PROCITY/docs/LANES/LANE_F_NOTES.md

# LANE F — NOTES (integration runbook + QA gates)

*Lane F is integration + QA. It runs **after** A–E land. This file is the durable technical spec:
the exact wiring edits, the contracts F needs from each lane, and the QA gate procedures. It is
written **before** A–E finished so the wiring is a fast, mechanical pass the moment they do —
and so each lane can see the small hook F will ask of it and build it in up front.*

Status of this file: **living**. Update the ✅/⏳ markers as wiring lands. Snapshot of lane
readiness lives in [`F-progress.md`](../../F-progress.md); run `node tools/qa/scaffold_check.mjs`
for the live matrix.

> **v2.0 FROZEN (round 9).** Nine rounds: seed → walkable town → weather, a shopping crowd,
> follow-a-ped-into-a-shop presence, and real stock you can buy. Current gate reality + the
> final v2 flags table live in [`F-progress.md`](../../F-progress.md); `qa.sh --strict` GREEN 5/5
> (scaffold+determinism · consistency · citygen selfcheck · manifest --depot · v2 flags harness STRICT).
> CityPlan v2 contract frozen by Lane A in CITY_SPEC; validated live by selfcheck (1727/1727) + goldens.

---

## 0. Ground truth / environment

- Repo root on this machine: `/Users/m3ultra/Documents/procity` (the lane prompts say
  `/Users/jing/Documents/PROCITY` — that path is from the authoring machine; **use the real path
  above**). Reference repos are cloned alongside: `../90sDJsim`, `../thriftgod`. Ultra box
  (existing 3D library / Blender / clip bank): `ssh johnking@100.91.239.7`.
- Serve: `cd web && python3 -m http.server 8130`. Node 26, Python 3.14 present.
- `web/package.json` has `"type":"module"` (Lane A) so `node web/js/**/*.js` runs as ESM.
- **F never edits another lane's internals.** F adds *wiring* — new files it owns, and small,
  clearly-marked hook edits at the seams. Where a hook must live inside a lane's file, F first
  looks for the hook that lane already exposed (see contracts below); the lane owns its file, F
  owns the glue.

## 1. Files Lane F owns / creates

| path | purpose |
|---|---|
| `tools/qa.sh` | the QA gate runner (scaffold + citygen selfcheck + manifest validator) ✅ |
| `tools/qa/scaffold_check.mjs` | scaffold + PRNG determinism law + **live lane-readiness matrix** ✅ |
| `tools/shots.py` | Playwright tour-capture → `docs/shots/v1_tour/` + contact sheet (ported from 90sDJsim `tools/shots.py`) |
| `tools/soak.py` | Playwright 10-minute scripted-walk soak (chunk/heap/leak/error gate) |
| `web/js/citygen/index.js` | barrel so B's `import('./js/citygen/index.js')` resolves to A's `plan.js` ✅ (§3.1) |
| `web/js/world/interior_mode.js` | **interior bridge** — B's shell ↔ C's `buildInterior`; owns the `interior` mode branch ✅ (§3.2) |
| `docs/V2_IDEAS.md` | parked-scope catalogue ✅ |
| `docs/shots/` | reference shot tree (`laneA…E/`, `v1_tour/`, `before/`, `references/`) |
| `F-progress.md` | status report for fable |

The wiring is kept as **focused F-owned modules** (e.g. `interior_mode.js`) that the shell imports,
rather than logic sprinkled through B's files. Each seam edit inside `index.html` is one line,
commented `[Lane F integration]`, and reversible. That keeps ownership clean: B owns the shell +
mode machine, C/D own their libraries, F owns the glue modules and the marked seams that call them.

---

## 2. Contracts F depends on (verify these as lanes land)

Pulled from CITY_SPEC + each lane prompt. The scaffold check's readiness matrix tracks presence;
these are the **shapes** F wires against. If a lane ships a different shape, fix it here and in
the wiring, not by guessing.

> **⚠ Corrected against the REAL landed code (2026-07-14).** The bullets below are what the lanes
> actually shipped — several differ from the spec-derived guesses in an earlier draft (verified by
> reading each file + the Lane F self-audit workflow).

**Lane A — `web/js/citygen/plan.js`** *(landed, verified)*
- `generatePlan(citySeed) → CityPlan` (schema in CITY_SPEC §Layer 1). <3ms, deterministic, JSON-clean.
- `chunkIndex(plan) → { chunkSize, chunks }` where `chunks["cx,cz"] = { lots:[id…], shops:[…], edges:[…] }`
  (a **plain object, not a callable**; a lot may bucket into several chunks). Also exports `chunkKey(cx,cz)`.
- `web/js/core/registry.js` exports `SHOP_TYPES` — per type `{ label, facades:[<full filename>.jpg…],
  sign, interior, fittings:[…], storeys:[min,max], hours:{open,close} }`. **`facades` are full
  filenames** (`facade-timber-teal.jpg`), not bare keys — see the skins seam in §7.
- `web/map.html` — 2D plan viewer (verified rendering real towns). `web/js/citygen/index.js` **is the
  barrel Lane F added** so the shell's `import('./js/citygen/index.js')` resolves (§3.1).

**Lane B — `web/index.html` + `web/js/world/*`** *(landed, verified live)*
- Mode state machine `MODE ∈ {map, street, interior}` (interior branch not yet used), one renderer.
- **`createChunkManager(plan, scene, ctx)`** — a **factory**, not a class; returns
  `{ update(pos), warmup(pos), getColliders(x,z), setNight(bool), getDoorMeshes(), count, dispose() }`.
  **No `onChunkBuilt/onChunkDisposed` lifecycle hooks** — so §3.3 must drive citizens off the street
  graph, not chunk lifecycle (or F adds a hook; prefer graph-driven).
- Door pick is wired via HUD: `createHUD({ onEnterShop: (shopId,name)=>enterShop(...) })`; `enterShop()`
  dispatches `procity:enterShop` and is otherwise **a stub** (`hud.showToast('interiors coming')`) —
  this is the seam F completes in §3.2. Interior returns via `procity:exitShop`.
- HUD shows draws / tris / fps / seed / time-of-day (F reads these for the budget gate).
- Exposes `window.PROCITY = { plan, scene, camera, renderer, chunks, lighting, player, skins }`
  (F builds the `window.DBG` harness hook on top of this — §4).

**Lane C — `web/js/interiors/interiors.js`** *(landed, verified)*
- `buildInterior(shop, THREE, opts={registry,archetype,stockAdapter}) → { group, spawn:{x,z,ry},
  exits:[…], places:[…], dims, recipe:{counterPos,…}, dispose() }`. Matches the wiring plan.
- Caller must attach lot dims: pass `{ ...shop, lot: plan.lots.find(l=>l.id===shop.lot) }`.
  `dispose()` frees tracked GPU resources (soak gate asserts baseline).

**Lane D — `web/js/citizens/*`** *(landed, verified)*
- `sim.js` exports **`class CitizenSim`** — `new CitizenSim({ renderer, scene, camera, citySeed,
  graph, fleet, group })`. It is **street-graph driven, not per-chunk**: there is no
  `spawnRoster/despawn/setDaySegment` — build it once from the street graph and tick it in the loop.
- `keepers.js` exports **`class KeeperManager`** — `new KeeperManager({ camera, citySeed, fleet })`,
  then `spawn(target, { x, z, ry, shopId, type }) → handle`, `remove(handle)`, `disposeAll()`,
  `update(dt, playerPos)`. (Not `spawnFor/disposeFor`.)

**Lane E — `web/assets/manifest.json` + `pipeline/validate_manifest.py`**
- Manifest: `{depot, fittings:{id:{file,footprint,thumb}}, furniture:{…}, skins:{facade,sky,ground,wall,interior}}`.
- `python3 pipeline/validate_manifest.py` green (F's gate 5 runs it).
- B/C read the manifest for GLB upgrades; **primitive fallbacks must still fire under `?noassets=1`**.

---

## 3. Wiring checklist (LANE_F §Wiring — expanded to exact steps)

All of this lives in `web/js/world/wiring.js` (F-owned) + the minimal hooks each lane exposes.

### 3.1 Plan source swap (A → B) ✅ DONE (verified live)
- Lane B already reads `?seed=N` (default `20261990`), guards the citygen import, and surfaces the
  town name + seed in the start panel and HUD. **But it imported `./js/citygen/index.js`, which did
  not exist** (Lane A shipped `plan.js`), so it silently fell back to the 14-shop fixture.
- **Fix:** Lane F added `web/js/citygen/index.js` (barrel re-exporting `generatePlan/chunkIndex/chunkKey`
  from `plan.js`). Verified live: shell logs "using Lane A generatePlan", HUD shows the real town
  ("Boolarra Heads", 523 shops), 31 chunks stream.
- Map key **M** is wired by Lane B to an in-shell minimap (not map.html). Fine for v1.
- **Gate:** plan determinism asserted green by `scaffold_check.mjs`. Map-PNG determinism pending the
  shot harness + DBG hook (§4).

### 3.2 enterShop → interiors (B ↔ C) ✅ DONE (verified live, 2026-07-14)
Implemented as an **F-owned bridge module `web/js/world/interior_mode.js`** (`createInteriorMode`),
plus a thin marked seam in the shell. The bridge renders the interior into its **own dark
THREE.Scene** — the street scene is simply left frozen (not disposed → instant return, CITY_SPEC L3
"pause, not dispose"), which is cleaner than hiding B's ground+chunk meshes in a shared scene.
```
enterShop(shopId, name):                                  // shell seam (was the toast stub)
  shop = plan.shops.find(s => s.id === shopId)            // id is numeric; matches door.shopId
  lot  = plan.lots.find(l => l.id === shop.lot)           // attach {w,d} — Lane C sizes the room to it
  interiorMode.enter({ ...shop, lot:{w,d} }, name); setMode('interior')
interiorMode.enter(shop):                                  // F module
  current = buildInterior(shop, THREE); scene.add(current.group)  // Lane C
  doorReturn = {x,y,z,ry of the player on the street}
  camera → current.spawn (x, 1.6, z, ry); exitArmed = false
loop [MODE==='interior']: if interiorMode.update(dt,keys) leaveShop()
  update: walk via current._debug.grid occ/bounds (mirrors interior_test.html) → renderer.render(ownScene)
          exit arms once player steps >2m from the door, then fires within 1m of exits[].toStreet
leaveShop() / 'procity:exitShop' / Esc(unlock):            // three exit routes, all → leaveShop
  interiorMode.exit(): current.dispose() (frees GPU + unparents); camera → doorReturn
  setMode('street')                                        // pointer stayed locked → walking resumes at once
```
- **Verified live** (seed 20261990 "Boolarra Heads"): door → **Toy Shop "Numbat Playthings"**
  renders (ivy wallpaper, stocked shelves, counter, exit doorway); exit state-machine correct
  (no instant-exit at spawn; arms then fires at the door); **leak-free** — GPU memory 134 geo/37 tex
  → 217 loaded → **back to 134/37 after `dispose()`**. Swept **all 9 shop types** (toy/video/pawn/
  opshop/book/record/stall/dept/milkbar), every one `ok+pathOK+leftClean`, worst build **8.4ms**
  (budget 50), zero console errors.
- **Gate:** determinism (byte-identical placement per seed) is asserted by Lane C's own soak page;
  memory-to-baseline after `dispose()` confirmed above. Real pointer-lock walk-in is the one bit the
  automated browser can't drive — needs a human (or the DBG hook in §4).

### 3.3 Citizens + keepers (D)
**Keepers ✅ DONE (verified live).** Wired into the interior bridge (`interior_mode.js`), not the shell:
`new KeeperManager({ camera, citySeed: plan.citySeed })` — **no `fleet` passed → asset-free placeholder
actor** (rig-fleet upgrade is later, with §3.4). On `enter`, find the counter interactable
(`places.find(p => p.userData.keeperStand)` — Lane C tags `{x,z,ry}` there) and
`keepers.spawn(interior.group, { x, z, ry, shopId, type })`; tick `keepers.update(dt)` each interior
frame (playerPos defaults to the camera); `keepers.disposeAll()` on `exit`, before the room disposes.
- **Verified:** placeholder keeper (11-mesh humanoid) stands at the counter pose (record shop:
  `{2.55,-2.46, ry 1.571}`), **turns to greet** a nearby player (0.21 rad) and eases back when they
  leave (~0), disposes to 0. **Leak-free**: 5 enter/leave cycles over 5 shop types → after-leave
  memory constant at 96 geo/16 tex, **net growth 0**; 0 console errors.

**CitizenSim (street peds) ✅ DONE (verified live).** Happy surprise: **`plan.streets` already IS the
graph** — `{ nodes:[{id,x,z}], edges:[{id,a,b,width,kind}] }` — so `graph: plan.streets` passes
straight in, **no adapter needed** (the runbook's earlier `streetGraphFrom` is unnecessary). In the
shell: `new CitizenSim({ renderer, scene, camera, citySeed: plan.citySeed, graph: plan.streets })`,
`setPopulation(140)` (`?pop=` tunable), then in the **street** branch each frame:
`setTimeOfDay((clk.seg + clk.frac)/6)` + **`update(dt)`** — note `update` takes **only dt** and reads
`this.camera.position` internally (the runbook's `update(dt,pos)` was wrong). `visibilitychange →
setPaused`. No fleet → asset-free placeholder(near)/impostor(mid) tiers; sim self-manages NEAR/MID/FAR
LOD off camera distance (not chunk-driven — chunks.js has no lifecycle hook).
- **⚠ gotcha (fixed):** `getClock().hour` is a **display string** (`'12:30'`), so `hour/24` → NaN →
  0 peds. Use the numeric day fraction `(seg + frac)/6` instead.
- **Verified:** 140 pop → **96 active midday** (density curve; `~7` at night), peds walk footpaths at
  ~1.5 m/s, deterministic per seed (Lane D property; F passes the same graph+seed). **Budget:** 1 near
  placeholder ≈ **11 draws** (11 meshes), bounded by `NEAR_MAX=24`; but a hamlet never fills it —
  worst across all 6 main/high edges was **near 3, ~191 composer draws** (budget 300). Coexists with
  interiors+keepers (round-trip regression clean); 0 console errors.
- **Note for §3.4:** placeholder near-tier is the draw cost; the **rig-fleet upgrade** (shared meshes +
  impostor promotion) is what lets `?pop=` rise well past 140. Until then 140 is the safe lively default.

### 3.4 Manifest + `?noassets` + rig-fleet upgrade ✅ DONE (R3, verified live)
Wired in the shell (all gated by `NOASSETS = ?noassets=1`):
- **Rig fleet:** `loadPedFleet('models/peds/')` (19 char GLBs + walk/idle clips exist locally) → passed
  to `new CitizenSim({…,fleet})` and (via `createInteriorMode({…,fleet})`) to `KeeperManager`. Peds +
  keeper **upgrade placeholder→shared GLB rigs** once `fleet.whenReady` resolves (verified:
  `citizens.mode==='rig'`, `keeperKind==='rig'`, detailed characters on the street + behind counters).
- **Interior GLB:** `preloadManifest()` at boot + `buildInterior(shop,THREE,{useGLB:!NOASSETS})` →
  Lane C `glb.js` swaps fitting primitives for **depot GLBs** (`depot:<file>` → 3GOD, reachable).
  Verified: bookshop fittings load real GLBs (+8 meshes, dense shelves). *Not all kinds map* — `counter`
  is intentionally primitive; `record_crate` is a known-failing GLB → fail-soft to primitive.
- **`?noassets=1`:** `fleet=null`, manifest not preloaded, `useGLB=false`. Verified **zero network**
  (Performance API: 0 GLB, 0 depot, 0 manifest, 0 ped-model requests); 100% primitive, still legible.
- **Leak-free:** rig keeper + interior GLBs dispose clean — the persistent geometry is the intentional
  **shared `loadGLB` cache** (cold entry +N geo, re-entries flat: proven cycle2/3 = 189→189). soak.py
  pre-warms this cache so the gate is honest.
- **⚠ finding (D/E):** GLB **character models are triangle-heavy** (~45k each near rig) → busiest view
  tris ~279k, soak peak ~1.0M, over the **200k** soft budget. Draws are fine (~200/300). **Decimate the
  ped GLBs** (and heavy fittings) to hit the tri budget; **F holds `?pop=140`** until then (raising pop
  adds near rigs = more tris). See Cross-lane requests §9.

### 3.5 Hours / closed shops ✅ DONE (R3, verified live)
- `currentHour()` parses `lighting.getClock().hour` (`'HH:MM'`→float); `isOpen(shop)` = `open ≤ H < close`.
  Both exposed on `window.PROCITY`. **`enterShop` gates on it**: closed → `🔒 CLOSED · opens HH:00`, no build.
- Lane A ships exactly one **`openLate:true`** landmark/town — always the **video rental** (Video Regal
  `[11,23]` etc.). Verified: **midday** toy shop `[10,16]` enters; **night (22:00)** toy shop blocked,
  **only the video shop opens** (the night destination).
- **Cross-lane (B):** the facade *visual* closed-state (dark windows + CLOSED plate) + a "CLOSED" door
  tooltip are Lane B's rendering — `window.PROCITY.isOpen(shop)` is the predicate. See §9.

### 3.5 Hours / closed shops (A data → B facade + C gate) ⏳
- `isOpen(shop, seg)` from `shop.hours:[open,close]` vs the current day segment (map 6 segments →
  hour). Closed ⇒ B renders dark windows + CLOSED plate (facade state); enterShop → locked toast.
- Exactly one late-night shop per town (Lane A seeds a shop whose `hours` run late). **F asserts it
  exists**: `plan.shops.some(s => s.hours[1] >= 22)` (tune threshold to A's convention).
- **Gate:** at night, ≥1 open shop; closed shops visibly closed + un-enterable.

