01
Trust boundary
Trust boundary: GEO may slow or freeze settlement surfaces, but it does not rewrite historical gameplay events or mutate raw USK anchor inputs.
- Gameplay mutation remains in USK/Postgres unless explicitly settled.
- On-chain state is used for ownership, receipts, governance execution, or proof.
- Public copy must describe the boundary honestly, including what is not decentralized yet.
02
Contract surfaces
Contract surfaces influenced by GEO: Seed pressure updates, SEEDOS emission caps, LP burn bands, settlement worker allow/deny decisions.
- Every surface should emit enough events for analytics and incident reconstruction.
- Privileged functions should be role-gated, timelocked, or emergency-scoped depending on blast radius.
- Batch, nonce, and root identifiers must remain replay-resistant across upgrades.
03
Operational assumptions
Operational assumption: users should see degraded, frozen, or recovery states clearly instead of discovering them through failed transactions.
- Failure modes must degrade visibly rather than pretending the world is healthy.
- Security posture takes priority over feature velocity when settlement or treasury risk is involved.
- Docs, tests, and live proof widgets should evolve together with contract changes.