asks `getStockPack(recipe.key)`. So the
+   only shelves that can *ever* be buyable are book spines in a `book` shop and toy boxes in a `toy`
+   shop — the video store's identical spine shelves cannot be, because no `video` pack exists.
+3. **Four stock kinds can never be bought in any mode**: `garment`, `snack`, `magazine`, `treasure`.
+   `hang()` and `treasures()` never call `buildBuyableShelf`, and no pack type maps to them. **The op
+   shop's actual stock — the clothes — is unbuyable by construction.**
+4. **`sellableIn` is `item.type === shopType`** (`sell.js:37`, fail-closed) and only two call sites
+   ever stamp a `type`: `interior_mode.js:206` (a dig pull — **always `'record'`, wherever it
+   happened**) and `:251` (a shelf buy — `currentShop.type`). Therefore on a default boot the sell
+   card can open in exactly one kind of room: a record shop.
+5. **`interactable: true` is not a verb.** `interior_mode`'s E routes exactly three things: an aimed
+   `kind:'bin'`, the counter (via `nearCounter`), and a `buyMesh`. `case`, `fridge`, `returns` and
+   the arcade cabinet all set `interactable: true` and **nothing reads them** — 5 glass cases per
+   pawn room, 8 per dept room, 4 fridges per milk bar, all inert. That flag is currently a comment.
+
+### 10.3 The correction to the binding fact (R39, measured — the honest direction)
+
+The round's binding fact #5 says *"only record shops and market stalls have a diggable crate."* True
+of the **recipes**. Not true of the **rooms**: the stall's `crate` is `zone:'centre'`, and the stall's
+3–6 trestle tables take the aisle first, so the centre candidates are blocked. **21 of 48 stall rooms
+(44%) contain no crate at all**; mean 0.92 per room against the record shop's 4.6.
+So RED TICKET DAY's roster, which counts a stall as a crate-shop by type, **overcounts**: a roster can
+name a stall you cannot dig in. One line fixes it (`fallbackZones` / `anywhere` on the stall's crate
+spec — the machinery landed this round), but it adds crates to the world, so it is **held with the
+contents question** and not shipped.
+
+### 10.4 THE RUMMAGE BIN — the op shop's own floor bin (SHIPPED, contents gated)
+
+`fittings.js rummageBin` + the `opshop` recipe. A shallow galvanised dump tub (0.95 × 0.70 × 0.28)
+with flared sides on a castored steel frame, rim at **0.76 m** — you rummage standing, not crouched —
+heaped with stickered mixed goods and a hand-lettered card taped to the front panel
+("EVERYTHING $2"). Deliberately not a record crate recoloured: `crate` is 0.55 × 0.45 and deep
+because it is sized to stand LPs in, and nothing stands up in this.
+
+```js
+// the shipped default — furniture. kind:'prop', no bin, no dig prompt, no `places` entry.
+buildInterior(shop, THREE)
+// armed — kind:'bin', the dig fires. ONE opt. (interior_test.html: ?opshopdig=1)
+buildInterior(shop, THREE, { fittingOpts: { rummageBin: { dig: true } } })
+```
+
+**New, generic, opt-in seams (all pure data, no stream reads, absent ⇒ pre-R39 byte-identical):**
+- `recipe.fittings[i].o` — opts handed to the fitting builder.
+- `buildInterior opts.fittingOpts[kind]` — per-build override of the above. F's gate handle.
+- `recipe.fittings[i].fallbackZones` / `.anywhere` — placement fallbacks for a fitting a recipe
+  *promises* will be there. Without them the bin landed in only **11 of 24** archetype×seed rooms,
+  because it is appended last and its zone is the fullest it will ever be. With them: **72/72**.
+
+**Guarantees (72 rooms = 6 archetypes × 6 seeds × GLB on/off, headless):**
+- placed **72/72** · **0 carves** · `pathOK` **72/72** · determinism **72/72**
+- **reachable 72/72** — the nearest walkable cell that is flood-reachable from the spawn sits
+  **0.77–1.15 m** from the bin, against the dig's 2.5 m proximity / 3.2 m aimed reach
+- **the rest of the room is byte-identical to pre-R39 in 72/72.** The spec is appended LAST, so the
+  shared `lay-count` / `lay-place` streams hand every existing op-shop fitting the same draws it
+  always had; only the tub is added.
+- end-to-end, armed: aim resolves → dig opens → **16 offers** → pull card → **BUY** debits the wallet
+  → the bin depletes to 15. Negative control, default: tub present, **0 bins**, aim finds nothing,
+  the dig never opens. Zero console errors on both arms.
+
+**Draw cost — measured on the GLB path, which is the default boot (`index.html:349`).**
+
+| `drawSweep` (the ≤350 law's own instrument) | pre-R39 | R39 | Δ |
+|---|---|---|---|
+| GLB-**off** worst | 156 (opshop/hall) | **161** (opshop/hall) | **+5** |
+| GLB-**on** worst | 319 (opshop/hall) | **329** (opshop/hall) | **+10** |
+| every other type, both modes | — | — | **0 — byte-identical, 11/11** |
+
+**Margin against the ≤350 law: 21 draws.** Per-room the tub costs **+3…+9** GLB-off and **+6…+18**
+GLB-on (the doubling is not the tub — see §10.5). It is the worst-case room it lands in, which is why
+this is stated against `opshop/hall` and not an average. Soak: 60 rooms, **leak geo 0 / tex 0**,
+determinism identical, avg 3.4 ms / worst 16.5 ms.
+
+**A free win found while costing it (`stock.js`, shipped).** The scatter fill minted a *tinted*
+material per item, so a pile of 9 goods in a room with no other scatter cost **9 draws** — one bucket
+each. New opt-in `slot.pool` keeps every face on the room's shared pooled textures at white, exactly
+as the spine and shelf-box rows already do, so the pile merges into buckets the room already has.
+The tub went from 9 goods / 12 draws to **12 goods / 3–9 draws**. Existing scatter callers
+(`trestleTable`, `pegboard`) draw the same values in the same order and are byte-identical — proven
+by all 11 other types' `drawSweep` numbers not moving.
+
+### 10.5 THE INTERIOR BUDGET IS ~2× WHAT IT NEEDS TO BE — one asset material (→ Lanes E/F)
+
+Costing the tub turned up something worth more than the tub. **Lane E's `bookshelf` GLB ships
+`transmission: 1`** on `mtl_10218_Bookshelves_v1`. One transmissive material in a scene makes
+three.js run its transmission pre-pass — **a second full render of the opaque scene into a render
+target** — so *every* draw in that room is issued and counted twice.
+
+Measured, seed 1990, isolated room, by setting `transmission = 0` on that material and re-rendering:
+
+| room | GLB-on draws | with `transmission: 0` | saved |
+|---|---|---|---|
+| `opshop`/hall (the game's worst interior) | 191 | **104** | **−87 (−46%)** |
+| `opshop`/wide | 142 | **80** | −62 (−44%) |
+| `book`/hall | 101 | **51** | **−50 (−50%)** |
+| `dept`/hall (no bookshelf) | 116 | 116 | 0 — the control |
+
+`bookshelf` is in the `opshop` (1–2) and `book` (5–8) recipes, which are the two worst GLB-on types
+in the sweep (329 and 243). **Roughly half the interior draw budget is being spent on a pre-pass
+nobody asked for, triggered by a flag on one asset**, and a bookshelf rendering as glass is almost
+certainly not the intent. **→ E:** re-emit without `KHR_materials_transmission`. **→ F:** the cheap
+runtime fence is a `transmission = 0` scrub in `glb.js upgradeFitting`; I have NOT shipped it, because
+it changes how another lane's asset renders and that is not mine to decide in passing. Either fix
+turns a 21-draw margin into a ~100-draw one.
+
+### 10.6 THE CONTENTS — HELD FOR JOHN. Do not flip the default without this ruling.
+
+The mechanism is shipped and gated. **What is IN the bin is the question**, because it is not "op
+shops now dig", it is "op shops now dig **records**". Measured against the 23 shipped town caches
+(1,236 shops: **44 record · 36 stall · 147 opshop**):
+
+| | today | with the op-shop bin armed |
+|---|---|---|
+| crate-**shops** per town | 0–11 | **2–25** |
+| towns with **none** | **3** (bowral, darwin, daylesford) | **0** |
+| diggable **bins**, all 23 towns¹ | ~235 | ~382 (**+63%**) |
+| under-band gems/day, all towns² | ~113 | ~183 |
+
+¹ record 4.6 bins/room × 44 + stall 0.92 × 36 + opshop 1.0 × 147. ² `dig.js:48` — 10% gem roll on a
+collector/grail band ⇒ 3% per sleeve × 16 sleeves/bin.
+
+**A · parody records (what the mechanism inherits).** **Cost: zero code** — `proceduralSleeves`
+already serves everything, and *the market stall already does exactly this*, so this is a change of
+scale, not of kind. BIBLE bands untouched (`record` bands exist). RED TICKET DAY gets a roster in all
+23 towns. **The catch:** an op-shop find is stamped `type:'record'`, so it can only be sold in a
+record shop — and bowral, darwin and daylesford have **zero** record shops. Those three towns would
+be able to dig and have nowhere to sell. The first pull from an armed bin, seed 42, was a `grail`-band
+record asking **$72**, in the Salvos bric-a-brac tub. That is either the op-shop fantasy made
+mechanical or the moment records stop being special; it is a taste call, not a measurement.
+
+**B · books and toys through the existing pull-and-buy pack.** Not free. (i) The pack is resolved by
+shop type, so an op shop asks for `stock_opshop_index.json`, which does not exist — it needs either an
+E-emitted pack or a recipe-declares-its-pack-types change in C. (ii) **The dig scene is
+record-shaped**: `dig.js` builds a crate of 0.31 m square sleeves and a card that says
+artist/title/condition. A paperback in it renders as a square LP sleeve. So B costs a second dig
+presentation. In its favour: the BIBLE already has `book` and `toy` bands (`bible.js:28-29`), so the
+price fences hold with **zero new numbers**, and the sell path is clean once F stamps the item's own
+type instead of the hardcoded `'record'`.
+
+**C · a new bric-a-brac class.** Highest cost — a new BIBLE band row, a parody generator or pack, a
+card treatment, gates. Also the only option that *fixes* A's asymmetry: `sellableIn` is type = type,
+so bric-a-brac would sell **in op shops**, which is both correct and diegetic, and the op shop becomes
+its own loop instead of a second-rate record shop.
+
+**My recommendation.** Ship the flag (done), and **let John play arm A for one session before anyone
+decides** — it is zero code and it answers the only question that matters, which is whether digging an
+op shop is fun. Then: **C is the destination**, because it is what stops "records" being the answer to
+every question in this game and it closes the three-town sell hole. **B is not worth doing alone** —
+its cost lands in the wrong place (a record-shaped dig scene showing a book), and its good half (the
+band table, the type stamp) is inherited by C anyway. If John wants RED TICKET DAY running in all 23
+towns *this round*, A does it today for nothing, and the three-town sell hole is the price.

docs/LANES/LANE_D_NOTES.md

@@ -6,6 +6,952 @@ _rotOnly/head-bone normalize/upgradeStreetPeople). Measurements on the M3 Ultra
 
 ---
 
+## ROUND 42 (§42.4) — RECAST, WIRED: five bodies swapped in place, and the bench mirror retired
+
+Summary in `D-progress.md` §Round 42; this file keeps the parts a future lane needs to *reuse*.
+Gates: `tools/qa/r42_cast.py` (new, six arms), `tools/qa/r42_shots.py` (new, two frames),
+`tools/qa/r41_citizens.py`, `tools/qa/interior_scale_check.py`, `tools/qa/r41_shots.py`.
+
+### THE LAW: a roster swap is an IN-PLACE assignment, never a delete-and-append
+
+`pickRig` indexes `PED_NAMES` and `fleet.all` (= `normal ++ comical`), and every citizen stores its
+result as `pedIndex`, which is *in the identity signature* and *is the impostor atlas's subject
+index*. So the pool LENGTHS are the identity, and:
+
+- **Replacing a name at its index** changes the wardrobe and nothing else. Measured: the identity
+  signature over 150 active citizens is **byte-identical** before and after the swap — 0 differing
+  lines, same seed, same bookmark, fresh contexts.
+- **Deleting a name** shortens the pool, renumbers every slot after it, moves every seeded identity
+  downstream and re-indexes the atlas. That is the R2 fleet-order bug arriving through a different
+  door. Lane E deliberately left the rejects in `PED_NAMES` for exactly this reason so the swap
+  could be one atomic edit.
+
+The same law applies to the gated `djs` tail: it is APPENDED to `normal`, so `?classic=1` still
+shortens the pool from the end without renumbering a base slot.
+
+### VERIFYING A PED CONTRACT FROM THE GLB BYTES — and the one-line trap that makes it vacuous
+
+`tools/qa/r42_cast.py` arm 1 reads the GLB JSON chunk directly (no browser, no three, no deps) and
+replays **rigs.js's own filter** over every clip the fleet can bind — the 8 base ped clips plus Lane
+E's 46-clip library, 54 in all — counting bindable tracks per ped. A contract-clean ped scores
+**3 456 / 3 460**, worst single clip 64, sole unbound node `mixamorig:Reference`.
+
+**The trap:** glTF animation channels use `target.path = "rotation"`, but three's GLTFLoader renames
+the track to `.quaternion`, and `_rotOnly` filters on `.quaternion`. Filter the raw glTF path and you
+match **zero tracks on every ped**, the totals come out `0/0`, and the arm passes while measuring
+nothing. Map `rotation→quaternion`, `translation→position` before comparing.
+
+**Every gate needs a control that can fail, and this one was on disk already:** the retired
+`comical_boy_01` scores **3 132 / 3 460** (worst clip 58) because six of its thumb bones —
+`{Left,Right}HandThumb{2,3,4}` — are named without the `mixamorig:` prefix. A ped that shipped for
+41 rounds had been silently dropping six tracks per clip. That is what "the node count is not the
+test" means in practice.
+
+### DRAW-NEUTRALITY IS NOT MEASURABLE AS A TOTAL. Measure the crowd as a difference.
+
+A street total is a number about the whole town on a shared tree with four other lanes landing work
+in the same hour, sampled while a wall-clock crowd walks through frame. Diffing two of them cannot
+resolve a five-body swap. What can: render the frame, hide `citizens.group`, render again, and take
+the difference — the crowd's own cost, in one frame, with nothing else changing.
+
+Measured at all 8 bookmarks: **the whole crowd costs `nearRigs × 1 + 1`** — one draw per near-tier
+rig (every ped GLB is one primitive and one material since the R7 merge) and exactly one for the
+entire instanced billboard layer however many mid citizens it holds (37 at `street_noon`, 36 at
+`patronage_door`). There is no mechanism by which a one-for-one swap can move that. Use this
+decomposition instead of a total whenever the question is "did MY change cost draws".
+
+### THE IMPOSTOR SEAM: 1.000 was never the contract, so use the roster as its own control
+
+R2's bug was a **systematic** 1.67× — a double-tone-mapped impostor material, every ped at once. The
+instrument for "does the bake still match its rigs" is therefore not an absolute tolerance. The bake
+lights the ped with its own key+hemi+env and the street lights it with the sun, so the
+billboard/rig luminance ratio is per-albedo: the **19 bodies this round did not touch span
+0.470–2.100 (median 0.972)**, and the worst-matched body in the town is `man_dj_streetwear_01` at
+0.470 — shipped long before this round.
+
+So the arm asks two questions instead of one: is there a **systematic** shift (new-five median
+1.098 vs untouched median 0.972 = **1.13×**), and is any individual body **outside the spread the
+town already ships** (none is). Method: stage the subject in the live shell at a fixed spot in front
+of the camera, once as a near rig posed at the atlas's own bake phase (`0.35 + idx·0.017`) and once
+as a single instance of the LIVE atlas; screenshot each against an EMPTY frame and count only the
+pixels that differ. Crop to the billboard quad's own projected box — an unbounded full-frame
+difference reported 68 000 "ped" pixels the moment a distant chunk streamed in. Absolute ratios
+wobble a little run to run (ACES makes a global exposure ramp non-linear), so every subject is
+measured **inside one run** and the claim is the within-run comparison.
+
+### THE BENCH MIRROR IS GONE — and this is why mirrors are not gates
+
+R41 shipped a copy of Lane B's bench placement rule in `sim.js` and filed the seam. B shipped
+`benchStops(plan)` in §42.5 *and, in the same round, fixed the rule the mirror had copied*: benches
+had been placed with `yaw = atan2(ux, uz)` — local +Z **down the street** — while both files' comments
+said "facing the road". The mirror was faithful to a wrong line, and a faithful mirror of a wrong
+line is still wrong.
+
+```js
+import { benchStops } from '../world/furniture.js';
+// benchStationsFor(e) is now a thin adapter: wrap the sim edge back into the two-node plan shape
+// resolveEdges() wants, and hand it to Lane B's own rule. No arithmetic of its own.
+```
+
+Three things worth carrying forward:
+
+1. **The import must be STATIC.** The bench-stop check draws three seeded randoms per crossed
+   station, so a dynamically-imported station list draws zero randoms until it lands and "same seed
+   → same crowd" starts depending on the network. `chunks.js` already imports `furniture.js` on
+   every boot (classic and `?noassets` included), so on the game path this costs no fetch, no module
+   and no behaviour. On the standalone `citizens_test.html` it does add one depot fetch
+   (`procity_street_bench_01.glb`, fail-soft): page smoked green, 507 active, 0 console errors.
+2. **`_seatPose` needed no edit**, because it was written in the bench's own local frame (+Z front,
+   +X plank). The corrected yaw carries straight through it. Live sitters measured: **+0.06 m in
+   front of the bench origin, ±0.38 m along the plank, 0.0° between the sitter's look direction and
+   the direction to the road.**
+3. **The station COUNT is what determinism depends on**, not the yaw — same cadence, same side rule,
+   same `len − 6` end margin ⇒ same number of randoms drawn. Identity and posture signatures are
+   byte-identical across the rewire (three-way: pre-swap, post-swap, post-bench-rewire).
+
+Gate: `r41_citizens.py` arm 6 now reads **14/14 stations matched to real instanced geometry within
+2 cm and 14/14 on yaw**, control at 2 m offset matching 0/14. Station-level geometry check across 40
+stations: bench front vs direction-to-road **0.0° (min = median = max)**, front vs street 90.0°.
+
+### A SCAN-THEN-RE-ENTER SHOT HARNESS PHOTOGRAPHS THE PAST
+
+`r41_shots.py`'s browse arm walked up to 8 occupied shops at ~3.1 s each, kept the id of the best,
+exited, and re-entered it 16–25 s later. Browsers are a function of LIVE patronage occupancy, so
+whether they are still there on the re-entry is not something the harness controls.
+
+**Measure the filing before you fix it.** F filed this as *deterministically* red; run verbatim in
+its own harness on today's tree it came back **green** (`browsePoints: 3, browsers: 1`), and two
+isolated repros agreed (one: 2 browsers still present, occupancy 2 → 2, 16.4 s scan). So the defect
+is not "always red" — it is **flaky by construction**, and that is precisely the property that cannot
+go `--strict`. Fixing a flake by widening a timeout or retrying hides it; the fix is to **take the
+frame inside the room, the moment a candidate beats the incumbent, and never leave.** The winning
+shop's occupancy at entry and at the end of the scan is printed into the sidecar on every run so the
+window stays legible rather than becoming a story in a comment.
+
+Generalise: any harness that CHOOSES a subject by scanning a live simulation and then RETURNS to it
+is racing that simulation. Shoot in place, or freeze first (Lane B's `DBG.freeze()`, R42 §42.5).
+
+---
+
+## ROUND 41 (§41.3) — THE CITIZENS COME ALIVE: 46 shipped · 29 wired · 20 on the street
+
+Summary in `D-progress.md` §Round 41; this is the measured detail. Lane E's `web/models/clips/*.glb`
++ `web/assets/motion_manifest.json` are the input, verified before wiring (`python3
+pipeline/clips_verify.py` → GREEN 0/0, 46 clips / 6 groups / 3 498 124 B on today's tree).
+
+### The one number that says what the round did
+
+A census of the live crowd at the retail heart, 12 samples × 146 active citizens, same seed, same
+pose, two arms:
+
+| state | `?clips=0` (R40) | default (R41) |
+|---|---:|---:|
+| walking | **99.3%** | 78.1% |
+| bench-sit (on a real bench) | — | **9.5%** |
+| shopfront lean | — | **7.1%** |
+| stopped at a window, own seeded idle | 0.4% | **5.1%** |
+| R17 free sit · R29 glance | 0.2% · 0.2% | 0.1% · 0.1% |
+| distinct clips in play across the crowd | **4** (`walk`/`idle`/`sit`/`look`, 99.3% on `walk.glb`) | **20** |
+
+`?clips=0` is a new flag in `rigs.js` that turns the motion library off and NOTHING else. It exists
+because `?classic=1` is a bad control for this — it also changes the ped pool (17 vs 22), the
+sit/look/dance clips, the fog, the game and half the shell, so a heap or draw delta measured against
+it says nothing about the library.
+
+### The files, and the one law that holds them together
+
+| file | what it is |
+|---|---|
+| `web/js/citizens/postures.js` | **NEW.** Pure, THREE-free, load-state-free: the clip pools and the seeded pickers. Node imports it directly (the gate does). |
+| `web/js/citizens/clipbank.js` | **NEW.** The group loader. **Dynamically imported** by rigs.js behind the gate, so `?classic=1` does not fetch the module either. |
+| `rigs.js` | `loadPedFleet` gains `clips = dance` (the R36 `djs = dance` trick again: the shell already passes `dance: !CLASSIC`, so **no shell edit was needed**). `makeActor` gains per-instance clip swapping; `spawnRig` gains `setClip`. |
+| `sim.js` · `keepers.js` · `band.js` | the states. |
+
+**THE LAW: posture is a pure function of (citySeed, id), decided once, never re-rolled.** Lazy
+loading can change *when* a posture appears but never *which one it is*. That is what makes six
+groups affordable — and it is gated: arm 3 of `tools/qa/r41_citizens.py` delays **every** clip GLB by
+2 s with a Playwright route and asserts the posture signature is byte-identical to the unstalled run.
+
+The same discipline runs one level down. `fleet.clipsRequested` is published **synchronously** by
+`loadPedFleet` before the dynamic import even starts, and every roll that can move a citizen (bench,
+lean, pause) is gated on that — never on `fleet.bank`, which only answers "is it resident yet".
+Otherwise the first second of a boot would draw a different number of randoms than the rest of it and
+"same seed → same crowd" would depend on the network. Every such roll is also drawn
+**unconditionally** (the R17/R29 pattern: roll always, act only if allowed), and the POSE falls back
+to the R2/R16/R29 base clip while the variant is in flight — so a slow fetch changes nothing at all.
+
+### Clip → state map (29 of the 46 wired, 17 deliberately not)
+
+| category | group | clips used | drives |
+|---|---|---|---|
+| idle | `idles.glb` | all 10 | **per-citizen deterministic idle** (`posturesFor().idle`) — the resting action of every near-tier actor, so it plays on every window pause, and the seeded shopkeeper idle |
+| locomotion | `locomotion.glb` | `walk_shopping_bag` (1 of 6) | the walk pool is `['@walk','@walk','walk_shopping_bag']` ⇒ **1 in 3 citizens carries a shopping bag**; `@walk` is the R2 `walk.glb` |
+| sitlean | `sitlean.glb` | all 8 | 4 sits on **Lane B's actual benches**, 4 leans on **shopfront walls** |
+| browse | `browse.glb` | 5 of 8 | interior browsers at Lane C's browse points, seeded per (shopId, slot) |
+| venue | `venue.glb` | 5 of 6 | gig crowd widening + `venue_bartending` for pub/rsl/band_room keepers + `venue_headphones` for record-shop keepers |
+| social | `social.glb` | **0 of 8** | **not loaded, not fetched.** A two-person clip needs a two-person state machine and a partner-pairing pass. 896 KB for a state D does not have. → R42 |
+
+Not used and why: `browse_hold_turn_l/r` (172°/147° loop seam — one-shot turns with no turn state),
+the four `turn_*` + `walk_to_stand` (the sim turns instantly at a node; a turn-state machine is R42's
+job and it is the only thing that makes those five clips mean anything), `venue_clap_seated` (no
+seated venue slot yet).
+
+**Loop safety is measured, not assumed.** E ships `loopSeamDeg` per clip; `clipbank.js` puts anything
+with `loopable:false` **and** a seam > 25° on `THREE.LoopPingPong` instead of repeat. Exactly one pool
+clip lands there — `browse_pick_up` (92.15°) — and ping-ponging it is why it reads as crate-digging
+(down, up, down) rather than a teleport back to the start. The other 28 either loop or have a
+measured seam ≤ 5° (E's `loopable` flag is conservative; the seam is the ground truth).
+
+### THE BENCH — the state that needed geometry, and how the mirror is kept honest
+
+R17's bench-sit sat a ped down at whatever graph node it stopped at, upright, on air ("no
+bench-position binding" — its own comment). R41 binds it. Lane B places benches at
+`s = 14, 40, 66, …` (step 26 m) on alternating sides of every edge (`furniture.js:203-209`).
+`sim.js benchStationsFor(edge)` mirrors that rule exactly, and a ped can only take a bench on ITS
+OWN footpath side: the sim's lane perpendicular is `forward × (uz, −ux)` = `−forward ×` the furniture
+perpendicular, so the match condition is `side === −forward`.
+
+The bench's local +Z is its FRONT (B's template puts the backrest at z = −0.2, the seat at y = 0.45)
+and rig fronts are local −Z after the R13 facing-normalise, so a sitter is `benchYaw + π`, nudged
+6 cm onto the seat. The plank is 1.6 m — **it seats two**, ±0.38 m on a seeded draw. That was a
+measured need, not a flourish: the first soak put `-1,-6#3` and `-1,-6#5` on the same station to the
+centimetre.
+
+**A mirror that drifts is a ped sitting on air again, so it is gated, not trusted.** Arm 6 of
+`tools/qa/r41_citizens.py` walks every station the sim derives inside the streamed window and
+requires real instanced geometry within **2 cm** of it, with the yaw matching mod 2π. Today:
+**14/14 position, 14/14 yaw**, against a scene holding 2 435 instances. **CONTROL:** the same
+stations offset 2 m match **0/14** — so "coincides" is a measurement, not a hit on any nearby prop.
+
+> **→ LANE B, one line, and D deletes the mirror:** please export
+> `benchStops(plan)` from `web/js/world/furniture.js` next to the existing `busShelterStops(plan)`
+> (same shape, same reason it exists). D switches to the import and drops `benchStationsFor`
+> entirely. Until then the gate is the seatbelt.
+>
+> **→ LANE B, observed while mirroring, not fixed (your file):** `pushYaw(lists.bench, …, yaw + …)`
+> with `yaw = atan2(ux, uz)` maps the bench's local **+Z to ALONG the edge**, so the bench's 1.6 m
+> plank runs ACROSS the footpath and it faces up the street, not the road — the comment on line 203
+> says "facing the road". The streetlight arm above it (`armYaw`, line 197, "arm reaches over the
+> road") has the same convention and so has the same question. D's sitters bind to the bench
+> TRANSFORM, so they sit correctly either way; this is only cosmetic and only yours to rule on.
+
+### THE SHOPFRONT LEAN — and the measurement that moved it
+
+First wired to the R17/R29 window-shop loiter, which fires at a graph NODE — i.e. at an
+intersection, where there is rarely a shopfront to lean on. **Measured: 0 leans in a 9 s run.** Moved
+to the R8 patronage stride check (every 10 m walked), which is already the moment the sim asks "is
+there a shop beside me" — which is exactly when a leaner is beside a wall. Strictly downstream of the
+duck-in decision, on its own `leanstop` stream.
+
+The wall anchor uses `shop._raw` — the door point **before** R40's footpath clamp. The clamp exists
+to drag doors onto the walkable strip (its whole job), but a leaner wants the facade the door was
+derived from, not the kerb the ped walks on. `_raw` is the shell's `lot + front-normal·(d/2+0.6)`,
+i.e. 0.6 m in front of the facade; push `LEAN_WALL_BACK` 0.30 m further out along the edge normal and
+the ped's back is ~0.15 m off the wall, offset `LEAN_SIDE` 1.05 m along the frontage so they are not
+in the doorway, facing the road.
+
+### THE WINDOW PAUSE — the measurement that changed the design
+
+The headline of the round is the per-citizen idle. Wired only to R17/R29's node loiter, a census of
+the live crowd found **0.8% of citizens stopped at any instant** — edges are long, node arrivals are
+rare — so nine of the ten new idles were assigned, deterministic, and **never seen**. That is a real
+failure of the brief dressed up as a green tick.
+
+Fix, on the same stride check as the lean: a ped who walks past a shop and neither goes in nor leans
+on it sometimes just **stops and looks at the window**, in their own seeded idle. No reposition, no
+new clip, no new fetch — the actor's resting action already IS this citizen's idle
+(`setIdleClip` at acquire). Stopped-citizen share went **0.8% → 5.1%**, and all ten idles now appear
+in a 12-sample census (`idle_cocky_lean` 1.5/sample down to `idle_breathing` 0.4/sample).
+
+### Rates, and what they buy (all seeded, all tunable in one place at the top of `sim.js`)
+
+| constant | value | effect at the retail heart |
+|---|---:|---|
+| `BENCH_STOP_FRAC` · `BENCH_DWELL` | 0.40 · 9–20 s | 9.5% of the crowd seated |
+| `LEAN_FRAC` · `LEAN_DWELL` | 0.12 · 6–14 s | 7.1% leaning |
+| `PAUSE_FRAC` · `PAUSE_DWELL` | 0.17 · 4–9 s | 5.1% stopped in their own idle |
+
+### The pooled-actor problem, and why `makeActor` grew four methods
+
+Near actors are POOLED by ped type and recycled between citizens (R2 decision #1), so a per-citizen
+idle cannot be baked in at construction — a recycled actor would carry the previous citizen's
+posture. `makeActor` now memoises one `AnimationAction` per SOURCE clip and re-points four live slots
+(`walkA`/`idleA`/`sitA`/`lookA`) on acquire, ≤3 per frame (`NEW_RIG_PER_FRAME`). three.js shares the
+`PropertyMixer` bindings per (root, track) across every action on the same root, so the marginal cost
+of an extra action is its interpolants, not another copy of the skeleton. `setSitting(s, clip)` and
+`setLooking(l, fade, clip)` gained an optional clip and keep their exact R16/R29 semantics with it
+omitted; `setIdleClip(null)` / `setWalkClip(null)` restore the base actions, which is precisely what a
+citizen whose clip has not landed (or a boot with no bank) gets — the R40 actor, byte for byte.
+
+`spawnRig` (single-clip figures: keepers, browsers, gig) gained `setClip`, the **self-heal seam**: a
+figure is posed with whatever exists at spawn and upgrades in place the frame its lazily-fetched group
+lands. Its re-plant generalises R29's lesson — `_rotOnly` drops the Hips POSITION track, so a clip's
+authored vertical motion comes out as the FEET moving (R29 measured +0.205 m on look.glb). spawnRig's
+original seated re-plant samples once at t=0, which is right for a fixed pose and wrong for a clip
+whose lowest bone travels, so `setClip` samples the posed skeleton at 6 points across the clip and
+plants the MINIMUM: soles can never sink through the floor, and the residual float is the clip's own
+authored range rather than an arbitrary phase's error.
+
+### Memory and fetch — the ledger, measured in fresh headless contexts
+
+| | fetches | bytes resident | groups / clips |
+|---|---:|---:|---|
+| at boot | **4** (manifest 16 KB · `clipbank.js` · `idles.glb` · `locomotion.glb`) | **1 242 272 B** | 2 / 16 |
+| + first street sit/lean intent | +1 `sitlean.glb` | 1 600 384 B | 3 / 24 |
+| + first interior with browsers | +1 `browse.glb` | 2 076 440 B | 4 / 32 |
+| + first gig night (from the street, `setGig`) | +1 `venue.glb` | 2 602 476 B | 5 / 38 |
+| ever | **never** `social.glb` | — | — |
+| `?clips=0` · `?classic=1` · `?noassets=1` | **0** | 0 | 0 / 0 |
+
+**One honest line on the `?classic=1` fetch delta.** It is zero for ASSETS — no clip GLB, no
+manifest, and not even `clipbank.js` (dynamic import behind the gate). It is **+1 JS module**:
+`postures.js` (7 098 B, pure data + five pure functions) is a static import of `sim.js`/`keepers.js`/
+`band.js` and so is fetched on every boot, exactly as R40's `door_snap.js` (4 017 B) already is. Zero
+asset bytes, zero GLB, zero behaviour under the gate — but stated rather than left to be found.
+
+
+Six fetches at boot was the thing the round warned about; the answer is **two GLBs at boot, three
+on first demand and one never**, and each lazy group is promise-cached so N racing callers cost one fetch (proven:
+the bank does not grow across 6 interior enter/exit cycles). **Heap delta (library ON − OFF),
+`performance.memory` after a forced GC in a fresh context: +3.34 MB and +6.87 MB across two runs** —
+the spread is GC timing, the floor is the resident clip bytes plus parsed `AnimationClip` overhead.
+`mixerMs` is unchanged: median 0.1 ms in both arms, max 0.3 ms vs 0.2 ms.
+
+### Zero draw — before/after, same seed, same bookmarks
+
+| view | `?clips=0` | default | Δ | budget |
+|---|---:|---:|---:|---|
+| street_noon | 193 | 193 | **+0** | ≤300 |
+| crossroads_busy | 108 | 108 | **+0** | ≤300 |
+| night_crowd | 128 | 128 | **+0** | ≤300 |
+| market_square | 94 | 94 | **+0** | ≤300 |
+| night_neon | 111 | 111 | **+0** | ≤300 |
+| interior (record) | 110 | 110 | **+0** | ≤350, margin **240** |
+
+Worst street view over the five bookmarks: **193 both arms**. Ruling 4 gave this round no street
+headroom and the round did not spend any: the clips are skeleton-only (E: tris = 0, meshes = 0,
+materials = 0, images = 0 on all six groups), so the ONLY mechanism by which they could move a draw
+count is repositioning a ped onto a bench or a wall — and that is bounded by the unchanged near-cap
+of 24 rigs, each of which is already one draw. **Caveat stated rather than hidden:** 193 is the worst
+of these five bookmarks on this seed, not the town's global worst; B's R40 number for the street law
+is 291/300 at a night pose these bookmarks do not reach. The delta is the claim, and the delta is 0.
+
+### Leak
+
+`tools/qa/r41_citizens.py` arm 6b: warm the caches with one enter/exit, then **6 more cycles into the
+same shop** — geometries 118 → 118 (**+0**), textures 91 → 92 (**+1**), clip bank flat at 4 groups /
+32 clips. The R2 shared-resource disposal contract still holds with more clips resident:
+`AnimationClip`s hold no GPU resources (these groups are 0 meshes / 0 materials / 0 images), and
+`_disposeInner` still disposes only the clone's own `Skeleton`. Warm-first is deliberate — counting
+cycle 1 measures cold start, not retention, and doing so is what made this arm read `+10` once.
+
+### Gates added (both new files, no collision)
+
+- `node tools/qa/r41_postures.mjs` — zero deps, ~40 ms. Manifest resolution (every pool id resolves
+  with the right category and group, **CONTROL:** a bogus id fails the same resolver) · determinism
+  over 1 000 citizens in two module instances (**CONTROL:** a different seed differs) · stream
+  isolation (the 6 R41 keys collide with none of the 12 pre-R41 keys; **CONTROL:** all 18 streams
+  produce different draws on the same id) · pool spread (all 10 idles, 90–110 each per 1 000) · loop
+  safety (**CONTROL:** the ping-pong class is non-empty).
+- `tools/.venv/bin/python tools/qa/r41_citizens.py` — 7 arms in fresh headless contexts against a
+  no-store server: boot ledger · lazy loading · determinism incl. the **2 s forced-stall** control ·
+  draw table both arms · `?noassets=1` + `?classic=1` · bench binding + control · leak · gig widening.
+- `tools/.venv/bin/python tools/qa/r41_shots.py` — the two acceptance shots, camera chosen by
+  measurement (bench station with the most shop doors around it, occlusion-raycast, then held while
+  the crowd fills in) and every figure measured for stature.
+
+**→ F: three lines for `qa.sh`.** All three exit 0/1 and are deterministic.
+
+### The stature law, and why the first version of it was wrong
+
+The shot harness first checked an absolute seated band `[0.9, 1.5]` m (R16's, written for the
+drummer on `sit.glb`) and called a 1.32 m leaner a failure. It is not one: the library's four wall
+leans take 15–25% off a standing crown **by construction** (you are leaning back), and its four sits
+run from bolt-upright-in-a-chair to slumped. A fixed band is the wrong instrument. What R10 forbids
+is a GIANT and what R16 forbids is a FOLD (keeping `Hips.quaternion` lays the body flat, head at hip
+height). So the gate now reports stature with its ratio to that citizen's own nominal height and
+fails on **stature > 2.0 m**, **stature < 55% of nominal**, or a nominal height outside the seeded
+[1.4, 2.0]. Measured today across both shots: leans 93%, sits 75–86%, browsers/keepers 93–101%,
+walkers 96–99% of nominal. No giant, no fold.
+
+### Shots
+
+- `docs/shots/laneD/r41_street_postures.jpg` (+ `.txt` sidecar with the human-sized line) — seed
+  20261990, camera (11.6, 58.5) yaw −1.890. **8 near-tier rigs, 3 distinct clips**: a hi-vis worker
+  seated on a real Lane B bench, a comical ped walking centre-frame, six more walkers (a third of
+  them on `walk_shopping_bag`). 126 draws / 300.
+- `docs/shots/laneD/r41_browse_interior.jpg` (+ `.txt`) — The Op Shop, 3 browse points: a browser at
+  the clothes rack on `browse_hold_idle` and the keeper at the counter on `idle_happy_1`. 69/350.
+
+Framing note for whoever re-shoots: "inside the frustum" is not "in the picture". Three runs reported
+3–6 rigs in shot while the JPEG showed footpath and a gum-tree billboard. `r41_shots.py` now
+ray-tests every candidate figure from the lens and counts only the ones that can actually be seen,
+and raycasts the camera pose itself (an unchecked "best score" pose put the lens inside a building
+twice — high score, grey wall).
+
+### Goldens
+
+`node web/js/citygen/selfcheck.js` → **157 647/157 647, fingerprint `0x5f76e76`**, unmoved. No citygen
+file was touched.
+
+### Filed to R42
+
+1. **The turn state.** `turn_left_90` / `turn_right_90` / `turn_walk_180` / `turn_in_place` /
+   `walk_to_stand` are shipped and unused because the sim turns instantly at a node. A short turn
+   state at `_advance`'s node branch (hold the ped for the clip's duration, blend the heading) makes
+   five clips real and would kill the remaining tell that these are waypoint walkers.
+2. **`social.glb`.** 8 clips, 896 KB, needs a partner-pairing pass: two peds who arrive at the same
+   loiter within N metres take `social_shake_1`/`_2` (E flagged the pair) or the conversation loop
+   facing each other. The manifest's `pair` field is the whole contract.
+3. **`benchStops(plan)`** from Lane B (above) retires D's mirror.
+4. **`browse_hold_walk` / `browse_hold_turn_*`** want a browser who walks the shop floor rather than
+   standing at a fixed point — Lane C's browse points would need a small path, not a pose.
+
+---
+
+## ROUND 40 (§40.5) — THE DOOR POINTS AND THE FOOTPATH: the kerb clamp + the gate
+
+Summary in `D-progress.md` §Round 40; this is the measured detail a later lane will want.
+
+### Today's numbers (all re-measured 2026-08-04, `tools/qa/door_footpath_check.mjs`)
+
+R39 shipped **0 door points on a footpath corpus-wide** (0/493 · 0/72 · 0/139 · 0/30 — the
+`(−sin,−cos)` sign at `index.html:428`-era, B's lineage table). B's R39 `+sin/+cos` fix, measured
+on today's tree, before any D change:
+
+| town | strict footpath | walkable front | residue classes (walkable) |
+|---|---|---|---|
+| synthetic@20261990 | 447/493 · 90.7% | 473 · 95.9% | shop:carriageway 3 · stall:carriageway 8 · stall:in-a-lot 6 · anchor:off-verge 1 · shop:in-a-lot 2 |
+| katoomba_real | 71/72 · 98.6% | 71 · 98.6% | shop:off-verge 1 (0.85 m) |
+| fitzroy_real | 138/139 · 99.3% | 138 · 99.3% | shop:off-verge 1 (0.85 m) |
+| bowral_real | 28/30 · 93.3% | 28 · 93.3% | shop:off-verge 2 (0.85 m) |
+
+After D's clamp (`door_snap.js` in `sim.setShops`): **katoomba 72/72, fitzroy 139/139, bowral
+30/30 — 100% on both measures; synthetic unchanged at 473/493 walkable (95.9%)**. Corpus
+transitions: fixes 4, breaks 0, moves 7 points total, max move 5.41 m (synthetic) / 0.85 m (real).
+
+### The two residue species, and why they got different answers
+
+1. **The 0.85 m kerb miss (fixed here).** `plan_osm.js:466-468` sets a real-town lot back at
+   `max(KERB, roadWidth(pe)/2 + FOOTPATH)` from the centreline. On corridors where that exceeds
+   `edge.width/2`, the facade stands past the corridor edge, so the shell's door point
+   (`d/2 + 0.6`) lands just OUTSIDE `vergeBand(e)` — off the walkable strip by under a metre. The
+   ped steered to the gutter shadow, not the footpath. `snapDoorToFootpath` clamps the point into
+   `[kerb+0.45, corridorEdge−0.45]` of its nearest footpath-bearing edge. Registry's published
+   split, the sim's own edges — no lots, no plan, no rng, so "sim stays graph-only" holds and same
+   seed → same doors.
+2. **The plaza fronts (measured, deliberately NOT dragged).** The synthetic's big strict-footpath
+   residue is 36 market stalls + arcade shops, 50–73 m from every footpath-bearing edge, fronting
+   the market square / covered arcade. An UNCAPPED snap "passes" them (measured: 488/493 strict)
+   by moving doors up to **59.85 m** onto a main street they do not front — peds would duck into a
+   stall by vanishing at a point three shops away. That is the R8 defect wearing a green tick. The
+   6 m cap exists to forbid exactly this; the gate scores plaza ground as a valid FRONT instead.
+
+### For whoever owns the derivation next (F's shell / B was last in)
+
+The remaining 20 synthetic misses are artefacts of the **fixed nudge** at `web/index.html:433-437`:
+`door = lot + (sin ry, cos ry) · (d/2 + 0.6)` assumes 0.6 m in front of the facade midline is clear
+public ground. On 4.5 m stalls packed in the square, that lands inside the neighbouring stall
+(6 cases) or past the square's kerb line (8); on two synthetic corner shops it clips the cross
+street's carriageway. If a round ever needs those: derive the point from `buildShopfront`'s own
+`doorRect` (buildings.js:410-416, :583-597 — the actual door, not the lot midline) instead of the
+nudge. I did not touch it — not my file, and the gate passes without it.
+
+### The gate (`tools/qa/door_footpath_check.mjs`) — what keeps this honest
+
+- Imports the SHIPPED `door_snap.js` (the sim's code path, not a copy) and replicates the shell's
+  raw derivation; measures both, so a regression in either shows as its own number.
+- **CONTROL:** the back point — the exact R8→R39 defect — must score under the floor on every town
+  (reads 0.4–13.3%). A heading has no falsifiable arm inside the file that computes it (B's R39
+  keeper insight), so this gate carries one.
+- **FIX-ONLY:** the clamp may break 0 previously-passing points, ever.
+- Deterministic (two runs byte-identical), ~2 s, zero deps, exit 0/1. **→ F: one line in qa.sh,
+  please — `node tools/qa/door_footpath_check.mjs` with the other node gates.**
+- Goldens: selfcheck 157,647/157,647, fingerprint `0x5f76e76`, run today after the change.
+
+### Shot
+
+`docs/shots/laneD/r40_front_duckin.jpg` — near-tier rig frozen 3.2 m from the VIDEO BARN door,
+mid-stride ON the footpath under the verandah (staged via the sim's own `_beginVisit` + `setPaused`
+at the threshold; the steering, the stored door point and the entry radius are all shipped code).
+
+---
+
+## ROUND 36 (wave 2.5) — CLASSIC KEEPS ITS PEOPLE: the DJ bodies gated out of `?classic`
+
+**The ruling (Fable, on F's §36.4 held warn):** `b339402` (July 20) appended the 5 trellis'd DJ
+bodies (`woman_dj_01/02/03`, `dj_techno_01`, `dj_phrtt_01`) to `PED_NAMES.normal` UNCONDITIONALLY —
+so `?classic=1` fetched them and its seeded crowd pool widened 17→22, six epochs after the covenant
+froze. Ruled option (b): the five gate OUT of classic's pool, mirroring the sit/look/dance `!CLASSIC`
+clip gates. Classic is the v2 town INCLUDING ITS PEOPLE; the DJs walk every other boot.
+
+**Mechanism (D's call — one file, `rigs.js`, per the wave-2.5 pathspec law):**
+- `PED_NAMES.normal` is restored to the covenanted **base 17** (exact pre-July-20 list, order
+  preserved). The five move to a new `PED_NAMES.djs` extension list.
+- `loadPedFleet` gains **`djs = dance`** — a new opt whose DEFAULT tracks the existing `dance` flag.
+  The shell already passes `dance: !CLASSIC` (index.html:194), so the classic-ness signal arrives
+  with ZERO shell edits: classic ⇒ `dance:false` ⇒ `djs:false` ⇒ no DJ fetch, 17-pool; default ⇒
+  `djs:true` ⇒ all 22. Separable for callers wanting clips without bodies (or vice versa).
+- The roster is built `djs ? [...normal, ...djs] : normal` — the five APPEND, so no base slot is
+  renumbered in either mode: the default-boot 22-list is byte-identical to the pre-ruling list, and
+  classic's 17-list is byte-identical to pre-b339402. `pickRig` maps `r01 * 997 % pool.length`, so
+  pool LENGTH is crowd identity — 17 restores the exact pre-July-20 mapping, not merely the width.
+- Known side effect (accepted, noted): `citizens_test.html` calls `loadPedFleet` with no opts ⇒
+  `dance:false` ⇒ its dev-harness roster shows 17+2, not 22+2. It is not a covenanted surface; a
+  future D round can pass `{djs:true}` there if the harness wants the five back.
+
+**Measured (fresh contexts each, port-isolated no-store servers :8971 current / :8972 pre-b339402
+shadow tree, seed 20261990):**
+
+| check | `?classic=1` (gated) | default boot (gated) |
+|---|---|---|
+| DJ-GLB fetches | **0 of 5** (21 ped-GLB fetches total = 17+2 bodies + walk+idle) | **5 of 5** |
+| pool | **17 normal** / 2 comical / 19 all | **22 normal** / 24 all |
+| crowd census | 129 active, 129 named, **19 distinct — all base-17 ∪ comical, zero DJ** | 153 named street peds incl. **37 DJ-bodied** (techno 13 / w01 8 / phrtt 7 / w03 6 / w02 3) |
+| gig crowd (F's organic proof) | n/a (gig layer absent) | **preserved** — pinned seed's venue crew (12) includes `dj_phrtt_01` + `woman_dj_02` in the crowd |
+| console errors | **0** | **0** |
+
+**The pre-July-20 identity check (the R29 lesson: measure, don't assume):** booted `?classic=1` on a
+shadow tree whose `rigs.js` is `b339402^` (everything else current), same seed, same server law.
+Roster arrays identical; the full 129-citizen census — every `(id, pedRoll, pedIndex, pedName)`
+tuple — is **byte-identical** to the gated tree's classic boot. Classic's crowd is not just 17-wide;
+it is the SAME crowd, ped for ped, as before July 20. (This held by construction — the five were
+appended, so gating them off restores both list content and length — but it is now held by
+measurement too.)
+
+## ROUND 29 — v6 SPIKE 1: `look.glb` bound and wired — peds glance (wave 0)
+
+*PROCITY-D, 2026-07-17. The spike finally reaches the game: E's `look.glb` (mesh-free, 65 joints, 6.5 s
+'Look') is bound through the fleet gate and street peds now glance around during window-shop stops. `lean`
+is not here and never was — E measured the stash (R28). Goldens untouched (clips sit outside every plan
+hash); the synthetic anchor is R27's amended `0x5f76e76`, unchanged by me.*
+
+### What shipped
+- **`rigs.js` — `loadPedFleet(base, { sit, look })`** → `fleet.lookClip`, the exact twin of the R16 sit gate.
+  The shell passes `look: !CLASSIC`, so **`?classic` fetches nothing** — a raw fetch would have breached the
+  zero-fetch-delta covenant (E flagged this; the gate is the answer).
+- **`makeActor({ …, lookClip })`** → a `lookA` action **played only on `setLooking(true)`**, so walkers,
+  placeholders and `?classic` never advance it. `setLooking` **crossfades** (0.3 s) rather than snapping the
+  way sit does — idle → idle-variant reads naturally, and there's no discrete replant for a fade to fight.
+- **`sim.js`** — a dedicated `glance` rng stream (`rng(citySeed,'glance',id)`), rolled **always** (deterministic)
+  but only flipped when a clip exists ⇒ classic inert at the source. **Mutually exclusive with the bench-sit**:
+  the sit rolls first at 35 %, the glance takes 40 % of what's left. `RigPool` threads `lookClip`; release
+  snaps the glance off so no rig is pooled mid-look.
+
+### The finding — I predicted this needed no re-plant, and the measurement said otherwise
+I wrote in my own first draft that a *standing* clip needs no foot re-plant ("no hip descent to recover —
+that trap was sit's alone"). **Wrong, and the numbers caught it:**
+
+| lowest bone over the full loop | idle clip | **look.glb, no plant** |
+|---|---|---|
+| min → max | −0.04 → 0.00 (span **4 cm**) | −0.009 → **+0.205** (span **21 cm**) |
+
+The ped **hovers up to 20.5 cm** (`mixamorigLeftToe_End` clean off the ground), drifting through the loop. It
+is the sit trap wearing a different coat: `_rotOnly` drops the Hips POSITION track (rig-height independence),
+so the clip's authored weight-shift **dip cannot move the hips — it comes out as the feet rising instead**.
+Sit's one-time replant cannot fix it because **the float varies frame to frame**.
+
+**Fix: `plantFeet()` — the per-frame twin of sit's replant.** Reset to the bind plant → measure the posed
+feet → drop `inner` by float / scale. **Absolute (reset→measure→correct), never incremental, so it cannot
+drift.** It reproduces the authored motion *exactly*: the hips dip relative to the ground instead of the feet
+leaving it. Scale-aware like sit's. Foot bones cached once; cost paid **only** by glancing peds, and only on
+frames their mixer actually ran (both mixer sites — the drummer's post-mix lean taught me that coupling rule).
+
+### Proofs
+| | before | after |
+|---|---|---|
+| foot float over the loop | **0.205 m** | **0.000 m** (pinned) |
+| head yaw sweep (the glance itself) | — | **span 1.735** (−0.85 → +0.89) |
+| `?classic`: look fetch / `Look` action / glance flips | — | **none / none / 0** — inert at the source |
+| identity signature | `-1,-1#0:6:0:1.777:1.171:1:-1` | **unchanged — no `glance` term** |
+| sit ∧ glance simultaneously | — | **0** (mutually exclusive) |
+| NaN | 0 | **0** |
+| goldens | `0x5f76e76` | **`0x5f76e76`** untouched |
+
+A glancing ped is **not** tagged `procitySeated`/`procityPosed` — it is a standing pose at standing stature,
+so F's no-giants gate needs no exemption arm for it.
+
+### Handshakes
+- **D → F:** **the pose gate has its subject** — un-SKIP it. A fresh `?localdepot=1` boot shows a ped glancing
+  on the footpath, head sweeping, feet planted (screenshot taken). Classic/`?noassets` untouched.
+- **Spike 2 readiness:** `plantFeet()` is the general machinery the brief wanted ("data, not new code") — the
+  riffle and the wall-lean will land as **clip + roll**, not new pose code. The lean's wall-contact placement
+  is the only genuinely new thing it will need.
+- **Stale line spotted (A's file, A rests):** `selfcheck.js:301` still says *"the synthetic golden above stays
+  0x3fa36874"* while line 267 pins the R27-amended `0x5f76e76`. A comment, not a rule — but it is the same
+  species as the epoch's five holds (a line outliving the case that wrote it), so: flagged, not touched.
+
+---
+
+## ROUND 28 — v5.1 THE SWEEP: instrument LOD — **KILLED with the measurement** (ledger #4)
+
+*PROCITY-D, 2026-07-17. The oldest tri item on the books (v3.1-era). The brief attached the wind-sway rule:
+**"if the measured win is <20k tris in practice, KILL the item with the measurement and it leaves the
+backlog forever."** It does not survive. **E: do not build the `_lo` variants — that work is now unnecessary.***
+
+### The measurement
+Instrument tri counts, parsed straight from the shipped depot GLBs (`web/assets/models/`):
+
+| instrument | tris |
+|---|---|
+| electric_guitar | 14,000 |
+| bass_guitar | 14,000 |
+| drum_kit | 14,000 |
+| guitar_amp | 14,000 |
+| mic_stand | 14,000 |
+| **band + amp, all on stage** | **70,000** |
+
+On paper that clears the bar: a 3–4k `_lo` each would "save" ~52k. **But the rule says *in practice*, and the
+brief named the reason — "interiors are close-quarters."** So I measured the rooms an LOD would have to fire in
+(live, all three venue archetypes, `interiorMode` driven by hand since rAF is throttled):
+
+| venue | room | **max diagonal** | room tris (no band) | draws |
+|---|---|---|---|---|
+| pub — The Exchange Hotel | 9.7 × 9.7 m | 13.7 m | 12,522 | 38 |
+| band_room — The Vinyl Shed | 8.9 × 9.6 m | 13.0 m | 11,699 | 35 |
+| rsl — Wangaratta RSL (biggest) | 12 × 9.4 m | **15.2 m** | 15,115 | 38 |
+
+### The verdict: practical win = **0 tris**. KILLED.
+**A player can never be more than 15.2 m from the band** — that is corner-to-corner in the *largest* venue, and
+the stage sits at one end, so the real stage-to-player max is shorter still. An LOD is a *distance* trade: it
+pays when the subject is small on screen. Inside a ≤15.2 m room the band is never small — it is the subject of
+the gig, and of F's tour money shot. Any sane swap threshold (15–25 m) **never fires**; an aggressive 8 m one
+would fire only in half a room, at a distance where a 3–4 k `_lo` is *visibly* worse with no perceptual cover.
+The win is not "small" — it is **structurally zero**, because the distance the LOD needs does not exist in this
+game. **Per the wind-sway rule: killed, off the backlog forever.**
+
+No budget motivates it either: a venue interior is ~12–15 k tris, ~85 k with the band — comfortably inside the
+200 k stress ceiling E's R22 tri diet restored, at 35–38 draws against a ≤350 ceiling.
+
+### Side-observation for E (NOT a proposal — no breach motivates it)
+All five instruments are **exactly 14,000 tris**, which is a decimator target, not a measurement of the objects:
+a **mic stand does not need 14 k**. If instrument tris ever *do* become the driver of a real breach, the lever is
+a **flat re-decimation by object complexity** (mic stand → ~1 k), which beats any LOD because it needs no
+distance — not a `_lo` swap. Filing the observation so the next tri hunt starts from it; **not** asking for work.
+
+---
+
+## ROUND 23 — v5.0-alpha: the GIG_RANGE chunk-neighbour fix (ledger #6, the carried v4.x item)
+
+*PROCITY-D, 2026-07-16. My own filed finding, finally fixed — post-release, as Fable scheduled. Hot path,
+so the R18-style before/after is the deliverable. `selfcheck` **ALL GREEN 161300/161300**, `0x3fa36874`
+frozen (runtime-only change — no plan, no golden).*
+
+### The finding grew while it waited: 8.7 % → 42.6 %
+I filed this at 8.7 % in R20, measured at katoomba's isolated pub. **A's R21 cluster bias made it worse**:
+venues now sit *inside* the retail cluster, where peds converge from every side rather than trickling along
+one street — so far more in-range peds are across a chunk edge. Re-measured on the relocated venue:
+**42.6 %** of in-gig-range ped-samples (5094 of 11971) were chunk-blind. Fixing it mattered more in R23
+than when I filed it.
+
+### The override: the brief contradicts itself, and the measurement broke the tie
+The brief said *"extend `_nearestOpenShop` to the ped's chunk + 8 neighbours"* **and** *"byte-identical
+flags-off"*. **I built the literal version first and measured it: those two cannot both be true.** On the
+synthetic town (exactly what `?classic=1` boots, gig layer absent), a full 3×3 scan sourced **127 of 855
+finds — 14.9 % — from neighbour chunks**: finds v2 never made. The frozen v2 crowd would start shopping
+~15 % more. That is a covenant breach, in a clause of the same brief that asked for it.
+
+**So the fix is scoped to the GIG path** — which is also what I actually filed (the finding was always
+`GIG_RANGE`-specific):
+- **Ordinary shops → own chunk only.** v2 semantics, frozen. A shopfront is noticed from its own block.
+- **Gig venues → the full 34 m radius, honest across chunk edges.** The gig is the "follow the sound" pull
+  that is *supposed* to reach further — that is the entire reason `GIG_RANGE` (34) > `PATRON_RANGE` (18).
+- **No gig on → `_gigVenues` is empty → the neighbour loop is skipped entirely.** `?classic` and every
+  flags-off boot take the *identical code path and identical cost* to v2. **Byte-identical by construction**,
+  not by measurement luck.
+
+Both ranges are < `CHUNK` (64), so a 3×3 sweep is *exact*, not an approximation; a fixed `dz/dx` order keeps
+exact-distance ties deterministic, as the old single-list scan was.
+
+### Before / after
+| proof | before | after |
+|---|---|---|
+| **cross-chunk in-range peds that see the gig** — katoomba | **0 % by construction**¹ | **4/4 = 100 %** |
+| — fitzroy (densest, worst case) | **0 % by construction**¹ | **11/11 = 100 %** |
+| same-chunk peds (must not change) | 100 % | 100 % |
+| **classic / flags-off: finds sourced from a neighbour** | 0 (v2) | **0** (127 under the rejected full scan) |
+| determinism (2 sims, same seed) | identical | **identical** (identity sets byte-equal) |
+| NaN — katoomba / fitzroy / synthetic | 0 | **0** |
+| sim cost, katoomba @14:00, 236 peds | 0.056 ms/frame | **0.057 ms/frame (+2 %)** |
+| lookup cost/call — no gig on | 0.58 µs | **0.58 µs (loop skipped)** |
+| lookup cost/call — gig on | 0.58 µs | **1.3–2.7 µs** |
+
+¹ *not a small-sample claim: v2 read `shopsByChunk.get(ownChunk)` only, so a venue in another chunk was
+never in the scanned list and could not be returned. 0 % is structural.*
+
+The lookup is 2–4× dearer **while a gig is on**, but it only fires every `PATRON_STRIDE` (10 m walked), not
+per frame — hence **+2 % of a 0.056 ms frame cost**. Against a 16.7 ms budget that is 0.006 %. Fitzroy at 376
+peds stayed clean. Minor known inefficiency: with a gig *scheduled but closed* (e.g. 14:00) the neighbour
+loop still runs for nothing (0.58 → 1.3 µs) — `_gigVenues` holds ids, so testing openness would need the
+lookup it's trying to avoid. Not worth it at +2 %; noted rather than hidden.
+
+### Handshakes
+- **D → F (gate):** the fix is **runtime-only** — no plan, no golden, no flag, no fetch. `?classic=1` takes
+  the identical code path to v2 (loop skipped), so the classic regression is untouched **by construction**.
+  Selfcheck green at 161300. No D-side blocker for `v5.0-alpha`.
+- **Carried (deliberate, documented):** `PATRON_RANGE` keeps v2's own chunk-blindness — an ordinary shop 10 m
+  away across a chunk edge still goes unnoticed. That is now a *frozen v2 quirk*, not an oversight: fixing it
+  costs the classic covenant, and the covenant wins. Revisit only if the covenant is ever relaxed.
+- **Still unowned (unchanged):** R20's main-street relocation half (heroes 0–19 % of the densest cluster).
+
+---
+
+## ROUND 22 — v4.0 THE EPOCH CLOSE: citizens at pack scale (ledger #5)
+
+*PROCITY-D, 2026-07-16. The fitzroy stress audit (160 shops — the densest citizen field this epoch) + the
+thin-tail spot-check. Against A's pack absorb (`3face97`, 23 towns / 36 goldens) — `selfcheck` **ALL GREEN
+161300/161300**, synthetic `0x3fa36874` frozen.*
+
+### Fitzroy stress: PASS — the sim doesn't notice
+| metric | fitzroy_real |
+|---|---|
+| shops | 160 → **139 seated** (21 dropped, counted by cause — A's fence at 2× scale) |
+| graph | **1859 nodes / 2408 edges** (biggest of the epoch) |
+| **active peds** | **376** (avg == max — saturated) |
+| **NaN** | **0** |
+| **sim cost** | **0.08 ms/frame** at 376 peds |
+| chunk rosters / identity sigs | 22 / 454 |
+| venues (A's R21 cluster bias) | 3, **min 8 shops within 160 m** ✓ |
+| patronage | 3086 checks, 79.6 % null, **103 visits** |
+| plan gen | 194 ms |
+
+**Nothing needed touching at 2× scale.** Zero NaN, rosters stream, identity signatures accumulate,
+determinism holds, and the sim layer costs **0.08 ms/frame** with 376 active citizens — the citizen field is
+not a budget risk at any scale this epoch reaches. A's cluster bias survives the mecca (min 8 ≥ the ≥3 bar).
+
+### Thin tail: "does 12 shops still read alive?" — **it depends entirely on CLUSTERING, and one pack town fails**
+I spot-checked **both** 12-shop towns rather than one, because they disagree — and the disagreement is the finding:
+
+| | darwin_real — **ALIVE** | toowoomba_real — **DEAD** |
+|---|---|---|
+| shops / road ways | 12 / 341 | 12 / **866** |
+| **median nearest-neighbour spacing** | **27 m** (a real strip) | **388 m** (14×) |
+| shops within 160 m of the hub | **7 of 12** | **3** |
+| median shop → hub | 101 m | **739 m** (max 2117) |
+| densest cluster | 6 neighbours | **2** |
+| min venue neighbours (A's bias) | 6 ✓ | **1** (no better candidate exists) |
+| open at 14:00 | 9 | **9** (hours are NOT the cause) |
+| patronage | 1455 checks, **18 visits** (13 hero) | 1417 checks, **0 finds, 0 visits** |
+| NaN / sim cost | 0 / 0.05 ms | 0 / 0.05 ms |
+
+**Both towns pass `MIN_TOWN_SHOPS`. One has a high street; the other doesn't.** Darwin's 12 shops sit 27 m
+apart with 7 of them on one strip — it reads as a small town with a main street. Toowoomba's 12 sit ~388 m
+apart across a **4.6 km** road network: **1417 patronage checks returned zero finds** and no citizen shopped
+once in the whole soak. It isn't a shopping town — it's a road network with occasional shops. (I verified
+this is real, not my R20-style sampling error: shops are **open**, camera stood on the town's own densest
+point, and that point only has 3 shops within 160 m.)
+
+**→ FILED for E / Fable (curation, not code): the floor measures the wrong thing.** `MIN_TOWN_SHOPS` counts
+shops; what makes a town read alive is whether they **cluster**. A cheap curation test that separates these
+two cleanly: **"≥5 shops within 160 m of the town's densest point"** — darwin 7 PASS, toowoomba 3 FAIL.
+Toowoomba is in the v4.0 pack today and has no main street to walk. Cull it, or accept it as a known
+thin-tail (it costs nothing — 0 NaN, 0.05 ms/frame — it just has nothing to do). **E/Fable's call, not mine**;
+A's venue bias is *correctly* exempting it ("no better candidate"), so this is a pack-curation question.
+
+### Handshakes
+- **D → F (gate):** citizens at pack scale **GREEN**. 23-town pack: fitzroy (160 shops / 376 peds) clean at
+  0 NaN and 0.08 ms/frame, thin tail stable, determinism + rosters + identity hold everywhere. **No D-side
+  blocker for `v4.0`.** The toowoomba item is curation, not a citizen defect — tag isn't gated on it from me.
+- **Carried to v4.x (unchanged):** `GIG_RANGE` 34 m radius vs the single-chunk `_nearestOpenShop` lookup
+  (8.7 % of in-range peds chunk-blind; fix = chunk + 8 neighbours).
+- **Still unowned (last flag before the retro):** R20's *main-street relocation* half — heroes are a
+  0–19 % minority of the densest cluster on the widened towns (fitzroy: 13 hero vs 90 texture visits). E's
+  3× texture cap bounds the ratio town-wide; whether the **hero strip is the densest cluster** was never
+  verified. If it matters for v4.x, it's a one-call re-run of this harness.
+
+---
+
+## ROUND 21 — v4.0-beta CLOSE: relocation verify (ledger #4)
+
+*PROCITY-D, 2026-07-16. Verifying A's venue cluster-adjacency bias (`110c828`), which Fable assigned from
+my R20 relocation finding. `selfcheck` **ALL GREEN 154141/154141** against A's re-pinned goldens.*
+
+### Verdict: A's bias PASSES acceptance on all five — my finding is closed
+Acceptance was "no venue sits with <3 shops in its 160 m radius." Shops within 160 m @ distance-to-retail-hub,
+before (R20) → after (R21):
+
+| town | min shops in 160 m | before → after |
+|---|---|---|
+| katoomba_real | **9** PASS | **pub 1→9 @1007→466 m** · rsl 10→12 @161→148 m · band_room 7→10 @181→161 m |
+| newtown_real | **5** PASS | **rsl 1→11 @2228→29 m** · band_room 0→7 @2433→124 m · pub 0→5 @2190→714 m |
+| bendigo_real | **5** PASS | rsl 0→10 @451→86 m · band_room 0→10 @1157→96 m · pub 1→5 @504→316 m |
+| castlemaine_real | **4** PASS | pub 1→5 @223→182 m · band_room 6→6 @0 m · rsl 4→4 @155 m |
+| fremantle_real | **3** PASS* | band_room 2→8 @612→309 m · *pub 1→3 @969→**1352 m*** · *rsl 2→3 @561→**1292 m*** |
+
+**My R20 headline is fixed**: katoomba's pub — "a gig with no passing crowd", 1 shop at 1007 m — now sits at
+**466 m with 9 shops**. Newtown is the dramatic one: all three venues were **2.2–2.4 km out with 0–1 shops**;
+the rsl now sits **29 m from the hub with 11**. Castlemaine's floor did NOT need an exemption (min 4).
+
+### The crowd followed — katoomba's pub, same density/seed/21:00
+| | R20 (pre-bias) | **R21 (post-bias)** |
+|---|---|---|
+| passing crowd (maxActive) | 34 | **66** (2×) |
+| patron checks | 226 | **442** (2×) |
+| inside frames | 1042 | **1424** |
+| tonightRoster | 2 | **3** |
+| NaN | 0 | **0** |
+
+The "gig with no passing crowd" observation is retired. (null % stays ~96 % at 21:00 — retail is shut at night
+**by design**; that's my own R20 correction, not a leak.)
+
+### Two readings that need care (so nobody mis-reads my own numbers)
+- ***fremantle is the weakest pass** (\*): its pub/rsl clear the ≥3 bar but moved **further** from the primary
+  hub (969→1352 m, 561→1292 m) — A's bias optimises **local cluster adjacency**, and fremantle's venues found
+  a *secondary* cluster. It satisfies the letter of acceptance and the crowd is healthy in practice (pub:
+  roster **6**, inside **2741**, maxActive **72**), so I'm **not** calling it a miss — just naming it, since
+  "3 shops at 1.3 km" is a thinner high street than katoomba's "9 shops at 466 m". A's call if they want it tighter.
+- **venue-win % DROPPING is not a regression.** newtown's rsl went 100 %→**21 %**, fremantle's pub 100 %→62 %.
+  That metric asks "when a check finds a shop, is it the venue?" — it was only ever 100 % because the venue
+  was *alone*. Post-bias the venue has real neighbours competing for finds, while total crowd went **up**
+  (newtown rsl: roster 3, inside 1873, maxActive 55). Isolation flatters that number; ignore it post-bias.
+
+### Handshakes
+- **D → F (gate):** relocation verify **GREEN**. All five towns pass A's acceptance, the pub finding is closed,
+  0 NaN at every venue, rosters populate. No D-side gate concern for `v4.0-beta`.
+- **FYI F:** `selfcheck` scans **every** `web/assets/towns/*.json` on disk, including E's *untracked* pack WIP.
+  I saw it transiently RED mid-round (`newcastle_real`: no open-late shop) purely from E's in-flight files, then
+  green again minutes later at 154141 checks. If you gate while E is mid-fetch you may catch a false red —
+  E's pack is non-gating, so check whether a failure is a pack town before believing it.
+- **Still filed for v4.x (agreed, not a mid-beta change):** `GIG_RANGE` is a 34 m radius but `_nearestOpenShop`
+  searches only the ped's own 64 m chunk → 8.7 % of in-range peds are chunk-blind. Fix = chunk + 8 neighbours.
+- **Unowned from R20:** the *main-street* relocation half (heroes 0–19 % of the densest cluster; castlemaine's
+  main street has zero secondhand shops). E's R20 SUBTLE guardrails (texture capped at 3× heroes) address the
+  ratio town-wide; whether the **hero strip is again the densest cluster** is unverified. Not in my R21 ledger —
+  flagging it so it doesn't get lost at the epoch close.
+
+---
+
+## ROUND 20 — v4.0-beta THE FIVE TOWNS: citizens at density (ledger #7)
+
+*PROCITY-D, 2026-07-16. Part 1 of 2: the **pre-density baseline** — the gig crowd's behaviour on all five
+real towns' venues (F's district gate owns placement; I own behaviour). This half is unblocked; the density
+re-audit waits on E's widened caches → A's absorb. Deliberately measured BEFORE the widening so the
+after-table is a real A/B.*
+
+### The gig crowd is behaviourally CORRECT on all five real towns
+Per town: stream sim on the real graph, `setGig` on its first venue, 21:00, camera at the venue, ~1400
+frames. Every town generates 3 venues (pub/band_room/rsl — charter's 2–4) on night hours.
+
+| town | shops | door chunks | patron checks | **null %** | hit venue | **venue win %** | roster | NaN |
+|---|---|---|---|---|---|---|---|---|
+| katoomba_real | 19 | ~5 | 703 | 97.3 | 14 | 74 | 2 | **0** |
+| newtown_real | 18 | 15 | 267 | 95.5 | 12 | **100** | 4 | **0** |
+| fremantle_real | 20 | 16 | 429 | 94.9 | 22 | **100** | 7 | **0** |
+| bendigo_real | 9 | 9 | 343 | 97.7 | 8 | **100** | 3 | **0** |
+| castlemaine_real | 6 | 5 | 364 | 95.9 | 6 | 40 | 4 | **0** |
+
+- **0 NaN on all five.** The gig crowd is numerically safe on every real graph.
+- **`tonightRoster` populates on all five** (2–7) — R14 identity continuity holds on real bones.
+- **Venue-win % is the surge working**: whenever the patronage check finds *any* shop, the gig venue beats
+  ordinary shopfronts (GIG_RANGE/gigBest preference) — 100% on three towns, 74% on katoomba.
+  **castlemaine's 40% is not a leak**: at the 6-shop floor, 3 of its 6 shops ARE venues, so the "other
+  shop" hits are mostly *other venues*. A quirk of the sparse floor, not the mechanism.
+
+### CORRECTION to my own first read of that null % — I misattributed it (measurement wins)
+My first pass called the 94.9–97.7 % null rate "the crowd is sparsity-throttled" and made it the headline
+before/after metric. **Both halves of that were wrong, and I'm correcting the record:**
+1. **It was measured at gig hours.** At 21:00 only **4 of 69** katoomba shops are open — retail is shut *by
+   design*. A high null rate at 21:00 is **correct night behaviour**, not sparsity. The gig IS the nightlife.
+2. **It was sampled at each town's first venue** (`shops.find(s => s.venue)`). For katoomba that is the
+   **pub, which sits 1,000 m from the retail cluster with 1 neighbour** — I had parked the camera on the one
+   isolated venue in town. Measured there, the daytime null was 99.4 % with **0 visits**; measured on the
+   actual main street, the same town same seed gives **77.2 % and 64 visits**. The number was an artefact of
+   where I stood.
+
+The gig-crowd table above still **stands** — it measures the *mechanism* (0 NaN, rosters populate,
+venue-win %), which is location-independent. Only the sparsity interpretation was bad.
+
+### The real density A/B — the main street, retail hours (14:00), same seed, like-for-like
+Camera on the **densest retail cluster** (the actual main street), pre-widening cache (from git) vs E's
+widened cache, 2,000 frames each:
+
+| main street @14:00 | PRE (20 shops) | **POST (80 shops)** |
+|---|---|---|
+| hub density (shops within 160 m) | 8 | **25** |
+| null % | 90.2 | **77.2** |
+| **total visits** | 17 | **64** (3.8×) |
+| **hero visits** (opshop/book/record/video/pawn/toy) | 17 | **19** |
+| texture visits (milkbar/dept/stall) | 0 | 45 |
+| hero share of visits | 100 % | **30 %** |
+| hero share of shops | 84 % | 26 % |
+| NaN | 0 | 0 |
+
+**The widening lands John's directive, measured from the crowd side.** The secondhand heroes did **not**
+lose footfall — they went **17 → 19 visits**. The 45 texture visits are added *on top*, not taken from them.
+The street is **3.8× busier** while the heroes stay **over-indexed** (26 % of shops, 30 % of visits). That is
+precisely "the player should notice the town feels more alive, not that the game changed."
+
+### Filed, not fixed
+- **Venue placement at density (A/F):** katoomba's 3 venues — rsl **13** shops within 160 m, band_room **10**,
+  **pub 1** (1,000 m from the cluster). A gig at the pub has almost no passing retail crowd. It still draws a
+  roster (peds stream everywhere), so it's a *quality* observation, not a break. Placement is A's/F's lane.
+- **`GIG_RANGE` vs the chunk lookup (mine):** GIG_RANGE is a 34 m *radius*, but `_nearestOpenShop` searches
+  only the ped's own 64 m chunk, so an in-range ped across a chunk edge is blind to the gig — **8.7 %** of
+  in-range ped-samples (852/9,740). Real but small; a hot-path change mid-beta isn't worth it. Fix (chunk +
+  8 neighbours) is a v4.x candidate.
+
+### FINAL — post A's absorb (`5d29863`), all five towns at density
+A's absorb landed (capacity widened, goldens pinned, `selfcheck` **51866/51866**). Re-ran everything against
+the absorbed graph. **The katoomba numbers barely moved** (null 77.2→78.1, visits 64→62, hero share 30→29 %)
+— the pre-absorb read was already sound.
+
+| town | cache→seated | hub | null % | visits | hero | texture | hero share | NaN | maxActive | rosters | sigs |
+|---|---|---|---|---|---|---|---|---|---|---|---|
+| katoomba_real | 80→72 (8) | 26 | 78.1 | 62 | 18 | 44 | 29 % | **0** | 217 | 15 | 262 |
+| fremantle_real | 80→79 (1) | 29 | 71.1 | 116 | 23 | 93 | 20 % | **0** | 401 | 24 | 483 |
+| newtown_real | 72→67 (5) | 12 | 85.9 | 44 | 6 | 38 | 14 % | **0** | 268 | 19 | 324 |
+| bendigo_real | 36→35 (1) | 14 | 87.2 | 45 | 1 | 44 | 2 % | **0** | 358 | 21 | 432 |
+| castlemaine_real | 24→23 (1) | 6 | 94.9 | 9 | 0 | 9 | 0 % | **0** | 295 | 20 | 359 |
+
+**Sim verdict: zero changes needed at 4× density.** 0 NaN on all five, chunk rosters stream (15–24), identity
+signatures accumulate (262–483), patronage/loiter/bench-sit all fire, up to **401 active peds** with no
+degradation. Determinism unchanged (identity is graph+seed keyed; shops don't touch it). **D→F: green.**
+
+### THE FINDING → for E / C / Fable: the widening MOVED the main street off the secondhand strip
+The hero share falling (29→0 %) is **not** a behaviour bug — patronage is type-agnostic, so visits track the
+*local* shop mix exactly. The mix is the story. Main street = the densest shop cluster (what "walk the main
+street" means to a player):
+
+| town | main-st shops | **heroes on main st** | hero % of main st | town-wide hero % | **hub moved** |
+|---|---|---|---|---|---|
+| katoomba | 9 → **27** | **9 (100 %) → 5** | 100 % → **19 %** | 25 % | **308 m** |
+| fremantle | — → 30 | 5 | **17 %** | 25 % | — |
+| newtown | — → 13 | 2 | **15 %** | 27 % | — |
+| bendigo | — → 15 | 1 | **7 %** | 25 % | — |
+| castlemaine | 3 → **7** | **1 → 0** | 33 % → **0 %** | 20 % | **434 m** |
+
+**Pre-widening the densest cluster WAS the secondhand strip** (katoomba: 9 of 9 main-street shops were
+heroes). Post-widening the town's centre of gravity **relocated 308–434 m onto the general-retail cluster**,
+where the heroes are a **0–19 % minority**. Castlemaine's main street now has **zero** secondhand shops
+(0 of 4 heroes within 160 m of its hub; median hero is 463 m away). The heroes weren't drowned *in place* —
+they were **demoted**: the liveliest street in town is no longer theirs.
+
+- **The good half stands:** heroes kept their absolute footfall (katoomba 17 → 18 visits) and the street is
+  **3.8× busier**. The widening works; it just overshot the dial.
+- **This is exactly the case John's directive pre-authorised:** *"if a real town's general retail would drown
+  the secondhand strip visually, E may seed-subsample the texture classes (count it, like every drop)."*
+  My read (measurement, not a ruling — E/C/Fable own it): **subsample texture until the secondhand strip is
+  again the town's densest cluster.** The sparse towns need it most (bendigo 7 %, castlemaine 0 %); katoomba
+  at 19 % is borderline. A hero-adjacency bias on texture seating would be the alternative lever (A's).
+
+### Also filed — venue placement at density (A / F)
+Venues are seeded from the shop pool, and at real density they land **off** the retail hub:
+
+| town | venue distance to hub (shops within 160 m) |
+|---|---|
+| katoomba | pub **1007 m (1)** · rsl 161 m (10) · band_room 181 m (7) |
+| fremantle | pub 969 m (1) · rsl 561 m (2) · band_room 612 m (2) |
+| **newtown** | **all three 2190–2433 m (0–1)** |
+| bendigo | pub 504 m (1) · rsl 451 m (0) · band_room 1157 m (0) |
+| castlemaine | band_room **0 m (6)** · rsl 155 m (4) · pub 223 m (1) |
+
+A gig 2.4 km from the high street has no passing retail trade. A's `5d29863` "pub facade bias" fixed frontage,
+not town position — katoomba's pub is still 1007 m out with 1 neighbour. Crowd still forms (peds stream with
+the camera), so it's a **quality** call, not a break — but "venue placement still lands" is in A's ledger and
+F's district gate, so it's theirs. Castlemaine shows the good case (band_room *on* the hub).
+
+---
+
 ## ROUND 19 — v4.0-alpha CLOSE: the fragmentation re-measure (ledger #3)
 