---

## 4. QA gates — ALL GREEN ✅ (v1.0 criterion met, R4). `tools/qa.sh --strict` is the static umbrella.

Measured against the fully-committed R4 tree (seed 20261990, "Boolarra Heads"), verified live +
by a 6-auditor adversarial v1-readiness workflow (2026-07-14) → **GO**.

| # | gate | criterion | result (R4) |
|---|---|---|---|
| 1 | **Determinism** | seed → identical plan (deep-equal + golden fingerprint) + selfcheck | ✅ scaffold_check green; selfcheck **1301/1301**, fingerprint **0x3fa36874** (intended A2 shift, not drift); two node processes → identical `sha256(plan)` per seed; chunkIndex covers every lot |
| 2 | **Soak** | walk ≥30 chunks, ≥15 shops; geo/tex baseline after each interior; heap stable; **0** console errors | ✅ **37 chunks, 20 shops, heap 38→38 MB, 0 errors, leak-free** |
| 3 | **Budget** | busiest intersection: ≤300 draws, ≤200k tris (settled clean measure) | ✅ **draws 138 · tris ~31k** (baseline 372k; peds decimated 924k→46k ≤3k each, D2 sign-off) |
| 4 | **Asset-free** | `?noassets=1` full playthrough, zero crashes, zero network | ✅ **heap 13→13 MB, 0 errors, 0 asset requests** |
| 5 | **Selfchecks** | `selfcheck.js` + `validate_manifest.py --depot` green via qa.sh | ✅ **qa.sh --strict 4/4**; manifest `--depot`: **23 GLBs live, 0 err** |
| 6 | **Shots** | `docs/shots/v1_tour/` 10 beauty shots + contact sheet | ✅ **10 full-frame 1280×720, no letterbox**, 3 new poses resolve; incl. §3.5 **night closed-facade** (CLOSED plates + lit openLate video) + real **record/opshop interiors** (keeper + hero props) |

> Note: soak peak-draw/tri *warnings* are transient teleport/impostor-atlas-bake sampling spikes;
> gate 3's settled busiest-intersection measure is the authoritative budget check (draws 138 / tris 31k).

### DBG hook — LANDED (Lane B `web/js/world/dbg.js`, `?dbg=1`)
`window.DBG` exposes `ready / shot(name) / teleport(x,z,ry) / setSegment(seg) / enterShop(id) /
exitShop() / info()` and drives `tools/shots.py` + `tools/soak.py` (mirrors 90sDJsim's `window.DBG`).
Bookmarks: street_noon, arcade, market_square, milkbar_dusk, night_neon, crossroads_busy,
residential_collar, warehouse_fringe. **Interior tour shots** (record/opshop) are captured by
`enterShop(id)` directly (not via `shot()`, which forces street mode) — see `tools/shots.py`.

---

## 5. Order of operations once lanes land

1. ✅ `node tools/qa/scaffold_check.mjs` — A's plan determinism + registry confirmed present.
2. ✅ Wire §3.1 (plan swap) → generated seed boots on the shell (barrel + skins fix, verified live).
3. ✅ Wire §3.2 (interiors) → door opens, enter/walk/exit + dispose verified across all 9 types.
4. ✅ Wire §3.3 (citizens + keepers) → keeper greets at the counter; peds walk the graph, budget-safe.
5. ✅ Wire §3.4 (manifest + `?noassets` + rig-fleet) and §3.5 (hours) — all verified live (R3).
6. ◑ Gates: 2 & 4 **PASS** (soak/asset-free), 5 **GREEN** (`--depot`), 3 tris-blocked on D/E decimation,
   6 shots need Lane B bookmark poses. `docs/shots/v1_tour/` captured.
7. ⏳ `tools/qa.sh --strict` green + gate 3 tris ⇒ tag v1 (pending D/E ped-GLB decimation).

## 7. Live smoke-test findings (2026-07-14, real generated town, seed 20261990)

Booted the wired game in a browser and drove the camera via `window.PROCITY`. State:
`Boolarra Heads · 523 shops · 711 lots · 31 chunks live · 31 door meshes · 24.7k tris`.

- ✅ **Seed → real town** works after the barrel fix (§3.1). Contiguous strip, awnings, verandah
  posts, doors, windows, gum trees, sky dome, 6-segment day cycle — all render.
- ✅ **Facade skins seam (FIXED).** `skins.js facadeMat` built `assets/gen/facade-<name>.jpg` but
  Lane A's `facadeSkin` is the **full filename** (`facade-fibro-blue.jpg`) → every facade requested
  `facade-facade-…jpg.jpg` (404 → flat colour). Lane F normalized the name at the `facadeMat`
  chokepoint (strip a leading `facade-` + image extension; idempotent for bare keys). Verified:
  facade JPEGs now return **200 OK**, town is textured. *Root cause is a cross-lane naming contract
  ambiguity — registry stores filenames, skins.js expected bare keys. Worth a CITY_SPEC line so
  ground/awning/interior skins don't hit the same trap.*
- ⚠ **Budget:** ~**334 draw calls** at spawn (radius 3), over the CITY_SPEC ≤300. Tris fine (~25k).
  Options for Lane B: drop default radius to 2, or merge more per chunk. Gate 3 will fail until shaved.
- ⏳ **Interiors not wired** (§3.2), **citizens not wired** (§3.3), **manifest/`?noassets` not wired**
  (§3.4) — the remaining integration passes.

## 8. Open questions for the lanes (surface, don't guess)
- **B:** will you expose the `window.DBG` hook (§4) and the `ChunkManager` lifecycle callbacks
  (§3.3)? If not, F wires citizens via a MutationObserver-style scan — slower, please prefer callbacks.
- **A:** which field marks the "open late" shop, and what's the `hours` encoding (24h ints? segment idx)?
- **C:** does `places` tag the counter slot with a stable `kind:'counter'` so keepers find it?
- **E:** is `?noassets` honored inside your manifest-consuming code, or does F gate it at the shell?
- **D:** roster spawn/despawn API name + does it accept a chunk key directly?

---

## 9. Cross-lane requests (Lane F → others, R3) — the integration surfaced these; not silent-editing your files

**→ Lane D / Lane E — decimate the ped GLBs (blocks gate 3 tris).** The rig fleet (`web/models/peds/*.glb`)
is wired and works, but the character models are triangle-heavy: **~45k tris each near rig**, so the
busiest-intersection view hits **~279k tris** (soak peak ~1.0M) vs the **200k** CITY_SPEC budget. Draws are
fine (~200/300 — the shared-mesh sharing worked). Please **decimate/LOD the 19 ped GLBs** (target ≤~10–15k
tris each) so gate 3 passes; then F can raise `?pop=` past 140. Same applies to any heavy interior fitting GLB.

**→ Lane B — three dbg.js / shell items:**
1. **shots.py bookmark poses (gate 6).** `dbg.js BOOKMARKS` defines `street_noon/arcade/market_square/
   milkbar_dusk/night_neon`, but F's v1_tour also uses `warehouse_fringe / residential_collar /
   crossroads_busy` — these fall back to `street_noon` (identical frames). Please add those 3 poses.
2. **shots letterbox.** In headless (1280×720), `DBG.shot()`→`composer.render()` renders into a square
   sub-region even though renderer/canvas/camera are correctly sized — the EffectComposer render targets
   don't rebuild on the initial resize. A real viewport toggle in shots.py didn't fix it; likely the
   composer needs an explicit `setSize`/reset on first `shot()`. (In-game, real window sizes render fine.)
3. **§3.5 closed-facade visual.** F gates *enterability* by hours (`window.PROCITY.isOpen(shop)`); the
   *visual* closed state — dark windows + a CLOSED plate, and a "CLOSED" door tooltip in `hud.js` — is
   your facade/HUD render. Predicate is ready on `window.PROCITY`.

**Note:** F-owned harness bugs found + fixed this round (so the gates actually run): `shots.py`/`soak.py`
polled `window.DBG` before its async install (race → false "absent"); read `DBG.plan` (unexposed → use
`window.PROCITY.plan`); `enterShop({shopId})` vs the bare-id contract; `shop.lot` treated as an object
(it's a lot **id**); soak now pins midday (else §3.5 closes shops mid-walk) + pre-warms the shared GLB
cache (else the one-time upload reads as a leak) + budget peaks demoted to warnings (DBG.info samples spike
during streaming; gate 3's clean single-pass is authoritative).

---

## 10. Round 5 — v1.1 close-out + v2 flag seams (Lane F tracking)

Round 5 (v1.1 polish + v2 foundations behind flags). **v2 prime law:** default boot stays
v1-identical; `GOLDEN.hash 0x3fa36874` must not move; `qa.sh --strict` green at every commit.

### v1.1 tag — ⏳ WATCH (blocked on C1 + E1)
Tag `v1.1` once **Lane C** re-maps `counter_till` + `record_crate` (C1) and **Lane E** bakes the
hero props ≤8k (E1). F then: verify record/milkbar/opshop interiors (GLB counter+till correct, bins
upgraded, baked props look right), re-capture ONLY the 2 interior tour shots if improved, qa green →
`git tag v1.1` (local). *Nothing to tag yet — HEAD `039c179`, no round-5 lane commits.*

### v2 flag seams — table (F wires `web/index.html` + `tools/` as lanes document them)
Every flag **default-off + independent**. Wire only from the owning lane's NOTES call-site spec.

| flag | owner | what | F wiring | state |
|---|---|---|---|---|
| `?plansrc=osm` | A | second plan source (OSM fixture) behind the CityPlan contract | select in shell plan bootstrap | ❌ **A did not run R5** — task carries to R6 |
| `?winmap=1` | B | parallax interior-mapping window shader | none needed (self-contained in `buildings.js`) | ✅ landed `2a923b6` |
| `?dig=1` | C | dig.js crate-riffle on procedural stock | wired by F (`26d68cd`): `DIG_ON` → `interiorMode`, Esc/pointer-lock guards | ✅ landed `7131f53` + F2 |
| `?roster=stream` | D | chunk-streamed citizen roster | none needed (self-contained in `sim.js`) | ✅ landed `93a3168` |

*(table updated by Fable in the R5 review — F3 harness extensions below did NOT land in R5; they
are the top Lane F item for R6.)*

### v2 QA harness extensions (F3) — build as flags land
- **Determinism gate:** pin `plan-hash` + `first-interior-hash` per `(seed, plansrc)`. Synthetic
  stays `0x3fa36874`; add the osm-fixture hash when A lands.
- **Flags-off regression check:** boot no-flags → assert plan hash + a settled draws/tris snapshot
  within tolerance of the v1 baseline (catches a v2 flag leaking into the default path). *This is the
  enforcement arm of the v2 prime law — build early, before flags land.*
- **v2 smoke:** boot each flag on, walk 2 chunks, enter 1 interior (+1 dig if C landed), 0 console
  errors. Wire into `qa.sh` as a **non-strict (warn) gate** this round; strict next round.

### Marshal
Shared-tree arbiter this round: F owns `web/index.html` + `tools/`; if two lanes collide on a file,
F arbitrates. Cross-lane asks → the owning lane's NOTES, not silent edits.

---

## 12. Round 12 — v3.0-alpha gig layer (`?gigs=1`). F wires it last; findings below.

**What F built.** `web/js/world/gig_state.js` (new, F-owned) — the Friday-night state machine; the
`?gigs=1` seam + `custom_bands.json` bootstrap in `index.html`; the cover charge at the door; the band +
crowd + gig-bed wiring in `interior_mode.js`; `smoke_gigs` in `tools/flags_check.py` (6 gates) + the
v3 arm of the flags-off regression.

### The state machine (`gig_state.js`) — the two things that are load-bearing
1. **It listens, it doesn't poll.** `lighting.js` dispatches `procity:segment` on every segment change;
   the latch rides that. A poll-only machine sees only the segments it is sampled on — driving
   NIGHT→DAWN→MORNING→NIGHT with nothing reading in between (player inside the pub, audio muted, so
   neither F's street loop nor B's audio rAF is reading) **skipped the night roll entirely**: the night
   never advanced and the cover was never due again. Caught live, fixed, re-verified.
2. **`state` is a getter, not a field.** B's audio engine self-ticks on its own rAF and reads
   `PROCITY.gigs.state` while the player is *inside* a shop — i.e. when F's street loop is not running.
   A pushed field goes stale there and the spill lies about the gig.

3. **The night rolls on WHERE the clock lands, not on watching `done` go by.** First cut incremented the
   night when leaving `'done'` forwards — which meant a clock *jump* straight from NIGHT to MORNING (never
   touching DAWN) never rolled the night at all, and **a broke punter walked in on last night's paid
   stamp**. `smoke_gigs` caught it; stepping with `[`/`]` always passes through DAWN, so only a jump
   (DBG/shots/soak all jump) exposed it. Now: the latch clears wherever it clears, and landing in the
   **daytime** (MORNING…ARVO) is what rolls the night; landing on the **doors** means we rewound out of
   the gig — same night, stays paid.

`done` is real, not decorative: the segment→hour map tops out at NIGHT (22:00) so the gig owns the whole
night segment, and "after the gig" can only be DAWN (closing time — band packing up, crowd draining per
A's closing-time ruling). Latch clears on any non-DAWN segment so rewinding the clock (`[`) doesn't leave
`done` stuck on a midday town — it did exactly that on the first verify.

### ⚠ Finding 1 (Lane C ↔ Lane E) — the gig bed key never met. **F bridged it; needs a contract line.**
`LANE_C_PUB.md` asks E to name the live bed **`gig-pubrock`** (C emits `room.audio.gigKey = 'gig-' +
genreKey`). E shipped it as **`pubrock-live`** (`gig:true`, `types:['pub']`) — which is also the key B's
street spill hardcodes. Neither is wrong; they just never met. Unresolved, `AUDIO.music['gig-pubrock']`
is `undefined` and **the pub plays to a silent room** — and because the audio law fails soft, nothing
errors: you just get a band miming. F resolves it at the glue (`interior_mode.js GIG_BED` + a generic
`gig-<genre>` → `<genre>-live` fallback). **This is the R1 facade-skin filename trap again** (registry
stored filenames, `skins.js` expected bare keys). → **C/E/Fable: pick one and put it in CITY_SPEC as a
named contract**, so genre #2 doesn't rediscover this. F's smoke now asserts `gigKey` resolves.

### ⚠ Finding 2 (Lane D + Lane E) — E's instrument GLBs landed; nothing wires them.
E shipped 5 instrument GLBs this round (`electric_guitar`, `bass_guitar`, `drum_kit`, `guitar_amp`,
`mic_stand`, all in `manifest.fittings` with footprints + thumbs). D's band holds **primitives** and
published `spawn(..., { instrumentFor })` as the injection seam — D-progress says E's GLBs "drop in via
`opts.instrumentFor(role)` **when they land**". They have landed. Nobody owns the join. Not blocking
(asset law: a primitive band is still a gig, and it reads fine in the shot), but it is a dangling R12
deliverable. F did **not** do it silently: picking manifest ids and orienting/scaling instruments inside
D's rig is D's call, and the R12 no-drummer question below wants answering in the same pass. → **R13.**

### ⚠ Finding 3 (ROUND12 spec ↔ Lane C) — the band has no drummer.
ROUND12 §Lane D.1 specifies "guitarist/bassist strum-sway, **drummer seated bob**", and E was asked for
"drum kit (one merged kit)". C's `stage.bandPoses` are **guitar / vocal / bass** — a front-line trio; the
drum riser is set-dressing with no pose. D built to C's poses and flagged it. So the shipped alpha band is
3-across-the-front with a mic stand where the spec expected a kit. Cosmetic, non-blocking, deterministic —
but it is a **spec/implementation divergence that no gate can catch**. → **Fable/John: rule for R13** (add
a 4th `drums` pose on the riser, or amend the spec to a front-line trio).

### Gate lesson — "no giants" must measure STATURE, not world crown.
The R10 gate asserts head-bone world Y ∈ [1.4, 2.0]. The band stands on C's **0.32 m stage deck**, so a
perfectly human 1.73 m guitarist has a world crown of **2.05 m** and a naive world-Y check **fails a
correct band** (it did, first run). `smoke_gigs` measures `crown − base.y` for the band/crowd and keeps
the world-crown assert only for "never clips the ceiling", which is the real R10 failure mode.
`tools/qa/interior_scale_check.py` is unchanged (keepers/browsers stand on the floor, base.y = 0) — but
**if anyone ever puts a keeper on a platform, that gate inherits this bug.**

### → Lane B (small, R13): no venue bookmark for shots
`dbg.js BOOKMARKS` has no venue pose, and `DBG.shot(name)` forces street mode **and re-poses/re-segments**
— so there is no way to drive a scripted "lit pub frontage at night, gig on" street shot (the alpha's other
money shot; your marquee + posters + spill are the whole street story of this round). F verified the
frontage lights correctly (`emissiveIntensity` 1.7 at `on`, 71 draws / 29.6k tris at the venue) but shot it
by hand. **Ask:** add a `venue_night` bookmark (pose at the pub frontage, `seg:5`) — then F's
`tools/qa/gig_shot.py` can capture the street side too. This is the same "3 missing bookmark poses" ask
from R3 §9, so it may be worth doing the set in one pass.

### Harness note — where the browser gates actually run
This session's box had **no Chromium and no Chrome**, so every Playwright gate (flags harness + scale
gate) is un-runnable locally until `tools/.venv/bin/python -m playwright install chromium`. The repo at
`/Volumes/m3ultra/Documents/procity` is a **mount of m3ultra's `~/Documents/procity`** — same tree, so
`ssh m3ultra@100.89.131.57` runs the real gates on the real files. **Gotcha:** node is not on the
non-interactive ssh PATH — `env PATH=/opt/homebrew/bin:$PATH tools/qa.sh --strict`, or every node gate
reports a bogus FAIL (`node: command not found`).

