Seed Layer

Seeds are the collectible entry layer: capped ERC-721 assets tied to provenance, launch access, and future lineage surfaces. The Seed layer combines a fixed supply, Dutch pricing, market pressure updates, whitelist/reveal controls, royalties, and secondary liquidity. It should feel like a high-end collectible access layer, not a casino. Seeds do not replace gameplay truth; they create ownership, provenance, and future utility around the civilization.

Trust boundary

Trust boundary: Seed ownership is on-chain; gameplay progression remains in the realm ledger. Metadata and royalties must be explicit, freezeable, and auditable.

Gameplay mutation remains in USK/Postgres unless explicitly settled.
On-chain state is used for ownership, receipts, governance execution, or proof.
Public copy must describe the boundary honestly, including what is not decentralized yet.

Contract surfaces

Contract surfaces: UUPS `SeedNFT`, ERC2981 royalties, Merkle allowlist, `SeedMarketplace` signed orders, treasury royalty routing.

Every surface should emit enough events for analytics and incident reconstruction.
Privileged functions should be role-gated, timelocked, or emergency-scoped depending on blast radius.
Batch, nonce, and root identifiers must remain replay-resistant across upgrades.

Operational assumptions

Operational assumption: no fake mint pressure. Unavailable chain or funnel data must be shown as unavailable, not fabricated.

Failure modes must degrade visibly rather than pretending the world is healthy.
Security posture takes priority over feature velocity when settlement or treasury risk is involved.
Docs, tests, and live proof widgets should evolve together with contract changes.