 *PROCITY-D, 2026-07-16. A resolved my R18 finding (commit `6fc4b40`: junction-protected DP + bridge-joins

docs/LANES/LANE_G_GODVERSE.md

@@ -0,0 +1,43 @@
+# Lane G — GODVERSE (the marriage lane)
+
+**Who:** runs on **ultra** (John's M1 Ultra — the machine with the thriftgod/dealgod Postgres),
+branch `lane-G-godverse`. Fable-on-ultra integrates this side; your integrator rules on anything
+that touches A–F's files. **This lane owns:** `pipeline/godverse_*.py`,
+`web/assets/towns/*_godverse.json`, this brief, `G-progress.md`. It touches nothing else without
+a ruling.
+
+## Mission
+
+PROCITY built the town; GODVERSE has the *census*. thriftgod's Postgres holds **2,928 real
+Australian secondhand shops** (names, types, lat/lng, suburbs, opening hours — DealGod-scraped,
+OSM-anchored) and dealgod holds **1.77M real items with photos**. Lane G plugs that real world
+into your engine, in slices, without disturbing the v4 lanes:
+
+1. **Real shops on real streets** (LANDED, first cut) — `pipeline/godverse_town.py` marries an
+   existing OSM cache's `roads[]` with thriftgod's real shop census for the same bbox →
+   `<town>_godverse.json` (`source: "godverse+osm"`, schema v2 unchanged). First artifact:
+   `newtown_godverse` — 18 real Newtown shops (5 record, 6 opshop, 4 book…) on the real 1,086-road
+   graph. Boots clean: `?plansrc=osm&town=newtown_godverse`.
+2. **Real stock in the bins** (NEXT) — your `?stock=real` hook + `build_stock_pack.py` atlases,
+   fed from dealgod's live per-shop inventory instead of a static TSV. Contract sketch in
+   G-progress.md; needs your ruling on atlas budgets per interior.
+3. **The economy backend** (LATER, the big one) — thriftgod's server (items, basket, buy/sell,
+   GodBay, THE BIBLE) as the transactional brain behind your interiors. Design doc first; nothing
+   moves without both integrators agreeing.
+
+## House-law compliance
+
+Seeded everything ✓ (adapter is deterministic; no RNG). Zero-asset law untouched ✓ (a godverse
+cache is just another town JSON). Licensing: shop names/locations are OSM-derived (ODbL,
+attribution kept) + DealGod's own scrape; item photos are the stores' own product shots —
+🟢 for the in-house games, flag before any public/commercial release.
+
+## Open asks for the m3 crew (see G-progress.md for detail)
+
+- **The Draco ruling** — your GLB law says no Draco; ultra's new thriftgod hero props are
+  Draco-compressed. Pick one law for the shared depot; either side can re-emit.
+- **Per-town bookmark coords** — `DBG.bookmarks` teleports assume the synthetic town; on OSM
+  towns they land inside geometry.
+- **Density fence** for godverse caches — 18 real shops across a full suburb bbox is sparse by
+  your round-20 standards; consider bbox-cropping godverse towns to the retail spine (King St)
+  or letting the R20 density widening backfill non-census buildings.

docs/LANES/ROUND20_INSTRUCTIONS.md

@@ -0,0 +1,102 @@
+# PROCITY — Round 20 lane instructions (from Fable, integrator)
+
+Date: 2026-07-16 · **v4.0-alpha SHIPPED** (tag on origin, `ddd1e68`). The alpha close was textbook:
+A's junction-protected Douglas–Peucker + bridge/cull took Katoomba from **105 components → 1**
+(100% street-metres connected, 0 silently-stranded shops — every drop counted), D re-measured with
+the R18 harness and confirmed the ruling landed clean (near-crowd on fragments: ~10% → 0%), F
+landed B's `BIG_CITY` one-liner early exactly as ordered (280k → 12k tris in play) and gated the
+close, B shipped the town selector with **zero shell seam** (hud.js owns it end-to-end) plus the
+corner-strip spot-check, C re-soaked 19/19 doors, E stayed cleanly on-call. The money shot is the
+epoch thesis made real: Katoomba's actual main street — asphalt, zebra crossing, walking crowd,
+gig posters, PROCITY's look on real bones. All five real-town goldens are pinned.
+
+Round 20 is **v4.0-beta: THE FIVE TOWNS** — the two honest alpha findings become the beta's
+headline (density), the tram gets its ruling, and every real town is proven end-to-end. Tag
+**`v4.0-beta`** at close.
+
+## The two filed findings that shape this round
+
+1. **Poster density scales with edges, not shops** (A's R19 finding + F's one open budget edge):
+   real Katoomba emits **438 posters** (~14 on synthetic), which reads busy and drives the one
+   matrix breach — `venue_night` at **200,965 tris (+0.5% over the 200k soft ceiling)**. In-play
+   views are fine (121k); this is the stress view.
+2. **Real towns are sparse** (F's density note): 19 secondhand shops spread across a whole real
+   town ⇒ a real *street* with life on it, not a retail strip. The vision says "walk the actual
+   main street" — main streets have bakeries, cafes, chemists, clothes shops. We fetch only the
+   thriftgod heritage classes.
+
+## The ledger
+
+1. **Poster cap (A).** Cap spine posters per real town — seeded subsample of the pole run,
+   scaled by shop count not edge count (you own the number; ~2–3× the synthetic feel is the
+   target, not 438). Real-town goldens re-pin (amendment law, one commit); synthetic + gig
+   frozen. This closes F's venue_night edge — tell F to re-measure.
+2. **THE DENSITY WIDENING (the beta headline — C rules, E fetches, A absorbs).** Fable's ruling
+   (John veto in Standing): real towns fetch **general retail**, not just secondhand — the main
+   street should hold its real bakery, cafe, chemist, newsagent, clothes shops. Mechanics:
+   - **C publishes FIRST**: the OSM-class → registry-archetype mapping table (e.g. cafe/bakery →
+     `milkbar`, pharmacy/newsagent/clothes → `retail`/`opshop` flavors — C owns which existing
+     archetype each class wears; **no new archetypes this round**, the mapping is the deliverable;
+     your R18 proof says unknowns degrade safely anyway). Publish in LANE_C_PUB (v4-beta marker).
+   - **E re-fetches** with the widened `shop=*` class list (same bbox, raw-cached, one more
+     Overpass pass per town under the standing authorization), maps per C's table, re-emits the
+     five caches (v2, deterministic) + **`web/assets/towns/index.json`** (key, town, state, shop
+     count, roads flag) so B's selector stops hardcoding `REAL_TOWNS`.
+   - **A absorbs the density**: five towns re-run at 3–6× shop count — seating capacity, overflow
+     accounting (`norm.dropped` stays honest), venue placement still lands, goldens re-pin once
+     at the end. If a town's real density overwhelms an edge, widen capacity or split runs —
+     your R18 overflow fence, now load-tested.
+3. **The tram ruling (B).** Alpha left the tram on an arbitrary longest-chain (21% of mains).
+   Beta ruling: **route by shop adjacency** — pick the main chain whose edges front the most
+   shops (the actual high street; on synthetic towns this must resolve to the current spine so
+   the goldens/feel don't move). If the shop-adjacent chain reads wrong on any real town, fence
+   the tram per-town instead (the `edges > 200` signal you left ready) and say which towns run it.
+4. **Ground polish at real intersections (B).** The R19 spot-check accepted overlap-fill; now the
+   finer pass: acute-angle junctions and z-fighting at the 58 degree-4 intersections. Fix what's
+   cheap, file what's structural (A's lot geometry) with measurements.
+5. **Selector polish (B + F).** Derive towns from E's `index.json` (drop the hardcode); F rules
+   the gating (always-on HUD vs `?dbg`) at close — F's call, one line either way.
+6. **Interiors across the five (C).** After E's widened caches land: sampled door-soak per town
+   (the R18/R19 harness — every town, sampled doors at the new density, all types resolve, no
+   carve fails, budgets). One table, five rows.
+7. **Citizens at density (D).** Re-run the R18 audit on the densest post-widening town: patronage
+   at 3–6× targets, chunk rosters, determinism, identity — and the gig crowd on all five towns'
+   venues (the district gate covers placement; you cover behaviour). Cheap by design — your
+   scaffolds exist. File anything that leaks with measurements.
+8. **The beta gate (F, last).** Full five-town matrix on real roads (boot/determinism/budget/
+   district/noassets/roads per town), the venue_night re-measure post-poster-cap (the +965 edge
+   must close), classic + default gates frozen as ever, selector gating ruling, beta money shot
+   (the densest real main street at golden hour — the retail strip reading), docs (README beta
+   paragraph, notes §20), tag **`v4.0-beta`**, push (standing authorization).
+
+## Laws
+
+Charter (V4_REAL_MAP.md) unchanged. Golden discipline this round: real-town goldens re-pin
+**twice at most** (A's poster cap; A's density absorb — batch them if the timing allows), each
+under the amendment law; synthetic `0x3fa36874`, gig `0xb1d48ea1`, fixtures — frozen. E's caches
+stay deterministic (same raw → same cache); the widened fetch is a NEW raw snapshot, committed
+like the first. Budgets unchanged and now measured at real density — if the widened towns bust
+them in play (not just stress views), that's a Fable scope call, say so loudly.
+
+## Order
+
+**C's mapping table first** (half-day rule — E builds to it), **A's poster cap in parallel**
+(independent). Then **E** (fetch + re-emit + index), then **A absorbs**, then **B / C / D**
+verify at density (B's tram + ground items are independent of density — start anytime). **F
+last.** Handshakes: C→E the table; E→A "caches re-emitted"; A→all "densities absorbed, goldens
+pinned"; B→F tram verdict + selector; C/D→F density verdicts.
+
+## Standing
+
+- **John — the density widening is APPROVED (kickoff, 2026-07-16), with one directive: SUBTLE.**
+  John: "subtle changes are great." Interpretation for C + E: general retail is **texture, not
+  takeover** — the secondhand shops stay the heroes of the town (they're the game). Practically:
+  keep the widened class list tasteful (the everyday main-street staples, not every OSM `shop=*`
+  value); if a real town's retail would drown the secondhand strip visually, E may seed-subsample
+  the texture classes (count it, like every drop). The player should notice the town feels more
+  alive, not that the game changed. FYI standing: tram routes by shop adjacency (B may fence
+  per-town); the selector ships from an index; poster density gets capped.
+- **v4.0 preview (next round, do not start):** the curated town pack (~15–25 towns through E's
+  pipeline at scale) · the release tour on real streets · docs freeze · the `v4.0` tag.
+- **Backlog:** instrument LOD · tram tri diet · audioEmitter · flag retirement · awning ripple ·
+  editor · multiplayer.

docs/LANES/ROUND21_INSTRUCTIONS.md

@@ -0,0 +1,91 @@
+# PROCITY — Round 21 lane instructions (from Fable, integrator)
+
+Date: 2026-07-16 · **R20 verdict: the density round delivered — but the beta is NOT tagged.**
+What landed (all verified in notes): **A** capped posters 438→31 (+ a new `REAL_TOWN_GIG_GOLDENS`
+guard) and absorbed the 3–6× densities (292 shops across five towns, drops down to 5.5% and now
+counted BY CAUSE, pub facade bias extended, goldens re-pinned once); **C** published the
+class→archetype mapping; **E** widened the fetch under John's SUBTLE directive — enforced by
+construction (heroes never subsampled, texture capped at 3× heroes, deterministic seed-subsample,
+every drop counted); **B** ruled the tram by shop adjacency (the alpha tram fronted 0 shops on 4
+of 5 real towns — "it really was a highway bus"), fenced katoomba/fremantle/bendigo per the
+fallback, and found+fixed the phantom-stop bug (Newtown: 149 stops → 16); **D** delivered the
+density A/B — heroes kept footfall (17→19 visits) while the street got 3.8× busier — and published
+a model self-correction (the sparsity null% was an artefact of measuring at 21:00 from the one
+isolated venue; the record is corrected in place). Quality is at series-best.
+
+**Open (why there's no tag):** F never ran (gate + tag), C's density door-soak (R20 ledger #6)
+wasn't done, B never consumed E's `index.json` (`hud.js:11` still hardcodes `REAL_TOWNS`), and D
+filed the **main-street relocation finding**: katoomba's pub sits 1,000 m from the retail cluster
+(1 shop within 160 m vs the RSL's 13) — a gig with no passing crowd. Round 21 closes all of it.
+Tag **`v4.0-beta`** at close.
+
+## The ledger
+
+1. **Venue cluster bias (A — D's relocation finding).** At real-town density, venue candidates
+   should prefer retail-cluster adjacency: bias `pickVenues` toward candidates with ≥N shops
+   within ~160 m (you own N and the weighting; keep the kind placement flavors — pub corner,
+   band_room fringe, rsl off-spine — as biases within the cluster-adjacent set, not absolutes).
+   **Synthetic + fixtures must be a no-op** (goldens frozen — the synthetic town is one dense
+   cluster anyway); real-town goldens re-pin ONCE (base+gig, amendment law). Acceptance: no venue
+   in any of the five towns sits with <3 shops in its 160 m radius unless the town genuinely has
+   no better candidate (castlemaine's floor may — say so if it does).
+2. **Selector from the index (B — the missed R20 #5).** Drop the `hud.js:11` hardcode; fetch
+   E's `web/assets/towns/index.json` (fail-soft: index missing → current hardcode as fallback,
+   zero errors). Selector shows shop counts from the index if it's cheap. Nothing else — your
+   tram/ground work is done and verified.
+3. **Density door-soak (C — the missed R20 #6).** The five towns at their new densities, sampled
+   doors per town (~25/town covers every archetype incl. the texture classes' first real
+   appearance — milkbar/dept/stall interiors on real shops), assert valid interiors / no carve /
+   budgets / types resolve per your §6 table. One table, five rows. **Run AFTER A lands** (venue
+   relocation changes which lots are venues).
+4. **Relocation verify (D).** After A: re-run the katoomba venue-adjacency numbers (the pub
+   should now sit in/near the cluster; your venue-win % and the "gig with no passing crowd"
+   observation should improve). One before/after line per town. Your GIG_RANGE chunk-blindness
+   finding stays filed for v4.x (agreed — not a mid-beta hot-path change).
+5. **Town-pack pull-forward (E — NON-GATING for the tag).** Begin v4.0's curated pack: propose
+   the candidate list (~15–25 AU towns with real secondhand density — you have the data instincts
+   from the first five), fetch + emit as **data-only commits** (same discipline: bounded bbox,
+   raw snapshots, C's mapping, SUBTLE guardrails, index.json grows). A absorbs + pins in R22 —
+   do NOT block the beta tag on any of it. If Overpass rate-limits at pack scale, batch politely
+   (sleep between towns) — the standing auth covers the fetches, courtesy covers the cadence.
+6. **The beta gate (F, last).**
+   a. Five-town matrix at density (boot/determinism/budget/district/noassets/roads), against A's
+      R21 re-pinned goldens.
+   b. **`venue_night` re-measure** — A's poster cap must close your +965-tri edge; record the
+      new number.
+   c. Tram in the matrix: newtown + castlemaine RUN (stops sane), the three fenced towns show
+      no tram and no errors (B's fence signal).
+   d. **Selector gating ruling** (your R19 open call): always-in-HUD vs `?dbg`-gated — rule it,
+      one line, done.
+   e. Beta money shot: the densest real main street at golden hour (fremantle or katoomba
+      post-widening — continuous shopfronts, crowd, heroes among texture), into
+      `docs/shots/v4_beta/`.
+   f. Docs (README beta paragraph, LANE_F_NOTES §20/§21 incl. the honest why-R20-had-no-tag
+      record), tag **`v4.0-beta`**, push (standing authorization).
+
+## Laws
+
+Charter unchanged. One golden move this round (A's #1, batched base+gig, once). Synthetic
+`0x3fa36874`, gig `0xb1d48ea1`, fixtures, classic — frozen. E's pack commits are data-only and
+touch no golden until A absorbs them (R22).
+
+## THE EXACT RUN ORDER (John asked)
+
+1. **Start together: A + B + E.** (A: venue bias — the only golden-moving item, the round's
+   spine. B: selector-from-index — independent. E: town-pack fetches — independent, non-gating.)
+2. **When A commits (goldens re-pinned): start C + D.** (C: door-soak on the relocated world.
+   D: relocation verify. Both read A's handshake note for the new goldens.)
+3. **When C + D have committed (and B is in): start F.** (E does NOT gate F — if E's pack is
+   still fetching, F tags without it.)
+
+Three waves: **[A, B, E] → [C, D] → [F].**
+
+## Standing
+
+- **John — nothing blocks this round.** FYI: Fable assigned D's relocation finding to A as a
+  cluster-adjacency bias (real towns only, synthetic untouched); E begins the v4.0 town pack
+  early as data-only commits. Both are course-corrections inside the chartered epoch.
+- **v4.0 preview (R22, do not start beyond E's data):** A absorbs + pins the pack · the release
+  tour on real streets · docs freeze across lanes · the `v4.0` tag · then the epoch retro.
+- **Backlog:** GIG_RANGE chunk-neighbour lookup (D, v4.x) · instrument LOD · tram tri diet ·
+  audioEmitter · flag retirement · awning ripple · editor · multiplayer.

docs/LANES/ROUND22_INSTRUCTIONS.md

@@ -0,0 +1,96 @@
+# PROCITY — Round 22 lane instructions (from Fable, integrator)
+
+Date: 2026-07-16 · **v4.0-beta SHIPPED** (`201a2bb`, tag on origin; matrix 10 towns × 7 gates
+green; qa `--strict` GREEN; selfcheck now 161k). R21 review, short: A's cluster bias turned out
+to fix a **systemic** stranding (11 of 15 venues under threshold → 0 of 15; Newtown's RSL moved
+2,228 m → 29 m from the retail hub), D closed its own finding with the before/after table, B and
+C cleared the missed R20 items, E pulled the entire v4.0 town pack forward (**22 towns · 1,192
+shops · 298 heroes · all 8 states/territories**, byte-identical re-runs, non-gating as briefed),
+and F closed the gate honestly — including recording that the one budget edge got WORSE, and
+correcting its own first bad money shot instead of shipping it. **Lane G is merged** at the
+boundary as ruled (`dd4489c`); the godverse town passes the sweep (161,264 green).
+
+Round 22 is **v4.0: THE EPOCH CLOSE** — the tri diet first, the pack absorbed, the release tour
+on real streets, the Lane G items, docs freeze, the tag. Tag **`v4.0`** at close.
+
+## The ledger
+
+1. **The `venue_night` tri diet (FIRST — the one open gate edge).** F's re-measure: katoomba
+   200,965 → **221,935 tris (+11%)**, bendigo ~201k. A's poster cap worked (438→111); **E's
+   density widening ate the savings** — more shops = more night geometry at the venue block.
+   Two steps, measure-first:
+   a. **B diagnoses** (streetscape budget is B's): a layer-by-layer `renderer.info` breakdown at
+      katoomba `venue_night` (buildings / posters / furniture / pools / peds / interiors-spill) —
+      name the driver with numbers, half a day.
+   b. **The named owner fixes** (A if it's plan geometry (lot/poster counts), B if render
+      (merge/instance/LOD), E if asset tris), F re-measures. **Must land < 200k** — this is a
+      release round; the stress view IS the gate.
+2. **A absorbs the pack (the round's spine).** E's 17 new towns + Lane G's `newtown_godverse`:
+   feed all through the lift, pin the **36 waiting goldens** (selfcheck prints them), and absorb
+   what the meccas surface — **fitzroy is 160 shops, 2× anything absorbed so far**; expect
+   overflow/capacity work (your R20 fence, now at scale; drops stay counted by cause). The
+   cluster bias + poster cap + junction pipeline all run at 23-town scale for the first time —
+   anything that breaks gets the usual treatment: fix or fence, written down. Batch the pins:
+   ONE golden commit at the end.
+3. **The Lane G items (queued from FABLE_TO_LANE_G):**
+   - **B**: per-town bookmarks — resolve bookmark poses against the ACTIVE plan (the
+     synthetic-coord teleports land inside OSM geometry; you did this for `poseForVenue` — the
+     old set gets the same treatment, plus F's R21 cluster-pose finding below is the right
+     primitive to share).
+   - **F**: `DBG.enterShop(selector)` grows name/type/id matching (cross-repo QA one-liners).
+   - **E**: refresh the stale MODELBEAST notes (trellis_mac proven, the :8777 queue, ultra's
+     ⚠️ finish-farm warning folded into pipeline docs verbatim, credited).
+   - **Lane G (on ultra, their branch): G2a is GREEN as of the beta tag** — static per-shop
+     real-stock atlases behind `?stock=real`, per the ruling. **C + E: the contract review is
+     due this round** (atlas per shop · interior budget ceilings are C's · fail-soft to parody).
+     Answer in G-progress or LANE_C_PUB; G builds to it next.
+4. **The release tour (F).** `tour_shots.py` grows the v4 set → `docs/shots/release_v4/`:
+   the Fremantle golden-hour hero (have it), a mecca main street (fitzroy, once A absorbs), a
+   thin-tail town (proof the floor holds), the synthetic town (unchanged, the control), and one
+   `?classic=1` frame (the covenant, visible). **Use your cluster-pose finding as the tour's
+   posing primitive** (project the densest spatial cluster onto its front edge, stand on the
+   road) — and publish it as a `dbg.js`-consumable so B's bookmark fix (#3) shares it.
+5. **Interiors + citizens at pack scale (C + D, after A).**
+   - **C**: sampled door-soak across all 23 towns (your five-town harness, scaled — sample
+     ~10 doors/town, every archetype covered town-set-wide). One table.
+   - **D**: the fitzroy stress audit (160 shops — the densest citizen field yet: patronage,
+     rosters, determinism) + spot-check one thin-tail town (does 12 shops still read alive?).
+6. **Docs freeze + the tag (F last, with A).**
+   - A: CITY_SPEC v4 amendments final (schema v2, the lift, connectivity rulings, cluster bias,
+     poster cap), charter risk-list retired-or-carried line by line.
+   - E: provenance table v4-final (22 towns ODbL + the pack's SOURCES.md; the licence spine
+     stays complete).
+   - F: README v4 section (the towns ARE the product — say it with the selector + tour), notes
+     §22, `qa.sh --strict --matrix` green, tag **`v4.0`**, push. **After the tag: Fable writes
+     the epoch retro** (not a lane deliverable).
+
+## Laws
+
+Charter laws hold. Golden discipline: A pins the 36 in ONE commit; the tri-diet fix may move
+real-town goldens if it's plan-side (amendment law, same commit as the fix); synthetic
+`0x3fa36874`, gig `0xb1d48ea1`, fixtures, classic — frozen, as always. The 200k stress edge is a
+BLOCKING gate this round (release rounds don't ship known breaches — the R19 precedent).
+
+## THE EXACT RUN ORDER
+
+1. **Start together: B (tri diagnosis, #1a) + A (pack absorb, #2) + E (#3 notes + #6 provenance
+   prep).** B's diagnosis is half a day — it lands while A grinds.
+2. **When B names the tri driver: the owner fixes (#1b)** — if it's A, fold into the absorb; if
+   B/E, parallel commit. **F re-measures immediately.**
+3. **When A pins the goldens: start C (#5 soak) + D (#5 audits) + F (#3 enterShop + #4 tour
+   build-out).** C+E answer G2a's contract review (#3) in this window too.
+4. **When C, D, and the tri re-measure are green: F closes (#6)** — docs, matrix, tag `v4.0`,
+   push. Fable retro follows.
+
+Waves: **[B, A, E] → [tri-fix owner] → [C, D, F-prep] → [F close]**.
+
+## Standing
+
+- **John — nothing blocks this round.** FYI: Lane G is merged and their G2a (real stock atlases,
+  static half) is green to start on their branch per the standing ruling; the C/E contract
+  review happens this round. The tri-diet is blocking for the tag — if the fix turns out to need
+  scope you'll hear it loudly, not silently.
+- **After v4.0 (the retro decides, do not start):** G2b/G3 design (the economy — both
+  integrators + you) · the v4.x backlog (GIG_RANGE chunk lookup · instrument LOD · tram tri diet
+  · flag retirement · awning ripple · fabric canopies) · and the next epoch conversation
+  (editor vs multiplayer vs the GODVERSE deepening).

docs/LANES/ROUND23_INSTRUCTIONS.md

@@ -0,0 +1,89 @@
+# PROCITY — Round 23 lane instructions (from Fable, integrator)
+
+Date: 2026-07-16 · **v4.0 SHIPPED, the epoch retro is written ([RETRO_V4.md](../RETRO_V4.md)),
+and John has chartered v5: [THE REAL SHOP](../V5_REAL_SHOP.md).** Read the charter first — the
+tier ladder (parody → static real → live GODVERSE) and the five laws are the epoch's spine.
+
+Round 23 is **v5.0-alpha: THE FIRST REAL CRATE** — one real shop's real stock, riffled and
+bought, end-to-end, plus the G3 design doc drafted for ratification. The v4.x tail runs as the
+light parallel lane the retro promised. Tag **`v5.0-alpha`** at close.
+
+## The ledger
+
+1. **G2a: the first real atlas (Lane G, on ultra — the round's headline).** Build the per-shop
+   atlas pipeline per the R22-reviewed contract (C's ceilings · atlas-per-shop keyed by godverse
+   shop id · fail-soft to parody): dealgod inventory → a static atlas + index for ONE real
+   Newtown record shop in `newtown_godverse`. Files stay in the G namespace
+   (`pipeline/godverse_*`, `web/assets/stock_godverse/**`). Deterministic (byte-identical
+   re-run against the same inventory snapshot — snapshot the query result like you snapshot
+   Overpass raw). Provenance per the licence law (charter law #3). **This deliverable is
+   gating, so per the merge amendment (charter law #5) your branch merges mid-round once
+   Fable-m3 reviews.** Ping via G-progress when it's up.
+2. **G3: the design doc draft (Lane G + both Fables).** `docs/G3_ECONOMY_DESIGN.md` covering:
+   API surface (read stock / price / reserve / buy) · async-enrichment caching (risk #1 — the
+   dig never blocks on network) · the determinism boundary (charter law #2) · failure modes
+   (server dies mid-session → tier 1 without a stutter) · census↔lot identity matching (risk
+   #3, mismatches counted) · **the write-back question stated as a decision for John** (charter
+   law #4 — options with trade-offs, no default). Draft this round; ratification is R24's
+   kickoff. Nothing server-side ships before it.
+3. **The interior side of the real crate (C).** When G's atlas merges: verify the contract in
+   the room — the godverse record shop's crates resolve the per-shop atlas through the existing
+   `stockAdapter` path, interior draw/tex ceilings hold with real covers, `?noassets` and
+   missing-atlas boots fail soft to parody with zero errors. If the contract needs an
+   amendment, you own the wording (LANE_C_PUB), G re-emits.
+4. **The atlas validator (E).** The format side: a `validate_atlas` check in the pipeline
+   (dimensions ≤ C's ceilings, provenance fields present, index↔atlas consistency, determinism
+   note) so G's output is gate-checkable on m3 without the dealgod DB. Plus the retro's
+   curation item: **the thin-tail clustering floor** — re-bbox toowoomba onto its actual retail
+   strip (or retire it, your call, counted either way) using D's median nearest-neighbour
+   spacing as the curation metric.
+5. **The spacing warn (A).** D's metric becomes law: `validateTownCache` warns when median
+   nearest-neighbour spacing exceeds a threshold you pick from the pack's measured spread
+   (darwin 27 m alive, toowoomba 388 m dead — plenty of daylight for a line). Warn, not error —
+   E curates, the validator flags. Re-pin only what E's toowoomba fix moves.
+6. **GIG_RANGE chunk-neighbour fix (D — the carried v4.x item).** The 8.7% blind spot: extend
+   `_nearestOpenShop` to the ped's chunk + 8 neighbours. Hot path, so bring the R18-style
+   before/after (perf cost, blind-spot elimination, determinism unchanged, byte-identical
+   flags-off). Post-release is exactly when this change is safe.
+7. **The alpha gate (F, last).**
+   a. THE CRATE, end-to-end in a fresh browser: boot `newtown_godverse` with `?stock=real`,
+      walk into the real record shop, riffle — **real covers render** — buy, wallet debits,
+      the item leaves the crate (tier-1 static semantics: gone this session, back next boot —
+      that's correct until G3).
+   b. The tier ladder proven: same shop under `?noassets` (tier 0, zero fetch), missing-atlas
+      (soft fall to parody), `?stock=real` (tier 1) — all silent-and-fine; classic + default
+      gates frozen as ever.
+   c. `qa.sh --strict --matrix` green (the matrix now includes E's toowoomba fix), notes §23,
+      README one-paragraph v5 teaser, tag **`v5.0-alpha`**, push.
+
+## Laws
+
+The charter's five (offline · determinism boundary · licence · write-back · two-studio) plus
+everything inherited. Golden discipline: only E's toowoomba re-bbox may move a town golden
+(amendment law, one commit). No server code anywhere this round — the G3 doc is paper.
+
+## THE EXACT RUN ORDER
+
+1. **Start together: G (atlas + doc draft, on ultra) + E (#4 validator + toowoomba) + A (#5
+   spacing warn) + D (#6 GIG_RANGE).** All disjoint.
+2. **When G's atlas is up and Fable merges it: start C (#3).** E's validator should be ready to
+   run against the merged atlas — coordinate in G-progress.
+3. **When C passes and E/A/D are in: F closes (#7)** — the crate, the ladder, the tag.
+4. **G3 doc review runs asynchronously all round** — both Fables comment in the doc; it lands
+   ratified-or-revised at R24 kickoff with John's write-back ruling.
+
+Waves: **[G, E, A, D] → [merge, C] → [F]**, with the doc threading through.
+
+## Standing
+
+- **John — one decision incoming, not blocking this round:** the write-back question (does an
+  in-game purchase ever touch real thriftgod inventory — sandbox, reservation, or full
+  write-back?). It arrives framed with trade-offs in the G3 doc at R24 kickoff. FYI: G's branch
+  merges mid-round this epoch when its deliverable is gating (charter law #5); item-photo
+  licensing stays in-house-green, flagged before anything public.
+- **B — deliberately light this round** (you've carried heavy since R16): on-call for C if the
+  crate render surfaces anything street-side, plus first pick of the v4.x polish list next
+  round (awning ripple and the tram-stop tri diet are yours when you want them).
+- **v5.0-beta preview (do not start):** every hero shop in 1–2 godverse towns stocked · mint()
+  pricing baked into atlases · fitzroy_godverse if the census is dense there · the dig UX for
+  real items.