### R12 numbers (measured, seed 20261990 → "Boolarra Heads", venue = The Thornbury Hotel)
| thing | number |
|---|---|
| gig-night interior, rig fleet | **42–50 draws** · ~40k tris (budget **≤350**) |
| gig-night interior, `?noassets=1` placeholders (**worst**) | **171 draws** (budget ≤350) |
| gig-night street at the venue | 69 draws · 29.6k tris (budget 300 / 200k) |
| band / crowd | **3** on the deck · **8** at 8 watch points · **3 dancing / 5 standing** |
| figure scale | band stature 1.68–1.77 m (crown ≤2.09 m under a 4.0 m ceiling); crowd 1.60–1.77 m |
| leak, 4 gig enter/exit cycles | geo 66→66 · tex 63→63 (**zero**) |
| tonight's covers (7 nights) | `10, 0, 0, 3, 2, 0, 9` — 3 free of 7 (~half, as seeded) |
| custom band names surfacing | **7 of John's 10** fill all 7 nights; `?noassets=1` → pure generator |

---

## 13. Round 13 — v3.0-beta THE DISTRICT (`?gigs=1`). F wires it last; findings below.

**What F built (all 7 tasks from ROUND13 §Lane F).** All committed Lane-F-only; verified green on m3ultra
(`qa.sh --strict`, the focused district gate, the scale gate). A single WARN — the queue — is a documented
handoff to D, not a hole (below).

1. **Per-venue state machine** (`gig_state.js`, rewritten). One latch PER VENUE keyed by `venueShopId`; a
   town of 2–4 venues runs 2–4 independent latches off the SAME `procity:segment` spine. All three hard-won
   R12 laws are preserved verbatim inside `createVenueLatch` (listens-not-polls · `state` is a getter ·
   night rolls on WHERE the clock lands). New runtime surface on `window.PROCITY.gigs`: **`.byVenue`** →
   `{ [id]: state }` (B's `venue.js`/`audio.js` read it), per-venue **`stateOf/onOf/openOf/gigOf/coverOf/
   bandNameOf/paidOf(id)` + `markPaidOf(id)` + `.venueShopIds`**. The R12 single-venue alias
   (`.state/.on/.venueShopId/.cover/.paid/…` → the **primary** venue = `gigs[0]`'s) is kept **one round** so
   B's mid-round single-venue callers don't break — it retires next round. Contract pinned in CITY_SPEC §v3.
   *Tonight* per venue = its night-0 gig (matches A's posters + B's frontage, all night-0-keyed); a
   dark-tonight venue latches 'quiet' all session, which is true to the seeded week.

2. **Walla + applause** (`interior_mode.js`). While a venue's gig is `on`, the crowd bed
   `ambience['crowd-walla']` rides the interior TONE layer under the live band bed (you hear the room, not
   the fridge hum) — it reuses B's existing `playInterior({musicKey,toneKey})`, no new audio API. On the
   `on → done` edge while the player is inside (crowd's last-song → the clock rolls NIGHT→DAWN), a one-shot
   `sfx['applause']` sting fires ONCE (`applauded` latch, re-armed per enter). Fail-soft throughout (no-op
   muted / `?noassets` / pre-gesture). Verified live: `iMusic=gig-pubrock`, `iTone=crowd-walla`, edge fires,
   0 errors.

3. **Cover charge PER VENUE** (`index.html`). The door seam now keys off the shop being ENTERED
   (`openOf/coverOf/paidOf/markPaidOf(shopId)`), so a night at two venues is two covers; each latch holds
   its own runtime paid-stamp. Verified: paid ($10 debited once, re-entry free), broke-knockback, free night.

4. **Debt #1 CLOSED — and the R12 bridge was a LIVE BUG.** E renamed the pub bed `pubrock-live → gig-pubrock`
   this round (the canonical `gig-<genreKey>`), so F's R12 `GIG_BED`/`gigBedKey` bridge — which rewrote
   `gig-pubrock → pubrock-live` — was now pointing at a manifest key that **no longer exists**: the band
   would have mimed in a silent room. DELETED. The room's `audio.gigKey` (already the manifest key) feeds the
   engine directly, zero mapping. Verified across two genres live: `gig-pubrock` (pub), `gig-covers` (rsl).

5. **Gate hardening — stature into the shared gate** (`interior_scale_check.py`, debt #6). The human-size
   assert now measures **stature = crown − foot** (feet→crown span, platform-independent), with the
   world-crown "never clips the ceiling" assert kept as its OWN line. The day a keeper stands on a platform,
   the gate won't fail a correct figure. Floor figures foot≈0 ⇒ stature≈crown ⇒ backward-compatible.
   Verified: 24 figs across 6 shops, statures 1.60–1.86 m.

6. **District smokes** (`flags_check.py smoke_gigs`, extended). band 3→**4** · a new **§2b DISTRICT** loop
   that enters EVERY playing venue and asserts its `gigKey` resolves to a real manifest bar (debt #1 across 3
   genres), per-venue crowd ≤ its own watchPoints, 4-piece, no-giants-by-stature · **§2c street budget** at
   the busiest venue block (settled-floor sample) · queue probe (WARN-pending, below) · plus the R12
   determinism / cover / noassets / flags-off arms. All green.

### ⚠ Cross-lane ask (Lane F → Lane D) — the QUEUE seam. F's smoke is READY; it WARN-skips until D exposes it.
D owns the outdoor queue (`web/js/citizens/queue.js` `VenueQueue`, charter item, landing this round). B has
already published the zone: **`window.PROCITY.venuePresentation.queueZoneFor(id) → {x,z,ry,len}`** and
`.queueZones`. F drives the surge per venue via `citizens.setGig(id, open)` (done). What F's smoke needs to
verify "queue ≤ cap and drains by done" is a read seam on the sim — **proposed contract:**
`window.PROCITY.citizens.queueInfo(venueShopId) → { count, cap }` (live count while doors/on; `0` once the
gig is `done`). Wire the queue's spawn to `queueZoneFor(id)` at `doors` and expose `queueInfo`, and F's smoke
flips WARN→assert with no further change. (If D picks a different accessor name, tell F and F adjusts the one
line in `smoke_gigs §2b`.)

### R13 numbers (measured, seed 20261990 → "Boolarra Heads", 3 venues)
| thing | number |
|---|---|
| district | **3 venues** — 2 playing tonight (pub #116 The Exchange Hotel · rsl #404), 1 dark (reads true) |
| live beds resolve | pub → `gig-pubrock` · rsl → `gig-covers` (both real manifest bars, debt #1 across genres) |
| band / crowd | **4-piece** each venue · pub crowd **8/8** watch points · **rsl crowd 12/12** (the cap stress case) |
| gig-night interior (rig) | **62 draws** · 34k tris (budget ≤350) · `?noassets` still a full 4-piece gig |
| street @ venue block, night | **99 draws** · 28k tris (budget 300 / 200k) — lit frontage + posters + queue zone in |
| figure scale | band+crowd stature **1.61–1.81 m**, tallest crown 2.12 m under the 4 m ceiling |
| cover, per venue | $10 debited once · re-entry free · broke knockback · free night (seed 1234) — all hold |
| flags-off prime law | fingerprint **0x3fa36874** unchanged · gig layer wholly absent · 0 errors |

**Status:** F's wiring is done, committed, and green. **Waiting on Lane D** for (a) the queue seam
(`queueInfo`) so the queue smoke goes live, and (b) the band polish (E's instrument GLBs in hand, drummer
facing/RY_FLIP) — the band already lands at 4, human-sized, 0 errors, so this is polish not a blocker. Once D
commits: re-run the gates, flip the queue assert, capture the district money shots, tag **v3.0-beta**.

*(R13 epilogue: D landed mid-session; F wired the queue (D shipped `VenueQueue`, left the street-side
lifecycle to F), the queue smoke went live, both money shots shipped, and **`v3.0-beta`** was tagged +
pushed. The `queueInfo` proposal above was superseded by D's `VenueQueue.count()` + F's shell `queueCountOf`.)*

---

## 14. Round 14 — F never ran; the brief carried in full to R15.

R14 was the "v3.0 release round." A–E landed excellent hardening (D's identity-continuity seam, B's
alias-reader retirement + `queue_night` hero + 19-bookmark tour audit, A's 400-seed invariant sweep + §v3
freeze, C's adversarial venue audit, E's provenance freeze) **but Lane F never ran** — so v3.0 was not
tagged and F's whole release brief (continuity wiring, alias deletion, week soak, the tour, the tag) was
untouched. Fable carried it verbatim into R15. Nothing F-authored landed in R14.

## 15. Round 15 — THE v3.0 RELEASE CLOSE (`?gigs=1`). F ran last; the six-item brief, all green.

A first (poster flip + golden re-pin) → B/C verify → D one-line amp move → **F closes**. All deps were in
before F ran (verified against origin). The six F items (ROUND15 §Lane F), each committed atomically by
pathspec:

1. **Continuity wiring + smoke** (ledger #3) — D published the seam in R14; F wired its three touches:
   `crew.spawn(…, { roster: rosterOf(shop.id) })` in `interior_mode.js` (front crowd slots become tonight's
   roster), `rosterOf:(id)=>citizens.tonightRoster(id)` + `onAdmit:(e)=>citizens.recordVenueEntry(id,e)` on
   the queue in the shell (the clear is automatic on `setGig(id,false)`). New `smoke_continuity` asserts the
   seam on **identities** (crowd ⊇ roster ∩ cap · every `member.pedIndex ∈ tonightRoster` · `crewInfo.fromRoster`),
   the empty-roster path injects nobody (shell side of D's byte-identical law), and **settled tris**
   (ledger #5). Commit `687d23f`.
2. **Alias deletion** (ledger #2) — the R12 single-venue scalar alias is **gone**; every read is keyed by
   `venueShopId`. Deleted the alias block + `primaryId`/`P` in `gig_state.js`; migrated `flags_check.py` +
   `gig_shot.py` (`.venueShopId→venueShopIds[0]` · `.state→stateOf(id)` · `.cover→coverOf(id)` ·
   `.bandName→bandNameOf(id)`); deleted the two CITY_SPEC §v3 alias sentences + added the omitted
   `nightOf(id)`. B's R14 sweep left the cross-lane readers clean; only F's tools remained. One atomic
   commit `146b5f3`.
3. **Full-week soak** (`tools/qa/week_soak.py`, opt-in `qa.sh --soak`, non-strict) — 7 nights × every playing
   venue in one context: latch state per `plan.gigs` (dark venues quiet), cover **stamped per venue per
   night** (debited once, re-entry free, due again next night), roster **clears per night** (no
   accumulation), and geo/tex return to a **warmed baseline** across ≥20 cycles — a leak is unbounded
   per-cycle growth; warm-up cache residue **plateaus** (the memTrail proves it). Commit `edc0c47`.
4. **The money-shot tour** (`tools/qa/tour_shots.py`, ledger #4/#5) — one deterministic run → `docs/shots/
   release_v3/` + `contact.html`: `venue_night`, `district_posters`, **`queue_night` (John's hero — A's
   flipped frontage poster now reads from the street)**, `gig_interior` (4-piece + real instruments + a
   roster crowd), `rain_verandah`, `tram_stop`. **Settled discipline**: measured after the async instrument
   GLBs / posters / chunks land (shoot-twice), clean per-group loads; queue driven **live** (explicit admits,
   not throttled rAF auto-drain). Commit `6a35b29`.
5. **Docs assembly** — README v3 section (what shipped · flags table · the tour), this §14/§15 runbook,
   F-progress current, the five freezes confirmed committed (A `a3911a4`/`35da83c`, B `eee60e0`/`a0b5784`,
   C `62e38c5`/`2446ae3`, D `9a65f51`/`66aec0f`, E `55f6698`).
6. **Acceptance + tag** — `qa.sh --strict` 6/6 + `smoke_continuity` + `week_soak.py` green → tag **`v3.0`**.

### Numbers (measured, seed 20261990 → "Boolarra Heads", 3 venues)
| thing | number |
|---|---|
| district | 3 venues — 2 playing (The Exchange Hotel `gig-pubrock` + an RSL `gig-covers`), 1 dark |
| gig interior, settled | 4-piece · crowd 8 (2 from the roster) · **56 draws** · **35k→182k tris** (pre-load→settled; gate is draws ≤350) |
| street @ venue block, night | `queue_night` 121 draws / 62k tris · `district_posters` 186 / 134k (busiest) — all ≤300/200k |
| week soak | 28 enter/exit cycles · $60 covers · geo/tex flat across the back half (115/86→115/84) · 0 errors |
| continuity seam | 2 queue admits carried into the crowd · empty roster 0-injected · `member.pedIndex ∈ tonightRoster` |
| **settled-tris honesty** (ledger #5) | C was right: the interior settles to **~182k** tris after the 5 instrument GLBs load, not the ~34k measured pre-load |

### The gotcha ledger closed this round
- **Alias retirement is a three-party move**: B swept cross-lane readers (R14), A left the spec sentences
  for F (avoiding a doc-ahead-of-code race), F deleted the code + migrated its own tools + the spec in ONE
  commit. No half-renamed state ever existed.
- **Settled measurement** (ledger #5): a headless smoke that reads `renderer.info` right after `enterShop`
  sees the room BEFORE its async instrument GLBs decode — ~34k, not the ~182k settled truth. The tour + the
  continuity smoke both wait/shoot-twice now; the interior gate stays on **draws** (which is load-order
  stable), so there was never a budget violation, only a dishonest number.
- **Drive live-spawned things explicitly**: automation throttles rAF, so the queue's seeded auto-drain may
  not fire on schedule — `smoke_continuity`/`week_soak`/`tour_shots` all call `admitOne()` / step the loop
  explicitly rather than trust the timer.

---

## 16. Round 16 — v3.1 THE FLIP (`?classic=1` is the new covenant). F bookends; opening below, close after.

The town shows its best by default. After three v3 stages the gig layer flips ON, and the mature v2 flags
(`weather`, `winmap`, `tram`) flip with it. F owns the flip; A–E landed their v3.1 polish against it (D's
seated drummer, B's town-wide pools + default re-baseline, C's backline unification, A's corner-poster +
no-spine fixture, E's `sit.glb`).

### The flip (ledger #1) — the covenant MOVED from "flags off" to `?classic=1`
- **Shell** (`index.html`): `const CLASSIC = has('classic') && get('classic')!=='0'`, `const flagOn = name
  => !CLASSIC && get(name)!=='0'`. `gigs`/`weather`/`tram` construct via `flagOn`; `loadPedFleet({sit:!CLASSIC})`
  gives the drummer his clip while keeping classic zero-fetch; `window.PROCITY.flags` publishes the intent.
- **`buildings.js`**: `winmap` reads the SAME rule (default-on, classic-off) — the one cross-lane flip line,
  because winmap's flag lives in B's file. Marked `[Lane F R16 THE FLIP]`.
- **Two goldens, two gates:** classic → `0x3fa36874` (byte-identical v2 forever, the frozen regression
  target); default → the gig golden `0xb1d48ea1`. `flags_off_regression` became **`classic_regression`**
  (boot `?classic=1`); a new **`default_boot_gate`** proves the no-flag boot is the full experience (all four
  flags on, gig layer present, gig golden green, budget). Every gig smoke re-points to the DEFAULT boot.

### Seated-stature gate (ledger #3) — published in the brief, no mid-round handshake
A seated figure fails the standing no-giants floor by design. Contract (in the round brief so D built to it):
D tags seated figs `fig.userData.procitySeated = true`; F's `interior_scale_check.py` + `flags_check.py`
accept them at **stature ∈ [0.9, 1.5] m** (still < ceiling, feet planted); standing stays [1.4, 2.0]. Landed
in the opening commit. Verified live: the seated drummer passes at **1.32 m stature**.

### Numbers (measured, seed 20261990 → "Boolarra Heads")
| thing | number |
|---|---|
| `?classic=1` | byte-identical v2: fingerprint 0x3fa36874, gig layer absent, streamed roster on, 160 draws / 21k tris |
| default boot | all four flags on · gig golden 0xb1d48ea1 · 14 gigs, 15 posters · **112 draws @ the venue block** (≤300) |
| district (default) | 3 venues, **3 playing** (corner-poster re-pin shifted the schedule) · 3 genres live |
| seated drummer | **1.32 m** stature — passes the seated band [0.9,1.5]; the standing crew 1.68–1.81 m |

### The gotchas closed this round
- **A flag whose parse lives in another lane's file** (winmap in `buildings.js`) still flips as part of F's
  structural change — one marked line, same `!classic && !=='0'` rule as the shell.
- **selfcheck prints the base fingerprint in its summary but asserts the GIG golden silently**, so the
  default-boot gate gates on the ALL-GREEN run (which includes the gig-golden assert), not a stdout substring.
- **`P.winmap` isn't exposed** — the default gate verifies winmap *intent* via `window.PROCITY.flags`; the
  actual shader is B's own `winmap` smoke.
- **`?classic` must zero the fetch delta**, so `sit.glb` is gated on `!CLASSIC` (not just on the fleet) — a
  raw sit fetch under classic would break the covenant even though the drummer never spawns there.

---

## 17. Round 17 — v3.2 THE TAIL + THE SCOUT. F: the town matrix + the close (ledger #7).

The tail drained (D's drummer lean + bench-sit, B's wind sway, C's backline verify, E's `--verify` fix) and
the real-map scout ran (E's 5 real AU town caches + A's cache contract + hardened `plan_osm`). F wired the
last mile and gated the whole matrix.

