PROCITY/docs/RETRO_V5.md

# PROCITY v5 — THE REAL SHOP: the epoch retro

*Fable (m3, integrator), 2026-07-17, written after the `v5.0` tag (`b2d29ba`) per ROUND27 §7.
Epoch span: R23 → R27. Tags: `v5.0-alpha` → `v5.0-beta` → `v5.0`. The first two-studio epoch:
Lane G (ultra) went from merged guest to the lane that shipped the epoch's server.*

## What shipped, in one breath

The tier ladder, whole: **344 real-or-minted items across 15 keyed crates in two godverse
towns**, every crate distinct (105 pairs, 0 shared titles), sourcing-honest (`real`/`mint` as
law, prefixes as namespace fences); Monster Robot Party's actual crate 550 riffled and bought
in-game off its actual POS; **tier 2 live** — read-only endpoints over the real till, fences
enforced at the DB credential, `/reserve`+`/buy` absent by John's A-then-B ruling; and the
epoch's defining proof: **a real HTTP server killed mid-session costs the game Δ+2 ms and
exactly one refused connection** — the offline law as an executable, not a sentence. Plus the
finale nobody ordered: **every shopfront in every town finally faces its street.**

## The five holds — the epoch's spine

Every hold was correct; every hold traced to the same species (a rule or contract meeting a
case written before the case existed); every hold was released by its owner, never by the
beneficiary:

1. **R23** — the crate was real but had no street, no identity, no compatible contract; the
   gate built to catch it was blind-green, and #7a as briefed would have passed vacuously.
2. **R24→25** — E's rebuild sat uncommitted; tagging would have produced a tag whose tree
   lacked the code that produced its green.
3. **R26** — the mint-id rule demanded a POS sku from crates that never saw a till; G refused
   the easy green because colliding id spaces in the economy layer eventually sells the wrong
   record.
4. **R27 (reader)** — "zero console errors on server death" was physically impossible; the
   replacement (exactly one refusal) is strictly stronger because it proves the breaker.
5. **R27 (facade)** — the fifth hold found the oldest bug in the project.

## The finale: the facade, and the covenant amendment

B's frontage helper — a micro-task — exposed that `plan_osm` aimed lots' −Z at the street
while `buildings.js` draws facades on +Z. The wave-5 ruling named it "every real town since
R18" and ordered A to *measure the marched path rather than assume it clean*. **A's measurement
caught the ruling's own premise: it was EVERY town, EVERY path, since v1** — all four seating
sites wrote `atan2(outward)` under comments that said `-outward`; 637 of 681 synthetic lots
faced no street at all; the classic covenant town was a row of back walls, and A proved it the
only way left — standing in the street, looking at NUMBAT PLAYTHINGS facing the dirt.

**John ruled the covenant amendment**, and his ruling is the epoch's best line: *the covenant
is anti-drift machinery, not a defect preservative.* `0x3fa36874` did its job for five epochs —
it never drifted. It was never right, and no hash can catch what was wrong in the first commit.
**A golden proves nothing changed; it cannot prove anything is correct.** 51 goldens re-pinned
in one commit; F re-pinned its own files per A's handoff (lane boundaries held to the last);
and A caught, in passing, a bare-string OR-clause in F's classic gate that would have gone
green off a *sentence about* the old covenant. The cross-convention gate is now in the
selfcheck so the two conventions are compared against each other forever.

## The epoch's signature species: the vacuous gate

Named as law in R24, then found NINE times — including three inside the law's own
applications: the empty-glob validator, the covers-render #7a, my id-equality gate spec
(positional ids collide), F's selector entering the wrong shop, the silent licence line, the
impossible zero-errors assert, F's 72/72 self-agreement (testing a spec line's data against
the same line), F's attempt-4 error-check (the call succeeded; the pose was never applied),
and the stdout OR-clause. The case law that came out of it is the epoch's real export:

- **A gate proves it touched its subject** (fetch log, matched-file count, id equality —
  something falsifiable) or it is not a gate.
- **The collateral assertion**: when correct and broken implementations both hide the obvious
  evidence, assert on what discriminates (the other 119 records unchanged).
- **Cross-convention checks**: two subsystems implementing "the same" convention are compared
  against each other, never each against its own spec line.
- **Control-deltas for performance**: an absolute threshold measures the wrong thing politely.
- **A named exception starts protecting new bugs the moment the real fix exists** (F's 404
  tolerance — deleted, and the deletion caught a ninth invisible probe).
- **Id prefixes are namespace fences**; plan ids, godverse ids, POS skus and listing ids are
  four spaces, and no bare number crosses them.

## What worked — keep doing

1. **Restraint under benefit.** F declined to touch A's sweep, E's validator, and E's
   uncommitted file across three separate holds where one edit would have unblocked its own
   tag; B proved the facade one-liner and reverted it; A handed F's re-pins to F instead of
   editing F's files. The party that benefits never releases its own hold.
2. **Ownership sentences.** "The red was mine" (E) · "my rule was the stale thing" (C) ·
   "it fired 54/72 on a good town" (A) · "four of the five attempts were F's fault" (F).
   Nobody defended; everybody measured.
3. **The contract's author is the authority for the contract's shape** — and when contract
   and runtime disagree, **the runtime is the authority** (R24's root-cause ruling).
4. **Machine-enforced fences beat reviewed promises**: the read-only credential (measured
   permission-denied), 501s for absent verbs, metadata-only responses.
5. **The two-studio pattern matured**: G went from branch-merged guest (R23) to full lane on
   main (R25) to shipping the epoch's server (R27), with John's rulings recorded as mechanism.

## What cost us — fixed or fenced

1. **Comments and specs are not measurements.** All four facade sites' comments described the
   correct behaviour above code doing the opposite, for 27 rounds. The cross-convention gate
   is the fix; the lesson is older: nothing is true because a document says it.
2. **Consistency masquerades as correctness.** Every subsystem agreed with itself, so every
   gate was green over a wrong world; only a human in the street saw it. Money shots and
   walk-arounds are QA, not decoration — John's browser stroll started the v6 charter, and
   A's street-level eyeball confirmed the covenant bug.
3. **My briefs carried five corrected errors this epoch** (the `tier` field, the id-equality
   gate, the zero-errors assert, the "wire on entry" default that F correctly made opt-in,
   and the wave-5 premise). All five were caught by the contract-first channel or by
   measurement before they became bugs. Briefs state acceptance; lanes own method; the
   integrator is not exempt from measurement-over-brief.

## Carried forward

- **v5.x**: Option B reservation (chartered, behind John's hold budget) · tier-2
  auto-discovery (needs a reachability contract) · more POS shops if monsterrobot gains
  siblings · **a shop-ops note for John, not a code item: the POS has recorded no sale since
  2026-07-01 — G proved the dump is fresh but the data is stale; worth checking the till's
  sync before the next live demo.**
- **v4.x tail** (unchanged): thin-tail clustering floor · seating overflow tail · instrument
  LOD · tram-stop tri diet · awning ripple · audioEmitter · flag retirement.
- **v6 — THE LIVING STREET**: charter drafted (`docs/V6_LIVING_STREET.md`), spikes gated on
  John's mocap vids (the MOCAPGOD queue is still empty) and the MOCAPGOD-C/MIRPAMO
  integration call on ultra.

*— Fable. Twenty-seven rounds, eleven tags, five correct holds, one amended covenant. The game
now sells a record that is really in the crate, in a shop that is really on the street, in a
town that is really in Australia — and for the first time since v1, the shops are facing you
when you walk up the road.*