docs/LANES/ROUND24_INSTRUCTIONS.md

@@ -0,0 +1,108 @@
+# PROCITY — Round 24 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **R23 verdict: THE HOLD WAS RIGHT.** F held the `v5.0-alpha` tag on a round
+where every suite was green — `qa.sh --strict --matrix` 7/7, MATRIX 10×7, selfcheck 152,015 —
+because the round's headline could not be reached: G's 120 real records (Monster Robot Party's
+actual crate 550, off the real POS) have **no street** (the shop isn't in any town cache), **no
+identity** (`godverse_id: null` on every godverse shop — the schema has no such field), and **no
+compatible contract** (C's published atlas naming and C's own runtime loader are mutually
+incompatible — an atlas named per the contract can never be loaded by the code meant to load
+it). G built runtime-compatible; E built contract-compatible. **Nobody was wrong; the contract
+was.** And two gates would have passed without touching their subject — E's validator returns 0
+on an empty glob, and #7a-as-written goes green on the *generic* v2 pack's real covers with zero
+fetches to `stock_godverse/` ever. "Release rounds don't ship known breaches" — F applied the
+law to its own tag. This is the discipline working at the exact moment it matters most.
+
+Round 24 is **THE ALPHA COMPLETION** — the three gaps closed by their owners, the two process
+fixes made law, and the tag earned. Tag **`v5.0-alpha`** at close (F, and only when #7a runs
+honestly).
+
+## Two process fixes, now law (from R23's findings)
+
+1. **THE VACUOUS-GATE LAW (all lanes, immediately):** a gate must FAIL — or explicitly SKIP with
+   a printed reason — when its subject is absent. A gate that can pass without touching its
+   subject is not a gate. "No atlases yet ⇒ clean pass" and "real covers render" were the same
+   species: presence-of-a-thing checked instead of the-right-thing. Every new gate states what
+   its subject is and proves it touched it (a fetch log line, a matched-file count, an id
+   equality — something falsifiable).
+2. **Charter law #5 amendment — F executes gating merges.** The mid-round merge was Fable's per
+   the charter and Fable was never invoked — the round's headline sat unmerged while five lanes
+   built around it. F proved the fix in the act: verify namespace disjointness empirically, then
+   execute. Going forward: **when a G deliverable is gating, Lane F executes the merge as part
+   of its integration duty** (disjointness verified, not assumed); Fable reviews at the round
+   boundary as before. One less cross-Mac synchronization point.
+
+## The ledger
+
+1. **The contract fix (C — the root cause is yours to close).** Your published atlas contract
+   and your own `stockpack.js:25` loader disagree. Ruling: **the runtime is the authority** —
+   rewrite the contract to what the loader family actually implements, extended per-shop:
+   per-shop atlases live under a per-shop `base` (`stock_godverse/<godverseShopId>/`), index
+   named as the loader expects, fields named as the loader reads them (the `licence`/`license`
+   and nested-vs-top-level provenance drift dies here — pick what the code reads, document it,
+   one truth). Plus F's filed item: **key the pack cache by `type+base`** so a per-shop pack
+   and the town-wide pack coexist. Publish the corrected contract FIRST (half-day rule — G and
+   E both re-emit against it).
+2. **The identity field (A, with G).** The town-cache schema grows an optional
+   **`godverseShopId`** on shop entries (schema stays v2 — optional field, absent everywhere
+   except godverse caches; `validateTownCache` requires it on `source: "godverse+osm"` shops).
+   G's adapter emits it from the census (the POS shop id IS the id — no mapping table). A: the
+   validator arm + selfcheck assert; G: re-emit `newtown_godverse` with ids.
+3. **The street (E).** Build **`redhill_real`** — one bounded Overpass fetch under the standing
+   authorization — so Monster Robot Party's real shop has its real street. Same discipline as
+   the pack (raw snapshot, ODbL, spans, C's mapping). Hand the donor to G.
+4. **The validator, made honest (E).** Fix `validate_atlas.py` per the vacuous-gate law: an
+   empty match set prints `SKIP: no atlases present (0 files matched glob <g>)`; a present-but-
+   unparseable or present-but-unmatched atlas FAILS; field names align with C's corrected
+   contract (your own docstring and your own check currently disagree — F caught it). Then run
+   it against G's re-emitted atlas and gate on the result. Also: the **ballarat** curation
+   (A's spacing warn caught it at 255 m — re-bbox onto its strip or retire, counted, your call).
+5. **The re-emit + the second town (G, on ultra).** Against C's corrected contract and A's
+   identity field: re-emit the Monster Robot atlas keyed by `godverseShopId`, run the adapter
+   on E's `redhill_real` donor → **`redhill_godverse`** (the town whose record shop is THE
+   shop). Update the G3 doc §4 if the corrected contract changes any API field naming. Your
+   deliverables are gating → F merges mid-round per the amended law.
+6. **The wire + the honest gate + the tag (F, last).**
+   a. Pass the per-shop `base` through the stock path (the seam you deliberately didn't build
+      against a three-quarters spec — the spec is now whole).
+   b. **#7a, honestly:** boot `redhill_godverse` + `?stock=real`, enter Monster Robot Party via
+      your selector, and assert on falsifiables: network log shows fetches under
+      `stock_godverse/<id>/`, rendered titles ∈ the atlas index (id equality, not "covers
+      render"), buy debits, tier-1 gone-this-session semantics. Then the ladder re-proof
+      (tier 0 zero-fetch / missing-atlas soft-fall / tier 1) and the frozen classic + default
+      gates.
+   c. `qa.sh --strict --matrix` green (with E's honest validator now IN the gate set), notes
+      §24, the held README v5 teaser ships WITH the tag (they're one claim, as you said), tag
+      **`v5.0-alpha`**, push.
+7. **On-call:** B (standing light-round offer holds — R25 gets you first pick of the polish
+   list), D (done — the GIG_RANGE fix landed scoped and clean).
+
+## Laws
+
+Charter v5 laws + the two new ones above. Golden discipline: E's ballarat fix and the
+`redhill_real`/`redhill_godverse` pins are the round's town-golden moves (A pins, batched);
+synthetic/classic/gig/fixtures frozen. No server code — G3 stays paper until ratified.
+
+## THE EXACT RUN ORDER
+
+1. **Start together: C (#1 contract fix — publish first) + A (#2 identity arm) + E (#3 redhill
+   + #4 validator + ballarat).**
+2. **When C's contract and A's field are published: G (#5) re-emits + builds redhill_godverse.**
+3. **When G pushes: F merges (amended law #5), then closes (#6)** — wire, honest gate, tag.
+
+Waves: **[C, A, E] → [G] → [F merge + close]**. B/D on-call.
+
+## Standing — JOHN: THE WRITE-BACK RULING (§7 of the G3 doc — due this round)
+
+The G3 draft frames it exactly as charter law #4 required: **does an in-game purchase ever touch
+real monsterrobot/Square inventory?** Three options — A: sandbox (read-live, sell-local; zero
+real-world risk; the one-of-a-kind thrill is fiction) · B: reservation (a real expiring hold via
+the POS's existing `hold_expires_at`; genuinely one-of-a-kind AND reversible; needs a hold
+budget, a staff-visible reason code, and the-shop-always-wins race policy) · C: full write-back
+(game sale = real sale; a business decision, not an engineering one).
+
+**Fable's recommendation (yours to overrule): ship v5.0 on Option A, charter Option B as a
+v5.x upgrade** behind a hold budget you set — B is the strongest truth-per-unit-risk in the doc,
+but it deserves plumbing that has soaked, not plumbing that tags this round. Option C should
+only ever happen as a deliberate business launch, if ever. Say A / B / C (or A-then-B, the
+recommendation) and the G3 doc ratifies with your ruling inline.

docs/LANES/ROUND25_INSTRUCTIONS.md

@@ -0,0 +1,98 @@
+# PROCITY — Round 25 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **R24 verdict: THE CRATE WALKS — and the tag correctly holds a second round.**
+F proved the epoch's claim falsifiably: Monster Robot Party resolves its own per-shop base,
+**120/120 rendered titles from its atlas and 0/120 from the generic pack, the GPU samples
+`stock_godverse/3962749/*.webp`**, a real record debits $15 exactly, the ladder re-proved on
+every rung, and the wire is a verified no-op off the godverse path. G gave the shop its street
+(Red Hill, 884 real roads, the shop's coordinate John-supplied because **no dataset we hold
+derives it** — honest sourcing), proved **Ruling 2 was load-bearing not cosmetic** (census-only
+Red Hill = 306 m spacing warn + a poster inside a kerb; with the texture layer it passes — the
+headline town was one design decision from shipping flagged), and recorded John's **A-then-B
+write-back ruling as mechanism**: `/reserve` + `/buy` stay ABSENT, not stubbed — a sandbox a
+config typo can flip isn't a sandbox. C owned the R23 root cause squarely. E built the street
+and the honest validator. A published the identity field first, as briefed.
+
+**Why the tag holds:** the tree carries 8 selfcheck reds F cannot fix — 2 are re-emitted
+`newtown_godverse` goldens awaiting A's pin (A ran before G; a handoff gap, not a defect), and
+**6 are A's sweep asserting what Fable's own Ruling 2 makes impossible by design** (every-shop-
+keyed on deliberately-mixed caches). Plus R24's finding chain, in escalating cost: the brief's
+own honest-gate spec was vacuous (positional `rec_0000…` ids collide across packs — id equality
+can't discriminate; **the vacuous-gate law's first application broke the law**, and the fix —
+titles + texture URLs — is F's, not the brief's); A's uniqueness check collapses `undefined`s
+into one Set entry (fails structurally on mixed caches AND can't catch a real duplicate — F
+measured the guarded hazard at zero); E's validator prints the licence flag from British
+`licence` while the contract mandates US `license`, so **"FLAG BEFORE ANY PUBLIC/COMMERCIAL
+RELEASE" silently never prints on real product photos**; and F's own classic gate cried wolf
+(fixed by F, two assertions two verdicts). Round 25 closes all of it. Tag **`v5.0-alpha`** at
+close — third time, earned.
+
+## Process rulings (from R24's events)
+
+1. **Lane G is a full lane on main.** G committed straight to main and it was right: the
+   namespace is disjoint, the commits were pathspec-atomic, and the branch ceremony has served
+   its purpose. Same treaty as A–F from here: own files only, atomic pathspec commits;
+   anything cross-namespace still needs a ruling first. (The R23 merge amendment is thereby
+   retired along with the branch.)
+2. **Ruling 2 is confirmed as law** — G measured it: mixed caches (keyed GODVERSE layer +
+   inherited texture layer) are the *design*, not an accident A's gates may assert away.
+3. **The brief-was-wrong entry for the record:** my #7a spec (id equality) was itself vacuous.
+   F's replacement (title sets + texture-URL provenance) is the canonical honest-gate pattern
+   for stock — measurement over brief applies to the integrator's gate specs too.
+
+## The ledger
+
+1. **A — reconcile the sweep with Ruling 2, pin the six (the round's spine).**
+   - The sweep's godverse arm goes per-layer: keyed asserts apply ONLY to shops carrying
+     `godverseShopId` (the GODVERSE layer); texture-layer shops are legitimately unkeyed.
+   - Replace the uniqueness check with one that works: uniqueness over **defined** ids only
+     (F measured zero real duplicates — the check should be able to catch one if it ever
+     appears, which the Set-collapse version cannot).
+   - Pin the six goldens: `newtown_godverse` base+gig (moved by G's keyed re-emit — values are
+     in G's commit), `redhill_real` base+gig, `redhill_godverse` base+gig.
+   - Acceptance: **selfcheck ALL GREEN, zero warns pending** except any E leaves deliberately.
+2. **E — the licence line, made unmissable (conflict #1).** Align the validator with C's §7.3
+   (top-level provenance, US `license` — one truth; your own docstring/check disagreement dies
+   in the same commit). Per the vacuous-gate law: when provenance exists, the licence evidence
+   line is a REQUIRED printed output and its absence is a FAIL — the flag exists for a human to
+   read, on real product photos; a gate that can say OK while hiding it is the R23 species.
+3. **C — one contract line; G — the sku re-emit (F's finding #1, made structural).** Positional
+   slot ids collide by construction. C: amend §7 — atlas-pack slot ids MUST be unique across
+   packs (sku-derived: `sku_<POS id>` or similar — your wording). G: re-emit the two atlases
+   with sku slot ids (index-only change — no town cache touched, no golden moves; the .webp
+   bytes shouldn't move either, same as your R24 re-bake). E's validator asserts the form.
+   This makes id-equality gates discriminating forever, before there are 50 atlases to migrate.
+4. **F — land your R24 work, then the tag.** Your wire, the DBG interior handoff, the crate
+   smoke, the classic-gate fix, and the notes are staged/uncommitted as of the R24 close —
+   commit them (F-pathspec) if the harness verdict hasn't already. Then, after A/E/G land:
+   full `qa.sh --strict --matrix` with the honest validator AND your crate smoke in the gate
+   set, the README v5 teaser ships WITH the tag (one claim, as you ruled), tag **`v5.0-alpha`**,
+   push. Your hold streak is the system working — end it only on green.
+5. **B / D — on-call.** B: the standing first-pick-of-polish offer moves to the beta round,
+   where the dig UX for real items will want street-side support anyway.
+
+## Laws
+
+Charter v5 + the vacuous-gate law (now with its own first counterexample on record) + the
+process rulings above. Golden moves this round: A's six pins only. No server code; the ratified
+G3 stays paper until the beta charters tier-2 read-live.
+
+## THE EXACT RUN ORDER
+
+1. **Start together: A (#1) + E (#2) + C (#3's one line).**
+2. **When C's line lands: G (#3) re-emits.** (G needs nothing else — A's pins don't gate the
+   re-emit since atlas indexes aren't in goldens.)
+3. **When A + E + G are in: F (#4)** — commit your R24 work if not already, full gate, tag,
+   push.
+
+Waves: **[A, E, C] → [G] → [F]**. B/D on-call.
+
+## Standing
+
+- **John — nothing needs you.** Your A-then-B ruling is recorded as binding mechanism in the
+  G3 doc (§7); the alpha tags this round on green.
+- **v5.0-beta preview (next round, do not start):** G2a at scale — every hero shop in
+  newtown_godverse + redhill_godverse stocked (the census inventory question: most census shops
+  aren't on the POS — the beta decides what a real-but-un-inventoried shop's crate holds) ·
+  mint()-seeded tier-0 variety per the G3 doc's note · the dig UX for real items (price cards
+  are real data) · B's polish pick.

docs/LANES/ROUND26_INSTRUCTIONS.md

@@ -0,0 +1,147 @@
+# PROCITY — Round 26 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **R25 verdict: one commit and one harness verdict from done.** A cleared all
+8 reds with the round's best self-accounting ("healthy towns my gate called broken — it fired
+54/72 on a good town"; keyed asserts now per-layer, the six goldens pinned, selfcheck
+**156,211/156,211**). C's contract line and G's sku re-emit landed (index-only, as designed —
+id-equality gates are discriminating forever). F's permanent crate smoke earned its keep on day
+one by catching **two of F's own bugs** — the sharper one being the round's theme biting its
+author: **plan ids and godverse ids share a numeric space**, so `enterShop(31)` silently entered
+Wholefood Cafe (plan id 31) instead of Silky Oak Furnature (godverse id 31), and the soft-fall
+assertion passed vacuously on the wrong shop. F fixed the selector to disambiguate and made the
+smoke prove its target is keyed. *Recorded as a standing note: the two id spaces are disjoint
+namespaces — no code or gate may compare a bare number across them.*
+
+**Open (why there is still no tag):** E's ledger #2 — the licence-line fix, and it's good work
+(runtime-authority glob, loud SKIP, licence evidence as a required line) — sits **uncommitted**
+in the tree; and F is mid-harness on its re-run. Round 26 opens by closing both, then the beta.
+
+## WAVE 0 — close the alpha (before anything else starts)
+
+*Status update (Fable): **WAVE 0 IS COMPLETE.** F's half DONE — verdict GREEN, committed
+(`2994200`), tag held a third time, correctly (a tag whose tree lacks the code that produced
+its green would be a lie). E's half DONE — the owner committed its own rebuild (`9b1df5c`) with
+the true root cause: the `or` fallback WAS the bug (permissive check, strict print — one path
+couldn't feel the other break). F adversarially verified the work pre-commit (broke it both
+ways, watched it bite); Fable re-ran the validator and pushed. **F: step 2 is GO — confirm and
+tag `v5.0-alpha` on resume, then the beta waves below.***
+
+1. **E: commit your own work.** `pipeline/validate_atlas.py` carries your R25 rebuild, unstaged.
+   If your session died before the commit: a fresh Lane E session verifies the diff against
+   ledger #2 (it should recognize its own writing), runs the validator against G's two sku
+   re-emitted atlases (the licence line must PRINT — that's the point), and commits E-pathspec.
+   Nobody else touches this file — it's yours.
+2. **F: tag on E's commit.** Your verdict is in and green; the moment E's commit lands, run the
+   short confirm (`qa.sh --strict`), tag **`v5.0-alpha`**, push, README teaser with it.
+
+## Then: v5.0-beta — EVERY CRATE DIFFERENT (the honest version)
+
+The R25 preview said "every hero shop stocked." The honest constraint: **only Monster Robot
+Party has a POS** — the census's other shops are real businesses with unknowable inventory.
+The beta makes every keyed crate *distinct and plausible* without pretending to data we don't
+hold, on three rungs:
+
+- **Real depth where the data is real:** Monster Robot's other crates (the G3 §4 crate-rotation
+  menu, baked statically).
+- **Minted plausibility where it isn't:** the G3 doc's own note, promoted — seeded `mint()`
+  (`random.Random(shop_id)`, ordered sample; deterministic) bakes per-shop atlases for keyed
+  shops without POS inventory, **provenance-marked `tier: "mint"`** so no gate, doc, or human
+  ever mistakes plausible for real.
+- **Parody below that:** the texture layer and everything unkeyed stays exactly as it is.
+
+## The ledger
+
+1. **The mint contract line (C, first — half-day rule).** §7 grows the `tier` field:
+   `"real"` (POS snapshot) vs `"mint"` (seeded sample) — required in provenance, and the dig's
+   price card may show it subtly or not at all (your call, it's a vibe question), but gates
+   must see it.
+2. **The mint baker + Monster Robot depth (G).** Seeded mint atlases for the keyed non-POS
+   hero shops in both godverse towns (deterministic: same shop_id → byte-identical bake);
+   Monster Robot's full crate menu baked as the real tier. Licence zone per atlas as ever —
+   mint items sample real dealgod listings, so the photo provenance is the same in-house-green
+   zone, flagged the same way.
+3. **The validator grows the tier arm (E).** `tier` required on every atlas; `mint` atlases
+   must NOT carry `pos_snapshot` fields and vice versa (the separation is the honesty); the
+   licence line prints for both. Vacuous-gate law applies: an atlas with no tier FAILS.
+4. **The dig UX for real items (C).** The price card gets the real fields the atlas index
+   already carries (artist / title / price / condition) — the card should read like a record
+   shop price sticker, not a database row. Budget ceilings unchanged.
+5. **B returns — dig-adjacent street polish (your pick, at last).** First pick of the polish
+   list as promised, weighted toward the beta: shopfront signage/window treatment for stocked
+   godverse shops (a crate-diggers' shop should read as one from the footpath), or the awning
+   ripple, or the tram-stop tri diet — your choice, one item, measured as ever.
+6. **The atlas manifest (F's R24 finding #4, made structural — C line, G emits, F consumes,
+   E validates).** Fail-soft-by-404 collides with the zero-console-errors law: the runtime
+   probes per-shop atlases blind and eats 404 noise (8 in F's gate run — tolerated by
+   attribution, which is a workaround, not a design). Fix at the root: G emits
+   `web/assets/stock_godverse/index.json` — the manifest of which `godverseShopId`s carry
+   atlases (types + tier per entry; mint atlases included). C: the §7 contract line. F: the
+   wire consults the manifest before fetching — no entry, no probe, zero 404s, the
+   zero-console-errors law holds without exceptions. E: manifest↔files consistency in the
+   validator (an atlas on disk absent from the manifest FAILS, and vice versa — vacuous-gate
+   law shape).
+7. **The beta gate (F).** *(Status, Fable: waves 1–2 are COMPLETE — C/B/E/G all landed. NOTE:
+   C RULED the brief's `tier` field wrong and is right — `tier` is the charter's ladder rung and
+   a mint atlas is also rung 1; the field is **`sourcing: "real"|"mint"`**, and E built to C's
+   contract not my brief ("the contract's author is the authority for the contract's shape").
+   Your gate asserts `sourcing`, not `tier`. G measured 15/15 keyed crates distinct, 0 shared
+   titles, manifest derived from disk; B's street mark reads from the manifest, not the key.)*
+   Per-shop distinctness (independently verify G's 15/15 — assert on title sets, the R24
+   pattern), `sourcing` provenance visible in gate output (a mint crate never reports as real),
+   zero console errors WITHOUT 404-attribution exceptions (the manifest makes this honest —
+   including the 13 keyed unfetchable-type shops that now stay silent), the ladder re-proof,
+   `qa.sh --strict --matrix`, tag **`v5.0-beta`**, push.
+7. **A / D — on-call.** A: nothing pending (your R25 close was clean). D: nothing — unless F's
+   distinctness gate wants a crowd check at a stocked shop (patronage at Monster Robot on a
+   Saturday feels like a D flourish, not a requirement).
+
+## WAVE 4 — the mint-id ruling (added post-hold; the beta's last inch)
+
+*F held the tag a FOURTH time (`528829e`): E's `SLOT_ID_PREFIX = "sku_"` is sourcing-blind, so
+all 14 mint crates fail a rule written before mint existed — the same shape as R24's sweep
+demanding a cafe carry a godverseShopId. The rule's INTENT holds (F measured: mint ids are
+`mint_<dealgod listing id>`, non-positional, seeded, 0 reused across all 15 crates); only the
+literal prefix fails. And G's refusal to go green the easy way is RATIFIED — a POS sku and a
+dealgod listing id are different id spaces, and filing one under `sku_` would recreate the R24
+collision inside the economy layer, where tier-2's sold-means-gone looks up POS skus. The
+prefixes ARE the namespace fence.*
+
+1. **C — one contract line (§7):** slot-id form is sourcing-scoped: real → `sku_<POS id>`,
+   mint → `mint_<dealgod listing id>`; both non-positional, both unique across packs; the
+   prefix encodes the id-space so the two can never collide — bless that as the design, not an
+   accident.
+2. **E — the one-line landing:** the slot-id check reads `sourcing` (you already read it at
+   :178) and asserts the matching prefix per C's line. Real crate: `sku_`. Mint crate: `mint_`.
+   Anything else, or a cross-wearing crate: FAIL.
+3. **F — re-run atlas-QA, then the tag:** `qa.sh --strict --matrix` (should flip 6/1/0 →
+   7/0/0), tag **`v5.0-beta`**, push. Your four holds are the epoch's spine — this one cost one
+   line and would have cost a mis-sold record.
+
+## Laws
+
+Charter v5 + vacuous-gate + the id-namespace note above (now with its economy-layer corollary:
+**id prefixes are namespace fences** — `sku_` is the POS space, `mint_` is the dealgod-listing
+space, and no gate or lookup may treat them as one). Golden discipline: no town-cache changes
+this round → no golden moves (mint atlases are `stock_godverse/**` files, outside every
+golden). No server code — tier 2 stays design until the beta ships and the v5.0 round charters
+it against the ratified G3.
+
+## THE EXACT RUN ORDER
+
+0. **WAVE 0: E commits; F lands the verdict and (on green) tags `v5.0-alpha`.** Hard stop until
+   the tag verdict is known.
+1. **Start together: C (#1 contract line + #4 dig card) + B (#5 pick).**
+2. **When C's line lands: G (#2 mint baker + depth) and E (#3 tier arm) in parallel.**
+3. **When G + E are in: F (#6)** — distinctness gate, ladder, tag **`v5.0-beta`**, push.
+
+Waves: **[E-commit, F-verdict] → [C, B] → [G, E] → [F]**. A/D on-call.
+
+## Standing
+
+- **John — nothing needs you.** The A-then-B ruling is binding and recorded; the beta stays
+  static-tier (no server); mint is the G3 doc's own blessed note, promoted with provenance
+  honesty.
+- **v5.0 preview (do not start):** tier-2 read-live per the ratified G3 (Option A semantics —
+  read-live, sell-sandboxed, `/reserve`+`/buy` stay absent) · the kill-the-server-mid-session
+  gate · the v5 tour (the crate walk as a money shot) · docs freeze · the `v5.0` tag · the
+  epoch retro.

docs/LANES/ROUND27_INSTRUCTIONS.md

@@ -0,0 +1,217 @@
+# PROCITY — Round 27 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **R26 wave-4 verdict: C and E landed the mint-id fence, and both wrote the
+same honest headline — "the rule was the stale thing, not E's check."** C owned its stale §7.2a
+squarely (second time a C contract line met a case written after it and another lane took the
+red); E proved the fix is *stronger* than the rule it replaces (the easy green was dropping the
+prefix check; instead the prefix is now a sourcing-scoped namespace fence). The epoch's four
+holds now all trace to the same species — a rule meeting a case written before the case
+existed — and all four were caught before they could lie. The system is working exactly as
+designed.
+
+**Open: F's wave-4 step 3.** The beta tag is one re-run away. Round 27 opens there, then closes
+the epoch: **v5.0 — THE LIVE CRATE.**
+
+## WAVE 0 — F tags the beta
+
+`qa.sh --strict --matrix` (the 6/1/0 should flip to 7/0/0 — E's fence is in, C's line is law),
+tag **`v5.0-beta`**, push. Nothing below starts until this lands.
+
+## Then: v5.0 — THE LIVE CRATE (tier 2, per the ratified G3)
+
+The charter's last rung, under John's binding A-then-B ruling: **read-live, sell-sandboxed** —
+`/reserve` and `/buy` stay ABSENT (not stubbed; a sandbox a config typo can flip isn't a
+sandbox). The server enriches, never gates: every boot path, gate, and tag works with the
+server dead. Scope honesty up front: if tier 2 proves bigger than one round, F holds and we
+split — four holds have proven the pattern; nobody forces an epoch close.
+
+## The ledger
+
+1. **The read endpoints (G, on ultra — server-side).** G3 §4 as ratified: `GET
+   /godverse/v1/shop/<godverse_id>/stock` (items + `gone:[sku]` + etag) and `/crates` (the
+   rotation menu), read-only over the live POS, serving **metadata only** (covers stay static
+   tier-1 files — the API never serves the atlas). Monster Robot is the only real shop; that's
+   the point — one shop, live, true. Deterministic-where-possible discipline: same POS state →
+   same response (etag'd).
+2. **The tier-2 reader (F, with C's seam).** Async enrichment at room build: on entering a
+   keyed real-sourced shop, the shell fires the stock read (timeout-guarded, etag-cached) and
+   the crate applies the `gone` list + live prices when the response lands — the dig NEVER
+   blocks on the network (charter risk #1). C: if the crate needs a post-build content-adjust
+   hook, that's your seam to publish (half-day rule); if the existing adapter re-read covers
+   it, say so and F wires direct. Server dead / unreachable / slow → tier 1 exactly, silently.
+3. **The kill-the-server gate (F — the epoch's defining gate).** Three arms, all falsifiable:
+   boot server-up → live fields present (assert etag/`gone` consumed); **kill the server
+   mid-session** → next read degrades to tier 1 with ZERO console errors and no stutter
+   (frame-time measured across the failure); boot server-down → pure tier 1, byte-identical to
+   the beta behaviour. This is charter law #1 made a gate. It runs as its own smoke class —
+   server lifecycle is controlled by the gate itself, so the assertion is deterministic even
+   though live stock isn't.
+4. **Sold-means-gone, sandboxed (F + G).** The server's `gone` list removes items from the
+   live crate read (a record sold IN THE REAL SHOP disappears from the game crate — that's the
+   GODVERSE magic, direction: real→game). In-game buys stay session-local per Option A. Assert
+   both directions of the sandbox: a real `gone` item never renders; a game buy never appears
+   in any server state (there's no verb to carry it — prove the absence).
+5. **The v5 tour + money shot (F).** `docs/shots/release_v5/`: the crate walk — Musgrave Road
+   → Monster Robot Party's frontage (B's mark visible) → the riffle with real covers → the
+   price sticker → the buy. Plus one mint-shop frame (the honest caption: plausible, not real)
+   and the `?classic=1` control. The R21 cluster-pose primitive poses the street frames.
+6. **Docs freeze (all lanes, light).** A: CITY_SPEC v5 section (the tier ladder, sourcing,
+   the id-space fences, the manifest) + charter risk-list retired-or-carried, v4-style. E:
+   provenance v5-final (mint atlases + the licence line's story). C: LANE_C_PUB v5-frozen
+   marker. G: the G3 doc updated design→as-built. B/D: notes current; nothing else owed.
+7. **The tag + the retro.** F: `qa.sh --strict --matrix` + the kill-the-server gate green →
+   tag **`v5.0`** → push. Then **Fable writes the epoch retro** (not a lane deliverable), and
+   the v6 conversation opens with John (the editor and multiplayer are still chartered; the
+   GODVERSE has more rungs — Option B's reservation upgrade is already chartered as v5.x).
+
+## Laws
+
+Charter v5 laws, all now with case law behind them · the vacuous-gate law · the id-namespace
+fences (`sku_`/`mint_`, plan-id/godverse-id) · no golden moves expected this round (tier 2
+touches no plan, no cache, no atlas bytes) · the offline law is THE gate this round, not a
+footnote.
+
+## WAVE-2 STATUS + F'S THREE LOAD-BEARING INPUTS (Fable, post-wave review)
+
+*A/B/C/E/G are ALL IN. The beta tagged. What remains is F's close (#2 reader → #3 gate → #4
+sandbox → #5 tour → #7 tag). The waves handed F three inputs that change the brief's letter —
+build to THESE, not to my original wording:*
+
+1. **C's seam ruling (§8): direct wire, no hook — but PICK-THEN-OMIT is law.** The naive wiring
+   (filter `pack.items`) RESHUFFLES the crate — C measured one sale changing 21 other records.
+   The reader draws from the stable full list and omits `gone` after: a crate with 3 sold shows
+   13, not a different 16. **Assert zero collateral in the gate** (sell one fixture record, the
+   other 119 identities unchanged). "Selling one record must remove one record, not re-stock
+   the shop."
+2. **G's finding: `gone[]` has no subject in production.** The real POS has recorded no sale
+   since 2026-07-01 — 0 of crate 550's 120 records have ever sold, so a sold-means-gone assert
+   on live data passes vacuously forever. G built the remedy: **`make-fixture`** gives the gate
+   a subject. The gate MUST use it (vacuous-gate law — G flagged it before the gate could be
+   born blind).
+3. **G's lifecycle is the kill switch:** `godverse_server.py start|stop|status` — the
+   kill-the-server gate drives it directly. The three fences are machine-enforced (read-only
+   credential measured permission-denied; `/reserve`+`/buy` → 501; metadata only, mint shops
+   404) — assert on them as fences, not re-derive them.
+
+*Also for the record: E's freeze caught redhill_godverse missing from the towns roster for
+three rounds (on disk, pinned, bootable by key — invisible only in B's selector; the one
+consumer nobody gated). E owned it, fixed it, and wrote the gate-shape lesson. B verified the
+R26 handshake against G's real manifest. A judged the risk list line-by-line and correctly
+CARRIED risk #1 — "nothing retires this line except that gate going green."*
+
+## WAVE-3 STATUS + TWO RATIFICATIONS (Fable, post-reader review)
+
+*F's reader is IN (`39cfc3d`): pick-then-omit with `gone`/`price` applied IN PLACE (identity
+and order preserved), fire-and-forget with a 1200 ms abort + circuit breaker, real-sourced
+shops only. Browser-proven: 3 fixture sales → 0 collateral; server killed mid-session → 13.1 ms
+enter, 14 ms worst frame gap, zero errors. Two F rulings are hereby RATIFIED as law:*
+
+1. **Tier 2 is opt-in: `?live=1` / `?live=<url>`; absent → byte-identical to the beta.** F's
+   reasoning is the R26 lesson applied to a server — a default boot must never ask a question
+   that has no answer on machines that aren't John's. "Tier 2 is a place you go, not a thing
+   that happens to you." Auto-discovery is a v5.x question with a reachability contract.
+2. **The collateral assertion is the canonical sold-means-gone gate.** "The gone item never
+   renders" cannot discriminate pick-then-omit from filter-the-array — both hide the record;
+   only COLLATERAL (the other 119 identities and order unchanged) tells them apart. Gates
+   assert collateral. (The vacuous-gate law's most precise application yet.)
+
+**F's remaining close, in order:** formalize the browser proofs as the permanent smoke class
+(#3's three arms + #4's both-directions sandbox, collateral-asserted, fixture-subject via
+`make-fixture`) → the v5 tour (#5 — the crate walk, the mint-shop honest caption, the classic
+control) → docs (#6 F-side: README v5 + the flags table gains `?live`) → `qa.sh --strict
+--matrix` + the new smoke class → tag **`v5.0`** → push. Then Fable writes the epoch retro.
+
+## WAVE-4 (Fable): two ratifications, one micro-task, and the tag path
+
+**RATIFIED — F's §27 console-error ruling, and it is strictly stronger than the brief it
+replaces.** The brief's "ZERO console errors on server death" (my wording, echoed in A's risk
+line #1) is physically unachievable: a dead-host fetch logs `ERR_CONNECTION_REFUSED` at the
+browser level where no `.catch()` reaches — to log zero, the reader would have to know the
+server is dead without asking. One refusal is the irreducible cost of discovering death. The
+ratified assertion: **zero errors from game code + EXACTLY ONE refused connection** — which
+proves the circuit breaker, where "zero" could never distinguish a working breaker from a
+broken one (both fail it). F filed this loudly as the beneficiary instead of relaxing it
+quietly; that is the standard. (A: your risk-line wording is superseded by this record — a
+one-line amendment at your leisure, not a blocker.)
+
+**RATIFIED — the control-based frame assertion.** F's original `<250 ms` threshold passed
+while measuring Lane C's room build and calling it network behaviour; the control (same walk,
+breaker tripped, no network: 202 ms) exposed it, and the death's true cost is **Δ+2 ms**.
+Assertions on frame cost are DELTAS AGAINST A CONTROL from here on, not absolute numbers —
+the R21 lesson, now law for performance gates.
+
+**THE MICRO-TASK — B: the frontage pose (F's filed ask).** F produced three frames of empty
+road trying to re-derive your frontage anchor, then stopped — correctly (the cluster primitive
+answers "where is the town's heart", and Red Hill's heart doesn't contain Monster Robot; a
+frontage frame asks a different question). You own the frontage geometry, the R26 shopfront
+mark, and the `poseForVenue` machinery: publish a pose helper or bookmark that frames a shop's
+frontage BY LOT (keyed off `shop.lot` / godverseShopId — `poseForShopFront(shopOrId, dist)`),
+verified on Monster Robot (mark visible, door centred, sleeves-through-glass a bonus). One
+commit, B-pathspec. This also closes the gap for every future godverse tour frame.
+
+**Then F closes:** the 4th frame through B's helper → full `qa.sh --strict --matrix` +
+the (now-permanent, corrected) kill-the-server smoke class → tag **`v5.0`** → push. Fable's
+retro follows.
+
+## WAVE-5 (Fable): THE SPEC RULING — the facade is +Z, and the fifth hold stands
+
+*B's micro-task found why F photographed empty road three times: it was never the pose.
+`plan_osm.js:443` aims the lot's −Z at the road (implementing CITY_SPEC:71); `buildings.js:404`
+draws the facade on +Z (CITY_SPEC:335, B's canon). The spec contradicts itself; each generator
+implemented one half; synthetic follows B's canon so every golden has been green over a wrong
+product since R18 — v4.0 shipped on it. The epoch's signature species at its worst: not a gate
+failing on correct behaviour, but a green suite over a wrong world.*
+
+**THE RULING: the visible facade is LOCAL +Z. B's canon is canonical.** It has been the de
+facto truth since v1 (buildings.js drew it there from the start; venue.js seats door-glow/
+queue/posters there; A's own R15 write-up said "the visible venue face is +Z"). CITY_SPEC:71's
+−Z line described the SIM convention (rig-forward at ry=0) and got written into the lots
+contract by ambiguity — the same −Z/+Z species as R13's RY_FLIP and R15's posters, now at the
+root. The spec amends so the lots contract states: **facade/door/frontage = local +Z**; the
+sim/rig-forward convention is documented separately as the different thing it is.
+
+**A — the fix, the sweep, the pins (ONE commit):**
+1. Land B's proven one-liner in the real-roads seating (`ry = atan2(-nx,-nz)` — B measured
+   katoomba 0/72 → 72/72 facing and F's money shot works 4 m from Musgrave Road; B reverted it
+   because it's your file).
+2. **Measure the marched-osm path for the same flaw** — don't assume it's clean because nobody
+   noticed; that's how this one survived nine rounds. State the verdict either way.
+3. Amend CITY_SPEC:71 per the ruling, re-pin every moved golden (the 36 real-town pins move;
+   marched/synthetic only if your measurement says so), all in the same commit per the
+   amendment law.
+4. **The cross-convention gate (the lesson made law):** the selfcheck gains an assert measured
+   in B's canon — every lot's +Z facade faces its frontEdge street side — so the two
+   conventions are compared AGAINST EACH OTHER forever, not each against its own spec line.
+   A self-consistent check over a self-contradicting spec passes under either convention;
+   only the cross-check sees it. (F proved this the hard way and recorded it.)
+
+**F — then the close:** re-gate (the matrix against A's re-pins), re-shoot the tour (the
+frontage frame through B's `poseForShopFront` — and `street_noon` on real towns, which has
+been "46 draws of bare road" since R18, becomes a real street), `qa.sh --strict --matrix`,
+tag **`v5.0`**, push.
+
+**B — done, with honours:** the helper (door-centred by projection, `doorCentreNdcX = 0.0000`),
+the selector extracted to ONE home (`'g:31'` — the id-namespace fence now has a single
+resolver), the self-correction of your own R27 intel, and the discipline of proving A's fix
+then reverting it. Nothing further owed.
+
+## THE EXACT RUN ORDER
+
+0. **WAVE 0: F re-runs and tags `v5.0-beta`.** Hard stop until it lands.
+1. **Start together: G (#1 endpoints, on ultra) + C (#2 seam ruling: publish the hook or bless
+   the direct wire) + A/E (#6 docs prep — can run the whole round).**
+2. **When G's endpoints are live on the tailnet and C's seam is ruled: F (#2 reader).**
+3. **F (#3 kill-the-server gate + #4 sandbox proofs + #5 tour), then #7: tag `v5.0`, push.**
+4. **Fable: the epoch retro.**
+
+Waves: **[F-beta-tag] → [G, C, A+E] → [F reader] → [F gate/tour/tag] → [retro]**. B/D on-call.
+
+## Standing
+
+- **John — one infra FYI, nothing to decide:** the kill-the-server gate needs the thriftgod
+  server reachable from m3 over the tailnet AND stop/start control from the gate (G owns the
+  mechanism — a lifecycle endpoint or an ssh'd systemd unit, G's call; it's in-house infra
+  under existing access). Your A-then-B ruling continues to hold the write verbs absent.
+- **v5.x / v6 preview (the retro decides, do not start):** Option B's reservation upgrade
+  (behind your hold budget) · more POS shops if monsterrobot ever gets siblings · the editor ·
+  multiplayer presence · the v4.x/v5.x polish tails.

docs/LANES/ROUND28_INSTRUCTIONS.md

@@ -0,0 +1,63 @@
+# PROCITY — Round 28 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **v5.0 SHIPPED, retro written ([RETRO_V5.md](../RETRO_V5.md)). Nothing is
+owed anywhere.** Round 28 is deliberately LIGHT: v6's first spike (the one that needs nothing
+new) plus one parked polish item per lane — the items that have waited politely since as far
+back as R7. Tag **`v5.1`** at close. The v6 spikes 2/3 stay gated on John's mocap vids and the
+ultra integration call; nobody starts them.
+
+## The ledger
+
+1. **SPIKE 1 — the free stash (E + D; v6 groundwork, the charter's first thread).**
+   - **E**: convert two cached Mixamo clips from the tailnet stash — **`lean`** and
+     **`look-around`** — via the proven `fbx_to_clip.py` path (mesh-free, 65-bone, licence
+     table lines per clip: Mixamo royalty-free, same zone as walk/idle/sit). Depot + local per
+     the sit.glb precedent.
+   - **D**: wire them into street loiter — a window-shopping stop occasionally leans
+     (shopfront-adjacent) or looks around (anywhere). Seeded rolls on your existing `benchsit`
+     pattern (own rng stream, identity signature untouched), classic-safe by the same
+     `!CLASSIC` fetch gate, byte-identical proofs as ever (setSitting taught you the
+     scale-aware traps — `lean` against a wall wants the same care).
+   - Acceptance: a fresh boot shows peds leaning and glancing; classic/`?noassets` untouched;
+     the R16 seated-stature precedent covers any pose the no-giants gate misjudges (tag
+     `procityPosed` if needed — F's gate arm from R16 generalizes).
+2. **Awning fabric ripple (B — parked since R17's wind round, your promised pick).** The
+   striped fabric canopies share the rigid awning InstancedMesh; split them (or attribute-mask
+   them) and give ONLY the fabric a gentle wind ripple riding your existing `wind.js` uniforms.
+   Weather-driven like the trees; `?classic`/`?weather=0` byte-identical by the same proof
+   pattern; budget stated (~0 expected — it's your shader).
+3. **`audioEmitter` (C — your own parked idea, at last).** Positional interior audio: the gig
+   bed/walla emitting from the stage rather than the room, the till from the counter. Scope it
+   yourself (it's your idea — the brief states acceptance only): audible positioning in a venue
+   + a normal shop, fail-soft under `?mute`/`?noassets`, no new assets (it's routing, not
+   content), B's audio engine consulted not modified (publish the ask if you need an engine
+   seam — B's file).
+4. **Instrument LOD (E + D — the oldest tri item, v3.1-era).** E: `_lo` variants (~3–4k) for
+   the five instruments (the `_hi` depot pattern in reverse); D: distance swap in the band
+   (interiors are close-quarters — if the measured win is <20k tris in practice, KILL the item
+   with the measurement and it leaves the backlog forever, the wind-sway rule).
+5. **The gate + the tag (F, last).** New-clip figure checks (lean/look poses through the
+   scale gate), a bookmark spot-check (leaning peds in old frames), `qa.sh --strict --matrix`,
+   notes §28, tag **`v5.1`**, push. Nothing here moves a golden (clips and shaders are outside
+   every plan hash) — flag loudly if anything disagrees.
+6. **A + G — rest.** A: on-call (nothing should touch a plan). G: your next work is v5.x
+   Option B when John sets a hold budget, or mocap support on ultra — nothing on m3 this round.
+
+## THE EXACT RUN ORDER
+
+1. **Start together: E (#1 clips + #4 `_lo` variants) + B (#2) + C (#3).**
+2. **When E's clips land: D (#1 wiring, then #4 swap-or-kill).**
+3. **When B/C/D are in: F (#5)** — gate, tag `v5.1`, push.
+
+Waves: **[E, B, C] → [D] → [F]**. A/G rest.
+
+## Standing
+
+- **John — two unblockers for v6, both yours, both parallel to this round:** (1) film 2–3
+  mocap test vids into MOCAPGOD's queue (`docs/CAPTURE.md` there — the crate-riffle first);
+  (2) nudge Fable-on-ultra for the MOCAPGOD-C/MIRPAMO integration call. When both exist,
+  R29 runs Spikes 2/3 and the v6 charter ratifies on their results.
+- Also from the retro, the real-world note: **the shop POS has recorded no sale since
+  2026-07-01** — check the till sync when you're next in.
+- **Backlog after this round** (if #4 kills cleanly): tram-stop tri diet · flag retirement ·
+  Option B · tier-2 auto-discovery · the v6 tracks. The polish debt is nearly drained.

docs/LANES/ROUND29_INSTRUCTIONS.md

@@ -0,0 +1,82 @@
+# PROCITY — Round 29 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **v5.1 SHIPPED** (`cdce67c`, tag on origin; qa 7/0/0, matrix 10×7, goldens
+unmoved as predicted). R28 review, short: the sweep was the culture working — B and D each
+**killed their item with a measurement** (the wind-sway rule twice in one round; the backlog
+polish debt is now effectively drained), D's mid-round STOP saved E a pointless bake, C shipped
+`audioEmitter` after measuring its own v3-era prescription inert (panner ratio 1.0000 —
+bit-identical door vs stage), E shipped `look.glb` with the bytes sha1-verified BACK off the
+public depot and found **`lean` does not exist** (the brief's sixth corrected premise — the
+stash never had it), and F tagged with the pose gate honestly SKIPPED: **the spike never
+reached the game.** Round 29 finishes Spike 1 and runs Spikes 2/3 — the v6 charter ratifies on
+their results. Most of this round is GATED ON JOHN (below); wave 0 runs today.
+
+## WAVE 0 — finish Spike 1 (runnable NOW, no dependencies)
+
+**D:** bind and wire `look.glb` — `loadPedFleet(base, { look })` per the sit gate (a raw fetch
+breaches the classic zero-fetch covenant, E already flagged it), a seeded glance during
+window-shop loiter (own rng stream, identity signature untouched, byte-identical proofs — your
+own R17/R28 pattern). **F:** the pose gate gains its subject — un-SKIP it, verify a glancing
+ped in a fresh boot, spot-check one old frame. No tag for this alone; it rides Spike 2's close.
+
+## THE GATE ON THIS ROUND — John's two unblockers (everything below waits)
+
+1. **Film the Spike-2 shot list into MOCAPGOD's queue** (protocol: MOCAPGOD `docs/CAPTURE.md`):
+   - **the crate-riffle** (at the shop if you can — it's the epoch's poster clip),
+   - **the wall-lean** (E's R28 finding made this a *need*, not a nice-to-have — the stash
+     never had one),
+   - one free pick (busker strum, trolley push, phone check — dealer's choice).
+2. **The ultra integration call**: MOCAPGOD Lane C (retarget) vs MIRPAMO's retarget — one
+   machine, decided by Fable-ultra before either is built twice. Nudge that session.
+
+## SPIKE 2 — the full mocap loop (when the queue has vids)
+
+Runs mostly on ultra (MOCAPGOD C/D lanes + the integration call), lands on m3 as clips:
+- **E (m3):** receive the retargeted clips, convert/validate to the house clip form (the
+  look.glb checklist: mesh-free, 65 joints, bind-verified), **licence line: in-house / NC-
+  flagged** per the MOCAPGOD decision — the validator prints it or fails (the R25 law).
+- **D:** wire the riffle to a crate-digger context and the lean to shopfront loiter (the R28
+  wave-0 machinery generalizes — this should be data, not new code).
+- **F:** the spike's falsifiable gate: a ped performs a clip that DID NOT EXIST before John
+  filmed it — assert the clip's provenance chain (queue video id → BVH → clip sha) end to end,
+  not "a ped moves". Then tag **`v6.0-spike`** (a checkpoint tag, not an epoch tag) with the
+  spike report.
+
+## SPIKE 3 — a generated body (parallel to Spike 2, ultra-heavy)
+
+flux_local concept → hunyuan3d_mlx mesh → **MIRPAMO autorig** → walk retarget → **in-game
+through the no-giants gate**. Owner: G/ultra produces; E validates + licences (CC0-equiv,
+generated); D spawns it as a fleet variant behind the same opt pattern. HONESTY CLAUSE: this is
+the least-proven link in the whole v6 stack — a clean failure report ("autorig quality on
+generated meshes: X") is a full deliverable and shapes the charter as much as a success.
+
+## After the spikes — the ratification
+
+Fable amends `V6_LIVING_STREET.md` DRAFT → ratified (or re-scoped) on the spike reports, and
+the v6 rounds proper get chartered: clips at scale · personas · street discipline (footpaths +
+occasional cars) · bodies. **A, B, C rest this round** (A: nothing touches a plan; B/C: your
+R28 kills closed your queues) — you're first up in v6 proper, where street discipline (B: cars;
+A: crossings data) and persona interiors (C) are the headline tracks.
+
+## Laws
+
+Unchanged, plus the R28 additions to the case law: **a kill with a measurement is a full
+deliverable** (two more this round — the backlog never carries a zombie again) and **a
+wishlist is not an inventory** (E measured the stash instead of trusting a four-epoch-old
+list; briefs cite measured stock only).
+
+## THE EXACT RUN ORDER
+
+0. **Now: D + F (wave 0, Spike 1 closes).**
+1. **John: film the vids + nudge ultra (the gate).**
+2. **When clips flow: E → D → F (Spike 2), G/ultra → E → D (Spike 3, parallel).**
+3. **F: the spike gate + `v6.0-spike` checkpoint tag.**
+4. **Fable: charter ratification → v6 rounds proper.**
+
+## Standing
+
+- **John — the two unblockers above are the whole critical path.** Everything m3-side is one
+  small D+F wave and then waiting on footage of you leaning on a wall. The till-sync note from
+  the retro stands too (no POS sale recorded since 2026-07-01).
+- **Backlog after R28's kills:** tram-stop tri diet · flag retirement (policy, not urgent) ·
+  Option B (your hold budget) · tier-2 auto-discovery. Thinner than it has ever been.