### Real towns boot in the engine (the F wiring)
E's caches sat on disk (`web/assets/towns/*.json`) + registered in the node selfcheck, but **the shell never
loaded them** — `?plansrc=osm&town=bendigo_real` silently fell back to Melbourne. F closed the gap: the barrel
(`index.js`) re-exports `registerTownCache`/`validateTownCache`; the shell fetches `assets/towns/<TOWN>.json`
+ registers it before `generatePlanFor` when the town isn't a checked-in fixture. **Fail-soft** — 404 /
invalid / `?noassets` → plan_osm's fixture fallback; the scout data is opt-in, never on the default or
`?classic` path. Verified: `?plansrc=osm&town=bendigo_real` → **Bendigo, 9 shops, a 3-venue district, 0 errors**.

### The town matrix (`tools/qa/town_matrix.py`, opt-in `qa.sh --matrix`) — the v4 evidence
Boots every town on the DEFAULT boot and gates boot / determinism / budget / district / `?noassets`. **All
10 × 5 green:**

| town | shops | budget (draws/tris) | district |
|---|---|---|---|
| synthetic/20261990 · 1234 | 493 · 486 | 124d/57k · 147d/71k | 3v ✓ |
| osm/melbourne · katoomba · silverton | 95 · 19 · 12 | 216d · 70d · 70d | 3v ✓ |
| real/bendigo · castlemaine · fremantle · katoomba · newtown | 9 · 6 · 21 · 20 · 18 | 82 · 86 · 159 · 69 · 93 d | 3v ✓ |

The headline: **the existing CityPlan contract eats real Australian geography** — Castlemaine at the 6-shop
floor still lands a 3-venue district; every real town is deterministic, in-budget, and silent under
`?noassets`. No new game systems — exactly the bounded scout the round asked for. This table is the evidence
John charters **v4 = THE REAL MAP** on.

### Gotchas
- **A published cache + selfcheck ≠ a bootable town.** The node sweep proved the *plan* generates; the
  *browser* boot needed the shell to fetch+register the cache. Classic integration seam — F owns it.
- **`?noassets` can't fetch a real cache**, so a real-town + noassets boot correctly falls back to a fixture
  (still silent-and-fine). The matrix's noassets gate tests that fallback, not the real town — as it should.

---

## 18. Round 18 — v4.0-alpha REAL ROADS. **F correctly did NOT run — the gate would have failed by design.**

The alpha gave `katoomba_real` its real OSM street geometry (A's schema v2 `roads[]` + graph lift; E's road
fetch). F's charter deliverable was "as much the failure list as the town" — and F, running the gate, found
the alpha **not green**, so F held the tag and filed the list rather than shipping a red release. This was
the round working as designed (Fable's R18 verdict agreed: "F never ran — correctly").

**What F caught (all Lane A plan-gen, surfaced with measurements):**
- **`qa.sh` selfcheck RED** — `katoomba_real`'s real-roads golden **UNPINNED** (the A→E→A finalization
  handshake never fired: E's roads landed *after* A's commits), and the 4 trailing towns' goldens stale
  (pinned on marched output, now roads).
- **Poster-kerb-clearance RED on all 5 real towns** — the real edge explosion (232 "main" edges) put spine
  posters **1.4–3.9 m into the road**.
- **Fragmentation** — 20 shops scattered over 799 real edges / 607 m ⇒ no walkable strip; the money-shot
  attempt was a vast empty field (D's finding: 105 components, 42% dead street-metres). And B's separate
  finding: the `BIG_CITY` heuristic misfired (20 shops < 120 ⇒ small-town streaming on a 799-edge graph ⇒
  **280k tris**, breaching the 200k gate).

**What was already green (the isolation held):** real roads ride the **cache schema, not a flag**, so
classic + default + synthetic + fixtures were untouched (`0x3fa36874` frozen) — the alpha changed nothing
outside the flagged path. The pipeline worked; the geometry needed the hardening the alpha existed to reveal.

## 19. Round 19 — the v4.0-alpha CLOSE. F: B's budget one-liner (early) + the gate (last).

A resolved the findings this round (fragmentation ruling — main component + joins, cull shopless islands;
poster clamp; goldens pinned; junction-protected DP), D re-measured and verified, C re-soaked, B shipped the
town selector. F ran two things:

1. **B's `BIG_CITY` one-liner** (`index.html`, landed EARLY per the order so D/B re-measures saw it):
   `BIG_CITY = shops > 120 || (streets.edges > 200)`. A real town can have few shops but a huge road graph;
   the graph now trips big-city streaming. **Verified: real Katoomba 799 edges → 61 draws / ~12k tris (was
   280k), 0 errors.** B proved it; F owns `index.html` so F landed it.
2. **The alpha gate + the roads dimension** — `town_matrix.py` grew a `roads` gate: a real cache (schema v2
   with `roads[]`) must build the REAL street graph (`norm.mode === 'roads'`, read via the plan_osm
   `opts.report` sink), while synthetic/fixture towns stay marched/synthetic by design. Plus the classic +
   default gates prove the alpha is still isolated to the cache path. Money shot: **Katoomba's real main
   street** — asphalt + lane markings, footpaths, a pedestrian crossing, a walking crowd, gig posters,
   streetlamps, B's town selector in-frame — PROCITY's look on real bones, in budget.

### The honest notes on the alpha (two, both filed for v4.0-beta)
1. **Density.** Real Katoomba's 19-shop cache is genuinely spread ~1 shop per real edge (`shopsOnBest = 1`),
   so the alpha is a real *street* with the town's life on it, not a dense retail strip — that density is a
   beta concern (more shops per cache, or focusing the retail spine).
2. **One open budget finding (non-blocking).** The matrix's worst-case view (`venue_night` — NIGHT, the lit
   venue block, all posters up) measures **200,965 tris on `katoomba_real`, +965 over the 200k soft ceiling
   (0.5%)**. Driver: the poster count scales with the real *edge* count (438 posters for 19 shops), not shop
   count. Normal play (the midday money shot) is 121k — well under. `qa.sh --strict` is GREEN; this rides
   the opt-in `--matrix` warn-gate, not a blocking gate. Beta hardening: A caps posters per real town.
The alpha's job was **real roads that boot, stream in budget in play, place a district, and read as a real
place** — that shipped; the venue_night stress view is the one filed edge.

---

## 20. Round 20 — v4.0-beta THE FIVE TOWNS (density). **F never ran — the honest record.**

R20 widened the towns (E: katoomba 20→80, five towns to 292 shops, "subtle" enforced by construction),
proved the directive from the crowd side (D's A/B: heroes kept footfall 17→19 while the street got 3.8×
busier), capped posters 438→31 (A), and ruled the tram by shop adjacency (B: the alpha tram fronted **zero
shops on 4 of 5 real towns** — "it really was a highway bus"). Excellent round.

**F did not run, and there was no tag.** Unlike R18 — where F ran the gate and *held* on evidence — R20's F
slot simply never executed. The round also left C's density door-soak undone, B's selector still hardcoding
`hud.js:11` instead of E's index, and D's relocation finding (katoomba's pub 1,000 m from the retail cluster
— a gig with no passing crowd) without an owner. R21 closed all four.

## 21. Round 21 — the v4.0-beta CLOSE. F: the beta gate + the tag (ledger #6).

Waves ran [A, B, E] → [C, D] → [F]. A biased `pickVenues` toward retail-cluster adjacency (D's finding) and
re-pinned once; B derived the selector from E's `index.json`; C soaked the five towns' doors at density; D
verified the relocation (**A's bias PASSES**); E pulled 22 towns / 1192 shops forward as non-gating data.

### The matrix — 10 towns × 7 gates (`--matrix`)
`boot · determ · district · roads · tram · noassets` **green on all ten**. Two budget flags (below).
Selfcheck **154141/154141**, `qa.sh --strict` GREEN.

### Tram (#6c) — B's R20 ruling verified exactly
| town | verdict |
|---|---|
| newtown_real | **runs, 16 stops** (B's phantom-stop fix: was 149) |
| castlemaine_real | runs, 10 stops |
| katoomba / fremantle / bendigo | **fenced** — 3 / 2 / 1 shops fronted, all < the 5-shop floor |

New seam: the shell now exposes `window.PROCITY.tram` — B built `routeInfo` *for F's smoke* but nothing
published it. F owns index.html, so F wired it. The matrix reads `{fenced, stops, shopsFronted}`.

### ⚠ The venue_night re-measure (#6b) — RECORDED, and the premise came out false
The brief expected A's poster cap to close F's R19 `+965`-tri edge. **It did not — it widened:**
| | R19 | R21 |
|---|---|---|
| katoomba_real venue_night | 200,965 (+965, **+0.5%**) | **221,935 (+21,935, +11%)** |
| bendigo_real venue_night | — | 201k (**+0.5%**) |
| fremantle / newtown / castlemaine | — | 184k / 179k / 112k ✓ |

**A's cap worked** (posters 438→111). The cause is the *density widening*: katoomba 19→72 shops + D's 3.8×
busier street more than ate the savings. **Draws are fine everywhere** (151/300 — half budget); this is
tris-only, at the worst night stress view. Not a blocking gate (it rides the opt-in `--matrix` warn), and
the brief's instruction was "record the new number" — recorded. **Filed as R22's first item**, where the
tri-diet backlog (instrument LOD · tram tri diet) already lives. katoomba is the outlier: a 966-edge graph
carrying 72 shops.

### Ruling (#6d) — selector gating: **always in the HUD**, not `?dbg`-gated
THE REAL MAP's product *is* the towns; gating their discovery behind a debug flag would hide the epoch's
headline feature. It's unobtrusive, shows friendly names, and lives in the HUD overlay. **Corollary (F's own
gap):** money shots must hide the HUD — the R19 alpha shot had the selector in-frame because F's harness
screenshotted the full viewport. The beta shot hides it.

### The beta money shot (#6e)
[`docs/shots/v4_beta/fremantle_mainstreet.png`](../shots/v4_beta/fremantle_mainstreet.png) — Fremantle's real
street at golden hour: buildings lining both sides down the corridor, footpaths, a crossing, gum trees,
streetlamps, and a genuinely busy crowd (the density widening, visible). 126 draws / 167k tris, HUD hidden.
Posed by projecting the densest **spatial** shop cluster (10 shops within 60 m) onto its front edge and
standing on the road — per-edge shop counts are ~1 on a real graph, so "densest edge" is the wrong pose
heuristic for real towns.

---

## 22. Round 22 — **v4.0: THE EPOCH CLOSE.** F: the re-measure, the selector, the tour, the tag.

### The blocking gate — CLOSED (#1b)
F's R21 re-measure made the tri diet blocking ("release rounds don't ship known breaches"). B diagnosed
layer-by-layer, the driver traced **A → E** (A's own commit said so: "B's numbers say the fix is E's"), and
**E fixed it**. F re-measured:

| `venue_night` | R21 | R22 |
|---|---|---|
| katoomba_real | 221,935 (+11%) | **108,365** (−51%) |
| bendigo_real | 201k (+0.5%) | **124,682** |
| fremantle_real | 184k | **88,397** |

**Worst 124,682 — the 200k stress edge is closed.** Selfcheck **161,300/161,300** (A's 36 goldens + the
23-town pack). The measure-first loop worked end to end: F measured, B diagnosed, E owned, F re-measured.

### `DBG.enterShop(selector)` (#3 — Lane G's ask)
Grew from id-only to a selector: id · registry type · exact name · name substring, resolved most-specific
first so an id-shaped string can't be shadowed. `DBG.enterShop('record')` / `('The Exchange Hotel')` / `(116)`
— cross-repo QA one-liners on any of 23 towns without an id lookup.

### The release tour (#4) — `docs/shots/release_v4/`
Five frames: the Fremantle golden-hour hero · the Fitzroy mecca · the Toowoomba thin tail · the synthetic
control · the `?classic=1` covenant. Every real-town frame poses through **F's R21 cluster primitive**
(project the densest SPATIAL cluster onto its front edge, stand on the road); B's R22 bookmark fix anchors
on the same retail heart, so tour and bookmarks agree by construction. HUD hidden throughout.

**The primitive earned itself twice.** First cut of the tour posed via `DBG.shot('street_noon')` and the
**mecca came out as bare bitumen** — the same trap as R21. Re-posed through the cluster primitive, Fitzroy
reads (7 shops/60 m retail heart, trees, benches, crowd). *Per-edge is always the wrong heuristic on a real
graph.*

### ⚠ The honest thin-tail finding (filed for v4.x)
The brief asked for a thin-tail frame as **"proof the floor holds."** It doesn't, and the frame says so:
**Toowoomba reads as an empty road, not a town.** The cause is a RATIO, not a count —

| town | shops / edges | shops per edge |
|---|---|---|
| fremantle (hero) | 79 / 1,056 | 0.075 |
| fitzroy (mecca) | 139 / 2,408 | 0.058 |
| **toowoomba (thin tail)** | **12 / 1,459** | **0.008** — 7–9× sparser |

Toowoomba is a real city whose *secondhand* cache is 12 shops, spread across its full road graph. The floor
isn't "≥N shops" — it's **shops-per-street-metre**. v4.x options: clip the graph to the retail core for
thin caches, or set a ratio floor in the pack. The frame ships **labelled honestly** rather than swapped for
a flattering town — same discipline as the R21 re-measure that got worse and said so.

---

## 23. Round 23 — v5.0-alpha THE FIRST REAL CRATE. **F HELD the tag — the crate has no street.**

**Verdict: `v5.0-alpha` NOT tagged.** The round's headline artifact is real and good — G's 120 real
records off a real shop's POS are in the tree, byte-identically re-bakeable. It cannot be reached from
the game. `#7a` (riffle the real crate, buy it) is not a gate that failed; it is a gate that **cannot be
run**. R18's law: *release rounds don't ship known breaches.*

### What F did run

| gate | result |
|---|---|
| **`qa.sh --strict --matrix`** | **7 passed · 0 failed · 0 warn** — QA GREEN |
| **town-matrix** | **MATRIX GREEN — 10 towns × 7 gates**, all green |
| citygen selfcheck | **ALL GREEN 152,015/152,015** (was 161,300 — E retired toowoomba) |
| flags harness (classic regression · default boot · STRICT) | **GREEN, 0 warnings** — the covenant holds through the merge |
| manifest validator · scaffold · consistency · no-giants | GREEN |
| tier 0 — `?noassets=1` | **zero fetches, zero console errors** — the offline law holds |
| tier 0 — default boot, godverse town | town loads (18 real Newtown shops), stock → parody |
| tier 1 (v2, town-wide) — `?stock=real` | 350-item pack resolves, real cover art |
| **tier 1 (v5, per-shop) — the round's deliverable** | **NEVER FETCHED** |
| tier 2 | N/A by law (no server code this round) |

### The merge that never executed (F did it — charter law #5)
Fable's mid-round merge never ran: `main` had **no `web/assets/stock_godverse/**` at all**, so the branch
F was asked to gate and tag did not contain the round's headline. The review had happened (the shared
checkout was parked on `lane-G-godverse` for it) and C verified the atlas from a temp worktree —
deliberately pre-merge — and passed. Only the `git merge` was missing. F executed it as the integration
lane, disjointness **verified before merging, not assumed** (G: `G-progress`, `G3 doc`,
`pipeline/godverse_*`, `stock_godverse/**` · main-since-fork: `C-progress`, `LANE_C_PUB` · overlap: none).
Zero conflicts, exactly as law #5 predicted. → `43b035a`.

### ⚠ FINDING 1 — the atlas contract contradicts itself. Nobody was wrong; the contract was.

| | says the index is |
|---|---|
| **C's published contract** — `LANE_C_PUB:271` | `stock_shop_<godverseShopId>_index.json` |
| **C's own runtime loader** — `stockpack.js:25` | `` fetch(`${base}stock_${type}_index.json`) `` |

**These are mutually incompatible.** An atlas named per the published contract can *never* be loaded by
the code that is supposed to load it. G shipped `3962749/stock_record_index.json` — **runtime-compatible**,
which is exactly why C's base-override verification passed. E globbed `stock_shop_*_index.json` —
**contract-compatible**, which is why E's validator never saw the atlas. Two lanes implemented opposite
halves of a self-contradicting spec and both were correct.

**F's recommendation (measured, not preferred):** amend the contract to G's shape —
`stock_godverse/<godverseShopId>/stock_<type>_index.json`. It is the only shape the runtime can load,
it keys per-shop by directory, and it costs G nothing (already emitted). E's glob follows. C owns the
wording (LANE_C_PUB); this is the amendment ledger #3 anticipated.

### ⚠ FINDING 2 — the gate built to catch this was blind, and green

`validate_atlas.py` globs for a filename that cannot exist at runtime, finds nothing, prints *"no
per-shop atlases yet — nothing to validate"* and **`return 0`**. `validate_manifest.py:158` propagates
that green (its comment states the intent: *"No atlases yet ⇒ clean pass"*). So the round's QA gate passes
whether the atlas is **absent, misnamed, or perfect** — it has never once looked at one. E built it in
wave 1 with no atlas to test against; on first contact (F, at close) it was blind.

The flaw is precise and the fix is a one-liner: the validator **conflates "no atlases exist" with "no
atlases matched my glob."** The first is a legitimate clean pass; the second is exactly the failure it
was written to catch. Cross-check the directory — if `stock_godverse/*/` is non-empty but no index
matched, that is an **ERR**, not a pass. *A gate that returns 0 on an empty set had better be certain the
set is empty.*

Pointing it at G's index by hand (filename drift removed) shows the drift is **deeper than the name**:
- **`ERR missing/empty provenance ['license','attribution','generator','snapshot']`** — but G *carries*
  `generator` and `snapshot`. E's line 68 reads `idx.get(f)` — **top-level** — while E's own docstring
  (line 14) specifies them **nested under `provenance`**, which is where G put them. **E's code
  contradicts E's doc**; G's atlas would fail even with E's exact field names.
- **`licence` vs `license`** — G used the British spelling; E's `REQUIRED_PROV` wants American.
- **`attribution`** — G folds the substance into `licence.covers`; E wants the field.
- **`WARN 2 atlases — C's rule is 1/shop`** — E built to C's *pre-correction* ceiling; C amended §7.2 to
  `≤2 atlases @≤2048²` in the same wave. Stale by one round.

