01
Trust boundary
Trust boundary: users can inspect the settlement footprint and batch root, but the economic policy remains constrained by caps and circuit state before it reaches `mintBatch`.
- Gameplay mutation remains in USK/Postgres unless explicitly settled.
- On-chain state is used for ownership, receipts, governance execution, or proof.
- Public copy must describe the boundary honestly, including what is not decentralized yet.
02
Contract surfaces
Contract surfaces: `SEEDOS.mintBatch`, `SEEDOS.mintBatchV2`, `SEEDOS.maxSupply`, staking funding, LP burn band, marketplace royalties.
- Every surface should emit enough events for analytics and incident reconstruction.
- Privileged functions should be role-gated, timelocked, or emergency-scoped depending on blast radius.
- Batch, nonce, and root identifiers must remain replay-resistant across upgrades.
03
Operational assumptions
Operational assumption: the project should never depend on SEEDOS price speculation as its core loop; utility, sinks, identity, and world progression must carry demand.
- Failure modes must degrade visibly rather than pretending the world is healthy.
- Security posture takes priority over feature velocity when settlement or treasury risk is involved.
- Docs, tests, and live proof widgets should evolve together with contract changes.