docs/LANES/ROUND30_INSTRUCTIONS.md

@@ -0,0 +1,120 @@
+# PROCITY — Round 30 lane instructions (from Fable, integrator)
+
+Date: 2026-07-17 · **V7 THE GAME is RATIFIED** ([docs/V7_THE_GAME.md](../V7_THE_GAME.md) —
+read it first, it is the epoch's truth). Round 30 opens **v7.0-alpha: THE SAVE AND THE CRATE**
+— wave 1 of the smallest set that makes one town play as a complete small game. *(Housekeeping:
+the phantom R30 that two lanes were spun up for never had a brief — that was Fable's miss, now
+fixed. If your session finds prior R30 work anywhere, it doesn't exist; this document is R30.)*
+
+## The ledger (v7.0-alpha wave 1)
+
+1. **THE SAVE CORE (F — the foundation everything consumes; publish the contract FIRST).**
+   - `web/js/world/save.js` (F-owned): versioned localStorage save implementing **the delta
+     law** — cash · owned items (each = `{townKey, godverseShopId|shopId, sku|slotId, pricePaid,
+     dayFound}` — the sku IS the identity, per the R25/26 fences) · current town · **day
+     number** · schema `procity-save/1`. Save on SLEEP (see #3) and on `beforeunload`;
+     export/import as JSON (John moves machines).
+   - **The published contract** (`window.PROCITY.game`): `{ day, cash, collection[], save(),
+     load(), sleep(), export(), import(json) }` — B builds UI on this, C reads it at the
+     counter. Publish the shape in LANE_F_NOTES §30 in your FIRST commit, implementation after.
+   - **Laws wired from birth:** `?classic=1` → NO save layer constructed, zero localStorage
+     touches (the covenant stays a pure v2 boot); `?game=0` opt-out; a corrupted/foreign save
+     → rejected loudly, fresh start, the town NEVER breaks (delta law: world state is not in
+     the save, so it can't).
+2. **THE SELL COUNTER CONTRACT (C — publish first, implement second).** Walk to a keeper's
+   counter with items → a sell card (mirror of the buy card): item, offer price, SELL.
+   **Offer = below the buy-side band, structurally** (the no-pump law — C picks the multiplier,
+   documents it in LANE_C_PUB §9). v7.0-alpha sells at any shop of the item's type (record
+   shop buys records); the fancy stuff (per-keeper taste, haggling) is beta+. C consumes
+   `PROCITY.game.collection` read-only; the debit/credit goes through the wallet exactly like
+   buying (the proven seam).
+3. **SLEEP = SAVE = TOMORROW (F + B).** v7.0-alpha's day-advance: the HUD gains a SLEEP action
+   (B's surface; enabled any time for the alpha — home-base gating is beta) → `game.sleep()`:
+   save, `day+1`, **stock rotation** (the parody/mint pick streams re-seed as
+   `rng(citySeed, shopId, 'stock', day)` — F threads `day` into the existing stock seeding;
+   REAL stock never rotates, it's real), gig night = `day % 7` (plugs into the existing week
+   schedule), wake at dawn (segment 0).
+4. **THE COLLECTION UI (B — after F's contract lands).** A collection panel in hud.js (your
+   selector/HUD patterns): cover thumb, title/artist, price paid, where + day found; count in
+   the standing HUD; the SLEEP button + day/cash readout. Money-shot-grade is beta; readable
+   and correct is alpha.
+5. **THE GATES (F, last).**
+   - **Save/load determinism:** play a scripted session (buy 2, sell 1, sleep 2×) → export →
+     fresh boot → import → assert byte-equal game state AND the world untouched (fingerprint
+     unchanged — the delta law's falsifiable form).
+   - **The no-pump gate v0:** script buy-then-immediately-sell N times → assert monotonic cash
+     LOSS (the spread is the house's). The full adversarial playtest-bot is beta.
+   - **Classic purity:** `?classic=1` → zero localStorage reads/writes (measure, don't trust),
+     no HUD additions, fingerprint frozen.
+   - **Rotation determinism:** same seed, same day → byte-identical shop stock; day N ≠ day
+     N+1 (actually different, not just asserted different).
+   - `qa.sh --strict --matrix` green throughout. **No tag** — the alpha tags when it plays
+     (likely R31, after the loop closes end-to-end).
+6. **A — the rotation boundary verify (small).** F threads `day` into stock seeding — A
+   verifies it rides RUNTIME streams only: plan generation never sees `day`, all goldens
+   frozen, selfcheck proves it. One note, one line. **D, E, G — rest** (E's guide-band bake
+   and G's GodBay open in beta; D's rumors likewise. If footage lands in the MOCAPGOD queue
+   meanwhile, v6's Spike 2 takes priority for E/D — the epochs interleave, Fable sequences).
+
+## Laws
+
+The charter's five (delta · no-pump · game-money · classic-pure · seeded-rotation) + everything
+inherited. No goldens move this round (rotation is runtime; A verifies the boundary). The
+vacuous-gate law applies to every new gate above — each names its subject and proves it touched
+it.
+
+## THE EXACT RUN ORDER
+
+1. **Start together: F (save core — contract in first commit) + C (sell contract first,
+   implementation second).**
+2. **When F's contract is published: B (collection UI + SLEEP surface).** F continues
+   (sleep/rotation threading) in parallel — disjoint files.
+3. **When F + B + C are in: F gates (#5), A verifies the boundary (#6).**
+4. Fable reviews; R31 charters the rest of the alpha (or its close, if it plays).
+
+Waves: **[F, C] → [B, F-cont] → [F-gate, A]**. D/E/G rest unless footage arrives.
+
+## WAVE-1/2 REVIEW NOTES (Fable, mid-round — the agents' reports are the record)
+
+**RATIFIED — F's two amendments, both measured:** (1) gig night = **(day − 1) % 7** — the
+brief's literal `day % 7` flips a fresh boot (day 1) off night 0 and breaks the R13 cover/band
+gates before the first sleep; the brief was wrong, the measurement wins. (2) **sleep saves
+AFTER incrementing** — disk always carries the morning you woke into.
+
+**ADJUDICATED — the cross-lane 6 lines (F edited C's `interiors.js`/`layout.js` for the
+`stockDay` salt):** SANCTIONED, this instance — because all three conditions held: the owner
+reviewed and ratified on the record BEFORE the commit ("rides my own sub-stream discipline,
+absent ⇒ byte-identical"), the edit is marked and cited in the commit, and it is minimal.
+**Without all three, a cross-lane edit gets reverted on sight.** The law stands: write the
+ask, not the edit — C folds the seam into LANE_C_PUB at its next session; carried to the
+epoch retro as a process note.
+
+**WAVE-3 INPUTS (bind these into the gates session):** the rotation gate must hash **vertex
+data, not transforms** (F measured its transform fingerprint vacuous over batched parody
+stock); C's money-pump **negative control** (an item minted into the collection without a
+successful debit must be impossible — assert `recordFind` only fires on `wallet.buy` truthy);
+the **E-key sell routing** (§9.4 dig → sell → shelf) is F's held item and lands in the wave-3
+session BEFORE the gates run against it.
+
+## ROUND CLOSED (Fable, at the wave-3 review) — **v7.0-alpha wave 1: COMPLETE, ALL GREEN**
+
+Ten commits, five lane-agent sessions, zero holds, zero cross-lane incidents beyond the one
+adjudicated. The loop is real and gated: dig → buy → the crate remembers → counter → E → sell
+(strictly at a loss) → sleep → tomorrow rotates the mint crates and never the real one → the
+save survives the reboot and the UI reads it. `qa.sh --strict --matrix` **7/0/0, MATRIX 10
+towns**, selfcheck 156,352, covenant frozen, the day provably cannot enter the world.
+
+**Fed to R31 (the alpha close — charter it after John PLAYS):** the beta rulings queue
+(scarcity-per-day pull records · guide bands · per-keeper taste · foreign-town display names
+via E's index) · F's harness lesson #3 (the HUD hides in interiors by design) · the design
+fact that re-buying a rotated sleeve is a strict money loser (correct, filed). **The alpha
+tags when it plays — John's hands on the real URL are the acceptance environment.**
+
+## Standing
+
+- **John — nothing blocks this round.** The deploy to digalot.fyi/procity still waits on your
+  VPS-access pick (grant me the ssh rule / run the script yourself) — worth doing THIS round:
+  testing the save loop in a real browser on the real URL is exactly the alpha's acceptance
+  environment. And the MOCAPGOD queue still wants your footage whenever.
+- **The drive question stands:** say "run it" and Fable spawns these lanes as subagents in the
+  wave order above, reviews between waves, and reports once at the end.

docs/LANES/ROUND31_INSTRUCTIONS.md

@@ -0,0 +1,53 @@
+# PROCITY — Round 31 instructions (from Fable, integrator)
+
+Date: 2026-07-18 · **R30 closed all green** (7/0/0, matrix 10 towns, the loop live and gated).
+Round 31 is **the v7.0-alpha CLOSE**: play it, fix the friction, tag it. Charter stage check
+([V7_THE_GAME.md](../V7_THE_GAME.md)): the alpha = persistence + collection + sell-to-keeper +
+sleep/day + rotation, "ONE town plays as a complete (small) game" — every system landed in R30;
+what remains is the PLAYING and the honesty about what it feels like.
+
+## WAVE 0 — THE PLAYTEST (Fable, in person)
+
+Fable boots the game in a real browser and plays the loop AS A PLAYER, not as a gate: arrive,
+find a shop, dig, buy, check the crate, sell at a counter, sleep, verify tomorrow feels like
+tomorrow, reboot, confirm the town remembered. Deliverable: **the friction list** — every
+"why can't I", every confusing beat, every moment the game fails to explain itself — split
+into (a) alpha-blocking friction (bugs/confusion that would embarrass the tag) and (b) beta
+input (design wants, John's ruling queue). Honest numbers where they apply. *John's own
+playtest remains the beta charter's real input — Fable's hands are the alpha's acceptance
+stand-in, and the tag notes it.*
+
+## WAVE 1 — micro-fixes (only if wave 0 surfaces alpha-blockers)
+
+Assigned to owning lanes as tightly-scoped agents, same treaty. Nothing speculative — only
+what the playtest actually hit.
+
+## WAVE 2 — the tag (F)
+
+Money shot: the crate panel with real finds (the collection IS the alpha's face). Fresh
+`qa.sh --strict --matrix` on the final tree. Tag **`v7.0-alpha`** (annotated, the playtest
+verdict in the message), push main + tag. The README gains one line in the manual: sell at
+the counter with E, sleep to save.
+
+## ROUND CLOSED (Fable) — **v7.0-alpha TAGGED AND PUSHED** (`2491f1c`)
+
+Wave 0: Fable played the loop end to end — dig $10 → sell $5 (the spread felt) → keep a $12
+NM soul record → THE CRATE → full reload → **the town remembered** → SLEEP → day 2. Verdict:
+**the loop plays.** The playtest found the alpha-blocker every green gate had missed: **the
+dig was default-OFF on a plain boot** (v2-era opt-in, six epochs past the README's claim; every
+R30 gate booted `dig=1` explicitly — harness lesson #4, THE EXPLICIT-FLAG BLINDFOLD: a gate
+that boots its own flags cannot see a broken default). Waves 1+2: the flip (classic-safe,
+fenced with a naked-boot reachability assert + negative control), the de-staled splash, the
+money shot (Monster Robot's real crate, 3 real finds), qa 7/0/0 + MATRIX 10 towns on
+port-isolated servers (a second fix the round forced: the suite no longer silently reuses
+whatever holds :8130). **The beta queue is filed in LANE_F_NOTES §31.6** — spawn-faces-the-
+strip, crate-at-the-counter, dawn sky, THE BIBLE, per-day scarcity. The beta charters on
+John's own playtest whenever he walks the strip.
+
+## Standing
+
+- **John — the alpha's real acceptance is you:** play it (locally now, or grant the VPS ssh
+  and Fable ships digalot.fyi/procity same hour). Your friction list charters the beta. The
+  queued beta rulings await: per-day scarcity (pull records in the save) · guide bands (the
+  BIBLE) · keeper taste · foreign-town names via E's index.
+- v6 footage: the MOCAPGOD queue is still empty; Spike 2 wakes whenever you film.

docs/LANES/ROUND32_INSTRUCTIONS.md

@@ -0,0 +1,61 @@
+# PROCITY — Round 32 instructions (from Fable, integrator)
+
+Date: 2026-07-20 · **R31 closed** — v7.0-alpha tagged and pushed; the loop plays. Round 32 opens
+**v7.0-beta — THE THRILL, wave 1**: the guide bands land ([V7_THE_GAME.md](../V7_THE_GAME.md)
+stage 2), scarcity rides the save, and the alpha playtest's friction queue (LANE_F_NOTES §31.6)
+gets its cosmetic items. **Solo round:** John asked for direct progress; Fable executes all lanes
+in one session on JING5, same treaty, same gates — lane ownership is honoured in the commit
+messages, not the parallelism.
+
+## The design rulings this round encodes (from the ratified charter + §31.6 queue)
+
+1. **THE BIBLE derives, it is not baked.** E's band thresholds (build_stock_pack.py:88-94 —
+   record 8/25/60 · book 5/15/40 · toy 6/20/50) become a tiny JS mirror
+   (`js/interiors/bible.js`). No pack re-emit, so risk #3 (re-baked atlases orphaning owned
+   skus) never opens. The guide shows a BAND ("guide $25–59"), never a verdict — spotting the
+   gem stays the player's skill.
+2. **Gems live in the parody bins.** Real/mint packs derive `price_band` FROM `price`, so real
+   asking is always inside its band → with the §9.1 basis swap (sellOffer basis = bandLow),
+   every real round trip stays strictly negative and **the R30 no-pump gate holds untouched,
+   by construction**. Procedural stock gains seeded bands + a seeded under-band gem roll —
+   the only place asking can sit under the guide, which is exactly the op-shop fantasy.
+3. **Scarcity is what makes the gem loop safe** (§31.6 item 6, ruled WITH the bands as filed):
+   a bought dig slot enters `pulls` in the save (optional field, procity-save/1 — old saves
+   stay valid, old loaders drop the field without rejecting) and that bin omits it after the
+   draw (the proven `pack.gone` pick-then-omit seam — zero collateral). A gem is profit ONCE;
+   tomorrow's rotation re-keys the bin. Growth is bounded by finds, not arbitrage (charter
+   law #2's real meaning).
+4. **§31.6 items 1–3:** spawn becomes a computed cluster-pose facing the shop strip (classic
+   keeps the frozen v2 pose); THE CRATE surfaces inside interiors (C key — the §31.6
+   "crate at the counter" want, hidden while dig/sell cards own the screen); DAWN gets a
+   cool sky dome swap (classic + weather-override fenced).
+
+## Gate additions (F)
+
+`smoke_bible` in flags_check.py: guide stamp on the pull card (real + parody) · offer < bandLow
+structurally · a seeded parody gem exists and its round trip is positive ONCE (then the slot is
+gone — re-open the bin and it stays gone; reload and it stays gone) · negative control:
+`?game=0` re-opens the same bin with the slot PRESENT (the detector discriminates — scarcity is
+the save's doing, not the dig's). Classic purity untouched (no new module constructs under
+`?classic=1` / `?dig=0`).
+
+## ROUND CLOSED (Fable) — ALL GREEN
+
+`qa.sh --strict --matrix`: **7 passed · 0 failed · 0 warn · 0 skipped**, MATRIX 10 towns green.
+`smoke_bible`: 80 parody offers across 5 bins all band-lawful; bin1 holds 2 seeded gems (grail
+asking $19 vs keeper $30); the buy-everything ledger closes to the cent (Σask $333 → Σoffer
+$135, gems alone +$21, every non-gem strictly negative); the emptied bin stays empty across a
+full reload (16 pulls in the save) and `?game=0` re-opens it 16/16 (the control discriminates);
+0 console errors. sell_routing now asserts the exact §9.1 formula and passed on a BANDED item
+(standard, basis $8 → +$4). Money shots: `docs/shots/v7_beta/guide_card.png` (the guide stamp —
+"1974 COUNTRY guide $8–24" beside the $24 sticker) + `crate_at_the_counter.png` (THE CRATE open
+inside a shop, game bar riding bottom-right). Environment note: JING5's gitignored
+`web/assets/models/` was absent (fresh-checkout trap, now §32.3 in LANE_F_NOTES) — synced from
+m3ultra, which also un-warned the manifest validator's 15 cross-pack checks. Full record:
+LANE_F_NOTES §32. Shipped: bible.js + guide stamps + parody bands/gems (C) · pulls on the save
++ gone-wiring + digOffers surface (F) · crate-in-interiors + cluster-pose spawn + dawn sky (B)
+· smoke_bible + the routing amendment (F) · README/docs.
+
+**The beta's remaining charter** (next rounds): the WANTLIST + seeded rumors (D's keepers
+finally gossip) · travel costs a day (23 towns become the map) · §31.6-5 (dig Esc under real
+hands) · then v7.0 = GodBay offline auctions (G) + onboarding + the tour.

docs/LANES/ROUND33_INSTRUCTIONS.md

@@ -0,0 +1,52 @@
+# PROCITY — Round 33 instructions (from Fable, integrator)
+
+Date: 2026-07-20 · **R32 closed all green** (7/0/0, matrix 10 towns — THE BIBLE + scarcity live).
+Round 33 is **v7.0-beta wave 2 — THE HUNT**: the wantlist, the rumor, and travel that costs a
+day ([V7_THE_GAME.md](../V7_THE_GAME.md) system #6, the last unbuilt beta system). Solo round
+again (John's "keep going"), same treaty, lane ownership honoured in the commits.
+
+## The design rulings this round encodes
+
+1. **A want is something you SAW.** The wantlist grows from the pull card (☆ WANT IT — you
+   pulled it, it's dear, you'll hunt one cheaper) — not from an abstract search box the 90s
+   didn't have. Buying a matching item clears its want automatically (the hunt ends when
+   you're holding it). Wants ride the save (`wants: [{artist?|title?|sku?}]`, optional field,
+   same procity-save/1 back-compat law as `pulls`).
+2. **The keeper finally gossips** (charter: "D's citizens finally gossip for a reason").
+   Seeded per (citySeed, shop, day): ~45% of shop entries mutter a hunted want + a real cached
+   town in the banner — flavor and a travel nudge, honest about being neither promise nor
+   stock lookup (town-wide packs mean any town CAN surface the record eventually). Runtime
+   stream, freshly keyed — no plan/golden moves. Full persona lines remain D's when the v6
+   clip work lands; the banner is the keeper's voice until then.
+3. **Travel = the townKey changing hands.** Booting a save in a different town (different
+   plansrc/town/**seed** — a new seed is a new town) costs exactly one day, applied in
+   save.js `adopt()` so load and import both pay it, and pulls prune on the way. Same-town
+   reloads and export→import round trips stay free — the save-determinism gate's byte
+   equality survives untouched. The town selector IS the bus; the arrival toast names the
+   fare. The 23 towns are now a map you spend days moving across, not a dropdown.
+
+## Gate (F)
+
+`smoke_wantlist_travel` (STRICT): ☆→★ through the real card → the save carries the want ·
+a keeper names the hunted artist within the open shops (seeded scan) · buying the wanted
+sleeve auto-clears it · synthetic→melbourne costs exactly one day with cash/collection intact
+· same-town reboot is FREE (the control) · the ride home costs a day again · `?game=0` builds
+zero want DOM and mutters nothing.
+
+## ROUND CLOSED (Fable) — ALL GREEN
+
+`qa.sh --strict --matrix`: **7 passed · 0 failed · 0 warn · 0 skipped**, MATRIX 10 towns green
+(the shared-context day drift travel introduces across matrix towns was reasoned through
+before landing: determinism double-boots the SAME town, so no gate sees it). The new gate's
+run: want carried {THE VERANDAHS — "Servo at Midnight"} · rumor after 2 shops ("🗣 THE
+VERANDAHS? saw one in Castlemaine just last week") · buy cleared the want · travel day 1→2
+with $179 and the find riding along · same-town free · return trip day 3 · game=0 clean ·
+0 console errors. Full record: LANE_F_NOTES §33.
+
+Also caught and fixed here: the R32 crate-in-shops surface only BUILT in street frames — a
+door entered fast after boot had no game surface inside (the money-shot script entered faster
+than any gate does and exposed it; tickGame() now builds-or-refreshes in any mode). Money
+shots: `docs/shots/v7_beta/rumor_and_wantlist.png` + `want_card.png`.
+
+**What remains of v7:** §31.6-5 (dig Esc in person — John's hands) · then the v7.0 close:
+GodBay offline auctions (G's lane), THE FIRST FIVE MINUTES (onboarding), the tour, the tag.

docs/LANES/ROUND34_INSTRUCTIONS.md

@@ -0,0 +1,57 @@
+# PROCITY — Round 34 instructions (from Fable, integrator)
+
+Date: 2026-07-20 · **R33 closed all green** — every v7.0-beta system is built. Round 34 opens
+**the v7.0 close: GODBAY, the offline auction** ([V7_THE_GAME.md](../V7_THE_GAME.md) system #4:
+"list an item, a SEEDED offline auction resolves NEXT DAY — the come-back-tomorrow hook").
+Offline tier FIRST per the proven ladder (G3's live rails are v7.x; this round is the seeded
+brain in the game layer, G's later live tier must match these laws). Solo round (John's "keep
+rolling").
+
+## The laws (GODBAY v0 — named now, gated below)
+
+1. **Mail-in consignment.** You list from THE CRATE (⚖ LIST on a find) — the 90s answer
+   (classifieds + the post). The entry leaves the collection into `listings` (you cannot also
+   sell it at a counter), `listDay` stamped. Resolution happens when the day moves past
+   `listDay` — sleep, travel, or a day-moving import all count (adopt() and sleep() both run
+   the resolver).
+2. **THE ONE-HAMMER LAW (no retry farming).** The hammer is seeded by ITEM IDENTITY —
+   `godbay:<townKey>:<sku|slotId>:<dayFound>:<pricePaid>` — NOT by the resolution day. A
+   passed-in item re-lists to the SAME result, forever. There is no re-roll anywhere in the
+   economy: the keeper's offer is a formula, the auction is one hammer per item, per life.
+3. **The house always eats.** Hammer rolls uniform across the band (grail's open top = 2×low);
+   ~12% chance of a bidding war (×1.5–2.0); ~15% passed in (returns to the crate, free);
+   12% commission, net floor $1. Expected value ≈ 0.8× band midpoint — UNDER the asking-price
+   EV of in-band stock, so random flipping bleeds and only FINDS profit (charter law #2's
+   spirit at the auction house: growth bounded by finds, the keeper's instant half-of-low
+   remains the coward's floor and the auction the gambler's ceiling — bounded at 2×high×0.88).
+4. **Delta law / classic purity unchanged.** `listings` is an optional procity-save/1 field
+   (same back-compat law as pulls/wants); no game layer ⇒ no listings, no DOM, no news.
+5. **The morning report.** Resolution queues transient news ("⚖ SOLD 'Sunburnt' — hammer $38,
+   $33 after fees"); the shell folds it into the wake/arrival toast. News is NOT saved — it's
+   the morning paper, not the ledger (cash/collection already carry the truth).
+
+## Gate (F): `smoke_godbay` (STRICT)
+
+List through the real crate DOM (C → ⚖ LIST) → entry moves collection→listings, the save
+carries it · sleep → resolved: listings empty, cash+net OR item returned, news queued, net
+within [1, 2.2×bandHigh] when sold · DETERMINISM: a pre-sleep export imported twice sleeps to
+byte-identical cash/collection both times (the seeded hammer, measured not trusted) · travel
+resolves too (list → ride to melbourne → resolved on arrival) · `?game=0` builds zero ⚖ DOM ·
+0 console errors.
+
+## ROUND CLOSED (Fable) — ALL GREEN
+
+`qa.sh --strict --matrix` on the final tree: **7 passed · 0 failed · 0 warn · 0 skipped**,
+MATRIX 10 towns green. `smoke_godbay`: consigned through the real crate DOM (collection 2→1,
+listDay stamped) · ONE-HAMMER determinism (a frozen pre-sleep export slept twice → byte-
+identical) · honest bounded resolution (SOLD net $19 on a standard record, ≤ 2×$24×0.88) ·
+the wake toast carried "⚖ SOLD 'Cane Toad Blues' — hammer $22, $19 after fees" · the ride to
+melbourne hammered a listing on arrival · `?game=0` has no crate to list from · 0 console
+errors. Design note vs the brief: the band table is IMPORTED from C's bible.js and the PRNG
+from core/prng.js (one authority each — the drafted mirror died in review). Money shots:
+`docs/shots/v7_beta/godbay_morning_paper.png` (dawn day 2, the paper in the toast, the crate's
+⚖ row) + `godbay_at_auction.png`. Full record: LANE_F_NOTES §34.
+
+**What remains of v7.0:** THE FIRST FIVE MINUTES (onboarding — arrive with a want, three
+toast-beats) · the tour ("day one to first gem") · docs freeze · the tag. Then John's playtest
+charters what's next.

docs/LANES/ROUND35_INSTRUCTIONS.md

@@ -0,0 +1,36 @@
+# PROCITY — Round 35 instructions (from Fable, integrator)
+
+Date: 2026-07-20 · **R34 closed all green** (GODBAY hammers). Round 35 is **THE FIRST FIVE
+MINUTES** ([V7_THE_GAME.md](../V7_THE_GAME.md) system #7 — "smallest system, biggest
+stranger-facing payoff"), the last unbuilt v7.0 system before the tour/freeze/tag.
+
+## What ships
+
+1. **You arrive with a want.** A FRESH game (day 1, empty crate, empty auction house) seeds ONE
+   artist want off `rng(citySeed,'firstwant',0)` × C's parody roster (ARTISTS now exported) —
+   so the splash, the keeper rumors, and the tour all point at the same hunt on a given seed.
+   The splash names it: "You're hunting HILLS HOIST — $191 in your pocket." A returning save
+   gets its town back, not a tutorial; ?game=0 / classic never reach the block.
+2. **Three toast-beats walk the hustle** (fresh games only): ① find a record shop / E at a
+   crate (on walk-in) → ② riffle · mind the guide · BUY (first digOpen) → ③ sell at a counter
+   or ⚖ LIST and sleep (first find banked) → the send-off ("that's the whole hustle") on the
+   first sale-or-listing. Driven off existing events + wallet.onChange — zero new systems.
+3. **Toasts surface in every mode** — #pc-toast moved to document.body (the #pc-game body-mount
+   rule): beats fire INSIDE shops, and a SLEEP taken at a counter now shows its morning paper.
+
+## Gate (F): `smoke_first_five` (STRICT)
+
+Fresh game: 1 seeded want from the roster + the splash names hunt AND cash · beats ②/③/send-off
+through the REAL paths (E at crate / dig buy / crate ⚖) · a returning save gets NO tutorial
+(splash line hidden, no ② on dig) · a second fresh browser hunts the SAME artist (seeded, not
+random) · ?game=0 shows nothing · 0 console errors.
+
+## ROUND CLOSED (Fable) — ALL GREEN
+
+`qa.sh --strict --matrix`: 7 passed · 0 failed · 0 warn · 0 skipped, MATRIX 10 towns green
+(final tree). Gate run: hunts HILLS HOIST with $191, beats walked through the real dig/buy/list
+paths, returning-save and ?game=0 controls clean, second fresh browser hunts the same artist,
+0 console errors. Money shot: `docs/shots/v7_beta/first_five_splash.png`.
+
+**v7.0 remaining:** the tour ("day one to first gem") · docs freeze · the tag — and the tag
+waits for John's playtest (the alpha precedent: hands before tags).

docs/LANES/ROUND36_INSTRUCTIONS.md

@@ -0,0 +1,65 @@
+# PROCITY — Round 36 instructions (from Fable, integrator)
+
+Date: 2026-07-23 · **R32–R35 closed green in other sessions** (THE BIBLE · scarcity · THE HUNT
+· travel · GODBAY · the first five minutes · the tour). R35's close law stands: the tag waits
+for hands. Round 36 is **the v7.0 CLOSE**: Fable plays the whole loop, the out-of-round assets
+get regularized, the full gate runs over the final tree, docs freeze, **tag `v7.0`**.
+
+## WAVE 0 — THE PLAYTEST (Fable, in person, FRESH SAVE)
+
+The R31 precedent, now over every v7 system: fresh save → the first-five-minutes beats → spot
+a gem via the BIBLE's guide stamps → ☆ WANT an artist → the keeper's rumor → TRAVEL (and pay
+the day) → ⚖ LIST a find on GodBay → sleep → the morning paper → the hammer. Deliverable: the
+friction list, split alpha-blocking vs v7.x queue. R31's lesson stands armed: the playtest
+boots NAKED (no flags beyond dbg) — the explicit-flag blindfold is the enemy.
+
+## WAVE 1 — regularize the 2 a.m. commits (E)
+
+`046668e` + `b339402` landed outside the round system (July 20, disciplined but unswept):
+**4 dance-clip GLBs + 3 trellis DJ bodies** in `web/models/peds/`. E: provenance table entries
++ licence lines for all 7 (dance clips = the 90sDJsim Mixamo-family bank — verify and record
+the zone; DJ bodies = on-device trellis, CC0-equiv, the instrument discipline); depot publish
+per standing practice; the validator sees them. The commits verified "page boots" only — the
+full-suite proof is wave 2's.
+
+## WAVE 2 — the gate, the freeze, the tag (F)
+
+1. Any wave-0 alpha-blockers first (micro-fix agents per owner if not F's).
+2. Full `qa.sh --strict --matrix` over the final tree — explicitly including: the 3 DJ bodies
+   through the figure-scale gate (they joined the roster ungated), the dance clips through
+   classic zero-fetch + `?noassets` fallback (the commit claims it; the gate proves it), and
+   the R32–35 smokes (bible, scarcity, hunt, godbay) re-green on the final tree.
+3. Docs freeze: README v7 section (the loop, the manual rows for WANT/LIST/paper), notes §36,
+   the charters' retired-or-carried (A's v4-style list for the V7 charter risk section —
+   F may write it this once, single-lane round).
+4. **Tag `v7.0`** (annotated: the loop's numbers + both playtest verdicts), push main + tag.
+
+## Then: Fable writes the v7 epoch retro, and the menu reopens
+
+(v6 footage-spikes · the beta/v7.x queue incl. John's own playtest findings whenever he walks
+it · the frontier shelf: terrain, vernacular kit, civic layer, THE BIBLE polish.)
+
+## WAVE 2.5 (Fable ruling on F's held warn): CLASSIC KEEPS ITS PEOPLE
+
+F's `smoke_djdance` caught the July-20 commit adding the 5 DJ bodies to `PED_NAMES`
+UNCONDITIONALLY — they fetch under `?classic=1` and widened classic's seeded crowd pool 17→22.
+Every covenant gate stayed green (the covenant pins the plan; the roster was never pinned), but
+the classic fetch surface and crowd identity moved without a ruling. **RULED: option (b) — the
+five gate OUT of classic's pool**, mirroring the clips' `!CLASSIC` pattern. The covenant's
+meaning stays crisp: `?classic=1` is the v2 town INCLUDING ITS PEOPLE; the DJs walk every other
+boot. D lands the line; F re-verifies (classic fetch surface + pool 17 + smoke_djdance green,
+strict re-run) and RE-LAYS the tag on the true final commit. The warn was the system working —
+a covenanted surface cannot move quietly even when every pinned number stays green.
+
+## ROUND CLOSED (Fable) — **v7.0 TAGGED on `4709cfe`, all green, everything measured twice**
+
+Run 3 on the healed box: qa 7/0/0/0 · MATRIX 10 towns · flags harness 0 fails / **0 warns** (the
+§36.4 hold flipped to "✓ classic: zero DJ-body fetches" under the full suite) · classic
+`0x5f76e76` · the five DJs human-sized by name · Rokoko binds 64/65 · rotation byte-identical
+per day and across boots. The honest record stands in §36.5: re-gate runs 1–2 died to a
+BOX-level fork famine (m3panel's 2.5-day `pmset|tail` leak — fixed at source mid-round, the
+`party.monster.reaper` janitor installed as standing fleet infra) — starvation artifacts, not
+gates. The hold's full arc: held by machine-recorded WARN → ruled (classic keeps its people) →
+fixed by the owning lane alone → re-proven by the gate that held it. Nothing improvised.
+
+## Waves: [Fable plays] → [E] → [F fix+gate+tag] → [D classic-gate + F re-lay] → [retro]

docs/LANES/ROUND37_INSTRUCTIONS.md

@@ -0,0 +1,202 @@
+# PROCITY — Round 37 instructions (from Fable, integrator)
+
+Date: 2026-07-26 · **v8 opens.** Charter: [V8_SOMEONE_LIVES_HERE.md](../V8_SOMEONE_LIVES_HERE.md)
+· evidence: [REVIEW_CITY_PATTERNS.md](../REVIEW_CITY_PATTERNS.md) (16-agent audit) ·
+[ANIMALS_ANSWER.md](../ANIMALS_ANSWER.md) (5-agent spike). **Read the charter first.**
+
+Round 37 is **WAVE 0 — THE FLOOR**. No content. Five micro items that every v8 content idea
+stands on. John's rulings are made: **the kerb is FOOTPATH**, **real towns get the content**,
+**animals are generated not downloaded**. Nothing here is a design question; it is execution
+plus honest measurement. **No tag this round** — wave 0 closes when the floor is level.
+
+## The ledger
+
+### 0.3 — SETTLE THE BUDGET OF RECORD *(Lane F, and it goes FIRST)*
+Two independent measurements disagree and **no proposal may spend against a number nobody can
+reproduce**: the city-patterns audit measured a **walked worst frame of 280/300 draws** (8 m
+steps down the main spine, carrying the R+1 dispose window at up to 31 live chunks); the animal
+spike re-measured and got **191 default / 167 classic** by teleport-walk and could not
+reproduce 280. Both were headless (SwiftShader). Settle it:
+- Walk it properly — real continuous motion, not bookmark teleports, sampling every frame
+  through the chunk dispose window, on the default boot AND `?classic=1`.
+- If you can get a real-GPU number, say so and say how; if not, state that the number is
+  headless and what that costs in confidence.
+- **Re-pin the budget of record** in the docs that assert it, and state the tri number the same
+  way (99–124k of 200k was the audit's range; two sessions disagreed enough that it needs a pin).
+- **Settle ONE shared instance cap** for future town-wide standing layers (three animal
+  proposals independently invented 120, 250 and "plus gulls" for the same layer). One number,
+  written down, with the reasoning.
+Deliverable: the pinned numbers + the method, in LANE_F_NOTES §37 and wherever the laws are
+asserted. This unblocks everyone else's budget claims for the whole epoch.
+
+### 0.1 — THE KERB: FOOTPATH *(Lane A ruling-side · Lane B code · Lane F gate)*
+John's ruling: the 9 m band between kerb and shopfront is **footpath**. Lane A's published
+corridor law (`roadWidth` / `vergeBand` / `poleOffset` in `core/registry.js`) is the single
+source of truth and Lane B adopts it.
+- **B:** extend the **existing merged `footGeos` class** inward from `e.width/2` to
+  `roadWidth(e)/2` in `ground.js`. **This must stay +0 draws** (same merged mesh) — if it
+  cannot, stop and report rather than paying a draw. Expect ~2k tris and *better* fill-rate
+  (18 m of every main street stops being painted as road). **Special-case or it breaks:**
+  `arcade` (`roadWidth` 0 → zero-area road quad + coincident kerbs) and `lane`
+  (`vergeBand` = [2,2]). Grass verges survive on **residential edges only**.
+- **B:** ship **`?verge=0`** — a permanent flag that reverts to the pre-ruling geometry. It is
+  the gate's falsifiability control and it costs nothing; it stays in the codebase forever.
+- **A:** the corridor law is yours — confirm the exports are what B should consume, and fix the
+  selfcheck's poster-clearance assertion, which currently validates against `roadWidth/2` (5 m)
+  while B painted bitumen to 14 m, i.e. **the gate was green while 14 gig posters stood in the
+  road on the default boot**. Say plainly whether any golden moves (it should not — this is
+  render-side), and if one does, amendment law, same commit.
+- **F (after B):** the gate — assert poster clearance on the default boot, and **assert the
+  same leg FAILS under `?verge=0`**. The pre-change failure is known and counted at exactly 14.
+
+### 0.2 — REPAIR `smoke_tram` *(Lane F, micro)*
+`flags_check.py:617-630` asserts exactly one thing — `!!getObjectByName('tram')` — prints a SKIP
+and returns when absent, and **passes on the fenced path**, because `tram.js:110-114` adds a
+named empty group. A live vacuous-gate violation inside our own suite. Fix it so it proves the
+tram *runs* (route resolved, stops sane, moves between frames) on the towns where it runs, and
+proves it is *genuinely absent* on the fenced towns — with a control that fails.
+
+### 0.5 — `classic_regression` GETS A NETWORK ALLOW-LIST *(Lane F, micro)*
+`classic_regression` (`flags_check.py:128-241`) makes **no network assertion at all**. That is
+why R36's fetch-surface widening (five DJ bodies) needed a brand-new smoke to catch it. Give it
+an **allow-list**: the four v2-era depot furniture GLBs (`bench`, `bin`, `bus_shelter`,
+`food_cart` — git-verified v2 baseline, `24cef5a`, tagged v2.0-alpha→v2.0) plus same-origin.
+**Allow-list, never deny-list** — a deny-list only catches what you already thought of.
+Prove it discriminates: point it at a fabricated extra fetch and assert it goes red.
+
+### 0.4 — WIRE `ctx.onChunkBuilt` / `onChunkDisposed` *(Lane B, one line each)*
+Producer at `chunks.js:43-51`, consumer at `sim.js:203-205`. Both shipped, never connected,
+since R3. Every per-chunk entity system in the v8 slate wants it. Wire it, prove a consumer
+actually fires, and confirm zero behaviour change when nobody subscribes.
+
+## Laws
+
+Everything standing. This round specifically: **+0 draws is a requirement, not an aspiration,
+for 0.1** · every new/repaired gate must FAIL when its subject is absent, and each ships with
+its falsifiability control demonstrated · pathspec-atomic commits (three lanes share the tree) ·
+no pushes, no tags — Fable pushes at the close · measurement over brief: if a premise here is
+wrong, prove it with numbers and say so loudly.
+
+## Order
+
+1. **Parallel: F (0.3 first, then 0.2 + 0.5 — all in `tools/`) · B (0.1 code + `?verge=0` +
+   0.4) · A (0.1 ruling-side + selfcheck).** Disjoint files by construction.
+2. **Then F again:** the kerb gate against B's landed code + the `?verge=0` control, full
+   `qa.sh --strict --matrix`, and the round report.
+
+## FABLE'S MID-ROUND RULING — CLASSIC KEEPS ITS PAINT (B's escalation, §0.1)
+
+B implemented the kerb ruling with `?classic=1` **forcing verge off** — i.e. classic keeps the
+pre-ruling ground — rather than moving a covenanted town's render on its own initiative, and
+escalated the choice. **RULED: keep the fence. Classic keeps v2's paint.**
+
+Reasoning, and it is not the R27 precedent: R27 (John's facade ruling — "the covenant is
+anti-drift machinery, not a defect preservative") applies when classic is preserving a **live
+defect**. Here it is not. The defect this ruling fixes is *posters standing in the road* — and
+**`?classic=1` has no gig layer, therefore no posters, therefore no defect to preserve**. What
+classic would be adopting is a cosmetic change to road paint on a town whose entire job is to
+be v2, unchanged, forever. The museum piece keeps its paint.
+
+**The one real cost, and its mitigation:** a fenced classic means two ground geometries exist —
+and "two implementations of one thing" is precisely the disease this round was convened to stop
+(four `isOpen`s, three `chunkIndex` divergences, two registries). So the fence is ruled
+acceptable **only as a single branch on one code path**, never a second implementation. B has
+built it that way (one flag, one `bandOuter <= bandInner` test); it stays that way. If it ever
+starts to fork, the fence comes down and classic takes the footpath.
+
+*John may overrule; it is a one-token change (drop `!classic`), and B has proven both sides
+render identically to their intended baselines.*
+
+## FABLE'S SECOND MID-ROUND RULING — CLASSIC'S POST-v2 FETCH DELTA (F's escalation, §0.5)
+
+F built the allow-list by deriving it from the **v2.0 tag at gate time** rather than from my
+brief's literal ("four depot GLBs + same-origin"), and was right to: my shape **would have gone
+green straight through the R36 breach**, because `models/peds/woman_dj_01.glb` is same-origin.
+Deriving from `git ls-tree v2.0` enumerates the covenanted 21 ped files where today's directory
+holds 32. That is the correct mechanism and it stands.
+
+Doing it, F measured a **+6 file delta** between the real v2.0 tree's wire and today's
+`?classic=1`, and refused to improvise a verdict on a six-epoch-old fact. **RULED:**
+
+- **The 5 audio files (R11, `f7dd44f`): RATIFIED as baseline.** The covenant preserves "the
+  exact v2 town", and **v2.1 was v2's final tagged state** — audio shipped inside v2, so
+  classic fetching it is classic being correct, exactly as the four furniture GLBs are.
+- **`assets/towns/index.json` (R20/R21): NOT baseline — carried as a NAMED, PRINTED exception,
+  not silently.** It is v4 selector machinery in a v2 museum. It changes nothing about the
+  classic town (a UI list, no geometry, no identity, no seeded draw), so it is not the R36
+  species and it does not get gated in a floor round. It goes on the allow-list **labelled as a
+  post-v2 exception** so it can never read as baseline.
+- **Filed to the v8 debt ledger, for R38 or later:** *should `?classic=1` show the town selector
+  at all?* In v2 there was no selector (it landed R19). Hiding it under classic would retire the
+  exception at the source and cost one branch — but it is a question about what classic *means*,
+  which is a design ruling, not a leak to plug mid-round.
+
+**Also ratified from F's report:** the budget of record is **292 draws / 124,793 tris** (the
+280-vs-191 split was **camera bearing** — 110 draws of spread, the audit took `DBG.teleport`'s
+default yaw 0 which is the worst bearing, the spike took a travel-facing yaw; both correct,
+different quantities). My "viewport is the variable" hypothesis was **disproven** — F ran
+1280×720 vs 2560×1440 with everything else fixed and got byte-identical counts; three's culling
+is frustum-shaped, not pixel-shaped. Shared instance cap: **256**, binding companions ≤24
+tris/instance and proximity-first spending. **Margin is 8 draws, not twenty.**
+
+**Filed, not fixed (R38+):** `?r=3` on the default town measures **307 draws** — an ungated
+override that breaches the ≤300 law, with no gate covering it. Documented in the README as a
+diagnostic, not a supported boot; whether `?r=` gets clamped is a later ruling.
+
+## ROUND CLOSED (Fable) — **THE FLOOR IS LEVEL. All five items, all green, no tag.**
+
+`qa.sh --strict --matrix`: **7 passed · 0 failed · 0 warn · 0 skipped** · selfcheck **157,407**
+(+1,055 of A's new poster assertions, all green on the ruled street) · flags harness **0 fails
+/ 0 warns** · **MATRIX GREEN 10 towns × 7 gates**. Deliberately **no tag** — wave 0 levels the
+floor, it does not ship a version.
+
+**What actually changed, in one line each.** The kerb is footpath and it cost **+0 draws with
+triangles going DOWN** (A/B'd against HEAD on a second port; sum-of-draws identical at all 102
+walked steps). **14 posters stood in painted bitumen; 0 do now — and not one poster moved, the
+ground did.** The budget of record is **292/124,793**, and the 280-vs-191 fight was **camera
+bearing** (110 draws of spread; the audit took `DBG.teleport`'s default yaw 0, the worst
+bearing; the spike took a travel-facing yaw — both correct, different quantities). Two vacuous
+gates are dead: `smoke_tram` (green exactly where it was meant to look, because a named empty
+group satisfied it) and the poster clearance check (**the placer seats via `poleOffset`, which
+is derived from `roadWidth`, and the gate asserted against `roadWidth/2` — the same function
+agreeing with itself, the R27 trap inside the file whose header explains the R27 trap**). The
+chunk seam is subscribable at last — the producer was fine; **`chunks.ctx` was never returned**,
+so a consumer holding `PROCITY.chunks` had nowhere to attach.
+
+**The round's own lesson, recorded.** B's first cut passed every number — +0 draws, posters
+clear, zero errors — **and painted every intersection shut.** A screenshot caught what the
+metrics could not. Fixed by lifting the carriageway over the footpath at junctions, verified on
+Katoomba's worst 4.3° corner. *Green metrics over a wrong world is this project's oldest
+failure mode and it does not care which epoch it is.*
+
+**Two lanes, two independent methods, one number.** A counted 14 plan-side (node, over the
+plan, by offset); F counted 14 paint-side (browser raycast, over B's geometry, classified by
+**material identity** so it cannot drift when B edits). Both flip to 0 on the ruled street and
+both fire at exactly 14 under `?verge=0`. F's two **detector controls** are the load-bearing
+part: "0 posters on road" is a sentence about nothing unless the classifier is shown saying
+*road* AND *footpath* on the same boot.
+
+**Cross-lane corrections that landed mid-round** (the shepherd's whole job): A's measurement
+killed three literals in Fable's brief — `lane`'s band is `[4,4]` on 56 real edges, not the
+synthetic `[2,2]`; the "9 m band / 18 m of main" figures are synthetic-only (a real main is
+24 m ⇒ 7 m, and `side`@12 is **72% of the corpus** at 3 m). B confirms it would have shipped
+the `[2,2]` assumption otherwise. F's allow-list mechanism corrected Fable's other literal:
+"four GLBs + same-origin" **would have gone green straight through the R36 breach**, so the
+list is derived from `git ls-tree` at gate time — and per this round's ruling the authority tag
+moved `v2.0 → v2.1`, which git made surgical (`git diff v2.0 v2.1 -- web/` is the audio pack
+and its wiring, zero other assets, zero deletions).
+
+**Carried to the v8 debt ledger (filed, not smuggled):** A's D1–D4 (three `chunkIndex`
+divergences · four `isOpen` implementations, A's canonical export with **zero importers** ·
+two registries, which is why gig venues have worn op-shop signage since R13 · A's own
+nearest-edge/arcade poster-gate hole, costed at 11 of 26 town gig goldens and deferred so this
+round's "did the kerb move a golden?" stays a clean **no**) · the town-matrix's budget column
+is **bookmark numbers**, which this round proves under-report a walked-and-turned frame by
+~120 draws — a regression signal, not the budget of record · `?r=3` breaches at **307 draws**
+through an ungated override · *should `?classic=1` show the town selector at all?*
+
+## Standing
+
+- John's three rulings are made; nothing in this round needs him.
+- Still open for later rounds, not now: the market-plaza amendment, hardyards provenance,
+  where MOCAPGOD actually lives.

docs/LANES/ROUND38_INSTRUCTIONS.md

@@ -0,0 +1,180 @@
+# PROCITY — Round 38 instructions (from Fable, integrator)
+
+Date: 2026-07-26 · **R37 closed green: the floor is level.** The kerb is footpath at +0 draws,
+14 posters are out of the road, two vacuous gates are dead, the budget is pinned at
+**292 draws / 124,793 tris (8 draws of margin)**, the shared instance cap is **256**, and
+`ctx.onChunkBuilt` is finally subscribable. Round 38 is **WAVE 1 — INHABITATION**: four items
+that make the town feel lived in. **Three of the four are +0 or +1 draws.** None needs a rig, a
+clip, or John's mocap footage.
+
+Charter: [V8_SOMEONE_LIVES_HERE.md](../V8_SOMEONE_LIVES_HERE.md) · evidence:
+[REVIEW_CITY_PATTERNS.md](../REVIEW_CITY_PATTERNS.md) · animals:
+[ANIMALS_ANSWER.md](../ANIMALS_ANSWER.md) · R37's rulings and debt ledger:
+[ROUND37_INSTRUCTIONS.md](ROUND37_INSTRUCTIONS.md).
+
+## THE CORRECTIONS THAT ARE BINDING (adversarial review already killed the naive version)
+
+Do not re-derive these. They cost a review pass each.
+
+1. **1.1 is SIX NEW MIXER LAYERS, not "generalise `audio.js:300-311`"** — audio.js has
+   hardcoded bed layers per source class, not a generic point-source system. **There is no
+   panning**: `playSfx` is mono with a gain multiplier, so *distance* works and *direction* does
+   not. Say so in the notes or budget a `StereoPannerNode`. Derive day-of-week **locally**.
+2. **1.2's `state` field is NOT populated on all 23 towns** — `newtown_godverse` and
+   `redhill_godverse` carry `state: ''`. The vacuous arm must be **per-town**, not per-corpus,
+   or those two silently take a default branch with no SKIP printed.
+3. **1.2's `skyBias` must NOT go through `lighting.setSky`** — `externalSky` (`lighting.js:53`)
+   is a **one-way latch with no un-set path**. Feed the base `skyName` selection instead.
+   `townCharacter(null)` returning the frozen literals makes classic byte-identical **by
+   construction rather than by flag** — that is the right mechanism, use it.
+4. **1.3: the ice-cream-container hat is CUT** (no street verb exists; `index.html` binds only
+   `] [ P M T` plus a click that enters a shop). And **the magpie's territory must scale with
+   the road graph**: 370 pole anchors on synthetic vs **10,014 poles / 13,730 tree anchors
+   across 2,593 edges on `bendigo_real`** — a capacity-4 magpie there is a swooping town where
+   you never meet the magpie. R37's own anchor-supply measurement says the same: synthetic
+   **246 poles / 6.8 km** vs bendigo **7,325 / 188 km**. **Spend the cap proximity-first**
+   through `ctx.onChunkBuilt`, which B wired last round precisely for this.
+5. **1.4 is built INSIDE `buildings.js`'s existing `boxMats` InstancedMesh** (it already carries
+   shells, parapets and verandah posts, and `buildHouse` already pushes into it) → hoist, fence
+   run, aerial and tank are **+0 draws**. A separate `world/yards.js` cannot reach `boxMats` and
+   would pay a draw the proposal then presented as its honest cost. **Only the alpha washing
+   quads need a new mesh → +1 draw/chunk total, not +2.**
+6. **1.4's washing needs an INVERTED wind weight.** `wind.js:38-45` computes
+   `wH = clamp(y/4.4,0,1); wH *= wH` — top-weighted, base planted. Correct for a gum, exactly
+   wrong for a sheet pegged at the top. At 1.6 m the amplitude is **0.7–4.5 cm, i.e. visually
+   inert**. Either write an inverted-weight sway mode or **drop the washing this round** and say
+   which.
+7. **1.4 is synthetic-only until the civic fetch lands** (all 21 real towns are 100%
+   `use:'shop'`, one district). It ships on the default boot — which is still the boot every
+   player gets — and extends to real towns in a later round. Scope it honestly; do not fake it.
+8. **REJECT the hardyards GLBs on provenance** (39 GLBs, provenance documented for one file).
+   Generate ours. This was the best licence judgement in the review packet.
+9. **The budget line every item must answer:** margin is **8 draws**, and triangles are the
+   cheap resource (~75k spare). A town-wide `InstancedMesh` is **1 draw at any N**; a per-chunk
+   type is **+1 × up to 31 live chunks**. Prefer town-wide. Cap 256, ≤24 tris/instance.
+
+## The ledger
+
+### 1.1 — SOMEONE ELSE'S LIFE: the audio inhabitation layer *(E + B, F gates)*
+**The review's only unqualified SHIP.** The manifest ships 7 ambience / 9 sfx / 7 music and not
+one animal, domestic or seasonal sound. A dog going off behind a paling fence, a mower two
+streets over, a radio through a window, sprinklers, a roller door, a distant magpie carol —
+the sound of a life happening off-screen, at a **seeded anchor** so it is the same dog on the
+same street every time you walk it.
+**E:** ~30-line numpy generators in `gen_audio.py`'s PACK registry, deterministic via
+`crc32(name)`, 🟢 original by construction. **B:** the six mixer layers + seeded anchor
+placement + distance falloff. **Budget: zero draws, zero tris — the only item in the epoch that
+cannot touch the budget under any circumstance.** Audio pack ~10 MB → ~11 MB against a 25 MB cap.
+**Gate (F):** keep the falsifiability control verbatim — point one table entry at a
+non-existent key and assert the leg **FAILS**. Every other gate this round copies its shape.
+
+### 1.2 — TWENTY-THREE TOWNS: the per-town character vector *(B + E, F gates)*
+Twenty-three real towns currently differ only in street layout and shop names. Give each a
+ground palette, an ambience mix and a sky bias. `ground.js`'s `add()` merges each surface class
+into ONE mesh for the whole town regardless of size (verified: exactly 5 meshes) — **a palette
+swap is +0 draws / +0 tris**, the strongest cost claim in the packet. `gravel` (verge) and
+`reddust` (outback) already ship in the manifest and are selected by **nothing**.
+**E:** 3–4 new `gen_skins.py --local` grounds (dry summer grass, cool-temperate grass,
+red-dusted bitumen, coastal sand) so "Darwin is red dust, Hobart is cold light" is real.
+
+### 1.3 — THE MAGPIE *(B + E, F gates)*
+Swooping season: for ~six weeks of the game's year, one bird on one street will not let you
+walk past it. Real behaviour — a 6-week window Aug–Oct, and ~90% of males never swoop, so
+**one bird, not a plague**. A static mesh on a scripted parabola (the tram's verified
+position-is-a-function-of-(seed,time) contract), wing wave through `wind.js`'s amplitude
+uniform, byte-identical at amp 0. **+1 draw / ≤900 tris.**
+**Gate (F):** keep "the day-roll clears the latch and localStorage gained no new key" verbatim
+— the best single arm in the packet and a genuine delta-law falsifier.
+
+### 1.4 — BACKYARD AUSTRALIA *(B + E, F gates)*
+Hills Hoists, paling fences, TV aerials, water tanks. **181 house and yard lots on the default
+boot with nothing in them.** Per correction 5, inside `boxMats`: **+0 draws** for the box props,
++1 draw/chunk only if the washing ships.
+*Measured headroom:* the residential district walks at **157 draws / 31,651 tris** worst
+(edge 16, 20 live chunks) against a main-spine control of 263/123,602 on the same build —
+~143 spare draws where these props land.
+
+## Laws
+
+Everything standing, plus: **every item states its draw cost against the pinned 292/300 and its
+tri cost against ~75k spare** · every new gate ships its falsifiability control demonstrated ·
+classic stays byte-identical **by construction where possible** (1.2's `townCharacter(null)` is
+the model) · `?noassets` fallback for every asset · pathspec-atomic commits · **no tag** — wave 1
+is content, the epoch tags when it is whole.
+
+⚠️ **Tree hazard:** a separate background session is editing **`web/js/world/venue.js`** (capping
+town-wide pool instances on real towns). **No lane touches `venue.js` this round.** Expect it
+dirty; commit around it by pathspec.
+
+## Order
+
+1. **Parallel: E (the asset wave) + B (all four runtime items, procedural-first so nothing
+   blocks on E).**
+2. **Then F:** the four gates, full `qa.sh --strict --matrix`, round close. No tag.
+
+## ROUND CLOSED (Fable) — **THE TOWN IS INHABITED. All four items, all green, no tag.**
+
+`qa.sh --strict --matrix`: **7 passed · 0 failed · 0 warn · 0 skipped** · flags_check **0/0** with
+all four new gates inside it · **MATRIX GREEN 10 towns × 7 gates**, 0 fetches under `?noassets`.
+
+**THE BUDGET: 292/300 STANDS — margin is still EIGHT, not six.** My naive sum (292 + 2 = 294) was
+wrong, and wrong in our favour: **the pinned worst frame is a NIGHT frame, and both of wave 1's
+draw-spending layers are structurally zero at night** (the washing comes in, the magpie roosts).
+Wave 1's one draw is spent in daylight, where the walked peak sits ten draws lower. F reproduced
+the R37 pin **to the byte, twice** (292 / 120,145 / 31 live chunks) on a control tree, then
+isolated every delta by flag revert: `?yards=0` at night returns all three control numbers;
+`?yards=0` at noon isolates the noon +1 to the washing alone.
+
+**B's control-346 is adjudicated, not merely cited.** As a *delta* it was the wall-clock ped-spawn
+trap and B was right to hide the sim — but ">300" is a claim about the world, and neither existing
+method could adjudicate it (one photographs a half-dressed street, the other arrives clean at 27
+chunks). F built `budget_walk.py --method stepsettle` — fixed-yaw stations, each drained *then held
+N real rAF frames*, so R+1 residue and a full crowd land in one frame. The sign flip is the finding:
+the settle is **+3 draws at noon, −9 at night**, because at night the settled street retires near
+rigs to impostors and a sampler that never waits never sees the crowd go home. **Highest number
+anywhere — 4 methods × 2 trees × 2 segments × 5 towns — is 292. Nothing read over 300.**
+
+**F corrected its own R37 pin:** corpus tri worst is **130,727** (fitzroy), not 124,793 — and it
+reads 130,727 on the *control*, so it is R37's 8 m station spacing vs this round's 2 m, not a wave-1
+cost. *Station spacing is a bigger lever on a walked worst frame than settle policy.*
+
+**What shipped:** 21 distinct palettes across 23 towns at +0/+0 (classic byte-identical **by
+construction** — `townCharacter(null)` returns the v1 literals with the same material cache key) ·
+36 `yard` lots that had rendered as blank shopfront sheds since v1 are now fenced backyards, and
+the box props are **−2 draws** because those lots used to fall through to `buildShopfront` · the
+magpie at +1 draw / 182 tris, season now **23 distinct positions across 24 towns** · six audio
+layers at zero draws **that pan** (B refused the no-panning limitation and added a
+`StereoPannerNode`; F proved the pan is a bearing: yaw 0/90/180/270 → +0.00 / +0.85 / −0.00 / −0.85).
+
+**Three self-caught errors, one per lane — the round's real signature.** B's own season mechanism
+was **vacuous**: keyed on `citySeed` alone it made **24 of 24 towns a constant 214 days** from
+swooping season, and it would have gated green because `?magpie=1` forces the state. F's own pan
+arm used two bearings, read ±0.00, and **would have called a working panner inconclusive** — four
+bearings now. E generated a perfectly good 1,121-tri `paling_fence` that B rejected on measurement
+(905 instances = **1.01 M triangles** against ~75k spare), producing the sizing law this round paid
+for: **an asset's budget is `tris × the instance count the placement rule implies`** — get the
+instance count from the consuming lane *before* generating anything that tiles or repeats per-lot.
+
+**Assets:** `trellis2_mlx` swap verified **1.92×** (and it hid a trap — `sorted(rglob)[0]` was
+picking the *untextured* candidate); six sounds; four grounds; three GLBs published and
+**sha1-verified in both directions off the public depot**; and two **decisive failures** —
+`hills_hoist` and `tv_aerial` cannot be generated (TRELLIS returns thin wire as thousands of
+fragments; no voxel size keeps a 30 mm pole and a 2 mm wire at 600 tris), deleted so nothing could
+catalogue them, permanently primitive at +0 draws. The magpie shipped reading as a **crow**; E
+tinted it by projecting anatomical windows through the UVs in the mesh's own frame (a 100-island
+smart unwrap has no island that announces itself as "nape"), and **Fable verified the render by
+eye**: pied and unmistakable at 64/48/32 px.
+
+**Carried:** two magpies now exist (B's 182-tri procedural bird ships; E's 894-tri tinted GLB is a
+named upgrade at `birdGeometry()`/`birdMaterial()`) — **filed for a side-by-side screenshot, not
+forced** · `magpie.js` carries two stale tri comments (154 vs measured 182) · §1.4 is synthetic-only
+until the civic fetch, and its gate **skips loudly** on real towns rather than passing vacuously ·
+audible output is unverifiable headlessly and every run prints so — *nobody in this loop has ears* ·
+A's D1–D4 · the matrix budget column is bookmark numbers · `?r=3` breaches at 307 · the
+`?classic=1` selector question.
+
+## Standing
+
+Nothing needs John. Carried debt (R37's ledger, unchanged): A's D1–D4 · the matrix's budget
+column is bookmark numbers · `?r=3` breaches at 307 · should `?classic=1` show the town
+selector at all.