### ⚠ FINDING 3 — `#7a` would have passed vacuously
The brief says: *"boot `newtown_godverse` with `?stock=real` … riffle — **real covers render**."* They do.
F walked into **The Vintage Record** (a real Newtown shop, on its real road) via `DBG.enterShop`, and the
crates filled with **real cover art** — from E's **350-item town-wide v2 pack** (`Sunburnt Milk Bar Vol. 2`,
`Midnight Departure`), the same pack every record shop in every town has had since v2. **Not** Monster
Robot Party's 120. Network confirms: every stock fetch goes to `assets/models/`; **zero requests to
`assets/stock_godverse/`, ever.** Had F eyeballed the gate as written, it would have gone green and proven
nothing. *Two vacuous gates in one round — same species: both test the presence of a thing rather than
the identity of it.*

### The exact failure list for R24 — three gaps, none of them F-only

1. **The crate has no street.** [E + G] No town cache contains shop `3962749`; `redhill_real` does not
   exist. Needs a `build_towns.py` TOWNS entry (~`center (-27.4553, 153.0064), span_km 2.4`) + one
   outward-facing Overpass fetch → `redhill_real`, then `godverse_town.py redhill_real redhill_godverse`
   with monsterrobot injected into `shops[]`. **F did not do this: E's file, G's generator, and an
   outward-facing fetch — inventing town data is not F's to invent.**
2. **No identity field exists to key an atlas by.** [A + G] Verified in the live runtime: *every* shop in
   `newtown_godverse` reports `godverse_id: null` — the cache schema carries no such field at all. C's
   rule is *"C consumes whatever identity field lands, C does not invent it"* — so nobody has landed it.
   A owns the CityPlan/cache contract; G emits it.
3. **The runtime wire.** [C + F] `stockpack.js` keys `_packs`/`_resolved` by **type alone** and returns a
   cache hit before `base` is ever read (`stockpack.js:24`), so two stocked shops collide **and fail-soft
   breaks** — an unstocked shop of a cached type inherits another shop's crate. C specced the seam (key by
   `type+base`, per-shop preload on entry, LRU=1 + dispose) and owns the file; F then passes the per-shop
   base at `interior_mode.js:192` and drops the town-wide preload at `index.html:199`.

**F deliberately did not build its half of #3 this round.** It is untestable while #1 and #2 are open
(no street to walk to, no identity field to pass), and F would be writing against three-quarters of a
spec that does not exist yet. Filed, not guessed. R24 order: **A+G (identity) → E (the town) → C (the
keying) → F (the wire + re-gate)**, and the crate walks.

### Also found
- **The godverse town is in no gate.** `newtown_godverse` is a shipping town cache that boots fine (F
  verified: 18 real shops, real roads) but the town-matrix covers `newtown_real`, not it — so the one
  town the whole epoch is built on is ungated. F's matrix, F's gap; it lands with the R24 re-gate rather
  than a held round.
- **A's spacing warn earns immediately:** with toowoomba retired, **`ballarat_real` now warns at median
  255 m > 150 m**. The thin tail has a second member — A's warn is doing exactly its job (warn, not error;
  E curates). Filed for E's next curation pass.
- **`?noassets=1` + `&town=<key>` silently boots a *different town*** (the fixture, not the cache) — F's
  own R17 wiring gates the cache fetch on `!NOASSETS`, correctly (noassets = zero network), but the tier
  ladder's *"same shop under `?noassets`"* can't mean the same shop for a real town. Tier 0 for **stock**
  is provable on the default boot; tier 0 for the **town** is a fixture fallback by design. Wording, not a bug.

---

## 24. Round 24 — v5.0-alpha THE ALPHA COMPLETION. **The crate WALKS. F held the tag anyway — A's gate.**

**THE CRATE WALKS.** You can boot `redhill_godverse`, walk down Musgrave Road into **Monster Robot
Party**, riffle **its own real crate**, and buy a real record for its real price. Proven falsifiably,
not by eyeball:

| assertion | result |
|---|---|
| room resolved base | **`assets/stock_godverse/3962749/`** (not the town-wide base) |
| **title equality** | **120/120 in Monster Robot's atlas · 0/120 in the generic town pack** |
| **texture provenance** (the pixels) | **2 atlases, both `stock_godverse/3962749/stock_record_atlas_0*.webp` · 0 from the generic pack** |
| network | `stock_godverse/3962749/` index + both atlases, `200` |
| **buy** | `rec_0000` *"Abstract Latin Lounge II (Part II)"* @ **$15** → cash **191 → 176**, debited exactly 15, count 0→1 |
| gone-this-session → back next boot | reboot ⇒ wallet 191/0 restored (no persistence layer exists) |

**Tier ladder, re-proved end to end:** tier 0 `?noassets` on a godverse town → **zero network requests**,
no base, no pack (the offline law survives the wire) · **soft fall live**: `Restoration Station`
(keyed 2289, no atlas) → `404` → null → parody, and the boot log shows those 404s happening in
production · **no cross-contamination**: after visiting other shops the real crate still resolves its
own 120 · **plain towns untouched**: `newtown_real` → 0 keyed, base `null`, 350 items, textures from
`models/` — **F's wire is a complete no-op off the godverse path**, byte-identical to pre-v5.

### What F built (#6a)
`godverseBaseFor(shop)` — **exported and used by both** the shell's boot preload and the room's lookup,
deliberately: C's cache identity is the LITERAL `(type, base)` pair, so two sides building that string
differently would miss the cache and drop a real shop to parody — a bug that looks exactly like "no
stock" and would sail straight past a covers-render eyeball. One function, one string, one key.
Boot-preloads keyed shops (`getStockPack` is sync and the room is built the instant the door opens, so
a pack first requested at `enter()` is not resolved in time), gated on `stockReal` and never on the id
alone, so `?noassets` fetches nothing.

### ⚠ FINDING 1 — the honest-gate spec was itself vacuous. The law's first application broke the law.
The brief specified #7a assert **"rendered titles ∈ the atlas index (id equality, not 'covers render')."**
**Id equality cannot discriminate.** Measured: both packs number their items **positionally** —
`rec_0000, rec_0001, …` — so the atlas's ids are `rec_0000..rec_0119` and the town-wide pack's are
`rec_0000..rec_0349`. **All 120 atlas ids are also generic-pack ids (120/120 overlap).** An id-equality
gate goes **green on the generic pack** — the exact failure the law was written to stop, reproduced
inside the fix for it. *Ids here are slot numbers, not identity.*
**What actually discriminates:** titles (**0 overlap**) and, strongest, the **texture URL** — the file
the GPU samples. A pack that merely looks right cannot fake the URL its pixels come from. F's gate
asserts on both, and `DBG.stockInfo()` exposes them so the assertion is scriptable, not eyeballed.

### ⚠ FINDING 2 — F's own selector was lying about the epoch's shop
`DBG.enterShop(3962749)` returned **`no shop matching`**. A GODVERSE shop has *two* ids — its plan id
(local, renumbered per town: Monster Robot is **8**) and its `godverseShopId` (**3962749**, the real POS
id, which is what the atlas, every G-side query and every cross-repo bug report names it by). F's R22
selector only knew the first. Fixed (plan id still matches first, so no existing call shifts). *The
harness F shipped for Lane G could not name the one shop the epoch is built on.*

### The 8 reds — F did NOT clear them, and did not touch A's file
`156,193/156,201`. They are **not** product defects; F proved the product correct above. They split:

**2 — goldens moved by G's re-emit** (`newtown_godverse` base `0xcf69b387`, gig `0x1e266f60`), exactly as
ledger #2 intends: adding `godverseShopId` changes the cache, so it changes the plan. A ran *before* G,
so A could not pin what G had not yet emitted. Plus 4 UNPINNED warns (`redhill_godverse`,
`redhill_real`). **F did not re-pin**: if conflict #2 resolves by changing the caches, these move again,
and the amendment law wants the spec change and the pin in ONE commit. Pin them with the resolution.

**6 — conflict #2: A's identity sweep contradicts Fable's own standing Ruling 2.** Ruling 2
([FABLE_TO_LANE_G.md:33](FABLE_TO_LANE_G.md)) *mandates* mixed caches — "merge census heroes **WITH** the
donor's texture shops (cafes/bakeries…)". A cafe lifted from OSM has no GODVERSE identity and never will;
minting one would invent identity, which is charter risk #3 itself. A's sweep asserts
`keyed === cache.shops.length` — i.e. that no such cache may exist. It is a gate authored in the same
wave as the thing it gates, with no mixed cache in existence to test against: **the identical species as
E's blind validator in R23**, one round later, in the opposite direction. G measured it and escalated it
to "A's call, Fable's ruling"; nobody ruled; it arrived at F.

**F's measurement of the hazard the gate guards: it does not exist.** `redhill_godverse` 10 keyed /
**10 unique**; `newtown_godverse` 18 keyed / **18 unique**; **zero duplicates**. And partial keying does
not mis-stock — F watched shop 2289 fall soft to parody in the browser, which is precisely what charter
risk #3 prescribes ("fail-soft to tier 0, never mis-stocked"). **A's own two checks already disagree**:
`validateTownCache` reasons it out correctly — *"Missing = tier 0 (soft). Duplicate = mis-stocked (hard).
They are not the same failure"* — and warns; the sweep hard-fails the same condition.

### ⚠ FINDING 3 — the uniqueness check is a silent risk-#3 hole (new; G did not catch this one)
`ok(new Set(seated.map(s => s.godverseShopId)).size === seated.length, 'godverse ids unique')`. On a
mixed cache every texture shop maps to `undefined`, and **all of them collapse into ONE Set entry** — so
the check fails on the undefineds, *not* on a duplicate, and it **cannot detect a real duplicate** while
any shop is unkeyed. It is the arm A called "the arm that earns its keep" for charter risk #3, and on
every cache Ruling 2 mandates it is **structurally incapable of doing its job, in both directions**.
Whoever fixes the coverage assert must not paper over this one: uniqueness belongs **over the defined
ids** (`seated.filter(s => s.godverseShopId !== undefined)`), where it would actually bite. That change
makes the risk-#3 guard **stronger**, not weaker.

### Why F held the tag — and why this hold is not R23's
R23 held because the **product** was broken. **R24's product is finished and proven.** What is red is a
**gate**, in **Lane A's file**, on a **schema question that is A's to answer** ("what marks the godverse
layer?" has at least three valid designs). F did not resolve it, for one reason above all: **F is the
party that benefits.** F changing a red gate to green, in another lane's file, to unblock F's own tag,
on the one check guarding "never mis-stocked" with Monster Robot's real crate as the prize — that move
would retroactively devalue every green F has ever reported. F's only asset is that F never shades a
result. The cost of waiting is an hour; the cost of F being quietly wrong is the charter's worst risk.
**Recommended (A's call): the sweep follows A's own validator — missing ⇒ warn (tier 0, soft), duplicate
⇒ error (hard, over defined ids), coverage asserted over the keyed layer, not the inherited one.** Then
A pins the four goldens in the same commit and F re-gates and tags. It is one commit's work.

### ⚠ FINDING 4 — the licence flag stopped reaching a human, and the gate says OK
R23's blind validator is **fixed** — E's `validate_atlas` now finds and validates the atlas
(`3962749/stock_record_index.json · Monster Robot Party · items=120 atlases=2 px=2048 OK`). But G's
conflict-#1 leftover is real and still open: `validate_atlas.py:198` prints from
`provenance.licence` — **British only** — while G's re-emit carries **`provenance.license`** (American,
per C's corrected contract). So `lic = {}`, and the licence line **silently never prints**. E's *check*
(:105) accepts either spelling, so the gate goes **OK**; only the evidence vanished.

That evidence is not decoration. E's own comment at :199 says *"the licence is PRINTED — clearing it is
a human call"* — it is the **mechanism** by which charter law #3 reaches a person, and the string it
failed to print is **`FLAG BEFORE ANY PUBLIC/COMMERCIAL RELEASE`**, on an atlas of a real shop's real
product photographs with real artist names. A gate that is green while the one thing it exists to
surface is invisible is the vacuous-gate law's own species, wearing the licence law's coat.
**Fix (E, one line, G already specified it):** `.get("licence") or .get("license")` at :198.

**F did not patch it.** It is E's file, F is not blocked on it (the tag is held regardless), and G
already routed it. Filing beats reaching across a lane boundary for a one-liner — the same restraint F
applied to A's gate, for the same reason.

### ⚠ FINDING 5 — F's own gate cried the loudest wolf we own (F's bug, F fixed it)
The classic-regression gate reported **`plan fingerprint != golden 0x3fa36874 — determinism/prime-law
broken`**. The covenant was never touched (`0x3fa36874`, node-side, unmoved; G said so too). F wrote
this gate in R16 with `if hash_ok and r.returncode == 0` — **two assertions, one verdict, reported with
the fingerprint's message** — so *any* unrelated red anywhere in Lane A's selfcheck (here: 8
godverse-identity checks in a different town) screams that the byte-identical-forever covenant is
broken. Fixed: two assertions, two verdicts, and the selfcheck failure now names its own lane and
quotes its own reds. *A gate must name what it actually measured — the same law as the vacuous gates,
one turn further round: it isn't enough to fail for a reason, you have to fail for YOUR reason.*

### ⚠ FINDING 6 — the id spaces collide, and it bit F's own selector inside the anti-vacuous gate
Plan ids are per-town (1..N); godverse ids are real POS ids (31, 767, 3962749). **They share a numeric
space.** Silky Oak Furnature's godverseShopId is **31** — and another shop's *plan* id is also **31**.
F's first cut at the R24 selector tried plan id first, so `enterShop(31)` silently entered **Wholefood
Cafe** instead. The smoke's soft-fall assertion then **passed on an unkeyed cafe** — a vacuous pass,
inside the gate F wrote to stop vacuous passes, in the round whose whole theme is *ids that aren't
identity*. Fixed both ends: `'g:<n>'` selects a godverse id explicitly; a bare number stays the plan id
(back-compatible) and now **reports the collision** rather than choosing quietly; and the smoke enters
via `g:` and asserts the shop it landed in **is the one it asked for** before asserting anything about it.

*The lift itself is clean* — F checked: cache 10 keyed → plan 9 keyed (Empire Revival didn't seat), every
one a real secondhand shop. **No cafe is keyed. There is no mis-stocking.**

### ⚠ FINDING 7 — fail-soft-by-404 vs the 0-console-errors law (a contract gap, filed not papered)
F's boot preload must resolve a keyed shop's pack *before* the door opens (`getStockPack` is sync and
the room builds on the same tick), so it probes every keyed shop. 9 of Red Hill's 10 have no atlas →
`404` → null → parody. **That is the fail-soft law working**, and it is also **8 console errors on every
godverse boot** — a browser-level log no `.catch()` can suppress. The house law is zero.
**The tension is structural: you cannot probe blind and stay silent.** The fix is not to loosen the law
but to stop probing for what isn't there: **an atlas index in G's namespace** (or a `hasStock` flag on
the cache's shop entries, A+G) so the shell preloads exactly the shops that have atlases — 404s then
mean a genuinely missing file, which is what fail-soft is *for*. **Filed as a contract ask, not
invented.** Until it lands, F's smoke counts the probes, names them, and fails on any other error —
tolerance stated out loud, never blanket-ignored.

---

## 26. Round 26 — v5.0-beta EVERY CRATE DIFFERENT. F: the manifest consumed, the tolerance retired.

### The 404 tolerance is gone — and that is the point
R24's wire preloaded a pack for **every keyed shop** and ate a `404` for each one with no atlas. That was
the fail-soft law working, and it was also **console errors on every godverse boot**. F's smoke could only
cope by *naming* the probes — and **a tolerance is a confession, not a fix**. F filed the real fix as a
contract ask rather than inventing it: *an atlas index in G's namespace, so we never ask for what isn't
there.* G built it. **F now consumes it** (`assets/stock_godverse/index.json` → `{godverseShopId, types[],
sourcing}`): the shell preloads only manifest-listed `(shop, type)` pairs, and the gate asserts **ZERO
404s with no attribution exceptions**. The 404s are gone because there is nothing absent to ask for — not
because the gate stopped looking. Fail-soft still covers the case that matters (manifest says yes, file is
gone), which is what fail-soft was always *for*. Fetched only when the town has keyed shops, so a plain
town stays byte-identical: no manifest, no fetch.

### Distinctness — G reported 15/15; F measured it, from the indexes of record
Not by entering one lucky shop: **105 pairs across all 15 keyed crates, 0 sharing a title**; **0 crates
overlapping the generic v2 pack**; **0 ids reused across crates** — G's sku fix holds at scale, which is
the R24 vacuity dead at the source rather than papered over in F's gate. 4 crates in Red Hill + 11 in
Newtown = the manifest's 15 exactly, and the manifest lists nothing that isn't on disk.

### Sourcing, not tier — C was right and the gate follows C
C ruled the brief's `tier` field wrong: `tier` is the **charter's ladder rung**, and a mint atlas is *also*
rung 1 — a mint crate is still a deterministic file, still offline, still tier 1. What differs is where the
stock **came from**, which is `sourcing: real|mint`. E built to C's contract over Fable's brief on the
principle that *the contract's author is the authority for the contract's shape*, and Fable ratified it.
F's gate asserts `sourcing`: every index declares it, every index agrees with the manifest, and **a mint
crate can never report as real**. The gate prints it per room, because provenance a human never reads is
provenance that isn't doing anything — the same lesson as R24's silent licence line.

