PROCITY/docs/RETRO_V5.md

PROCITY v5 — THE REAL SHOP: the epoch retro

Fable (m3, integrator), 2026-07-17, written after the v5.0 tag (b2d29ba) per ROUND27 §7. Epoch span: R23 → R27. Tags: v5.0-alpha → v5.0-beta → v5.0. The first two-studio epoch: Lane G (ultra) went from merged guest to the lane that shipped the epoch's server.

What shipped, in one breath

The tier ladder, whole: 344 real-or-minted items across 15 keyed crates in two godverse towns, every crate distinct (105 pairs, 0 shared titles), sourcing-honest (real/mint as law, prefixes as namespace fences); Monster Robot Party's actual crate 550 riffled and bought in-game off its actual POS; tier 2 live — read-only endpoints over the real till, fences enforced at the DB credential, /reserve+/buy absent by John's A-then-B ruling; and the epoch's defining proof: a real HTTP server killed mid-session costs the game Δ+2 ms and exactly one refused connection — the offline law as an executable, not a sentence. Plus the finale nobody ordered: every shopfront in every town finally faces its street.

The five holds — the epoch's spine

Every hold was correct; every hold traced to the same species (a rule or contract meeting a case written before the case existed); every hold was released by its owner, never by the beneficiary:

1. R23 — the crate was real but had no street, no identity, no compatible contract; the gate built to catch it was blind-green, and #7a as briefed would have passed vacuously.
2. R24→25 — E's rebuild sat uncommitted; tagging would have produced a tag whose tree lacked the code that produced its green.
3. R26 — the mint-id rule demanded a POS sku from crates that never saw a till; G refused the easy green because colliding id spaces in the economy layer eventually sells the wrong record.
4. R27 (reader) — "zero console errors on server death" was physically impossible; the replacement (exactly one refusal) is strictly stronger because it proves the breaker.
5. R27 (facade) — the fifth hold found the oldest bug in the project.

The finale: the facade, and the covenant amendment

B's frontage helper — a micro-task — exposed that plan_osm aimed lots' −Z at the street while buildings.js draws facades on +Z. The wave-5 ruling named it "every real town since R18" and ordered A to measure the marched path rather than assume it clean. A's measurement caught the ruling's own premise: it was EVERY town, EVERY path, since v1 — all four seating sites wrote atan2(outward) under comments that said -outward; 637 of 681 synthetic lots faced no street at all; the classic covenant town was a row of back walls, and A proved it the only way left — standing in the street, looking at NUMBAT PLAYTHINGS facing the dirt.

John ruled the covenant amendment, and his ruling is the epoch's best line: the covenant is anti-drift machinery, not a defect preservative. 0x3fa36874 did its job for five epochs — it never drifted. It was never right, and no hash can catch what was wrong in the first commit. A golden proves nothing changed; it cannot prove anything is correct. 51 goldens re-pinned in one commit; F re-pinned its own files per A's handoff (lane boundaries held to the last); and A caught, in passing, a bare-string OR-clause in F's classic gate that would have gone green off a sentence about the old covenant. The cross-convention gate is now in the selfcheck so the two conventions are compared against each other forever.

The epoch's signature species: the vacuous gate

Named as law in R24, then found NINE times — including three inside the law's own applications: the empty-glob validator, the covers-render #7a, my id-equality gate spec (positional ids collide), F's selector entering the wrong shop, the silent licence line, the impossible zero-errors assert, F's 72/72 self-agreement (testing a spec line's data against the same line), F's attempt-4 error-check (the call succeeded; the pose was never applied), and the stdout OR-clause. The case law that came out of it is the epoch's real export:

• A gate proves it touched its subject (fetch log, matched-file count, id equality — something falsifiable) or it is not a gate.
• The collateral assertion: when correct and broken implementations both hide the obvious evidence, assert on what discriminates (the other 119 records unchanged).
• Cross-convention checks: two subsystems implementing "the same" convention are compared against each other, never each against its own spec line.
• Control-deltas for performance: an absolute threshold measures the wrong thing politely.
• A named exception starts protecting new bugs the moment the real fix exists (F's 404 tolerance — deleted, and the deletion caught a ninth invisible probe).
• Id prefixes are namespace fences; plan ids, godverse ids, POS skus and listing ids are four spaces, and no bare number crosses them.

What worked — keep doing

1. Restraint under benefit. F declined to touch A's sweep, E's validator, and E's uncommitted file across three separate holds where one edit would have unblocked its own tag; B proved the facade one-liner and reverted it; A handed F's re-pins to F instead of editing F's files. The party that benefits never releases its own hold.
2. Ownership sentences. "The red was mine" (E) · "my rule was the stale thing" (C) · "it fired 54/72 on a good town" (A) · "four of the five attempts were F's fault" (F). Nobody defended; everybody measured.
3. The contract's author is the authority for the contract's shape — and when contract and runtime disagree, the runtime is the authority (R24's root-cause ruling).
4. Machine-enforced fences beat reviewed promises: the read-only credential (measured permission-denied), 501s for absent verbs, metadata-only responses.
5. The two-studio pattern matured: G went from branch-merged guest (R23) to full lane on main (R25) to shipping the epoch's server (R27), with John's rulings recorded as mechanism.

What cost us — fixed or fenced

1. Comments and specs are not measurements. All four facade sites' comments described the correct behaviour above code doing the opposite, for 27 rounds. The cross-convention gate is the fix; the lesson is older: nothing is true because a document says it.
2. Consistency masquerades as correctness. Every subsystem agreed with itself, so every gate was green over a wrong world; only a human in the street saw it. Money shots and walk-arounds are QA, not decoration — John's browser stroll started the v6 charter, and A's street-level eyeball confirmed the covenant bug.
3. My briefs carried five corrected errors this epoch (the tier field, the id-equality gate, the zero-errors assert, the "wire on entry" default that F correctly made opt-in, and the wave-5 premise). All five were caught by the contract-first channel or by measurement before they became bugs. Briefs state acceptance; lanes own method; the integrator is not exempt from measurement-over-brief.

Carried forward

• v5.x: Option B reservation (chartered, behind John's hold budget) · tier-2 auto-discovery (needs a reachability contract) · more POS shops if monsterrobot gains siblings · a shop-ops note for John, not a code item: the POS has recorded no sale since 2026-07-01 — G proved the dump is fresh but the data is stale; worth checking the till's sync before the next live demo.
• v4.x tail (unchanged): thin-tail clustering floor · seating overflow tail · instrument LOD · tram-stop tri diet · awning ripple · audioEmitter · flag retirement.
• v6 — THE LIVING STREET: charter drafted (docs/V6_LIVING_STREET.md), spikes gated on John's mocap vids (the MOCAPGOD queue is still empty) and the MOCAPGOD-C/MIRPAMO integration call on ultra.

— Fable. Twenty-seven rounds, eleven tags, five correct holds, one amended covenant. The game now sells a record that is really in the crate, in a shop that is really on the street, in a town that is really in Australia — and for the first time since v1, the shops are facing you when you walk up the road.