01
Trust boundary
Players trust the world because actions are persisted in the game ledger; collectors trust Seed ownership because it is ERC-721; engineers trust the system because economic epochs can be replayed and anchored.
- Gameplay mutation remains in USK/Postgres unless explicitly settled.
- On-chain state is used for ownership, receipts, governance execution, or proof.
- Public copy must describe the boundary honestly, including what is not decentralized yet.
02
Contract surfaces
Primary surfaces: `SeedNFT`, `SEEDOS`, `WardenseedAnchor`, `SeedMarketplace`, `TreasuryRouter`.
- Every surface should emit enough events for analytics and incident reconstruction.
- Privileged functions should be role-gated, timelocked, or emergency-scoped depending on blast radius.
- Batch, nonce, and root identifiers must remain replay-resistant across upgrades.
03
Operational assumptions
Assumption: Wardenseed remains a hybrid economy. The chain verifies and settles; it does not run the ecological tick loop.
- Failure modes must degrade visibly rather than pretending the world is healthy.
- Security posture takes priority over feature velocity when settlement or treasury risk is involved.
- Docs, tests, and live proof widgets should evolve together with contract changes.