*Note for whoever reads the runtime:* C's pack (`stockpack.js`) does **not** carry `sourcing` through —
the gate reads it from the index of record, which is correct (the index is the artifact; B's street mark
reads the manifest). Not a gap; recorded so nobody re-derives it.

### ⚠ The tolerance came out and immediately caught the leftover
F wired the **boot** preload to the manifest, ran the gate with the 404 tolerance **deleted**, and it went
red on exactly one 404: `stock_godverse/31/stock_opshop_index.json`. That was F's *other* probe — R24 also
preloaded a shop's pack **on entry**, so walking into a keyed shop whose type has no atlas fired a fetch
that could only ever 404. Removed: the door does a lookup, never a fetch. The manifest is consulted once,
at boot, and by the time a door opens the pack is either resolved or was never going to exist.

The lesson is the round's, not just the bug's: **the tolerance was hiding a second instance of the very
thing it tolerated.** While the gate said "8 atlas-probe 404s, expected", the ninth would have been
invisible too. A named exception is still an exception; it earns its keep only until the real fix exists,
and the moment it does, the exception must die or it starts protecting new bugs.

### The gate, green
`DISTINCTNESS 15 crates / 105 pairs / 0 shared · 0 vs the generic pack · SOURCING 15/15 declared, all
agreeing with the manifest · Monster Robot Party → sourcing REAL, 120/120 own titles, 2 own textures / 0
generic · Presents of Mind → sourcing MINT, 16/16 own, 1 own / 0 generic · soft fall silent · ZERO 404s ·
0 console errors, no attribution exceptions.`

### ⚠ THE HOLD — `v5.0-beta` NOT tagged. `atlas-QA FAIL — 14 error(s)`, and it is not the product.
`qa.sh --strict --matrix` → **6 passed · 1 failed · 0 warn**. The one failure is the manifest validator:
E's `validate_atlas` rejects **all 14 mint crates** (the real crate passes). Everything else is green —
selfcheck **ALL GREEN 156,212/156,212** · **MATRIX GREEN 10 towns × 7 gates** · flags harness (carrying
F's beta gate) · consistency · figure-scale. **One gate, one assertion, 14 identical errors, one line.**
That ratio is the whole argument for the hold: the beta is finished, and what stands between it and the
tag is a rule meeting a case it was written before.

**The conflict:** `SLOT_ID_PREFIX = "sku_"` (`validate_atlas.py:73`) is a module constant applied to
**every** pack — E reads `sourcing` at :178 but the slot-id check is **sourcing-blind**. C §7.2a's rule is
*"derive from the source's own stable key, never position, unique across ALL packs"*, and it specifies
`sku_<POS sku>` **"for a real-stock (godverse) pack"**. **A mint crate has no POS sku by construction** —
it was never in that shop's till. Demanding one demands a thing that cannot exist: the same shape as R24's
sweep demanding a cafe carry a `godverseShopId`, and as the brief's `tier` demanding a rung where the
question was provenance.

**F measured the rule's INTENT, and it holds:** mint ids are `mint_<dealgod listing id>` — a real external
key, **non-positional**, items sorted by it, the bake seeded (`random.Random(158)` over an id-ordered
pool), and **0 ids reused across all 15 crates** (F's own pairwise measurement). Stable, unique,
non-positional. Only the literal prefix fails.

**G refused to go green the easy way, and was right to** — worth recording, because it is F's own R24
finding grown up: *"a POS sku and a dealgod listing id are different id spaces; filing dealgod listing ids
under `sku_` recreates that bug INSIDE the economy — tier-2's sold-means-gone looks up POS skus, and
`sku_6031122` (a dealgod id) is indistinguishable by shape from a real sku."* R24's plan-id-31 vs
godverse-id-31 collision entered the wrong shop; the same collision in the money layer sells the wrong
record. G caught it **before** shipping rather than after. Emitting `sku_` would have made this gate green
and the economy wrong.

**Why F did not fix E's one line:** identical to R24's conflict #2, and the answer has not changed. It is
**E's file implementing C's contract**, the question ("does §7.2a's sku rule bind a mint pack?") is **C's
to answer as the contract's author** — the principle Fable ratified when C overruled `tier` — and **F is
the party that benefits**, since the fix is the only thing between F and the tag it was sent to place.
F's whole worth is that F never shades a result. Cost of waiting: one line. Cost of F being quietly wrong:
a gate that green-lights id-space collisions in the layer that moves money.

**The fix (C rules, E lands it, one line):** gate `SLOT_ID_PREFIX` on `sourcing == 'real'`; for `mint`,
assert `mint_`-prefixed + non-positional + unique — which F has already measured true. Then F re-gates
and tags. **Everything else for the beta is done and green.**

### The fence went in and the hold ended — wave 4
C ruled and both lanes titled their commit the same thing: **"my rule was the stale thing."** E's one line:

```python
SLOT_ID_PREFIX = {"real": "sku_", "mint": "mint_"}      # sourcing-scoped, not one space
```

Fable's ruling — **prefixes are namespace fences** — and E's comment makes G's judgment the law:
*"`sku_` names a POS copy on a shelf, `mint_` names a dealgod listing standing in for one… a prefix that
lies doesn't fail a gate, it **SELLS THE WRONG RECORD** out of a real shop to satisfy a minted stand-in.
Never treat them as one space (**same standing note as plan-ids vs godverse-ids**)."*

That closing clause is F's R24 collision — plan id 31 vs godverse id 31, which quietly walked the harness
into a cafe — promoted from a finding to a standing law, and re-derived independently by G in the layer
that moves money. The bug F found by entering the wrong shop is the bug G refused to ship by selling the
wrong record. **The rule bent; the id spaces didn't.** That is the correct direction: a rule is a
description of an intent, and when a legitimate case fails it, the description is what's wrong — provided
somebody has measured that the intent still holds. F measured it before the ruling (non-positional,
seeded, stable, 0 reuse across 15 crates), which is what made the ruling a decision rather than a guess.

**`atlas-QA OK — 15 per-shop atlas(es) valid, 15 licence line(s) shown, 0 warning(s)`** — and that second
number is R24's finding #4 at full scale: fifteen `FLAG BEFORE ANY PUBLIC/COMMERCIAL RELEASE` lines now
reach a human, where one silently printed nothing.

---

## 27. Round 27 — v5.0 THE LIVE CRATE. F: the reader, and the server killed on purpose.

### ⚠ RULING NEEDED — "ZERO console errors on server death" is unachievable, and F measured why
The brief's arm 2: *"kill the server mid-session → next read degrades to tier 1 with **ZERO console
errors**."* **It cannot.** A `fetch` to a dead host logs `net::ERR_CONNECTION_REFUSED` at the **browser**
level — no `.catch()` suppresses it, because nothing in JS ever sees it. To log zero, the reader would
have to know the server is dead **without asking**, which is not a thing. **One refused connection is the
irreducible cost of discovering death.**

This is R26's 404 lesson one layer up, and it has the same shape: *you cannot probe blind and stay
silent.* R26's answer was to stop probing blind — the manifest told us what existed. There is no
manifest for "is the server alive"; the only way to know is to ask.

**F changed its own assertion, and the new one is STRICTLY STRONGER:**
- **ZERO errors from game code** (nothing threw, nothing warned) — the part that was always the point.
- **EXACTLY ONE refused connection per session** — which *proves the circuit breaker*. Without the
  breaker it is one error per shop entry, forever. **"Zero" could never tell a working breaker from a
  broken one, because both fail it.** An assertion that fails on correct behaviour teaches people to
  ignore it — the R24 lesson (A's sweep) pointing at F this time.

**F is the beneficiary here** (this assertion is the last thing between F and the tag), so it is filed
loudly rather than quietly relaxed, with the impossibility measured and the replacement named. Fable
ratifies or overrules at the retro. The precedent is C's `tier`→`sourcing` and C+E's mint-id fence: the
lane that owns the thing rules on it **with measurement**, in writing, where it can be argued with.

### ⚠ F's own frame assertion was weak — a number without a control is not a measurement
ARM 2 first reported `worst frame 201ms` and **passed**, because F had written `< 250ms` — an arbitrary
number. 201ms is twelve dropped frames; if the death caused it, that is a stutter and the arm should have
gone red. **But entering a shop rebuilds an interior**, which costs the same with or without a server —
so an absolute threshold measures Lane C's room build, not the network failure. Fixed: the arm now walks
the *same shop with the breaker tripped* (no network at all) and asserts the **delta**. The question is
"did the death cost anything", not "is entering fast". *F caught this in F's own gate, one round after
telling A the same thing.*

### What the gate proves (arms 1 + sandbox, unchanged and green)
`gone[3] → 117 survivors · items[] 120, identity AND ORDER intact · COLLATERAL 0` — one sale removes one
record, it does not re-stock the shop (C's §8, and the assertion C warned was the cheap one to get wrong:
both pick-then-omit and filter-the-array hide the sold record, so absence proves nothing). `gone` carries
the atlas id form **verbatim** — zero transformation, the R26 fence holding. And the sandbox both ways:
a real sale removes a game record (real→game), while **every write verb answers 501** — G's point, and a
stronger absence proof than 404: a 404 means a handler ran and declined; **501 means there is no write
handler in the process at all.** A mint shop 404s: only the one real shop is live, which is the point.

**The subject exists only because G built it.** Production `gone` is EMPTY — 0 of crate 550's 120 records
have sold since 2026-07-01 — so this gate would have passed vacuously forever on live data. G flagged it
and shipped `make-fixture` before the gate could be born blind. *"A fixture is not a lie; a green assert
over an absent subject is."*

### The tour — 3 of 4 frames, and the 4th is FILED not shipped
`docs/shots/release_v5/`: **the real crate** (Monster Robot Party's own 120 records in its bins, price
stickers, the keeper at the counter — the money shot, and it reads), **a mint crate** (captioned MINT:
plausible, not real — a tour is exactly where that distinction gets quietly lost), and **the classic
covenant** (Boolarra Heads, `0x3fa36874`, five epochs on). Zero page errors.

**The frontage frame does not land, and F is not shipping it green.** Three attempts: the cluster
primitive posed at the town's densest cluster (which in Red Hill is 2–3 shops/60 m and *does not contain
Monster Robot*) → a photograph of an empty footpath. Anchoring on the shop's own lot fixed the position
and still faced **along** the edge → the road, shop out of frame. Facing the lot along its road-normal
still frames bitumen. **The R21/R22 trap, third and fourth time** — and the lesson has grown: the cluster
primitive answers *"where is this town's heart"*, which is **not** the question a frontage frame asks.
Red Hill's heart isn't Monster Robot; a sparse town has no heart to speak of. Anchor on the SUBJECT when
the frame is about the subject.

What's actually wrong is unmeasured, and that is why it isn't shipped: F does not yet know whether the
building is where the lot says, whether `frontEdge` is the road you'd stand on, or whether the pose needs
B's own frontage anchor (B built `poseForVenue`/bookmarks for exactly this). **Next: ask B** — B owns the
frontage and shipped the stocked-shopfront mark this round; F re-deriving B's anchor in a tour script is
how you get three bad frames. The interior money shot needed none of this: the room poses itself.

### ⚠ THE HOLD — `v5.0` NOT tagged. Every real town's shops face away from their street.
B's micro-task found it while fixing F's frame, and **F's three photographs of empty road are the
evidence**: it was never the pose. `plan_osm.js:443` aims the lot's **−Z** at the road ("facade (−Z)
faces road"); `buildings.js:404` draws the facade on the **local +Z face**. Exactly opposite. The
shopfront — sign, door, R26 crate mark — lands on the **far side**, and the street gets a blank wall.
**Since R18.** v4.0 shipped on it. Nine rounds of tours shot it. `katoomba_real`'s `street_noon`, the
bookmark the tours have used since R9, is 46 draws of bare road.

Root cause: **CITY_SPEC contradicts itself** — `:71` (the lots contract) says −Z, `:335` (R15 posters)
says "+Z, B's canon" — and each generator implements one half. **Synthetic follows B's canon and looks
right, which is why every golden passes and nobody saw it for nine rounds.** The epoch's signature
species, one last time, and the worst instance of it: not a gate that fails on correct behaviour, but a
gate suite that is *green over a product that is wrong*.

**F verified it, and F's first check was VACUOUS — worth recording, because it nearly ended the round the
wrong way.** F measured each lot's `ry` against CITY_SPEC:71's own convention and got **35/35 and 72/72
FACING** — a clean contradiction of B. But `plan_osm` implements :71, so testing :71's data against :71's
rule is self-agreement: it cannot fail. **A self-consistent check over a self-contradicting spec passes
under either convention** — which is precisely why nine rounds of checks never caught this, and why F
nearly reported "B is wrong" with a green number in hand. The only test that sees it compares the two
conventions. F's frames already had.

**Not F's to fix**, and B was right not to either: it is **A's file**, it moves **every real-town plan**
(so every real-town golden re-pins under the amendment law — 36 of them), and **a self-contradicting spec
is Fable's to rule**, not a lane's to pick a side of. B proved the one-liner works (`ry = atan2(-nx,-nz)`
→ katoomba 0/72 → 72/72, and F's money shot appears 4 m from Musgrave Road) and reverted it. That is the
same discipline F applied to A's sweep and E's validator, arriving from the other direction.

**Order: Fable rules the spec → A lands the line + re-pins the goldens in one commit (amendment law) → F
re-gates, re-shoots the tour, tags `v5.0`.** Everything else for the release is done and green: the
kill-the-server gate, the reader, the sandbox, the interior money shot (interiors pose themselves and are
untouched by this — the crate is real either way).

*And B's own postscript is the lesson twice over: B credited "chunk-buildings 348 tris (0.2%)" to the
instancing work in R22 — 348 tris is ~29 boxes. It wasn't efficiency, it was the buildings being absent
from frame. B read the evidence as a win for five rounds. A number you like is the easiest vacuous gate
of all.*

### Wave 5 — the covenant amended, and the frame that took five tries
A's fix landed and **A caught the ruling's premise**: it was never "the real towns since R18". Synthetic is
broken identically — **0 toward / 681 away, dot = −1.0000** — and so is the marched path, and all three
fixtures. **EVERY TOWN, EVERY PATH, SINCE v1.** A booted `?classic=1`, stood on the synthetic main street,
found three blank grey boxes, walked *behind* them and found **NUMBAT PLAYTHINGS facing the dirt**. The
covenant town has been a row of back walls since the first commit.

**F re-pinned its own files** per A's handoff (A doesn't edit other lanes' files, correctly):
`GOLDEN_HASH 0x3fa36874 → 0x5f76e76` · `GIG_GOLDEN → 0xec7a2d39` · melbourne · katoomba · the captions.
**And A caught a live hazard in F's gate**: `hash_ok` carried `or ('3fa36874' in r.stdout)` — a bare-string
OR-clause that was dead the moment the covenant moved, and worse than dead, because it would go green off
a *sentence about* the old covenant appearing in stdout. Deleted. The check derives from `GOLDEN_HASH` or
it doesn't exist.

**John's ruling is the epoch's best line: the covenant is anti-drift machinery, not a defect
preservative.** `0x3fa36874` did exactly its job for five epochs — it never drifted. It just was never
right, and **no hash can catch what was wrong in the first commit**. A golden proves *nothing changed*; it
cannot prove *anything is correct*. Every gate we own was green over a world of back walls, and the only
thing that ever saw it was a human standing in the street looking at a wall.

**The frontage frame took five attempts and four of them were F's fault:**
1. cluster pose → the town's heart, which in Red Hill isn't Monster Robot. Empty road.
2. lot-anchored, facing along the edge → the road, shop beside the lens.
3. lot-normal facing → bitumen.
4. **B's helper — and F threw the result away.** `poseForShopFront` *returns* a pose; it does not apply
   one. F called it, error-checked it, and never touched the camera, so the frame was the spawn paddock.
   *A helper that hands you a value is not a helper that does the thing* — and F's own error-check passed,
   because the call succeeded perfectly. The vacuous check, one last time, in the last frame of the epoch.
5. Applied it → **MONSTER ROBOT PARTY**, sign, door, awning, a ped walking in off Musgrave Road.

Attempts 1–3 were also never winnable: the shops faced backwards the whole time. **F was posing a camera
at a wall and tuning the geometry.** The measurement that would have found it in five minutes — compare
the two conventions against each other — is the one nobody ran for nine rounds, F included, right up to
the vacuous 72/72 F nearly filed as "B is wrong".

---

## 28. Round 28 — v5.1 THE SPIKE AND THE SWEEP. **The sweep landed. The spike did not reach the game.**

### ⚠ F's pose gate has NO SUBJECT — SKIPPED with the reason, per the law
The brief: *"New-clip figure checks (lean/look poses through the scale gate), a bookmark spot-check
(leaning peds in old frames)."* **There are no new poses in the game, so there is nothing to check:**
- **`lean` does not exist.** E measured it rather than assumed it — the stash's 34 clips contain no
  lean, and `find -iname "*lean*"` across ultra returns nothing. The brief and the kickoff both named it
  as already-cached; **the premise was half wrong**, and E found it the only way anyone ever finds these:
  by looking instead of trusting the list.
- **`look.glb` is shipped, verified, published — and NOTHING BINDS IT.** `loadPedFleet()` loads
  `walk.glb`, `idle.glb`, and `sit` (gated). No `look`. E's own handoff said it plainly: *"→ D: it's
  ready. Gate it behind an opt the way rigs.js gates sit."* **D's entire R28 commit is
  `LANE_D_NOTES.md` — 48 lines, docs only.** The run order said *"When E's clips land: D (#1 wiring)"*;
  the log says **D committed BEFORE E shipped** (`afad68b` precedes `640bdbb`). Nobody was careless —
  the wave order was, and the file on disk looks exactly like a delivered spike from every angle except
  the one that matters.