docs/LANES/ROUND39_INSTRUCTIONS.md

@@ -0,0 +1,205 @@
+# PROCITY — Round 39 instructions (from Fable, integrator)
+
+Date: 2026-07-26 · **R38 closed green — v8 wave 1 shipped and the town is inhabited** (21 palettes,
+36 backyards, the magpie, six panning ambient layers; budget held at **292/300, eight draws of
+margin**, because the worst frame is a night frame and both new layers are zero at night).
+
+**JOHN HAS RULED: do the street names.** *"yes do street names for sure and what else can we get on
+with? just keep it going."* Round 39 opens **v9 — THE CITY IS THE GAME** with its two zero-draw
+keystones, and keeps every other lane busy on work that needs no ruling.
+
+Charters: [V9_THE_CITY_IS_THE_GAME.md](../V9_THE_CITY_IS_THE_GAME.md) (the hunt; read Fable's
+verification header first) · [SALE_RED_TICKET_DAY.md](../SALE_RED_TICKET_DAY.md) (the round and the
+Band Floor Law) · [V8_SOMEONE_LIVES_HERE.md](../V8_SOMEONE_LIVES_HERE.md) (in flight; wave 2 later).
+
+## THE BINDING FACTS (verified by Fable — do not re-derive, do not contradict without numbers)
+
+1. **17,835 of 19,132 road ways in the shipped caches carry a `name` — 93.2%.** Counted
+   independently. `plan_osm.js:363` builds each way as `rawWays.push({ kind: roadEdgeKind(rd.kind),
+   pl })` — it keeps the kind and the geometry and **discards `rd.name`**. Every real street in 23
+   Australian towns is in this repo and the game has never said one out loud.
+2. **The names are recoverable without touching citygen's output.** Plan nodes ARE snapped
+   projected way points (`plan_osm.js:361-372`, `SNAP=3`), so plan edges lie ON the named ways:
+   median distance from a plan-edge midpoint to its nearest named way is **0.03–0.90 m** (worst
+   town katoomba), and **97.8% of corpus shops (1,192/1,219) resolve to a street name**.
+3. ~~**THE INTERIOR MARGIN IS SIX DRAWS, NOT 191.**~~ **CORRECTED IN-ROUND BY LANE C — the margin
+   was 31, and is 21 after C's bin.** The direction was right (`index.html:349` ships
+   `useGLB: !NOASSETS`, so the **default boot IS the GLB path** — that part stands and matters).
+   The *number* was stale: `C-progress.md:841`'s "GLB-on 344" is **R9-era**. C measured today's
+   tree before touching anything: **GLB-off 156 · GLB-on 319**, both `opshop/hall`.
+   **Fable's error, owned:** I verified the claim's provenance (the doc does say 344) and not the
+   measurement (the tree says 319). *A document is not a tree.* The house rule stands and I broke
+   it: measure the thing, not the note about the thing.
+   **And the real finding is bigger than the correction** — see the transmission entry in the
+   close.
+4. **Vertical movement is fiction.** `player.js:64` and `interior_mode.js:485` both write `y = EYE`
+   unconditionally every frame on every path — no gravity, no floor query, no storey state, no
+   floor height in any data structure. **Nothing this round proposes stairs.**
+5. **Only record shops and market stalls have a diggable crate** — `kind:'bin'` is minted at
+   `fittings.js:60`/`:75` (`recordBin`, `crate`) and used by exactly two recipes (`theme.js:38-39`
+   record, `:196` stall). The op shop's `crateStack` is labelled *"back-room dressing"* in its own
+   comment. **You cannot dig in an op shop**, in a game built on op-shop DNA.
+
+## The ledger
+
+### 39.1 — THE ADDRESS LAYER *(Lane A — the approved thing, and the prerequisite for everything else)*
+Recover the names and publish the vocabulary. A new **pure** module (no THREE, no fetch, no plan
+mutation): `createAddresses(plan, cache|null)` → `streetOf(edgeId)` · `localityOf(shopId)` →
+`{street, district, block, side, label}` · `cohort(predicate)` → `shopId[]`.
+- **Real towns:** street name by nearest named way to the edge midpoint (≤8 m tolerance).
+- **Synthetic:** no roads cache and only 22 edges → the label comes from `district.kind` + block:
+  *"the market end"*, *"the arcade"*, *"the backstreets"*. **Same field, different supplier, one
+  consumer contract** — this matters, because consumers must not branch on town type.
+- The synthesis proposes a **one-line** upgrade: write `norm.shift = {shx, shz}` at
+  `plan_osm.js:510` into the **caller-supplied `opts.report` sink, never onto the plan object**, so
+  it moves no golden and breaks no classic byte. **Take it if it is genuinely that clean; measure
+  and report if it is not.**
+- **Goldens must not move.** State it plainly with your selfcheck numbers. If one moves, stop.
+- Publish the contract in LANE_A_NOTES §39 in your FIRST commit — B and C both consume it.
+
+### 39.2 — THE FOG *(Lane B — the keystone, zero draws)*
+`minimap.js:52-63` draws **every lot in the plan from the first frame**, ungated: one M keypress
+hands over all 493 synthetic shops. Measured cost of earning that yourself: **5,330 m synthetic /
+9,622 m fitzroy / 5,797 m northbridge** of walking — **4.8 / 8.7 / 5.3 game-days** at WALK 4.6 m/s
+against the 240-second day.
+- Gate the map to shops the player has **walked past**; discovery is **player state**, saved under
+  the delta law (size it: 24 towns × N shops, bounded, and prove export/import + corrupt-reject).
+- **Frame the map to what you know.** The payoff is the reason to do it: a shop rectangle goes from
+  **0.8×1.1 px to 29×39 px on bowral — a 35× legibility gain** (21× katoomba, 17× adelaide, 11×
+  fitzroy). The map is currently useless on the 21 towns that are supposed to be 21 mental maps.
+- **BINDING corrections from the judges:** discovery is a **proximity probe, not
+  `chunks.onChunkBuilt`** (real towns are all BIG_CITY ⇒ R=2, so the outermost live chunk centre is
+  128 m out and its far corner 181 m — chunk-built discovery would hand you shops you never saw).
+  And classic-gate it **by construction**: `createMinimap(plan)` becomes `createMinimap(plan, game
+  ? knownProvider : null)`, where a null provider is today's exact behaviour — the same pattern
+  `ground.js` already uses, so `minimap.js` needs no flag test at all.
+- Consume A's `localityOf` for street labels on the map once A publishes.
+
+### 39.3 — THE OP SHOP CAN'T BE DUG *(Lane C — the game's namesake activity)*
+PROCITY is built on thriftgod's op-shop DNA and **an op shop has no diggable bin**. Its recipe is
+clothes racks, metal shelves, a bookshelf, a trestle table and a `crateStack` its own comment calls
+back-room dressing. Meanwhile the dig — the crown jewel, soaked since v2 — fires only in record
+shops and market stalls.
+- **Measure first**: what can a player actually DO in each of the 12 shop types today? Enumerate it
+  honestly (dig / pull-and-buy / nothing) and put the table in your notes. That table is the
+  deliverable even if nothing else lands.
+- **Then the mechanism**: give the op shop a diggable bin (a bric-a-brac tub, a $2 book crate, a
+  rummage bin — you own the fitting and the recipe). The *mechanism* is uncontroversial and yours.
+- **FLAG, do not decide: what is IN it.** Records mixed in? Books and toys through the existing
+  pull-and-buy pack? Its own item class? That is a John taste call and it is the difference between
+  "op shops now dig" and "op shops now dig *records*", which changes the game's economy. Propose,
+  measure the options, and hold.
+- **Spend against SIX draws** (fact 3). Say what your bin costs and prove it.
+
+### 39.4 — TWO MAGPIES, AND THE ARCADE'S ASSETS *(Lane E)*
+- **Settle the magpie** (filed from R38): B ships a 182-tri procedural bird with vertex-colour
+  white; E published an 894-tri tinted GLB that reads properly. **Render them side by side at the
+  size the bird is actually seen** (64/48/32 px, the same sheet form as your tint render) and
+  recommend. Fable rules on the picture, not the prose.
+- **The arcade** is a real 42 m covered lane with **17 shops** and it is dressed as nothing — no
+  props, no signage, no roof texture, no reverb. Generate its kit for a later round: a two-dollar-
+  shop A-frame, a key-cutter sign, hanging shopfront signage, a tiled arcade floor skin. Same laws:
+  $0, on-device, 🟢, provenance rows, and **size every asset by `tris × the instance count the
+  consuming lane implies`** — the law your own `paling_fence` bought us.
+- Correct `magpie.js`'s two stale tri comments (154 vs measured 182) — **that is Lane B's file, so
+  write the ask, do not edit it.**
+
+### 39.5 — THE GATES AND THE CLOSE *(Lane F, last)*
+Gate 39.1–39.3 with falsifiability controls; full `qa.sh --strict --matrix`; round close. **No tag.**
+Specifically: prove the address layer resolves ≥97% of corpus shops and **fails loudly** on a town
+with no roads cache; prove the fog hides what has not been walked and **reveals what has** (both
+arms, or it is vacuous); prove classic and `?noassets` untouched; and re-measure the interior
+budget against fact 3 if C's bin lands.
+
+## ROUND CLOSED (Fable) — **v9 IS OPEN. 10 passed · 0 failed · 0 warn · 0 skipped. No tag.**
+
+Selfcheck **157,647/157,647**, fingerprint `0x5f76e76`, **zero goldens moved**, MATRIX GREEN 10
+towns × 7 gates. Three new gates added coverage without moving a single existing verdict.
+
+**THE TOWN KNOWS ITS OWN STREETS.** 1,192 of 1,219 corpus shops resolve to a real Australian
+street name — 97.8%, 100% on 17 of 23 towns — and **zero wrong names**, validated against a
+second independent resolver (857 shop-bearing edges, 0 disagree). Katoomba's map now says
+*Katoomba Street*. `map.html` had never rendered a real street in four epochs of holding the data.
+
+**THE MAP IS A MAP.** The fog costs **+0 draws AND +0 tris** (four fresh browsers, both orders,
+arms proven distinguishable first) and framing to what you know takes a shop from **0.83 × 1.11 px
+to 29.4 × 39.2 — 35× on bowral**. B's sharper measurement: an exact-palette count found **26,506
+shop-coloured pixels on the synthetic and ZERO on Katoomba** — all 72 shops rasterised to not one
+pixel of their own colour. The map wasn't hard to read on real towns; it was drawing nothing.
+
+**THE FOURTH AND FIFTH INSTANCES OF THE SAME BUG.** `(−sin,−cos)` at `index.html:384`/`:450`:
+**not one door point in the entire corpus was on a footpath** (0/493, 0/72, 0/139, 0/30) — Lane D's
+peds have been ducking into the back fence since R8 — and the spawn put **0 shops in front of the
+player on 4 of 4 towns**, which is precisely the "faces dirt and building-backs" complaint from
+Fable's own R31 playtest, finally explained. Two characters; 0 → 4 on all four towns.
+**B wrote the lineage down (R13 `RY_FLIP` · R15 posters · R27 facades · R39 these two) with the
+keeper insight: *every instance was caught by a picture or by a consumer with a different
+convention, never by a metric — a heading has no falsifiable arm inside the file that computes
+it.*** And then the table paid for itself **inside the same round**: wiring E's magpie, B pointed a
+measurement at the heading *because the lineage said to*, and found instance five — E's bird faces
++Z, the file flies −Z, **the magpie would have swooped tail-first**. First one ever caught before
+shipping.
+
+**THREE GLBs WERE SHIPPING AS GLASS.** `transmissionFactor: 1` forces three.js's transmission
+pre-pass — **every opaque draw issued twice**. E scanned all 103 GLBs: `bookshelf` (shipped and
+hurting), plus `longbench` and `streetlight` — **unwired STREET assets E had itself recommended to
+B**, where a pre-pass would have cost ~292 draws against eight of margin. Armed, not fired. Fixed
+at source with BIN sha1 identical, republished, sha1-verified off the public depot, **and gated**:
+`validate_manifest.py` now hard-fails on it.
+
+**THE INTERIOR MARGIN'S THIRD VALUE — and the epoch's cleanest lesson in three numbers:**
+**6** (a stale doc I quoted) → **21** (a correct measurement of a tree about to change) → **162**
+(the tree as it now stands). F re-measured through a true A/B — the shipped GLB vs a copy with the
+glass re-inserted, BIN identical — and got worst-room **329 → 188**: `opshop` −47%, `book` −49%,
+every other type 0. **The worst interior room is now `dept/auto` — a room with no bookshelf in it.**
+E's fix took, and it bought **+141 draws**.
+
+**THE OP SHOP CAN BE DUG** — `rummageBin`, 72/72 placed and reachable, 0 carves, rest-of-room
+byte-identical, **contents deliberately unarmed** (default boot: `kind:'prop'`, 0 dig targets) and
+held for John. Alongside it, C's table of what a player can actually do in each of 12 shop types —
+including that **the default boot contains not one buyable mesh anywhere**, and that
+`interactable:true` is not a verb.
+
+**Two self-caught errors worth keeping.** F aimed its transmission control at the plausible path
+(`web/assets/models/`) rather than the code path (`pipeline/_normalized/`) and **nearly filed a
+defect against Lane E on the strength of it** — *aim the control at the code path, not the
+plausible path*. And B, ordered to fix its own fallback magpie, made the change, measured it, found
+**true white went 33 → 28 px** (a downward-facing surface catches no sun, so the white it moved
+into view reads grey against E's 755) and reported it as a half-win **that strengthens the ruling
+against its own bird**.
+
+**F's judgement call, ratified:** it re-shot the spawn gates but **refused to overwrite
+`v7_tour/` and `v7_beta/`** — *re-shooting a tagged epoch's release tour on a v9 tree falsifies a
+record.* They stay as history.
+
+**Filed to R40 (gate gap, not a live defect):** `check_transmission()` skips any GLB with no local
+`pipeline/_normalized/` copy and never scans `web/assets/models/` — demonstrated live, the glass
+asset **passes rc 0** with the local copy removed. **A depot-only transmissive GLB — exactly the
+shape of `longbench`/`streetlight` — would ship unseen.** Also carried: A's D1–D4 · the matrix
+budget column is bookmark numbers · `?r=3` breaches at 307 ungated · the arcade's awning posts
+stand two rows 1.00 m apart down a 5.00 m lane and should be designed with the roof · should
+`?classic=1` show the town selector · **nobody in this loop has ears.**
+
+**Street budget: 292/300 stands** — both new layers are zero-draw and measured at zero, the spawn
+is a pose, the bin is interior.
+
+## Laws
+
+Everything standing. This round: **zero draws is the requirement for 39.1 and 39.2** — they are
+information design and must cost nothing on the street · the interior margin is **six** ·
+pathspec-atomic commits (four lanes share the tree) · no pushes, no tags — Fable pushes at close ·
+every gate ships its control demonstrated.
+
+⚠️ **Tree note:** a background session may still be editing `web/js/world/venue.js`. No lane touches
+it this round.
+
+## Order
+
+1. **Parallel: A (39.1, contract in the first commit) · B (39.2) · C (39.3) · E (39.4).**
+2. **Then F (39.5).**
+
+## Standing — for John, when he wants them
+
+The op-shop bin's **contents** (39.3) · whether the fog is default-on or a mode · and the v9 shape
+itself: the address layer and the fog are its first two layers, and the third (the unmarked door /
+semi-hidden retail) waits on how these two feel.

docs/LANES/ROUND40_INSTRUCTIONS.md

@@ -0,0 +1,94 @@
+# PROCITY — Round 40 instructions (from Fable, integrator)
+
+Date: 2026-08-03 · R39 closed green (QA 10/0/0/0, street 292/300, interior worst 188 — margin 162).
+**John's direction: "just keep building — big bugtest playthru feedback sesh later."** So round 40
+is the no-rulings round: every filed R39 debt that needs no decision, plus one new keystone — the
+harness that will turn John's eventual playthrough into tickets. The three standing questions
+(op-shop bin contents · fog default-on · v9 third layer) stay parked until that session; nothing
+here pre-empts them. Audio stays unlistened — John has no ears free either right now; the listen
+pass is part of the sesh.
+
+## Integrator rulings made so this round needs none from John
+
+- **`?classic=1` gets the town selector.** Classic is the shop-window mode; hiding the 23 towns
+  from it serves nobody. It's information, not gameplay state.
+- **Feedback capture is a build item, not tooling fluff** — it's 40.6 and F's keystone.
+
+## The ledger
+
+### 40.1 — CLOSE THE TRANSMISSION GATE'S BLIND SPOT *(Lane E)*
+R39 demonstrated it live: `check_transmission()` skips any GLB with no local
+`pipeline/_normalized/` copy and never scans `web/assets/models/` — the glass asset passes rc 0
+with the local copy removed. A depot-only transmissive GLB (exactly the shape of
+`longbench`/`streetlight`) would ship unseen.
+- The gate must scan **every path the game can load from**: `pipeline/_normalized/`,
+  `web/assets/models/`, and the depot listing (fetch headers/GLB chunk over the tailnet path is
+  fine — it's free).
+- **Control demonstrated, both arms:** plant a transmissive fixture reachable only by the
+  previously-unscanned path → gate goes RED; remove it → GREEN. The R39 live demo is your red-arm
+  spec.
+- Aim the control at the code path, not the plausible path — that sentence is in the round close
+  because F nearly filed a false defect over it.
+
+### 40.2 — A's D1–D4, CLOSED OR RE-FILED WITH NUMBERS *(Lane A)*
+The carried list has ridden three rounds. This round each item either closes with a measurement or
+gets formally re-filed with a number and a reason it can wait. No third option, no silent carry.
+Goldens must not move; say so with selfcheck numbers as always.
+
+### 40.3 — THE `?r=3` BREACH, AND CLASSIC'S SELECTOR *(Lane B)*
+- `?r=3` measures 307 ungated against the ≤300 street law. Gate it or shave it: either the flag
+  page states its own budget law (and qa asserts it), or the draws come down. Numbers either way —
+  and the matrix budget column is bookmark numbers (R39 carry), so re-measure, don't quote.
+- `?classic=1` shows the town selector (ruling above). Zero-draw in-game; selector is UI chrome.
+- Consume A's address vocabulary anywhere the map/HUD still says nothing where it could say a
+  street name — you built the fog; finish the signage on it.
+
+### 40.4 — THE ARCADE'S POSTS *(Lane E, with C consulted)*
+Two rows of awning posts 1.00 m apart down a 5.00 m lane. Design the posts WITH the roof as one
+kit (the R39 close's instruction): re-measure the lane, one kit, placement rule stated, before/
+after shot pair. If the fix is a placement-rule change and not an asset change, say so and E hands
+it to whoever owns the rule with the measurement attached.
+
+### 40.5 — THE DOOR POINTS AND THE FOOTPATH *(Lane D — verification-first)*
+R39 measured **0 door points on a footpath across the whole corpus** (0/493, 0/72, 0/139, 0/30) —
+peds ducking into the back fence since R8 — and B's two-character heading fix landed in the same
+round. What this round needs is the truth of TODAY'S tree:
+1. Measure the door-point-on-footpath rate corpus-wide now.
+2. If B's fix covered it: close with the numbers, done.
+3. If not: fix the door-point derivation (D owns where peds duck in), same gate — rate ≥95% on all
+   four measured towns, and the ped visibly enters through the front on a shot.
+No new mechanics; this is making the R8-era claim true.
+
+### 40.6 — THE PLAYTEST HARNESS *(Lane F — the keystone)*
+John's next session with this game is a bug-hunt playthrough. Build the thing that makes it count:
+- **One key (F8) drops a note**: captures `{pos, mode, shopId+name if inside, street/locality via
+  A's layer, seed, town, clock seg, flags, fps, draws}` + a screenshot to downloads + a typed
+  one-liner (small overlay input, Esc cancels). Zero cost when unused; classic-gated by
+  construction like everything else.
+- Notes persist under the delta law (bounded, export/import, corrupt-reject — the fog's pattern)
+  and **export as one JSON** John can paste back to the lanes as tickets.
+- **A `?bugtour=1` mode**: strings the existing bookmarks into a guided walk (N key = next stop)
+  covering: spawn → street day → shop enter/buy → dig → op-shop bin (unarmed) → gig night → tram →
+  rain → night → map/fog → second town via selector. The point: John's session covers every system
+  without him needing a checklist.
+- Smokes: harness off = byte-identical boot; on = note round-trips (drop → export → validate
+  schema); screenshot lands; qa stays green.
+- Close the round: budgets re-stated (street ≤300, interior ≤350 with today's margins), tour shots
+  for anything visual this round touched, then STOP — no tag until John's sesh rules on the parked
+  three.
+
+## Laws
+
+Everything standing: zero draws for information design · pathspec-atomic commits · no pushes/tags —
+Fable pushes at close · every gate ships its control demonstrated · measure the thing, not the note
+about the thing · fresh browser contexts · human-sized line on humanoid shots.
+
+## Order
+
+1. **Parallel: A (40.2) · B (40.3) · D (40.5) · E (40.1, then 40.4).**
+2. **Then F (40.6) last, consuming A's layer for the note metadata.**
+
+## Parked for John's sesh (unchanged, not blockers)
+
+Op-shop bin contents · fog default-on vs mode · v9 third layer (the unmarked door) · the audio
+listen pass — all become tickets from the F8 harness the moment he plays.

docs/LANES/ROUND41_INSTRUCTIONS.md

@@ -0,0 +1,160 @@
+# PROCITY — Round 41 instructions (from Fable, integrator)
+
+Date: 2026-08-07 · **R40 closed green** (12/12 gates, `c3384b9` pushed, goldens `0x5f76e76`).
+**Theme: THE LIBRARY LANDS.** John: *"we have heaps new furniture clothes ppl animations
+heapppppppps animations in our library — take a look and mega update our game."* Fable surveyed
+the fleet. The survey is the ground truth for this round; its numbers are quoted below and must be
+re-measured, not re-quoted, before anyone acts on them.
+
+## The finding that defines the round
+
+**PROCITY ships 8 animation clips.** `idle · walk · sit · look · dance_drink · dance_medium ·
+dance_party · dance_sway` — skeleton-only GLBs, 66 mixamorig nodes, loaded by
+`rigs.js:69 loadPedFleet()`.
+
+**The fleet holds 6,866 licence-clean clips** in ultra's `~/Documents/MOTIONLIB/green/`
+(2,394 Mixamo FBX · 2,548 CMU BVH · 1,620 100STYLE BVH · 304 ACCAD BVH), and
+**`~/Documents/MIRPAMO/` is a working local Mixamo** (`./bin/mirpamo batch <rig>.glb <clipdir> -o
+out/`, headless Blender, no cloud). **The skeletons match 1:1** — 66 mixamorig nodes both sides;
+retarget output is byte-shaped like the existing `idle.glb`. The Mixamo bank alone holds **237
+idle variants · 270 walks · 140 sits · 163 greet/point/wave · 113 dances · 112 push/pull/pick/reach
+· 63 carry**. Every non-walking citizen in the game today plays the same idle.
+
+Plus: **45 record-shop fittings that pass the house law untouched** (`~/Documents/3dstore/`,
+~300 tris median, metre-correct), **60 DJ-gear GLBs, 45 of them control-rigged** (working
+`Fader_CROSS` / `Platter_SPIN` / `Btn_STARTSTOP` node contracts), **48 pub/venue props** at 200k
+tris needing a 40× decimation, and **441 hand-prompted 1990–99 Australian garment PNGs** from
+wardrobegod (174 tops / 119 bottoms / 69 shoes / 66 hats / 12 bags).
+
+## INTEGRATOR RULINGS — binding, no lane may reinterpret them
+
+1. **🔴 THE BANDAI HAZARD IS CLOSED BEFORE ANY RETARGET RUNS.** m3ultra holds 3,077 **CC BY-NC**
+   (non-commercial, never shippable) Bandai-Namco BVH at
+   `~/Documents/MIRPAMO/library/downloads/bandai_namco_1/` — in a neutrally-named path, outside
+   ultra's `red/` zone system, with nothing in the filename marking it. It is **one
+   `mirpamo batch` away from a shipped build.** Lane E-motion's FIRST action, before touching any
+   clip: zone it (rename with the `_NC-research` suffix per the house rule, or delete in favour of
+   ultra's correctly-zoned `red/bandai/`) and reconcile `MIRPAMO/library/manifest.json`'s wrong
+   `CC-BY-NC-ND` label against ultra's corrected `SOURCES.md`. Report it done with the paths.
+2. **R41 clips come from the MIXAMO bank only.** Mixamo is usable inside games with **no
+   attribution requirement** — the only rule is never redistributing clip packs, and retargeted
+   per-character clips inside the game are explicitly fine. CMU/100STYLE/ACCAD are all attribution-
+   bearing; they are a later round's work, after the credits surface exists (41.5). One licence
+   regime this round.
+3. **A DENY-LIST enters the repo law.** These never enter `web/` under any circumstance:
+   `character_kit_modular/exports/bodies/**` (44 bodies, 30 named `-nsfw`, 465k tris each, broken
+   0×0×0 bboxes) · any `anatomy/` dir · `elsa_coronation_hair_wig_kh3.glb` (Disney/Square Enix IP
+   rip) · `daphne_sexy.glb` (unverified rip) · `~/Documents/mocaponline/**` (vendor demo packs,
+   licence unread, includes Epic's EULA-bound `SK_Mannequin.fbx`). No wildcard copies from any
+   library — every asset enters by name.
+4. **THE STREET BUDGET IS SPENT: 291/300 at night, nine draws.** No lane adds a street-side prop
+   this round. Every asset in R41 lands **interior** (margin 162) or is **zero-draw** (clips are
+   skeleton-only, 0 tris). Any street-side proposal gets measured and filed to R42, not shipped.
+5. **Never run `gltf-transform optimize` on the DJ gear.** It collapsed a 696-node mixer to 25
+   nodes and deleted `Fader_CROSS`. Decimate only, and verify the node contract survives.
+6. **Clip delivery is GROUPED, not 40 files.** A GLB holds many animations; boot fetch count is a
+   budget. Deliver **≤6 grouped clip GLBs by category** with a documented index, not one file per
+   clip.
+
+## The ledger
+
+### 41.1 — THE MOTION LIBRARY *(Lane E, motion half — the critical path, starts first)*
+Ruling 1 first, then: pick and retarget **~40–48 clips** from `green/mixamo_full` through MIRPAMO
+onto PROCITY's ped rig. Pick for what this game actually is — a shopping town with shops, benches,
+a pub, and citizens who currently only walk and stand:
+- **Idles (8–10 distinct)** — `Breathing_Idle`, `Big_Yawn_While_Standing`, `Sit_With_Fidgeting_Feet`,
+  cocky/hip-lean variants: the clone-army killer.
+- **Browse/shop (6–8)** — `Examine_Forwards`/`_Backwards`, `Holding_An_Object_Idle`/
+  `_While_Walking`/`_While_Turning_Left`/`_Right`, `Closing_Cabinet_Door`, `Carrying_A_Box`.
+- **Sit/lean (6–8)** — `Little_Girl_Sitting_On_A_Bench_Swinging_Her_Legs`,
+  `Leaning_Against_A_Wall_With_Various_Postures`, `Legs_Crossed_Leaning_On_Object`.
+- **Social (6–8)** — `General_Conversation`, `Having_A_Chat_At_The_Watercooler`,
+  `Greeting_While_Standing`, `2_People_Shaking_Hands_Part_1/2` (a matched pair — keep them paired),
+  `Nodding_Head_Yes`, `Shaking_Head_No_Dismissively`.
+- **Locomotion (4–6)** — walk variants + the `45/90/135/180_Degree_{Left,Right}_Turn` set.
+- **Venue (4–6)** — better dances, clapping standing/seated, cheering.
+Deliver: ≤6 grouped GLBs under `web/models/clips/`, a **new** `web/assets/motion_manifest.json`
+(new file — no race with props' manifest.json) indexing clip→group→category→duration→loopable,
+provenance in AUDIT.md, and MIRPAMO's `make smoke` green. Watch the documented gotcha: Blender 5
+FBX export flattens slotted actions — feed GLB/BVH or use `strip_skin.py`.
+
+### 41.2 — THE FITTINGS *(Lane E, props half — parallel with 41.1, disjoint files)*
+1. **`~/Documents/3dstore/` — 45 of 46 GLB pass the house law as-is** (~300 tris median, metre
+   scale, no Draco, no textures). Re-verify with `glb_stat.py`, bring them in by name, manifest
+   them with footprints for C. Reject `3dmrp.glb` (499,948 tris). **This is the round's cheapest
+   win — do it first.**
+2. **DJ gear (ultra `3D=models/dj-gear/`, 60 GLB)** — 18 already ≤5k; normalize the rest
+   (decimate only, ruling 5), **verify the `Fader_*`/`Platter_SPIN`/`Btn_STARTSTOP` node contract
+   survives on every rigged model** and state the check. Manifest them with their control-node
+   names so C/D can drive them later.
+3. **Pub/venue props (`~/Documents/not-tonight/art_incoming/`, 48 GLB @ ~200k tris)** — 40×
+   decimation through `normalize.py`. Content is exactly pub/cafe/milkbar (pokie, jukebox, keg,
+   bain-marie, pie warmer, banquettes, ashtrays, sandwich board). Skip the 6 `staff*.glb` — they
+   are 200k-tri statues with no skin, no anims, no materials.
+Publish to the depot over the tailnet path, sha1-verify, run the R40 transmission gate over every
+new asset (it now scans all four surfaces — prove it stays green).
+
+### 41.3 — THE CITIZENS COME ALIVE *(Lane D — after 41.1 lands)*
+Wire the clip library into the fleet. `rigs.js loadPedFleet()` and the sim's state machine are
+yours.
+- **Per-citizen deterministic idle** from the new pool — seeded by identity, so the same citizen
+  always stands the same way and the street stops looking like one person copy-pasted.
+- **A real BROWSE state** for the interior browsers (they currently stand): examine/hold/reach at
+  C's browse points, seeded per browse point.
+- **Sit and lean** on the street furniture that already exists (benches, shopfronts) — this is
+  where sit/lean clips earn their keep; keep it zero-draw (a seated ped is a ped that was already
+  drawn).
+- Keep memory bounded and **state the numbers**: clips resident, fetch count at boot, heap delta.
+  Determinism law holds — same seed, same crowd, same postures, byte-equal across two runs.
+- Everything gated so `?noassets=1` still runs (the 8-clip path must survive as the fallback).
+
+### 41.4 — THE SHOPS GET THEIR STOCK *(Lane C — after 41.2 lands)*
+Place the new fittings. Interior margin is 162 draws — spend it deliberately and report the worst
+room after every change.
+- **Record/opshop/book/video/pawn/stall**: the `3dstore` tubs, crates, wooden racks, stackable
+  `mos-japhop` units, library trolley, `vinylsleeve_v5`, window booth.
+- **Pub/cafe/milkbar**: the decimated venue props — this is the set that finally furnishes the pub.
+- **Record shop + gig venue**: the DJ gear (turntables, mixers, the 808/SP-1200/MPC) as hero props.
+- **The wardrobe PNGs** (441 garment layers, `90sDJsim/web/world/media/doll/`): route R5 — use them
+  as op-shop rack textures and shelf stock art at **zero geometry cost**. Period-correct Australian
+  1990s naming is the whole point; keep the names visible where the game shows item text.
+- Every recipe change re-runs your sweep + soak: 0 throws, 0 path-fails, 0 leaks, draws ≤350.
+
+### 41.5 — THE CREDITS SURFACE *(Lane B — small, and it unlocks future rounds)*
+PROCITY has no attribution surface. R41 ships Mixamo only (no attribution debt, ruling 2) — but
+CMU/100STYLE/ACCAD are 4,472 more clips waiting behind exactly this. Build it now: a credits panel
+(the flag/selector UI idiom you already own), fed by a data file lanes append to, listing asset
+sources and their licences. Zero draws in-game, classic-gated by construction. Then R42 can spend
+the CC-BY libraries the day it wants them.
+**Also yours, filed from R40:** A's D3 — `SHOP_REGISTRY` is missing pub/band_room/rsl, so 81 venue
+lots corpus-wide wear op-shop signage (`buildings.js:465`). Cosmetic, measured, and it will show in
+every pub shot this round takes.
+
+### 41.6 — INTEGRATION AND PROOF *(Lane F — last)*
+Wire what needs wiring, gate what needs gating, and **prove the round with pictures** — this is the
+first round in a long time whose whole point is visible. New/extended gates: clip-manifest
+integrity (every referenced clip resolves), citizen-posture determinism (two runs byte-equal),
+interior draw budget with the new fittings, `?noassets=1` still clean, deny-list compliance (no
+banned path ever referenced from `web/`). Re-shoot the tour: a busy street with citizens in
+*different* postures, a browsing interior, the furnished pub, the record shop with real gear.
+`qa.sh --strict` green, budgets restated, goldens unmoved. **No tag** — John's playtest session
+rules on the epoch.
+
+## Laws
+
+Everything standing, plus rulings 1–6 above. Highlights: measure the thing, not the note about the
+thing · pathspec-atomic commits, **no git commands from lanes** — the integrator commits at close ·
+fresh browser contexts · human-sized line on humanoid shots · every gate ships its control
+demonstrated · budgets are numbers.
+
+## Order
+
+1. **Wave 1 (parallel):** E-motion (41.1, ruling 1 first) · E-props (41.2) · B (41.5).
+2. **Wave 2 (parallel, after their inputs land):** D (41.3, needs 41.1) · C (41.4, needs 41.2).
+3. **Wave 3:** F (41.6).
+
+## For John
+
+Nothing blocks this round. Still parked for the playtest session: the op-shop bin's contents · fog
+default-on vs mode · v9's third layer · **the audio listen pass** (nobody in this loop has ears).
+The F8 notepad and `?bugtour=1` are live and waiting.

docs/LANES/ROUND42_INSTRUCTIONS.md

@@ -0,0 +1,128 @@
+# PROCITY — Round 42 instructions (from Fable, integrator)
+
+Date: 2026-08-07 · **R41 closed green** (18 gates, `d14cf7f` pushed, goldens `0x5f76e76`).
+**Theme: THE LOOK.** R41 furnished the rooms and filled the streets with postures; doing so made
+three cosmetic faults newly visible. John looked and said fix them. This round is a **visual
+debt pass** — no new systems, no new content, just making what shipped last round *read* right.
+
+## The three faults (Fable's own eyeball pass on R41's proof shots — go look before you start)
+
+1. **The pub props render as untextured white blobs.** `docs/shots/laneF_r41/pub_furnished.jpg` —
+   the couch and jukebox are lumpy white masses. E's own §41.2 note says 37 of 39 shipped with
+   **no texture at all**; they are geometrically correct and visually unfinished. A 90s pub couch
+   is brown vinyl or worn floral, not white.
+2. **The DJ booth reads as a plain black box.** `docs/shots/laneF_r41/record_dj_booth.jpg` — the
+   rigged Technics with working `Platter_SPIN`/`Fader_PITCH` nodes are in there, and at normal
+   viewing distance you cannot tell it is a turntable setup. Right result, wrong read.
+3. **The ped roster does not fit 1990s Australia.** There is a **purple masked luchador** in the
+   pub crowd. The survey found ultra's `3D=models/characters/` is 83 FBX = **53 people-normal ·
+   10 comical · 9 fantasy** — some of the wrong 19 are in our shipped 24.
+
+## Standing debt this round also clears (all filed, all small)
+
+- **[B, from D]** `furniture.js` puts the bench's front **along** the street, not facing the road —
+  contradicting its own comment. D's citizens now sit on these benches, so it shows.
+- **[B, from D]** one `benchStops(plan)` export retires D's derived-station mirror.
+- **[B, from F]** one `await document.fonts.ready` in `buildings.js` — the sign-atlas font race that
+  makes four bookmarks unreproducible across boots.
+- **[E, from B]** the **19 base ped models have no per-asset licence record anywhere in this repo**,
+  and CITY_SPEC's declared zone includes CC-BY and paid-royalty-free. B built the credits surface;
+  this round fills the rows. A ped we cannot licence is a ped we replace.
+- **[D, from F]** `r41_shots.py`'s browse arm is deterministically red (it re-enters the winner
+  after a ~3 s/candidate scan, by which time the occupant has left) — currently warn-level.
+
+## INTEGRATOR RULINGS
+
+1. **Period law, now explicit: PROCITY is 1990s Australia.** No fantasy, no superhero, no
+   luchador, no anime, no medieval. If a model would look out of place on a suburban Sydney street
+   in 1996, it does not ship. This applies to peds first and everything after.
+2. **Prefer CC0 or known-licence replacements** — it fixes the look *and* the licence gap in one
+   move. The survey found **Quaternius (CC0)** ships Casual, Casual2, Punk, Suit, Worker, Farmer,
+   Beach: directly usable town archetypes with zero attribution debt. Ultra's 53 people-normal FBX
+   are the other pool; each needs its licence recorded before it ships (ruling: unrecorded ⇒ not
+   shipped).
+3. **Every ped that ships gets a `credits.json` row** — name, source, licence, attribution-if-any.
+   B built the surface in R41; this is what it was for.
+4. **Draw-neutral or better.** Street is **291/300 at night — nine draws.** A ped swap is
+   one-for-one; a texture is not a draw. Interior margin is **227** (the true number after C's
+   phantom-room fix) — the pub may spend some of it, measured, and must state the worst room.
+5. **No new capability.** No conversation system, no DJ driver, no new mechanics. If a fix needs a
+   system, file it to R43 with the measurement.
+
+## The ledger
+
+### 42.1 — DRESS THE PUB *(Lane E, look half)*
+The 39 `art_incoming` props ship untextured. Give them materials that read as a 1990s Australian
+pub/cafe/milkbar. Cheapest correct route first — these are flat-material meshes, so **baked vertex
+colour or a small shared palette atlas beats per-asset texture maps** (and keeps the draw win C
+fought for). Priorities by how much screen they own: `old_couch`, `jukebox`, `banquette`,
+`plywood_bar`, `bistro_table`, `pokie`, `bain_marie`, `pie_warmer`, `keg`, `lounge_chair`.
+Beer-stained carpet reds, brown vinyl, laminex, brass and chrome — not white. Ship a contact sheet
+and an A/B pair against R41's shot. Keep the house GLB law, re-run the four-surface transmission
+gate, republish + sha1-verify.
+
+### 42.2 — MAKE THE DECKS READ *(Lane E look half + Lane C, jointly)*
+The booth is right and unreadable. Diagnose before you change anything: is it the asset (a black
+plinth with a dark deck on a dark counter), the composition (nothing around it says *DJ*), or the
+lighting? Then fix the cheapest cause. Likely both: E gives the deck body some contrast (silver
+platter, coloured slipmat, visible tonearm, a lit pitch fader), and C composes the booth so it
+reads at a glance — mixer beside the deck, a record on the platter, sleeves in the rack behind,
+maybe the booth angled toward the door instead of flat to a wall. **No control-node driver this
+round** (ruling 5) — the nodes stay recorded for R43. Before/after pair required.
+
+### 42.3 — RECAST THE TOWN *(Lane E cast half — audit and source)*
+1. **Audit the shipped 24 peds**: for each, name it, judge it against ruling 1 (1990s Australian
+   street: yes/no), and record its licence — or mark it `unverified`. The survey's split of ultra's
+   library (53 normal / 10 comical / 9 fantasy) is your map; the shipped roster is the territory.
+   **Show the luchador and name it.**
+2. **Source replacements** for every reject, preferring CC0 (Quaternius: Casual, Casual2, Punk,
+   Suit, Worker, Farmer, Beach) then ultra's people-normal pool. Normalize to the existing ped
+   contract — **same mixamorig skeleton, same 66-node shape, same 2,132–3,999 tri band, same
+   texture budget** — because D's 46 clips and the impostor bake both ride that contract and a
+   deviation breaks them silently.
+3. **Fill `credits.json`** for the whole roster (ruling 3), replacing B's amber `unverified` rows
+   with real ones.
+
+### 42.4 — RECAST, WIRED *(Lane D — after 42.3)*
+Swap the roster in `rigs.js`/`loadPedFleet` and the fleet slot machinery. Non-negotiables:
+**determinism holds** (same seed → same crowd — the fleet-order bug you fixed in R2 is exactly the
+hazard here: fill fixed slots by index, never by load-completion order), **draw count unchanged**,
+the impostor bake still matches its rigs at the swap boundary, and the no-giants gate stays green
+(new models, new scale risk — this is precisely the R10 failure class). Re-shoot your street shot.
+Also yours: fix `r41_shots.py`'s browse arm so it stops being warn-level.
+
+### 42.5 — THE THREE SMALL ONES *(Lane B)*
+The bench yaw (make the bench face the road; D's sitters will show it either way, so a
+before/after shot is the proof), the `benchStops(plan)` export, and `await document.fonts.ready`
+in `buildings.js`. That last one should make the four unreproducible bookmarks stable — **verify
+it does** by re-running F's 3-boot hash check, and tell F whether byte-hash goldens become
+possible again.
+
+### 42.6 — PROVE THE LOOK *(Lane F — last)*
+This round is judged by eye, so the shots are the deliverable. Re-shoot every R41 frame that
+showed a fault, **paired against the R41 original** (they are committed — use them as the before):
+pub, DJ booth, street crowd, pub crowd (the luchador's replacement). Gates: period-law compliance
+(no banned-genre model in the ped manifest — a name-list gate, control demonstrated), roster
+licence completeness (every shipped ped has a credits row — red if any `unverified` remains),
+plus everything standing. Budgets restated with the true numbers. `qa.sh --strict` green.
+**No tag.**
+
+## Laws
+
+Everything standing: no git commands from lanes (integrator commits at close) · measure the thing,
+not the note about the thing · fresh browser contexts · human-sized line on humanoid shots · every
+gate ships its control demonstrated · the R41 deny-list is permanent repo law.
+
+## Order
+
+1. **Wave 1 (parallel):** E-look (42.1, then 42.2's asset half) · E-cast (42.3) · B (42.5).
+2. **Wave 2 (parallel):** C (42.2's composition half) · D (42.4).
+3. **Wave 3:** F (42.6).
+
+## For John
+
+Still parked for your playtest: the op-shop bin's contents · fog default-on vs mode · v9's third
+layer · **the audio listen pass** (nobody in this loop has ears). F8 and `?bugtour=1` are live.
+Filed to R43: the DJ control-node driver, the paired-conversation state machine (D's 8 social
+clips are shipped and unused), and repainting the nine non-venue shop signage palettes (an art
+call B deliberately left you).

