# PROCITY v5 — THE REAL SHOP (epoch charter)

*Fable (m3, integrator), 2026-07-16. John's pick at the v4 retro. Grounded in: the Lane G
marriage (merged, ruled, G2a atlas contract reviewed by C/E in R22), dealgod's 1.77M real items
with photos, thriftgod's census already driving `newtown_godverse`, and the v2-era dig/wallet/
stock machinery that has been waiting for this data since it shipped.*

## The vision

**v4 made the towns real; v5 makes the shops real.** Walk Fitzroy's actual street into an actual
op shop, riffle a crate, and the records in it are that shop's real stock — real covers, real
titles, real prices. Buy one and it's gone, because it was one-of-a-kind in the real world.
Thriftgod is the brain and the bank; PROCITY is the body.

## The tier ladder (the epoch's load-bearing idea)

Stock is a DATA TIER, like assets — each tier fully playable, each degrading softly to the one
below. This is the offline law made structural:

| tier | source | flag state | deterministic? |
|---|---|---|---|
| 0 · parody | seeded canvas sleeves (v1) | any boot, always works | yes — the QA baseline |
| 1 · static real | per-shop atlases baked from dealgod (G2a) | `?stock=real`, no server | yes — atlases are files |
| 2 · live GODVERSE | thriftgod server: live stock, sold-means-gone (G3) | server reachable | **no — by design** |

The seeded-everything law is NOT weakened: the *world* (geometry, layout, venues, citizens)
stays seeded and byte-identical; stock *contents* are inventory data riding the asset law.
QA gates run on tiers 0–1; tier 2 gets its own smoke class (reachability, fail-soft, latency)
that never gates a tag on server state.

## The stages

- **v5.0-alpha: THE FIRST REAL CRATE.** One real shop end-to-end — a Newtown record shop in
  `newtown_godverse`, static atlas (G2a), riffle real covers, buy, wallet debits, every tier
  degrades clean. Plus the **G3 design doc ratified** (both integrators + John) before any
  server code exists.
- **v5.0-beta: THE REAL SHOPPING TOWN.** Every hero shop in 1–2 godverse towns carries real
  static stock; godverse coverage grows where thriftgod's census is dense (fitzroy is the
  prize); pricing from thriftgod's `mint()` profiles baked into the atlases; the dig UX polished
  for real items (title/price cards are real data).
- **v5.0: THE LIVE TIER.** Thriftgod's server behind tier 2 per the ratified G3 design:
  live per-shop stock, sold-means-gone, reservation semantics — with the offline law proven by
  the gate (kill the server mid-session; the game degrades to tier 1 without a stutter). Tour,
  docs freeze, tag.

## The laws

Everything inherited (classic covenant `0x3fa36874` forever · determinism for the world ·
budgets · amendment law · measurement-over-brief · drops counted · fresh-context verification),
plus this epoch's own:

1. **The offline law (non-negotiable, from the standing G3 ruling): the server enriches, never
   gates.** Full offline play at tier 0 and tier 1, always. No boot path, gate, or tag may
   depend on a reachable server.
2. **The determinism boundary:** world = seeded, frozen, gated. Stock = data tiers. Tier 2 is
   openly non-deterministic and therefore never inside a golden or a byte-identical assert.
3. **The licence law (extends E's provenance spine):** item photos are the stores' own product
   shots — 🟢 for in-house play; **flagged before any public/commercial release** (G's own
   note, now law). No private-individual data, ever. Every atlas carries provenance.
4. **The write-back law:** game purchases NEVER mutate real thriftgod inventory without an
   explicit, John-ratified reservation design in the G3 doc. Until then tier 2 is read-live,
   sell-sandboxed. (Whether "sold in game" can mark real stock is John's call to make in the
   design review, not a default.)
5. **The two-studio law:** G owns `pipeline/godverse_*`, `web/assets/stock_godverse/**`,
   godverse caches, and the server side; A–F own their lanes; cross-repo contracts publish
   FIRST; both integrators sign the G3 design. **Merge amendment:** when a round's brief names
   a G deliverable as gating, G's branch merges mid-round after Fable-m3 review (G's file
   namespace is disjoint, so pathspec safety holds); otherwise boundaries as before.

## The risk list (kept current, v4-style)

1. **Latency/stutter at tier 2** — server calls must be async enrichment; the dig must never
   block on the network. The G3 doc owns the caching design.
2. **Atlas budgets at real density** — a mecca hero shop can hold hundreds of real items; C's
   interior ceilings are the law and the atlas contract must respect them (pagination/crate
   rotation rather than bigger atlases).
3. **Census↔OSM identity** — matching thriftgod shops to godverse lots is fuzzy (names drift,
   shops move). Mismatches must be counted and fail-soft to tier 0, never mis-stocked.
4. **Sold-means-gone semantics** — race conditions, reservations, and the write-back question.
   All design-doc territory; nothing ships before ratification.
5. **Settled non-risks:** the dig/wallet/stockAdapter machinery (shipped v2, soaked 16 rounds);
   static-atlas determinism (E's byte-identical pipeline discipline); the fail-soft ladder
   (proven pattern from `?noassets` day one).