**The R17/R23 pattern, fifth appearance, and the cheapest one yet to have missed**: an asset on disk,
verified, published to a public depot, sha1-checked by fetching the bytes BACK — and no consumer. Every
check E ran was real and passed. None of them could see that nothing loads it. *A gate on the artifact
cannot see the wire.*

### So: v5.1 SHIPS, and it does not claim the spike
Nothing is broken — an unbound clip is inert, the game is unchanged and correct. This is not R18's
"known breach"; it is an **unfinished item**, and holding a polish tag over an inert file would be
precious. **What ships is the sweep, and the tag says exactly that:**
- **C's `audioEmitter`** — the till rings from the counter, the bed from the stage. C's own idea, parked
  since R7, and C found its own v3.0 note had specified it wrong on both halves (*"the panner was
  inert"*).
- **Two items KILLED with the measurement** — B's awning ripple and D's instrument LOD, the oldest tri
  item on the books. They don't leave the backlog "deferred"; they leave it **gone**, with the number
  that killed them. *A backlog that only grows is a backlog nobody measures.*
- **`look.glb`** — staged on the depot, and honestly described as staged.

**Filed for R29 (D, one opt):** `rigs.js` gains `look` the way it gates `sit`; F passes it from the shell.
Then the pose gate has a subject and F will run it. **v6 has not begun in-game — the tag must not say it
has.**

---

## 29. Round 29 wave 0 — **the pose gate gains its subject. v6's first clip is in the game.**

R28's gate had **no subject** and skipped with the reason printed. D bound the clip in wave 0, so the
gate binds too — and it is now permanent, not a hand-proof:

| assertion | result |
|---|---|
| default boot: `look.glb` **bound** | **6.5 s, 64 tracks** |
| **the glance reaches the game** | **peak 46 of 396 peds glancing** · 0 console errors |
| `?classic=1`: the clip | **never fetched** — the zero-fetch-delta covenant holds |
| `?classic=1`: the behaviour | **inert at the source** — 0 of 269 peds, **and the rng stream still draws** |

**That last row is the whole design, and it's D's cleverness worth naming: the determinism lives in the
DRAW, not the outcome.** D takes from a dedicated `glanceRng` stream *always* — so the seeded sequence is
identical whether or not a clip exists — and only flips the flag when `fleet.lookClip` is real. Under
`?classic` the roll still happens, the flag never sets, nothing is fetched, and the covenant is
byte-identical. Add a behaviour without touching a hash.

**And the gate asserts the clip's ABSENCE under classic, not just "0 glancing."** "0 glancing" alone
passes on a fleet that failed to load entirely — the vacuous form of this exact check. Present on the
default boot + absent under classic is the pair that can't both be satisfied by a broken fleet.

### ⚠ F's gate crashed the suite before it ran — worth recording
The first cut checked for its subject with `pg.goto('.../look.glb')`. Navigating to a `.glb` starts a
**download**, Playwright aborts the navigation, and the exception took `flags_check` down with it —
before a single assertion ran. **A gate that dies looking for its subject is worse than one that skips:
it doesn't report "no subject", it reports nothing at all, and takes the suite with it.** The
subject-presence check now reads the disk. *The vacuous-gate law has a sibling: a gate must survive its
own subject being absent.*

**No tag** — wave 0 rides Spike 2's close, which is gated on John's footage. Nothing else is owed on m3.

---

## 30. Round 30 — v7.0-alpha THE SAVE CORE (ledger #1) + SLEEP=SAVE=TOMORROW (ledger #3)

### §30.1 THE CONTRACT — `window.PROCITY.game` (PUBLISHED FIRST, per the brief; B builds on this, C reads it at the counter)

`window.PROCITY.game` is **null** under `?classic=1` and under `?game=0`; on every other boot it is:

```js
window.PROCITY.game = {
  day,          // getter, int ≥ 1. DAY 1 IS THE PRE-v7 TOWN: stock streams carry no day salt on day 1,
                // so a fresh game's shops are byte-identical to a ?game=0 boot. Rotation begins at the
                // first sleep. (Falsifiable: day-1 stock == no-game stock; day-2 stock != day-1 stock.)
  cash,         // getter, int dollars — always equals PROCITY.wallet.cash()
  collection,   // getter → the LIVE array. READ-ONLY for every consumer (C's §9.3 law); the only
                // mutations are game.recordFind (buy seam) and game.removeFind (sell seam).
  townKey,      // string for THIS boot: `${plansrc}/${town || 'default'}@${seed}`
                //   e.g. 'synthetic/default@20261990' · 'osm/redhill_godverse@20261990'
  save(),       // → bool. Serializes schema procity-save/1 → localStorage['procity-save'].
  load(),       // → bool (ran once at construction). Corrupted/foreign blob → LOUD reject
                //   (console.error), raw stashed at localStorage['procity-save.rejected'], fresh start.
                //   THE TOWN NEVER BREAKS: the save holds only player deltas (the delta law), so a bad
                //   save can cost you your stuff, never the world.
  sleep(),      // → the new day (int). day+1 → gig weekNight re-keys to (day − 1) % 7 (see the §30.3
                //   amendment) → wake at DAWN (lighting segment 0) → save(). Stock streams re-seed (§30.3).
  export(),     // → JSON string — the exact procity-save/1 payload (John moves machines).
  import(json), // → bool. Validated exactly like load(). true ⇒ state replaced + saved + day-derived
                //   state applied (weekNight etc). false ⇒ loud reject, CURRENT STATE UNTOUCHED.
  wallet,       // the wallet-compatible facade — PROCITY.wallet IS this object when the game is on.
                //   Full Lane C v0 interface: cash() start() canBuy(p) buy(o) sell(o, offer)
                //   inventory() count() onChange(fn). buy/sell/inventory keep C's exact semantics
                //   (sell credits the offer + drops the matching v0-inventory entry, per §9.3);
                //   cash is game-backed so a loaded save's cash is authoritative.
  recordFind(shop, info),  // F's buy-seam internal (interior_mode calls it) — appends a collection
                           //   entry stamped with townKey + day. Exposed so the gates can drive it.
  removeFind(entry),       // → bool. Identity (===) removal — THE only way the collection shrinks.
                           //   C's sell counter: onSell ⇒ F calls wallet.sell(item, offer) +
                           //   game.removeFind(entry). Returns false (nothing moves) if entry ∉ collection.
};
```

**Collection entry shape** (C's §9.2 asks honoured: `type` stamped at buy time, `title`/`artist` carried):

```js
{ townKey,            // where in the world — the boot key above
  shopId,             // plan shop id (always present)
  godverseShopId,     // the real POS id, ONLY when the shop has one (the two id spaces stay separate — R24 law)
  type,               // the ITEM's stock type: 'record' (any dig, incl. an opshop bin) · 'book' · 'toy' (shelf
                      //   buys). Sellability is type = type, fail-closed (C §9.2) — this field is load-bearing.
  sku,                // pack item id (`sku_*` / `mint_*` / `rec_*` — the sku IS the identity, R25/26 fences)…
  slotId,             // …OR, for parody items with no pack id: `<binKey>#<offerIndex>` (dig). Exactly one
                      //   of sku|slotId is set.
  title, artist,      // display (B's collection card; C's sell card falls back to sku/slotId when absent)
  pricePaid,          // int dollars actually debited
  dayFound }          // game.day at purchase
```

**Save schema `procity-save/1`** (localStorage key `procity-save`):

```js
{ schema: 'procity-save/1', day, cash, town: townKey, collection: [entries], savedAt }
```

THE DELTA LAW, enforced by shape: no plan, no shop, no stock, no clock, no world field of any kind ever
enters this object — the world regenerates from seed. Validation on load/import is exact-schema-string +
field checks (day int ≥ 1 · cash finite ≥ 0 · collection entries carry townKey/pricePaid/dayFound and
one of sku|slotId); any miss rejects the WHOLE save loudly. Versioning: a future `procity-save/2`
migrates-or-rejects, never silently coerces.

**Save points:** `sleep()` and `beforeunload`. (Note, measured against the brief's "save, day+1" order:
sleep increments FIRST and saves the post-sleep state, so disk always carries the morning you woke into —
the literal order would leave disk one day stale between sleep and unload. Same falsifiable outcome, one
fewer window.)

### §30.2 The laws, wired from birth

- **`?classic=1`** → `createGame` is NEVER CALLED: no game object, no wallet facade, no listener, ZERO
  localStorage touches (save.js has no module-scope storage access — the classic-purity gate in ledger #5
  measures this rather than trusting it). `?game=0` → same absence, C's plain `createWallet` runs the
  session exactly as pre-v7. Default boot → game on (the v3.1 flip precedent).
- **Game money is game money:** the save carries dollars that exist nowhere else; import validates shape,
  not provenance — there is no bridge to anything real, in either direction.

### §30.3 SLEEP = TOMORROW — the rotation law (ledger #3, runtime only)

- **The day salt.** The parody/mint stock pick streams re-seed per (shop, day) by salting the EXISTING
  runtime streams — plan generation NEVER sees `day` (A verifies the boundary, ledger #6):
  - interior stock: `buildInterior(shop, THREE, { …, stockDay: day })` → `ctx.stockSalt = ':d'+day` →
    layout.js appends it to the `stk-*` sub-stream salts (one marked seam line each in interiors.js +
    layout.js — `[Lane F R30 seam]`). Fittings/layout/audio streams untouched: the ROOM is the same
    room every day; what rotates is which items the streams pick into it.
  - the dig: `binSeed(shop.seed, binKey + '@d' + day)` (interior_mode, F-owned).
  - `day === 1` or no game layer ⇒ NO salt (byte-identical to pre-v7 — the day-1 convention above).
- **REAL-sourced stock never rotates.** A shop whose per-shop pack the godverse manifest declares
  `sourcing:'real'` (Monster Robot Party) gets NO day salt, ever — its crate is a real crate. `mint`
  crates and parody stock rotate. (The town-wide v2 packs are real *images* used as seeded set-dressing,
  not a real shop's inventory — they rotate with the parody streams. Ruled here so nobody re-derives it.)
- **Gig night = (day − 1) % 7 — AMENDED from the brief's literal `day % 7`, with the measurement.**
  `day` starts at 1, so the literal form keys a FRESH game's first night to night 1 — flipping the
  default boot's gigs off night 0 before the player ever sleeps, breaking the R13 cover/band gates and
  B's night-0-keyed frontage, and contradicting the day-1-is-the-pre-v7-town convention this same
  contract establishes for stock. (day − 1) % 7 keeps the brief's intent exactly — every sleep walks
  the existing seeded week — and day 1 IS night 0. `gig_state.js` (F-owned) gains `setWeekNight(n)` +
  `get weekNight`; every venue's latch re-keys to its night-n gig (plan.gigs is already the whole week;
  the three hard-won latch laws untouched). Cover stamps reset with the re-key (new night ⇒ cover due),
  correct by John's R12 ruling. Fable ratifies or overrules at review — filed loudly, not slipped in.
- **Wake at dawn:** `sleep()` → `lighting.setSegment(0)` (fires `procity:segment`, so every latch +
  facade observes the morning — the listens-not-polls law does the work for free).

### §30.4 Cross-lane notes on this contract

- **→ B (collection UI + SLEEP surface, ledger #4):** everything you need is `PROCITY.game`
  (`day`/`cash`/`collection`/`sleep()`) + `wallet.onChange` for the cash chip. Cover thumbs: resolve via
  the entry's `sku` against the shop's pack where present; parody entries have no thumb (title/artist
  card is correct-and-readable, per the brief).
- **→ B (found while wiring weekNight):** `venue.js:38` keys "tonight" to **night 0** — correct pre-game,
  but after the first sleep the marquee/frontage would advertise night-0's band while the latch plays
  night-(day%7)'s. `PROCITY.gigs.weekNight` (and `game.day`) are published; one line in venue.js when
  you touch the HUD. Filed, not silently fixed (your file).
- **→ C (sell counter, §9.3):** your asks are honoured — `type` stamped at buy time, `title`/`artist`
  carried, removal via `game.removeFind(entry)`, credit via the facade's `sell(item, offer)` (mirrors
  your wallet.js exactly). The E-key routing hook (aimed bin → dig · near counter + sellable → sell card
  · else shelf-buy) is F's and lands with the sell wiring pass, not this one.
- **→ A (ledger #6):** the day salt rides `buildInterior` opts / `binSeed` only — grep-provable that
  `generatePlan*`/plan_osm never receive `day`.

### §30.5 RESULTS — implemented, measured, committed (`53fcd3c` contract · `207bcff` implementation)

All measured in FRESH browser contexts on a port-isolated no-store server (:8791 — the module-cache lesson),
seed 20261990, plus `redhill_godverse?stock=real` for the crate legs. Seven legs, all green:

| leg | measured |
|---|---|
| the contract | default boot: `game` live — day 1 · cash **$191 == wallet.cash()** · collection 0 · townKey `synthetic/default@20261990` · weekNight 0 · full API incl. `wallet.sell` · 0 errors |
| classic purity | `?classic=1` AND `?game=0`: `game === null`, **ZERO Storage-prototype calls** (instrumented before any page script, not trusted) · wallet $191 (C's v0) · 0 errors |
| buy → collection | dig pull: **$12 debited**, entry `{type:'record', slotId:'20_-317#0', pricePaid:12, dayFound:1, title:'Sunburnt'}` — debit == pricePaid, shape == §30.1 |
| sell seam halves | `wallet.sell` credited $3 (179→182) · `removeFind` true then **false on re-remove** · collection 0 |
| sleep | `sleep()` → day 2 · **woke at DAWN (seg 0)** · weekNight 1 · localStorage payload keys exactly `[cash, collection, day, savedAt, schema, town]` — the delta law by shape, no world field |
| rotation | parody shop vertex-data fp: day 1 `3396372961` → day 2 `1818111125` (**rotates**) · re-entry same day **byte-identical** · after reload **still identical** (cross-boot determinism) · `?game=0` fp **== day-1 fp** (the day-1 convention, measured) |
| persistence | reload: day 2 · cash · collection 1 · weekNight 1 all restored (beforeunload save) · `export()` valid · `import()` of garbage + foreign schema **rejected loudly, state untouched**; real payload adopted + weekNight re-keyed |
| corrupt save | pre-seeded bad blob → **1 loud reject**, raw stashed at `procity-save.rejected`, fresh start ($191, day 1), **town boots, 0 other errors** |
| the crates | **REAL** (Monster Robot Party g:3962749): base `stock_godverse/3962749/`, fp **identical** day 1 → day 2 — real never rotates · **MINT** (Presents of Mind g:767): fp **rotates** — mint does |

`qa.sh --strict` **6 passed · 0 failed · 0 warn** over the landed layer — classic regression, default-boot
gate, buy-v0, cover (paid + free), the R26 crate gate, R27 live gate, glance, no-giants: all green with the
game layer default-ON.

**Two of F's own harness bugs caught by the run (recorded per house habit):**
1. **The post-sleep CLOSED door.** First fp read after `sleep()` failed to enter the shop — because the
   town woke at DAWN and the shop was **correctly closed** (the hours law doing its job). The harness now
   sets midday before entering. A verify that forgets the world has rules will read the rules as bugs.
2. **The fingerprint was vacuous for parody rooms.** It hashed mesh transforms + first UVs — but
   `batchRoom` merges parody stock into merged geometry at IDENTITY transform, so it hashed constants and
   reported "no rotation" over stock that rotates. (Mint showed through only because atlas UV rects land
   in the first 8 floats.) Fixed: hash the **vertex data** (position + uv arrays), where the day-salted
   picks/jitters actually live. The vacuous-measurement species, caught in F's own tool, same round it
   re-read the law to everyone else.

**Live cross-lane note (seen mid-session, not F's commit):** B picked up §30.4 within the hour —
`venue.js` "tonight" is already a live getter off `PROCITY.gigs.weekNight`, and `hud.js` has the
collection/SLEEP surface in flight. The contract-first order did exactly what it exists to do.

**Held / next session (per the brief):** ledger #5 gates (save/load determinism scripted session ·
no-pump v0 · classic-purity localStorage gate · rotation determinism) — a LATER F session. The sell-card
E-key routing (dig → sell → shelf priority, §9.4) rides the sell wiring pass alongside it.

### §30.6 THE GATES SESSION (wave 3) — the routing landed, five gates wired STRICT, all green

All measured on the house harness (:8130, fresh Playwright contexts per gate — no module cache to lie).
Committed as five new STRICT smokes in `tools/flags_check.py` (`smoke_sell_routing` ·
`smoke_save_determinism` · `smoke_nopump` · `smoke_classic_purity` · `smoke_rotation`), so every future
`qa.sh` run re-proves them; the session-local instruments from §30.5 are now suite property.

**THE E-KEY SELL ROUTING (§9.4, the held join) — landed + verified live through the real UI:**
`interior_mode.js` grew `trySell()` (C's `createSell`/`nearCounter`, lazily built, only when the game is
on) and the E chain is now: **AIMED bin → dig · else near counter with ≥1 sellable → sell card · else
forgiving nearest-bin → dig · else shelf-buy.** F does both §9.3 halves in `onSell`, in this order:
`game.removeFind(item)` FIRST (false ⇒ keeper veto — no credit can exist for an item not in the
collection), then `wallet.sell(item, offer)`. Shell seams (3 lines, `index.html`): `procity:sellOpen` →
`player.unlock()`, and `sellActive` guards the Esc-leaves-shop + click-relock paths (the dig's exact
contract). The full loop, measured through the real DOM: **dig pull $9 debited → entry
{type:'record', sku|slotId, pricePaid:9} → E at the counter → C's card → SELL +$4 (< $9, the clamp) →
collection 1→0 → back on the street B's HUD reads $186 · CRATE 0.** Negative legs: empty collection ⇒
E opens NOTHING (open() false, zero DOM); `?game=0` ⇒ no game, no card, zero errors.