docs/RETRO_V4.md

@@ -0,0 +1,97 @@
+# PROCITY v4 — THE REAL MAP: the epoch retro
+
+*Fable (integrator), 2026-07-16, written after the `v4.0` tag (`8ac3b18`) per ROUND22 ledger #6.
+Epoch span: the R17 scout → R22 close (charter: [V4_REAL_MAP.md](V4_REAL_MAP.md)). Tags:
+`v4.0-alpha` → `v4.0-beta` → `v4.0`.*
+
+## The epoch in numbers
+
+**23 real Australian towns · 1,210 real shops (298 secondhand heroes) · all 8 states and
+territories · on their actual streets.** Selfcheck grew 15,277 → **161,300** checks. 36 town
+goldens pinned in one commit. Every real graph lands as **1 connected component** with 3 venues.
+The covenant was never broken: `?classic=1` boots the exact v2 town, `0x3fa36874`, byte-identical
+through six rounds of the largest structural change in the project's history. The default
+synthetic town is untouched. One sanctioned golden move per round, every one recorded.
+
+## What shipped, in one breath
+
+Cache schema v2 → the real-graph lift (junction-protected Douglas–Peucker, cull/bridge
+connectivity) → the density widening under John's SUBTLE directive (heroes never subsampled,
+texture capped at 3×, and D proved the heroes *gained* footfall) → cluster-adjacent venues (11/15
+were stranded; 0/15 after) → the tram's shop-adjacency ruling with per-town fencing → the town
+selector → the poster cap → the furniture tri diet → the five-frame release tour, including one
+honestly-dead town. Plus the marriage: **Lane G** (ultra) joined mid-epoch, merged at a round
+boundary, with the depot format ruled (no-Draco) and the G2a atlas contract reviewed.
+
+## What worked — keep doing these
+
+1. **Measurement over brief.** The epoch's defining pattern. A proved my poster "nudge" was
+   geometrically impossible and fixed the root cause. D refuted my prescribed `_rotWithHips`
+   with an in-shell proof. B tested a five-round-old park reason and found it was folklore.
+   D published a self-correction of its own headline metric. F recorded a re-measure that got
+   *worse*, and refused to caption a dead town as proof the floor holds. The brief is a
+   hypothesis; the lane's measurement is the ruling.
+2. **The measure-first fix loop.** R22's blocking gate ran F measured → B diagnosed (91.5%
+   attribution by hide-a-layer) → A confirmed not-A with numbers → E owned it and fixed (−51%)
+   → F re-measured. Four lanes, one gate, zero ego, one round.
+3. **Alpha as failure-list.** R18's brief said the deliverable was the failure list, and it was:
+   fragmentation (105 components), the BIG_CITY misfire, the DP junction-drop — each surfaced by
+   audit, filed with measurements, fixed the next round. Budget the discovery round; don't ask
+   it to also be the fix round.
+4. **Contract-first beats sequencing.** R16's order inverted (lanes ran before F's flip) and
+   nothing broke, because contracts were published in the brief. Same for schema v2, C's mapping
+   table, the backline shape, the G2a atlas contract. The half-day-handshake rule is the
+   project's real synchronization primitive.
+5. **Drops are counted, never silent.** `norm.dropped` by cause, `textureDropped`, fenced towns
+   named, the 6.4% seating tail per-cause-attributed. Nothing in the pack pretends.
+6. **Independent convergence.** The thin-tail finding was discovered twice in one round by
+   different methods (F's tour frame; D's nearest-neighbour spacing metric) — that's the
+   redundancy of honest lanes, and it's why the finding is trustworthy.
+
+## What cost us — fix these
+
+1. **Lane F is the fragile point.** F no-showed R14 and R18, and stalled mid-gate in R21. Every
+   time, the epoch sat untagged with five lanes done. The close is the longest, most serial
+   brief and it runs last, when sessions die. *Mitigation adopted going forward: F's brief is
+   written in resumable numbered items (R21 proved a successor can pick up mid-gate), and the
+   integrator checks for uncommitted F WIP before declaring a round done.*
+2. **Soft ceilings invite drift.** `venue_night` breached the 200k "soft" reference twice
+   (+0.5%, then +11%) before R22 made it blocking. *Rule going forward: a stress view that
+   breaches twice is automatically a blocking gate the next round.*
+3. **Old assets bite in new contexts.** The tri-diet driver was four furniture GLBs sized in
+   R6 for a 22-edge synthetic town, harmless for sixteen rounds until a 966-edge real graph
+   multiplied their cadence. *When the context scales, re-audit the assets it multiplies.*
+4. **The integrator was wrong twice** (the nudge, `_rotWithHips`). Acceptable — that's what
+   measurement-over-brief is for — but both were cases of prescribing the mechanism instead of
+   the outcome. *Briefs should state acceptance; lanes own method.*
+
+## The v4.x ledger (carried, measured, not hidden)
+
+- **The thin-tail clustering floor** (the epoch's parting finding): aliveness is not shop
+  *count* but **clustering** — median nearest-neighbour spacing (darwin 27 m ALIVE vs toowoomba
+  388 m DEAD at the same 12 shops). Candidate law: E curates on spacing, `validateTownCache`
+  warns above a threshold; toowoomba gets re-bboxed or retired.
+- The **6.4% seating tail** (daylesford 19%, fitzroy 13%) — known, per-cause, the drop-and-count
+  ruling stands.
+- `GIG_RANGE` chunk-neighbour lookup (D, 8.7% blind) · instrument `_lo` LOD · tram-stop close-ped
+  tri diet · drummer pelvic-lean v2 · awning fabric ripple · flag retirement (classic keeps
+  soaking) · selector polish beyond debug-grade.
+
+## The next epoch — Fable's recommendation to John
+
+Three chartered candidates remain: **the GODVERSE economy (G2/G3)**, **the editor/override
+layer**, **multiplayer presence**.
+
+**Recommendation: v5 = THE REAL SHOP — the GODVERSE economy.** The argument: v4 made the towns
+real; v5 makes the *shops* real. The marriage lane is already live (G2a contract reviewed, first
+atlases next), dealgod holds 1.77M real items with photos, and the destination — walk Fitzroy's
+real street into a real op shop, riffle a real crate, and the record you buy is one-of-a-kind
+because it's real stock (sold means GONE) — is the most PROCITY-shaped thing either studio can
+build. Sequence per the standing ruling: **G3 design doc first** (both integrators + John;
+the server enriches, never gates — full offline play is non-negotiable), G2a atlases land
+meanwhile, v4.x tail runs as a light parallel lane. The editor and multiplayer stay chartered
+for v6+ — the editor gets stronger the more real content exists to override, and presence gets
+stronger the more there is to visit.
+
+*— Fable. Twenty-two rounds: seed → town → weather → crowd → interiors → stock → gigs → the flip
+→ real roads → real shops → real Australia. The covenant held the whole way.*

docs/RETRO_V5.md

@@ -0,0 +1,122 @@
+# PROCITY v5 — THE REAL SHOP: the epoch retro
+
+*Fable (m3, integrator), 2026-07-17, written after the `v5.0` tag (`b2d29ba`) per ROUND27 §7.
+Epoch span: R23 → R27. Tags: `v5.0-alpha` → `v5.0-beta` → `v5.0`. The first two-studio epoch:
+Lane G (ultra) went from merged guest to the lane that shipped the epoch's server.*
+
+## What shipped, in one breath
+
+The tier ladder, whole: **344 real-or-minted items across 15 keyed crates in two godverse
+towns**, every crate distinct (105 pairs, 0 shared titles), sourcing-honest (`real`/`mint` as
+law, prefixes as namespace fences); Monster Robot Party's actual crate 550 riffled and bought
+in-game off its actual POS; **tier 2 live** — read-only endpoints over the real till, fences
+enforced at the DB credential, `/reserve`+`/buy` absent by John's A-then-B ruling; and the
+epoch's defining proof: **a real HTTP server killed mid-session costs the game Δ+2 ms and
+exactly one refused connection** — the offline law as an executable, not a sentence. Plus the
+finale nobody ordered: **every shopfront in every town finally faces its street.**
+
+## The five holds — the epoch's spine
+
+Every hold was correct; every hold traced to the same species (a rule or contract meeting a
+case written before the case existed); every hold was released by its owner, never by the
+beneficiary:
+
+1. **R23** — the crate was real but had no street, no identity, no compatible contract; the
+   gate built to catch it was blind-green, and #7a as briefed would have passed vacuously.
+2. **R24→25** — E's rebuild sat uncommitted; tagging would have produced a tag whose tree
+   lacked the code that produced its green.
+3. **R26** — the mint-id rule demanded a POS sku from crates that never saw a till; G refused
+   the easy green because colliding id spaces in the economy layer eventually sells the wrong
+   record.
+4. **R27 (reader)** — "zero console errors on server death" was physically impossible; the
+   replacement (exactly one refusal) is strictly stronger because it proves the breaker.
+5. **R27 (facade)** — the fifth hold found the oldest bug in the project.
+
+## The finale: the facade, and the covenant amendment
+
+B's frontage helper — a micro-task — exposed that `plan_osm` aimed lots' −Z at the street
+while `buildings.js` draws facades on +Z. The wave-5 ruling named it "every real town since
+R18" and ordered A to *measure the marched path rather than assume it clean*. **A's measurement
+caught the ruling's own premise: it was EVERY town, EVERY path, since v1** — all four seating
+sites wrote `atan2(outward)` under comments that said `-outward`; 637 of 681 synthetic lots
+faced no street at all; the classic covenant town was a row of back walls, and A proved it the
+only way left — standing in the street, looking at NUMBAT PLAYTHINGS facing the dirt.
+
+**John ruled the covenant amendment**, and his ruling is the epoch's best line: *the covenant
+is anti-drift machinery, not a defect preservative.* `0x3fa36874` did its job for five epochs —
+it never drifted. It was never right, and no hash can catch what was wrong in the first commit.
+**A golden proves nothing changed; it cannot prove anything is correct.** 51 goldens re-pinned
+in one commit; F re-pinned its own files per A's handoff (lane boundaries held to the last);
+and A caught, in passing, a bare-string OR-clause in F's classic gate that would have gone
+green off a *sentence about* the old covenant. The cross-convention gate is now in the
+selfcheck so the two conventions are compared against each other forever.
+
+## The epoch's signature species: the vacuous gate
+
+Named as law in R24, then found NINE times — including three inside the law's own
+applications: the empty-glob validator, the covers-render #7a, my id-equality gate spec
+(positional ids collide), F's selector entering the wrong shop, the silent licence line, the
+impossible zero-errors assert, F's 72/72 self-agreement (testing a spec line's data against
+the same line), F's attempt-4 error-check (the call succeeded; the pose was never applied),
+and the stdout OR-clause. The case law that came out of it is the epoch's real export:
+
+- **A gate proves it touched its subject** (fetch log, matched-file count, id equality —
+  something falsifiable) or it is not a gate.
+- **The collateral assertion**: when correct and broken implementations both hide the obvious
+  evidence, assert on what discriminates (the other 119 records unchanged).
+- **Cross-convention checks**: two subsystems implementing "the same" convention are compared
+  against each other, never each against its own spec line.
+- **Control-deltas for performance**: an absolute threshold measures the wrong thing politely.
+- **A named exception starts protecting new bugs the moment the real fix exists** (F's 404
+  tolerance — deleted, and the deletion caught a ninth invisible probe).
+- **Id prefixes are namespace fences**; plan ids, godverse ids, POS skus and listing ids are
+  four spaces, and no bare number crosses them.
+
+## What worked — keep doing
+
+1. **Restraint under benefit.** F declined to touch A's sweep, E's validator, and E's
+   uncommitted file across three separate holds where one edit would have unblocked its own
+   tag; B proved the facade one-liner and reverted it; A handed F's re-pins to F instead of
+   editing F's files. The party that benefits never releases its own hold.
+2. **Ownership sentences.** "The red was mine" (E) · "my rule was the stale thing" (C) ·
+   "it fired 54/72 on a good town" (A) · "four of the five attempts were F's fault" (F).
+   Nobody defended; everybody measured.
+3. **The contract's author is the authority for the contract's shape** — and when contract
+   and runtime disagree, **the runtime is the authority** (R24's root-cause ruling).
+4. **Machine-enforced fences beat reviewed promises**: the read-only credential (measured
+   permission-denied), 501s for absent verbs, metadata-only responses.
+5. **The two-studio pattern matured**: G went from branch-merged guest (R23) to full lane on
+   main (R25) to shipping the epoch's server (R27), with John's rulings recorded as mechanism.
+
+## What cost us — fixed or fenced
+
+1. **Comments and specs are not measurements.** All four facade sites' comments described the
+   correct behaviour above code doing the opposite, for 27 rounds. The cross-convention gate
+   is the fix; the lesson is older: nothing is true because a document says it.
+2. **Consistency masquerades as correctness.** Every subsystem agreed with itself, so every
+   gate was green over a wrong world; only a human in the street saw it. Money shots and
+   walk-arounds are QA, not decoration — John's browser stroll started the v6 charter, and
+   A's street-level eyeball confirmed the covenant bug.
+3. **My briefs carried five corrected errors this epoch** (the `tier` field, the id-equality
+   gate, the zero-errors assert, the "wire on entry" default that F correctly made opt-in,
+   and the wave-5 premise). All five were caught by the contract-first channel or by
+   measurement before they became bugs. Briefs state acceptance; lanes own method; the
+   integrator is not exempt from measurement-over-brief.
+
+## Carried forward
+
+- **v5.x**: Option B reservation (chartered, behind John's hold budget) · tier-2
+  auto-discovery (needs a reachability contract) · more POS shops if monsterrobot gains
+  siblings · **a shop-ops note for John, not a code item: the POS has recorded no sale since
+  2026-07-01 — G proved the dump is fresh but the data is stale; worth checking the till's
+  sync before the next live demo.**
+- **v4.x tail** (unchanged): thin-tail clustering floor · seating overflow tail · instrument
+  LOD · tram-stop tri diet · awning ripple · audioEmitter · flag retirement.
+- **v6 — THE LIVING STREET**: charter drafted (`docs/V6_LIVING_STREET.md`), spikes gated on
+  John's mocap vids (the MOCAPGOD queue is still empty) and the MOCAPGOD-C/MIRPAMO
+  integration call on ultra.
+
+*— Fable. Twenty-seven rounds, eleven tags, five correct holds, one amended covenant. The game
+now sells a record that is really in the crate, in a shop that is really on the street, in a
+town that is really in Australia — and for the first time since v1, the shops are facing you
+when you walk up the road.*

docs/RETRO_V7.md

@@ -0,0 +1,104 @@
+# PROCITY v7 — THE GAME: the epoch retro
+
+*Fable (m3, integrator), 2026-07-26, written after the `v7.0` tag (`4709cfe`). Epoch span:
+R30 → R36. Tags: `v7.0-alpha` → `v7.0`. The first epoch shepherded end-to-end by Fable-driven
+lane agents — John said "run it" once per round, and the lanes ran.*
+
+## What shipped, in one breath
+
+**The town became a game.** A save that carries only the player's deltas (the world regenerates
+from seed, so a save can cost you your records but never your town) · THE CRATE — the
+collection with real covers, honest provenance per find · the sell counter where the keeper
+pays under the band, structurally, forever · sleep, and a tomorrow where the mint crates
+rotate and the real one never does · THE BIBLE's guide stamps that turn a price sticker into a
+skill check · the wantlist that hunts across 23 towns, where TRAVEL COSTS A DAY · GodBay,
+whose hammer falls overnight under the one-hammer law, delivered by the morning paper · and a
+first five minutes that hands a stranger $191 and a want. Plus, mid-epoch and out of hours:
+five trellis DJ bodies and four Rokoko dance clips, swept into provenance and gated into law.
+
+## The epoch's defining pattern: HANDS BEFORE TAGS
+
+Twice the playtest found what every green gate could not:
+
+1. **R31**: the dig — the heart of the game — was default-OFF on a plain boot, six epochs
+   after the README claimed otherwise, because **every gate booted its own flags** (harness
+   lesson #4, THE EXPLICIT-FLAG BLINDFOLD). The suite tested the game; nobody tested that the
+   default boot IS the game. The fix came with a naked-boot reachability gate so it can never
+   silently regress.
+2. **R36**: zero blockers — and that verdict is the epoch's proudest number, because the same
+   hands that found the R31 blocker walked every system (splash → beats → guide → want → list
+   → hammer → travel) and came home with only a polish queue. The game taught its own tester:
+   *it charged $12 tuition for ignoring the guide's advice* — bought at $19 top-of-band,
+   hammered at $8, $7 after fees. An economy that punishes bad digging is an economy working.
+
+## The final hold: CLASSIC KEEPS ITS PEOPLE
+
+The epoch's last warn was its best lesson in miniature. Two 2 a.m. commits (disciplined, but
+outside the round system) added five DJ bodies to the ped roster unconditionally — every
+covenant gate stayed green (the covenant pins the plan, not the roster), but F's new
+`smoke_djdance` machine-recorded that classic's fetch surface and crowd pool had moved without
+a ruling, and HELD the tag. The arc: held by WARN → ruled by Fable (the covenant means the v2
+town *including its people*) → fixed by D in the owning file alone (base-17 restored, proven
+byte-identical against a shadow tree of the pre-commit code — classic's crowd is the same
+crowd, ped for ped) → re-proven by the very gate that held it. **A covenanted surface cannot
+move quietly even when every pinned number stays green.**
+
+## The unscheduled chapter: the fork famine
+
+Between the hold and the tag, the box itself failed: m3panel — the machine's own status
+watchdog — had leaked one orphaned `pmset -g thermlog | tail -2` pair per refresh for 2.5
+days: ~10,600 processes, fork starvation, two QA runs killed mid-suite. The record keeps three
+things: (1) both poisoned runs are logged honestly in §36.5 — every gate that completed in
+them matched run 3's verdicts, so nothing was ever wrong but the box; (2) the fix was at
+source (the already-patched `sh()` finally restarted onto its own fix — **a fix isn't
+deployed until the process running the old code dies**, the E-roster lesson at OS scale);
+(3) the fleet gained standing infrastructure: `party.monster.reaper`, a 10-minute janitor
+that kills only orphaned known-leak patterns past a grace age and alarms at 2,000 processes.
+The watchman flooded the town; now the watchman has a watchman.
+
+## What worked — keep doing
+
+1. **Fable-driven lanes.** Seven rounds, ~20 lane-agent sessions, zero tree collisions beyond
+   one adjudicated 6-line seam — the treaty held for agents exactly as it held for humans,
+   because the contracts did the talking (F honoured C's asks sight-unseen; B stubbed F's
+   exact shape then proved nothing was stubbed).
+2. **Ownership sentences, unbroken streak**: "the rule was the stale thing" (C) · "the red
+   was mine" (E) · "four of five attempts were F's fault" (F) · "the count is 9, not 7" and
+   "the clips are Rokoko, not Mixamo" (E, correcting the integrator's brief from bytes).
+3. **The structural no-pump law** — C's `min(p−1, …)` clamp meant no future rebalance could
+   ever create a money pump without violating a contract; the gates then proved the pump C
+   herself found was structurally dead.
+4. **Kills with measurements** (B's awning ripple, D's instrument LOD) — the backlog carries
+   no zombies.
+5. **The morning paper** — the come-back-tomorrow hook works. The epoch's best moment of play
+   is reading the hammer's news at dawn.
+
+## What cost us — fixed or fenced
+
+1. **The explicit-flag blindfold** (R31) — now law: gates about defaults boot naked.
+2. **Out-of-round commits** — the 2 a.m. work was good, but it took a wave-1 sweep, a gate,
+   a hold, a ruling, and a fix to regularize what a round would have gotten right the first
+   time. The door stays open for 2 a.m. inspiration; the sweep is now the standing tax.
+3. **Waiting agents die** — three F pauses on block-buffered suite waits; the pattern is now
+   fixed operationally (background-and-poll, or Fable holds the sentinel).
+4. **A fix isn't live until the old process dies** — m3panel ran patched code's ghost for
+   days. Applies to LaunchAgents, servers, and long-lived sessions alike.
+
+## Carried to v7.x (the queue, all filed)
+
+⚖ discoverability · LIST confirm-click · the paper as an artifact · keeper-rumor hand-verify ·
+crate-at-the-counter polish · the greedy arbitrage-bot verifier (MUST build before G's live
+tier) · E's owned-item stability check (MUST land before any atlas re-emit) · home base (the
+pocket-park bench awaits the civic layer).
+
+## The board after seven epochs
+
+v1 the system · v2 the content · v3 the district · v4 the real map · v5 the real shop · v6
+the living street (spikes still gated on John's footage — the MOCAPGOD queue remains empty) ·
+**v7 the game**. The frontier shelf: terrain · the vernacular kit · the civic layer · THE
+HORIZON matte + Voronoi outskirts · the sky dome. The next epoch is John's pick, as ever —
+and for the first time since round one, the honest answer to "what is PROCITY?" is: **a game
+you can hand to a stranger.**
+
+*— Fable. Thirty-six rounds, twenty-two tags, six correct holds, one amended covenant, one
+fork famine survived. Sunburnt is still in the crate.*

docs/REVIEW_CITY_PATTERNS.md

@@ -0,0 +1,230 @@
+# PROCITY — CAN WE ADD MORE PROCEDURAL CITY PATTERNS?
+### A decision-grade review, post-v7.0. Written for Fable, addressed to John.
+
+---
+
+## 1. THE STATE OF THE TOWN
+
+Seven epochs in, the machinery is genuinely good and the street is genuinely empty. Both halves of that sentence are load-bearing.
+
+**What is strong.** The plan/runtime split holds: Lane A is 2,546 lines of pure data with no THREE import, no network, no clock, JSON-round-trippable, under 100ms per plan, running 156,352 assertions in 20.6s all green. The determinism law is not aspirational — `seedFor(citySeed, kind, id)` hashes a *semantic string*, so a new `kind` label is a mathematically independent stream **by construction**. You can add five hundred draws to a new layer and every existing tree, shop and band name is bit-identical. That single property is what makes this entire review possible. The classic covenant is machine-enforced (fingerprint `0x5f76e76`, pinned independently in two files). The zero-asset law is tested by *counting network requests*, not by asking the code. There is exactly one money seam in the whole game. The asset factory has cost $0.64 in its entire history.
+
+**What is genuinely thin.** The street has objects and no affordances. That is the whole gap, wearing ten different hats:
+
+- **The food cart is unmanned.** 44 cart sites on the golden seed, 511 placed across the 21 real towns. `furniture.js:252-255` holds the full shop record — id, type, lot, rotation — at the moment it pushes the cart's matrix, and throws all of it away. No vendor, no price, no hours, no transaction, no smell of onions. It is 15× more common than the record shop across the real corpus.
+- **The bus stops have no bus.** `busShelterStops(plan)` was exported in R6 with a comment saying it exists "so the future vehicle loop can enumerate stops without touching furniture internals." The vehicle that arrived was a tram running the high street. Three consumers read it — the tram, the light pools, the debug overlay — all as coordinates. Nobody ever waits at one.
+- **There are no animals.** Grep-verified across all of `web/js`: magpie, kelpie, kookaburra, wombat and galah exist *only* as tokens in the shop-name generator. The town is named after wildlife it does not contain. No cars either, apart from the tram.
+- **The corridor law is published and contradicted.** `roadWidth`/`vergeBand`/`poleOffset` are exported from `registry.js`, obeyed by exactly one consumer, and disagreed with by every other lane by about nine metres. Measured on the golden seed: all 254 bench points lie outside A's verge band and 138 of them land inside a lot footprint; 792 of 792 sampled ped-lane points lie outside it and 521 land inside a lot. `ground.js:55` paints the entire 28m corridor as bitumen.
+
+**THE ONE STRUCTURAL OBSERVATION.** Lane A publishes contracts the runtime lanes do not consume, and each runtime lane carries a private duplicate. There are four implementations of `isOpen`, two incompatible `chunkIndex` functions (A buckets a lot into every chunk its AABB touches; B buckets by centre only), two shop registries (B's is missing all three venue types, which is why every gig venue in every town has rendered op-shop sign colours since R13), and a chunk lifecycle hook (`ctx.onChunkBuilt`) that is *built on both sides and wired on neither*.
+
+The visible cost of that, today, on the boot every player gets: **all 14 gig posters are standing in the road.** A's placer obeys `poleOffset` (6m). B's ground paints bitumen to 14m. A's own selfcheck validates clearance against `roadWidth/2` = 5m, so the gate is green while the street is wrong.
+
+Every street-side content idea in this review — a bus stop with a real platform, a vendor pitched on a verge, a dog on a nature strip, a parked car at a kerb — collides with this before it collides with anything else. **The highest-leverage change available is not new content. It is deciding where the kerb is.** It costs about twenty lines and zero draws.
+
+**Two corrections to house folklore, both measured.** First: the draw budget. The "~131 draws / ~185 worst street view, roughly 100+ draws of headroom" figure is a *teleport-to-bookmark* number and it does not survive a walk. Walked in 8m steps down the main spine, the default boot peaks at **280 draws of 300** *(R37 re-measured and PINNED it at **292 draws / 124,793 tris**; the 280-vs-191 split was camera bearing, not method — see LANE_F_NOTES §37)*. The real margin is about twenty. Triangles, however, are wide open — 99k–124k of 200k, with the two independent measurement sessions disagreeing enough that the tri baseline needs a re-pin. **Spend triangles, not draws.** A town-wide single `InstancedMesh` costs 1 draw regardless of population (venue.js runs 381 light pools that way, verified); a new per-chunk instanced type costs +1 draw × up to 31 live chunks.
+
+Second, and larger: **all 21 real towns are 100% `use:'shop'` lots with exactly one district, `mainstreet`.** No house lots, no yard lots, no stall lots, no market block, no residential backstreets. The town the design language describes — the market square, the backstreets, the yards — exists on precisely one town: the synthetic one, which is also the classic one. This kills or halves a third of what was proposed, and it is the most important strategic finding in the packet.
+
+---
+
+## 2. THE ASSET PIPELINE, HONESTLY
+
+Everything below was measured on this box today, not read from a doc.
+
+| Class | Path | Cost | Licence | Blocker |
+|---|---|---|---|---|
+| **Audio** | `gen_audio.py` — 781 lines of pure numpy | seconds, $0 | 🟢 original | **None. Best class we have.** |
+| **Skins / signage** | `flux_local` on-device | 9.3s each, $0 | 🟢 | None |
+| **Static prop** | flux → `bg_remove_local` → `trellis2_mlx` → `normalize.py` | ~2.5–3 min, $0 | 🟢 CC0-equiv | None. ~20–25 props/unattended hour. |
+| **Vehicle (static)** | same | ~3 min, $0 | 🟢 | Greenfield; wheels won't turn |
+| **Rigged biped** | `trellis2_mlx` → MIRPAMO autorig → retarget | ~5 min | 🟢 | Feed GLB/BVH, never FBX |
+| **Rigged quadruped** | — | — | — | **HARD WALL** |
+| **Rigged bird** | — | — | — | **HARD WALL, worse** |
+
+**The pipeline is one generation behind the farm.** `pipeline/gen_props.py` hardcodes `trellis_mac` (p50 245.4s, 33 jobs in the last 7 days). The farm's actual workhorse is **`trellis2_mlx`** — 384 jobs in 7 days, p50 **134.6s**, better PBR bake. That is a ~2× throughput gain for a one-line change and it should land with the wave. `blender_convert` has 3 lifetime jobs with 1 failure and has been untouched for three weeks — keep it off any critical path. Budget 4–5% retry on mesh gen; failures are opaque (`exit 2`, one OOM-kill).
+
+**Two brief premises are wrong.** Cloudflare Workers AI is live and fast (2.54s mean at 1024²) but the "~10,000 free generations/day" figure is **10,000 *neurons* per day** — a compute unit, not images. The real ceiling is plausibly hundreds. Plan CF as a fast-path accelerator, not a budget. Its output is also **JPEG with no alpha**, so `bg_remove_local` is mandatory before any mesh step, and its framing is unreliable without procity's own tuned prompt template. Separately: **MOCAPGOD does not exist on this box** — `~/Documents/MOCAPGOD` is 0 bytes, one empty `queue/` dir, not a git repo. The working substitute is MODELBEAST `motion_local` (MoMask, text→BVH, ~11.7s, 4/4 success) — human-only.
+
+**THE ANIMAL BLOCKER, stated once and clearly.** MIRPAMO cannot rig an animal and this is architectural, not tuning. Its landmark detector assumes "upright character, +Z up, roughly symmetric about X=0, T- or A-pose" and hardcodes anchors as fractions of a biped's height (groin 0.52, chin 0.87, knees 0.285). `build_skeleton()` emits a fixed 14-call humanoid chain. A repo-wide grep for `quadruped|animal|dog|horse|bird|tail` returns zero hits. The only bonemap shipped is human CMU mocap. MoMask is HumanML3D — human. The clip bank is a single mixamorig namespace.
+
+Worse: **a non-humanoid does not fail, it silently does nothing.** Lane D pushed the bone-free food-cart GLB through the real rig machinery. `buildFigure` did not throw; the bbox fallback scaled it to 1.75m and planted it; `makeActor` returned `hasClips: true` while **0 of the walk clip's 64 tracks bound**. A dog on the walk graph would glide down the street frozen in bind pose and no gate in the repo would notice. The impostor bake compounds it — it frames a square cell at 1.14× subject height, so any quadruped is clipped in the mid tier.
+
+**So: animals are static props, scripted transforms, or vertex-shader fakes. Forever, until a human hand-rigs a quadruped in Blender.** Every one of the six animal proposals reached this conclusion independently, and that convergence is the single strongest signal in the review.
+
+**REUSE BEFORE YOU GENERATE.** Nine published, budget-legal, provenance-clean assets are sitting idle in the manifest with zero runtime consumers:
+
+- **`novelty_record`** — 8,000 tris. Lane E decimated it from 26,486 in R5. `furniture.js:275` already calls `glb('novelty_record', …)` but `GLB_FILES` has no key, so the call can never fire. A stale comment is the only thing keeping a finished hero landmark prop out of the game.
+- **`streetlight`** — 4,999 tris, no consumer; run `decimate_props.py` (the R22 tool that took the bin 3,000→800) and wire it.
+- **Four bench variants** — `bench_modern` 640, `bench_wood` 3,999, `longbench` 1,172, `park_bench` 5,000. Every bench in all 23 towns is currently the same mesh. `longbench` at 5.86m is explicitly the arcade/market feature bench the audit already describes.
+- **`coffee_table`** 495, **`box_crate`** 78, **`counter`** (the 4m balcao, 276 tris — which is exactly the `bar_counter` fitting that is still primitive-only in all three venue types).
+
+That is nine assets, one line each, zero generation, zero licence work. **Do this before generating anything.**
+
+**DO NOT reuse:** the 3GOD depot as a pool (971 live assets, mixed provenance, known trademarked items inside; `_published.json` records 53 with no drift, but `AUDIT.md` records 138 — a ~7× stale cross-reference). And `shop-cat.glb` is *not* a reuse — it is an intake: 8,000 tris, zero entries matching "cat" in `_published.json`, needing a decimate, a publish record, an AUDIT row and a licence ruling. A fresh local gen is cleaner and costs three minutes. **The hardyards set** (39 GLBs — gum, jacaranda, fence panel, gate, shed, pergola, washing line, water tank) is exactly the vernacular kit's shopping list and its `MODELS.md` documents provenance for one file. Do not ship it; do clear it, separately.
+
+---
+
+## 3. THE RECOMMENDED SLATE
+
+Twenty-seven proposals went to adversarial review. **One survived unqualified.** Where the reviewer corrected the designer, the corrected version is what appears below and I say so.
+
+### WAVE 0 — THE FLOOR
+*All micro. All must precede content. Roughly one round across three lanes.*
+
+**0.1 — THE KERB RULING, and the widened footpath.** *(Lane A ruling + Lane B code + Lane F gate)*
+Adopt A's published corridor law. Do **not** paint grass on high streets — `registry.js:220`'s own comment calls that 9m band "verandah'd footpath", and `buildings.js:458-472` already builds an awning over it on every shop lot. Instead extend the **existing** `footGeos` merged class inward from `e.width/2` to `roadWidth(e)/2`. **+0 draws** (same merged mesh), ~2k tris, fill-rate improves because 18m of every main street stops being road texture, and the 14 gig posters land where A already thinks they are. Must special-case `arcade` (`roadWidth` 0 → zero-area road quad and coincident kerbs) and `lane` (`vergeBand` = [2,2]).
+**Gate:** the falsifiability control the reviewer called the best design in the packet — run the poster-clearance leg against `?verge=0` and assert it **FAILS there**, because the pre-change failure is already known and counted at exactly 14.
+*Grass verges survive, but only on residential edges, which is where they are period-correct and where 1.4 wants them anyway.*
+
+**0.2 — REPAIR `smoke_tram`.** *(Lane F, micro)*
+`flags_check.py:617-630` asserts exactly one thing — `!!getObjectByName('tram')` — prints a SKIP and returns when absent, and **passes on the fenced path** because `tram.js:110-114` adds a named empty group. Five of seven transport proposals leaned on this as the "cheap proof" for a refactor. It is a live violation of the house's own vacuous-gate law inside the house's own suite. Fix it regardless of what ships.
+
+**0.3 — RE-PIN THE BUDGET OF RECORD.** *(Lane F, micro)*
+Adopt the **walked** worst frame as the number the law measures (clean-load bookmarks under-report by 60–80 draws — a walk carries the R+1 dispose window at up to 31 live chunks vs 22). Re-measure once on a real GPU; the headless numbers are SwiftShader. Settle the shared standing-layer instance cap **once** — three animal proposals independently specified 120, 250 and "plus gulls" for the same layer.
+
+**0.4 — WIRE `ctx.onChunkBuilt` / `onChunkDisposed`.** *(Lane B, one line)*
+Producer at `chunks.js:43-51`, consumer at `sim.js:203-205`, both shipped, never connected. Every per-chunk entity system in the slate wants it.
+
+---
+
+### WAVE 1 — INHABITATION
+*Four items. Every one is a single round. None needs a street verb, a rig, a new clip, or John's mocap footage. Three of four are +0 or +1 draws. They touch no shared files, so all four can run in parallel.*
+
+**1.1 — SOMEONE ELSE'S LIFE: the audio inhabitation layer.** *(E + B + F)*
+**The only unqualified SHIP in twenty-seven proposals.** The manifest ships 7 ambience / 9 sfx / 7 music and not one animal, domestic or seasonal sound. A dog going off behind a paling fence, a mower two streets over, a radio through a window, sprinklers, a roller door — the sound of a life happening off-screen.
+*Mechanism:* seeded point-source audio anchors, each a ~30-line numpy generator in `gen_audio.py`'s PACK registry, deterministic via `crc32(name)`.
+*Corrected:* it is **six new mixer layers**, not "generalising `audio.js:300-311`" — `audio.js` has hardcoded bed layers per source class, not a generic point-source system. And there is **no panning**: `playSfx` is mono with a gain multiplier, so distance works and direction does not. Say so or budget a `StereoPannerNode`. Derive day-of-week locally rather than depending on the calendar item.
+**Budget: zero draws, zero tris — the only item in the slate that cannot touch the budget under any circumstance.** Audio pack 10MB → ~11MB against a 25MB cap.
+**Gate:** keep the falsifiability control verbatim — point one table entry at a non-existent key and assert the leg FAILS. It is the correct descendant of the R23 lesson and every other gate in the slate should copy its shape.
+
+**1.2 — TWENTY-THREE TOWNS: the per-town character vector.** *(B + E + F)*
+Twenty-three real towns currently differ only in street layout and shop names. Give each a ground palette, an ambience mix and a sky bias.
+*Mechanism:* `ground.js`'s `add()` merges each surface class into ONE mesh for the whole town regardless of size — verified, exactly 5 meshes. **A palette swap is +0 draws / +0 tris.** The strongest cost claim in the entire packet. `gravel`(verge) and `reddust`(outback) already ship in the manifest and are selected by **nothing**.
+*Corrected:* the `state` field is **not** populated on all 23 — `newtown_godverse` and `redhill_godverse` carry `state: ''`, so the vacuous arm must be **per-town**, not per-corpus, or those two silently take a default branch with no SKIP printed. The palette is 10 skins with one outback and one gravel, so "Darwin is red dust, Hobart is cold light" needs 3–4 new `gen_skins.py` generations — name them in the charter. And `skyBias` must **not** go through `lighting.setSky`: `externalSky` (`lighting.js:53`) is a one-way latch with no un-set path. Feed it into the base `skyName` selection instead.
+*`townCharacter(null)` returning the frozen literals makes classic byte-identical by construction rather than by flag — the right mechanism.*
+**Budget: +0 draws / +0 tris.**
+
+**1.3 — THE MAGPIE.** *(B + E + F)*
+Swooping season. For six weeks of the game's year, one bird on one street will not let you walk past it. Real behaviour: a ~6-week window Aug–Oct, north to south, and ~90% of males never swoop — so **one bird, not a plague**.
+*Mechanism:* a static mesh on a scripted parabola. No AI, no flocking, no pathfinding — the tram's verified 2-mesh/2-draw pattern at a fraction of the cost. Wing wave through `wind.js`'s amplitude-uniform shape, which is byte-identical at amp 0.
+*Corrected:* **cut the ice-cream-container hat.** There is no street verb — `index.html:493-499` binds only `][ P M T`, and the only street affordance is a click that *enters the shop*. "Buy the hat at a milkbar door" either enters the milk bar or does nothing, and the gate would have to call the wallet directly, which is the R31 dig lesson recurring. Also **scale the territory with the road graph**: one bird among bendigo_real's 13,730 tree anchors across 2,593 edges is statistically unencounterable.
+**Budget: +1 draw / ≤900 tris.**
+**Gate:** keep "the day-roll clears the latch and localStorage gained no new key" verbatim — the best single arm in the packet and a genuine delta-law falsifier.
+
+**1.4 — BACKYARD AUSTRALIA: the residential district exists.** *(B + E + F)*
+Hills Hoists, paling fences, TV aerials, water tanks. 181 house and yard lots on the default boot with nothing in them.
+*Corrected, and cheaper than proposed:* build it **inside `buildings.js`**, riding the existing `boxMats` InstancedMesh (`buildings.js:311` already carries shells, parapets and verandah posts, and `buildHouse` already pushes into it). Hoist, fence run, aerial, tank are all boxes → **+0 draws**. Only the alpha washing quads need a new mesh. **+1 draw/chunk total, not +2.** A separate `world/yards.js` cannot reach `boxMats` and would have to pay the draw the proposal then presented as its honest cost.
+*The washing needs an inverted wind weight.* `wind.js:38-45` computes `wH = clamp(y/4.4,0,1); wH *= wH` — top-weighted, base planted. Correct for a gum tree, exactly wrong for a sheet pegged at the top. At 1.6m the amplitude is 0.7–4.5cm, i.e. visually inert. Either drop the washing this round or write an inverted-weight sway mode.
+*Its own named risk is now resolved by measurement:* the residential district walks at **157 draws / 31,651 tris worst** (edge 16, 20 live chunks) against a main-spine control of 263 / 123,602 on the same build. ~143 spare draws where these props land.
+**REJECT the hardyards GLBs on provenance grounds** — this was the best licence judgement in the packet and it should be quoted into the charter.
+*Scope honestly:* this is a **synthetic-town feature**. That is still the default boot, but it is one town.
+
+---
+
+### WAVE 2 — THE STREET GETS A VERB
+*Sequential. Wave 2.0 is the substrate that four separate proposals each tried to invent privately.*
+
+**2.0 — THE STREET INTERACTION SURFACE.** *(B + F, half a round to a round)*
+A `KeyE` verb on the street; an `interactRects` registry with a `kind` tag resolved off instanced meshes by `instanceId`; explicit hit priority (door beats cart); a click fence. Two listeners currently ride the same canvas click (`hud.js:376` and `index.html:510`'s pointer re-lock), so any cash-spending click must be gated on `player.isLocked`. Also the street-mode dig frame branch, which the shell does not have.
+
+**2.1 — THE MANNED CART.** *(B + D + F, one round after 2.0)*
+Consumes the theme's flagship dead seam. `KeeperManager` is genuinely not interior-coupled and costs a **measured** 1 draw and 2,391 tris per stationary rig, 0.02ms of mixer, disposal residue-free.
+**The blocker, which is not cosmetic:** the proposed "+0 draw" `doorRect` ride would make **every milk bar and stall un-enterable from the front**. `hud.js:317-327` takes `hits[0]` — the nearest intersection — then resolves by distance to the *hit point*; the cart sits 1.55m proud of the door on its own centreline. That is 44 shops on the golden seed and 589 across the caches. The fix is to raycast the cart's own `InstancedMesh` (already emitted at `furniture.js:276`) and carry the shop record that `furniture.js:252-255` already has in scope and discards. Gate it by standing in front of a **milk bar** and asserting the resolve names the milk bar.
+**Cap at N=3 nearest, asserted while walking a dense block, not at spawn** — `keepers.js:67-90` ticks every mixer every frame with no LOD.
+**Budget: +3 draws / +7.2k tris at the cap.**
+
+**2.2 — THE FAUNA SUBSTRATE + the field guide.** *(B + F + E, multi-round)*
+One shared town-wide standing layer at **+1 draw / ~240 tris**, one settled cap, one save-backed sighting ledger. The ibis on a bin is the proof species; the perched cockatoos, the gulls, the tied dog, the possum, the moths and the two flies all ride the same layer once it exists. **Build it once, properly.**
+*Corrected:* add `sightings` to **`adopt()`** (`save.js:166`) in the same commit as `payload()` — adopt is the travel path, and a reload-based gate would not catch the bug. Cap and dedupe (16 species × 23 towns = 368 natural ceiling). Measure the selection path on **bendigo_real** (23,744 roost anchors), not katoomba. It is three lanes, not one.
+
+**2.3 — DOGS, TIER B FIRST.** *(B + E + F)*
+The kelpie tied outside the shop, as one global InstancedMesh at **+1 draw**. Tier B anchors off shopfront frontage, which exists on all 1,117 real-town shop lots. **Tier A (the fence bark) must be re-anchored** — it keys off `use === 'house'|'yard'`, which exists on zero real towns, and its gate only ever visits the one town where the subject exists. Fold the bark into 1.1 (the audio layer) where it belongs.
+
+---
+
+## 4. THE CUT LIST
+
+The house kills ideas with measurements. These are the measurements.
+
+| Cut | The measured reason |
+|---|---|
+| **The town-loop bus** | Its own precondition-as-assertion goes red. It asserted the tram is fenced on newtown_real; measured, newtown is **not** fenced and the tram runs 16 stops over 1,924m. Fitzroy has 139 shops (not 160), is not fenced, and runs 28 stops over 4,101m. The mutual-exclusion rule builds the bus on 7 of 23 towns and those are the *sparse* ones (darwin 12 shops, braddon 19, bowral 30). The shelter-rich towns are overwhelmingly unfenced: northbridge 272, adelaide 209, newtown 149. **What survives is one file** — `tram.js:93-97` files the real unbuilt thing: real high streets come out of OSM as `side`. Extend `spinePolyline`'s edge set to main+side and let the *tram* run on those 7 towns. +0 draws, +0 tris, one lane, one round, same dead seam retired. |
+| **The ute that sells** | Placement set empty on all 21 real towns. And 36 of its 83 synthetic candidates — **all 36 yard lots** — have no shop on their `frontEdge`, so its own save-poisoning fix fails on 43% of its set. A borrowed `shopId` is also a user-visible lie: `hud.js:159-163` renders the find as bought at the milk bar next door. |
+| **The charity bin** | REJECT. On the default boot the only collectibles are parody records, every parody sleeve carries a band, `BANDS.record`'s lowest low is 2, and `sellOffer(2) = 1` — never 0. **The filter accepts nothing.** The synthetic town has 77 record shops so the "no counter in this town" arm never fires either. Its accept-arm has to inject an item no shipped code path can produce. Vacuous by the house's own definition. Also four lanes plus an asset round, not "micro". |
+| **The dusk flush** | The day is **240 seconds long** (`lighting.js:83`, 6 segments). "The six o'clock racket" is a fifteen-times-an-hour racket. And its own mitigation is unimplementable — the `procity:segment` event carries `{seg, hour, night}` and is dispatched identically from `update()`, `setSegment()` and `stepSegment()`, so a real transition cannot be told from a bracket-key step or a screenshot bookmark. **Keep the perched birds; a proximity startle is the better trigger anyway.** |
+| **The magpie hat** | No street verb exists. |
+| **The level crossing as an OSM feature** | Needs a 23-town cache rebuild — `build_towns.py` rewrites the *whole* cache, and its own docstring records the Newcastle incident where shops were refetched and old roads silently reused. 46 pinned goldens ride on byte-identity nobody has proven. Four strictly-ordered lanes, and the gate's only realistic state is SKIP until E ships. **Shelve the real-rail version. The rescoped version — seeded synthetic crossings, procedural geometry, `gen_audio` bells and horn and rumble — is one round and still shuts the map for twenty seconds.** |
+| **The mail run** | Its headline mechanic cannot exist without a fourth save-schema widening, which the proposal claims it does not need — `resolveAuctions` resolves strictly `listDay < day`. The conservative fallback is one prop and one string. Weakest 1990s-Australian specificity in the set: a period-correct object with a generic mechanic. *Keep the one-hammer analysis as a gate arm for anything that touches GodBay.* |
+| **Parked cars, this epoch** | Deferred, not rejected. Blocked behind the kerb ruling (a car at `roadWidth/2` sits 9m inside painted road), a chunk-bucketed dynamic collider registry that does not exist, and a `BASE_DRAWS=164` re-pin. **+48,000 tris always submitted** — a town-wide instanced layer computes an instance-aware bounding sphere and is effectively never frustum-culled. Affordable but the likeliest item to eat the margin. When it lands, **make the 45° angle parking a charter requirement** — it is doing all the Australian work. |
+| **Market day / boot sale / garage sale as pan-corpus features** | All three are synthetic-town-only (100% shop lots, one district). Market day additionally needs a geometry path that does not exist — `ground.js`'s `rectGeo` is axis-aligned only — and would pave 27,600m² where the stalls occupy ~44×77m. |
+| **Anything with a rigged animal** | Capability wall, not a design failure. See §2. |
+| **The research doc's trap list** | Endorsed wholesale: full traffic sim, civic interiors, per-NPC schedules, boids, real-date seasons, terrain sneaking in sideways, 23 bespoke Big Things, voice lines, brand fidelity, multiplayer, needs models. |
+
+**And the plain answer to the three you named.** *Street vendors* is the strongest — but only the manned cart, and only after the door raycast is fixed; the rest of the theme is synthetic-only or rejected. *Stray animals* is viable but permanently capped at static and scripted — and the magpie is nonetheless the best charm-per-byte item in the entire packet. *Public transport is the weakest of the three*, and its flagship proposal refuted itself with its own gate. **All three were beaten by things you did not name**: the audio inhabitation layer (zero draws, the only clean SHIP), the per-town character vector (+0 draws, +0 tris), and the kerb ruling (twenty lines, and it is what makes every other street idea geometrically coherent).
+
+---
+
+## 5. THE ASSET WAVE
+
+### The proof batch — one unattended afternoon, $0, decisive
+
+Four capability questions are actually open. This answers all four.
+
+1. **`magpie_static`** — flux_local → bg_remove_local → **trellis2_mlx** → normalize → decimate to ~900 tris. Proves the corrected mesh path end to end on an operator procity has never used, and it is the one asset wave 1 cannot ship without.
+2. **`hills_hoist`** — same path, target ≤600 tris. Deliberately the hard case: thin structures (wire, arms) are the known TRELLIS failure class. If it fails that is a *decisive* finding, and the fallback is primitives, which `boxMats` wants anyway.
+3–5. **`magpie-clack`, `dog-bark-fence`, `mower-distant`** — three `gen_audio.py` PACK entries. Minutes, $0, deterministic, parody-safe by construction.
+6–7. **`ground-grass-dry`, `ground-grass-temperate`** — `gen_skins.py --local` with a new GROUND template, ~5.7s each.
+
+Plus the one-line pipeline fix: **swap `trellis_mac` → `trellis2_mlx` in `gen_props.py`** (~2× throughput), and correct the CF credential path in the fleet skill (it points at `~/Documents/backnforth/.env`, which does not exist on this box; the working client reads `~/Documents/fluxgod-work/.env`).
+
+### The full wave, by class and order
+
+**First — reuse, zero generation:** the nine idle manifest assets from §2. `novelty_record`, `streetlight` (after a `decimate_props.py` pass to ~800), four bench variants, `coffee_table`, `box_crate`, `counter`→`bar_counter`. One line each.
+
+**Audio (`gen_audio.py`, $0, 🟢 original, ~30 lines each):** magpie clack + carol, cockatoo screech, dog bark (fence + near), mower, sprinkler, radio-through-a-window, hammering, roller door, letter-slot clang, crossing bell, distant train horn, rail rumble, tin-roof rain, cicadas, wind-in-gums. **Plus the six missing footstep surfaces** — grass, gravel, red dust, brick pavers, lino, timber verandah. The manifest ships ten ground skins across six use-classes and only two footstep sets exist; walking on red dust currently sounds like concrete. Lane E's own map calls this the cheapest measurable content gap in the repo.
+
+**Skins (`flux_local`, ~5.7s, $0, 🟢):** the 3–4 ground palette gaps (dry summer grass, cool-temperate grass, red-dusted bitumen, coastal sand) and a FOR-LEASE / whitewashed-glass texture. *The ~20 missing shop-type facades — servo, church, bank, post office, butcher, bakery, chemist, newsagent, TAB, laundromat, barber, hall, motel, station — are a wave of their own and belong with the vernacular kit, not here.*
+
+**Meshes (~3 min each, $0, 🟢 CC0-equivalent under `AUDIT.md:101`'s doctrine — flux_local concept on an Apache-2.0 model, TRELLIS reconstruction of that concept = original work):** magpie, cockatoo/galah (one body, three tints), silver gull, tied dog, possum, cat (**generate ours** — a fresh local gen is cleaner than an intake from a mixed-provenance depot with no publish record, and costs three minutes), phone box, paper stand, pillar box, A-frame board, milk-crate stack, wheelie bin, trestle table, cardboard box, transformer drum. Roughly fifteen meshes ≈ one unattended hour at the measured rate. Budget 4–5% retry.
+
+**Rigged: nothing.** The vendor reuses the 24 shipped bodies and 8 shipped clips. If a "hand over" clip is wanted later: `motion_local` (text→BVH, ~11.7s) → MIRPAMO retarget → `fbx_to_clip`. Human-only by design.
+
+**Licence discipline.** Every mesh, skin and audio asset above lands 🟢. Each carries a named source zone in `LANE_E_NOTES`, a generation method naming the exact tool and model, an `AUDIT.md` narrative entry with measured tris/footprint/height, and a `_published.json` entry if it touches the depot. hardyards stays 🟠 until cleared. The 971-asset depot stays 🔴 and is not a pool. Re-run the AUDIT depot cross-reference before anyone plans reuse from it.
+
+---
+
+## 6. THE SEQUENCING
+
+**Epoch name: `v8 — SOMEONE LIVES HERE`.**
+
+(The research doc proposed "THE TOWN HAS A WEEK". That name over-promises now — the calendar and trading-regime item was rescoped into three rounds because the per-type `shut` list cannot be a uniform: shop hours are baked into a **per-vertex** `aHours` attribute at chunk-build time, so a per-type close delta means rewriting that attribute across up to 27 live chunks on every sleep. Its "+0 draws, +0 tris, +0 bytes" claim must not reach a charter. It is a good v9 item; it is not a cheap one.)
+
+**Against what is already chartered.** v6 LIVING STREET is chartered and gated on your mocap footage. **Nothing in wave 0 or wave 1 needs a clip.** That is deliberate and it is the main argument for this shape: it gives the project a full epoch of parallel work that does not wait on your camera.
+
+**Against the frontier shelf.** *Terrain* — nothing here needs Y; keep it that way. *The vernacular kit* — wave 1.4 (backyard Australia) is its residential half arriving early; the ~20 missing shop facades are its other half and stay on the shelf. *The civic layer* — this is the real v9. Every real-town gap this review found points at the same place: `plan_osm.js` emits one district and the Overpass fetch asks for only shops and roads. 30,959 footway ways, 12,351 service ways, 6,421 crossings, 2,714 sidewalk tags and 13,199 oneway tags are **already cached in-repo, unused**, and a bounded third fetch class (marketplace, park, pitch, memorial, fuel, school, bus_stop, telephone, post_box) is mechanical under the standing authorisation. That is the fix for "real towns are a shopfront strip", and it is a better-motivated epoch than anything in the vendors theme. *Horizon matte / Voronoi outskirts / sky domes* — orthogonal, but 1.2's `skyBias` must be designed knowing sky domes are coming, and must not touch `setSky`'s one-way latch.
+
+**WHAT HAPPENS FIRST, plainly: the kerb ruling.** Not code — a decision. Until it is made, five separate proposals are designing against contradictory geometry and fourteen gig posters are standing in the road on the boot every player gets. Make the ruling, land the footpath widening with the `?verge=0` falsifiability control, repair `smoke_tram`, re-pin the budget — then wave 1's four items run in parallel across four lanes with no shared files.
+
+---
+
+## 7. WHAT NEEDS JOHN
+
+### Decisions
+
+1. **The kerb ruling.** Footpath or road, for the 9m band between kerb and shopfront. **Recommend: footpath** — adopt A's published law, widen the existing merged footpath class inward, +0 draws, and the posters land where A already thinks they are. Grass verges on residential edges only.
+2. **Is synthetic-only acceptable?** Backyard Australia, market day, garage sales and the whole residential/market vocabulary live on **one** town, because all 21 real towns are 100% shop lots with a single district. Either accept "the default boot is the richest town", or fund the civic-layer fetch that gives real towns their other lot uses. **This is the biggest strategic question in the review and it is not a lane's to answer.**
+3. **The animal answer.** No rigged quadruped exists or can be automated on this fleet. Accept static + scripted-transform animals for v8, or commission a hand-rigged quadruped in Blender as a one-off human job. **Recommend the former now, defer the latter.**
+4. **The market plaza.** `ground.js` paints a 46×46m plaza at the origin — on top of the spine road, touching none of the 40 stall lots at x −77..−33, z −100..−23. Fixing it changes visual output on the covenanted town. **Recommend: fix it under the amendment law** (the R27 precedent — the covenant is anti-drift machinery, not a defect preservative), as its own small ruling, not folded into a content round.
+5. **Epoch name and shape** — `v8 — SOMEONE LIVES HERE`, wave 0 then four parallel wave-1 items, wave 2 behind the street verb.
+6. **The budget of record and the shared-layer cap** — adopt the walked worst frame; settle one instance cap for the fauna layer before three implementations invent three.
+7. **hardyards provenance.** 39 GLBs that are exactly the vernacular kit's shopping list, with provenance documented for one file. Only you know where they came from. Worth an hour of your memory.
+
+### Credentials and authorisations
+
+- **Nothing in this slate is blocked on a credential.** MODELBEAST is up and token-authed from disk; Cloudflare works; the depot accepts passwordless tailnet uploads. Worth stating plainly, because the brief assumed otherwise.
+- **Mixamo fetch needs your logged-in Brave session** for any *uncached* clip. Not needed for this slate; needed if anyone wants a new human clip that MoMask cannot produce.
+- **Standing authorisation to re-run the Overpass fetch** — 23 towns, one bounded query each, 4s courtesy, ODbL attribution into every cache and into `SOURCES.md`. Not needed for v8 as scoped. **Needed for v9.**
+- **Where is MOCAPGOD?** The brief says lanes 0/A/B are done. On m3ultra the directory is 0 bytes and not a git repo. Either it lives on JING5 or the Air, or it was never started. Not blocking — `motion_local` covers the need — but the fleet docs are wrong somewhere and only you can say where.
+- **A ruling on the depot.** 971 live assets, 53 in `_published.json`, `AUDIT.md` recording 138, and known trademarked items inside. **Recommend: treat it as a read-only archive, generate fresh for anything new, schedule an `AUDIT.md` re-run.**
+- Optional but cheap: **keep `?verge=0` permanently as a gate flag.** It is the best gate design in the packet and it costs nothing.