### Retired-or-carried at the v5.0 close (ROUND27 ledger #6 — Lane A, line by line)

Verdicts against what shipped, not against the plan. Written in **wave 2**, so tier-2 items that F's reader
and kill-the-server gate will decide are **carried, not pre-retired** — the gate retires them, not this doc.

1. **CARRIED — and it is this round's defining gate, not a footnote.** The only risk here the epoch has not
   yet measured. The reader (#2) and the kill-the-server gate (#3) don't exist as I write this; **nothing
   retires this line except that gate going green** — boot server-up (live fields consumed), kill mid-session
   (degrade to tier 1, zero console errors, frame-time measured across the failure), boot server-down (pure
   tier 1). Until then the charter's offline law is a promise, and the whole point of #3 is that a promise
   isn't a gate. *(If tier 2 proves bigger than one round, F holds and this line simply carries — four holds
   have proven nobody forces an epoch close.)*
2. **RETIRED — the remedy the risk named is the remedy that shipped.** It predicted "pagination/crate
   rotation rather than bigger atlases", and that is exactly what happened: the mecca case is served by the
   **crate-rotation menu**, not by growing the sheet. Measured across all **15 keyed atlases**: max **2
   atlases/shop** against C's hard cap of 2; the 14 mint shops sit at **16 items / 1 atlas / 1024²** and only
   the one real POS shop earns 2048² (**120 items, 2 atlases, 1.2 MB**) under C §7.2's 60+ item rule. E's
   validator enforces the ceilings from the committed files alone. Total: 344 items.
3. **RETIRED — the risk was designed out, not solved.** It assumed a **fuzzy-matching** problem ("names
   drift, shops move") and demanded mismatches be counted. There is no matcher: identity is an **explicit
   opaque key** (`godverseShopId`) that G emits, so there is nothing to mis-match. The predicted failure
   couldn't occur in the predicted form — and the case that would have broken any name-matcher proves it:
   **Monster Robot Party is in neither the census nor OSM**, so no matching strategy could ever have found
   it; it is keyed by injection. Mis-stocking is fenced structurally instead: duplicate ids **error**,
   uniqueness runs over defined ids, and the **orphaned-atlas gate** fails if a stocked shop isn't seated.
4. **SPLIT — the write half RETIRED by ruling, the read half CARRIED to F's #4.** *Write-back:* retired, and
   retired properly — John's **A-then-B** ruling is recorded as **mechanism, not config**: `/reserve` and
   `/buy` are **ABSENT, not stubbed**. Race conditions and reservation semantics cannot occur because the
   verbs do not exist; "prove the absence" is a stronger guarantee than any sandbox flag, since a sandbox a
   config typo can flip isn't a sandbox. *(Option B's reservation upgrade is chartered as v5.x, behind a
   hold budget — it re-opens this line deliberately, when it is built.)* *Read (`gone`, real→game):* carried
   — F's #4 asserts both directions this round.
5. **Unchanged, and extended by what the epoch settled:** static-atlas determinism proved in practice
   (byte-identical re-bakes, including G's index-only sku re-emit that moved no `.webp` bytes); the
   fail-soft ladder proved on every rung; and the **id-space fences** (`sku_`/`mint_`, plan-id vs
   godverse-id) now have case law behind them rather than good intentions.
6. **NEW, CARRIED — the orphaned atlas.** The lift legitimately drops shops (overlap-resolve, counted since
   R19); dropping one that carries a **committed atlas** means real stock keyed to a shop that isn't in the
   town. Gated in `selfcheck` since R25 and **currently green** — and the gate armed itself this round
   without anyone touching it: it SKIPped on `newtown_godverse` while no atlas keyed there, and **began
   binding the moment G's mint atlases landed**. Live near-miss on the books: `redhill_godverse`'s lift drops
   keyed shop **2286 "Empire Revival"**; G stocked its numeric neighbour **2287** instead. Carried because
   the hazard grows with every shop stocked — **stocking 2286 would orphan it today.**
7. **NEW, CARRIED — "real" is one shop wide.** 14 of 15 keyed atlases are **mint**; exactly one is a POS
   snapshot, because exactly one shop has a POS. That is honest and marked (`sourcing`), not a defect — but
   the epoch's headline claim rests on **one** shop, and any future claim of scale needs either more POS
   shops (v5.x: "if monsterrobot ever gets siblings") or continued care that `sourcing` stays legible to
   humans, not just gates.