**One routing amendment, filed with the measurement (F's own file, F's own routing):** `binUnderAim`'s
forgiving fallback picks the nearest bin within 2.5 m of the camera and **ignores aim** — at a counter
that sits near a bin it would swallow every E and the sell card could never open there. The chain now
asks aimed-raycast FIRST (the §9.4 contract's literal "aimed bin"), lets the sell trigger decline, and
only then runs the forgiving pick. Both sides proven live: at Moe Vinyl's counter-adjacent bin the card
now opens (`sell:true, dig:false` — the old chain opened the dig); by a bin away from the counter with
a sellable held and aim wrong, the dig still opens (`dig:true, sell:false` — the fallback survives).

**THE GATES (ledger #5) — each with its subject named and touched:**

| gate | verdict + numbers |
|---|---|
| (a) save/load determinism | scripted session buy 2 · sell 1 · sleep 2× (via **B's real SLEEP button**) → day 3 · $177 · 1 item → export → FRESH browser → import: state **byte-equal** (243 B) + savedAt-normalized export **byte-equal** (269 B) · plan fp **unchanged** `0xb1c7843e` across export→import (the delta law's falsifiable form) · weekNight re-keyed to 2 == (3−1)%7 · 0 errors both contexts |
| (b) no-pump v0 | 5 real round trips (dig UI pull+BUY → counter card SELL-all): **5/5 strictly negative, deltas [−6,−6,−6,−6,−6], Σ −$30** — identical deltas are the deterministic re-seeded crate, not a stuck instrument (the controls prove discrimination) |
| (b′) C's negative control | broke player ($0 via import): dig BUY **disabled**, clicked anyway — zero debit, zero entry · shelf path: `wallet.buy` **INVOKED once (counted, not mocked), returned false, recordFind unreachable** — no entry, cash still $0 · positive arm: same aim with cash → debit $14 == entry.pricePaid, 1 entry — **C's pump is dead, and the control can tell** |
| (c) classic purity | Storage **prototype** instrumented before any page script: `?classic=1` AND `?game=0` → **0 calls**, game null, **0 of B's 7 game DOM ids** · POSITIVE control: default boot → instrument saw the `procity-save` getItem + all 7 ids present (a zero nobody proved the instrument could see would be vacuous) · plan fp game-on **==** game-off `0xb1c7843e` (the layer moves zero plan bytes; classic's own fp differs by design — its golden is classic_regression's) |
| (d) rotation determinism | **VERTEX-DATA fp (position+uv arrays), per the wave-3 binding** — transforms measured vacuous in §30.5: day 1 `0x50edd91b` (**88,320 bytes / 20 stock meshes** — subject present, printed) · re-entry byte-identical · day 2 `0x2121f187` ≠ day 1, re-entry identical · day 3 `0x2f4a9b93` ≠ both · **cross-boot: day-3 fp byte-identical after a full reboot** off the persisted save · `?game=0` fp **== day-1 fp** (the pre-v7 town IS day 1, measured again from the suite) |
| (e) the suite | all five wired **STRICT** into flags_check (FAIL-level, house pattern) · `qa.sh --strict --matrix` full run: see §30.6 numbers below |

**Harness bug #3 of the round (recorded per house habit):** the routing gate first read B's HUD
*inside* the shop and called it stale — but the HUD is **hidden and unrefreshed in interior mode by
design** (`hud.setVisible(m === 'street')`; `gameUI.refresh()` rides the street loop). The gate now
walks back onto the street and reads it where a player could — $186 · CRATE 0, correct. Same species
as §30.5's closed-door: a verify that forgets the world's rules reads the rules as bugs.

**Design fact, filed not fixed (alpha-acceptable, for the beta ledger):** parody/mint dig stock has no
`gone` tracking — the same $11 sleeve is back in the bin on re-entry (the crate is a seeded stream, not
an inventory). Buying it again is possible **and loses money every time** (the −$6/trip measurement is
exactly this); scarcity-per-day would need the save to carry per-day pull records. The no-pump clamp is
what makes the infinite crate safe. Rule it in beta with the guide bands, not here.

---

## 31. Round 31 — the v7.0-alpha CLOSE: THE DIG FLIP (wave 1) + THE TAG (wave 2)

### §31.1 The alpha-blocker (Fable's wave-0 playtest) and the flip

**The dig was default-OFF on a plain boot.** `web/index.html` still carried the v2-era opt-in
(`const DIG_ON = params.has('dig') && params.get('dig') !== '0'`) six epochs after the README's
flags table began claiming "dig on" — and every R30 game-loop gate booted `dig=1` EXPLICITLY, so
the whole suite was green while the boot every player gets had no crate-riffle at all: E at a bin
did nothing. The gates tested the game; nobody tested that the default boot IS the game.

**The flip (one line + the law):** `DIG_ON = flagOn('dig')` — default-ON, `?dig=0` opts out,
`?classic=1` master-off: the exact pattern the other flipped flags ride. `dig` joins the
`PROCITY.flags` intent surface (the gates read intent there). Measured both ways in fresh
contexts on a port-isolated server (:8951):

| boot | measured |
|---|---|
| NAKED (no params) | E at a bin → riffle **OPENED** + closed clean · `flags.dig` true · 0 errors |
| `?dig=0` | opt-out honoured — riffle does NOT open, **ZERO** dig DOM |
| `?classic=1` | dig INERT at the bin (E falls through `trySell` (null game) + shelf no-op) · ZERO `pcdg-*` DOM · **ZERO Storage-prototype calls** (instrumented) · 0 errors — the covenant untouched |
| `?noassets=1` naked | dig opens on **parody canvas** · 0 errors (existing law holds) |

*(Observation filed, pre-existing, NOT touched: `assets/gen/*.jpg` skin textures fetch under
`?noassets` — 22 fetches, fail-soft, present since v1; the dig added zero fetches to that boot.)*

### §31.2 The gate that makes the regression impossible (vacuous-gate law, turned on F's own suite)

Two new STRICT legs in `tools/flags_check.py`:

- **default_boot_gate** grows **dig REACHABILITY on the NAKED boot**: enter a record shop, E at an
  aimed bin, `digActive` must go true (and close clean via WALK OUT); plus a `PROCITY.flags.dig`
  intent assert. Un-flip the default again and this line goes red. Negative control: the identical
  measurement on a `?dig=0` boot reads `opened:false` (pre-flight, :8951) — the detector
  discriminates.
- **classic_regression** grows the **dig-INERT leg**: the old `digActive` assert was vacuously
  false on the street; it is now measured AT THE BIN — E opens nothing, zero dig DOM, filed as
  "measured, not assumed".

**Harness lesson #4 of the epoch (house habit): the explicit-flag blindfold.** A gate that
force-feeds its subject's flag (`dig=1` in every boot query, belt-and-braces) can never notice the
default is broken. Where a flag is CLAIMED default-on, at least one gate must exercise it with the
flag ABSENT. Now true for dig; gigs/weather/winmap/tram always had it (the default-boot gate boots
naked by construction).

### §31.3 Port isolation (small, suite-wide)

`PROCITY_QA_PORT` env override added to `flags_check.py`, `qa/interior_scale_check.py`,
`qa/town_matrix.py`. `ensure_server()` silently REUSES anything parked on :8130 — this round that
was Fable's own preview server, and a shared server is somebody else's cache semantics + somebody
else's lifecycle. The R31 re-gate rode `:8931`; default behaviour unchanged.

### §31.4 The splash (same file, same commit)

"Every door opens **(soon)**" — stale by six epochs — is gone: the tagline now sells the loop
("Every door opens. Dig the crates, sell the flips, sleep — the town remembers.") and the controls
line carries the game beats (E riffle a bin / sell at the counter · C your crate · SLEEP to save).
README manual gains the matching row (sell at the counter · C crate · SLEEP = save/advance/rotate).

### §31.5 The re-gate, the shot, the tag — RESULTS

All on the FINAL tree (commit `50385c0`), suite port-isolated on `:8931` (`PROCITY_QA_PORT` —
Fable's preview holds :8130, untouched):

- **`qa.sh --strict --matrix`: 7 passed · 0 failed · 0 warn · 0 skipped.** flags_check **0 fails /
  0 warns** — both new R31 legs green in the run (`dig REACHABLE on the naked boot — E at a bin
  opened the riffle (and closed clean)` · `?classic dig INERT at the bin — E opened nothing, zero
  dig DOM`), all five R30 STRICT gates re-proven over the flipped tree, classic covenant fingerprint
  green, no-giants green. **MATRIX GREEN — 10 towns (synthetic + fixtures + real caches) × 7 gates.**
- **The money shot: `docs/shots/v7_alpha/crate_panel.png`** — Monster Robot Party's real frontage
  (redhill_godverse, `stock=real`), THE CRATE open with **3 real finds** (The Return $40 ·
  First Filtration Of The Duplex Brains $15 · Blue Blackness $20 — real cover thumbs off the
  per-shop atlas, every row honest: `paid $N · Monster Robot Party · day 1`), game bar
  **day 1 · $116 · CRATE 3 · SLEEP**. Driven through the REAL loop with the dig param ABSENT (the
  flip carries the shot): enter → E at three different bins → riffle → pull → BUY ×3 → street →
  C. 0 console errors. Script: session scratchpad (`crate_shot.py`) — the PNG is the deliverable.
- **The tag: `v7.0-alpha`**, annotated, **LOCAL ONLY** on the notes commit — Fable reviews and
  pushes main + tag together (treaty).

### §31.6 THE BETA QUEUE (Fable's playtest, filed NOT fixed — John's ruling queue)

1. **Spawn faces dirt/building-backs** instead of the strip — wants a cluster-pose for spawns.
2. **THE CRATE is unreachable inside shops** — C is street-only by design (hud.js); a player wants
   it at the counter.
3. **Dawn sky reads dusk-orange** (cosmetic).
4. The pull card's **value hint is THE BIBLE** (chartered — the beta's guide bands).
5. Automation-only, unverified in person: **dig Esc-close under synthetic events**.
6. *(carried from §30.6)* no per-day `gone` tracking on parody/mint dig stock — scarcity-per-day
   needs the save to carry pull records; rule it with the guide bands.

## §32 — R32: v7.0-beta wave 1 — THE BIBLE + scarcity + the §31.6 queue (Fable, solo round, JING5)

**The round in one line:** the guide bands land (derived, not baked), gems exist (parody bins only,
by construction), a bought slot stays gone for the day (pulls ride the save), and §31.6 items 1–3
are fixed. All gates green; the no-pump law survives the §9.1 basis swap structurally.

### §32.1 What shipped, by seam

- **`js/interiors/bible.js`** (C) — the band table mirroring E's pipeline thresholds
  (record 8/25/60 · book 5/15/40 · toy 6/20/50), `bandRange`/`guideText`/`sellBasis`. Derivation
  ruling: NO pack re-emit (charter risk #3 never opens); if E's thresholds move, bible.js moves in
  the same commit.
- **dig.js** (C) — parody sleeves roll seeded bands (25/45/22/8%) + a 10% gem on collector/grail
  (asking strictly under the keeper's own bandLow offer: collector $2–9 vs $12 · grail $5–20 vs
  $30); fixed 9-draw stream shape per item; `rare` now ≡ grail (matches real packs). Real offers
  carry `band` off `price_band`. `open({gone})` omits pulled slots AFTER the draw (the R27
  pick-then-omit seam, zero collateral) — real via `'sku:<id>'`, parody via original offer index
  (`o.i` survives filtering, identity preserved). The pull card + sell card gain the **guide
  stamp** (`guide $8–24` / `$60+`) — present-fields-only, and the card NEVER says "gem": spotting
  asking-under-guide is the player's skill.
- **sell.js** (C) — §9.1 basis swap executed exactly as pre-ratified: `sellOffer(sellBasis(entry))`
  = `min(bandLow−1, max(1, floor(bandLow·0.5)))` when banded, pricePaid basis for alpha-era
  entries (they sell exactly as before — no migration needed).
- **save.js** (F) — optional `pulls: string[]` on procity-save/1 (validated loudly when present;
  absent on alpha saves — old savers drop it silently, never reject). `recordPull`/`pullsFor`
  seams; pruned on sleep/import (day-tagged keys from other days are unreachable by construction;
  untagged = real-sourced, kept — sold means gone). Cap 600 FIFO. Collection entries gain
  optional `band` (recordFind stamps dig + shelf buys).
- **interior_mode.js** (F) — pull keys `${shopId}|${binKey}${pullTag}#${slot}`; pullTag =
  `@d<game.day>` for rotating crates (INCLUDING day 1 — the seed stays untagged per the day-1
  convention, the ledger doesn't), `''` for real-sourced. The SEED input is untouched (A's
  rotation boundary holds). `digOffers` honest surface (index/ask/band/sku) for the gate.
- **hud.js + index.html** (B/F) — §31.6-2: `#pc-game` rides document.body (position:fixed, z 30),
  ticks in every mode (`hud.tickGame()` from the interior/map branches), yields to the dig/sell
  cards and the map; C toggles the crate anywhere. §31.6-1: cluster-pose spawn — main-street
  shop doors (block kind, both generators), stand at the door nearest the cluster heart, face the
  longer run of shopfronts; pure plan math, zero draws; `?classic=1` keeps the frozen pose.
  §31.6-3: DAWN swaps the dome to `high-cirrus` (lighting `dawnSky` opt, null under classic);
  a weather `setSky` is now an explicit override that always wins.

### §32.2 THE GATE (`smoke_bible`, STRICT) + the R30 amendment

Scans EVERY bin of the record shop off `digOffers`: band law on all offers (in-band unless a
collector/grail gem), then runs the buy-EVERYTHING ledger on **the gem's bin** (leg is
non-vacuous by construction — 80 offers/5 bins, bin1 holds 2 gems on the pinned seed, grail
asking $19 vs keeper $30). Ledger closes exactly: Σask $333 → Σoffer $135 (gems alone +$21,
every non-gem strictly negative). Scarcity: the emptied bin re-opens at 0, STAYS 0 across a full
reload (16 pulls in the save); negative control: `?game=0` re-opens it at 16 — the detector
discriminates. 0 console errors. **R30 amendment (sell_routing):** `credited < paid` was the
alpha inequality; the gate now asserts the exact formula (`credited == min(basis−1, basis//2)`,
basis = bandLow-or-pricePaid, `credited < basis`) — the fence moved from the receipt to the
band, which is what charter law #2 always said.

### §32.3 Environment note (JING5)

`web/assets/models/` is GITIGNORED build output — a fresh checkout runs stock=real/book-toy/
no-pump gates RED with 404s (the R31-green tree lives on m3ultra). Fixed here by rsync from
m3ultra. If a third machine joins the rotation, sync that dir (49 M) or re-run E's pipeline.

## §33 — R33: v7.0-beta wave 2 — THE HUNT (wantlist · rumor · travel) (Fable, solo, JING5)

- **save.js:** optional `wants: [{artist?|title?|sku?}]` on procity-save/1 (validated
  exact-and-loud when present; ≥1 string field per entry; cap 40; absent-when-empty keeps the
  alpha byte shape). `recordWant` (case-insensitive dedupe) / `findWant` (a want covers an item
  when every field the WANT names matches — sku exact, artist/title by value) / `removeWant`
  (identity). **TRAVEL in `adopt()`:** adopted save's `town !== townKey` ⇒ `day += 1`,
  `traveled = true`, prunePulls — load AND import both pay the fare; same-town adoption free
  (save-determinism byte-equality untouched). `game.traveled` getter → the shell's arrival toast.
- **dig.js:** the pull card's ☆ WANT line — construction-gated on `opts.onWant` (game absent ⇒
  zero want DOM, the classic-pure pattern). ☆ click → ★ ON THE WANTLIST (a stamp, not a button,
  once wanted).
- **interior_mode.js:** onWant/isWanted seams into dig.open; buy of a matching item removes the
  want (+ '✓ off the wantlist' toast). **THE RUMOR** in the enter() banner: seeded
  `xmur3('rumor:<citySeed>:<shopId>:<day>')` → 45% roll → hunted want + a town from
  RUMOR_TOWNS (the repo's real cached towns, current town excluded). Runtime-only stream —
  A's boundary holds; no game / empty wants ⇒ the line never exists.
- **hud.js:** THE WANTLIST section in the crate panel (non-empty only): artist/title rows, ✕
  stops hunting; refresh watches wants length so an open panel follows adds/clears.
- **Gate:** `smoke_wantlist_travel` STRICT (see ROUND33_INSTRUCTIONS for the green run) — real
  card path, seeded rumor scan, auto-clear, +1-day travel with same-town negative control and
  the return fare, `?game=0` zero-DOM control, 0 console errors.
- **Matrix note:** town_matrix shares one browser across towns, so travel drifts the day as it
  walks the matrix — safe because determinism double-boots the SAME town (free by the
  same-town rule) and no matrix gate reads absolute day. Reasoned before landing, not after.
- **The shot found what the gate didn't (harness lesson #5 candidate):** R32's crate-in-shops
  surface BUILT only in street update() frames — a door entered fast after boot had no game
  surface inside at all, and the interior tickGame() happily refreshed a UI that never existed.
  Green gates missed it because every gate's boot idles on the street long enough to build.
  Fixed: tickGame() now builds AND refreshes (any mode); found by taking the money shot, which
  entered the shop faster than any gate does. Shots are a detector, not decoration.