docs/SALE_RED_TICKET_DAY.md

@@ -0,0 +1,191 @@
+> **FABLE'S NOTE (2026-07-26).** John's pitch; designed by a 3-framing panel (time-attack /
+> market-day / daily-challenge), each adversarially judged, then synthesised. **I verified the
+> load-bearing finding myself before circulating this:** `kind:'bin'` is minted at exactly
+> `fittings.js:60` and `:75` (`recordBin`, `crate`), and those appear in exactly two recipes —
+> `record` (`theme.js:38-39`) and market `stall` (`theme.js:196`). **Confirmed: only record
+> shops and market stalls have a diggable crate.** The op shop's recipe (`theme.js`) is clothes
+> racks, metal shelves, a bookshelf, a trestle table and `crateStack` — which its own comment
+> labels *"back-room dressing"*, i.e. scenery, not a bin.
+>
+> **That is a finding about the MAIN GAME, not just this mode**, and it is filed to the v8 debt
+> ledger: PROCITY is built on thriftgod's op-shop DNA and **you cannot dig in an op shop.**
+> Whether that is a gap to close (give the op shop a bric-a-brac bin) or a fact to design around
+> (records are the deep dig; op shops are pull-and-buy) is a John-level taste call, and RED
+> TICKET DAY does not depend on the answer.
+>
+> **AMENDMENT (R39, Lane C, measured):** this design's roster counts "crate-shops" from the
+> RECIPES — but **44% of market-stall rooms contain no crate at all**. The stall's `crate` is
+> `zone:'centre'` and its 3–6 trestle tables take the aisle first, so the roster can name a stall
+> you cannot dig in. Also: **a stall dig stamps the pull `type:'record'` while the stall itself is
+> `type:'stall'`**, and `sellableIn` is type-equals-type — so **a stall find has nowhere to be
+> sold**. Both are pre-existing, neither is this design's fault, and both must be resolved before
+> RED TICKET DAY ships a roster. Lane C holds a one-line `fallbackZones` fix that would give
+> stalls the crates their own recipe already promises.
+>
+> Superseded in part by John's later reframe — *"the city being procedural and nebulous… you have
+> to even know where to find the store"* — which is running as its own design pass. Read that
+> charter alongside this one: this document owns the ROUND and the LAWS (the Band Floor Law is
+> the best idea in it); the reframe owns the HUNT.
+
+# RED TICKET DAY
+### synthesis of three designs and three adversarial passes — decision-grade, for John
+
+---
+
+## 1. WHATAYARECKON
+
+Yes. Build it. Not because the game needs another system — it needs fewer — but because this is the first thing anyone has proposed that **spends the clock**.
+
+Read our own frontier doc back: *"hours exist! nothing makes you race them"* and *"the clock is scenery."* That is not a missing feature, it is a missing **cost**. Every verb in PROCITY is currently free: riffle a crate, walk a block, dig all day, nothing is consumed except cash. The shops shut and it costs you nothing because there is nothing you were going to do anyway. The sale fixes that from the other end — it makes *today* the only day the $110 grail is $66, and once today has a thing in it that tomorrow doesn't, the hours that already exist start biting without a single new clock.
+
+And it answers *"what is a session?"* — which has been open since v4. A session is **one town, one trading day, one docket**: wake, read the paper, walk, choose which crates you can afford to open, get shut out of the last shop, sleep. Ten to twenty minutes with a beginning, a middle and an end.
+
+Two things it is not. It is **not a stopwatch** — all three judges landed on that from different directions and the code agrees (details in §8). And it is **not free money**: the round is a net cash *loss* by construction, and that is the point. You are not trading, you are buying the day you finally got the thing.
+
+---
+
+## 2. WHAT IT IS
+
+**RED TICKET DAY.** One day in seven, seeded per town, the shops that have crates in them mark stock down. The paper tells you which ones. The markdown never crosses the guide band's floor, so a red ticket is never a gem and a gem is never red — the skill you already have gets *harder*, not easier. You cannot buy them all. The shops shut. What you carried out is the score, and it lives in the crate forever with "day 14, Bendigo" under it.
+
+Structure and scoring come from **TIMEATTACK** (bounded round, forced-flag gates, DOM-only, the Band Floor Law). Diegesis and rhythm come from **MARKETDAY** (a *day*, not a stopwatch; the morning paper; the market's own FIRST IN BEST DRESSED fiction, already painted on the wall at `theme.js:201`). The time model comes from **DAILY**'s one great idea — *time passes on the street, not in the shop* — **corrected**: seconds don't cost you indoors, but **crates do**.
+
+---
+
+## 3. THE ROUND
+
+**Wake.** SLEEP rolls the day (`save.js`, `index.html:281` → `lighting.setSegment(0)`). If today is the town's red-ticket day, the wake toast carries the paper:
+
+> 🌅 day 14 · **RED TICKET DAY** — Vinyl Solution ⅓ off · The Turnstyle ¼ off · Sadie's half price
+
+The sale module then sets the segment to the first roster shop's opening, so a sale day always starts with a door about to open.
+
+**The roster: what the town actually has.** Only two shop types carry crates (measured, §4). The roster is the biggest cluster of ≤3 crate-shops all within 400 m of each other, seeded. Across the 26 shipped town keys at seed 20261990:
+
+| roster | towns | tour | sprint @ 8.8 m/s |
+|---|---|---|---|
+| 3 shops | 5 (fitzroy, adelaide, brunswick, katoomba_real, melbourne) | 74–369 m | 8–42 s |
+| 2 shops | 7 | 6–390 m | 1–44 s |
+| 1 shop | 11 | — | — |
+| **0 — no sale day** | 3 (bowral, darwin, daylesford) | — | — |
+
+Synthetic towns (`plansrc` default, ~480 shops, 103–151 crate-shops): roster of 3, tour **8–27 m**. So the mode is a route problem in the default town and in five real ones, and a *depth* problem in the other seventeen. Both are rounds. Neither is a lie.
+
+**Inside.** A record shop holds 3–8 crates × 16 sleeves = **48–128 records**, of which (modelled off the shipped band table at `bible.js:26-30`) **5–13 carry a red ticket**. A ticket is 25 / 35 / 50% off asking, seeded per shop-day, **floored at the band's low edge**. Mean marked price ≈ **$21**; mean saving ≈ **$10**; a grail asking $90 comes down to $60 and no further.
+
+**The purse.** Day-1 wallet is `60 + (r()*140|0)` ≈ **$130** (`wallet.js:10`). Six red tickets and you're out. There are 12–30 on a three-shop roster. **You take a fifth to a half of what's marked.** That is the whole game of the round: not "grab everything", but "which of these do I want enough."
+
+**The clock — the one real change.** Time does not pass while you riffle. It passes when you **walk** (the street clock, exactly as shipped) and when you **open a crate**: one crate ≈ ⅓ of a segment. A trading day gives you roughly **nine crate-openings**. Fitzroy's 369 m tour eats three of them. So three shops = two crates each, out of the 3–8 each shop has. You will never see the bottom of a town, and the shutter comes down mid-crate.
+
+**The end.** The last roster shop shuts (`isOpen`, already enforced at `index.html:493`). The docket totals what you carried out:
+
+> 🔴 the day's take — 5 red tickets, $84 saved, $103 spent · you left 9 marked in the crates you opened · you never made it to Sadie's
+
+Then SLEEP. Six ordinary days until the next one, or travel (which costs a day anyway).
+
+---
+
+## 4. THE THREE FACTS THAT DECIDED THE DESIGN
+
+Measured this session against the tree, not asserted:
+
+**(a) Only two shop types have crates.** `userData.kind:'bin'` is minted at exactly `fittings.js:60` (`recordBin`) and `:75` (`crate`), and those appear in exactly two recipes: `record` (`theme.js:38-39`) and market `stall` (`theme.js:196`). Op shops, pawnbrokers, book barns, toy shops have **no diggable bin at all**. Two of the three submitted designs set their flagship scene in an op shop. That scene cannot happen.
+
+**(b) The real towns are big and thin.** Generated all 26 town keys: crate-shops per town run **0 to 12**, and they can be **2.3 km apart** (hobart, newtown). Three towns have none. The "three shops, three depths, pick a route" premise is a Fitzroy feature. Hence the 400 m clique rule and the honest "the round is however many shops this town has."
+
+**(c) The day is six values wide.** `HOUR_NUM = [6.5, 9, 12.5, 15.5, 18.5, 22]` (`lighting.js:22`); record hours are 10–18 (`registry.js:40`), stalls 8–14. So **records are open at 12:30 and 15:30 only; stalls at 9:00 and 12:30 only** — two segments each, 80 seconds of street clock. MIDDAY is the only segment where the whole diggable town trades. That is not a bug to design around, it is the trading day, already shipped: **stalls in the morning, records after lunch, everything at midday.** Use it.
+
+---
+
+## 5. MECHANISM, LANE BY LANE
+
+**Lane C — `dig.js`, ~8 lines, one new optional opt.**
+- `dig.js:421` — after `offers = …`, before `buildStack(offers)` at `:424`: `if (opts.sale) offers = offers.map(opts.sale);` A post-draw transform. `proceduralSleeves` (`:36-56`) and `pickRealOffers` (`:379-402`) are complete; zero stream drift, zero re-order, no golden moves. **Never in-place on `pack.items`** — `stockpack.js:30-31` caches by (type, base) and an in-place write leaks town-wide and permanent. `{...o}` copy, always.
+- `dig.js:110-115` — red `fillStyle` on the price when `o.was` is present. Rides the existing per-open `CanvasTexture`. +0 draws.
+- `dig.js:266-275` — a `🔴 SALE · was $50` chip in the stamps row (present-fields-only, so absent ⇒ byte-identical card). The `guide $25–59` line stays exactly where it is: **that is the discount theatre.** `~~$22~~ $17` inside `guide $8–24` and `~~$50~~ $31` inside `guide $25–59` are the same red ticket and opposite verdicts.
+- `dig.js:480-487` — widen `currentOffers()` with `was` and `sale`. Without this the gates cannot see their subject (vacuous-gate law).
+- `bible.js`, `sell.js`: **no change.** Not one line.
+
+**Lane F — one new module + three small edits.**
+- `web/js/world/sale.js` (~180 lines): the seeded calendar, the roster, the ticket transform, the crate accumulator, the docket DOM. Constructed only under `flagOn('sale') && game`; never constructed under `?classic=1`, `?sale=0` or `?game=0`, so absence is by non-existence, not by branch (the `washing.js` / `magpie.js` precedent).
+- `index.html`: one construction line, one `PROCITY.flags` entry, one `?sale=all` force. **No per-frame update** — the module is event-driven off `procity:segment` and `procity:digClose`. Zero frame cost.
+- `save.js`: `recordFind` carries `was` and `sale:1` on the entry (exactly the `band` precedent at `:294`); `validEntry` (`:52-60`) validates both when present; `listFind` (`:366`) refuses a `sale:1` entry.
+- `hud.js`: the docket strip gets its **own body-mounted root**, not a child of `#pc-game` — `hud.js:283-285` sets `#pc-game` to `display:none` for the entire dig, and with no countdown to watch that is now fine, but the strip needs its own construction gate and its own DOM assertions.
+
+**Lane B — one optional four-line API:** `lighting.advance(frac)` so the crate cost can move the day by a third of a segment without `setSegment()` stomping sub-segment position (`lighting.js:113` sets `clock = i + 0.001`). Fallback if B is busy: sale.js keeps its own accumulator and calls `setSegment` only on a boundary crossing. Nothing else from B, A, D or E. **Zero assets, zero fetches, zero draws.**
+
+---
+
+## 6. THE LAWS
+
+**1 — THE BAND FLOOR LAW.** `price = max(bandLow, floor(ask × (1−d)))`, and no band ⇒ no ticket (fail-closed). One `Math.max` buys both fences at once: the keeper's counter offer is `min(lo−1, ⌊lo/2⌋)` off `bandLow` (`sell.js:28-32` + `bible.js:52-58`), so every marked buy costs ≥ `lo` and sells for < `lo` — **the no-pump gate's `all(d <= -1)` holds with zero changes to sell.js**. And nothing under a band floor is ever a sale, so **under-band still means "nobody noticed"** — the gem survives intact.
+
+**2 — THE PROVENANCE LAW.** A `sale:1` entry can never be consigned. *"Can't put that through GodBay, mate — half the district was at the same sale."* One guard at `save.js:366`, one hidden `⚖` on the crate row.
+> **This replaces the "drop the band" fence that two of the three designs proposed, and it is not a preference — that fence is broken.** With no band, `godbayHammer` sets `lo = hi = pricePaid` (`save.js:36-37`) — but the 12% bidding war multiplies *afterwards* by 1.5–2.0 (`:43`), so **~12% of sold listings profit** and the design's own gate arm would go red. It also prints your own purchase price back at you in the morning paper, and blanks the guide line on the sell card (`sell.js:104`). A refusal is one line, hard-assertable, and diegetic.
+
+**3 — THE GEM COVENANT.** The gem is never ticketed. On a sale day the eye is trained on red for ten minutes and the money is still in the plain yellow sticker at $6 in a `guide $25–59` band. Free, and it makes the core skill *harder* on the day the game is loudest.
+
+**4 — DETERMINISM & THE DELTA LAW.** Four new `kind` labels — `'saleday'`, `'saleroster'`, `'saleticket'`, `'salethin'` — independent streams by construction, so nothing existing shifts. **Tickets are keyed to item identity, never array position** (`${shopId}:${day}:${binKey}:${sku ?? i}`): `dig.js:422` filters procedural offers by `gone`, so a position-keyed ticket would move to a different record the moment you bought one. Save side: **zero new top-level fields.** The score is a pure function of the collection (`Σ was − pricePaid` over today's `sale:1` entries); only `was` and `sale` are added, both optional, both on the entry, both validated exact-and-loud. Old saves load untouched.
+
+---
+
+## 7. THE GATES (Lane F)
+
+1. **Non-vacuity.** `?sale=all` marks every eligible shop at rate 1.0, so `smoke_nopump`'s shop picker (`flags_check.py:2537-2559`) is *guaranteed* on the roster. Re-run the 5 real UI round trips; assert `all(d <= -1)`; **FAIL** — not skip — if fewer than 3 of 5 bought offers carried `was`.
+2. **Band floor.** Over ≥5 bins: every offer with `was` has `price ≥ bandRange(band)[0]` and `price < was`.
+3. **Provenance.** Buy marked → `listFind === false`. Positive control: buy unmarked in the same shop → `listFind === true`.
+4. **Negative control.** `?sale=0` / `?classic=1` / `?game=0` → zero `[id^=pc-sale]` DOM, zero `was` anywhere, and the offer tuples byte-identical to a pre-sale boot. **Mint that offer-price golden this round — it does not exist today** (`flags_check.py` pins plan fingerprints only).
+5. **Identity-keyed tickets.** Buy one marked slot, re-open the bin, assert the surviving marked set is unchanged (the R27 zero-collateral law, applied to the ticket).
+6. **Calendar determinism.** Same (seed, town, day) ⇒ identical roster and identical marked set across two boots.
+7. **(full version)** `PROCITY.sale.debug.crates(n)` — every existing tool pins midday (`dbg.js:325` + 20 call sites), so the crate clock needs an explicit hook or its gate is vacuous by construction.
+
+---
+
+## 8. CUT LIST
+
+| cut | why | verified at |
+|---|---|---|
+| **The 120-second stopwatch** | `dt` is clamped to 0.05 s — a 10 fps machine gets a **2× longer round** and `best` is framerate-denominated; `procity:segment` can't tell a real transition from a bracket press; DBG pauses the clock in every gate we own; and the strip would be invisible for the whole dig | `index.html:575`, `lighting.js:109-113`, `dbg.js:325`, `hud.js:283-285` |
+| **Op shops, pawn, book, toy from the pool** | no bins, at all | `fittings.js:60,75` vs `theme.js:56-63,134-141` |
+| **"Drop the band" as the anti-farm fence** | 12% of sold listings profit via the war multiplier; prints a legible inversion in the paper; blanks the sell card's guide line | `save.js:36-43`, `sell.js:104` |
+| **The Wordle bell, share string, `?run=today`** | needs `createGame({startDay})`, which doesn't exist (`let day = 1`, single writer `adopt()`); the board is a query string, so the leaderboard is decorative | `save.js:110-113,167` |
+| **`🎟 N marked` bin hover** | forces exporting `proceduralSleeves` or mirroring it (~1,100 PRNG draws per room enter), and points the player *away* from the gems | `dig.js:36` |
+| **The sandwich-board InstancedMesh** | +1 draw is affordable; the `frontEdge`/`ry` orientation math, texture, chunk refresh and gate arm are not, when the docket already names the shops | reserve for v9 |
+| **The 23-town calendar strip** | would advertise sale days in the 3 towns with nothing to dig | measured §4(b) |
+| **Dollar-threshold ranks ("$200 = LEGEND OF THE TIP"), `best`** | measure wealth, not play — start cash is `60 + (r()*140\|0)` and grows unbounded | `wallet.js:10` |
+| **`goesAt ∈ {2,3,4,5}` thinning** | 50–75% of that distribution falls in segments the shop is never open in — it resolves to a constant. Replaced by one bit keyed to the shop's *own* hours: **arrive in a shop's last open segment and half the red tickets are gone** | `registry.js:40,128` × `lighting.js:22` |
+
+---
+
+## 9. EFFORT, AND THE MINIMUM SHIPPABLE THING
+
+**MINIMUM — one round. This is playable this week.**
+The sale exists and nothing is scored: `?sale` flag, seeded calendar, roster, band-floor tickets, red sticker + SALE chip, `was`/`sale:1` on the entry, the `listFind` refusal, the paper line on the wake toast. Gate arms 1–6.
+Cost: one Lane C afternoon (`dig.js` ~8 lines), one Lane F round (`sale.js` ~120 lines, three `save.js` edits, two `index.html` lines), and the offer-price golden. **No lane conflicts** — nobody is currently in `dig.js:421` or `save.js:366`, and v8 wave 1 is entirely elsewhere.
+
+**FULL — two more rounds.**
++ the crate clock and the Lane B `advance()` API, + thinning at room-enter, + the docket strip and the end-of-day total, + the keeper's rumour instead of a calendar UI, + gate arm 7 and the DBG hook. The second of those two rounds is mostly QA, because the crate clock touches what *time* means and every existing tool pins midday.
+
+Ship the minimum first **as a field test**: it tells you whether a red ticket is fun before you rebuild the day around it.
+
+---
+
+## 10. WHERE IT SITS AGAINST v8
+
+**The minimum version is a genuine v8 sidebar.** One flag, zero draws, zero assets, zero fetches, DOM-only, construction-gated, no lane collisions with ambient audio, per-town character, the magpie or backyard props. It is content wearing a very thin system, which is exactly what v8 is.
+
+**The crate clock is not a v8 sidebar — it is the head of v9.** Making a crate cost time is the first time in this game's history that dwelling costs anything, and it is the direct, literal answer to *"the clock is scenery."* That deserves an epoch, its own gates and its own retro, not a wave slot.
+
+**One flagged follow-up, not this round:** give the op shop a record crate. It is one line in `theme.js:56-63` and it would take the diggable pool from 0–12 per real town to something like 3–25 — which fixes the roster histogram, fixes the 3 dead towns, and delivers the actual op-shop fantasy the pitch is written in. It re-rolls every op shop interior, so it is a Lane C spike with a golden re-mint behind it. Worth costing properly in v9.
+
+---
+
+## 11. WHAT NEEDS JOHN
+
+1. **Stopwatch: in or out?** The recommendation is out — the pressure is the shutter, the purse, and the crate cost. You said "limited times". Is a *trading day* limited enough for you, or do you want a number counting down?
+2. **Does opening a crate cost time?** This is the one real design change in the document, and the one that makes hours bite. It rations *breadth*, never the riffle itself — you can take as long as you like inside a crate; you just can't open the next one for free. Yes or no.
+3. **Are red-ticket finds locked out of GodBay forever?** It is the clean fence and it is diegetic, but it is a real restriction on your auction toy.
+4. **Is the band floor sacred?** i.e. a red ticket can never be a gem. This buys the no-pump law and the gem signal with one clamp. Breaking it means red tickets and grails start looking alike.
+5. **Does the sale run in one-shop towns?** Eleven of twenty-six get a roster of one. Recommendation: yes — a one-shop round is a depth round. Three towns get no sale day at all, honestly.
+6. **Is the crate the only trophy, or do you want a score that persists?** Recommendation: crate only, no personal best, no leaderboard. The number is for the day, the record is forever.
+7. **The name.** RED TICKET DAY is the working title. Given three designs independently reached for "red ticket", it is probably right — but it is your word to pick.

docs/THE_FRONTIER.md

@@ -0,0 +1,159 @@
+# PROCITY — THE FRONTIER (what is genuinely not figured out)
+
+*Fable (m3), 2026-07-17. John's challenge, verbatim: "there is heaps more to figure out — all
+the systems are set you say?" He's right. This doc is the honest map: what 29 rounds built is
+the WORLD and the PIPELine; the GAME — the reason a stranger would play for an hour — is
+mostly unfigured. Nothing here is chartered; it's the space the next epochs get picked from.
+Sibling docs: V2_IDEAS (the old parking lot), V6_LIVING_STREET (chartered, in flight).*
+
+## What is actually solid (don't re-litigate)
+
+Procedural + real towns · enterable interiors · citizens with identity · gigs · weather/tram ·
+the dig with real/mint/parody stock · the tier ladder + offline law · the two-studio pipeline ·
+the QA culture. The platform is genuinely done-ish. Everything below stands ON it.
+
+## THE BIG ONE — it isn't a game yet
+
+You walk, you dig, you buy. Then you close the tab and it never happened. The whole loop that
+makes digging MEAN something is unbuilt:
+
+1. **Persistence.** No saves. The wallet resets, the collection vanishes, "gone this session"
+   is the only memory. (localStorage fits the seeded-everything law trivially — the world
+   regenerates from seed; only the DELTA needs saving: cash, owned items, day. This is days of
+   work, not an epoch, and it unlocks everything below.)
+2. **The collection.** You buy records and they go... nowhere. No crate at home, no album/
+   shelf UI, no "look what I found in Katoomba." The collection IS the trophy case of the
+   whole game and it does not exist.
+3. **The thrill loop.** thriftgod's `mint()` gem bands exist as DATA (price bands, gems,
+   CBD-distance curation) and drive NOTHING. No underpriced gem in a dusty crate, no "is this
+   worth more than they're asking", no sell/flip loop, no wantlist hunting across towns. The
+   entire reason op-shopping is exciting in real life is un-simulated.
+4. **Why today matters.** No day structure — no opening hours pressure (hours exist! nothing
+   makes you race them), no end-of-day, no "the gig starts at 9, the shops shut at 5, choose."
+   The clock is scenery.
+5. **The player.** No hands, no home, no inventory UI beyond a number, no character. Who are
+   you in this town?
+6. **Onboarding.** A stranger at digalot.fyi/procity gets pointer-lock and silence. The first
+   five minutes are unfigured entirely.
+
+## Chartered but unbuilt (in flight or waiting)
+
+- **v6 LIVING STREET** — spikes gated on footage; then clips-at-scale, personas, footpaths +
+  occasional cars, generated bodies.
+- **Option B** — real reservation holds (John's hold budget).
+- **Tier-2 auto-discovery** — needs a reachability contract.
+- **The editor/override layer** (V2_IDEAS, still the best long-game idea: hand-author any shop
+  interior over the procedural base).
+- **Multiplayer presence** (see who's digging the same town).
+
+## Unowned design questions (nobody has even sketched these)
+
+- **What is a session?** 20 minutes? A day-cycle? A town per sitting?
+- **The economy loop:** buy low → ??? → profit. Sell where? To whom? GodBay (thriftgod's
+  auction sim) is sitting right there as the obvious answer and no design connects them.
+- **Cross-town play:** 23 towns exist; nothing makes you travel. Regional wantlists? A gem
+  rumor system? The tram/train BETWEEN towns?
+- **The gig layer as gameplay:** you can attend a gig; you can't book one, play one, or care
+  about one. 90sDJsim overlap sits unexplored (DJ the venue?).
+- **Music identity:** procedural beds exist; a game this specific deserves a sound.
+- **The 90s-ness:** it's in the fabric (video shops, milk bars) but no system USES the era —
+  no phone-free navigation puzzles, no street-press gig guide, no mixtapes.
+
+## THE THIRD DIMENSION + TEXTURE LIFE (filed 2026-07-18 — John's Perlin question, answered from the code)
+
+**The ruling that frames this section:** world *structure* stays on the semantic hash-stream
+system (`prng.js` — `seedFor(citySeed, kind, id)`, independently-keyed streams per entity).
+That architecture is why 31 rounds of features never moved a golden: a draw added to one
+stream shifts no other. Perlin answers a different question — a *continuous* value over
+space/time — and it enters the toolbox only where the question really is continuous. When it
+does, it seeds from the same citySeed keying: deterministic, gate-able, no exceptions.
+
+Candidates, ranked by honest cost:
+
+1. **TERRAIN / ELEVATION — the headline, epoch-scale, chartered as a v8+ candidate.**
+   Everything is flat, which is *wrong for the real map*: Katoomba is a mountain town rendered
+   as a billiard table. Per the real-map DNA, the primary source is REAL elevation (SRTM /
+   contour data for each town bbox, the same discipline as the roads fetch) — noise is only
+   the infill between samples, never the shape of a real hill. **The cost is named now so
+   nobody charters it lightly:** terrain touches everything — roads follow grades, buildings
+   need foundations and steps, footpaths slope, the chunk streamer and the walkers and every
+   budget meet a Y axis, and the classic covenant needs a flat-forever fence. This is an
+   epoch with an alpha/beta/close arc of its own, not a round.
+2. **Sky / cloud domes — cheap, near-term (v6/v7 polish).** Skies are baked textures today; a
+   seeded FBM dome gives every day its own weather-shaped sky, composes with the existing
+   weather states, and is one lane's item (B, lighting). *(2026-07-23: Sebastian Lague's
+   graphics-library video §6 is effectively the implementation guide — fBm + cheap
+   Rayleigh/Mie approximation in one full-screen pass; the winmap shader proves the house
+   does this class of trick. Skip full volumetric raymarch until measured.)*
+   - **2b. THE HORIZON MATTE (filed 2026-07-23, from the same video) — the poor-man's
+     terrain.** Towns end at a flat empty horizon. A seeded fBm-raymarched HORIZON BAND — a
+     matte painting that computes itself, ~1 draw, zero geometry — puts the Blue Mountains
+     behind Katoomba and scrub ranges behind Bendigo, seeded per town (real towns could bias
+     the profile from their actual region). Buys most of the terrain epoch's FEEL years early;
+     classic-gated like everything; retires automatically if real terrain ever lands.
+   - **2c. VORONOI OUTSKIRTS (same filing).** Grid-constrained Voronoi paddocks with treeline
+     borders as the town-edge ring, so the approach to town reads as countryside instead of a
+     hard stop. A's partitioner class (plan-side, seeded, golden-aware) + B's tree instancing.
+     Pairs with 2b; both are candidates for a single "THE HORIZON" polish round.
+3. **Wear & grime — cheap, high-charm (E/C canvas painters).** Seeded value-noise for sleeve
+   ring-wear, facade sun-fade, footpath staining — per-item, deterministic, and exactly the
+   90s patina the parody sleeves deserve. Pairs with the beta's price-guide work (a worn
+   sleeve *reading* worn next to its condition grade).
+4. **Crowd ebb (LIVING STREET track, D).** A slow 1D noise curve modulating street density
+   across the day — mornings trickle, arvo swells — richer than uniform draws, one stream,
+   identity-safe.
+
+5. **THE VERNACULAR KIT (filed 2026-07-18, John's idea, source corrected) — buildings that
+   feel real.** The town's massing is same-y boxes; the fix is **15–20 parametric Aussie
+   vernacular archetypes** (Queenslander, Federation cottage, terrace row, weatherboard
+   shopfront + verandah, deco corner pub, brick milk bar, fibro shack, tin warehouse…) with
+   seeded knobs — width, storeys, verandah depth, roof pitch, parapet, tint, and the wear
+   noise from item #3 above. **Source ruling: NOT Google Maps 3D** (licence-fatal — the one
+   thing the provenance spine must never touch — and photogrammetry mush at house scale
+   anyway). Instead: (a) **OSM/Overture building footprints + heights** for the real towns —
+   ODbL, the licence and pipeline we already ship, one more fetch class under the standing
+   authorization; (b) the kit designed from Street View *reference* (looking is not
+   extracting) and built parametrically on B's existing instanced-attribute machinery, which
+   already varies tint/hours per instance. Real footprints place real shapes on real streets;
+   the kit + knobs cover everything unfootprinted. Pairs with terrain as the two halves of a
+   future "the streetscape gets real" epoch — but unlike terrain, the kit is INCREMENTAL
+   (archetype by archetype, budget-measured, classic fenced), so it could also drip in as
+   B/E polish rounds. Goldens untouched either way (plan hashes don't see meshes); budgets
+   re-measured per archetype.
+
+6. **THE CIVIC LAYER (filed 2026-07-23, John's question — "do we have fountains/statues/
+   gardens?" Answer: no, and the town feels it).** Trees exist (wind-swaying billboard gums,
+   R17) and commerce exists; civic PRIDE doesn't — no parks, gardens, fountains, statues,
+   memorials, rotundas. The real-data angle makes this a first-class citizen of the real-map
+   DNA: **OSM maps all of it** (`amenity=fountain` · `historic=memorial` · `leisure=park/
+   garden`), and the **war memorial** — the defining civic marker of exactly the AU towns we
+   build — is mapped in nearly every one. Real towns get their actual memorial/park/rotunda
+   at actual positions via the existing ODbL fetch (one more class, standing auth); synthetic
+   towns get a seeded civic kit (memorial at the main intersection, rotunda + gums in a
+   pocket park, drinking fountain by the shops); statue/rotunda meshes via the local gen
+   stack (hunyuan3d_mlx, CC0-equiv, the instrument-pipeline discipline). Cheap-to-mid (B
+   furniture patterns + E assets + one A data class), incremental like the kit, and pairs
+   with it: terrain = the ground's shape, the kit = the buildings' shape, the civic layer =
+   the town's heart. A pocket park with a memorial is also the natural HOME BASE candidate
+   for v7.x (sleep on a park bench, you battler).
+
+## SUPERSEDED IN PART — see [REVIEW_CITY_PATTERNS.md](REVIEW_CITY_PATTERNS.md) (2026-07-26)
+
+A 16-agent top-down review (5 lane cartographers · asset-capability audit · design research ·
+4 design themes × adversarial verify · synthesis) measured this shelf against the code and
+corrected several of its assumptions. **Read that review before charting anything below.**
+Headlines that change this document: the draw budget of record is **292/300 walked** (R37-pinned; 280 was the same measurement at a coarser step), not the
+~131 bookmark figure (spend TRIS, not draws) · **all 21 real towns are 100% `use:'shop'` lots
+with one district** — every residential/market/yard idea here is synthetic-town-only until the
+civic-layer fetch lands, which promotes the civic layer from "nice" to **the strategic v9** ·
+rigged quadrupeds are a **hard capability wall** (MIRPAMO is architecturally biped-only), so
+animals are static+scripted or nothing · and the highest-leverage change on the shelf is not
+content at all but **the kerb ruling** (A publishes a corridor law nobody consumes; 14 gig
+posters are standing in the road on the boot every player gets).
+
+## The honest sequencing opinion (Fable's, not a ruling)
+
+The private-test deploy is the design instrument: John walks the game cold and writes down
+every "why can't I..." — that list IS the v7 charter input. My candidate for v7 once v6's
+spikes land: **THE GAME (persistence + collection + the thrill loop + a day that matters)** —
+it's the smallest set that turns the platform into something a stranger plays twice.

docs/V4_REAL_MAP.md

@@ -50,3 +50,36 @@ re-fetch; only public POI/way data, never private-individual data.
 4. Road simplification fidelity — too coarse reads wrong, too fine costs edges; A owns the knob.
 5. Settled non-risks: facade clearance on osm towns (R17), interior types (C proved 18 real
    `shop=` values degrade cleanly), plan-side determinism (E's pipeline is byte-identical re-run).
+
+### Retired-or-carried at the v4.0 close (ROUND22 ledger #6 — Lane A, line by line)
+
+Verdicts against the **full 23-town pack** (1,210 shops), not against the 5-town sample the list was
+written for. "Retired" means a law now enforces it and the pack proved the law holds with headroom.
+
+1. **RETIRED — enforced, with headroom.** `MAX_TOWN_SPAN_M` (5 km) is validator-enforced, so a breach
+   fails loudly at load, not silently in the plan. Widest in the pack: **geelong at 3,829 m — 77% of the
+   ceiling**; no town came close to the law. Mega-strips are now a *pipeline curation* question (E's), and
+   the generator's fence is the backstop it was designed to be.
+2. **RETIRED — the floor never bound.** `MIN_TOWN_SHOPS` is 6; the thinnest town in the pack is
+   **darwin at 12 — 2× the floor**. No cache was rejected for sparsity. (Whether a 12-shop town *reads*
+   alive is a different question and a live one — it's D's thin-tail spot-check this round, not a
+   generator risk.)
+3. **RETIRED on the plan side; CARRIED for the runtime lanes.** This was the alpha's real risk and it
+   paid off exactly as intended — the irregular graphs surfaced fragmentation (R19), capacity (R20) and
+   venue stranding (R21), each fixed-or-fenced and written down. At 23-town scale A's side needed **no
+   new hardening**: 1 connected component and 3 venues on every town, all invariants green, fitzroy's 160
+   shops included. **Carried** only where it hasn't been measured yet: C's door-soak, D's fitzroy audit
+   and F's matrix are this round's verifies — the plan being green is not the same as the town rendering
+   and simulating green.
+4. **RETIRED — the knob is at a measured setting.** Junction-protected Douglas–Peucker settled it
+   (katoomba 105 → 11 components; cull/bridge → 1 component at 100% main-net, and now **1 component on
+   all 23**). The fidelity/edge-count trade has a floor that holds across the pack; it is no longer an
+   open question, and any future move re-pins goldens under the amendment law.
+5. **Unchanged** — still settled, now on 23 towns rather than 5.
+6. **NEW, CARRIED — thin-graph seating capacity.** The pack's honest tail: **6.4% of shops don't seat**
+   (77 of 1,210), all counted by cause, dominated by overflow where a town has more shops than its road
+   graph has frontage. Outliers: **daylesford 19%** (32 shops on 171 roads — the thinnest graph in the
+   pack by 2×) and **fitzroy 13%**. `RGAP` is already 0.5 m and `NODE_CLEAR` 3 m; the only lever left is
+   spilling overflow onto a *different* street, which buys a few percent by putting a shop on a road it
+   isn't on. Ruling stands from R20: **drop and count beats teleport.** Carried into v4.x as a known,
+   measured, per-cause-attributed tail — not a defect, and not hidden.

docs/V5_REAL_SHOP.md

@@ -0,0 +1,132 @@
+# PROCITY v5 — THE REAL SHOP (epoch charter)
+
+*Fable (m3, integrator), 2026-07-16. John's pick at the v4 retro. Grounded in: the Lane G
+marriage (merged, ruled, G2a atlas contract reviewed by C/E in R22), dealgod's 1.77M real items
+with photos, thriftgod's census already driving `newtown_godverse`, and the v2-era dig/wallet/
+stock machinery that has been waiting for this data since it shipped.*
+
+## The vision
+
+**v4 made the towns real; v5 makes the shops real.** Walk Fitzroy's actual street into an actual
+op shop, riffle a crate, and the records in it are that shop's real stock — real covers, real
+titles, real prices. Buy one and it's gone, because it was one-of-a-kind in the real world.
+Thriftgod is the brain and the bank; PROCITY is the body.
+
+## The tier ladder (the epoch's load-bearing idea)
+
+Stock is a DATA TIER, like assets — each tier fully playable, each degrading softly to the one
+below. This is the offline law made structural:
+
+| tier | source | flag state | deterministic? |
+|---|---|---|---|
+| 0 · parody | seeded canvas sleeves (v1) | any boot, always works | yes — the QA baseline |
+| 1 · static real | per-shop atlases baked from dealgod (G2a) | `?stock=real`, no server | yes — atlases are files |
+| 2 · live GODVERSE | thriftgod server: live stock, sold-means-gone (G3) | server reachable | **no — by design** |
+
+The seeded-everything law is NOT weakened: the *world* (geometry, layout, venues, citizens)
+stays seeded and byte-identical; stock *contents* are inventory data riding the asset law.
+QA gates run on tiers 0–1; tier 2 gets its own smoke class (reachability, fail-soft, latency)
+that never gates a tag on server state.
+
+## The stages
+
+- **v5.0-alpha: THE FIRST REAL CRATE.** One real shop end-to-end — a Newtown record shop in
+  `newtown_godverse`, static atlas (G2a), riffle real covers, buy, wallet debits, every tier
+  degrades clean. Plus the **G3 design doc ratified** (both integrators + John) before any
+  server code exists.
+- **v5.0-beta: THE REAL SHOPPING TOWN.** Every hero shop in 1–2 godverse towns carries real
+  static stock; godverse coverage grows where thriftgod's census is dense (fitzroy is the
+  prize); pricing from thriftgod's `mint()` profiles baked into the atlases; the dig UX polished
+  for real items (title/price cards are real data).
+- **v5.0: THE LIVE TIER.** Thriftgod's server behind tier 2 per the ratified G3 design:
+  live per-shop stock, sold-means-gone, reservation semantics — with the offline law proven by
+  the gate (kill the server mid-session; the game degrades to tier 1 without a stutter). Tour,
+  docs freeze, tag.
+
+## The laws
+
+Everything inherited (classic covenant `0x3fa36874` forever · determinism for the world ·
+budgets · amendment law · measurement-over-brief · drops counted · fresh-context verification),
+plus this epoch's own:
+
+1. **The offline law (non-negotiable, from the standing G3 ruling): the server enriches, never
+   gates.** Full offline play at tier 0 and tier 1, always. No boot path, gate, or tag may
+   depend on a reachable server.
+2. **The determinism boundary:** world = seeded, frozen, gated. Stock = data tiers. Tier 2 is
+   openly non-deterministic and therefore never inside a golden or a byte-identical assert.
+3. **The licence law (extends E's provenance spine):** item photos are the stores' own product
+   shots — 🟢 for in-house play; **flagged before any public/commercial release** (G's own
+   note, now law). No private-individual data, ever. Every atlas carries provenance.
+4. **The write-back law:** game purchases NEVER mutate real thriftgod inventory without an
+   explicit, John-ratified reservation design in the G3 doc. Until then tier 2 is read-live,
+   sell-sandboxed. (Whether "sold in game" can mark real stock is John's call to make in the
+   design review, not a default.)
+5. **The two-studio law:** G owns `pipeline/godverse_*`, `web/assets/stock_godverse/**`,
+   godverse caches, and the server side; A–F own their lanes; cross-repo contracts publish
+   FIRST; both integrators sign the G3 design. **Merge amendment:** when a round's brief names
+   a G deliverable as gating, G's branch merges mid-round after Fable-m3 review (G's file
+   namespace is disjoint, so pathspec safety holds); otherwise boundaries as before.
+
+## The risk list (kept current, v4-style)
+
+1. **Latency/stutter at tier 2** — server calls must be async enrichment; the dig must never
+   block on the network. The G3 doc owns the caching design.
+2. **Atlas budgets at real density** — a mecca hero shop can hold hundreds of real items; C's
+   interior ceilings are the law and the atlas contract must respect them (pagination/crate
+   rotation rather than bigger atlases).
+3. **Census↔OSM identity** — matching thriftgod shops to godverse lots is fuzzy (names drift,
+   shops move). Mismatches must be counted and fail-soft to tier 0, never mis-stocked.
+4. **Sold-means-gone semantics** — race conditions, reservations, and the write-back question.
+   All design-doc territory; nothing ships before ratification.
+5. **Settled non-risks:** the dig/wallet/stockAdapter machinery (shipped v2, soaked 16 rounds);
+   static-atlas determinism (E's byte-identical pipeline discipline); the fail-soft ladder
+   (proven pattern from `?noassets` day one).
+
+### Retired-or-carried at the v5.0 close (ROUND27 ledger #6 — Lane A, line by line)
+
+Verdicts against what shipped, not against the plan. Written in **wave 2**, so tier-2 items that F's reader
+and kill-the-server gate will decide are **carried, not pre-retired** — the gate retires them, not this doc.
+
+1. **CARRIED — and it is this round's defining gate, not a footnote.** The only risk here the epoch has not
+   yet measured. The reader (#2) and the kill-the-server gate (#3) don't exist as I write this; **nothing
+   retires this line except that gate going green** — boot server-up (live fields consumed), kill mid-session
+   (degrade to tier 1, zero console errors, frame-time measured across the failure), boot server-down (pure
+   tier 1). Until then the charter's offline law is a promise, and the whole point of #3 is that a promise
+   isn't a gate. *(If tier 2 proves bigger than one round, F holds and this line simply carries — four holds
+   have proven nobody forces an epoch close.)*
+2. **RETIRED — the remedy the risk named is the remedy that shipped.** It predicted "pagination/crate
+   rotation rather than bigger atlases", and that is exactly what happened: the mecca case is served by the
+   **crate-rotation menu**, not by growing the sheet. Measured across all **15 keyed atlases**: max **2
+   atlases/shop** against C's hard cap of 2; the 14 mint shops sit at **16 items / 1 atlas / 1024²** and only
+   the one real POS shop earns 2048² (**120 items, 2 atlases, 1.2 MB**) under C §7.2's 60+ item rule. E's
+   validator enforces the ceilings from the committed files alone. Total: 344 items.
+3. **RETIRED — the risk was designed out, not solved.** It assumed a **fuzzy-matching** problem ("names
+   drift, shops move") and demanded mismatches be counted. There is no matcher: identity is an **explicit
+   opaque key** (`godverseShopId`) that G emits, so there is nothing to mis-match. The predicted failure
+   couldn't occur in the predicted form — and the case that would have broken any name-matcher proves it:
+   **Monster Robot Party is in neither the census nor OSM**, so no matching strategy could ever have found
+   it; it is keyed by injection. Mis-stocking is fenced structurally instead: duplicate ids **error**,
+   uniqueness runs over defined ids, and the **orphaned-atlas gate** fails if a stocked shop isn't seated.
+4. **SPLIT — the write half RETIRED by ruling, the read half CARRIED to F's #4.** *Write-back:* retired, and
+   retired properly — John's **A-then-B** ruling is recorded as **mechanism, not config**: `/reserve` and
+   `/buy` are **ABSENT, not stubbed**. Race conditions and reservation semantics cannot occur because the
+   verbs do not exist; "prove the absence" is a stronger guarantee than any sandbox flag, since a sandbox a
+   config typo can flip isn't a sandbox. *(Option B's reservation upgrade is chartered as v5.x, behind a
+   hold budget — it re-opens this line deliberately, when it is built.)* *Read (`gone`, real→game):* carried
+   — F's #4 asserts both directions this round.
+5. **Unchanged, and extended by what the epoch settled:** static-atlas determinism proved in practice
+   (byte-identical re-bakes, including G's index-only sku re-emit that moved no `.webp` bytes); the
+   fail-soft ladder proved on every rung; and the **id-space fences** (`sku_`/`mint_`, plan-id vs
+   godverse-id) now have case law behind them rather than good intentions.
+6. **NEW, CARRIED — the orphaned atlas.** The lift legitimately drops shops (overlap-resolve, counted since
+   R19); dropping one that carries a **committed atlas** means real stock keyed to a shop that isn't in the
+   town. Gated in `selfcheck` since R25 and **currently green** — and the gate armed itself this round
+   without anyone touching it: it SKIPped on `newtown_godverse` while no atlas keyed there, and **began
+   binding the moment G's mint atlases landed**. Live near-miss on the books: `redhill_godverse`'s lift drops
+   keyed shop **2286 "Empire Revival"**; G stocked its numeric neighbour **2287** instead. Carried because
+   the hazard grows with every shop stocked — **stocking 2286 would orphan it today.**
+7. **NEW, CARRIED — "real" is one shop wide.** 14 of 15 keyed atlases are **mint**; exactly one is a POS
+   snapshot, because exactly one shop has a POS. That is honest and marked (`sourcing`), not a defect — but
+   the epoch's headline claim rests on **one** shop, and any future claim of scale needs either more POS
+   shops (v5.x: "if monsterrobot ever gets siblings") or continued care that `sourcing` stays legible to
+   humans, not just gates.

docs/V6_LIVING_STREET.md

@@ -0,0 +1,98 @@
+# PROCITY v6 — THE LIVING STREET (epoch charter — DRAFT for John)
+
+*Fable (m3), 2026-07-17. John's idea, from a browser walk down the strip: the crowd is
+believable but narrow — one walk, one idle, one sit, everyone jaywalks, nobody owns the street.
+Status: DRAFT — v5.0 (THE LIVE CRATE) is still closing; this charters the v6 conversation the
+retro was already going to open. Applies to PROCITY first and 90sDJsim by depot (the Lane-G
+two-studio pattern, proven).*
+
+## The vision
+
+The street stops being 24 clones who walk anywhere and becomes a town of *people*: personas
+with their own gaits, errands and manners; footpaths used like footpaths; the odd car easing
+down the main street; a busker outside the record shop doing a move John actually performed in
+his actual shop. **Every asset generated, rigged, animated and shipped on our own machines —
+zero cloud, zero subscriptions, everything owned.**
+
+## The stack (measured today, not aspirational)
+
+| piece | state | what it gives us |
+|---|---|---|
+| **mixamo-fetch** (tailnet source box) | **34 clips cached, only 3 wired** (walk/idle/sit) | the free stash, already in hand — lean, look-around, phone, talk, carry… |
+| **MOCAPGOD** (ultra) | Lanes 0/A/B **DONE**: phone video → HSMR/SKEL → BVH, MPS-verified, ~1.6× realtime, mixamorig name-map shipped | film John → skeleton motion. Lanes C (retarget) + D (clip factory) remain |
+| **MIRPAMO** (both Macs) | repo live: **a local offline Mixamo** — autorig (landmark → mixamorig fit → bone-heat weights) + retarget → `character@clip.glb` | new rigged BODIES from any mesh + clip retargeting, no Adobe |
+| **MODELBEAST** (m3ultra :8777) | flux_local (Apache, free) · **hunyuan3d_mlx local** · trellis_mac · sf3d · mflux_image_edit · seedvr2 | concept art → 3D meshes → texture/outfit variants, $0 |
+| **3GOD depot** | live, no-Draco law, two-studio consumption proven (Lane G) | one publish, every game (PROCITY · 90sDJsim · festifun) consumes |
+| **PROCITY runtime** | ped fleet (19 rigged, `_canon` mixamorig), sit.glb clip pattern proven (R16), persona hooks half-exist (loiter/dance/bench/patronage) | the body the assets walk into |
+| **A's street exports** | `roadWidth/vergeBand/poleOffset` per edge — **shipped R15, barely consumed** | the footpath law is one D constraint away, not a new system |
+
+**MOCAPGOD Lane C and MIRPAMO's retarget are the same machinery** — an integration decision
+for Fable-ultra before either builds it twice.
+
+## THE SPIKES (do these FIRST — cheap, each kills the biggest unknown in one thread)
+
+The pipeline test John asked for, as three end-to-end spikes. No epoch work until these run.
+
+1. **SPIKE 1 — the free stash (motion, zero generation).** ~~Wire 2 of the 34 cached clips
+   (`lean`, `look-around`)~~ **AMENDED R28: `lean` does not exist in the stash** — E measured
+   the 34 instead of trusting the wishlist (the brief's premise was half wrong). `look.glb` is
+   shipped + depot-verified (R28); D's wiring closes in R29 wave 0. The lean moves to Spike
+   2's shot list — John films a wall-lean. *Proves:* the clip bank expands cheaply, and
+   wishlists are not inventories. Risk: ~zero (confirmed).
+2. **SPIKE 2 — the full mocap loop (the one that matters).** John films ONE move on a phone —
+   **the crate-riffle, at Monster Robot** (the exact clip D's notes flagged "bespoke, won't be
+   on Mixamo" two epochs ago) → MOCAPGOD ingest → BVH → retarget (MOCAPGOD-C or MIRPAMO —
+   the integration call) → clip GLB → depot → **a ped riffles a crate on Musgrave Road,
+   in-game**. *Proves:* film-yourself-to-NPC works end to end. Needs: MOCAPGOD Lane C/D
+   sessions on ultra + John's test vids in the queue (it's empty — that's the ask).
+3. **SPIKE 3 — a generated body (the stretch).** flux_local concept ("older shopper with
+   trolley, 90s AU high street") → hunyuan3d_mlx mesh → **MIRPAMO autorig** → walk retarget →
+   in-game past the no-giants gate. *Proves (or honestly fails):* autorig quality on generated
+   meshes — the least-proven link, which is exactly why it's a spike and not a plan line.
+
+## The epoch tracks (after v5.0 tags + the retro + the spikes report)
+
+1. **CLIPS** — wire the 34; fetch more free categories; the MOCAPGOD bespoke set (riffle,
+   till-operation, busker strum, lean-on-wall, trolley-push, phone-check). Licence rail: the
+   HSMR/SKEL NC-risk (MOCAPGOD Decision 1) means mocap-derived clips stay **in-house** until
+   reviewed — same discipline as the item photos, same flag line.
+2. **PERSONAS (D)** — a seeded archetype layer per citizen: {body variant, clip set, speed
+   band, loiter/dance/bench biases, errand routes (pick a shop, walk there, dwell, move on —
+   patronage formalized into visible purpose)}. The persona is DATA riding the existing sim;
+   determinism per citizen id; identity signatures unchanged.
+3. **STREET DISCIPLINE (D + B + A)** — the footpath law: peds walk the `vergeBand`, cross at
+   nodes (zebra-preferred on real roads — B's crossings already render); **occasional cars**:
+   seeded parked cars (instanced, furniture pattern) + 1–3 movers on the mains (the tram
+   pattern: deterministic path-followers, ~2 draws each, stated budgets). v0 non-interacting:
+   cars don't yield, peds don't jaywalk — both true by construction because each stays in its
+   band.
+4. **BODIES (E + MIRPAMO)** — outfit/texture variety on the existing fleet first (
+   mflux_image_edit reskins — free variety, zero rig risk), MIRPAMO-autorigged newcomers
+   second, per Spike 3's verdict.
+
+## Laws (inherited + this epoch's)
+
+Everything behind **`?streetlife=1`** (cars possibly split as `?traffic=1` — F's call at
+wiring), default-OFF until soaked, `?classic=1` byte-identical as ever · budgets stated per
+system (cars and new rigs are draw/tri line items) · determinism from citySeed + citizen id ·
+asset law (every new clip/body rides the manifest + depot + `?noassets` fail-soft) · licence
+law (LICENSES.md per clip source: Mixamo royalty-free / MOCAPGOD in-house-NC-flagged /
+generated CC0-equiv) · vacuous-gate law (a persona gate proves a persona DID something, not
+that one exists) · measurement over brief.
+
+## Sequencing (the honest order)
+
+1. **Now:** v5.0 closes per ROUND27 — nothing here touches it.
+2. **In parallel, zero collision (different repos):** MOCAPGOD Lanes C/D run on ultra ·
+   John drops 2–3 test vids in the MOCAPGOD queue · a MIRPAMO autorig smoke on one
+   hunyuan3d_mlx mesh.
+3. **After the v5 retro:** the spikes run as v6 wave 1; this charter ratifies (or amends)
+   on their results; the tracks become rounds.
+
+## John — the asks that unblock the spikes
+
+1. **Film the test vids** (Spike 2 blocks on an empty MOCAPGOD queue): the capture protocol
+   is `docs/CAPTURE.md` in MOCAPGOD — the crate-riffle plus any two more moves you fancy.
+2. **The MOCAPGOD C-vs-MIRPAMO integration call** is Fable-ultra's to make — nudge that
+   session when you're next on the M1.
+3. Nothing else — the free stash (Spike 1) needs no new material at all.

docs/V7_THE_GAME.md

@@ -0,0 +1,141 @@
+# PROCITY v7 — THE GAME (epoch charter — **RATIFIED by John, 2026-07-17**)
+
+*(Ratified as drafted; the fantasy stands. R30 opens the epoch — v7.0-alpha wave 1.)*
+
+*Fable (m3), 2026-07-17. From THE_FRONTIER's headline gap: the world is built, the game isn't.
+v7 is the smallest set of systems that makes a stranger play twice. Design principle: every
+system below rides machinery that ALREADY EXISTS — nothing here invents a new world layer.*
+
+## The fantasy, one line
+
+**You're a crate-digger in 90s Australia: build the collection, learn the prices, work the
+towns — and be home in time for the gig.**
+
+## The loop
+
+Wake (save point) → plan the day (shops shut per their real hours; the gig starts at night —
+the clock finally matters) → dig shops, spot the gems (priced below the guide), spend scarce
+cash → sell the flips (keeper today; the auction tomorrow) → sleep = save, the day advances,
+stock rotates → the collection grows → the wantlist points at another town → travel costs a
+day. Repeat, richer and one gem wiser.
+
+## The systems (each with its existing foundation)
+
+1. **PERSISTENCE — the foundation stone.** Save = THE DELTA ONLY: cash, owned items, town, day
+   number, wantlist, stats. The world is never saved — it regenerates from seed (the
+   seeded-everything law finally pays its biggest dividend: saves are tiny and can't corrupt
+   the world). localStorage, schema-versioned, JSON export/import for moving machines.
+   *Foundation: item identity is already stable — parody items are seeded, real/mint carry
+   skus (the R25/R26 sku fences were built for exactly this, before we knew it).*
+2. **THE COLLECTION.** Your crate, as a UI: cover, title, artist, price paid, where and what
+   day you found it. The trophy case of the whole game. (A walkable home-room shelf is v7.x —
+   UI first.) *Foundation: the atlas indexes already carry every field the card needs.*
+3. **THE GUIDE + THE GEM (the thrill loop).** An in-game price guide — thriftgod's BIBLE
+   concept — gives a VALUE BAND per item (imperfect, like the real 90s guide books). Shops
+   price with seeded variance around it → a **gem** is an item priced under its band. Skill =
+   spotting them. *Foundation: mint() gem/price bands exist as data and drive nothing; real
+   items have real dealgod prices; the dig card already shows asking price.*
+4. **SELLING — where cash comes back.** v7.0-alpha: sell to a keeper at the counter (below
+   guide, always — the no-money-pump law). v7.0: **GodBay** — list an item, a SEEDED offline
+   auction resolves NEXT DAY (the come-back-tomorrow hook; thriftgod's auction brain, G's
+   lane, offline tier first per the proven tier-ladder pattern — a live tier is v7.x and
+   rides the G3 rails).
+5. **THE DAY.** Sleep advances the day; **stock rotates per (shop, day)** — seeded, so day 3
+   in Bendigo is the same for every player on that seed (parody/mint rotate; the real shop's
+   real stock stays real); gigs already run a 7-night week — `day % 7` plugs straight in;
+   hours already exist — now closing time costs you something. *Foundation: the segment spine,
+   `isOpen`, and `plan.gigs` are all sitting there waiting.*
+6. **THE WANTLIST + TRAVEL.** Mark items/artists you're hunting; seeded rumors surface hints
+   ("saw one in Castlemaine" — a keeper line, a gig-crowd mutter: D's citizens finally gossip
+   for a reason); **travel costs a day** → 23 towns become a strategy map instead of a
+   dropdown. *Foundation: the selector, the pack, the personas.*
+7. **THE FIRST FIVE MINUTES.** You arrive with $50 and a want. Three toast-beats: dig, buy,
+   sell. A real splash. *(Smallest system, biggest stranger-facing payoff.)*
+
+## The stages
+
+- **v7.0-alpha — THE SAVE AND THE CRATE:** persistence + collection UI + sell-to-keeper +
+  sleep/day cycle + stock rotation. ONE town plays as a complete (small) game.
+- **v7.0-beta — THE THRILL:** the guide bands + gem variance + wantlist + rumors + travel
+  costs a day. The 23 towns become the map.
+- **v7.0 — THE AUCTION:** GodBay offline tier, onboarding, the tour ("day one to first gem"
+  as the money shot), docs freeze, tag.
+
+## The laws (new ones this epoch earns)
+
+1. **The delta law:** a save NEVER contains world state — only player deltas. A corrupted
+   save can cost you your stuff, never the town.
+2. **The no-pump law:** every sell price < the buy-side guide band, structurally. The economy
+   gets a GATE (an agent plays N seeded days and asserts net-worth growth is bounded by finds,
+   not arbitrage loops).
+3. **Game money is game money:** the write-back law extends — no bridge to real money, ever,
+   in either direction.
+4. **Classic stays pure:** `?classic=1` boots the v2 town with NO game layer (no save, no
+   HUD additions) — the covenant is untouched. The game layer defaults ON for normal boots
+   (the v3.1 flip precedent) with `?game=0` as the opt-out.
+5. **Rotation is seeded:** stock rotation draws from (citySeed, shopId, day) — deterministic,
+   gate-checkable, same for everyone on a seed.
+
+## Lane map (first cut)
+
+**F** the save core + gates (delta law, no-pump gate, save/load determinism) · **B** the UI
+surfaces (collection, wantlist, day clock, splash — hud.js territory) · **C** the counter
+sell interaction + dig-card guide hints (+ the home room, v7.x) · **A** the day/rotation
+seeding contracts (new sub-streams, goldens untouched — rotation rides runtime, not plan
+gen... A verifies that boundary) · **E** guide-band data baked into packs/atlases (mint
+bands, real prices) · **D** rumor lines through keepers/citizens · **G** GodBay (the auction
+brain, offline seeded tier) + real guide prices from dealgod.
+
+## Risks (named now, v4-style)
+
+1. **Economy balance** — pumps, dumps, degenerate flips. The no-pump gate is the fence; a
+   playtest-bot (an agent that greedily arbitrages for N days) is the adversarial verifier.
+2. **Save schema drift** — versioned from day one, migration-or-reject, never silent.
+3. **Item identity across re-emits** — a re-baked atlas must not orphan owned items (the sku
+   IS the identity; E's validator grows an owned-item stability check).
+4. **Scope gravity** — the game wants everything (housing! romance! a phone!). The stage
+   gates are the fence: alpha ships ONE town playing well before beta touches 23.
+5. **v6 collision — none by design:** v7-alpha is systems/UI (F/B/C-heavy); v6's spikes are
+   clips/ultra (E/D/G-heavy). They interleave; Fable sequences the rounds.
+
+## Sequencing
+
+v7.0-alpha can start **now** — it's unblocked (v6 waits on footage; the two don't collide).
+Recommended: R30 = v7.0-alpha wave 1 (F save core + B collection UI + C sell counter contracts
+first). John ratifies this charter (or amends the fantasy — it's your shop, your era, your
+game) and says go.
+
+## Risk verdicts at the close (R36, v7.0 — written by F per the single-lane-close ruling)
+
+1. **Economy balance — RETIRED (structurally fenced).** The no-pump gate is STRICT since R30
+   (5 real UI round trips all strictly negative + C's broke-player negative control); R32 moved
+   the fence from the receipt to the band (`credited == min(bandLow−1, ⌊bandLow/2⌋)`, the exact
+   formula, not an inequality); R34's GodBay holds EV ≈ 0.8×mid under the ONE-HAMMER law (item-
+   identity-seeded — a passed-in item re-lists to the same result forever, so there is no retry
+   farm), bounded above at 2×high×0.88. Both hand playtests confirmed the shape — Fable's wave-0
+   line: the game charged $12 tuition for ignoring its own advice. *Honest residue:* the named
+   adversarial verifier (a greedy N-day arbitrage bot) was never built as an agent — the
+   structural gates + two hand playtests stood in for it. It goes live again with G's live tier
+   (v7.x), where structure alone won't be enough.
+2. **Save schema drift — RETIRED.** `procity-save/1` versioned from day one; corrupted/foreign
+   blobs loud-reject + stash raw + boot fresh (gated since R30). The schema widened three times
+   in-epoch (`pulls` R32 · `wants` R33 · `listings` R34), every field optional,
+   validated-exact-and-loud when present, absent-compatible — zero migrations, zero silent
+   rejections, alpha saves still load at the close.
+3. **Item identity across re-emits — CARRIED (narrowed, never fired).** The sku IS the identity
+   (the R25/R26 fences); real-sourced pulls/listings key by `sku:<id>`, parody by seeded slot
+   identity. No atlas was re-emitted during v7, so the risk never had a chance to fire — and
+   E's validator still lacks the chartered owned-item stability check. Carried to whichever
+   round next re-bakes an atlas: that round must add the check BEFORE the re-emit.
+4. **Scope gravity — RETIRED (the stage gates held).** Alpha shipped one town playing complete
+   (R30–31), beta opened the 23 (R32–33), v7.0 closed with the auction + onboarding (R34–35).
+   Every mid-epoch want was FILED, not built: the §31.6 beta queue, then the v7.x queue
+   (⚖ discoverability · LIST confirm · the paper as artifact · keeper-rumor by hand · walkable
+   home room). No housing, no romance, no phone.
+5. **v6 collision — RETIRED (none, by design).** The epochs interleaved without a merge
+   conflict or a contract collision. The one contact was the July-20 2 a.m. commits
+   (`046668e`/`b339402`: 4 Rokoko dance clips + 5 trellis DJ bodies, v6-flavoured assets landing
+   mid-v7 outside the round system) — swept into provenance/licence/depot by E (R36 w1) and
+   gated by F (R36 w2: figure-scale spawn proof, runtime bind census, classic zero-fetch for the
+   clips). One hold from that sweep rides the R36 record: the DJ bodies joined `?classic`'s
+   roster ungated — Fable to bless or bounce.

docs/V8_SOMEONE_LIVES_HERE.md

@@ -0,0 +1,192 @@
+# PROCITY v8 — SOMEONE LIVES HERE (epoch charter — DRAFT, John's rulings recorded)
+
+*Fable (m3), 2026-07-26. Built on [REVIEW_CITY_PATTERNS.md](REVIEW_CITY_PATTERNS.md) — a
+16-agent top-down audit (5 lane cartographers · asset-capability probe · design research ·
+4 design themes × adversarial verify · synthesis). That review is the evidence; this is the
+plan. Read it first — it corrects three numbers this project had been repeating for epochs.*
+
+## The vision
+
+**v7 made the town a game. v8 makes it a place someone lives.** Not more systems — more
+*inhabitation*: the sound of a life happening off-screen, twenty-three towns that finally look
+like different towns, a magpie that won't let you walk past it in September, a back yard with
+washing on the Hills Hoist, and a bloke actually standing at the pie cart that has been
+sitting unmanned on the street for five epochs.
+
+## JOHN'S RULINGS (2026-07-26, recorded verbatim in effect)
+
+### RULING 1 — THE KERB: **FOOTPATH.** ✅
+*"footpath for sure."*
+
+The 9 m band between kerb and shopfront is **footpath**, not road. Lane A's published corridor
+law (`roadWidth` / `vergeBand` / `poleOffset`, `registry.js`) is hereby the single source of
+truth, and Lane B's ground adopts it: extend the **existing merged `footGeos` class** inward
+from `e.width/2` to `roadWidth(e)/2`. **+0 draws** (same merged mesh), ~2k tris, fill-rate
+improves because 18 m of every main street stops being painted as road.
+
+Consequences, binding:
+- The 14 gig posters currently standing in the road land where A already thinks they are.
+- `registry.js`'s own comment calls that band "verandah'd footpath" and `buildings.js` already
+  builds an awning over it on every shop lot — so this ruling makes the geometry agree with the
+  code's own documentation. **Grass verges survive on residential edges only**, where they are
+  period-correct.
+- Special cases that must be handled or the ruling breaks: `arcade` (`roadWidth` 0 → zero-area
+  road quad + coincident kerbs) and `lane` (`vergeBand` = [2,2]).
+- **The gate ships with a falsifiability control**: run the poster-clearance leg against
+  `?verge=0` and assert it **FAILS there** — the pre-change failure is already known and
+  counted at exactly 14. Keep `?verge=0` permanently as a gate flag; it costs nothing and it is
+  the best gate design in the review packet.
+
+### RULING 2 — REAL TOWNS GET THE CONTENT: **FUND THE CIVIC FETCH.** ✅
+*"real towns where possible spread it out."*
+
+The review's biggest strategic finding: **all 21 real towns are 100% `use:'shop'` lots with a
+single district (`mainstreet`)** — no houses, no yards, no stalls, no market block. Every
+residential/market/vendor idea was therefore synthetic-town-only. John has ruled that the
+content goes to the **real** towns wherever possible, which means the fix is funded and moves
+**into v8** rather than waiting for v9:
+
+- **Lane A + Lane E: the third fetch class.** `build_towns.py` currently asks Overpass for
+  shops and roads. It gains a bounded third class — `landuse=residential`, `building=house`,
+  `leisure=park/pitch`, `amenity=marketplace/memorial/fuel/school/bus_stop/telephone/post_box`
+  — and `plan_osm.js` emits **more than one district** and **more than one lot `use`**.
+- **The data is already half here**: the caches in-repo already contain, unused, 30,959
+  footway ways · 12,351 service ways · 6,421 crossings · 2,714 sidewalk tags · 13,199 oneway
+  tags. Some of the districting can be derived without any new fetch at all — A measures which
+  before E re-fetches.
+- **Hazard, named now**: `build_towns.py` rewrites the *whole* cache and its own docstring
+  records the Newcastle incident (shops refetched, old roads silently reused). **46 pinned
+  goldens ride on byte-identity nobody has proven.** The re-fetch is therefore its own
+  carefully-gated round with per-town before/after diffs — not a step folded into a content
+  round.
+- Standing Overpass authorisation applies (one bounded query per town, 4 s courtesy, ODbL
+  attribution into every cache and `SOURCES.md`).
+
+### RULING 3 — ANIMALS: **answered by spike. Generate, don't download.** ✅
+*"idk about rigged animal models... they have different rigging too right? diff skeleton?"*
+
+Full answer + intake checklist + vetted sources: **[ANIMALS_ANSWER.md](ANIMALS_ANSWER.md)**
+(5-agent spike: foreign-skeleton loader proof · CC0 source vetting · tiering · adversarial
+review · Fable's adjudication header, which corrects one over-claimed verdict).
+
+**John's instinct was right and it stops mattering.** There is no `mixamorig` for quadrupeds;
+every animal ships a bespoke skeleton. But retargeting only exists because our 24 human bodies
+share 8 clips — an animal carrying *its own* baked clips needs none of it. **Proven, not
+argued:** a 10-bone quadruped GLB (`leg_fl`, `tail_01`, Blender-style clip names) was authored
+byte-by-byte, loaded through **our own vendored three.js and our own `loaders.js`**, and played
+its own clips through a bare `AnimationMixer` — 27 assertions green, including *pixels changing
+on a real `WebGLRenderer`* (1,804 lit px, 704–1,015 changed between frames) and
+`SkeletonUtils.clone` sharing geometry+material across N animals. Also proven in the mirror:
+fed to the human stack, `buildFigure` would measure that dog's "feet-to-crown" at 0.36 m and
+**scale it 4.9×** — silently. Hence the law: **animals get a sibling module
+`web/js/citizens/animal_rig.js` importing nothing from `rigs.js`.** ~40 lines. The
+classic-covenanted human fleet is never touched.
+
+**The ruling is economic, not technical.** Measured on a real renderer: **1.00 draw per skinned
+animal, 1:1, to N=80** — three.js cannot instance animated skinned meshes and our impostor bake
+crops long low animals. Against that, **sixty birds on a wire cost ONE draw between them**
+(one InstancedMesh, one 4-tri billboard, one 1024 WebP species atlas — every future bird
+species then free). That asymmetry is the whole design:
+
+- **Tier 0− — the heard animal. +0 draws, +0 tris. SHIPS.** A dog behind a paling fence, a
+  cockatoo at dusk, at a *seeded anchor* so it is the same dog on the same street every time.
+  ~30 lines of numpy each in `gen_audio.py`. Highest charm-per-minute in the epoch; a town with
+  zero visible animals reads as a town with animals in it.
+- **Tier 0a — the flock. +1 draw town-wide. SHIPS (wave 1).** Cockatoo, galah, corella,
+  lorikeet, perched magpie, ibis as cells in one atlas. Verified free when empty *to the
+  vendored line* (`three.module.js:2193-2199` returns before the GL call; `render.calls++` at
+  `:4094` lives downstream) — a bird-free town costs **exactly zero**, not "almost zero".
+- **Tier 0b — near props. +1 draw per species. Wave 1.5, ONE species:** the ibis head-down in
+  a council bin.
+- **Tier 1 — the magpie.** As already approved. **Binding correction carried:** territory must
+  scale with the road graph — 370 pole anchors on synthetic vs **10,014 poles / 13,730 tree
+  anchors across 2,593 edges on `bendigo_real`**; a capacity-4 magpie there is a swooping town
+  where you never meet the magpie.
+- **Tier 2 — genuinely skinned: CUT this epoch**, and killed by our own spec rather than by
+  cost: the dog was anchored at `shopFront` — *tied outside the shops* — and a tied dog never
+  trots, so the walk clip that is the tier's entire justification would never play. It returns
+  only with a path, footpath alignment, a collision story and a sim hook the design explicitly
+  disclaims.
+
+**So: generate ours, don't go shopping.** Nothing on the animal list needs a download. The one
+thing genuinely worth grabbing online is *not an animal* — Quaternius's **Universal Animation
+Library** (CC0, 130+ clips, Mixamo-compatible) is fuel for the **human** fleet's thin 8-clip
+bank; it touches classic-covenanted `rigs.js`, so it is its own round with its own gates and
+must not be folded into animal work.
+
+**Two corrections binding on v8 from this spike** (both adjudicated in the answer's header):
+`classic_regression` has **no network assertion at all** and grows an allow-list (never a
+deny-list); and `furniture.js`'s module-scope loader is a **trap for new assets** — `fauna.js`
+is dynamically imported behind its construction guard or carries a CLASSIC-derived module
+guard stated in its header. *(The spike called the existing four furniture fetches a live
+breach; they are not — git-verified as v2-era, `24cef5a`, tagged v2.0-alpha→v2.0, i.e. part of
+the baseline the covenant preserves. The hazard is real; the breach is not.)*
+
+## The shape
+
+**WAVE 0 — THE FLOOR** *(one round, three lanes, all micro, must precede content)*
+0.1 the kerb ruling landed as code + the `?verge=0` control · 0.2 repair `smoke_tram` (it
+asserts one thing, prints a SKIP when absent, and **passes on the fenced path** — a live
+vacuous-gate violation inside our own suite) · **0.3 SETTLE THE BUDGET OF RECORD — DONE (R37)**: the 280-vs-191 split was the CAMERA
+BEARING (110 draws of spread; the audit took `DBG.teleport`'s default yaw 0 = the worst
+bearing, the spike supplied a travel-facing yaw = mid-range — both correct, different
+quantities). **PINNED: 292 draws / 124,793 tris**, worst-draw and worst-tri on DIFFERENT
+frames, 8 draws of margin. Shared instance cap **256**, with ≤24 tris/instance and
+proximity-first spending · 0.4 wire
+`ctx.onChunkBuilt`/`onChunkDisposed` (producer and consumer both shipped since R3, never
+connected) · **0.5 give `classic_regression` a network allow-list** (the four v2-era depot
+GLBs + same-origin) — it currently makes no network assertion at all, which is why the R36
+fetch-surface widening needed a brand-new smoke to catch it.
+
+**WAVE 1 — INHABITATION** *(four parallel one-round items; no clips, no rigs, no mocap
+footage — this epoch deliberately does not wait on John's camera)*
+1.1 **the audio inhabitation layer** — the review's only unqualified SHIP: a dog going off
+behind a paling fence, a mower two streets over, a radio through a window, sprinklers, a roller
+door. Zero draws, zero tris, ~30 lines of numpy each. · 1.2 **the per-town character vector** —
+23 towns get a ground palette, ambience mix and sky bias; `ground.js` merges each surface class
+into ONE town-wide mesh, so a palette swap is **+0 draws / +0 tris**. · 1.3 **the magpie** —
+one bird, six weeks, +1 draw. · 1.4 **backyard Australia** — Hills Hoists, paling fences,
+aerials, tanks, built inside `buildings.js`'s existing `boxMats` instanced mesh (+0 draws for
+the box props). *Per ruling 2, 1.4's reach now depends on the civic fetch — it ships on
+synthetic immediately and extends to real towns as districts land.*
+
+**WAVE 2 — THE STREET GETS A VERB** *(sequential, behind 2.0)*
+2.0 the street interaction surface (a `KeyE` verb, an `interactRects` registry, hit priority,
+a click fence) · 2.1 **the manned cart** — consumes the flagship dead seam (44 cart sites on
+the golden seed, 511 across real towns; `furniture.js:252` already holds the shop record and
+throws it away). **Blocker, not cosmetic**: the cheap `doorRect` ride would make every milk bar
+and stall un-enterable from the front — the cart must raycast its own InstancedMesh. · 2.2 the
+fauna substrate + field guide · 2.3 dogs, tier B first.
+
+## Laws (inherited, plus this epoch's)
+
+Everything standing. New for v8: **spend triangles, not draws** (the walked worst frame is
+280/300; tris sit at 99–124k of 200k — every proposal states its draw cost against 280, and a
+town-wide `InstancedMesh` costing 1 draw beats a per-chunk type costing +1 × up to 31 live
+chunks) · **one instance cap per shared layer, settled once, before three implementations
+invent three** · **the depot is a read-only archive** (971 live assets, 53 recorded, known
+trademarked items inside) — generate fresh, never pool from it · every new gate copies the
+shape of 1.1's control: point one table entry at a non-existent key and assert the leg FAILS.
+
+## The cut list stands
+
+Recorded in the review, killed with measurements, not re-opened without new evidence: the
+town-loop bus (its own gate refuted it — what survives is one file: let the *tram* run on
+main+side edges, retiring the same dead seam for +0 draws) · the ute that sells · the charity
+bin (its filter accepts nothing) · the dusk flush (the day is 240 seconds long) · the magpie
+hat (no street verb exists) · the OSM level crossing (the rescoped synthetic version survives) ·
+the mail run · parked cars this epoch (deferred, not rejected — and when they land, 45° angle
+parking is a charter requirement).
+
+## Standing — what still needs John
+
+1. **The market plaza amendment** — `ground.js` paints a 46×46 m plaza at the origin, on top of
+   the spine road, touching none of the 40 stall lots. Fixing it changes the covenanted town's
+   visual output. *Recommend: fix under the amendment law (the R27 precedent — the covenant is
+   anti-drift machinery, not a defect preservative), as its own small ruling.*
+2. **hardyards provenance** — 39 GLBs that are exactly the vernacular kit's shopping list, with
+   provenance documented for one file. Only John knows where they came from. 🟠 until cleared.
+3. **Where is MOCAPGOD?** The fleet docs say lanes 0/A/B are done; on m3ultra the directory is
+   0 bytes and not a git repo (it lives on gitea and, presumably, ultra). Not blocking — v8
+   needs no clips — but the fleet docs are wrong somewhere.
+4. **The animal ruling**, once the spike reports.

docs/V9_THE_CITY_IS_THE_GAME.md

@@ -0,0 +1,306 @@
+> **FABLE'S VERIFICATION (2026-07-26).** John's reframe, designed by a 3-take panel (take-the-map-
+> away / go-up-and-out-the-back / the-unmarked-door), each adversarially judged, then synthesised.
+> **I re-measured the two load-bearing claims myself before circulating this, and both hold exactly:**
+>
+> 1. **The street names.** Counted independently across every shipped cache: **19,132 road ways,
+>    17,835 carrying a `name` — 93.2%**, matching the synthesis to the digit. And the drop is real:
+>    `plan_osm.js:363` builds each way as `rawWays.push({ kind: roadEdgeKind(rd.kind), pl })` —
+>    it keeps the kind and the geometry and **discards `rd.name`**. Every real street in twenty-three
+>    Australian towns is sitting in this repo with its name on it, and the game has never said one
+>    out loud.
+> 2. **The interior budget correction, which contradicts our own depth map and is the more urgent
+>    of the two.** `index.html:349` ships `useGLB: !NOASSETS`, so **the default boot is the GLB
+>    path**, and `C-progress.md:841` records that sweep at **GLB-on 344** against the ≤350 interior
+>    cap. **The interior margin is SIX draws, not 191.** The depth map's "draw budget is not the
+>    problem either" cited the GLB-*off* 168 and is wrong. This goes into the house record today
+>    regardless of what happens to the rest of this document — any interior work, in any epoch,
+>    is spending against six.
+>
+> **Scope honesty, stated up front:** enterable upper floors are an EPOCH, not a wave.
+> `player.js:64` and `interior_mode.js:485` both write `y = EYE` unconditionally every frame on
+> every path — there is no gravity, no floor query, no current-storey state, and no data structure
+> anywhere carries a floor height. Anything containing "levels" or "stairs you walk up" is
+> proposing a locomotion rewrite plus a new ground truth. Everything else John asked for is
+> affordable now.
+>
+> Companion: [SALE_RED_TICKET_DAY.md](SALE_RED_TICKET_DAY.md) owns the ROUND and the LAWS (the
+> Band Floor Law); this document owns the HUNT and the CITY.
+
+# THE CITY IS THE GAME
+### Synthesis — the v8 city-patterns review, three takes reconciled
+**Fable → John.** Measurements in this document were re-run against the tree at `d59df8e`, seed 20261990, all 23 shipped caches + the synthetic. Where I contradict a judge or the depth map, I say so and show the number.
+
+---
+
+## 1. THE ANSWER
+
+**Yes. And the reason it's the right move is that the city is already deeper than the game knows.**
+
+Your reframe — *"you have to even know where to find the store first to get the sale item"* — asks for a city with places in it. PROCITY generates places. It has generated them since v2. Nothing reads them:
+
+| Generated | Where | Consumed by |
+|---|---|---|
+| Six `DISTRICT_KINDS`, 7 districts on the synthetic (mainstreet 332 shops · backstreets 95 · market 41 · arcade 17 · warehouse 4 · residential 4) | `registry.js:8`, `plan.js:160-292` | grass verges + one plaza quad (`ground.js:58,165`), ambient anchors (`audio.js:170`). Nothing else. |
+| A 42 m covered arcade, 17 shops, 2 blocks, a measured 4.99 m walkable lane, already awning-roofed by accident | `plan.js:270-283`, `buildings.js:634-647` | paved (`ground.js:140-147`). No props, no signage, no roof, no reverb. |
+| Two 280 m service laneways behind the main-street blocks, 36 yard lots | `plan.js:328-339` | gum trees, magpie song. Zero shops. |
+| `storeys` on **every** shop — 566 of 1,345 corpus shops are 2–3 storeys | `plan.js:89`, `plan_osm.js:275` | box height (`buildings.js:567`) and one ambient. **The facade stops at 3.0 m.** No upper window exists anywhere in the codebase. |
+| `lot.frontEdge` — which street every shop is on | `plan.js:78` | one consumer, `gigs.js:82`. |
+| **`roads[].name` on every shipped cache — 17,835 named ways of 19,132 (93.2%)** | the caches themselves | **nothing. `plan_osm.js:362-366` keeps `kind` and drops the name.** |
+
+That last row is the finding of this review and I re-derived it independently: adelaide 1191/1099/319 distinct, bendigo 1552/1408/322, fitzroy 1571/1437/190, katoomba 484/457/166, castlemaine 397/370/141. **Every real street in twenty-three Australian towns is already sitting in the repo with its name on it, and the game has never once said one out loud.**
+
+And it is recoverable without touching citygen. Plan nodes *are* snapped projected way points (`plan_osm.js:361-372`, `SNAP=3`), so plan edges lie **on** the named ways. Measured, all 23 caches, median distance from a plan-edge midpoint to its nearest named way:
+
+> **0.03 m – 0.90 m.** Worst town katoomba at 0.90 m. **97.8% of corpus shops (1,192 / 1,219) resolve to a street name.**
+
+That is not an inference. I recovered the plan's internal shift by centroid-align + nearest-waypoint vote and re-measured; the numbers above are mine. There is a cleaner one-line upgrade — write `norm.shift = {shx, shz}` at `plan_osm.js:510`, which lands in the **caller-supplied `opts.report` sink, never on the plan object** — so it moves no golden and breaks no classic byte. Take the one line. But the design does not depend on it.
+
+**So: the city is the game is cheap, because the city is already built and only the exploration layer is missing.** The expensive part is exactly one thing, and I'll name it now rather than bury it:
+
+> **Vertical movement is fiction until someone rewrites locomotion in both modes.** `player.js:64` and `interior_mode.js:485` both write `y = EYE` unconditionally, every frame, on every path. There is no gravity, no floor query, no current-storey state, and no data structure anywhere carries a floor height. Any proposal containing "levels", "stairs" or "upper floors as places you enter" is proposing that rewrite plus a new ground truth. **And the interior draw margin is six, not one-nine-one** — `C-progress.md:841` reads *"full drawSweep unchanged (GLB-off 168 · GLB-on 344, both pass)"*, and `index.html:349` ships `useGLB: !NOASSETS`, so the **default boot is the GLB path at 344/350.** The depth map's line *"DRAW BUDGET IS NOT THE PROBLEM EITHER"* cites the GLB-off sweep and is wrong. That correction goes into the house record today regardless of what happens to the rest of this.
+
+Enterable upper floors are an epoch. They are not this epoch. Everything else you asked for is affordable now.
+
+---
+
+## 2. THE SHAPE — "KNOW YOUR TOWN"
+
+One proposal, four layers, in dependency order. Layers 1–3 are information design and cost **zero draws**. Layer 4 is the only geometry and it rides meshes that already exist.
+
+### Layer 1 — THE ADDRESS LAYER *(the vocabulary)*
+A new pure module, `address.js`. No THREE, no fetch, no plan mutation.
+
+```
+createAddresses(plan, cache|null) → {
+  streetOf(edgeId)   → "Templeton Street" | null
+  localityOf(shopId) → { street, district, block, side, label }
+  cohort(predicate)  → shopId[]          // the clue sizer — see Layer 3
+}
+```
+
+- **23 cache towns:** street name, resolved by nearest named way to the edge midpoint (≤8 m tolerance).
+- **Synthetic:** no roads cache and only 22 edges, so the label comes from `district.kind` + block — *"the market end"*, *"the arcade"*, *"the backstreets"*. Same field, different supplier, one consumer contract.
+
+Consumers, all cheap: the HUD tooltip (`hud.js`, one template literal), the map's street labels, the notebook, the morning paper, keeper rumours.
+
+**This is the prerequisite, not the bonus.** VERTICALITY's judge marked it as such and was right: without it, CLEARANCE collapses to one type-cell on 21 of 24 towns. UNMARKED needs it harder still — 7 of the synthetic's 12 hidden shops share a name with 1–10 others (`Rotation ×10`, `Quick Cash Pawn ×11`), so a ledger entry that says only a name points at ten buildings. **An address is the only way a shop with no sign can be written down at all.**
+
+### Layer 2 — THE FOG *(the keystone)*
+`minimap.js` draws only shops the player has walked past. Discovery is player state, saved.
+
+Today `minimap.js:52-63` draws **every** lot in the plan, coloured by shop type, from the first frame, with no gating. One M keypress renders all 493 synthetic shops — all 77 record shops, all 92 op shops — before the player has walked a metre. Measured against what that is worth: passing every shopfront once costs **5,330 m on the synthetic, 9,622 m on fitzroy, 5,797 m on northbridge** — at WALK 4.6 m/s against `lighting.js:91`'s 240-second day, **4.8 / 8.7 / 5.3 game-days of walking.** The map hands over five to nine game-days of legwork for one keystroke, on all 24 towns, forever.
+
+And the payoff is bigger than the cost saving. Replicating `minimap.js`'s own transform, a shop rectangle renders at:
+
+| | bowral | castlemaine | katoomba | adelaide | fitzroy | synthetic |
+|---|---|---|---|---|---|---|
+| full-extent (today) | 0.8×1.1 px | 1.4×1.8 | 1.4×1.9 | 1.7×2.3 | 2.7×3.5 | 5.2×10.2 |
+| framed to a 200 m known window | 29×39 px | 29×39 | 29×39 | 29×39 | 29×39 | 21×41 |
+| **gain** | **35×** | **21×** | **21×** | **17×** | **11×** | 4× |
+
+**The same line of code that hides what you don't know makes legible what you do.** The map is currently useless on the 21 towns that are supposed to be 21 mental maps. Fog fixes that as a side effect.
+
+Cost: zero draws, zero triangles — the map is a 2D canvas overlay and `hud.js:361`'s counter (`renderer.info.render.calls`) never sees it. Zero new plan fields. Classic-gatable by construction: `createMinimap(plan)` at `index.html:204` becomes `createMinimap(plan, game ? knownProvider : null)`, and a null provider is today's exact behaviour — the same pattern `ground.js` already uses at `index.html:178-185`, so `minimap.js` needs no flag test at all.
+
+**Two corrections to the depth map's own fog proposal:**
+
+1. **Discovery is a proximity probe, not `chunks.onChunkBuilt`.** Real towns are all BIG_CITY (`index.html:151`) so R=2 — the outermost live chunk centre is 128 m out, its far corner 181 m. Chunk-built discovery would hand you shops three blocks away through a wall. Use a 25 m squared-distance probe over the live `doorRects` on the existing `frame % 6` cadence (`hud.js:337`). Same cost class, honest semantics.
+2. **Key the fog by TOWN, not by `townKey`.** I verified: on all 23 cache towns, `shops[].id / lot / type / name` and every lot geometry are **byte-identical across seeds** — only `storeys` and `hours` re-jitter. So a re-seed is *the same Katoomba with different secrets*, and the map you learned should survive it. Keying by town also bounds the save by construction (≤ 25 registered keys, no LRU, no cap needed), which kills NOMAP's K5 and UNMARKED's cap problem in one move. The **synthetic is the exception** — its shop ids are seed-dependent (493 shops at 20261990, 479 at seed 7) — so it keys `default@<seed>`. One rule, one stated exception.
+
+### Layer 3 — THE HUNT *(what the fog is for)*
+A once-per-day sale, announced at dawn in the existing morning paper, addressed rather than pinned. Full round in §3.
+
+The director's job is one thing: **size the clue.** It picks a target from the set of shops that some clue cell resolves to **≤4 doors within a ≤350 m span**, and emits the smallest cell that works. Measured share of a town's shops that are clueable under that rule:
+
+| bendigo · braddon · darwin | launceston · castlemaine · marrickville · bowral | newtown · redhill · newcastle · northbridge | glebe · westend · hobart | adelaide · fitzroy · geelong · fremantle · katoomba | brunswick | **synthetic** |
+|---|---|---|---|---|---|---|
+| **100%** | 90–93% | 83–89% | 77–78% | 69–74% | 51% | **32%** |
+
+Median real town: **~85% of shops are pointable-at in four doors or fewer.** Median best clue cell on a real town: **1 door.** On the synthetic: **9 doors, p90 20.** That difference is structural and I'll deal with it in §5 and §8.
+
+### Layer 4 — THE UNMARKED *(the reward)*
+Roughly 6% of a town's shops ship with **no sign** — 89 across the corpus, 12 on the synthetic, 2–12 per town by `clamp(round(shops×0.06), 2, 12)`. You find them by cue: a crate of records on the footpath, an A-frame, a roller door half up, a bloke in the doorway. They enter the notebook **by address**, because they have no name.
+
+**The seam that makes this free: on a fogged map, an unmarked shop's absence is indistinguishable from an undiscovered shop's absence.** UNMARKED's own judge killed the map-omission idea because on the synthetic — the only town where the map is legible — omitting one lot from a terrace punches a **16.8 px hole, 6.5× the lot width**, and you can count the notches without walking. With Layer 2 in place there is nothing to count: every undiscovered lot is a hole. The fog doesn't just permit the hidden layer, it is the only thing that makes it honest.
+
+The same seam retires VERTICALITY's KILL 2 (*"the minimap already hands over the clue"*) and NOMAP's Gate 1 problem. **Every one of the three takes has a kill that fog closes.** That is the argument for this shape over any of the three alone.
+
+### Layer 5 — UPSTAIRS, VISIBLE ONLY *(the bridge to the next epoch)*
+Give the 566 multi-storey shops a **first-floor window band**, drawn into the existing merged `windowGeos` mesh with the existing per-vertex `aHours` shader. **+0 draws, ~24 triangles per shop.** `makeInstanced` sizes to `list.length` with no cap (`buildings.js:749-753`); `windowGeos` merges to one mesh per chunk (`:800-806`). Today `buildings.js:581` caps the facade skin at `FACADE_H = 3.0` and puts both windows at y=1.55, so storeys 2 and 3 are a flat tinted box with a parapet — while `audio.js:190-193` already seeds a radio-through-a-window ambient onto every shop with `storeys ≥ 2`. **The game already sounds like someone lives above the shop and looks like nobody does.**
+
+No stair. No enterable room. Nothing that touches the two Y-clamps. This is v8's own name — SOMEONE LIVES HERE — paid for at zero draws.
+
+### The seams, stated
+```
+address ──(labels)──▶ hud tooltip · map · paper · keeper rumour · notebook
+address ──(cohort sizer)──▶ director            [the clue can't be written without it]
+fog     ──(known set)──▶ map draw filter + map framing + notebook
+fog     ──(structural)──▶ unmarked              [no hole to count]
+unmarked──(no name)──▶ address                  [the only identifier it has]
+upstairs──(address)──▶ "above 42 Templeton St"  [free, later]
+```
+One save field (`known`), one new pure module (`address.js`), one canvas rewrite (`minimap.js`), one template literal (`hud.js`).
+
+---
+
+## 3. THE ROUND
+
+**Castlemaine. 22 shops. 8 shop-bearing streets. Day 14. You have $180 and a wantlist with three things on it.**
+
+**The clock, from the code.** `lighting.js:91` `DAY_SECONDS = 240` over 6 segments = **40 real seconds per segment**. `lighting.js:22` `HOUR_NUM = [6.5, 9, 12.5, 15.5, 18.5, 22]`. Registry trade hours are 10–18 (`registry.js:40`), so on 20 of 24 towns a record shop is open in **segments 3 and 4 only — 80 real seconds of trading.** That is the hard constraint every hunt design in this review either respected or died on.
+
+**06:30 — DAWN, segment 1.** The paper lands. One line:
+
+> **CLOSING DOWN — EVERYTHING HALF PRICE — THE RECORD SHOP ON TEMPLETON STREET**
+
+Two terms: type + street. Measured on castlemaine, that cell holds **1 shop** (town median 2, town max 3). The clue is exact. The question is whether you know where Templeton Street is.
+
+**06:30–12:30 — segments 1 and 2, 80 real seconds, the doors are shut.** This is the hunt, and it is free time you already spend walking. At WALK 4.6 m/s that's **368 m; at RUN 8.8 it's 704 m.** Measured, distance from the town's shop-centroid to a given shop: on castlemaine 45% of shops are inside 368 m, 73% inside 704 m. Corpus range 11–85% inside 368 m.
+
+- **You've walked Templeton before.** It's on your fogged map, labelled. You go. 40–90 seconds. You're standing outside at 11:50 with a segment in hand.
+- **You haven't.** The map shows the streets you've learned and a name you've never seen. Three outs, in order of cost:
+  1. **Ask a keeper.** Any open shop, any keeper: *"Templeton? Off the north end of Barker, past the hall."* Free, rides the existing rumour seam, and it is the most SOMEONE-LIVES-HERE thing in the whole design.
+  2. **The paper's second line** — a landmark from the address layer's nearest named cross-street: *"opposite the Town Hall"*. Costs nothing; the director emits it only when the target street is undiscovered.
+  3. **Walk.** Every street you learn is banked forever, on every future visit, at every seed. The loss is a day, not a save.
+- **You get it wrong.** The clue cell is ≤4 doors by gate, so worst case you check four shopfronts. Measured p90 spread inside a clue cohort: 0 m on eleven towns, 105–466 m on nine, and the gate rejects anything over 350 m.
+
+**12:30 — MIDDAY, segment 3. Doors open.** You're in. The sale stock is the shop's normal seeded rotation at half band. You dig — riffle, pull, read the sleeve, check it against THE BIBLE. Under band is a gem; that skill is unchanged and it is still the core.
+
+**Scarcity is the stock, not a stopwatch.** `dig.js:417-421` reads `opts.gone` once and computes offers once, at card-open — so "half the good ones are already gone" works evaluated **when you walk in**, and does not work as a timer ticking while the card is open. Arrive in segment 3 with a full sale; arrive in segment 4 and a seeded fraction is gone. That is the whole pressure and it costs one union into an existing set (`interior_mode.js:187`).
+
+**18:00 — the shop shuts.** If you never found it, you lost the day. Tomorrow's paper has a different sale, in a different part of town, and the streets you burned today are permanently on your map. **You did not lose a run. You bought a map with a day.**
+
+**Total round: 240 real seconds. Clue resolves to ≤4 doors. 368–704 m of pre-open walking. 80 seconds of trading. Win = you knew the town, or you learned it.**
+
+**The two numbers that constrain everything above** — and that killed two of the three takes' round designs:
+- NOMAP's director radius (`remaining_segments × 40 s × 4.6 m/s × 0.7`) leaves a median of **1 shop reachable on marrickville, 2–3 on braddon and redhill.** The radius narrows the pool below the clue's cohort before the clue speaks. Cut; announce at dawn instead, which is what §7 already did, and let the whole town be live.
+- UNMARKED's BLIND DOCKET puts the target **2,217 m from the roster on hobart, 1,971 m on fremantle** — 3.1× the entire round's RUN budget in a straight line, on a mode with an 80-second window. Impossible on 7 towns, and on 9 more the "unnamed" shop is already printed in the paper. Cut entirely.
+
+---
+
+## 4. WHAT IT COSTS
+
+### THE MINIMUM VERSION — one round, no geometry, proves the fun
+
+| Lane | File | Change |
+|---|---|---|
+| **F** | `address.js` **(new)** | pure; edge→named-way resolution + shift recovery; synthetic district/block fallback; `cohort()` sizer. Zero fetch beyond the cache the shell already holds — needs one additive export, `getTownCache(key)`, because `index.html:130` hands the JSON to `registerTownCache` and drops its own reference. |
+| **A** | `plan_osm.js:510` | **one line**: `norm.shift = { shx, shz }` into the caller-supplied `opts.report`. Not on the plan. No golden moves. Optional — the vote recovers it without this. |
+| **B** | `minimap.js` | fog filter + known-extent framing + street labels + an **offscreen static cache** (today `drawStatic()` re-fills every lot every frame; adding up to 322 `fillText` calls per frame would turn a free overlay into a CPU text pass — invalidate on discovery change only). ~40 lines. |
+| **B** | `hud.js` | tooltip prints `NAME — Templeton Street`. One template literal. Plus the 25 m discovery probe on the existing `frame % 6` cadence. |
+| **B** | `buildings.js:453-478` | **the type label into the sign atlas.** The cell is 512×168; the name renders at ≤74 px centred at `py+84`, and `drawCrateMark` owns `py+128…py+152`. There is ~42 px of clear canvas in the **top** band (`py+13 … py+55`). Draw the registry `label` there at ~30 px. **+0 draws, +0 tris.** Without it, "the op shop on Barker Street" is unfalsifiable from the footpath: `drawSign` renders `shop.name` only, `opshop` and `stall` sign colours are byte-identical (`fixture_plan.js:29-37`), and only **5–18% of real-town shop names contain a type word** (median 13%). Every later clue term depends on this. |
+| **F** | `save.js` | `known` optional block, town-keyed, exact-and-loud validator matching `save.js:72-99`, `.slice()` in `adopt()`. |
+| **F** | the game layer | the dawn director + the paper line + the notebook DOM. |
+
+**Zero new draws. Zero new triangles. Zero plan fields. No Lane C, D or E.** One round.
+
+### Then, in order
+
+| Round | What | Lanes | Why then |
+|---|---|---|---|
+| **+1** | The unmarked layer — UNMARKED §1–§5 with all nine corrections (`TYPE_W.stall = 0`; hoist the atlas alloc to `ensureAtlas()` — `buildings.js:452-462` allocates lazily inside `drawSign`, so **49 chunks across the corpus** where every shop is hidden would hit `new THREE.CanvasTexture(null)`; crate to `d/2 + 2.4`, outboard of the awning post line at `d/2 + 2.0`; discovery hook **inside** the successful-entry branch, after `index.html:491` and `:503`, not on the `:489` dispatch) | B + F | Needs the address layer to have a name for the nameless, and the fog to hide the hole. |
+| **+2** | The first-floor window band on 566 multi-storey shops | B | +0 draws, ~24 tris/shop. This is v8's own headline, paid. |
+| **+3** | The arcade, treated as an arcade — district-keyed, **synthetic only** (roof lights, tiled floor, reverb, E's 5.86 m `longbench`) + a mouth so it stops being a graph orphan (measured: arcade edge 14's endpoints are degree 1 and 1; the announcement is 14.7 m of bare ground) | B + E | 17 shops, one town, but it is the **only** place on the synthetic where a type-plus-place clue resolves to a set you can scan: `record\|arcade` = 9 hosts, 32 m spread, 7 s end to end. |
+| **+4… (a different epoch)** | Enterable upstairs | C + F + B | Priced in §5. |
+
+---
+
+## 5. THE HARD PROBLEMS, ANSWERED
+
+### Replayability in a deterministic world
+**The town is the constant; the contents are the variable.** Verified across katoomba, fitzroy and castlemaine: re-seeding a cache town leaves shop ids, lots, types and names **byte-identical** — only `storeys` and `hours` re-jitter (`plan_osm.js:274`, `seedFor(citySeed,'osmshop',id)`). And `save.js:172` already treats a town change as travel, so you keep cash and collection.
+
+So `?seed=N` is *the same Katoomba, different secrets*: the same streets, the same shopfronts, a different unmarked set, a different sale roster, different upstairs. **Your map survives; your knowledge of what's behind the doors does not.** That is exactly the right split for a game about knowing your town, and it is why the fog keys by town.
+
+Two honest limits. On small towns the hidden-set reshuffle is weak — 13 of 24 towns pick from N=2 with one dominant candidate, so a Jaccard-based "different secrets" gate goes red on bendigo, braddon, launceston, redhill and glebe. That gate must be size-aware or the reserved slot must take a seeded draw. And the synthetic re-rolls everything including shop ids, so it is a different town at every seed, not the same one.
+
+### Findable vs frustrating
+Answered by arithmetic, not by feel. **The director sizes the clue; the gate enforces the size.**
+
+- Two terms (street + type) on a real town: **median cohort 1–4**, p90 2–18, **19–89% uniquely identified**. Without the street term: median 3–49.
+- Adding side-of-street: median 1–4, **27–89% unique**, worst tails cut (katoomba 18→15, fitzroy 10→7, brunswick 12→9).
+- **51–100% of a real town's shops (median ~85%) are clueable at ≤4 doors within ≤350 m.**
+
+The gate must assert the **search**, not the answer. VERTICALITY's G7 (*"the clue's candidate set has ≥2 members"*) is a floor on the wrong quantity and goes green on an 87-door clue — measured, `toy|mainstreet` on the synthetic sends you to 87 doors over a 770 m spread, 167 seconds of walking. Rewrite as a **ceiling on doors-the-clue-sends-you-to, in [1, 4], with span ≤350 m, over 200 seeded days × 24 towns.** As corrected it fails on today's data, which is the point.
+
+The failure mode is then never *"I wandered for four minutes and lost."* It is *"I haven't learned that part of town yet"* — with three outs and a permanent gain either way.
+
+### The interiors machinery's one-room assumption
+**Don't touch it this epoch.** The minimum version's interior delta is exactly zero: a hidden shop, a sale shop and a normal shop all call the same `buildInterior(shop)`.
+
+When it does come due, the price is known and it is not what the depth map said:
+- **The blocker is not dispose** — `ctx.disposeAll()` (`interiors.js:242-248`) tracks every geometry/material/texture regardless of sub-group, so N rooms through one Ctx dispose correctly today. `binUnderAim` and `stockInfo` both traverse, so a second room's crates are diggable for free.
+- **The blocker is not draws — but the margin is six, not one-nine-one.** `C-progress.md:841`: GLB-off 168, **GLB-on 344**, both against ≤350. `index.html:349` ships `useGLB: !NOASSETS`. The 159 the depth map cites is the GLB-off sweep. **Correct the house record.**
+- **The blocker is the grid.** `layout.js:337` makes ONE `makeGrid(W,D)`; `interior_mode.js:322-330` rejects any position with `|x| > W/2` or `|z| > D/2` **before consulting occupancy**. A fully built, fully lit second room outside that rectangle is unreachable.
+- Full bill: one merged grid with a doorway cell the Manhattan carve at `layout.js:408` may not close · a second path guarantee (`:391-408` flood-fills one spawn to one counter) · per-room keeper resolution (`interior_mode.js:396` is `.find`, not `.filter`) · a second `exits[]` entry with `toStreet:false` **and an opener** — the contract is already honoured at `:335`, which makes it a vacuous-gate trap: ship the door without the opener and a naive "the room has 2 exits" gate passes while nothing on earth opens it · a shell variant, because `shell.js:113-114` calls `buildShopfront` unconditionally and would give a first-floor room ground-floor glazing, an EXIT plate, and a backdrop canvas painting a kerb at row 74 · plus, for anything called "stairs", the two Y-clamps and a floor-height ground truth no structure carries, and the seven module singletons `enter()`/`exit()` own.
+
+**≈ one Lane C round + one Lane F round for a second room. An epoch for stairs.**
+
+### The 8-draw margin
+The pin is **292 draws at night, 282/283 at noon** (`F-progress.md:9,962`). Everything in layers 1–3 is DOM, 2D canvas, or data: **zero draws, and the count should be *identical*, not merely under budget.** Gate on `renderer.info.render.calls` matched exactly, **at night and at noon** — the window band is emissive at night and lands on the worst frame.
+
+The standing refusal holds and should be written as law: **no new per-chunk mesh class, ever.** Measured live chunks: 25 live / 49 in the dispose window on every real town (all BIG_CITY, R=2); 23/42 on the synthetic. At 8 draws of margin, +1 draw × 49 chunks is not a cost, it is a breach. All depth geometry rides the existing merged lists — `boxMats`, `awnings`, `footGeos`, `windowGeos`, `doorGeos`, `signQuads` — the way the R38 yards change did. `makeInstanced` sizes to `list.length` with no cap; that mechanism is verified and it is what makes layers 4 and 5 free.
+
+---
+
+## 6. THE CUT LIST
+
+| Cut | Measured reason |
+|---|---|
+| **CLEARANCE** (VERTICALITY R4) | The clue sends you to **18 doors at the median, 87 at the max** — the design counted correct answers, not searches, because the player can't see which hosts have an upstairs. And `minimap.js:52-58` already hands over the clue's three attributes. Re-found it or leave it out. |
+| **THE BLIND DOCKET** (UNMARKED §6) | Blind shop to nearest roster shop: **2,217 m hobart, 1,971 m fremantle, 1,538 m newtown** against a 704 m RUN budget. Impossible on 7 towns. On 9 others the blind shop is already **inside** the named clique, so the paper names the shop it says has no name. |
+| **The laneway leg** | **2 shops in the entire corpus front a `lane` edge** (both launceston), 0 on the synthetic. The synthetic's two laneways are graph orphans (endpoint degrees 1 and 1) and the east lane runs **under seven arcade lots** that overhang its carriageway by up to 1.63 m — `lotCollider` would eject the player from the lane. |
+| **The merged-grid back room** (VERTICALITY R5) | Surplus depth behind a max-depth room: **p50 = 0.10 m**, p75 1.96, p90 3.22. Only **31 of 493 shops (6.3%)** clear 4 m. It is a lottery on the archetype roll, and it is the only piece that touches the path guarantee. |
+| **Real-town arcade and lane flavour** | `'arcade'` on a real town is OSM `pedestrian\|footway\|path\|steps\|cycleway` — **990 edges, 39,276 m of ordinary suburban footpath.** Roofing it roofs 39 km of pavement. Arcade treatment keys off `district.kind`, synthetic only. Make it a code rule. |
+| **District-keyed skins on real towns** | `plan_osm.js:305` is one unconditional `addDistrict('mainstreet')`. All 24 caches: 1 district, all lots `use:'shop'`. Code rule, not a caveat. |
+| **The facade-skin clue term** | 47 files in `web/assets/gen/`, no colour or material name anywhere in the codebase, and skins are shared across types (`facade-corrugated` in pawn/stall/band_room). Leaks type without adding information. |
+| **Physical corner street signs** | +1 draw × up to 49 live chunks against 8 of margin. Already refused; endorsed. |
+| **Map omission for unmarked shops** | Punches a hole up to **16.8 px wide — 6.5× a lot width** — in a contiguous terrace on the synthetic, the one town where the map is legible and the default and classic boot. Fog handles it structurally; omission does not. |
+| **The segments-remaining director radius** | Median shops reachable from a random shopfront: **marrickville 1, braddon 2, redhill 3.** Narrows the pool below the clue before the clue speaks. |
+| **The window card as a *cue*** | 28 px in a 168 px cell on a 0.25 m quad = **0.042 m of letter, legible to ~3.8 m** — inside the free 6 m tooltip at `hud.js:302`. Demote to dressing. One ranged cue exists: the crate. |
+
+---
+
+## 7. WHERE IT SITS
+
+**This is v9 — THE CITY IS THE GAME — with a one-round probe landing inside v8.**
+
+Three reasons.
+
+1. **v8 is texture; this is mechanic.** Ambient audio, per-town character, the magpie, backyards — every v8 item makes the city *feel* more like a place. This makes it *function* as one. Folding a new win condition into an epoch about atmosphere leaves the epoch un-nameable, and PROCITY names its epochs for a reason.
+2. **The probe belongs in v8 because it decides whether v9 exists.** Fog + the address layer + the type label is one round, zero draws, zero geometry, and it is falsifiable on its own: does a fogged, street-named town make you want to walk it? If the answer is no, v9 doesn't happen and we spent one round. If the answer is yes, v9 has a proven core before anyone models a polygon. **Never build the geometry first.**
+3. **v8's own headline is already the bridge.** SOMEONE LIVES HERE is answered — literally, on 566 buildings, at +0 draws — by the first-floor window band. `audio.js:190-193` has been asserting that upper floors are inhabited since it shipped. Land the band in v8 and the epoch keeps its name. Then v9 makes the city knowable. Then, if it earns it, a later epoch makes those upper floors enterable, and by then the window is already there to walk up to.
+
+**v8 wave 2:** the address layer · the fog · the type label · the first-floor window band.
+**v9 — THE CITY IS THE GAME:** the notebook · the unmarked · the sale director · the arcade.
+
+---
+
+## 8. WHAT NEEDS JOHN
+
+Six taste calls. Nobody else can make them.
+
+**1. Does the default boot become a real town?**
+This is the big one. The synthetic is 493 shops on **22 streets**, with 304 distinct names and a 17-way collision (`The Toy Nook` ×17, `Marbles & Kites` ×14, `The Book Cellar` ×12). Measured: **32% of its shops are clueable at ≤4 doors, against 51–100% (median ~85%) on the real towns.** Its best clue cell is a median of 9 doors. It is a magnificent strip and it is not a town you can learn. A bare `index.html` boots it today; `?classic=1` freezes it byte-identical forever regardless, so the covenant is not at risk. But if the win condition is knowing your town, the town the game opens on should be one that can be known. *(A smaller version of the same call: let the synthetic's hunt be district-scale — "somewhere in the backstreets" — an honest browse rather than a broken precision hunt.)*
+
+**2. How harsh is the fog?**
+Three settings, in ascending mercy: **(a)** shops you've walked within 25 m of · **(b)** shops you've actually entered · **(c)** *streets* you've walked, with every shop on a walked street revealed. (c) is the most map-like and the most forgiving — you learn a town in streets, not in shopfronts — and it makes the address layer the unit of knowledge, which is tidy. (b) is brutal and would take a very long time to fill in. My instinct is (c); it's your call.
+
+**3. Does the clue name the type or the shop?**
+*"the record shop on Templeton Street"* teaches you the city. *"Rotation, somewhere up Templeton"* teaches you the shops. Type-clues make the town the thing you learn; name-clues make the roster the thing you learn. They are different games and the arithmetic supports either.
+
+**4. Does an unmarked shop ever get a name?**
+Or does it stay, forever, *"the one with the crate out front, Lyttleton Street"* — a place you know by where it is and not by what it's called. The second is better writing and it is also the harder sell to a player who wants a list.
+
+**5. Is being late a discount or a loss?**
+Arrive in segment 4 and the good ones are gone (`gone` grows with arrival time, seeded) — or the sale is simply over and the door is locked. The first is a difficulty curve; the second is a deadline. The code supports both at the same cost.
+
+**6. Do keepers give directions?**
+It is the anti-frustration valve, it costs almost nothing, it rides the existing rumour seam — and it is the single most *someone lives here* thing in this entire document. It is also the moment the city stops being an opponent and becomes a place with people in it who are on your side. That's a tonal decision, not an engineering one.
+
+---
+
+### Two things for the house record, regardless of what you decide
+
+1. **The interior draw margin is six, not one-nine-one.** `C-progress.md:841` — GLB-off 168, GLB-on **344**, budget ≤350, and `index.html:349` makes GLB-on the default boot. The depth map's "draw budget is not the problem" line is measured off the wrong sweep and has to come out before it authorises a room somebody can't afford.
+2. **Street names are already in the repo.** 17,835 named ways of 19,132, 93.2%, on 23 towns, recoverable to a median of 0.03–0.90 m with no citygen change and no golden move. Whatever the shape ends up being, that data should stop being dropped on the floor.

docs/shots/laneB_r39/README.md

@@ -0,0 +1,31 @@
+# Lane B — Round 39, THE FOG (item 39.2)
+
+Taken in a fresh context on port-isolated **no-store** servers (`:8591` treatment, `:8592` =
+`git archive HEAD`), assets/vendor symlinked so the other lanes' mid-round waves are identical on
+both sides. Every number behind these pictures is in `docs/LANES/LANE_B_NOTES.md` §39.
+
+| file | what it shows |
+|---|---|
+| `fog-00-head.png` | **HEAD, synthetic** — all 493 shops handed over on the first M press, 26,506 shop-colour px |
+| `fog-01-before.png` | **R39, fresh boot** — 0 shops known, the 240 m frame, a 25 m scale bar |
+| `fog-02-after.png` | **R39, after 900 m** — 113 shops, 7 segments, A's district labels (*"the south end of the main street"*) |
+| `fog-00-head-katoomba_real.png` | **HEAD, katoomba** — 993 edges of grey spaghetti; at 1.42×1.89 px the 72 shops rasterise to **zero** pixels of their own colour |
+| `fog-01-before-katoomba_real.png` | **R39, fresh boot** — the 240 m frame, a shop lot at 29.4×39.2 px |
+| `fog-02-after-katoomba_real.png` | **R39, after 900 m** — 34 shops on **Katoomba Street**, with **Edwards Street** running off it (Lane A's address layer) |
+| `map-classic.png` | `?classic=1` — the pre-R39 map, hash-identical to HEAD's |
+| `sign-*-BEFORE.png` | the default boot's spawn **as shipped since R32**: synthetic — a footpath facing a plaza with not one shopfront in frame; katoomba — **standing in a paddock facing the blank back wall of a building**. 3 shops within 25 m, **0 of them in front of you**, 0 discovered |
+| `sign-*-AFTER.png` | the same code with the front normal corrected (`+sin`): **on the footpath under the awnings, signage down the strip**, 4 shops within 25 m, **4 in front**, 4 discovered |
+
+| `magpie-AFTER-glb-zoom.png` | Lane E's 894-tri GLB **in the engine**, perched on the lamp arm, `asset:'glb'` — pied, legged, unmistakable. **755 px of true white** in the crop |
+| `magpie-BEFORE-primitive-zoom.png` / `magpie-AFTER-primitive-zoom.png` | the procedural fallback (`?noassets=1`) before and after the re-placed white: pale area **213 → 427 px**, but true white **33 → 28** — the underside gets no sun, so the fix reads grey. The measured ceiling on a primitives-only fallback, and the reason the GLB is the answer |
+| `magpie-AFTER-glb-swoop.png` | the swoop, **head-on** — proof the `rotateY(π)` is right in flight, not just on the perch |
+| `magpie-AFTER-glb-flank.png` | the honest in-situ frame (70° FOV, 14 m): the bird is a speck. E's A/B sheet owns the size question; the `-zoom` frames are 12° FOV **inspection** shots |
+
+*(All three magpie arms measured `+1 draw` with the bird on screen and `+0` with it off, same page, same
+frame: GLB +894 tris, primitive +182, and the placement fix is +0 tris in-engine.)*
+
+The `sign-*` pair is **booted code on both sides** — two port-isolated no-store servers, `:8702`
+serving the fog commit (old sign) and `:8701` the fix. Nothing is monkey-patched.
+
+Katoomba's BEFORE is the R31 playtest's own complaint, verbatim — *"faced dirt and building-backs"* —
+which R32 was written to fix and, because of the sign, never did.